diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index d480b8633a7b..81389bf97a8b 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -38,6 +38,8 @@
 
 - LLVM 12, 13, 14, 15, 16, and 17 have been removed, as they have reached end‐of‐life upstream and are no longer supported.
 
+- The `vlock` output from kbd has been removed. Instead a new package `kbdVlock` has been introduced. Use this package now instead of the output.
+
 - GHCJS 8.10, exposed via `haskell.compiler.ghcjs` and `haskell.compiler.ghcjs810`, has been removed. Downstream users should migrate their projects to the new JavaScript backend of GHC proper which can be used via `pkgsCross.ghcjs` from Nixpkgs. Haskell packaging code, like `haskellPackages.mkDerivation`, `ghcWithPackages` and `hoogleWithPackages`, also no longer supports GHCJS.
 
 - GHC 8.6, 8.10, 9.0, 9.2, and their package sets have been removed.
@@ -240,6 +242,12 @@
 
 - `mariadb` now defaults to `mariadb_114` instead of `mariadb_1011`, meaning the default version was upgraded from 10.11.x to 11.4.x. See the [upgrade notes](https://mariadb.com/kb/en/upgrading-from-mariadb-10-11-to-mariadb-11-4/) for potential issues.
 
+- `qt5.full` and `qt6.full` aliases have been removed. Their use has always been discouraged, and downstream projects should use `qtN.env` with the right set of packages.
+
+- `python3Packages.duckduckgo-search` has been updated to v9+ and therefore has been renamed to ddgs.
+  Use `python3Packages.ddgs` instead.
+  See [release note for v9.0.0](https://github.com/deedy5/ddgs/releases/tag/v9.0.0)
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/lib/licenses.nix b/lib/licenses.nix
index d6e232482534..9e2edd69836a 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -172,6 +172,11 @@ lib.mapAttrs mkLicense (
       fullName = "Baekmuk License";
     };
 
+    bitstreamCharter = {
+      spdxId = "Bitstream-Charter";
+      fullName = "Bitstream Charter Font License";
+    };
+
     bitstreamVera = {
       spdxId = "Bitstream-Vera";
       fullName = "Bitstream Vera Font License";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 9708249e5fdb..7b064b84501b 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -309,6 +309,7 @@ with lib.maintainers;
       xanderio
       blitz
       snu
+      e1mo
     ];
     scope = "Team for Cyberus Technology employees who collectively maintain packages.";
     shortName = "Cyberus Technology employees";
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index fd3c4e485d09..fd3c1b10d81b 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -871,6 +871,7 @@ in
         render.gid = ids.gids.render;
         sgx.gid = ids.gids.sgx;
         shadow.gid = ids.gids.shadow;
+        clock.gid = ids.gids.clock;
       };
 
       system.activationScripts.users =
@@ -1033,6 +1034,7 @@ in
           cdrom = { };
           tape = { };
           kvm = { };
+          clock = { };
         };
       };
 
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 949531d9a83c..b3cf6a063356 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -690,6 +690,7 @@ in
       rstudio-server = 324;
       localtimed = 325;
       automatic-timezoned = 326;
+      clock = 327;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/programs/ssh.nix b/nixos/modules/programs/ssh.nix
index 63d2bd865758..443878715bc0 100644
--- a/nixos/modules/programs/ssh.nix
+++ b/nixos/modules/programs/ssh.nix
@@ -339,37 +339,37 @@ in
 
     # SSH configuration. Slight duplication of the sshd_config
     # generation in the sshd service.
-    environment.etc."ssh/ssh_config".text = ''
+    environment.etc."ssh/ssh_config".text = lib.concatStringsSep "\n" (
       # Custom options from `extraConfig`, to override generated options
-      ${cfg.extraConfig}
-
-      # Generated options from other settings
-      Host *
-      ${lib.optionalString cfg.systemd-ssh-proxy.enable ''
+      lib.optional (cfg.extraConfig != "") cfg.extraConfig
+      ++ [
+        ''
+          # Generated options from other settings
+          Host *
+        ''
+      ]
+      ++ lib.optional cfg.systemd-ssh-proxy.enable ''
         # See systemd-ssh-proxy(1)
         Include ${config.systemd.package}/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf
-      ''}
-
-      GlobalKnownHostsFile ${builtins.concatStringsSep " " knownHostsFiles}
-
-      ${lib.optionalString (!config.networking.enableIPv6) "AddressFamily inet"}
-      ${lib.optionalString cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"}
-      ${lib.optionalString (cfg.forwardX11 != null)
-        "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"
-      }
-
-      ${lib.optionalString (
+      ''
+      ++ [
+        "GlobalKnownHostsFile ${builtins.concatStringsSep " " knownHostsFiles}"
+      ]
+      ++ lib.optional (!config.networking.enableIPv6) "AddressFamily inet"
+      ++ lib.optional cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"
+      ++ lib.optional (cfg.forwardX11 != null) "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"
+      ++ lib.optional (
         cfg.pubkeyAcceptedKeyTypes != [ ]
-      ) "PubkeyAcceptedKeyTypes ${builtins.concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"}
-      ${lib.optionalString (
+      ) "PubkeyAcceptedKeyTypes ${builtins.concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"
+      ++ lib.optional (
         cfg.hostKeyAlgorithms != [ ]
-      ) "HostKeyAlgorithms ${builtins.concatStringsSep "," cfg.hostKeyAlgorithms}"}
-      ${lib.optionalString (
+      ) "HostKeyAlgorithms ${builtins.concatStringsSep "," cfg.hostKeyAlgorithms}"
+      ++ lib.optional (
         cfg.kexAlgorithms != null
-      ) "KexAlgorithms ${builtins.concatStringsSep "," cfg.kexAlgorithms}"}
-      ${lib.optionalString (cfg.ciphers != null) "Ciphers ${builtins.concatStringsSep "," cfg.ciphers}"}
-      ${lib.optionalString (cfg.macs != null) "MACs ${builtins.concatStringsSep "," cfg.macs}"}
-    '';
+      ) "KexAlgorithms ${builtins.concatStringsSep "," cfg.kexAlgorithms}"
+      ++ lib.optional (cfg.ciphers != null) "Ciphers ${builtins.concatStringsSep "," cfg.ciphers}"
+      ++ lib.optional (cfg.macs != null) "MACs ${builtins.concatStringsSep "," cfg.macs}"
+    );
 
     environment.etc."ssh/ssh_known_hosts".text = knownHostsText;
 
diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix
index fea0428f36d1..4dcfecd7746d 100644
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@@ -91,6 +91,7 @@ in
           kio-admin # managing files as admin
           kio-extras # stuff for MTP, AFC, etc
           kio-fuse # fuse interface for KIO
+          knighttime # night mode switching daemon
           kpackage # provides kpackagetool tool
           kservice # provides kbuildsycoca6 tool
           kunifiedpush # provides a background service and a KCM
@@ -166,7 +167,6 @@ in
           spectacle
           ffmpegthumbs
           krdp
-          xwaylandvideobridge # exposes Wayland windows to X11 screen capture
         ]
         ++ lib.optionals config.hardware.sensor.iio.enable [
           # This is required for autorotation in Plasma 6
@@ -267,6 +267,7 @@ in
     services.udisks2.enable = true;
     services.upower.enable = config.powerManagement.enable;
     services.libinput.enable = mkDefault true;
+    services.geoclue2.enable = mkDefault true;
 
     # Extra UDEV rules used by Solid
     services.udev.packages = [
diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index ca9464d091c1..2a76e1a8b26f 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -156,7 +156,7 @@ let
 
         # Verify all the udev rules
         echo "Verifying udev rules using udevadm verify..."
-        udevadm verify --resolve-names=never --no-style $out
+        udevadm verify --resolve-names=late --no-style $out
         echo "OK"
 
         # If auto-configuration is disabled, then remove
@@ -179,7 +179,8 @@ let
         for i in $packages; do
           echo "Adding hwdb files for package $i"
           for j in $i/{etc,lib}/udev/hwdb.d/*; do
-            ln -s $j etc/udev/hwdb.d/$(basename $j)
+            # This must be a copy, not a symlink, because --root below will chase links within the root argument.
+            cp $j etc/udev/hwdb.d/$(basename $j)
           done
         done
 
@@ -461,6 +462,7 @@ in
       "${config.boot.initrd.systemd.package}/lib/systemd/systemd-udevd"
       "${config.boot.initrd.systemd.package}/lib/udev/ata_id"
       "${config.boot.initrd.systemd.package}/lib/udev/cdrom_id"
+      "${config.boot.initrd.systemd.package}/lib/udev/dmi_memory_id"
       "${config.boot.initrd.systemd.package}/lib/udev/scsi_id"
       "${config.boot.initrd.systemd.package}/lib/udev/rules.d"
     ]
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 9715c8645dc3..bdfc53c83767 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -1243,7 +1243,7 @@ in
       "services.postfix.relayPort was removed in favor of services.postfix.settings.main.relayhost, which now takes a list of host:port."
     )
     (lib.mkRemovedOptionModule [ "services" "postfix" "extraConfig" ]
-      "services.postfix.extraConfig was replaced by the structured freeform service.postfix.settings.main option."
+      "services.postfix.extraConfig was replaced by the structured freeform services.postfix.settings.main option."
     )
     (lib.mkRenamedOptionModule
       [ "services" "postfix" "networks" ]
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 10faf3e9d6f7..c56193cb4f83 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -21,7 +21,6 @@ let
     let
       # reports boolean as yes / no
       mkValueString =
-
         v:
         if lib.isInt v then
           toString v
@@ -456,7 +455,7 @@ in
                 default = "none"; # upstream default
                 description = ''
                   Specifies a file that lists principal names that are accepted for certificate authentication. The default
-                  is `"none"`, i.e. not to use	a principals file.
+                  is `"none"`, i.e. not to use a principals file.
                 '';
               };
               LogLevel = lib.mkOption {
@@ -825,37 +824,29 @@ in
       authPrincipalsFiles != { }
     ) "/etc/ssh/authorized_principals.d/%u";
 
-    services.openssh.extraConfig = lib.mkOrder 0 ''
-      Banner ${if cfg.banner == null then "none" else pkgs.writeText "ssh_banner" cfg.banner}
-
-      AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
-      ${lib.concatMapStrings (port: ''
-        Port ${toString port}
-      '') cfg.ports}
-
-      ${lib.concatMapStrings (
-        { port, addr, ... }:
+    services.openssh.extraConfig = lib.mkOrder 0 (
+      lib.concatStringsSep "\n" (
+        [
+          "Banner ${if cfg.banner == null then "none" else pkgs.writeText "ssh_banner" cfg.banner}"
+          "AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}"
+        ]
+        ++ lib.map (port: ''Port ${toString port}'') cfg.ports
+        ++ lib.map (
+          { port, addr, ... }:
+          ''ListenAddress ${addr}${lib.optionalString (port != null) (":" + toString port)}''
+        ) cfg.listenAddresses
+        ++ lib.optional cfgc.setXAuthLocation "XAuthLocation ${lib.getExe pkgs.xorg.xauth}"
+        ++ lib.optional cfg.allowSFTP ''Subsystem sftp ${cfg.sftpServerExecutable} ${lib.concatStringsSep " " cfg.sftpFlags}''
+        ++ [
+          "AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}"
+        ]
+        ++ lib.optional (cfg.authorizedKeysCommand != "none") ''
+          AuthorizedKeysCommand ${cfg.authorizedKeysCommand}
+          AuthorizedKeysCommandUser ${cfg.authorizedKeysCommandUser}
         ''
-          ListenAddress ${addr}${lib.optionalString (port != null) (":" + toString port)}
-        ''
-      ) cfg.listenAddresses}
-
-      ${lib.optionalString cfgc.setXAuthLocation ''
-        XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
-      ''}
-      ${lib.optionalString cfg.allowSFTP ''
-        Subsystem sftp ${cfg.sftpServerExecutable} ${lib.concatStringsSep " " cfg.sftpFlags}
-      ''}
-      AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}
-      ${lib.optionalString (cfg.authorizedKeysCommand != "none") ''
-        AuthorizedKeysCommand ${cfg.authorizedKeysCommand}
-        AuthorizedKeysCommandUser ${cfg.authorizedKeysCommandUser}
-      ''}
-
-      ${lib.flip lib.concatMapStrings cfg.hostKeys (k: ''
-        HostKey ${k.path}
-      '')}
-    '';
+        ++ lib.map (k: "HostKey ${k.path}") cfg.hostKeys
+      )
+    );
 
     system.checks = [
       (pkgs.runCommand "check-sshd-config"
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 9bb6f30e41db..fdc2164f0f9d 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -177,7 +177,7 @@ let
     {
       postInstall = ''
         alias='cursor -xfree86-cursor-medium-r-normal--0-${sizeString}-0-0-p-0-adobe-fontspecific'
-        echo "$alias" > $out/lib/X11/fonts/Type1/fonts.alias
+        echo "$alias" > $out/share/fonts/X11/Type1/fonts.alias
       '';
     }
   );
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index f2b1b4fc7ede..04c814b7ec6e 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -568,9 +568,6 @@ in
         "${cfg.package.util-linux}/bin/umount"
         "${cfg.package.util-linux}/bin/sulogin"
 
-        # so NSS can look up usernames
-        "${pkgs.glibc}/lib/libnss_files.so.2"
-
         # Resolving sysroot symlinks without code exec
         "${config.system.nixos-init.package}/bin/chroot-realpath"
         # Find the etc paths
@@ -586,7 +583,8 @@ in
         "${pkgs.bashNonInteractive}/bin"
       ]
       ++ jobScripts
-      ++ map (c: builtins.removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents);
+      ++ map (c: builtins.removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents)
+      ++ lib.optional (pkgs.stdenv.hostPlatform.libc == "glibc") "${pkgs.glibc}/lib/libnss_files.so.2";
 
       targets.initrd.aliases = [ "default.target" ];
       units =
diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index 4d2ca7f11f21..279da8f47c0b 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -79,8 +79,11 @@ in
     };
 
     services.journald.audit = lib.mkOption {
-      default = null;
-      type = lib.types.nullOr lib.types.bool;
+      default = "keep";
+      type = lib.types.oneOf [
+        lib.types.bool
+        (lib.types.enum [ "keep" ])
+      ];
       description = ''
         If enabled systemd-journald will turn on auditing on start-up.
         If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged.
diff --git a/nixos/modules/system/boot/systemd/oomd.nix b/nixos/modules/system/boot/systemd/oomd.nix
index 82a87f00e97b..90c786ec5c22 100644
--- a/nixos/modules/system/boot/systemd/oomd.nix
+++ b/nixos/modules/system/boot/systemd/oomd.nix
@@ -50,10 +50,6 @@ in
       "systemd-oomd.socket"
     ];
 
-    systemd.services.systemd-oomd.after = [
-      "swap.target" # TODO: drop after systemd v258
-      "systemd-sysusers.service" # TODO: drop after systemd v257.8
-    ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 
     environment.etc."systemd/oomd.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings;
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index f911c43b0a68..d9df8f820ee7 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -1451,9 +1451,9 @@ in
           "cat /proc/partitions >&2",
           "udevadm control --stop-exec-queue",
           "mdadm --create --force /dev/md0 --metadata 1.2 --level=raid1 "
-          + "--raid-devices=2 /dev/vda5 /dev/vda6",
+          + "--raid-devices=2 --bitmap=internal /dev/vda5 /dev/vda6",
           "mdadm --create --force /dev/md1 --metadata 1.2 --level=raid1 "
-          + "--raid-devices=2 /dev/vda7 /dev/vda8",
+          + "--raid-devices=2 --bitmap=internal /dev/vda7 /dev/vda8",
           "udevadm control --start-exec-queue",
           "udevadm settle",
           "mkswap -f /dev/md1 -L swap",
diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix
index bd0d3b7bc005..ab80b8aaabf0 100644
--- a/nixos/tests/login.nix
+++ b/nixos/tests/login.nix
@@ -48,12 +48,13 @@
         machine.wait_for_file("/home/alice/done")
 
     with subtest("Systemd gives and removes device ownership as needed"):
-        machine.succeed("getfacl /dev/snd/timer | grep -q alice")
+        # Change back to /dev/snd/timer after systemd-258.1
+        machine.succeed("getfacl /dev/dri/card0 | grep -q alice")
         machine.send_key("alt-f1")
         machine.wait_until_succeeds("[ $(fgconsole) = 1 ]")
-        machine.fail("getfacl /dev/snd/timer | grep -q alice")
+        machine.fail("getfacl /dev/dri/card0 | grep -q alice")
         machine.succeed("chvt 2")
-        machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice")
+        machine.wait_until_succeeds("getfacl /dev/dri/card0 | grep -q alice")
 
     with subtest("Virtual console logout"):
         machine.send_chars("exit\n")
diff --git a/nixos/tests/systemd-initrd-luks-tpm2.nix b/nixos/tests/systemd-initrd-luks-tpm2.nix
index 20e203b0e86b..6cc42bbbda73 100644
--- a/nixos/tests/systemd-initrd-luks-tpm2.nix
+++ b/nixos/tests/systemd-initrd-luks-tpm2.nix
@@ -11,6 +11,7 @@
         useBootLoader = true;
         # Booting off the TPM2-encrypted device requires an available init script
         mountHostNixStore = true;
+        efi.OVMF = pkgs.OVMFFull; # this really should be the default. Only OVMFFull contains TCG
         useEFIBoot = true;
         tpm.enable = true;
       };
diff --git a/nixos/tests/systemd-initrd-swraid.nix b/nixos/tests/systemd-initrd-swraid.nix
index 933b2ad41056..1a504a4ae4e0 100644
--- a/nixos/tests/systemd-initrd-swraid.nix
+++ b/nixos/tests/systemd-initrd-swraid.nix
@@ -48,7 +48,7 @@
 
   testScript = ''
     # Create RAID
-    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90")
+    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90 --bitmap=internal")
     machine.succeed("mkfs.ext4 -L testraid /dev/md0")
     machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
 
diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index cc6975588ff6..8238bcea3f3a 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -166,7 +166,7 @@ in
     machine.succeed("ping -n -c 1 ${containerName}");
 
     # Test systemd-nspawn uses a user namespace
-    machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
+    machine.succeed("test $(machinectl status ${containerName} | grep 'ID Shift: ' | wc -l) = 1")
 
     # Test systemd-nspawn reboot
     machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index fbece2a73dfc..f0bbdef76c61 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -244,7 +244,7 @@
           assert "0B read, 0B written" not in output
 
       with subtest("systemd per-unit accounting works"):
-          assert "IP traffic received: 84B sent: 84B" in output_ping
+          assert "IP Traffic: received 84B, sent 84B" in output_ping
 
       with subtest("systemd environment is properly set"):
           machine.systemctl("daemon-reexec")  # Rewrites /proc/1/environ
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 8403a57e5fb5..20175c813f8a 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.2";
+  version = "1.33.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-LFT6u/ppbc6PmxN8jvekKaBh+P5jPNfQpRGAmFXywhk=";
+    hash = "sha256-agxkct0VbiE8IGj0ARXru3OXjC2HPma64qJQ4tIZjSY=";
   };
 
   outputs = [
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 11875eaac7e1..de4362946baa 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1765";
+  version = "9.1.1833";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-bL6mqnke0uE0Bk7oYjJPiPtl/9Qk8fvCXrQVqAb7pPM=";
+    hash = "sha256-bcHTwrJt7ERsIYydCj+Um4AY7sREtkdkqlEA0OdgnuM=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 4cb9c1bc531e..69ea179c954b 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.0.22";
-    hash = "sha256-ystT5nHh0ivpFLwhHr6Uw5PyubkdY/kWm841wzIfyJ4=";
+    version = "2.0.24";
+    hash = "sha256-5lPa2xBDqdVFdwVBiGz0u8Cp/oHvUTNEzvyKy4t2qvw=";
   };
 
   meta = {
diff --git a/pkgs/applications/misc/zathura/core/default.nix b/pkgs/applications/misc/zathura/core/default.nix
index 1c25d4e55610..8ff6cef784f7 100644
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   # add support for more image formats
   env.GDK_PIXBUF_MODULE_FILE = gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
     extraLoaders = [
-      libheif.out
+      libheif.lib
       libjxl
       librsvg
       webp-pixbuf-loader
diff --git a/pkgs/applications/networking/cluster/k3s/README.md b/pkgs/applications/networking/cluster/k3s/README.md
index dcc2bffcc69e..7ad2a4be131f 100644
--- a/pkgs/applications/networking/cluster/k3s/README.md
+++ b/pkgs/applications/networking/cluster/k3s/README.md
@@ -9,6 +9,7 @@ K3s is a simplified [Kubernetes](https://wiki.nixos.org/wiki/Kubernetes) version
 ## Configuration Examples
 
 * [Nvidia GPU Passthru](docs/examples/NVIDIA.md)
+* [Intel GPU Passthru](docs/examples/INTEL.md)
 * [Storage Examples](docs/examples/STORAGE.md)
 
 ## Cluster Maintenance and Troubleshooting
diff --git a/pkgs/applications/networking/cluster/k3s/docs/examples/INTEL.md b/pkgs/applications/networking/cluster/k3s/docs/examples/INTEL.md
new file mode 100644
index 000000000000..467208b44457
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/docs/examples/INTEL.md
@@ -0,0 +1,168 @@
+# Intel GPU Support in k3s
+
+This article makes the following assumptions:
+1. `services.k3s.enable` is already set to true
+2. The Linux kernel running is modern enough to support your GPU out of the box
+3. The desired driver is `i915` -- modify as needed for other drivers
+
+> Note: at the time of writing, the author was using an Intel Arc A770 in k3s. The majority of this guide likely should work on other Kubernetes distributions, and will likely work identically for integrated graphics capabilities.
+
+### Enable the Intel driver in NixOS
+
+Add the following NixOS configuration to enable the Intel driver (necessary on headless deployments):
+
+```
+services.xserver.videoDrivers = [ "i915" ];
+```
+
+After rebuilding the configuration, reboot the host for the GPU driver to be assigned to the GPU. Use the following command to ensure the GPU is using the i915 kernel:
+
+```
+sudo lspci -k
+```
+
+i.e. the output looks like this on a host with the Intel Arc A770:
+
+```
+❯ sudo lspci -k | grep -A 3 'Arc'
+03:00.0 VGA compatible controller: Intel Corporation DG2 [Arc A770] (rev 08)
+        Subsystem: ASRock Incorporation Device 6010
+        Kernel driver in use: i915
+        Kernel modules: i915, xe
+```
+
+## Install Intel Node Feature Discovery (NFD) in k3s
+
+Intel's device plugin for kubernetes provides Node Feature Discovery (NFD). NFD allows for GPU capabilities on a node to be automatically discovered if a discrete GPU is installed and the Intel drivers have been properly assigned.
+
+> Documentation for Intel NFD installation is here for reference: [Install with NFD](https://intel.github.io/intel-device-plugins-for-kubernetes/cmd/gpu_plugin/README.html#install-with-nfd)
+
+The following commands will install NFD in the cluster (assumes `curl`, `jq` and `kubectl` are all installed/configured):
+
+```
+# Use the latest release
+export LATEST_RELEASE=$(curl -s https://api.github.com/repos/intel/intel-device-plugins-for-kubernetes/releases/latest | jq -r '.tag_name')
+
+# Use Kustomize to deploy the configuration
+kubectl apply -k "https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd?ref=$LATEST_RELEASE"
+kubectl apply -k "https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/nfd/overlays/node-feature-rules?ref=$LATEST_RELEASE"
+kubectl apply -k "https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/gpu_plugin/overlays/nfd_labeled_nodes?ref=$LATEST_RELEASE"
+```
+
+NFD should automatically apply relevant labels to your node. This can be verified with the following command:
+
+```
+kubectl get nodes -o yaml | grep gpu.intel.com | sort -u
+```
+
+Output should look similar to the following:
+
+```
+❯ kubectl get nodes -o yaml | grep gpu.intel.com | sort -u
+      gpu.intel.com/device-id.0300-56a0.count: "1"
+      gpu.intel.com/device-id.0300-56a0.present: "true"
+      gpu.intel.com/family: A_Series
+      gpu.intel.com/i915: "1"
+      gpu.intel.com/i915_monitoring: "0"
+      nfd.node.kubernetes.io/feature-labels: gpu.intel.com/device-id.0300-56a0.count,gpu.intel.com/device-id.0300-56a0.present,gpu.intel.com/family,intel.feature.node.kubernetes.io/gpu
+```
+
+> Note: `gpu.intel.com/i915: "1"` indicates only one pod can use the GPU -- see below for a fix.
+
+Now, GPU-enabled pods can be run with this configuration:
+
+```
+spec:
+  containers:
+    resources:
+      requests:
+        gpu.intel.com/i915: "1"
+      limits:
+        gpu.intel.com/i915: "1"
+```
+
+### Allowing more than one pod to use the GPU
+
+In the default configuration, only one pod can use the GPU. To enable multiple pods to use the GPU, apply the following Kustomize patch:
+
+```
+patches:
+- target:
+    kind: DaemonSet
+    name: intel-gpu-plugin
+  patch: |
+    - op: add
+      path: /spec/template/spec/containers/0/args
+      value:
+        - -shared-dev-num=10
+```
+
+Or, manually edit the `intel-gpu-plugin` DaemonSet to run with `-shared-dev-num=10` (or however many max pods can access the GPU), like so:
+
+```
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: intel-gpu-plugin
+spec:
+    spec:
+      containers:
+      - args:
+        - -shared-dev-num=10
+```
+
+Verify the number has been applied like so:
+
+```
+kubectl get nodes -o yaml | grep gpu.intel.com/i915 | sort -u
+```
+
+i.e. in this configuration, up to 10 pods can use the GPU:
+
+```
+❯ kubectl get nodes -o yaml | grep gpu.intel.com/i915 | sort -u
+    gpu.intel.com/i915: "10"
+```
+
+### Test pod
+
+This is a complete pod configuration for reference/testing:
+
+```
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: intel-gpu-test
+  namespace: default
+spec:
+  containers:
+  - name: intel-gpu-test
+    image: docker.io/ubuntu:24.04
+    command: [ "/bin/bash", "-c", "--" ]
+    args: [ "while true; do sleep 30; done;" ]
+    resources:
+      requests:
+        gpu.intel.com/i915: "1"
+      limits:
+        gpu.intel.com/i915: "1"
+```
+
+Once the pod is running, use the following command to test that the GPU is available:
+
+```
+kubectl exec -n default -it pod/intel-gpu-test -- ls /dev/dri
+```
+
+If the GPU is available, the output will look like the following:
+
+```
+❯ kubectl exec -n default -it pod/intel-gpu-test -- ls /dev/dri
+by-path  card1  renderD128
+```
+
+Delete the pod so as to not count against the GPU limit:
+
+```
+kubectl delete -n default pod/intel-gpu-test
+```
diff --git a/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh b/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
index 7fabd80eec1f..d954bb010df2 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh
@@ -29,7 +29,11 @@ npmConfigHook() {
     fi
 
     local -r cacheLockfile="$npmDeps/package-lock.json"
-    local -r srcLockfile="$PWD/package-lock.json"
+    if [[ -f npm-shrinkwrap.json ]]; then
+        local -r srcLockfile="$PWD/npm-shrinkwrap.json"
+    else
+        local -r srcLockfile="$PWD/package-lock.json"
+    fi
 
     echo "Validating consistency between $srcLockfile and $cacheLockfile"
 
diff --git a/pkgs/by-name/ab/abseil-cpp/package.nix b/pkgs/by-name/ab/abseil-cpp/package.nix
index 8fee318a4947..a264041af441 100644
--- a/pkgs/by-name/ab/abseil-cpp/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abseil-cpp";
-  version = "20250814.0";
+  version = "20250814.1";
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-cpp";
     tag = finalAttrs.version;
-    hash = "sha256-6Ro7miql9+wcArsOKTjlyDSyD91rmmPsIfO5auk9kiI=";
+    hash = "sha256-SCQDORhmJmTb0CYm15zjEa7dkwc+lpW2s1d4DsMRovI=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix b/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix
index 68704a0d4a4c..10935377cd22 100644
--- a/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/add-core-symbolication.nix
@@ -42,7 +42,6 @@ in
 self: super: {
   buildPhase = super.buildPhase or "" + ''
     mkdir -p System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
-    ln -s A System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/Current
     ln -s Versions/Current/Headers System/Library/PrivateFrameworks/CoreSymbolication.framework/Headers
     cp '${CoreSymbolication}/include/'*.h System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
   '';
diff --git a/pkgs/by-name/ap/apple-sdk/common/plists.nix b/pkgs/by-name/ap/apple-sdk/common/plists.nix
index 33bb1f134c12..70184d89429b 100644
--- a/pkgs/by-name/ap/apple-sdk/common/plists.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/plists.nix
@@ -2,15 +2,28 @@
   lib,
   stdenvNoCC,
   xcodePlatform,
+  sdkVersion,
 }:
 
 let
   inherit (lib.generators) toPlist;
 
-  Info = {
-    CFBundleIdentifier = "com.apple.platform.${lib.toLower xcodePlatform}";
-    Type = "Platform";
+  Info = rec {
+    CFBundleIdentifier = "com.apple.platform.${Name}";
+    DefaultProperties = {
+      COMPRESS_PNG_FILES = "NO";
+      DEPLOYMENT_TARGET_SETTING_NAME = stdenvNoCC.hostPlatform.darwinMinVersionVariable;
+      STRIP_PNG_TEXT = "NO";
+    };
+    Description = if stdenvNoCC.hostPlatform.isMacOS then "macOS" else "iOS";
+    FamilyDisplayName = Description;
+    FamilyIdentifier = lib.toLower xcodePlatform;
+    FamilyName = Description;
+    Identifier = CFBundleIdentifier;
+    MinimumSDKVersion = stdenvNoCC.hostPlatform.darwinMinVersion;
     Name = lib.toLower xcodePlatform;
+    Type = "Platform";
+    Version = sdkVersion;
   };
 
   # These files are all based off of Xcode spec files found in
diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
index fe58181980b6..f9551b5b9bad 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
@@ -56,16 +56,19 @@ self: super: {
       darwin.libsbuf
       # Shipped with the SDK only as a library with no headers
       (lib.getLib darwin.libutil)
-      # Required by some SDK headers
-      cupsHeaders
     ]
     # x86_64-darwin links the object files from Csu when targeting very old releases
     ++ lib.optionals stdenvNoCC.hostPlatform.isx86_64 [ darwin.Csu ];
 
   # The Darwin module for Swift requires certain headers to be included in the SDK (and not just be propagated).
   buildPhase = super.buildPhase or "" + ''
-    for header in '${lib.getDev libiconv}/include/'* '${lib.getDev ncurses}/include/'*; do
+    for header in '${lib.getDev libiconv}/include/'* '${lib.getDev ncurses}/include/'* '${cupsHeaders}/include/'*; do
       ln -s "$header" "usr/include/$(basename "$header")"
     done
   '';
+
+  # Exported to allow the headers to pass the requisites check in the stdenv bootstrap.
+  passthru = (super.passthru or { }) // {
+    cups-headers = cupsHeaders;
+  };
 }
diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
index f993441c757e..ff0094df60e0 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
@@ -3,11 +3,12 @@
   pkgsBuildHost,
   stdenv,
   stdenvNoCC,
+  sdkVersion,
 }:
 
 let
   plists = import ./plists.nix {
-    inherit lib stdenvNoCC;
+    inherit lib stdenvNoCC sdkVersion;
     xcodePlatform = if stdenvNoCC.hostPlatform.isMacOS then "MacOSX" else "iPhoneOS";
   };
   inherit (pkgsBuildHost) darwin cctools xcbuild;
@@ -38,11 +39,15 @@ self: super: {
     # Include `libtool` in the toolchain, so `xcrun -find libtool` can find it without requiring `cctools.libtool`
     # as a `nativeBuildInput`.
     mkdir -p "$toolchainsPath/usr/bin"
-    ln -s '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' "$toolchainsPath/usr/bin/libtool"
+    if [ -e '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' ]; then
+      ln -s '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' "$toolchainsPath/usr/bin/libtool"
+    fi
 
     # Include additional binutils required by some packages (such as Chromium).
     for tool in lipo nm otool size strip; do
-      ln -s '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool "$toolchainsPath/usr/bin/$tool"
+      if [ -e '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool ]; then
+        ln -s '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool "$toolchainsPath/usr/bin/$tool"
+      fi
     done
   '';
 }
diff --git a/pkgs/by-name/ap/apple-sdk/package.nix b/pkgs/by-name/ap/apple-sdk/package.nix
index 04b32f07a642..2a0dabd97ae0 100644
--- a/pkgs/by-name/ap/apple-sdk/package.nix
+++ b/pkgs/by-name/ap/apple-sdk/package.nix
@@ -41,7 +41,7 @@ let
     # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
     ++ lib.optionals (!enableBootstrap) [
       (callPackage ./common/propagate-inputs.nix { })
-      (callPackage ./common/propagate-xcrun.nix { })
+      (callPackage ./common/propagate-xcrun.nix { inherit sdkVersion; })
     ]
     # This has to happen last.
     ++ [
@@ -58,12 +58,6 @@ stdenvNoCC.mkDerivation (
 
     dontConfigure = true;
 
-    # TODO(@connorbaker):
-    # This is a quick fix unblock builds broken by https://github.com/NixOS/nixpkgs/pull/370750.
-    # Fails due to a reflexive symlink:
-    # $out/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/A
-    dontCheckForBrokenSymlinks = true;
-
     strictDeps = true;
 
     setupHooks = [
@@ -96,6 +90,11 @@ stdenvNoCC.mkDerivation (
         ln -s "${sdkName}" "$sdkpath/MacOSX${sdkMajor}.sdk"
         ln -s "${sdkName}" "$sdkpath/MacOSX.sdk"
 
+        # Swift adds these locations to its search paths. Avoid spurious warnings by making sure they exist.
+        mkdir -p "$platformPath/Developer/Library/Frameworks"
+        mkdir -p "$platformPath/Developer/Library/PrivateFrameworks"
+        mkdir -p "$platformPath/Developer/usr/lib"
+
         runHook postInstall
       '';
 
diff --git a/pkgs/by-name/ap/appres/package.nix b/pkgs/by-name/ap/appres/package.nix
new file mode 100644
index 000000000000..21d45efb2ea3
--- /dev/null
+++ b/pkgs/by-name/ap/appres/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  meson,
+  ninja,
+  xorgproto,
+  libx11,
+  libxt,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "appres";
+  version = "1.0.7";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/appres-${finalAttrs.version}.tar.xz";
+    hash = "sha256-ERSxiSOf2HqNHbQz7ctEhjRtKZEhMrkeru5WZ/E7gZ8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxt
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Utility to list X application resource database";
+    longDescription = ''
+      The appres program prints the resources seen by an application (or subhierarchy of an
+      application) with the specified class and instance names.
+      It can be used to determine which resources a particular program will load.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/appres";
+    license = lib.licenses.mitOpenGroup;
+    mainProgram = "appres";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ar/ares-cli/package.nix b/pkgs/by-name/ar/ares-cli/package.nix
index 8c5be1fea7eb..adb13af633d1 100644
--- a/pkgs/by-name/ar/ares-cli/package.nix
+++ b/pkgs/by-name/ar/ares-cli/package.nix
@@ -14,10 +14,6 @@ buildNpmPackage rec {
     hash = "sha256-L8suZDtXVchVyvp7KCv0UaceJqqGBdfopd5tZzwj3MY=";
   };
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   dontNpmBuild = true;
   npmDepsHash = "sha256-ATIxe/sulfOpz5KiWauDAPZrlfUOFyiTa+5ECFbVd+0=";
 
diff --git a/pkgs/by-name/as/assimp/package.nix b/pkgs/by-name/as/assimp/package.nix
index a28053da6644..e09e2ed5723f 100644
--- a/pkgs/by-name/as/assimp/package.nix
+++ b/pkgs/by-name/as/assimp/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   zlib,
   nix-update-script,
@@ -23,6 +24,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ixtqK+3iiL17GEbEVHz5S6+gJDDQP7bVuSfRMJMGEOY=";
   };
 
+  patches = [
+    # Fix build with gcc15
+    # https://github.com/assimp/assimp/pull/6283
+    (fetchpatch {
+      name = "assimp-fix-invalid-vector-gcc15.patch";
+      url = "https://github.com/assimp/assimp/commit/59bc03d931270b6354690512d0c881eec8b97678.patch";
+      hash = "sha256-O+JPwcOdyFtmFE7eZojHo1DUavF5EhLYlUyxtYo/KF4=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index c0b8534382ac..247666bb13fb 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -33,9 +33,6 @@ buildNpmPackage' rec {
 
   npmDepsHash = "sha256-GQXbXkOt8nkOB2OeEcKsp1yJd5lXS+KKout/5ffLgD0=";
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
   makeCacheWritable = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index 6cdfb11e2954..ad3ed152731b 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -57,13 +57,17 @@ stdenv.mkDerivation (finalAttrs: {
   # * directive-export{,-gmake}: another failure related to TZ variables
   # * opt-keep-going-indirect: not yet known
   # * varmod-localtime: musl doesn't support TZDIR and this test relies on impure, implicit paths
-  env.BROKEN_TESTS = lib.concatStringsSep " " [
-    "cmd-interrupt"
-    "directive-export"
-    "directive-export-gmake"
-    "opt-keep-going-indirect"
-    "varmod-localtime"
-  ];
+  env.BROKEN_TESTS = lib.concatStringsSep " " (
+    [
+      "cmd-interrupt"
+      "directive-export"
+      "directive-export-gmake"
+      "opt-keep-going-indirect"
+      "varmod-localtime"
+    ]
+    # TODO: drop the name-conditioning on stdenv rebuild
+    ++ lib.optional (stdenv.isDarwin && lib.getName stdenv != "bootstrap-stage1-stdenv-darwin") "export"
+  );
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/br/bruno-cli/package.nix b/pkgs/by-name/br/bruno-cli/package.nix
index 9088460b5ffd..811fb768f17d 100644
--- a/pkgs/by-name/br/bruno-cli/package.nix
+++ b/pkgs/by-name/br/bruno-cli/package.nix
@@ -1,5 +1,7 @@
 {
   lib,
+  stdenv,
+  clang_20,
   buildNpmPackage,
   bruno,
   pkg-config,
@@ -24,7 +26,8 @@ buildNpmPackage {
 
   nativeBuildInputs = [
     pkg-config
-  ];
+  ]
+  ++ lib.optional stdenv.isDarwin clang_20; # clang_21 breaks gyp builds
 
   buildInputs = [
     pango
diff --git a/pkgs/by-name/bt/btc-rpc-explorer/package.nix b/pkgs/by-name/bt/btc-rpc-explorer/package.nix
index b8074f93fbc4..93e32a9f67f5 100644
--- a/pkgs/by-name/bt/btc-rpc-explorer/package.nix
+++ b/pkgs/by-name/bt/btc-rpc-explorer/package.nix
@@ -20,10 +20,6 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-eYA2joO4wcV10xJeYLqCbvM2szWlqofmugoHHD9D30U=";
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   makeCacheWritable = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bt/btrfs-progs/package.nix b/pkgs/by-name/bt/btrfs-progs/package.nix
index fd8e3bce91c4..ffa5dac48db6 100644
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.16";
+  version = "6.17";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-Makw+HN8JhioJK1L0f3YP1QQPg6qFaqtxIT/rjNGb8U=";
+    hash = "sha256-J31pbJ15cT/1r7U8fv69zq0uamAHeJsXQuxBH05Moik=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bu/bundler/package.nix b/pkgs/by-name/bu/bundler/package.nix
index 1b6ac8a1cff1..07f1b71d99dc 100644
--- a/pkgs/by-name/bu/bundler/package.nix
+++ b/pkgs/by-name/bu/bundler/package.nix
@@ -13,8 +13,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.7.1";
-  source.sha256 = "sha256-CtWgAqh5d2sqmL5lL1V6yHMb4zU2EtY/pO8bJwbcHgs=";
+  version = "2.7.2";
+  source.sha256 = "sha256-Heyvni4ay5G2WGopJcjz9tojNKgnMaYv8t7RuDwoOHE=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 82dac85d93c1..07ec9ee16c3c 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.0.22",
+  "version": "2.0.24",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.0.22",
+      "version": "2.0.24",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 3ca88da75005..2c81854f4e18 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,14 +7,14 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.0.22";
+  version = "2.0.24";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-SDXYXEb7Vi150Hx04y9kd+Owzu11VSqVRgej36P2khU=";
+    hash = "sha256-pi8EdN/XyzMGWBcTiV8pr9GODcBs0uPFarWjQMoCaEs=";
   };
 
-  npmDepsHash = "sha256-kphPXek1YoEs4yvikOYg/CmkKuq1rMUJC6Rkrhydkxo=";
+  npmDepsHash = "sha256-XylBq0/zu7iSTPiLAkewQFeh1OmtJv9nUfnCb66opVE=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index 7e3b689f4567..3f099d56c7f9 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -50,11 +50,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "4.1.1";
+  version = "4.1.2";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-sp9vGXM6oiS3djUHoQikJ+1Ixojh+vIrKcROHDBUkoI=";
+    hash = "sha256-ZD8EGCt7oyOrMfUm94UTT7ecujGIqFIgbvBHP+4oKhU=";
   };
 
   patches = [
@@ -80,9 +80,6 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ]
   ++ [
-    # Backport of https://gitlab.kitware.com/cmake/cmake/-/merge_requests/11134
-    ./fix-curl-8.16.patch
-
     # Remove references to non‐Nix search paths.
     ./remove-impure-search-paths.patch
   ];
diff --git a/pkgs/by-name/co/containerlab/package.nix b/pkgs/by-name/co/containerlab/package.nix
index 63b181c26168..f0f2b220ecab 100644
--- a/pkgs/by-name/co/containerlab/package.nix
+++ b/pkgs/by-name/co/containerlab/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "containerlab";
-  version = "0.69.3";
+  version = "0.70.2";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RJNJ5LUCGaARn5NOSepTL/0Owr/ozFUYAvlynDTyqfY=";
+    hash = "sha256-QBv0SZ7XxVc0yWbOxPKdfzk9AKYlMJyeZwpAx1jbamk=";
   };
 
-  vendorHash = "sha256-28Q1R6P2rpER5RxagnsKy9W3b4FUeRRbkPPovzag//U=";
+  vendorHash = "sha256-XttJ/GXhNKVHLR33A/o3N3OYHsyKWHBhD5QOz0AlfFk=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -27,9 +27,9 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/srl-labs/containerlab/cmd/version.Version=${finalAttrs.version}"
-    "-X github.com/srl-labs/containerlab/cmd/version.commit=${finalAttrs.src.rev}"
-    "-X github.com/srl-labs/containerlab/cmd/version.date=1970-01-01T00:00:00Z"
+    "-X github.com/srl-labs/containerlab/cmd.Version=${finalAttrs.version}"
+    "-X github.com/srl-labs/containerlab/cmd.commit=${finalAttrs.src.rev}"
+    "-X github.com/srl-labs/containerlab/cmd.date=1970-01-01T00:00:00Z"
   ];
 
   preCheck = ''
@@ -37,9 +37,10 @@ buildGoModule (finalAttrs: {
     export USER="runner"
   '';
 
-  # TestVerifyLinks wants to use docker.sock, which is not available in the Nix build environment.
+  # TestVerifyLinks wants to use docker.sock which is not available in the Nix build env
+  # KernelModulesLoaded wants to use /proc/modules which is not available in Nix build env
   checkFlags = [
-    "-skip=^TestVerifyLinks$"
+    "-skip=^TestVerifyLinks$|^TestIsKernelModuleLoaded$"
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/co/cosmic-applets/package.nix b/pkgs/by-name/co/cosmic-applets/package.nix
index 670fff08479b..eb3e8993e527 100644
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -20,17 +20,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-uUcEwa9rGHLzmlutmLl/e38ZqybfYMU0Dhe+FsT5V/E=";
+    hash = "sha256-Vs6sNf6nbOqxlHq3NTFyRltiWVdPmumvuAq8nlWZEkc=";
   };
 
-  cargoHash = "sha256-RnkyIlTJMxMGu+EsmZwvSIapSqdng+t8bqMVsDXprlU=";
+  cargoHash = "sha256-uTKHCrgy3URLvqO96CJ0jORZF9/KPDf59iEsdrK1tY4=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-applibrary/package.nix b/pkgs/by-name/co/cosmic-applibrary/package.nix
index 2f60f0f352b0..72a3013a0e6e 100644
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-LVNOUOVeX8QpTbUG3bOhMkdrjkF3M0sZg+agSQyWAfA=";
+    hash = "sha256-Y0fohkNV9C78rGK+uoofQBDdK6Fb7XzmAdY1SorKFxA=";
   };
 
-  cargoHash = "sha256-f5uMgscentTlcPXFSan1kKcKh1nk88/3kQPTSuc0wz4=";
+  cargoHash = "sha256-s2YiB4U/pVAul2YC5/6bCVwKd18odoTAua4YhUJDN3U=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-bg/package.nix b/pkgs/by-name/co/cosmic-bg/package.nix
index 719f4650bde2..05cf6292d191 100644
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-bg";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-t5tY7Axiz39lCDhDC/lKSRCURfHspeaP49kNXJvCLC4=";
+    hash = "sha256-mF6W/RND9cNfS27lQNZRcXY4OUMS+UUMMcEalBQ59Yg=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index a18d018a1ba1..705bd550c322 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -20,17 +20,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-RHeQk1yBNnDN/efuDDWNLn9O7FQTYLBsbs+h+gxi+Xo=";
+    hash = "sha256-VMM26rSO1ldM5WgoSJ5z89UgEK2GFNyDbqwdN53p8J8=";
   };
 
-  cargoHash = "sha256-Jaw2v+02lA5wWRAhRNW/lcLnTI7beJIZ43dqcJ60EP0=";
+  cargoHash = "sha256-hqw5nGKP0nw00qQoHyrcryVg2Kkdnx6yyJIERbh3DFE=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index c861f9a5ead8..a81a49b959b1 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-Zd/vTNZt9tPXryOwo2U68FtIul7xiRcz5N4Heuyicoc=";
+    hash = "sha256-AIx7lZSWApdNMETVxTXmAeMcDlPFitG5lLlhAi+NUF0=";
   };
 
-  cargoHash = "sha256-YfD06RAQPZRwapd0fhNsZ0tx+0JMNDXiPJIWwDhmG0M=";
+  cargoHash = "sha256-RwBrZ6cgr/7qmZZ+680otWQSWZyW04QE/102l+bKtpc=";
 
   postPatch = ''
     substituteInPlace justfile --replace-fail '#!/usr/bin/env' "#!$(command -v env)"
diff --git a/pkgs/by-name/co/cosmic-files/package.nix b/pkgs/by-name/co/cosmic-files/package.nix
index f931d3df52e6..5ecdbe58e6ef 100644
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-pSjmsWsGGhjCekMTX8iiNVbF5X33zg5YVDWtemjIDWU=";
+    hash = "sha256-D4oyuNSGMGRLRkPmKYIXUCTZh94QJuUYBbpiLA4szKk=";
   };
 
-  cargoHash = "sha256-7RANj+aXdmBVO66QDgcNrrU4qEGK4Py4+ZctYWU1OO8=";
+  cargoHash = "sha256-GLO5d+NRaKIlc7K1CZ0YH9kp6Q0rVfh0sJRjMLqPTBY=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-greeter/package.nix b/pkgs/by-name/co/cosmic-greeter/package.nix
index 77ef71a8dace..271b99b99640 100644
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -19,20 +19,22 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-rMZ+UbHarnvPaVAI5XeBfLduWEZHthguRSKLv3d/Eo0=";
+    hash = "sha256-Q4JrqyZbqdRk9nYk+u61CCHIucUOP4VjNALJRGaCfn4=";
   };
 
   cargoHash = "sha256-qioWGfg+cMaRNX6H6IWdcAU2py7oq9eNaxzKWw0H4R4=";
 
-  env.VERGEN_GIT_COMMIT_DATE = "2025-09-16";
-  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
+  env = {
+    VERGEN_GIT_COMMIT_DATE = "2025-10-14";
+    VERGEN_GIT_SHA = finalAttrs.src.tag;
+  };
 
   cargoBuildFlags = [ "--all" ];
 
diff --git a/pkgs/by-name/co/cosmic-icons/package.nix b/pkgs/by-name/co/cosmic-icons/package.nix
index 5a40a5269324..579b417c2a56 100644
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -9,7 +9,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-idle/package.nix b/pkgs/by-name/co/cosmic-idle/package.nix
index 9847ce7966f0..ba6778cc2154 100644
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-initial-setup/disable-language-page.patch b/pkgs/by-name/co/cosmic-initial-setup/disable-language-page.patch
deleted file mode 100644
index 1276c39cd0ce..000000000000
--- a/pkgs/by-name/co/cosmic-initial-setup/disable-language-page.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-diff --git a/src/main.rs b/src/main.rs
-index a0e8f2e..07cf8b9 100644
---- a/src/main.rs
-+++ b/src/main.rs
-@@ -194,19 +194,19 @@ impl Application for App {
-                         }
-                     }
- 
--                    page::Message::Language(message) => {
--                        if let Some(page) =
--                            self.pages.get_mut(&TypeId::of::<page::language::Page>())
--                        {
--                            return page
--                                .as_any()
--                                .downcast_mut::<page::language::Page>()
--                                .unwrap()
--                                .update(message)
--                                .map(Message::PageMessage)
--                                .map(cosmic::Action::App);
--                        }
--                    }
-+                    // page::Message::Language(message) => {
-+                    //     if let Some(page) =
-+                    //         self.pages.get_mut(&TypeId::of::<page::language::Page>())
-+                    //     {
-+                    //         return page
-+                    //             .as_any()
-+                    //             .downcast_mut::<page::language::Page>()
-+                    //             .unwrap()
-+                    //             .update(message)
-+                    //             .map(Message::PageMessage)
-+                    //             .map(cosmic::Action::App);
-+                    //     }
-+                    // }
- 
-                     page::Message::Layout(message) => {
-                         if let Some(page) = self.pages.get_mut(&TypeId::of::<page::layout::Page>())
-diff --git a/src/page/mod.rs b/src/page/mod.rs
-index 389728c..937a1b3 100644
---- a/src/page/mod.rs
-+++ b/src/page/mod.rs
-@@ -4,7 +4,7 @@ use std::any::{Any, TypeId};
- 
- pub mod appearance;
- pub mod keyboard;
--pub mod language;
-+// pub mod language;
- pub mod launcher;
- pub mod layout;
- pub mod location;
-@@ -34,10 +34,10 @@ pub fn pages(mode: AppMode) -> IndexMap<TypeId, Box<dyn Page>> {
-     if let AppMode::NewInstall { create_user } = mode {
-         pages.insert(TypeId::of::<wifi::Page>(), Box::new(wifi::Page::default()));
- 
--        pages.insert(
--            TypeId::of::<language::Page>(),
--            Box::new(language::Page::new()),
--        );
-+        // pages.insert(
-+        //     TypeId::of::<language::Page>(),
-+        //     Box::new(language::Page::new()),
-+        // );
- 
-         pages.insert(
-             TypeId::of::<keyboard::Page>(),
-@@ -95,7 +95,7 @@ pub fn pages(mode: AppMode) -> IndexMap<TypeId, Box<dyn Page>> {
- pub enum Message {
-     Appearance(appearance::Message),
-     Keyboard(keyboard::Message),
--    Language(language::Message),
-+    // Language(language::Message),
-     Layout(layout::Message),
-     Location(location::Message),
-     SetTheme(cosmic::Theme),
diff --git a/pkgs/by-name/co/cosmic-initial-setup/disable-timezone-page.patch b/pkgs/by-name/co/cosmic-initial-setup/disable-timezone-page.patch
deleted file mode 100644
index 5af92f16d5bb..000000000000
--- a/pkgs/by-name/co/cosmic-initial-setup/disable-timezone-page.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-diff --git a/src/main.rs b/src/main.rs
-index a0e8f2e..b6ff8dc 100644
---- a/src/main.rs
-+++ b/src/main.rs
-@@ -221,7 +221,7 @@ impl Application for App {
-                         }
-                     }
- 
--                    page::Message::Location(message) => {
-+                    /* page::Message::Location(message) => {
-                         if let Some(page) =
-                             self.pages.get_mut(&TypeId::of::<page::location::Page>())
-                         {
-@@ -233,7 +233,7 @@ impl Application for App {
-                                 .map(Message::PageMessage)
-                                 .map(cosmic::Action::App);
-                         }
--                    }
-+                    } */
- 
-                     page::Message::User(message) => {
-                         if let Some(page) = self.pages.get_mut(&TypeId::of::<page::user::Page>()) {
-diff --git a/src/page/mod.rs b/src/page/mod.rs
-index 389728c..38ced5e 100644
---- a/src/page/mod.rs
-+++ b/src/page/mod.rs
-@@ -7,7 +7,7 @@ pub mod keyboard;
- pub mod language;
- pub mod launcher;
- pub mod layout;
--pub mod location;
-+// pub mod location;
- pub mod new_apps;
- pub mod new_shortcuts;
- pub mod user;
-@@ -48,10 +48,10 @@ pub fn pages(mode: AppMode) -> IndexMap<TypeId, Box<dyn Page>> {
-             pages.insert(TypeId::of::<user::Page>(), Box::new(user::Page::default()));
-         }
- 
--        pages.insert(
-+        /* pages.insert(
-             TypeId::of::<location::Page>(),
-             Box::new(location::Page::new()),
--        );
-+        ); */
-     }
- 
-     pages.insert(
-@@ -97,7 +97,7 @@ pub enum Message {
-     Keyboard(keyboard::Message),
-     Language(language::Message),
-     Layout(layout::Message),
--    Location(location::Message),
-+    // Location(location::Message),
-     SetTheme(cosmic::Theme),
-     User(user::Message),
-     Welcome(welcome::Message),
-@@ -150,4 +150,4 @@ pub trait Page {
-     fn view(&self) -> Element<'_, Message> {
-         widget::text::body("TODO").into()
-     }
--}
-+}
-\ No newline at end of file
diff --git a/pkgs/by-name/co/cosmic-initial-setup/package.nix b/pkgs/by-name/co/cosmic-initial-setup/package.nix
index 63558e905a57..eb300279a439 100644
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@@ -3,8 +3,8 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch2,
   just,
+  killall,
   libcosmicAppHook,
   libinput,
   openssl,
@@ -14,13 +14,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-initial-setup";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-initial-setup";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-kjJqGNcIlnzEsfA4eQ9D23ZGgRcmWQyWheAlwpjfALA=";
+    hash = "sha256-sgtZioUvBDSqlBVWbqGc2iVpZKF0fn/Mr1qo1qlzdlA=";
   };
 
   cargoHash = "sha256-orwK9gcFXK4/+sfwRubcz0PP6YAFqsENRHnlSLttLxM=";
@@ -41,23 +41,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   buildInputs = [
+    killall
     libinput
     openssl
     udev
   ];
 
-  # These are not needed for NixOS
-  patches = [
-    ./disable-language-page.patch
-    ./disable-timezone-page.patch
-    # TODO: Remove in next update
-    (fetchpatch2 {
-      name = "fix-layout-and-themes-page.patch";
-      url = "https://patch-diff.githubusercontent.com/raw/pop-os/cosmic-initial-setup/pull/53.diff?full_index=1";
-      hash = "sha256-081qyQnPhh+FRPU/JKJVCK+l3SKjHAIV5b6/7WN6lb8=";
-    })
-  ];
-
   postPatch = ''
     # Installs in $out/etc/xdg/autostart instead of /etc/xdg/autostart
     substituteInPlace justfile \
@@ -66,6 +55,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "autostart-dst := prefix / 'etc' / 'xdg' / 'autostart' / desktop-entry"
   '';
 
+  preFixup = ''
+    libcosmicAppWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ killall ]})
+  '';
+
   dontUseJustBuild = true;
   dontUseJustCheck = true;
 
diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index f2617f151cc7..d44e097bdf89 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-vAuWH9qmstPcfPvcKoM/2VjGxAfdtO9hhOPaZ5Ft4Y0=";
+    hash = "sha256-V4FShr8kTf3lsYpPoU3hfeLgR4iQXmo+BxNOBko8pN0=";
   };
 
-  cargoHash = "sha256-57rkCufJPWm844/iMIfULfaGR9770q8VgZgnqCM57Zg=";
+  cargoHash = "sha256-bW6XtdK+AZiuwfzBUWmUi00RJXeuzgzGKoL35lyDBfM=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-notifications/package.nix b/pkgs/by-name/co/cosmic-notifications/package.nix
index 9ff3f7ac8299..e25b2fb5a2e1 100644
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-notifications";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-notifications";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-wgOjaiKJ1KYdYsynQV5+KKGhdneELiLTHYqjMEWaxt0=";
+    hash = "sha256-HMs08kAS+dC8GsznmQveZczwYtlSKxS4MU3BEKLgxjY=";
   };
 
   cargoHash = "sha256-CL8xvj57yq0qzK3tyYh3YXh+fM4ZDsmL8nP1mcqTqeQ=";
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index 0dcc4b8dc4b5..32ae263c5019 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-osd";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-tsP4dlHmzuf5QgByDWbuigMrpgnJAjuNsYwWDSutCoI=";
+    hash = "sha256-xGVB1RGbraTUORcEE5I70wxwnUpe/itMQyNaxCh1bfY=";
   };
 
-  cargoHash = "sha256-YcNvvK+Zf8nSS5YjS5iaoipogstiyBdNY7LhWPsz9xQ=";
+  cargoHash = "sha256-v6/lWqGG3uFSFgw77M0kGM+cK9wSiuaGaciPqz/wFIQ=";
 
   nativeBuildInputs = [
     libcosmicAppHook
diff --git a/pkgs/by-name/co/cosmic-panel/package.nix b/pkgs/by-name/co/cosmic-panel/package.nix
index ff40a8512385..3c8e1265058f 100644
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-panel";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-panel";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-gSTvF6Zcixh5/uYZuUiCIdBlXJj31+lISBwLujTuOfo=";
+    hash = "sha256-d21/ydBbT/lWudx9+hEDu7PlbIbORr3tqWcvMzenxr8=";
   };
 
   cargoHash = "sha256-8KOl581VmsfE7jiVFXy3ZDIfAqnaJuiDd7paqiFI/mk=";
diff --git a/pkgs/by-name/co/cosmic-player/package.nix b/pkgs/by-name/co/cosmic-player/package.nix
index a213b228531a..fc42c3570653 100644
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-player";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-player";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-oTTVVQkSkON5NTgO5+eUD2wVpiW5MvW3MZyeyqqc3qk=";
+    hash = "sha256-jf9KSgA94SL6JX7Nh1BQiumOYBJjjt5O5DRCjeBHovo=";
   };
 
-  cargoHash = "sha256-DodFIfthiGFSvXWfPsPjFhNY6G7z3lb6pfc5HtUXhMo=";
+  cargoHash = "sha256-fnX5BkzRAetKxHZ9XyWdmG6TSxFqGJsmg16zlpYG9Ag=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-randr/package.nix b/pkgs/by-name/co/cosmic-randr/package.nix
index 95f1be48c2fc..90791bfb918f 100644
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-randr";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-screenshot/package.nix b/pkgs/by-name/co/cosmic-screenshot/package.nix
index 19e6b35a9007..b04fe70ea437 100644
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-screenshot";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-screenshot";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-TKR8EDXZwKKC1WSZhlcf5U6tiM4cWCdb24U74vVKTaU=";
+    hash = "sha256-ZvbYb3gkA5cLcIulUQID8lj9USu6EurPUUMEdaGnZak=";
   };
 
   cargoHash = "sha256-O8fFeg1TkKCg+QbTnNjsH52xln4+ophh/BW/b4zQs9o=";
diff --git a/pkgs/by-name/co/cosmic-session/package.nix b/pkgs/by-name/co/cosmic-session/package.nix
index b097d249adbc..71a7f7bae081 100644
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-session";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-settings-daemon/package.nix b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
index 8e3e29e75f6c..13dfde98f513 100644
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings-daemon";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings-daemon";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-tHG/VoaP1tcns6AyedkkVUpWFlcOclWijsHYQ3vOIjs=";
+    hash = "sha256-CtHy8qy7CatbErNZKu1pLFC9aUWLj0r87+lvRB16oSE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index 31c4217cca33..9efa293f3f58 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -27,17 +27,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-Yn5CSp/vsLMbkcQ7mCDw/ErgkSCyEvkwNvWqupVUkZ4=";
+    hash = "sha256-ziA9dy3wZHhpgBNgjC/Uq8M7R5B62k3PGzFiC+rrPpI=";
   };
 
-  cargoHash = "sha256-dHyUTV5txSLWEDE7Blplz8CBvyuUmYNNr1kbifujHKk=";
+  cargoHash = "sha256-mMfKY+ouszbN2rEf6zvv1Sc1FEZ/ZVuQ6RXGMBFDwIE=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 234b522ceb37..ddfcfa9d06da 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-store";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-store";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-KlXFFoUEa0YTQDEJHMrbWOIEsSnXvJNzzaEFYR83t9s=";
+    hash = "sha256-t27WA/q+RFyjGpmpgJCGmen67h4NMAkyHbObpaJiSz4=";
   };
 
-  cargoHash = "sha256-xdNYQB/zmndnMAkstwJ6Z2uk0fXli3gIYHchUq/3u6k=";
+  cargoHash = "sha256-7FvelbsXa3ya6EY2irfCxwjAr9o3VWJ9/vJutFTjYpQ=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index cbd95303c28d..c3571b9cdd93 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-term";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-term";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-1kQuPMaLXq+V1fTplXKoXAVOtyuD4Sh8diljHgTDbdI=";
+    hash = "sha256-Gf5C135I3MBxyYBvgbOcY4USa75BeD7sPhFjq5BIM1s=";
   };
 
-  cargoHash = "sha256-mpuVSHb9YcDZB+eyyD+5ZNzUeEgx8T25IFjsD/Q/quU=";
+  cargoHash = "sha256-qXAgmVsjhr3aqEQRGjsK2JM8YwpkRK5Y+XYJRSZ8Swc=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index 888b41c96a9b..158f18977f0f 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
index c2831c0b3a93..879a62516599 100644
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-workspaces-epoch";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-workspaces-epoch";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-gcS8Q9SR7Dj1FH2Dtdd6jUMX8u5kHJBMvlgqJGw+rjA=";
+    hash = "sha256-WHMOA7fNPIAwaQmzqyo+XlBYl+13cz0LrRpT0GUa8Vs=";
   };
 
   cargoHash = "sha256-BE6s2dmbgXlFXrtd8b9k2LltLnegLzWbIUlaEQvv+5o=";
diff --git a/pkgs/by-name/cp/cpuinfo/package.nix b/pkgs/by-name/cp/cpuinfo/package.nix
index 2859ea5557ec..65424033c77d 100644
--- a/pkgs/by-name/cp/cpuinfo/package.nix
+++ b/pkgs/by-name/cp/cpuinfo/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpuinfo";
-  version = "0-unstable-2025-07-24";
+  version = "0-unstable-2025-09-05";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "cpuinfo";
-    rev = "33ed0be77d7767d0e2010e2c3cf972ef36c7c307";
-    hash = "sha256-0rZzbZkOo6DAt1YnH4rtx0FvmCuYH8M6X3DNJ0gURpU=";
+    rev = "877328f188a3c7d1fa855871a278eb48d530c4c0";
+    hash = "sha256-JW83AgI1cWv4TSpXNe9sv/hNYAA7MOdUeTHY8+0lHgc=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
diff --git a/pkgs/by-name/cu/cursor-cli/package.nix b/pkgs/by-name/cu/cursor-cli/package.nix
index 9ce40695c797..58215b6618de 100644
--- a/pkgs/by-name/cu/cursor-cli/package.nix
+++ b/pkgs/by-name/cu/cursor-cli/package.nix
@@ -9,26 +9,26 @@ let
   inherit (stdenv) hostPlatform;
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.02-bd871ac/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-tqppTOkeChlyw3IjSkhGpNvMX9U5s2hiu13/RWakENg=";
+      url = "https://downloads.cursor.com/lab/2025.10.20-f1b214f/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-v6wGVuKrK4JFFaJN55le5+wZV7LI9Bc70Osc05F0PeQ=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.02-bd871ac/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-Gf/2wLS2+xQ6Mu4u96n4hI1I4L2iIG16R668BQCNZaw=";
+      url = "https://downloads.cursor.com/lab/2025.10.20-f1b214f/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-j3z3K2tt2wl54OjLMPudGnCP2+9U2dOspM0G0Ob68Ds=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.02-bd871ac/darwin/x64/agent-cli-package.tar.gz";
-      hash = "sha256-/qznJxLpyUBH4L6zJSDB5mVFVk2Y7UJCt2Uw5g7U6AQ=";
+      url = "https://downloads.cursor.com/lab/2025.10.20-f1b214f/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-KRECUSqYohrCiF3YySZeJ0MaRhb7h+O+KyqCfpCbV8w=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.02-bd871ac/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-drbaPM4ho5/1vmQWMgBelmqR7Np45w/XR0ZsfR53vZI=";
+      url = "https://downloads.cursor.com/lab/2025.10.20-f1b214f/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-4S1HMPielrUwP5pyA/tp1FuByge9dcRx2XndTFnBKbY=";
     };
   };
 in
 stdenv.mkDerivation {
   pname = "cursor-cli";
-  version = "0-unstable-2025-10-02";
+  version = "0-unstable-2025-10-20";
 
   src = sources.${hostPlatform.system};
 
diff --git a/pkgs/by-name/di/discord-rich-presence-plex/package.nix b/pkgs/by-name/di/discord-rich-presence-plex/package.nix
new file mode 100644
index 000000000000..2c9f3a73e6df
--- /dev/null
+++ b/pkgs/by-name/di/discord-rich-presence-plex/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  python3Packages,
+  python3,
+  fetchFromGitHub,
+  makeWrapper,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "discord-rich-presence-plex";
+  version = "2.16.0";
+  format = "other";
+  src = fetchFromGitHub {
+    owner = "phin05";
+    repo = "discord-rich-presence-plex";
+    tag = "v${version}";
+    hash = "sha256-e1r0w72IOEY5XsjANkAHbfPYEf1B8n6KYVLMWFSLs0g=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+  dontBuild = true;
+  dontUseSetuptoolsBuild = true;
+  dontUseSetuptoolsCheck = true;
+
+  dependencies = with python3Packages; [
+    requests
+    pillow
+    plexapi
+    pyyaml
+    websocket-client
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/discord-rich-presence-plex
+    cp -r * $out/lib/discord-rich-presence-plex/
+
+    mkdir -p $out/bin
+    makeWrapper ${lib.getExe python3} \
+      $out/bin/discord-rich-presence-plex \
+      --add-flags "$out/lib/discord-rich-presence-plex/main.py" \
+      --prefix PYTHONPATH : "$out/lib/discord-rich-presence-plex:$PYTHONPATH" \
+      --set DRPP_NO_PIP_INSTALL "true"
+
+    runHook postInstall
+  '';
+
+  # No tests
+  doCheck = false;
+
+  meta = {
+    homepage = "https://github.com/phin05/discord-rich-presence-plex";
+    changelog = "https://github.com/phin05/discord-rich-presence-plex/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    description = "Displays your Plex status on Discord using Rich Presence";
+    maintainers = with lib.maintainers; [ hogcycle ];
+    mainProgram = "discord-rich-presence-plex";
+  };
+}
diff --git a/pkgs/by-name/dn/dnsdiag/package.nix b/pkgs/by-name/dn/dnsdiag/package.nix
index 8ae326177f87..ae1da2edbd49 100644
--- a/pkgs/by-name/dn/dnsdiag/package.nix
+++ b/pkgs/by-name/dn/dnsdiag/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dnsdiag";
-  version = "2.6.0";
+  version = "2.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "farrokhi";
     repo = "dnsdiag";
     tag = "v${version}";
-    hash = "sha256-6TDs+ncbVa7LWtGLlqEXJb9zzXZ+nAhbi4QGyCSu3ho=";
+    hash = "sha256-VTxIKqc7yFTLx7VLEjb4UwPKAmSD+4X+ZHrmriScVGA=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/el/ell/package.nix b/pkgs/by-name/el/ell/package.nix
index 57ced639540a..85795193b0d9 100644
--- a/pkgs/by-name/el/ell/package.nix
+++ b/pkgs/by-name/el/ell/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.79";
+  version = "0.80";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-5NqzuUDimairQJjHsSy0sbpqiDfNDvrt3BEV9e1bF1E=";
+    hash = "sha256-B7Dz5H49d8kQaHfPQt7Y3f9D6EdqLOBMK+378g4E46U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/eo/eog/package.nix b/pkgs/by-name/eo/eog/package.nix
index 09ce3ade221a..4169f140d603 100644
--- a/pkgs/by-name/eo/eog/package.nix
+++ b/pkgs/by-name/eo/eog/package.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
           libjxl
           librsvg
           webp-pixbuf-loader
-          libheif.out
+          libheif.lib
         ];
       }
     }"
diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index ba5a46d034f8..d650a64b19fc 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.7.2";
+  version = "2.7.3";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-Ibd4s07IN8KsKFrvNA+ftfoGOoEbIepNJBKpcCyImVw=";
+    hash = "sha256-cd+PQHBqe7CoClNnB56nXZHaT4xlxY7Fm837997Nq58=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index 0836c8308748..d49639074912 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -8,7 +8,7 @@
   nixosTests,
 }:
 let
-  version = "2.44.0";
+  version = "2.44.1";
 
   pnpm = pnpm_9;
 
@@ -16,7 +16,7 @@ let
     owner = "filebrowser";
     repo = "filebrowser";
     rev = "v${version}";
-    hash = "sha256-j7V1POuF6cFpnq6UgBseHe6GxypOoj2rYrN6k2nIF8w=";
+    hash = "sha256-ln7Dst+sN99c3snPU7DrIGpwKBz/e4Lz+uOknmm6sxg=";
   };
 
   frontend = buildNpmPackage rec {
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index c0ca27b3ac6c..1e294851f6a1 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -21,10 +21,6 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-VJquJ7mDBHeclgd/jsAPyRLEFOQp27tUXGAQJX3bXyQ=";
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   nativeBuildInputs = [
     python3
   ]
diff --git a/pkgs/by-name/fo/font-bh-100dpi/package.nix b/pkgs/by-name/fo/font-bh-100dpi/package.nix
new file mode 100644
index 000000000000..7932de16aa13
--- /dev/null
+++ b/pkgs/by-name/fo/font-bh-100dpi/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-100dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-/Y9e/oSR+qvdJ0SAjT1Or9rlyD5hcBfH/d0nFtBJqx4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Luxi 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-100dpi";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-bh-75dpi/package.nix b/pkgs/by-name/fo/font-bh-75dpi/package.nix
new file mode 100644
index 000000000000..c970a3826f54
--- /dev/null
+++ b/pkgs/by-name/fo/font-bh-75dpi/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-75dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-YCbYwHNWPdPLtIeNAHbu2XDeur0hQjs7Yd2QRBuefNo=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Luxi 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-75dpi";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix b/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix
new file mode 100644
index 000000000000..7f80b188a61d
--- /dev/null
+++ b/pkgs/by-name/fo/font-bh-lucidatypewriter-100dpi/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-lucidatypewriter-100dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-duwJ7aQJSinUe5HPWcProinI99HKa64qu7P5JeM96PI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Lucida Sans Typewriter 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-lucidatypewriter-100dpi";
+    # no license just a copyright notice
+    license = lib.licenses.unfree;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix b/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix
new file mode 100644
index 000000000000..696a05e0e0e1
--- /dev/null
+++ b/pkgs/by-name/fo/font-bh-lucidatypewriter-75dpi/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-lucidatypewriter-75dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-hk4sOaxh8E9pP8LIqq7SSymMLNQCg87BLu5FnFY16PU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Lucida Sans Typewriter 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-lucidatypewriter-75dpi";
+    # no license just a copyright notice
+    license = lib.licenses.unfree;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-bitstream-100dpi/package.nix b/pkgs/by-name/fo/font-bitstream-100dpi/package.nix
new file mode 100644
index 000000000000..380c99a83401
--- /dev/null
+++ b/pkgs/by-name/fo/font-bitstream-100dpi/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bitstream-100dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bitstream-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-LRzGgu/k9+vfX72Ilh2MoysnKZaHKGM96iChYnaQwac=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Bitstream Charter and Terminal 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bitstream-100dpi";
+    license = with lib.licenses; [
+      hpnd
+      # TODO: change this license or remove this comment when
+      # https://github.com/spdx/license-list-XML/issues/2824
+      # gets resolved
+      xfig
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-bitstream-75dpi/package.nix b/pkgs/by-name/fo/font-bitstream-75dpi/package.nix
new file mode 100644
index 000000000000..3dd6e249b0df
--- /dev/null
+++ b/pkgs/by-name/fo/font-bitstream-75dpi/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bitstream-75dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bitstream-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-qus02HQkqcKwzw6FkHBMkMtbQsajtqDvnkZ273c7+CY=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Bitstream Charter and Terminal 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bitstream-75dpi";
+    license = with lib.licenses; [
+      hpnd
+      # TODO: change this license or remove this comment when
+      # https://github.com/spdx/license-list-XML/issues/2824
+      # gets resolved
+      xfig
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-bitstream-type1/package.nix b/pkgs/by-name/fo/font-bitstream-type1/package.nix
new file mode 100644
index 000000000000..0fe3b97a951a
--- /dev/null
+++ b/pkgs/by-name/fo/font-bitstream-type1/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  fontforge,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bitstream-type1";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bitstream-type1-${finalAttrs.version}.tar.xz";
+    hash = "sha256-3i8ji0zXLbQiigumeCnXait8A54imT1mpyLuOFJIxig=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    mkfontscale
+    fontforge
+  ];
+
+  postBuild = ''
+    # convert Postscript (Type 1) font to otf
+    for i in $(find -type f -name '*.pfa' -o -name '*.pfb'); do
+        name=$(basename $i | cut -d. -f1)
+        fontforge -lang=ff -c "Open(\"$i\"); Generate(\"$name.otf\")"
+    done
+  '';
+
+  postInstall = ''
+    # install the otf fonts
+    fontDir="$out/share/fonts/X11/otf"
+    install -Dm444 -t "$fontDir" *.otf
+    mkfontscale "$fontDir"
+  '';
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Bitstream Charter PostScript Type 1 and OpenType fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bitstream-type1";
+    license = lib.licenses.bitstreamCharter;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix b/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix
new file mode 100644
index 000000000000..ebc6e229669d
--- /dev/null
+++ b/pkgs/by-name/fo/font-cronyx-cyrillic/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-cronyx-cyrillic";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-cronyx-cyrillic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-3AeBzg3L/9v2quGgAXOhNAP5Kw3pJbylqeEX5OLWt4k=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Cronyx pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/cronyx-cyrillic";
+    license = lib.licenses.cronyx;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-isas-misc/package.nix b/pkgs/by-name/fo/font-isas-misc/package.nix
new file mode 100644
index 000000000000..d58c4fed6b00
--- /dev/null
+++ b/pkgs/by-name/fo/font-isas-misc/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-isas-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-isas-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-R+WVu+baREufb8qiZTmrx7oZieI6+mzcSeIuSEzEOPw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Isas Fangsong ti & Song ti pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/isas-misc";
+    license = lib.licenses.hpnd;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-micro-misc/package.nix b/pkgs/by-name/fo/font-micro-misc/package.nix
new file mode 100644
index 000000000000..4a11aa3d5bdf
--- /dev/null
+++ b/pkgs/by-name/fo/font-micro-misc/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-micro-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-micro-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-LuC51r166Emv8b2C76tEobazaPu14R0S/38BWj32+UM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Micro pcf font";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/micro-misc";
+    license = lib.licenses.publicDomain;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-misc-cyrillic/package.nix b/pkgs/by-name/fo/font-misc-cyrillic/package.nix
new file mode 100644
index 000000000000..491326daf9c7
--- /dev/null
+++ b/pkgs/by-name/fo/font-misc-cyrillic/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-misc-cyrillic";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-misc-cyrillic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-dgIaf1MGQAGRSlf9CO+uV/draPCiTcqKsbJFR07o6ZM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Misc Cyrillic pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/misc-cyrillic";
+    license = with lib.licenses; [
+      publicDomain
+      cronyx
+      # misc free
+      # "May be distributed and modified without restrictions."
+      free
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-misc-ethiopic/package.nix b/pkgs/by-name/fo/font-misc-ethiopic/package.nix
new file mode 100644
index 000000000000..863e1cc39045
--- /dev/null
+++ b/pkgs/by-name/fo/font-misc-ethiopic/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-misc-ethiopic";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-misc-ethiopic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-R0mn5uGh7vbJH8yaBOixwO0CfUDBWZ5abJMnDYRpthI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Ge'ez Frontiers Foundation's Zemen OpenType and TrueType fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/misc-ethiopic";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-schumacher-misc/package.nix b/pkgs/by-name/fo/font-schumacher-misc/package.nix
new file mode 100644
index 000000000000..c83b593c16aa
--- /dev/null
+++ b/pkgs/by-name/fo/font-schumacher-misc/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-schumacher-misc";
+  version = "1.1.3";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-schumacher-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-i4SfDNseVaNMw92LD7N0Q/q7wiTVukQIVWlYEkSmgHA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Schumacher pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/schumacher-misc";
+    license = lib.licenses.hpnd;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-screen-cyrillic/package.nix b/pkgs/by-name/fo/font-screen-cyrillic/package.nix
new file mode 100644
index 000000000000..bea6992d9b24
--- /dev/null
+++ b/pkgs/by-name/fo/font-screen-cyrillic/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-screen-cyrillic";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-screen-cyrillic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-j3WLuM1YDH5lVIfR0Ntp0xmsrlTZMrKV2W2dm4P95cA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Screen Cyrillic pcf font";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/screen-cyrillic";
+    license = lib.licenses.cronyx;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-sony-misc/package.nix b/pkgs/by-name/fo/font-sony-misc/package.nix
new file mode 100644
index 000000000000..8562279b8678
--- /dev/null
+++ b/pkgs/by-name/fo/font-sony-misc/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-sony-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-sony-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-5rCfgj/MsG4L0LIGIoO2UUFTMjvYp0hunC4/VauElGs=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Sony pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/sony-misc";
+    license = lib.licenses.hpnd;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-sun-misc/package.nix b/pkgs/by-name/fo/font-sun-misc/package.nix
new file mode 100644
index 000000000000..bc8eb50a71c5
--- /dev/null
+++ b/pkgs/by-name/fo/font-sun-misc/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-sun-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-sun-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-3YTdEW2Sev+k+g+ilyez7PwPBkI4gXwKHlUqCsOE258=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Open Look Glyph and Cursor pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/sun-misc/";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix b/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix
new file mode 100644
index 000000000000..efbee8e3633e
--- /dev/null
+++ b/pkgs/by-name/fo/font-winitzki-cyrillic/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-winitzki-cyrillic";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-winitzki-cyrillic-${finalAttrs.version}.tar.xz";
+    hash = "sha256-O22CEi3BR3bjr82HeDOng04fkAxT/Bx7stZ8eBz6l6g=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Winitzki Proof Cyrillic pcf font";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/winitzki-cyrillic";
+    license = lib.licenses.publicDomain;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/font-xfree86-type1/package.nix b/pkgs/by-name/fo/font-xfree86-type1/package.nix
new file mode 100644
index 000000000000..6d8e451f8594
--- /dev/null
+++ b/pkgs/by-name/fo/font-xfree86-type1/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-xfree86-type1";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-xfree86-type1-${finalAttrs.version}.tar.xz";
+    hash = "sha256-qTwseIpeocACr3yGYs+dmCH7HfUbjSssXgAm39/qSDc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "XFree86 Cusrsor Postscript Type 1 Font";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/xfree86-type1";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fr/freeglut/package.nix b/pkgs/by-name/fr/freeglut/package.nix
index e112d25a82fe..4397b47e08d5 100644
--- a/pkgs/by-name/fr/freeglut/package.nix
+++ b/pkgs/by-name/fr/freeglut/package.nix
@@ -29,6 +29,14 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/freeglut/freeglut/commit/2294389397912c9a6505a88221abb7dca0a4fb79.patch";
       hash = "sha256-buNhlVUbDekklnar6KFWN/GUKE+jMEqTGrY3LY0LwVs=";
     })
+
+    # Fix build with gcc15
+    # https://github.com/freeglut/freeglut/pull/187
+    (fetchpatch {
+      name = "freeglut-fix-fgPlatformDestroyContext-prototype-for-C23.patch";
+      url = "https://github.com/freeglut/freeglut/commit/800772e993a3ceffa01ccf3fca449d3279cde338.patch";
+      hash = "sha256-agXw3JHq81tx5514kkorvuU5mX4E3AV930hy1OJl4L0=";
+    })
   ];
 
   outputs = [
diff --git a/pkgs/by-name/ge/geos/package.nix b/pkgs/by-name/ge/geos/package.nix
index a11d8097b8e8..422269bea247 100644
--- a/pkgs/by-name/ge/geos/package.nix
+++ b/pkgs/by-name/ge/geos/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geos";
-  version = "3.13.1";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner = "libgeos";
     repo = "geos";
     tag = finalAttrs.version;
-    hash = "sha256-zPVP01AMIBKMnKi6Sq++CIaVZb5JA1v8/QAdGzKdL8Y=";
+    hash = "sha256-tPuAYNi2Gfc/2hj8SFqnvuDztXkSAEoGPcvXVULrLKg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 87017cbbc429..c17b59e72158 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.4.2";
+  version = "18.5.0";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,10 +21,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-jwImYofmGfpnj43FinFmo9SQP6vpM0C4K6fmUECifG0=";
+      hash = "sha256-kVFO8brtXWWGU2nWTtHR1q5RrTIXy2ssra9YjtWsglU=";
     };
 
-    vendorHash = "sha256-DNZgdP7juELUX0cs0tnyqdf1yiUJ0S17nm0xqTk3KHQ=";
+    vendorHash = "sha256-I2YMn84wEAY+Z02bmkyP/b0eix7FW3hP/noyEKYsEaQ=";
 
     ldflags = [
       "-X ${gitaly_package}/internal/version.version=${version}"
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 524e46299197..a460c4c5de58 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@
 
 buildGo124Module rec {
   pname = "gitlab-container-registry";
-  version = "4.28.0";
+  version = "4.29.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGo124Module rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-0v39mQ0wLq2VUYNeDU6E2M8Ny/e/A3VrE8+pmpwJgug=";
+    hash = "sha256-SUhlJi0LEDXl9pwnT2JATtEBIUnCA2yyEaMzDpL/QCM=";
   };
 
-  vendorHash = "sha256-tCOXSZjJOWHTIdWYxdBaH6STKAwqlHsuDfhGd2KPx1Q=";
+  vendorHash = "sha256-Ee9OmKkFrm00BN/V5kuLFbFV/6HkJ4hk7AAXMptTyxs=";
 
   checkFlags =
     let
diff --git a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/code-parser.nix b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/code-parser.nix
index 62188e2a805e..862e2bc81056 100644
--- a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/code-parser.nix
+++ b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/code-parser.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitlab-code-parser";
-  version = "0.16.1";
+  version = "0.19.3";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "rust/gitlab-code-parser";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GskOPKv1Jp3eqd+a9nEwZPfHfOw6luyglPXzJZAPvBc=";
+    hash = "sha256-gwldgZsiHjNafebtgiy5mVAmNNAj0Mz+krz4sI18zj4=";
   };
 
-  cargoHash = "sha256-g6FV8kX3/9wk692FJLNyGNzv3ffE8RWmMYmvmUIqzVs=";
+  cargoHash = "sha256-h6JWOhdjN4Ikwzvuv7PIYmsk1KxJyGHbjibJKVWtExY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
index af33bad7e8b5..f0c06277b1dc 100644
--- a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
+++ b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
@@ -11,17 +11,17 @@ let
 in
 buildGoModule rec {
   pname = "gitlab-elasticsearch-indexer";
-  version = "5.9.1";
+  version = "5.9.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-elasticsearch-indexer";
     rev = "v${version}";
-    hash = "sha256-Xt22fyTM4rfqUpNE6Q3yfT9r4vqME3KmqxYCqUKmnLQ=";
+    hash = "sha256-Vj3QqskgrQIMF9mNY8WzvHL0KCU9Ebr3eDm4mUwQJL0=";
   };
 
-  vendorHash = "sha256-pY8hHFy0AxMwol00BN85jPR0ZnHVgno10Tp+Opz65tQ=";
+  vendorHash = "sha256-nmgRQwjf6F7IkED0S7Q03T6Wad5sEmYLbBHLyA33WjU=";
 
   buildInputs = [ icu ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index a4902b0c87f0..e9ebdcf15885 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,17 +6,17 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.4.2";
+  version = "18.5.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-21VCBUE6wGU7DT98YYPuEz7lw6EMqCfe14mofbai0lk=";
+    hash = "sha256-7jMiKN2L4rF4YyqoJW8pzj5rP5g6ScwZ3qkY+OCZOZ8=";
   };
 
-  vendorHash = "sha256-FdmozSo/eWTnAxrO+/TZOKataLwDkKfwGOXymkRBVCI=";
+  vendorHash = "sha256-VWD/AXqEVWo7G9p1q1BM2LUNwAFmkPm+Gm2s9EPu6nM=";
   subPackages = [ "." ];
 
   ldflags = [
diff --git a/pkgs/by-name/gi/gitlab-runner/package.nix b/pkgs/by-name/gi/gitlab-runner/package.nix
index 19db034432a6..0592229902ec 100644
--- a/pkgs/by-name/gi/gitlab-runner/package.nix
+++ b/pkgs/by-name/gi/gitlab-runner/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-runner";
-  version = "18.4.0";
+  version = "18.5.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kLUQTxj4t6H/by6lzsLmG8S3Ft1QFdUjTa4Y9aCT88o=";
+    hash = "sha256-xuRYnK5Ev2M/vrVWMHcTcK7LLwlQ30MVadMjA67fHpY=";
   };
 
-  vendorHash = "sha256-zXyyfJ3VBBcB3Qfsex2pDcDJIRg/HRgFAytWloHHUnM=";
+  vendorHash = "sha256-5Gh9jQ4GkvtN8inEUphehbsnmfyQldvxjbxBkXQ63wc=";
 
   # For patchShebangs
   buildInputs = [ bash ];
diff --git a/pkgs/by-name/gi/gitlab-shell/package.nix b/pkgs/by-name/gi/gitlab-shell/package.nix
index e93dcc6819c8..4fb8a47b40e2 100644
--- a/pkgs/by-name/gi/gitlab-shell/package.nix
+++ b/pkgs/by-name/gi/gitlab-shell/package.nix
@@ -8,14 +8,14 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.45.2";
+  version = "14.45.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    hash = "sha256-FxtqTRCa1sYSeTR+V2UKEsb480llU6cHWVwNiNFtUmE=";
+    hash = "sha256-S8LtWQgzyDKr4Jnk7Qn/pfLzZYYnVfZNVqNBFyqr5cM=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index b7d743bae841..59c57336b8f2 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,15 +1,16 @@
 {
-  "version": "18.4.2",
-  "repo_hash": "053fw6g1rrqlmgr22phbsv57pg04iy20yv3yvgz1hm4jn2jm0zln",
-  "yarn_hash": "1s9fz2apb7wkpppq14b3020b2pqdah917wblvzk32np8s2dqqc14",
+  "version": "18.5.0",
+  "repo_hash": "0r1q6byqv3zziwsw63z7km5jjap7q6222j91lnr048w6cf425n1w",
+  "yarn_hash": "16f7r4v4mjjdsfbzy5vy1g18p0l3gnjvfvzrl2xrxdibx7a3b4xs",
+  "frontend_islands_yarn_hash": "0kks9hzm5fq3fss9ys8zxls3d3860l1fvsfcrbhf9rccmwvmjn3l",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.4.2-ee",
+  "rev": "v18.5.0-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.4.2",
-    "GITLAB_PAGES_VERSION": "18.4.2",
-    "GITLAB_SHELL_VERSION": "14.45.2",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.9.1",
-    "GITLAB_WORKHORSE_VERSION": "18.4.2"
+    "GITALY_SERVER_VERSION": "18.5.0",
+    "GITLAB_PAGES_VERSION": "18.5.0",
+    "GITLAB_SHELL_VERSION": "14.45.3",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.9.4",
+    "GITLAB_WORKHORSE_VERSION": "18.5.0"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 777e5d397bb6..1e3add758495 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.4.2";
+  version = "18.5.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-R9hI+y4n+6YM0dXIRvNZWwy1gAasdKHBWmFBXJaI1G0=";
+  vendorHash = "sha256-wO+QuWptrcpqy3K3tvYpQQFzlr7A2m2rhPM64Or3qaY=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;
diff --git a/pkgs/by-name/gi/gitlab/package.nix b/pkgs/by-name/gi/gitlab/package.nix
index 525e3338416e..f95125a94964 100644
--- a/pkgs/by-name/gi/gitlab/package.nix
+++ b/pkgs/by-name/gi/gitlab/package.nix
@@ -83,7 +83,7 @@ let
               cp Cargo.lock $out
             '';
           };
-          hash = "sha256-NJLpfIgVgqbf1fHIzEKxzpHOKvtY9QHXVQPpRdvH0Uo=";
+          hash = "sha256-IPVpUj0ixYKQg8ZUKLGcS9RcR2zOWCrqkwJFUF1cmdI=";
         };
 
         dontBuild = false;
@@ -146,6 +146,10 @@ let
       yarnLock = src + "/yarn.lock";
       sha256 = data.yarn_hash;
     };
+    frontendIslandsYarnOfflineCache = fetchYarnDeps {
+      yarnLock = src + "/ee/frontend_islands/apps/duo_next/yarn.lock";
+      sha256 = data.frontend_islands_yarn_hash;
+    };
 
     nativeBuildInputs = [
       rubyEnv.wrappedRuby
@@ -171,6 +175,7 @@ let
     # of rake tasks fails.
     GITLAB_LOG_PATH = "log";
     FOSS_ONLY = !gitlabEnterprise;
+    SKIP_FRONTEND_ISLANDS_BUILD = lib.optionalString (!gitlabEnterprise) "true";
 
     SKIP_YARN_INSTALL = 1;
     NODE_OPTIONS = "--max-old-space-size=8192";
@@ -184,6 +189,26 @@ let
       mv config/gitlab.yml.example config/gitlab.yml
 
       patchShebangs scripts/frontend/
+      patchShebangs scripts/
+    ''
+    + lib.optionalString gitlabEnterprise ''
+      # Get node modules for frontend islands
+      export HOME=$(mktemp -d)
+      pushd ee/frontend_islands/apps/duo_next
+      yarn config --offline set yarn-offline-mirror "$frontendIslandsYarnOfflineCache"
+      fixup-yarn-lock yarn.lock
+      yarn install \
+          --frozen-lockfile \
+          --force \
+          --production=false \
+          --ignore-engines \
+          --ignore-platform \
+          --ignore-scripts \
+          --no-progress \
+          --non-interactive \
+          --offline
+      patchShebangs node_modules
+      popd
     '';
 
     buildPhase = ''
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index 2452d9f209ce..49c314934630 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -161,6 +161,7 @@ gem 'grape-entity', '~> 1.0.1', feature_category: :api
 gem 'grape-swagger', '~> 2.1.2', group: [:development, :test], feature_category: :api
 gem 'grape-swagger-entity', '~> 0.5.5', group: [:development, :test], feature_category: :api
 gem 'grape-path-helpers', '~> 2.0.1', feature_category: :api
+gem 'gitlab-grape-openapi', path: 'gems/gitlab-grape-openapi', feature_category: :api
 gem 'rack-cors', '~> 2.0.1', require: 'rack/cors', feature_category: :shared
 
 # GraphQL API
@@ -175,7 +176,7 @@ gem 'gitlab-topology-service-client', '~> 0.1',
   feature_category: :cell
 
 # Duo Workflow
-gem 'gitlab-duo-workflow-service-client', '~> 0.3',
+gem 'gitlab-duo-workflow-service-client', '~> 0.4',
   path: 'vendor/gems/gitlab-duo-workflow-service-client',
   feature_category: :agent_foundations
 
@@ -223,9 +224,9 @@ gem 'google-cloud-storage', '~> 1.57.0', feature_category: :shared
 gem 'google-apis-core', '~> 0.18.0', '>= 0.18.0', feature_category: :shared
 gem 'google-apis-compute_v1', '~> 0.129.0', feature_category: :shared
 gem 'google-apis-container_v1', '~> 0.100.0', feature_category: :shared
-gem 'google-apis-container_v1beta1', '~> 0.90.0', feature_category: :shared
+gem 'google-apis-container_v1beta1', '~> 0.91.0', feature_category: :shared
 gem 'google-apis-cloudbilling_v1', '~> 0.22.0', feature_category: :shared
-gem 'google-apis-cloudresourcemanager_v1', '~> 0.31.0', feature_category: :shared
+gem 'google-apis-cloudresourcemanager_v1', '~> 0.44.0', feature_category: :shared
 gem 'google-apis-iam_v1', '~> 0.73.0', feature_category: :shared
 gem 'google-apis-serviceusage_v1', '~> 0.28.0', feature_category: :shared
 gem 'google-apis-sqladmin_v1beta4', '~> 0.41.0', feature_category: :shared
@@ -267,10 +268,10 @@ gem 'asciidoctor', '~> 2.0.18', feature_category: :markdown
 gem 'asciidoctor-include-ext', '~> 0.4.0', require: false, feature_category: :markdown
 gem 'asciidoctor-plantuml', '~> 0.0.16', feature_category: :markdown
 gem 'asciidoctor-kroki', '~> 0.10.0', require: false, feature_category: :markdown
-gem 'rouge', '~> 4.6.0', feature_category: :shared
+gem 'rouge', '~> 4.6.1', feature_category: :shared
 gem 'truncato', '~> 0.7.13', feature_category: :team_planning
 gem 'nokogiri', '~> 1.18', feature_category: :shared
-gem 'gitlab-glfm-markdown', '~> 0.0.33', feature_category: :markdown
+gem 'gitlab-glfm-markdown', '~> 0.0.36', feature_category: :markdown
 gem 'tanuki_emoji', '~> 0.13', feature_category: :markdown
 gem 'unicode-emoji', '~> 4.0', feature_category: :markdown
 
@@ -380,7 +381,7 @@ gem 'rack-proxy', '~> 0.7.7', feature_category: :shared
 gem 'cssbundling-rails', '1.4.3', feature_category: :shared
 gem 'terser', '1.0.2', feature_category: :shared
 
-gem 'click_house-client', '0.5.1', feature_category: :database
+gem 'click_house-client', '0.8.0', feature_category: :database
 gem 'addressable', '~> 2.8', feature_category: :shared
 gem 'gon', '~> 6.5.0', feature_category: :shared
 gem 'request_store', '~> 1.7.0', feature_category: :shared
@@ -403,7 +404,7 @@ gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation', feature_c
 gem 'gitlab-http', path: 'gems/gitlab-http', feature_category: :shared
 
 gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications
-gem 'gitlab-labkit', '~> 0.40.0', feature_category: :shared
+gem 'gitlab-labkit', '~> 0.42.0', feature_category: :shared
 gem 'thrift', '~> 0.22.0', feature_category: :shared
 
 # I18n
@@ -430,7 +431,7 @@ gem 'prometheus-client-mmap', '~> 1.2.9', require: 'prometheus/client', feature_
 
 # Event-driven reactor for Ruby
 # Required manually in config/initializers/require_async_gem
-gem 'async', '~> 2.28.0', require: false, feature_category: :shared
+gem 'async', '~> 2.32.0', require: false, feature_category: :shared
 gem 'io-event', '~> 1.12', require: false, feature_category: :shared
 
 # Security report schemas used to validate CI job artifacts of security jobs
@@ -473,7 +474,7 @@ end
 gem 'warning', '~> 1.5.0', feature_category: :shared
 
 group :development do
-  gem 'lefthook', '~> 1.12.0', require: false, feature_category: :tooling
+  gem 'lefthook', '~> 1.13.0', require: false, feature_category: :tooling
   gem 'rubocop', feature_category: :tooling, require: false
   gem 'debug', '~> 1.11.0', feature_category: :shared
 
@@ -490,11 +491,11 @@ group :development do
 
   gem 'listen', '~> 3.7', feature_category: :shared
 
-  gem 'ruby-lsp', "~> 0.23.0", require: false, feature_category: :tooling
+  gem 'ruby-lsp', "~> 0.26.0", require: false, feature_category: :tooling
 
-  gem 'ruby-lsp-rails', "~> 0.3.6", feature_category: :tooling
+  gem 'ruby-lsp-rails', "~> 0.4.8", feature_category: :tooling
 
-  gem 'ruby-lsp-rspec', "~> 0.1.10", require: false, feature_category: :tooling
+  gem 'ruby-lsp-rspec', "~> 0.1.27", require: false, feature_category: :tooling
 
   gem 'gdk-toogle', '~> 0.9', '>= 0.9.5', require: 'toogle', feature_category: :tooling
 
@@ -512,7 +513,7 @@ group :development, :test do
   gem 'pry-rails', '~> 0.3.9', feature_category: :shared
   gem 'pry-shell', '~> 0.6.4', feature_category: :shared
 
-  gem 'awesome_print', require: false, feature_category: :shared
+  gem 'amazing_print', require: false, feature_category: :shared
 
   gem 'database_cleaner-active_record', '~> 2.2.0', feature_category: :database
   gem 'rspec-rails', '~> 7.1.0', feature_category: :shared
@@ -634,7 +635,7 @@ gem 'sys-filesystem', '~> 1.4.3', feature_category: :shared
 gem 'net-ntp', feature_category: :shared
 
 # SSH keys support
-gem 'ssh_data', '~> 1.3', feature_category: :shared
+gem 'ssh_data', '~> 2.0', feature_category: :shared
 
 # Spamcheck GRPC protocol definitions
 gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat
@@ -643,9 +644,9 @@ gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat
 gem 'gitaly', '~> 18.4.0.pre.rc1', feature_category: :gitaly
 
 # KAS GRPC protocol definitions
-gem 'gitlab-kas-grpc', '~> 18.3.0', feature_category: :deployment_management
+gem 'gitlab-kas-grpc', '~> 18.5.0-rc4', feature_category: :deployment_management
 
-gem 'grpc', '~> 1.74.0', feature_category: :shared
+gem 'grpc', '~> 1.75.0', feature_category: :shared
 
 gem 'google-protobuf', '~> 3.25', '>= 3.25.3', feature_category: :shared
 
@@ -656,7 +657,7 @@ gem 'flipper', '~> 0.28.0', feature_category: :shared
 gem 'flipper-active_record', '~> 0.28.0', feature_category: :shared
 gem 'flipper-active_support_cache_store', '~> 0.28.0', feature_category: :shared
 gem 'unleash', '~> 3.2.2', feature_category: :shared
-gem 'gitlab-experiment', '~> 0.9.1', feature_category: :shared
+gem 'gitlab-experiment', '~> 1.0.0', feature_category: :shared
 
 # Structured logging
 gem 'lograge', '~> 0.5', feature_category: :shared
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index fe11d3cd5bce..cf4481484644 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -49,7 +49,7 @@ PATH
       google-cloud-storage_transfer (~> 1.2.0)
       google-protobuf (~> 3.25, >= 3.25.3)
       googleauth (~> 1.14)
-      grpc (~> 1.74.0)
+      grpc (~> 1.75)
       json (~> 2.7)
       jwt (~> 2.5)
       logger (~> 1.5)
@@ -62,12 +62,19 @@ PATH
       rexml (~> 3.4.0)
       thor (~> 1.3)
 
+PATH
+  remote: gems/gitlab-grape-openapi
+  specs:
+    gitlab-grape-openapi (0.1.0)
+      grape (~> 2.0.0)
+      grape-entity (~> 1.0.1)
+
 PATH
   remote: gems/gitlab-housekeeper
   specs:
     gitlab-housekeeper (0.1.0)
       activesupport
-      awesome_print
+      amazing_print
       httparty
       rubocop
 
@@ -149,7 +156,7 @@ PATH
 PATH
   remote: vendor/gems/gitlab-duo-workflow-service-client
   specs:
-    gitlab-duo-workflow-service-client (0.3)
+    gitlab-duo-workflow-service-client (0.5)
       grpc
 
 PATH
@@ -203,7 +210,7 @@ GEM
       nkf
       rexml
     RedCloth (4.3.4)
-    acme-client (2.0.25)
+    acme-client (2.0.26)
       base64 (~> 0.2)
       faraday (>= 1.0, < 3.0.0)
       faraday-retry (>= 1.0, < 3.0.0)
@@ -294,6 +301,7 @@ GEM
     amatch (0.4.1)
       mize
       tins (~> 1.0)
+    amazing_print (1.8.1)
     android_key_attestation (0.3.0)
     apollo_upload_server (2.1.6)
       actionpack (>= 6.1.6)
@@ -311,7 +319,7 @@ GEM
     asciidoctor-plantuml (0.0.16)
       asciidoctor (>= 2.0.17, < 3.0.0)
     ast (2.4.2)
-    async (2.28.0)
+    async (2.32.0)
       console (~> 1.29)
       fiber-annotation
       io-event (~> 1.11)
@@ -364,7 +372,7 @@ GEM
     base64 (0.2.0)
     batch-loader (2.0.5)
     bcrypt (3.1.20)
-    benchmark (0.4.0)
+    benchmark (0.4.1)
     benchmark-ips (2.14.0)
     benchmark-malloc (0.2.0)
     benchmark-memory (0.2.0)
@@ -375,14 +383,14 @@ GEM
       erubi (>= 1.0.0)
       rack (>= 0.9.0)
       rouge (>= 1.0.0)
-    bigdecimal (3.1.7)
+    bigdecimal (3.2.3)
     bindata (2.4.11)
     binding_of_caller (1.0.0)
       debug_inspector (>= 0.0.1)
     bootsnap (1.18.6)
       msgpack (~> 1.2)
     browser (5.3.1)
-    builder (3.2.4)
+    builder (3.3.0)
     bullet (8.0.8)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
@@ -424,7 +432,7 @@ GEM
       cork
       nap
       open4 (~> 1.3)
-    click_house-client (0.5.1)
+    click_house-client (0.8.0)
       activerecord (>= 7.0, < 9.0)
       activesupport (>= 7.0, < 9.0)
       addressable (~> 2.8)
@@ -433,7 +441,7 @@ GEM
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
     colored2 (3.1.2)
-    commonmarker (0.23.11)
+    commonmarker (0.23.12)
     concurrent-ruby (1.3.5)
     connection_pool (2.5.4)
     console (1.29.2)
@@ -477,9 +485,9 @@ GEM
     danger-gitlab (8.0.0)
       danger
       gitlab (~> 4.2, >= 4.2.0)
-    database_cleaner-active_record (2.2.1)
+    database_cleaner-active_record (2.2.2)
       activerecord (>= 5.a)
-      database_cleaner-core (~> 2.0.0)
+      database_cleaner-core (~> 2.0)
     database_cleaner-core (2.0.1)
     date (3.4.1)
     deb_version (1.0.2)
@@ -545,15 +553,18 @@ GEM
     dotenv (2.7.6)
     drb (2.2.3)
     dry-cli (1.0.0)
-    dry-core (1.0.1)
+    dry-core (1.1.0)
       concurrent-ruby (~> 1.0)
+      logger
       zeitwerk (~> 2.6)
-    dry-inflector (1.0.0)
-    dry-logic (1.5.0)
+    dry-inflector (1.2.0)
+    dry-logic (1.6.0)
+      bigdecimal
       concurrent-ruby (~> 1.0)
-      dry-core (~> 1.0, < 2)
+      dry-core (~> 1.1)
       zeitwerk (~> 2.6)
-    dry-types (1.7.1)
+    dry-types (1.8.3)
+      bigdecimal (~> 3.0)
       concurrent-ruby (~> 1.0)
       dry-core (~> 1.0)
       dry-inflector (~> 1.0)
@@ -630,7 +641,7 @@ GEM
     fast_gettext (4.1.0)
       prime
       racc
-    ffaker (2.24.0)
+    ffaker (2.25.0)
     ffi (1.17.2)
     ffi-compiler (1.0.1)
       ffi (>= 1.0.0)
@@ -719,14 +730,14 @@ GEM
     git (1.19.1)
       addressable (~> 2.8)
       rchardet (~> 1.8)
-    gitaly (18.4.0.pre.rc1)
+    gitaly (18.4.1)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
       terminal-table (>= 1.5.1)
     gitlab-chronic (0.10.6)
       numerizer (~> 0.2)
-    gitlab-cloud-connector (1.32.0)
+    gitlab-cloud-connector (1.33.0)
       activesupport (~> 7.0)
       jwt (~> 2.9)
     gitlab-crystalball (1.1.1)
@@ -736,7 +747,7 @@ GEM
       danger (>= 9.3.0)
       danger-gitlab (>= 8.0.0)
       rake (~> 13.0)
-    gitlab-experiment (0.9.1)
+    gitlab-experiment (1.0.0)
       activesupport (>= 3.0)
       request_store (>= 1.0)
     gitlab-fog-azure-rm (2.4.0)
@@ -748,11 +759,11 @@ GEM
       mime-types
       net-http-persistent (~> 4.0)
       nokogiri (~> 1, >= 1.10.8)
-    gitlab-glfm-markdown (0.0.33)
+    gitlab-glfm-markdown (0.0.36)
       rb_sys (~> 0.9.109)
-    gitlab-kas-grpc (18.3.2)
+    gitlab-kas-grpc (18.5.0.pre.rc4)
       grpc (~> 1.0)
-    gitlab-labkit (0.40.0)
+    gitlab-labkit (0.42.0)
       actionpack (>= 5.0.0, < 8.1.0)
       activesupport (>= 5.0.0, < 8.1.0)
       google-protobuf (~> 3)
@@ -777,7 +788,7 @@ GEM
       activesupport (>= 5.2.0)
       rake (~> 13.0)
       snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.33.3)
+    gitlab-secret_detection (0.35.1)
       grpc (>= 1.63.0, < 2)
       grpc_reflection (~> 0.1)
       parallel (~> 1)
@@ -805,7 +816,7 @@ GEM
       omniauth (>= 1.3, < 3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (2.20.0)
+    gitlab_quality-test_tooling (2.20.3)
       activesupport (>= 7.0, < 7.3)
       amatch (~> 0.4.1)
       fog-google (~> 1.24, >= 1.24.1)
@@ -831,13 +842,13 @@ GEM
       google-apis-core (>= 0.15.0, < 2.a)
     google-apis-cloudbilling_v1 (0.22.0)
       google-apis-core (>= 0.9.1, < 2.a)
-    google-apis-cloudresourcemanager_v1 (0.31.0)
-      google-apis-core (>= 0.9.1, < 2.a)
+    google-apis-cloudresourcemanager_v1 (0.44.0)
+      google-apis-core (>= 0.15.0, < 2.a)
     google-apis-compute_v1 (0.129.0)
       google-apis-core (>= 0.15.0, < 2.a)
     google-apis-container_v1 (0.100.0)
       google-apis-core (>= 0.15.0, < 2.a)
-    google-apis-container_v1beta1 (0.90.0)
+    google-apis-container_v1beta1 (0.91.0)
       google-apis-core (>= 0.15.0, < 2.a)
     google-apis-core (0.18.0)
       addressable (~> 2.5, >= 2.5.1)
@@ -964,7 +975,7 @@ GEM
       logger (~> 1.6)
       ostruct (~> 0.6)
       sass-embedded (~> 1.58)
-    grpc (1.74.1)
+    grpc (1.75.0)
       google-protobuf (>= 3.25, < 5.0)
       googleapis-common-protos-types (~> 1.0)
     grpc-google-iam-v1 (1.5.0)
@@ -992,7 +1003,7 @@ GEM
     haml (5.2.2)
       temple (>= 0.8.0)
       tilt
-    haml_lint (0.64.0)
+    haml_lint (0.66.0)
       haml (>= 5.0)
       parallel (~> 1.10)
       rainbow
@@ -1003,7 +1014,7 @@ GEM
       thor
       tilt
     hana (1.3.7)
-    hashdiff (1.2.0)
+    hashdiff (1.2.1)
     hashie (5.0.0)
     health_check (3.1.0)
       railties (>= 5.0)
@@ -1030,7 +1041,7 @@ GEM
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.14.4)
+    i18n (1.14.7)
       concurrent-ruby (~> 1.0)
     i18n_data (0.13.1)
     icalendar (2.10.3)
@@ -1112,10 +1123,10 @@ GEM
       jsonpath (~> 1.0)
       recursive-open-struct (~> 1.1, >= 1.1.1)
       rest-client (~> 2.0)
-    language_server-protocol (3.17.0.3)
+    language_server-protocol (3.17.0.5)
     launchy (2.5.2)
       addressable (~> 2.8)
-    lefthook (1.12.3)
+    lefthook (1.13.0)
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
     letter_opener_web (3.0.0)
@@ -1188,7 +1199,7 @@ GEM
     mini_histogram (0.3.1)
     mini_magick (4.13.2)
     mini_mime (1.1.2)
-    mini_portile2 (2.8.8)
+    mini_portile2 (2.8.9)
     minitest (5.11.3)
     mixlib-cli (2.1.8)
     mixlib-config (3.0.27)
@@ -1203,7 +1214,7 @@ GEM
     multi_xml (0.6.0)
     multipart-post (2.2.3)
     murmurhash3 (0.1.7)
-    mustermann (3.0.0)
+    mustermann (3.0.4)
       ruby2_keywords (~> 0.0.1)
     mustermann-grape (1.0.2)
       mustermann (>= 1.0.0)
@@ -1232,7 +1243,7 @@ GEM
     nio4r (2.7.0)
     nkf (0.2.0)
     no_proxy_fix (0.1.2)
-    nokogiri (1.18.9)
+    nokogiri (1.18.10)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     notiffany (0.1.3)
@@ -1270,8 +1281,9 @@ GEM
       ostruct (>= 0.2)
     oj-introspect (0.8.0)
       oj (>= 3.16.10)
-    omniauth (2.1.3)
+    omniauth (2.1.4)
       hashie (>= 3.4.6)
+      logger
       rack (>= 2.2.3)
       rack-protection
     omniauth-alicloud (3.0.0)
@@ -1323,7 +1335,7 @@ GEM
     opensearch-ruby (3.4.0)
       faraday (>= 1.0, < 3)
       multi_json (>= 1.0)
-    openssl (3.3.0)
+    openssl (3.3.1)
     openssl-signature_algorithm (1.3.0)
       openssl (> 2.0)
     opentelemetry-api (1.2.5)
@@ -1496,7 +1508,7 @@ GEM
     prime (0.1.3)
       forwardable
       singleton
-    prism (1.2.0)
+    prism (1.4.0)
     proc_to_ast (0.1.0)
       coderay
       parser
@@ -1527,7 +1539,7 @@ GEM
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
     racc (1.8.1)
-    rack (2.2.17)
+    rack (2.2.18)
     rack-accept (0.4.5)
       rack (>= 0.4)
     rack-attack (6.7.0)
@@ -1597,7 +1609,7 @@ GEM
       ffi (~> 1.0)
     rb_sys (0.9.110)
       rake-compiler-dock (= 1.9.1)
-    rbs (3.6.1)
+    rbs (3.9.5)
       logger
     rbtrace (0.5.2)
       ffi (>= 1.0.6)
@@ -1606,8 +1618,8 @@ GEM
     rchardet (1.8.0)
     rdoc (6.13.0)
       psych (>= 4.0.0)
-    re2 (2.19.0)
-      mini_portile2 (~> 2.8.7)
+    re2 (2.20.0)
+      mini_portile2 (~> 2.8.9)
     recaptcha (5.12.3)
       json
     recursive-open-struct (1.1.3)
@@ -1618,7 +1630,7 @@ GEM
       actionpack (>= 5)
       redis-rack (>= 2.1.0, < 4)
       redis-store (>= 1.1.0, < 2)
-    redis-client (0.25.3)
+    redis-client (0.26.1)
       connection_pool
     redis-cluster-client (0.13.5)
       redis-client (~> 0.24)
@@ -1653,10 +1665,10 @@ GEM
     retriable (3.1.2)
     reverse_markdown (3.0.0)
       nokogiri
-    rexml (3.4.2)
+    rexml (3.4.4)
     rinku (2.0.0)
     rotp (6.3.0)
-    rouge (4.6.0)
+    rouge (4.6.1)
     rqrcode (2.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 1.0)
@@ -1737,15 +1749,14 @@ GEM
     rubocop-rspec_rails (2.30.0)
       rubocop (~> 1.61)
       rubocop-rspec (~> 3, >= 3.0.1)
-    ruby-lsp (0.23.20)
+    ruby-lsp (0.26.1)
       language_server-protocol (~> 3.17.0)
       prism (>= 1.2, < 2.0)
-      rbs (>= 3, < 4)
-      sorbet-runtime (>= 0.5.10782)
-    ruby-lsp-rails (0.3.31)
-      ruby-lsp (>= 0.23.0, < 0.24.0)
-    ruby-lsp-rspec (0.1.24)
-      ruby-lsp (~> 0.23.19)
+      rbs (>= 3, < 5)
+    ruby-lsp-rails (0.4.8)
+      ruby-lsp (>= 0.26.0, < 0.27.0)
+    ruby-lsp-rspec (0.1.27)
+      ruby-lsp (~> 0.26.0)
     ruby-magic (0.6.0)
       mini_portile2 (~> 2.8)
     ruby-progressbar (1.11.0)
@@ -1853,9 +1864,8 @@ GEM
       tilt (~> 2.0)
       yard (~> 0.9, >= 0.9.24)
       yard-solargraph (~> 0.1)
-    solargraph-rspec (0.5.2)
-      solargraph (~> 0.52, >= 0.52.0)
-    sorbet-runtime (0.5.11647)
+    solargraph-rspec (0.5.4)
+      solargraph (>= 0.52.0)
     spamcheck (1.3.3)
       grpc (~> 1.63)
     spring (4.3.0)
@@ -1870,7 +1880,8 @@ GEM
       actionpack (>= 6.1)
       activesupport (>= 6.1)
       sprockets (>= 3.0.0)
-    ssh_data (1.3.0)
+    ssh_data (2.0.0)
+      base64 (~> 0.1)
     ssrf_filter (1.0.8)
     stackprof (0.2.27)
     state_machines (0.5.0)
@@ -2060,7 +2071,7 @@ GEM
     yard (0.9.37)
     yard-solargraph (0.1.0)
       yard (~> 0.9)
-    zeitwerk (2.6.7)
+    zeitwerk (2.7.3)
 
 PLATFORMS
   ruby
@@ -2072,6 +2083,7 @@ DEPENDENCIES
   activerecord-gitlab!
   addressable (~> 2.8)
   akismet (~> 3.0)
+  amazing_print
   apollo_upload_server (~> 2.1.6)
   app_store_connect
   arr-pm (~> 0.0.12)
@@ -2079,10 +2091,9 @@ DEPENDENCIES
   asciidoctor-include-ext (~> 0.4.0)
   asciidoctor-kroki (~> 0.10.0)
   asciidoctor-plantuml (~> 0.0.16)
-  async (~> 2.28.0)
+  async (~> 2.32.0)
   atlassian-jwt (~> 0.2.1)
   attr_encrypted (~> 4.2)
-  awesome_print
   aws-sdk-cloudformation (~> 1)
   aws-sdk-core (~> 3.226.0)
   aws-sdk-s3 (~> 1.193.0)
@@ -2104,7 +2115,7 @@ DEPENDENCIES
   carrierwave (~> 1.3)
   charlock_holmes (~> 0.7.9)
   circuitbox (= 2.0.0)
-  click_house-client (= 0.5.1)
+  click_house-client (= 0.8.0)
   commonmarker (~> 0.23.10)
   concurrent-ruby (~> 1.1)
   connection_pool (~> 2.5.3)
@@ -2168,14 +2179,15 @@ DEPENDENCIES
   gitlab-cloud-connector (~> 1.26)
   gitlab-crystalball (~> 1.1.0)
   gitlab-dangerfiles (~> 4.10.0)
-  gitlab-duo-workflow-service-client (~> 0.3)!
-  gitlab-experiment (~> 0.9.1)
+  gitlab-duo-workflow-service-client (~> 0.4)!
+  gitlab-experiment (~> 1.0.0)
   gitlab-fog-azure-rm (~> 2.4.0)
-  gitlab-glfm-markdown (~> 0.0.33)
+  gitlab-glfm-markdown (~> 0.0.36)
+  gitlab-grape-openapi!
   gitlab-housekeeper!
   gitlab-http!
-  gitlab-kas-grpc (~> 18.3.0)
-  gitlab-labkit (~> 0.40.0)
+  gitlab-kas-grpc (~> 18.5.0.pre.rc4)
+  gitlab-labkit (~> 0.42.0)
   gitlab-license (~> 2.6)
   gitlab-mail_room (~> 0.0.24)
   gitlab-markup (~> 2.0.0)
@@ -2197,10 +2209,10 @@ DEPENDENCIES
   gon (~> 6.5.0)
   google-apis-androidpublisher_v3 (~> 0.86.0)
   google-apis-cloudbilling_v1 (~> 0.22.0)
-  google-apis-cloudresourcemanager_v1 (~> 0.31.0)
+  google-apis-cloudresourcemanager_v1 (~> 0.44.0)
   google-apis-compute_v1 (~> 0.129.0)
   google-apis-container_v1 (~> 0.100.0)
-  google-apis-container_v1beta1 (~> 0.90.0)
+  google-apis-container_v1beta1 (~> 0.91.0)
   google-apis-core (~> 0.18.0, >= 0.18.0)
   google-apis-iam_v1 (~> 0.73.0)
   google-apis-serviceusage_v1 (~> 0.28.0)
@@ -2222,7 +2234,7 @@ DEPENDENCIES
   graphlyte (~> 1.0.0)
   graphql (= 2.5.11)
   graphql-docs (~> 5.2.0)
-  grpc (~> 1.74.0)
+  grpc (~> 1.75.0)
   gssapi (~> 1.3.1)
   guard-rspec
   haml_lint (~> 0.58)
@@ -2249,7 +2261,7 @@ DEPENDENCIES
   knapsack (~> 4.0.0)
   kramdown (~> 2.5.0)
   kubeclient (~> 4.12.0)
-  lefthook (~> 1.12.0)
+  lefthook (~> 1.13.0)
   letter_opener_web (~> 3.0.0)
   license_finder (~> 7.0)
   licensee (~> 9.16)
@@ -2361,7 +2373,7 @@ DEPENDENCIES
   responders (~> 3.0)
   retriable (~> 3.1.2)
   rexml (~> 3.4.0)
-  rouge (~> 4.6.0)
+  rouge (~> 4.6.1)
   rqrcode (~> 2.2)
   rspec-benchmark (~> 0.6.0)
   rspec-parameterized (~> 1.0, >= 1.0.2)
@@ -2370,9 +2382,9 @@ DEPENDENCIES
   rspec_junit_formatter
   rspec_profiling (~> 0.0.9)
   rubocop
-  ruby-lsp (~> 0.23.0)
-  ruby-lsp-rails (~> 0.3.6)
-  ruby-lsp-rspec (~> 0.1.10)
+  ruby-lsp (~> 0.26.0)
+  ruby-lsp-rails (~> 0.4.8)
+  ruby-lsp-rspec (~> 0.1.27)
   ruby-magic (~> 0.6)
   ruby-progressbar (~> 1.10)
   ruby-saml (~> 1.18)
@@ -2404,7 +2416,7 @@ DEPENDENCIES
   sprite-factory (~> 1.7)
   sprockets (~> 3.7.0)
   sprockets-rails (~> 3.5.1)
-  ssh_data (~> 1.3)
+  ssh_data (~> 2.0)
   stackprof (~> 0.2.26)
   state_machines-activerecord (~> 0.8.0)
   state_machines-rspec (~> 0.6)
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 7d093a838c87..1f5b15a95a5a 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -9,10 +9,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0c8gxs7vhsl0hi7wnyd9wi3aqmqkm0y77y1k17z9zzc5yywsgfz0";
+      sha256 = "1g93cpxhk3n0lp42accb7b76km2di300lw9zpsrb2rigvnjmw3h6";
       type = "gem";
     };
-    version = "2.0.25";
+    version = "2.0.26";
   };
   actioncable = {
     dependencies = [
@@ -336,6 +336,19 @@ src: {
     };
     version = "0.4.1";
   };
+  amazing_print = {
+    groups = [
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0s3d1nf5afapjrk8746c8qfydl17l33l0a12rdircgzmh4c4wfzm";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
   android_key_attestation = {
     groups = [ "default" ];
     platforms = [ ];
@@ -454,10 +467,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0vhmmn7n92ilvkvbdbav85hyg8w047zm20vbfzk502g0j495sv4n";
+      sha256 = "11s733zhjvriqbzca85ry29j33p3y7n24xjwwvjyga4rba5brzvr";
       type = "gem";
     };
-    version = "2.28.0";
+    version = "2.32.0";
   };
   atlassian-jwt = {
     dependencies = [ "jwt" ];
@@ -734,10 +747,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jl71qcgamm96dzyqk695j24qszhcc7liw74qc83fpjljp2gh4hg";
+      sha256 = "1kicilpma5l0lwayqjb5577bm0hbjndj2gh150xz09xsgc1l1vyl";
       type = "gem";
     };
-    version = "0.4.0";
+    version = "0.4.1";
   };
   benchmark-ips = {
     groups = [
@@ -821,14 +834,20 @@ src: {
     version = "2.10.1";
   };
   bigdecimal = {
-    groups = [ "default" ];
+    groups = [
+      "coverage"
+      "default"
+      "development"
+      "monorepo"
+      "test"
+    ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cq1c29zbkcxgdihqisirhcw76xc768z2zpd5vbccpq0l1lv76g7";
+      sha256 = "06sfv80bmxfczkqi3pb3yc9zicqhf94adh5f8hpkn3bsqqd1vlgz";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.2.3";
   };
   bindata = {
     groups = [ "default" ];
@@ -879,15 +898,16 @@ src: {
     groups = [
       "default"
       "development"
+      "monorepo"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
+      sha256 = "0pw3r2lyagsxkm71bf44v5b74f7l9r7di22brbyji9fwz791hya9";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.3.0";
   };
   bullet = {
     dependencies = [
@@ -1128,10 +1148,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0s9dgq9k6caappqr6y6vbzx3d8pmcb58cbp37am9slmfyvq2l0hh";
+      sha256 = "166j9r2pn6hbqqhgjx37c245yhd60dz00jphp18snrsfcxx841ds";
       type = "gem";
     };
-    version = "0.5.1";
+    version = "0.8.0";
   };
   coderay = {
     groups = [
@@ -1190,10 +1210,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1gyjwd7in1nlf8zai2fxazxi8cy6xjzswdcjway520blb39ka7cx";
+      sha256 = "1k9wa8fnfz08lyn86vpqhdv4jffznlxcx6p6qr11rdf7qy4jybfs";
       type = "gem";
     };
-    version = "0.23.11";
+    version = "0.23.12";
   };
   concurrent-ruby = {
     groups = [
@@ -1451,10 +1471,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jxzgg3yccp3gjncl5ih0y13dcappmy0y8pq85wgjj0yx5fh0ixy";
+      sha256 = "1203q6zdw14vwmnr2hw0d6b1rdz4d07w3kjg1my1zhw862gnnac8";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.2.2";
   };
   database_cleaner-core = {
     groups = [
@@ -1821,6 +1841,7 @@ src: {
   dry-core = {
     dependencies = [
       "concurrent-ruby"
+      "logger"
       "zeitwerk"
     ];
     groups = [
@@ -1831,10 +1852,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03a5qn74c4lk2rpy6wlhv66synjlyzc4wn086xzphkpmw12l4bzk";
+      sha256 = "15di39ssfkwigyyqla65n4x6cfhgwa4cv8j5lmyrlr07jwd840q9";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.1.0";
   };
   dry-inflector = {
     groups = [
@@ -1845,13 +1866,14 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09hnvna3lg2x36li63988kv664d0zvy7y0z33803yvrdr9hj7lka";
+      sha256 = "0blgyg9l4gpzhb7rs9hqq9j7br80ngiigjp2ayp78w6m1ysx1x92";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.2.0";
   };
   dry-logic = {
     dependencies = [
+      "bigdecimal"
       "concurrent-ruby"
       "dry-core"
       "zeitwerk"
@@ -1864,13 +1886,14 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05nldkc154r0qzlhss7n5klfiyyz05x2fkq08y13s34py6023vcr";
+      sha256 = "18nf8mbnhgvkw34drj7nmvpx2afmyl2nyzncn3wl3z4h1yyfsvys";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.6.0";
   };
   dry-types = {
     dependencies = [
+      "bigdecimal"
       "concurrent-ruby"
       "dry-core"
       "dry-inflector"
@@ -1885,10 +1908,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1f6dz0hm67rhybh6xq2s3vvr700cp43kf50z2lids62s2i0mh5hj";
+      sha256 = "1g61cnmmwzff05sf8bh95qjd3hikasgvrmf3q0qk29zdw12pmndm";
       type = "gem";
     };
-    version = "1.7.1";
+    version = "1.8.3";
   };
   dumb_delegator = {
     groups = [
@@ -2346,10 +2369,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ljxb9kqssp70waz0an1ppm33821r0dbvs4b75qbqbv05p0ziqs3";
+      sha256 = "0h7crcdqddlds3kx0q3vsx3cm6s62psvfx98crasqnhrz2nwb1g4";
       type = "gem";
     };
-    version = "2.24.0";
+    version = "2.25.0";
   };
   ffi = {
     groups = [
@@ -2762,10 +2785,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0677zbflbjvmxbf6riczscjl6g3pqdh5xb1f783d4lfhdi43rbg4";
+      sha256 = "1qg3kc103v767hjw77wcx5mwx5dg2b6vlhxk3bb4hpbsjqgm4mf3";
       type = "gem";
     };
-    version = "18.4.0.pre.rc1";
+    version = "18.4.1";
   };
   gitlab = {
     dependencies = [
@@ -2859,10 +2882,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0h9kfc8ni6lc0jy5r8hvs1768130adq75pnn4vy7jfl7fk7683yp";
+      sha256 = "0bvjvc2yvc2sjn4f6lgww46gw39pb1ripsl5a6rq6wldfahvp7mw";
       type = "gem";
     };
-    version = "1.32.0";
+    version = "1.33.0";
   };
   gitlab-crystalball = {
     dependencies = [
@@ -2908,7 +2931,7 @@ src: {
       path = "${src}/vendor/gems/gitlab-duo-workflow-service-client";
       type = "path";
     };
-    version = "0.3";
+    version = "0.5";
   };
   gitlab-experiment = {
     dependencies = [
@@ -2919,10 +2942,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0j0zs29izmhqc1jvgfsvikqdyg6r8kf3j9azbmsmm02l45sfwc7j";
+      sha256 = "1fgar7p0rpi0ycqdccrzxz8lvxzm78zi95xy642jy09hbpjnzxwz";
       type = "gem";
     };
-    version = "0.9.1";
+    version = "1.0.0";
   };
   gitlab-fog-azure-rm = {
     dependencies = [
@@ -2950,15 +2973,28 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pr1lqa5s4xrl5lxqw2sq5c3kdqlrlpxl9x9ybvf1lmpygkbcnmc";
+      sha256 = "12r3g7fb7wbhykmjn1n6b0jiyb26bma0x89wcm8ac4phz8aqhm6j";
       type = "gem";
     };
-    version = "0.0.33";
+    version = "0.0.36";
+  };
+  gitlab-grape-openapi = {
+    dependencies = [
+      "grape"
+      "grape-entity"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      path = "${src}/gems/gitlab-grape-openapi";
+      type = "path";
+    };
+    version = "0.1.0";
   };
   gitlab-housekeeper = {
     dependencies = [
       "activesupport"
-      "awesome_print"
+      "amazing_print"
       "httparty"
       "rubocop"
     ];
@@ -2996,10 +3032,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k0jbpfycg23pm8gddwzxj8b1wpvqisxc6dd33xxr2f7canr8bx8";
+      sha256 = "1imwvsfzd040pjkwid8xb5s5bdjy51mq68hcx4pasaspaz4qpzlf";
       type = "gem";
     };
-    version = "18.3.2";
+    version = "18.5.0.pre.rc4";
   };
   gitlab-labkit = {
     dependencies = [
@@ -3018,10 +3054,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0awcb5bb9y1y61yzzvj5gkm03w232njym7cdw0s2gpgwh37q6pyg";
+      sha256 = "07xbjd5vap486vspzz164hf2j5x0v9g4q6j0whzlh3ak1svqb22j";
       type = "gem";
     };
-    version = "0.40.0";
+    version = "0.42.0";
   };
   gitlab-license = {
     groups = [ "default" ];
@@ -3161,10 +3197,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0h7wf8p369zqw51ikychqsii2kh9f920jwhr4b352p1sd1a59qf8";
+      sha256 = "0s9akkxm69i9mlcl5n3ikv9dy678cqqa3jl3cq785653gcx8p8ww";
       type = "gem";
     };
-    version = "0.33.3";
+    version = "0.35.1";
   };
   gitlab-security_report_schemas = {
     dependencies = [
@@ -3291,10 +3327,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xxi1grl13663cwmpqvyq75carn05nd8ns26aq34xjqmk0gc8j9c";
+      sha256 = "0b3db3p68b8h2089rhi5z3m927xkv4vcxa998v17lmspj2496wra";
       type = "gem";
     };
-    version = "2.20.0";
+    version = "2.20.3";
   };
   globalid = {
     dependencies = [ "activesupport" ];
@@ -3369,10 +3405,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1gzv5svbj62qcdw5ljva0sh8wifjx9wwx00kfj9bbff052i7597h";
+      sha256 = "1y05cy0h486lrdbl5vv3vpv2nh6pkizqa937v1yl0r46y8zp55my";
       type = "gem";
     };
-    version = "0.31.0";
+    version = "0.44.0";
   };
   google-apis-compute_v1 = {
     dependencies = [ "google-apis-core" ];
@@ -3405,10 +3441,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jbb5zqv7krxy60iylrnwb9qz0brbgj2m66w5kdhq040ww0760lx";
+      sha256 = "16f2ylvlyby4vzxn03ajqd4bnd6gcz5gxqs4gdi5jq47yi5ncfcn";
       type = "gem";
     };
-    version = "0.90.0";
+    version = "0.91.0";
   };
   google-apis-core = {
     dependencies = [
@@ -3946,10 +3982,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12qy6yga90hs2pdzkxwm80d38dbmjdxmf2szqwb40ky1jr4klfp7";
+      sha256 = "1na1h7nkc9s9s33g1pliml1nm3dq56ffwp9ajs95kpazbplbcd79";
       type = "gem";
     };
-    version = "1.74.1";
+    version = "1.75.0";
   };
   grpc-google-iam-v1 = {
     dependencies = [
@@ -4072,10 +4108,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1gvkhb18inkwkf9ja1i774975l259dzlvcvjii3zfyzmzylki5qb";
+      sha256 = "1v64nbbckmfgi7b5c5j609mpcdyhbf7gav3n99xjy5fpyca7hpab";
       type = "gem";
     };
-    version = "0.64.0";
+    version = "0.66.0";
   };
   hamlit = {
     dependencies = [
@@ -4110,10 +4146,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1da0w5v7ppxrgvh58bafjklzv73nknyq73if6d9rkz2v24zg3169";
+      sha256 = "1lbw8lqzjv17vnwb9vy5ki4jiyihybcc5h2rmcrqiz1xa6y9s1ww";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.2.1";
   };
   hashie = {
     groups = [ "default" ];
@@ -4293,10 +4329,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lbm33fpb3w06wd2231sg58dwlwgjsvym93m548ajvl6s3mfvpn7";
+      sha256 = "03sx3ahz1v5kbqjwxj48msw3maplpp2iyzs22l4jrzrqh4zmgfnf";
       type = "gem";
     };
-    version = "1.14.4";
+    version = "1.14.7";
   };
   i18n_data = {
     groups = [ "default" ];
@@ -4746,10 +4782,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gvb1j8xsqxms9mww01rmdl78zkd72zgxaap56bhv8j45z05hp1x";
+      sha256 = "1k0311vah76kg5m6zr7wmkwyk5p2f9d9hyckjpn3xgr83ajkj7px";
       type = "gem";
     };
-    version = "3.17.0.3";
+    version = "3.17.0.5";
   };
   launchy = {
     dependencies = [ "addressable" ];
@@ -4771,10 +4807,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pqam7p5f72ic1x16jmgvydjxgqd0lddq4pnkxjmwn174yk2k778";
+      sha256 = "0wl9bskb500gw0l2f1bm8rnv3xa2564lw6294pw6qnldz5zm2mx2";
       type = "gem";
     };
-    version = "1.12.3";
+    version = "1.13.0";
   };
   letter_opener = {
     dependencies = [ "launchy" ];
@@ -5209,10 +5245,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0x8asxl83msn815lwmb2d7q5p29p7drhjv5va0byhk60v9n16iwf";
+      sha256 = "12f2830x7pq3kj0v8nz0zjvaw02sv01bqs1zwdrc04704kwcgmqc";
       type = "gem";
     };
-    version = "2.8.8";
+    version = "2.8.9";
   };
   minitest = {
     groups = [
@@ -5352,10 +5388,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rwbq20s2gdh8dljjsgj5s6wqqfmnbclhvv2c2608brv7jm6jdbd";
+      sha256 = "08ma2fmxlm6i7lih4mc3har2fzsbj1pl4hhva65kljf6nfvdryl5";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "3.0.4";
   };
   mustermann-grape = {
     dependencies = [ "mustermann" ];
@@ -5603,10 +5639,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0czsh9d738kj0bmpkjnczq9j924hg103gc00i0wfyg0fzn9psnmc";
+      sha256 = "1hcwwr2h8jnqqxmf8mfb52b0dchr7pm064ingflb78wa00qhgk6m";
       type = "gem";
     };
-    version = "1.18.9";
+    version = "1.18.10";
   };
   notiffany = {
     dependencies = [
@@ -5748,6 +5784,7 @@ src: {
   omniauth = {
     dependencies = [
       "hashie"
+      "logger"
       "rack"
       "rack-protection"
     ];
@@ -5755,10 +5792,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1hjnb5b5m549irs0h1455ipzsv82pikdagx9wjb6r4j1bkjy494d";
+      sha256 = "0g3n12k5npmmgai2cs3snimy6r7h0bvalhjxv0fjxlphjq25p822";
       type = "gem";
     };
-    version = "2.1.3";
+    version = "2.1.4";
   };
   omniauth-alicloud = {
     dependencies = [ "omniauth-oauth2" ];
@@ -6003,10 +6040,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ygfbbs3c61d32ymja2k6sznj5pr540cip9z91lhzcvsr4zmffpz";
+      sha256 = "0dzq3k5hmqlav2mwf7bc10mr1mlmlnpin498g7jhbhpdpa324s6n";
       type = "gem";
     };
-    version = "3.3.0";
+    version = "3.3.1";
   };
   openssl-signature_algorithm = {
     dependencies = [ "openssl" ];
@@ -6846,10 +6883,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0bvdq2jsn1jj8vgp9xrmi6ljw0hqlv4i97v5aa0fcii34g9rrzr4";
+      sha256 = "0gkhpdjib9zi9i27vd9djrxiwjia03cijmd6q8yj2q1ix403w3nw";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.4.0";
   };
   proc_to_ast = {
     dependencies = [
@@ -7043,10 +7080,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pcr8sn02lwzv3z6vx5n41b6ybcnw9g9h05s3lkv4vqdm0f2mq2z";
+      sha256 = "0kvz20sxih8f976ry45b6c8srkh4km0cw4ilc5ynlmyk2nkywkya";
       type = "gem";
     };
-    version = "2.2.17";
+    version = "2.2.18";
   };
   rack-accept = {
     dependencies = [ "rack" ];
@@ -7382,10 +7419,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1h1jal1sv47saxyk33nnjk2ywrsf35aar18p7mc48s2m33876wpd";
+      sha256 = "1c0r26dhdr4jiklc0g7wjmr5q56dp7hwcfa8z75khkp8mrhazfpa";
       type = "gem";
     };
-    version = "3.6.1";
+    version = "3.9.5";
   };
   rbtrace = {
     dependencies = [
@@ -7436,10 +7473,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rvf0yyff2anyfnmx6csx7fai8dk727b843hzz1bm2nqcmm9asv7";
+      sha256 = "1hpkh647ffsqhnj4ps85n2v4d116fg3250m9y7pcnc55lxl6nda5";
       type = "gem";
     };
-    version = "2.19.0";
+    version = "2.20.0";
   };
   recaptcha = {
     dependencies = [ "json" ];
@@ -7517,10 +7554,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0l2fsgfzzrspgrg6x3s38hws5clgbn1aaxcmiyz5jz6xd3dpkxdz";
+      sha256 = "0wx0v68lh924x544mkpydcrkkbr7i386xvkpyxgsf5j55j3d4f8y";
       type = "gem";
     };
-    version = "0.25.3";
+    version = "0.26.1";
   };
   redis-cluster-client = {
     dependencies = [ "redis-client" ];
@@ -7714,10 +7751,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05y4lwzci16c2xgckmpxkzq4czgkyaiiqhvrabdgaym3aj2jd10k";
+      sha256 = "0hninnbvqd2pn40h863lbrn9p11gvdxp928izkag5ysx8b1s5q0r";
       type = "gem";
     };
-    version = "3.4.2";
+    version = "3.4.4";
   };
   rinku = {
     groups = [ "default" ];
@@ -7748,10 +7785,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ynxxmvzczn9a6wd87jyh209590nq6f6ls55dmwiky8fvwi8c68h";
+      sha256 = "1pkp5icgm7s10b2n6b2pzbdsfiv0l5sxqyizx55qdmlpaxnk8xah";
       type = "gem";
     };
-    version = "4.6.0";
+    version = "4.6.1";
   };
   rqrcode = {
     dependencies = [
@@ -8151,16 +8188,15 @@ src: {
       "language_server-protocol"
       "prism"
       "rbs"
-      "sorbet-runtime"
     ];
     groups = [ "development" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0s97zck9v2c1awk4lbj5ccsnn6p0jp018mrq12fvh5hp00sn3586";
+      sha256 = "050qg73g4qs3xza441nafy7610daa3k4ra0pbi3sdlawy9fwfh6i";
       type = "gem";
     };
-    version = "0.23.20";
+    version = "0.26.1";
   };
   ruby-lsp-rails = {
     dependencies = [ "ruby-lsp" ];
@@ -8168,10 +8204,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xlcpxsz2sk57l0kwla2gj8l9cfqj7dxxf0794p67daldr3fs2k7";
+      sha256 = "1bj4bj35l9jas2yf6w93j5ngw3f24lck2j9h5zmxwqs0dn91z7gh";
       type = "gem";
     };
-    version = "0.3.31";
+    version = "0.4.8";
   };
   ruby-lsp-rspec = {
     dependencies = [ "ruby-lsp" ];
@@ -8179,10 +8215,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08m2fw4f784lkbyz5rbzdhj57p0x2pfygk66ls0qsn5avnv7izs1";
+      sha256 = "09wqhrrkfhbjy8yxkp1bn9rmrdcjp85j3lisvwp1qp7jz18yk0bm";
       type = "gem";
     };
-    version = "0.1.24";
+    version = "0.1.27";
   };
   ruby-magic = {
     dependencies = [ "mini_portile2" ];
@@ -8776,23 +8812,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1wxzz7580h6k2sghj9p1ss33i6nlmpmwqawi6ilr87si233rwgxc";
+      sha256 = "073ymwmn028lgzs62yfghdlgarndr3a972j8733dqkk9k2pcapr9";
       type = "gem";
     };
-    version = "0.5.2";
-  };
-  sorbet-runtime = {
-    groups = [
-      "default"
-      "development"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1dpxyhph8rp0bwiacqjsvsm67gm6v7bw16na20rk59g6y8953dk4";
-      type = "gem";
-    };
-    version = "0.5.11647";
+    version = "0.5.4";
   };
   spamcheck = {
     dependencies = [ "grpc" ];
@@ -8873,14 +8896,15 @@ src: {
     version = "3.5.2";
   };
   ssh_data = {
+    dependencies = [ "base64" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1h5aiqqlk51z12kgvanhdvd0ajvv2i68z6a7450yxgmflfaiwz7c";
+      sha256 = "1nsv1411dp5c13sbfzncf9kn3shf302gqqg8g7vmvvpzj5x35s1a";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "2.0.0";
   };
   ssrf_filter = {
     groups = [ "default" ];
@@ -10073,9 +10097,9 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "028ld9qmgdllxrl7d0qkl65s58wb1n3gv8yjs28g43a8b1hplxk1";
+      sha256 = "119ypabas886gd0n9kiid3q41w76gz60s8qmiak6pljpkd56ps5j";
       type = "gem";
     };
-    version = "2.6.7";
+    version = "2.7.3";
   };
 }
diff --git a/pkgs/by-name/gi/gitlab/update.py b/pkgs/by-name/gi/gitlab/update.py
index 6c171c981682..4904884510e4 100755
--- a/pkgs/by-name/gi/gitlab/update.py
+++ b/pkgs/by-name/gi/gitlab/update.py
@@ -62,10 +62,10 @@ class GitLabRepo:
             .strip()
         )
 
-    def get_yarn_hash(self, rev: str):
+    def get_yarn_hash(self, rev: str, yarn_lock_path="yarn.lock"):
         with tempfile.TemporaryDirectory() as tmp_dir:
             with open(tmp_dir + "/yarn.lock", "w") as f:
-                f.write(self.get_file("yarn.lock", rev))
+                f.write(self.get_file(yarn_lock_path, rev))
             return (
                 subprocess.check_output(["prefetch-yarn-deps", tmp_dir + "/yarn.lock"])
                 .decode("utf-8")
@@ -112,6 +112,7 @@ class GitLabRepo:
             version=self.rev2version(rev),
             repo_hash=self.get_git_hash(rev),
             yarn_hash=self.get_yarn_hash(rev),
+            frontend_islands_yarn_hash=self.get_yarn_hash(rev, "/ee/frontend_islands/apps/duo_next/yarn.lock"),
             owner=self.owner,
             repo=self.repo,
             rev=rev,
diff --git a/pkgs/by-name/gl/glslang/package.nix b/pkgs/by-name/gl/glslang/package.nix
index a4e3e5a6987d..51a7e8699a67 100644
--- a/pkgs/by-name/gl/glslang/package.nix
+++ b/pkgs/by-name/gl/glslang/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "15.4.0";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    hash = "sha256-sPc+G7/ua7LQ7scuSvqWs7Q7Q+gFvXQ5wGQsEXbWH6w=";
+    hash = "sha256-/DwdyuSGCx22zsXZrcZGTECfsIqvzPQzTZ2mU8EkjxY=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/gr/grafanactl/package.nix b/pkgs/by-name/gr/grafanactl/package.nix
index 28ee2c72b09b..784ce3cdf36a 100644
--- a/pkgs/by-name/gr/grafanactl/package.nix
+++ b/pkgs/by-name/gr/grafanactl/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafanactl";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafanactl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XHcNyPSN01CGkuj9p54yAAWFlwoWLF6cm5Q2f8iZtVM=";
+    hash = "sha256-elCTtsBkPthlDnUDWSOmM+JMBh/ms2+30b4hVsiJU6Q=";
   };
 
-  vendorHash = "sha256-fHlktADqw3p377g3vXr2LZdBfWfNZOHxnp9H8/C31Gg=";
+  vendorHash = "sha256-WmMkLMxkfGWq8dGjVfME86hEI76Rlp5aWqbNKatUZ80=";
 
   ldflags = [
     "-X main.version=v${finalAttrs.version}"
diff --git a/pkgs/by-name/gr/graphhopper/version.toml b/pkgs/by-name/gr/graphhopper/version.toml
index 3bd74b1906c9..64b95b5ab207 100644
--- a/pkgs/by-name/gr/graphhopper/version.toml
+++ b/pkgs/by-name/gr/graphhopper/version.toml
@@ -1,8 +1,8 @@
-major = "10.0"
-patch = "10.2"
-mapsBundle = "0.0.0-4718098d1db1798841a4d12f1727e8e8f7eab202"
+major = "11.0"
+patch = "11.0"
+mapsBundle = "0.0.0-f171bcf55e447bf494348dd274cd377b73c951f6"
 
 [hash]
-src = "sha256-E6G9JR1lrXhNJ4YgMM0n0RsQcMZQM2QldGc74f5FALo="
-mapsBundle = "sha256-jZTNJfmMWJQHpJ8um3yTBx/KtIfdr0EwKJ9kSFalWJQ="
-mvnDeps = "sha256-KidbIBnW//IiKPFy3plFWOED8gP/ZCg4buwMgzttaY8="
+src = "sha256-tK8zEX2szcU77ydHW+ak/GTjKKC6C5xlG0Uum7a/76I="
+mapsBundle = "sha256-ehwWBIuYBwXu7W7uHYYuGl0lS4s6Tm5c4BfKPkY+w0A="
+mvnDeps = "sha256-0B38C37QbkOhxd5e4SHfMg9SqcUZkuIf1g1S9SnCu7U="
diff --git a/pkgs/by-name/gr/grpc/package.nix b/pkgs/by-name/gr/grpc/package.nix
index f52a2cdfb1a5..0e71063ec0b0 100644
--- a/pkgs/by-name/gr/grpc/package.nix
+++ b/pkgs/by-name/gr/grpc/package.nix
@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation rec {
   pname = "grpc";
-  version = "1.75.0"; # N.B: if you change this, please update:
+  version = "1.75.1"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "grpc";
     repo = "grpc";
     tag = "v${version}";
-    hash = "sha256-2SeL/O6FaAnrPXMHAPKCSzx3hlcKLuC5y+ljJ1gewkE=";
+    hash = "sha256-SnKK52VLO4MM/ftfmzRV/LeLfOucdIyHMyWk6EKRfvM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gs/gss/package.nix b/pkgs/by-name/gs/gss/package.nix
index 8c45bf33b43b..cbe7445f7e2b 100644
--- a/pkgs/by-name/gs/gss/package.nix
+++ b/pkgs/by-name/gs/gss/package.nix
@@ -1,9 +1,17 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  autoreconfHook,
+  fetchzip,
+  autoconf,
+  automake,
+  gengetopt,
+  gettext,
+  gnulib,
   gtk-doc,
+  help2man,
+  libtool,
+  perl,
+  texinfo,
   withShishi ? !stdenv.hostPlatform.isDarwin,
   shishi,
 }:
@@ -12,9 +20,24 @@ stdenv.mkDerivation rec {
   pname = "gss";
   version = "1.0.4";
 
-  src = fetchurl {
-    url = "mirror://gnu/gss/gss-${version}.tar.gz";
-    hash = "sha256-7M6r3vTK4/znIYsuy4PrQifbpEtTthuMKy6IrgJBnHM=";
+  # The dist tarballs do not contain everything necessary to
+  # autoreconf.  Trying to use autoreconfHook with a dist tarball
+  # produces a broken result that fails to build for some platforms.
+  # If we want to autoreconf, we need to build from a git snapshot.
+  #
+  # See this explanation from the maintainer, about an existing
+  # package that exhibits the same problem (that we were able to
+  # produce when building for Darwin an musl.)
+  #
+  # https://lists.gnu.org/archive/html/help-libidn/2021-07/msg00009.html
+  src = fetchzip {
+    url = "https://gitweb.git.savannah.gnu.org/gitweb/?p=gss.git;a=snapshot;h=v${version};sf=tgz";
+    extension = "tar.gz";
+    hash = "sha256-yT19kwAhGzbIoMjRbrrsn6CyvkMH5v1nxxWpnGYmZUw=";
+  };
+
+  env = {
+    GNULIB_SRCDIR = gnulib.src;
   };
 
   # krb5context test uses certificates that expired on 2024-07-11.
@@ -24,15 +47,22 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    autoreconfHook
+    autoconf
+    automake
+    gengetopt
+    gettext
     gtk-doc
+    help2man
+    libtool
+    perl
+    texinfo
   ];
 
   buildInputs = lib.optional withShishi shishi;
 
-  # ./stdint.h:89:5: error: expected value in expression
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export GNULIBHEADERS_OVERRIDE_WINT_T=0
+  preConfigure = ''
+    patchShebangs doc/gdoc
+    ./autogen.sh
   '';
 
   configureFlags = [
diff --git a/pkgs/by-name/gu/gumbo/package.nix b/pkgs/by-name/gu/gumbo/package.nix
index 7c64ef08745f..ef1dbf8a7f47 100644
--- a/pkgs/by-name/gu/gumbo/package.nix
+++ b/pkgs/by-name/gu/gumbo/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gumbo";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "gumbo-parser";
     repo = "gumbo-parser";
     rev = version;
-    hash = "sha256-QNzllJI0ZHRl8o3ktJq+rI8v4SUUJ3MJ6uIubqf1heI=";
+    hash = "sha256-8mri7mLZkuIZgzE6p0yc41bNNyzGTV9V90OiA/9TkkU=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/by-name/ha/harfbuzz/package.nix b/pkgs/by-name/ha/harfbuzz/package.nix
index 080dac7b48ed..3742ae131312 100644
--- a/pkgs/by-name/ha/harfbuzz/package.nix
+++ b/pkgs/by-name/ha/harfbuzz/package.nix
@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "11.2.1";
+  version = "12.1.0";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${finalAttrs.version}/harfbuzz-${finalAttrs.version}.tar.xz";
-    hash = "sha256-CTcUyFSKKFCUaF8L3JmeIC1ma1nus98v+SGraLgzakk=";
+    hash = "sha256-5cgbf24LEC37AAz6QkU4uOiWq3ii9Lil7IyuYqtDNp4=";
   };
 
   postPatch = ''
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # ApplicationServices.framework headers have cast-align warnings.
     substituteInPlace src/hb.hh \
-      --replace '#pragma GCC diagnostic error   "-Wcast-align"' ""
+      --replace-fail '#pragma GCC diagnostic error   "-Wcast-align"' ""
   '';
 
   outputs = [
diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index b0a26d17b091..28440ad5a0be 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.399";
+  version = "0.400";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7IhOMl0o5dyevklvOSZrTbNMkMy/Sp/MtxaPdeqpHJg=";
+    hash = "sha256-X3LL3PZjEiGrkntegcSWNW2Wsx/IpdTowSVp/F4ov+E=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
diff --git a/pkgs/by-name/in/inetutils/package.nix b/pkgs/by-name/in/inetutils/package.nix
index 655d43a187d3..ee1a08aee946 100644
--- a/pkgs/by-name/in/inetutils/package.nix
+++ b/pkgs/by-name/in/inetutils/package.nix
@@ -27,9 +27,7 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
     ./inetutils-1_9-PATH_PROCNET_DEV.patch
-  ]
-  # FIXME: apply unconditionally
-  ++ lib.optionals (stdenv.isAarch64 && stdenv.isLinux) [
+
     ./tests-libls.sh.patch
   ];
 
diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index ab399a44c343..ea44bacf92f2 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   buildPackages,
   bison,
   flex,
@@ -19,24 +18,14 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.16.0";
+  version = "6.17.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-WQDMwV+aw797fq6B3rWTcSPfNemTR6fxGiKBhILwqNA=";
+    hash = "sha256-l4HllBCrfeqOn3m7EP8UiOY9EPy7cFA7lEJronqOLew=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "color-assume-background-is-dark-if-unknown.patch";
-      url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/patch/?id=cc0f1109d2864686180ba2ce6fba5fcb3bf437bf";
-      hash = "sha256-BGD70cXKnDvk7IEU5RQA+pn1dErWjgr74GeSkYtFXoI=";
-    })
-    (fetchpatch {
-      name = "color-do-not-use-dark-blue-in-dark-background-palette.patch";
-      url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/patch/?id=46a4659313c2610427a088d8f03b731819f2b87a";
-      hash = "sha256-TXrmGZNsYWdYLsLoBXZEr3cd8HT4EhRg+jACRrC0gKE=";
-    })
     (fetchurl {
       name = "musl-endian.patch";
       url = "https://lore.kernel.org/netdev/20240712191209.31324-1-contact@hacktivis.me/raw";
@@ -47,6 +36,15 @@ stdenv.mkDerivation rec {
       url = "https://lore.kernel.org/netdev/20240804161054.942439-1-dilfridge@gentoo.org/raw";
       hash = "sha256-47obv6mIn/HO47lt47slpTAFDxiQ3U/voHKzIiIGCTM=";
     })
+  ]
+  # Temporarily gated to keep rebuild counts under control.
+  # The proper fix (targeted to staging) is done in https://github.com/NixOS/nixpkgs/pull/451397
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    (fetchurl {
+      name = "musl-redefinition.patch";
+      url = "https://lore.kernel.org/netdev/20251012124002.296018-1-yureka@cyberchaos.dev/raw";
+      hash = "sha256-8gSpZb/B5sMd2OilUQqg0FqM9y3GZd5Ch5AXV5wrCZQ=";
+    })
   ];
 
   postPatch = ''
@@ -57,6 +55,7 @@ stdenv.mkDerivation rec {
   outputs = [
     "out"
     "dev"
+    "scripts"
   ];
 
   configureFlags = [
@@ -87,6 +86,10 @@ stdenv.mkDerivation rec {
     "CONFDIR=$(out)/etc/iproute2"
   ];
 
+  postInstall = ''
+    moveToOutput sbin/routel "$scripts"
+  '';
+
   depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
   nativeBuildInputs = [
     bison
diff --git a/pkgs/by-name/is/istioctl/package.nix b/pkgs/by-name/is/istioctl/package.nix
index 7b9533563912..bee109171146 100644
--- a/pkgs/by-name/is/istioctl/package.nix
+++ b/pkgs/by-name/is/istioctl/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.27.2";
+  version = "1.27.3";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    hash = "sha256-o+rKTm1Yc2J+/uDp1DCkCpmOrODpfQ7bQ/FB62UyKfk=";
+    hash = "sha256-MgicdVRYHdp38lHY7VjAH+4xKD9sgEroEIwNkSmbfjU=";
   };
   vendorHash = "sha256-AJzEAFZZe4QtuYRcIJ8GwosbBi5gWn+DAOpVS8JnAdQ=";
 
diff --git a/pkgs/by-name/ja/jasp-desktop/modules.nix b/pkgs/by-name/ja/jasp-desktop/modules.nix
index 040b3a258947..8b743c851d2b 100644
--- a/pkgs/by-name/ja/jasp-desktop/modules.nix
+++ b/pkgs/by-name/ja/jasp-desktop/modules.nix
@@ -176,6 +176,7 @@ let
     {
       pname,
       version,
+      rev ? "refs/tags/${version}",
       hash,
       deps,
     }:
@@ -185,8 +186,7 @@ let
         name = "${pname}-${version}-source";
         owner = "jasp-stats";
         repo = pname;
-        tag = "v${version}";
-        inherit hash;
+        inherit rev hash;
       };
       propagatedBuildInputs = deps;
       # some packages have a .Rprofile that tries to activate renv
@@ -713,8 +713,9 @@ in
     };
     jaspRegression = buildJaspModule {
       pname = "jaspRegression";
-      version = "0.95.0";
-      hash = "sha256-9Q5Ei9vjFaDte//1seCj9++ftbDctkHzP8ZpGVETXH0=";
+      version = "0.95.0-unstable-2025-08-27";
+      rev = "b0ecad26bb248964e778ee6d4486d671b83930b2";
+      hash = "sha256-wm/Fz/wA7B96bzj8UylZjFgrrZgwOTdGnCsmfaCPGp0=";
       deps = [
         BAS
         boot
@@ -723,7 +724,6 @@ in
         emmeans
         ggplot2
         ggrepel
-        hmeasure
         jaspAnova
         jaspBase
         jaspDescriptives
diff --git a/pkgs/by-name/kb/kbd/package.nix b/pkgs/by-name/kb/kbd/package.nix
index 5e89ce36d19b..4b0d29ed563e 100644
--- a/pkgs/by-name/kb/kbd/package.nix
+++ b/pkgs/by-name/kb/kbd/package.nix
@@ -20,11 +20,12 @@
   zstd,
   gitUpdater,
   pkgsCross,
-  withVlock ? true,
+  withVlock ? false,
+  kbdVlock,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "kbd";
+  pname = "kbd" + lib.optionalString withVlock "-vlock";
   version = "2.9.0";
 
   __structuredAttrs = true;
@@ -35,16 +36,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-uUECxFdm/UhoHKLHLFe6/ygCQ+4mrQOZExKl+ReaTNw=";
   };
 
-  # vlock is moved into its own output, since it depends on pam. This
-  # reduces closure size for most use cases.
   outputs = [
     "out"
     "dev"
     "scripts"
     "man"
-  ]
-  ++ lib.optionals withVlock [
-    "vlock"
   ];
 
   patches = [
@@ -112,10 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     moveToOutput bin/unicode_start $scripts
     moveToOutput bin/unicode_stop $scripts
-  ''
-  + lib.optionalString withVlock ''
-    moveToOutput bin/vlock $vlock
-    moveToOutput etc/pam.d/vlock $vlock
   '';
 
   outputChecks.out.disallowedRequisites = [
@@ -137,6 +129,8 @@ stdenv.mkDerivation (finalAttrs: {
         pkgsCross.${systemString}.kbd;
       inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
     };
+    # For backwards compatibility. Remove after 26.05.
+    vlock = kbdVlock;
   };
 
   meta = {
diff --git a/pkgs/by-name/ke/kew/package.nix b/pkgs/by-name/ke/kew/package.nix
index 8dc3fe52ff43..418e999bcbc6 100644
--- a/pkgs/by-name/ke/kew/package.nix
+++ b/pkgs/by-name/ke/kew/package.nix
@@ -33,13 +33,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kew";
-  version = "3.5.3";
+  version = "3.6.4";
 
   src = fetchFromGitHub {
     owner = "ravachol";
     repo = "kew";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7bO9IvSTJJKiNYQzcTSI2Ugjhw1ibbyE5/fe6EDYqvI=";
+    hash = "sha256-PhNBAy+XS1wpU91GNoRc4jume9razD03xmmUER0p8I0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/lib60870/package.nix b/pkgs/by-name/li/lib60870/package.nix
index 8a39f3d5d5e0..3887f73d2329 100644
--- a/pkgs/by-name/li/lib60870/package.nix
+++ b/pkgs/by-name/li/lib60870/package.nix
@@ -20,8 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/lib60870-C";
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace src/CMakeLists.txt --replace-warn "-lrt" ""
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace src/CMakeLists.txt \
+      --replace-warn "-lrt" "" \
   '';
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/li/libacars/package.nix b/pkgs/by-name/li/libacars/package.nix
index 0d2cd6b4bd03..adb346920174 100644
--- a/pkgs/by-name/li/libacars/package.nix
+++ b/pkgs/by-name/li/libacars/package.nix
@@ -15,9 +15,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-2n1tuKti8Zn5UzQHmRdvW5Q+x4CXS9QuPHFQ+DFriiE=";
   };
 
-  nativeBuildInputs = [
-    cmake
-  ];
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 3.1)" "cmake_minimum_required (VERSION 3.10)"
+  '';
+
+  nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=lib"
diff --git a/pkgs/by-name/li/libamqpcpp/package.nix b/pkgs/by-name/li/libamqpcpp/package.nix
index dfabbdb40c3a..6c6ceb5f4d54 100644
--- a/pkgs/by-name/li/libamqpcpp/package.nix
+++ b/pkgs/by-name/li/libamqpcpp/package.nix
@@ -17,6 +17,11 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-iaOXdDIJOBXHyjE07CvU4ApTh71lmtMCyU46AV+MGXQ=";
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.4 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10 FATAL_ERROR)"
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [ openssl ];
@@ -24,7 +29,6 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [ ./libamqpcpp-darwin.patch ];
 
   enableParallelBuilding = true;
-  doCheck = true;
 
   meta = {
     description = "Library for communicating with a RabbitMQ server";
diff --git a/pkgs/by-name/li/libbtbb/package.nix b/pkgs/by-name/li/libbtbb/package.nix
index 2e9fbc46a460..00643a1cfda7 100644
--- a/pkgs/by-name/li/libbtbb/package.nix
+++ b/pkgs/by-name/li/libbtbb/package.nix
@@ -18,8 +18,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  # https://github.com/greatscottgadgets/libbtbb/issues/63
   postPatch = ''
+    # https://github.com/NixOS/nixpkgs/issues/445447
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+
+    # https://github.com/greatscottgadgets/libbtbb/issues/63
     substituteInPlace lib/libbtbb.pc.in \
       --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
       --replace '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
diff --git a/pkgs/by-name/li/libcaption/package.nix b/pkgs/by-name/li/libcaption/package.nix
index adcf4f7f22c2..27d788b00937 100644
--- a/pkgs/by-name/li/libcaption/package.nix
+++ b/pkgs/by-name/li/libcaption/package.nix
@@ -8,16 +8,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcaption";
-  version = "0.7";
+  version = "0.8";
 
   src = fetchFromGitHub {
     owner = "szatmary";
     repo = "libcaption";
-    tag = finalAttrs.version;
-    hash = "sha256-OBtxoFJF0cxC+kfSK8TIKIdLkmCh5WOJlI0fejnisJo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9tszEKR30GHoGQ3DE9ejU3yOdtDiZwSZHiIJUPLgOdU=";
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ re2c ];
 
diff --git a/pkgs/by-name/li/libdnf/package.nix b/pkgs/by-name/li/libdnf/package.nix
index 8a19697e882a..ab7827cfa43f 100644
--- a/pkgs/by-name/li/libdnf/package.nix
+++ b/pkgs/by-name/li/libdnf/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libdnf";
-  version = "0.74.0";
+  version = "0.75.0";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     owner = "rpm-software-management";
     repo = "libdnf";
     tag = version;
-    hash = "sha256-NAnE8VPz2j7h/gB1A4FDwG/x7ki7QEmBjcfvOb6/+VY=";
+    hash = "sha256-ujkJVeI6wgapTW1DBIhj4F/rXJFBb+KdREpc5jfU124=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libdrm/package.nix b/pkgs/by-name/li/libdrm/package.nix
index ab6b129b9b1c..e9bb0c3d449b 100644
--- a/pkgs/by-name/li/libdrm/package.nix
+++ b/pkgs/by-name/li/libdrm/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.125";
+  version = "2.4.126";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-1LrpJ5elD4GpNSR2LgQQpJzYTPoPmXeVvAFyrI+x2Wo=";
+    hash = "sha256-bKsW1NJZtqvJ9IUjOGNFQRSjwwfsqAZnmq0+2+lnv0I=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libfann/package.nix b/pkgs/by-name/li/libfann/package.nix
index 2cccdac05c1d..7e5623c858ac 100644
--- a/pkgs/by-name/li/libfann/package.nix
+++ b/pkgs/by-name/li/libfann/package.nix
@@ -5,15 +5,15 @@
   cmake,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "libfann";
-  version = "2.2.0";
+  version = "2.2.0-unstable-2025-10-13";
 
   src = fetchFromGitHub {
     owner = "libfann";
     repo = "fann";
-    rev = version;
-    sha256 = "0awbs0vjsrdglqiaybb0ln13ciizmyrw9ahllahvgbq4nr0nvf6y";
+    rev = "3907e1b37f94ed606b627c55dd2238956046a19b";
+    sha256 = "sha256-UdEpUD7ASrqygwFgW4CdCDGIJtUTKeJbHZDnnQI5jSI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 2ac0eb645df0..c69af0dda7cd 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
     "out"
     "dev"
     "man"
+    "lib"
   ];
 
   src = fetchFromGitHub {
@@ -57,7 +58,13 @@ stdenv.mkDerivation rec {
   ];
 
   # Fix installation path for gdk-pixbuf module
-  PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${placeholder "out"}/${gdk-pixbuf.moduleDir}";
+  PKG_CONFIG_GDK_PIXBUF_2_0_GDK_PIXBUF_MODULEDIR = "${placeholder "lib"}/${gdk-pixbuf.moduleDir}";
+
+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/heif.thumbnailer \
+      --replace-fail "TryExec=heif-thumbnailer" "TryExec=$bin/bin/heif-thumbnailer" \
+      --replace-fail "Exec=heif-thumbnailer" "Exec=$bin/bin/heif-thumbnailer"
+  '';
 
   # Wrong include path in .cmake.  It's a bit difficult to patch because of special characters.
   postFixup = ''
diff --git a/pkgs/by-name/li/libnotify/package.nix b/pkgs/by-name/li/libnotify/package.nix
index 8345b27ae222..5403b0d07218 100644
--- a/pkgs/by-name/li/libnotify/package.nix
+++ b/pkgs/by-name/li/libnotify/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -19,7 +20,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libnotify";
-  version = "0.8.6";
+  version = "0.8.7";
 
   outputs = [
     "out"
@@ -29,11 +30,20 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-xVQKrvtg4dY7HFh8BfIoTr5y7OfQwOXkp3jP1YRLa1g=";
+    hash = "sha256-S+FSAuxBhPzhrBWZfs5VMNK+Mv6Vc4da6xDjtXOFh0g=";
   };
 
+  patches = [
+    # build: Do not use GDesktopAppInfo if not available
+    # https://gitlab.gnome.org/GNOME/libnotify/-/issues/62
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/libnotify/-/commit/13de65ad2a76255ffde5d6da91d246cd7226583b.patch";
+      hash = "sha256-a1wiUQnrncPqL2OTY1sUWyvVcoI54bXPvkIkZAcC6kI=";
+    })
+  ];
+
   mesonFlags = [
-    # disable tests as we don't need to depend on GTK (2/3)
+    # disable tests as we don't need to depend on GTK 4
     "-Dtests=false"
     "-Ddocbook_docs=disabled"
     "-Dgtk_doc=false"
diff --git a/pkgs/by-name/li/libressl/cmake-install-full-dirs.3.9.patch b/pkgs/by-name/li/libressl/cmake-install-full-dirs.3.9.patch
deleted file mode 100644
index 69a4b102be64..000000000000
--- a/pkgs/by-name/li/libressl/cmake-install-full-dirs.3.9.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git c/CMakeLists.txt w/CMakeLists.txt
-index 01a42fb..1a9a505 100644
---- c/CMakeLists.txt
-+++ w/CMakeLists.txt
-@@ -515,9 +515,9 @@ if(ENABLE_LIBRESSL_INSTALL)
- 	if(NOT MSVC)
- 		# Create pkgconfig files.
- 		set(prefix      ${CMAKE_INSTALL_PREFIX})
--		set(exec_prefix \${prefix})
--		set(libdir      \${exec_prefix}/${CMAKE_INSTALL_LIBDIR})
--		set(includedir  \${prefix}/include)
-+		set(exec_prefix ${CMAKE_INSTALL_FULL_BINDIR})
-+		set(libdir      ${CMAKE_INSTALL_FULL_LIBDIR})
-+		set(includedir  ${CMAKE_INSTALL_FULL_INCLUDEDIR})
- 		if(PLATFORM_LIBS)
- 			string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}")
- 		endif()
diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index f4cbfbc673df..279cbdf60f2e 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -117,26 +117,9 @@ let
   };
 in
 {
-  libressl_3_9 = generic {
-    version = "3.9.2";
-    hash = "sha256-ewMdrGSlnrbuMwT3/7ddrTOrjJ0nnIR/ksifuEYGj5c=";
-
-    patches = [
-      # Fixes build on ppc64
-      # https://github.com/libressl/portable/pull/1073
-      (fetchpatch {
-        url = "https://github.com/libressl/portable/commit/e6c7de3f03c51fbdcf5ad88bf12fe9e128521f0d.patch";
-        hash = "sha256-LJy3fjbnc9h5DG3/+8bLECwJeBpPxy3hU8sPuhovmcw=";
-      })
-      # common-cmake-install-full-dirs-patch doesn't apply for this version, so
-      # this is a manual backport
-      ./cmake-install-full-dirs.3.9.patch
-    ];
-  };
-
   libressl_4_0 = generic {
-    version = "4.0.0";
-    hash = "sha256-TYQZVfCsw9/HHQ49018oOvRhIiNQ4mhD/qlzHAJGoeQ=";
+    version = "4.0.1";
+    hash = "sha256-IClLh3eMJidIk4Y5Q8hjWJebSZ03tJl31r+Gj3tZfL0=";
     # Fixes build on loongarch64
     # https://github.com/libressl/portable/pull/1146
     patches = [
@@ -156,8 +139,8 @@ in
   };
 
   libressl_4_1 = generic {
-    version = "4.1.0";
-    hash = "sha256-D3HBa9NL2qzNy5al2UpJIb+2EuxuDrp6gNiFTu/Yu2E=";
+    version = "4.1.1";
+    hash = "sha256-x/96fWddX1dzCUDlzP8dvi3NW3QFtTl+D3/9ZqXtVnk=";
     # Fixes build on loongarch64
     # https://github.com/libressl/portable/pull/1184
     postPatch = ''
diff --git a/pkgs/by-name/li/librsvg/expect-any-error-too-many-elements.patch b/pkgs/by-name/li/librsvg/expect-any-error-too-many-elements.patch
new file mode 100644
index 000000000000..94f145bb744c
--- /dev/null
+++ b/pkgs/by-name/li/librsvg/expect-any-error-too-many-elements.patch
@@ -0,0 +1,23 @@
+diff --git a/rsvg/tests/errors.rs b/rsvg/tests/errors.rs
+index 02b134bee..46391fa5d 100644
+--- a/rsvg/tests/errors.rs
++++ b/rsvg/tests/errors.rs
+@@ -14,15 +14,12 @@ use rsvg::{CairoRenderer, ImplementationLimit, Loader, LoadingError, RenderingEr
+ 
+ #[ignore]
+ #[test]
++#[should_panic]
+ fn too_many_elements() {
+     let name = "tests/fixtures/errors/bug515-too-many-elements.svgz";
+ 
+-    assert!(matches!(
+-        Loader::new().read_path(name),
+-        Err(LoadingError::LimitExceeded(
+-            ImplementationLimit::TooManyLoadedElements
+-        ))
+-    ));
++    // libxml2 might return an error without updating the element count, so just expect any error, not specifically too many elements
++    Loader::new().read_path(name).unwrap();
+ }
+ 
+ fn rendering_instancing_limit(name: &str) {
diff --git a/pkgs/by-name/li/librsvg/package.nix b/pkgs/by-name/li/librsvg/package.nix
index fde58ccc80a4..4317c8cbb319 100644
--- a/pkgs/by-name/li/librsvg/package.nix
+++ b/pkgs/by-name/li/librsvg/package.nix
@@ -64,6 +64,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vBu81BkSCwmNsovqVTNdneJHDU5qn27pcge0EPwVhn0=";
   };
 
+  patches = [
+    # too_many_elements test fails with libxml 2.15.0,
+    # because libxml2 no longer updates the element count
+    # before erroring out, which breaks the librsvg limit check.
+    #
+    # This is okay, because the error is still detected.
+    # The error is simply not reported accurately.
+    # https://gitlab.gnome.org/GNOME/librsvg/-/issues/1201
+    ./expect-any-error-too-many-elements.patch
+  ];
+
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
diff --git a/pkgs/by-name/li/libsndfile/package.nix b/pkgs/by-name/li/libsndfile/package.nix
index 3e894e8e40f4..4884e3480e49 100644
--- a/pkgs/by-name/li/libsndfile/package.nix
+++ b/pkgs/by-name/li/libsndfile/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   autogen,
   pkg-config,
@@ -35,6 +36,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-MOOX/O0UaoeMaQPW9PvvE0izVp+6IoE5VbtTx0RvMkI=";
   };
 
+  patches = [
+    # Fix build with gcc15
+    # https://github.com/libsndfile/libsndfile/pull/1055
+    (fetchpatch {
+      url = "https://github.com/libsndfile/libsndfile/commit/2251737b3b175925684ec0d37029ff4cb521d302.patch";
+      hash = "sha256-LaeptEicnjpVBExlK4dNMlN8+AAJhW8dIvemF6S4W2M=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     autogen
diff --git a/pkgs/by-name/li/libwebp/package.nix b/pkgs/by-name/li/libwebp/package.nix
index b814308b8ae0..d20b25693a88 100644
--- a/pkgs/by-name/li/libwebp/package.nix
+++ b/pkgs/by-name/li/libwebp/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   threadingSupport ? true, # multi-threading
   openglSupport ? false,
@@ -44,6 +45,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-7i4fGBTsTjAkBzCjVqXqX4n22j6dLgF/0mz4ajNA45U=";
   };
 
+  patches = [
+    # Fixes endianness-related behaviour in build result when targeting big-endian via CMake
+    # https://groups.google.com/a/webmproject.org/g/webp-discuss/c/wvBsO8n8BKA/m/eKpxLuagAQAJ
+    (fetchpatch {
+      name = "0001-libwebp-Fix-endianness-with-CMake.patch";
+      url = "https://github.com/webmproject/libwebp/commit/0e5f4ee3deaba5c4381877764005d981f652791f.patch";
+      hash = "sha256-VNiLv1y3cjSDCNen9KxqbdrldI6EhshTSnsq8g9x8HA=";
+    })
+  ];
+
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" true)
     (lib.cmakeBool "WEBP_USE_THREAD" threadingSupport)
diff --git a/pkgs/by-name/li/libwindowswm/package.nix b/pkgs/by-name/li/libwindowswm/package.nix
new file mode 100644
index 000000000000..f195e4bbd76b
--- /dev/null
+++ b/pkgs/by-name/li/libwindowswm/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libwindowswm";
+  version = "1.0.1";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libWindowsWM-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-JfB8+EfL6R02wg80i0uUlMRQT+ApZujN9lz1YxanDtw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libWindowsWM \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "library for Cygwin/X rootless window management extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libwindowswm";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [ "windowswm" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxcb-cursor/package.nix b/pkgs/by-name/li/libxcb-cursor/package.nix
index 8f8a61d6e5d7..0afb6ae53ea3 100644
--- a/pkgs/by-name/li/libxcb-cursor/package.nix
+++ b/pkgs/by-name/li/libxcb-cursor/package.nix
@@ -13,7 +13,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxcb-cursor";
-  version = "0.1.5";
+  version = "0.1.6";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/xcb-util-cursor-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DK+ZsNYJcPgc5Bx7ppTl6q+DMie7LLzbL23JZmpmPFc=";
+    hash = "sha256-/euL0SeHNRm+XMcNzQ07XTO2Z4dyAPmSWln9ytj3qTM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/libxcomposite/package.nix b/pkgs/by-name/li/libxcomposite/package.nix
new file mode 100644
index 000000000000..b141e7eece76
--- /dev/null
+++ b/pkgs/by-name/li/libxcomposite/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxfixes,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcomposite";
+  version = "0.4.6";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXcomposite-${finalAttrs.version}.tar.xz";
+    hash = "sha256-/kC88K4aCQcOuiQIil65gQ7+V0U3eeweIKVQgMbcLIc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxfixes
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    # header file dependencies
+    libxfixes
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXcomposite \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Client library for the Composite extension to the X11 protocol";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcomposite";
+    license = with lib.licenses; [
+      hpndSellVariant
+      mit
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xcomposite" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxdamage/package.nix b/pkgs/by-name/li/libxdamage/package.nix
new file mode 100644
index 000000000000..39c34e3530fa
--- /dev/null
+++ b/pkgs/by-name/li/libxdamage/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxfixes,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxdamage";
+  version = "1.1.6";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXdamage-${finalAttrs.version}.tar.xz";
+    hash = "sha256-UnM8H1Ji/KNfZOfVBgxvzYGogLqOHmXJYhzwcnr7XRE=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxfixes
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXdamage \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Damage Extension library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxdamage";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xdamage" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxfixes/package.nix b/pkgs/by-name/li/libxfixes/package.nix
index cf51e21d9d1e..026a2d4259ec 100644
--- a/pkgs/by-name/li/libxfixes/package.nix
+++ b/pkgs/by-name/li/libxfixes/package.nix
@@ -10,7 +10,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxfixes";
-  version = "6.0.1";
+  version = "6.0.2";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libXfixes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tpX5PNJJlCGrAtInREWOZQzMiMHUyBMNYCACE6vALVg=";
+    hash = "sha256-OfEV1y2cX4ER5GhBZNPWjMH9Ifmyf/JAGwj938D0Cbo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/libxfont_1/package.nix b/pkgs/by-name/li/libxfont_1/package.nix
new file mode 100644
index 000000000000..421f34dd9afe
--- /dev/null
+++ b/pkgs/by-name/li/libxfont_1/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libfontenc,
+  xorgproto,
+  freetype,
+  xtrans,
+  zlib,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxfont_1";
+  version = "1.5.4";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXfont-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-Gn90kHdMh/IFLRRtHg5kUY0y5oSBhKGGVOjQu1eIMkI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libfontenc
+    xorgproto
+    freetype
+    xtrans
+    zlib
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  # prevents "misaligned_stack_error_entering_dyld_stub_binder"
+  configureFlags = lib.optional stdenv.hostPlatform.isDarwin "CFLAGS=-O0";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXfont \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X font handling library for server & utilities";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxfont";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+      hpnd
+      hpndSellVariant
+      # this was originally BSD-3-Clause-UC, however the University of California rescinded
+      # clause 3, the advertising clause, in 1999 effectively reverting it to a BSD-3-Clause
+      bsd3
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xfont" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxfont_2/package.nix b/pkgs/by-name/li/libxfont_2/package.nix
new file mode 100644
index 000000000000..9f1dbea7359e
--- /dev/null
+++ b/pkgs/by-name/li/libxfont_2/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libfontenc,
+  xorgproto,
+  freetype,
+  xtrans,
+  zlib,
+  writeScript,
+  testers,
+  # for inheriting the meta attributes
+  libxfont_1,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxfont_2";
+  version = "2.0.7";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXfont2-${finalAttrs.version}.tar.xz";
+    hash = "sha256-i3uC/eukh2m2lDPo4/u5hKX2vzaLDV9Hq+7EnePljvs=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libfontenc
+    xorgproto
+    freetype
+    xtrans
+    zlib
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXfont2 \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    inherit (libxfont_1.meta) description homepage license;
+    maintainers = [ ];
+    pkgConfigModules = [ "xfont2" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxft/package.nix b/pkgs/by-name/li/libxft/package.nix
new file mode 100644
index 000000000000..3f5955be00ac
--- /dev/null
+++ b/pkgs/by-name/li/libxft/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  fontconfig,
+  freetype,
+  libx11,
+  libxrender,
+  xorgproto,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxft";
+  version = "2.3.9";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXft-${finalAttrs.version}.tar.xz";
+    hash = "sha256-YKJbeJRe1pMmNbO7GJmlF9Md90VuaYZ/+6J/if85dvU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libx11
+    libxrender
+    xorgproto
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    # header file dependencies
+    freetype
+    fontconfig
+    libxrender
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXft \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X FreeType library";
+    longDescription = ''
+      libXft is the client side font rendering library, using libfreetype, libX11, and the
+      X Render extension to display anti-aliased text.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxft";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xft" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxi/package.nix b/pkgs/by-name/li/libxi/package.nix
new file mode 100644
index 000000000000..3cbac22c36f3
--- /dev/null
+++ b/pkgs/by-name/li/libxi/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxfixes,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxi";
+  version = "1.8.2";
+
+  outputs = [
+    "out"
+    "dev"
+    "man"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-0OBVXlPW4hFOq/pEImuhYtJwhQGiXhjZnPs1wJTGwQQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxfixes
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    # header file dependencies
+    libx11
+    libxext
+    libxfixes
+  ];
+
+  configureFlags =
+    lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "xorg_cv_malloc0_returns_null=no"
+    ++ lib.optional stdenv.hostPlatform.isStatic "--disable-shared";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXi \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "library for the X Input Extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxi";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpnd
+      mit
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xi" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxinerama/package.nix b/pkgs/by-name/li/libxinerama/package.nix
new file mode 100644
index 000000000000..8708e49b3dec
--- /dev/null
+++ b/pkgs/by-name/li/libxinerama/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxinerama";
+  version = "1.1.5";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXinerama-${finalAttrs.version}.tar.xz";
+    hash = "sha256-UJTR8PzBgoyxaW0NOdnoZq4yUgxU0B9hjxo8HjDCCFw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXinerama \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Library for Xinerama extension to X11 Protocol";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxinerama";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+      # TODO: change this to a new license depending on if this
+      # https://github.com/spdx/license-list-XML/issues/2831
+      # actually creates a new license or just new markup for X11
+      x11
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xinerama" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxkbfile/package.nix b/pkgs/by-name/li/libxkbfile/package.nix
new file mode 100644
index 000000000000..93cd9028b379
--- /dev/null
+++ b/pkgs/by-name/li/libxkbfile/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxkbfile";
+  version = "1.1.3";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libxkbfile-${finalAttrs.version}.tar.xz";
+    hash = "sha256-qbY+6pl6u57mqLT7tRWDHIQfRxr4RaCd5EOygAOHS+w=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "XKB file handling routines";
+    longDescription = ''
+      libxkbfile is used by the X servers and utilities to parse the XKB configuration data files.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxkbfile";
+    license = with lib.licenses; [
+      hpnd
+      mitOpenGroup
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xkbfile" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxp/package.nix b/pkgs/by-name/li/libxp/package.nix
new file mode 100644
index 000000000000..076b7ddb5510
--- /dev/null
+++ b/pkgs/by-name/li/libxp/package.nix
@@ -0,0 +1,69 @@
+# TODO: remove this deprecated package
+# X.Org removed support for the Xprt server from the xorg-server releases in the 1.6.0 release in
+# 2009, and the standalone git repo it was moved to has been unmaintained since 2009, making it
+# difficult to actually use this library.
+# Some packages in nixpkgs still somehow depend on it tho.
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxau,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxp";
+  version = "1.0.4";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXp-${finalAttrs.version}.tar.xz";
+    hash = "sha256-HxnjuOgqNKj9mImn2a8KvoWIywP7V8N8VpY0zzud8aQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxau
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXp \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Print Client Library";
+    longDescription = ''
+      This library provides support for X11 clients to print via the X Print Extension, as
+      previously implemented in the Xprt server.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxp";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xp" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxpresent/package.nix b/pkgs/by-name/li/libxpresent/package.nix
new file mode 100644
index 000000000000..10145497ef1d
--- /dev/null
+++ b/pkgs/by-name/li/libxpresent/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxfixes,
+  libxrandr,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxpresent";
+  version = "1.0.2";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXpresent-${finalAttrs.version}.tar.xz";
+    hash = "sha256-TlshtIEiBqSyIwE2Bq4xFwUCwQQwOHd6Hvj3DAnTdgI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxfixes
+    libxrandr
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    # header includes dependencies
+    libxfixes
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXpresent \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "library for the X Present Extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxpresent";
+    license = with lib.licenses; [
+      hpndSellVariant
+      mit
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xpresent" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxres/package.nix b/pkgs/by-name/li/libxres/package.nix
new file mode 100644
index 000000000000..1dbf4c937f6c
--- /dev/null
+++ b/pkgs/by-name/li/libxres/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxres";
+  version = "1.2.3";
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXres-${finalAttrs.version}.tar.xz";
+    hash = "sha256-0t6PVAHWyGqJknkWVFR+uN71hd/cDAjMFuJO9q7radw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXres \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X-Resource extension client library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxres";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xres" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxscrnsaver/package.nix b/pkgs/by-name/li/libxscrnsaver/package.nix
new file mode 100644
index 000000000000..e6a716365638
--- /dev/null
+++ b/pkgs/by-name/li/libxscrnsaver/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxscrnsaver";
+  version = "1.2.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXScrnSaver-${finalAttrs.version}.tar.xz";
+    hash = "sha256-UFc2X4RyU+DidYcUQeEP94RsgyKl2I4eGH0ybeHNjQA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  propagatedBuildInputs = [ xorgproto ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXScrnSaver \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X11 Screen Saver extension client library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxscrnsaver";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xscrnsaver" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxshmfence/package.nix b/pkgs/by-name/li/libxshmfence/package.nix
new file mode 100644
index 000000000000..1d771b05060b
--- /dev/null
+++ b/pkgs/by-name/li/libxshmfence/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxshmfence";
+  version = "1.3.3";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libxshmfence-${finalAttrs.version}.tar.xz";
+    hash = "sha256-1KTfCWq6lv6gLAKe46ROEaR+t/chPBpym+g+hew/3hA=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ xorgproto ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Shared memory 'SyncFence' synchronization primitive library";
+    longDescription = ''
+      This library offers a CPU-based synchronization primitive compatible with the X SyncFence
+      objects that can be shared between processes using file descriptor passing.
+      There are two underlying implementations:
+      - On Linux, the library uses futexes
+      - On other systems, the library uses posix mutexes and condition variables.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxshmfence";
+    license = lib.licenses.hpndSellVariant;
+    maintainers = [ ];
+    pkgConfigModules = [ "xshmfence" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libxslt/package.nix b/pkgs/by-name/li/libxslt/package.nix
index 8427fe49597d..d31337777f26 100644
--- a/pkgs/by-name/li/libxslt/package.nix
+++ b/pkgs/by-name/li/libxslt/package.nix
@@ -39,16 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
     # https://gitlab.gnome.org/GNOME/libxslt/-/issues/144
     # Source: https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77
     ./77-Use-a-dedicated-node-type-to-maintain-the-list-of-cached-rv-ts.patch
-
-    # Fix type confusion in xmlNode.psvi between stylesheet and source nodes
-    # https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
-    # Fix heap-use-after-free in xmlFreeID caused by `atype` corruption
-    # https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
-    #
-    # Depends on unmerged libxml2 patch that breaks ABI.
-    #
-    # Source: https://github.com/chromium/chromium/blob/4fb4ae8ce3daa399c3d8ca67f2dfb9deffcc7007/third_party/libxslt/chromium/new-unified-atype-extra.patch
-    ./new-unified-atype-extra.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/libxtst/package.nix b/pkgs/by-name/li/libxtst/package.nix
new file mode 100644
index 000000000000..6cd9ababca26
--- /dev/null
+++ b/pkgs/by-name/li/libxtst/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxi,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxtst";
+  version = "1.2.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXtst-${finalAttrs.version}.tar.xz";
+    hash = "sha256-tQ1MJblwCadEcGwQOcWY9NjmSRDJ/eOBmU4criNdkkI=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxi
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXtst \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Library for the XTEST and RECORD X11 extensions";
+    longDescription = ''
+      The XTEST extension is a minimal set of client and server extensions required to completely
+      test the X11 server with no user intervention. This extension is not intended to support
+      general journaling and playback of user actions.
+      The RECORD extension supports the recording and reporting of all core X protocol and arbitrary
+      X extension protocol.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxtst";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpndSellVariant
+      hpndDoc
+      x11
+      hpndDocSell
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "xtst" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/lincity-ng/package.nix b/pkgs/by-name/li/lincity-ng/package.nix
index 7232f1c1dcd4..734b8868105c 100644
--- a/pkgs/by-name/li/lincity-ng/package.nix
+++ b/pkgs/by-name/li/lincity-ng/package.nix
@@ -1,22 +1,19 @@
 {
   stdenv,
   SDL2,
-  SDL2_gfx,
   SDL2_image,
   SDL2_mixer,
   SDL2_ttf,
   cmake,
   fetchFromGitHub,
+  fmt,
   lib,
-  libGL,
-  libGLU,
   libwebp,
   libtiff,
   libX11,
   libxml2,
   libxmlxx5,
   libxslt,
-  physfs_2,
   pkg-config,
   xorgproto,
   zlib,
@@ -24,47 +21,42 @@
   include-what-you-use,
 }:
 
-let
-  # https://github.com/lincity-ng/lincity-ng/issues/25
-  physfs = physfs_2;
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "lincity-ng";
-  version = "2.13.1";
+  version = "2.14.2";
 
   src = fetchFromGitHub {
     owner = "lincity-ng";
     repo = "lincity-ng";
     tag = "lincity-ng-${finalAttrs.version}";
-    hash = "sha256-ACJVhMq2IEJNrbAdmkgHxQV0uKSXpwR8a/5jcrQS+oI=";
+    hash = "sha256-HW+bB9xnrok8tWKIJJUt3Qgo5e9HmI6NZORG4PazmEM=";
   };
 
   hardeningDisable = [ "format" ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     pkg-config
     gettext
     include-what-you-use
     libxml2
+    libxslt
   ];
 
   buildInputs = [
+    fmt
     SDL2
-    SDL2_gfx
     SDL2_image
     SDL2_mixer
     SDL2_ttf
-    libGL
-    libGLU
     libX11
     libwebp
     libtiff
     libxmlxx5
     libxml2
     libxslt
-    physfs
     xorgproto
     zlib
   ];
@@ -81,6 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
   ";
 
   meta = {
+    homepage = "https://github.com/lincity-ng/lincity-ng";
     description = "City building game";
     mainProgram = "lincity-ng";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/li/lint-staged/package.nix b/pkgs/by-name/li/lint-staged/package.nix
index a7dd006a657f..0dc439ea64c9 100644
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "16.2.4";
+  version = "16.2.5";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-r4BJVY4PoBItIpCOQO5eTVyOGnIqV1fJ/cbrNyjvhAs=";
+    hash = "sha256-9SsdcF294v6/PAsz/cJXsqUbloSy24HHG7z7bCKUHaw=";
   };
 
-  npmDepsHash = "sha256-0lVx2s58XFa9xj2fiP6P5jCfVeUZ8pFkmdy/J6yDK9A=";
+  npmDepsHash = "sha256-/hknNGUG02jFEYfYNM/eShiNptktJcc4XGAG3klfryA=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/lm/lmstudio/package.nix b/pkgs/by-name/lm/lmstudio/package.nix
index 3f6eddb71be0..3b5bd0383065 100644
--- a/pkgs/by-name/lm/lmstudio/package.nix
+++ b/pkgs/by-name/lm/lmstudio/package.nix
@@ -7,10 +7,10 @@
 let
   pname = "lmstudio";
 
-  version_aarch64-darwin = "0.3.28-2";
-  hash_aarch64-darwin = "sha256-7sxhKZwZKzA2VUPHsChgysxXMB7SKEd9zK4kIPbWYjo=";
-  version_x86_64-linux = "0.3.28-2";
-  hash_x86_64-linux = "sha256-ewVjJ0Sy5Zwf9tvlfngQKnAfAv3BvPIAO+p1tJ3mO8M=";
+  version_aarch64-darwin = "0.3.30-2";
+  hash_aarch64-darwin = "sha256-49wubBIteg+gs9RQEozRiiFgWnVlHm1aOf7EqK1uvt4=";
+  version_x86_64-linux = "0.3.30-2";
+  hash_x86_64-linux = "sha256-v2m5/BoyGXRi09To9rHp79+t2QnT5U0XuL5WNpfWWRU=";
 
   meta = {
     description = "LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)";
diff --git a/pkgs/by-name/lm/lmstudio/update.sh b/pkgs/by-name/lm/lmstudio/update.sh
index 415c2006e172..c884550ecae0 100755
--- a/pkgs/by-name/lm/lmstudio/update.sh
+++ b/pkgs/by-name/lm/lmstudio/update.sh
@@ -3,13 +3,14 @@
 
 set -euo pipefail
 
-packages="$(curl -s -L "https://lmstudio.ai/" | grep -oE 'https://installers.lmstudio.ai[^"\]*' | sort -u | grep -v \\.exe)"
 for system in "aarch64-darwin darwin/arm64" "x86_64-linux linux/x64"; do
   # shellcheck disable=SC2086
   set -- ${system} # split string into variables $1 and $2
 
   arch="${1}"
-  url=$(echo "${packages}" | grep "${2}")
+  platform="${2}"
+
+  url=$(curl -ILs -o /dev/null -w %{url_effective} "https://lmstudio.ai/download/latest/${platform}")
   version="$(echo "${url}" | cut -d/ -f6)"
   hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 "$(nix-prefetch-url "${url}")")
 
diff --git a/pkgs/by-name/m1/m1n1/package.nix b/pkgs/by-name/m1/m1n1/package.nix
index 868003eaaa35..960f27cef605 100644
--- a/pkgs/by-name/m1/m1n1/package.nix
+++ b/pkgs/by-name/m1/m1n1/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "m1n1";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "AsahiLinux";
     repo = "m1n1";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J1PZVaEdI6gx/qzsoVW1ehRQ/ZDKzdC1NgIGgBqxQ+0=";
+    hash = "sha256-/TQpR/3OUM4OIrfv6cBgZigyLR0VKw6Rd1v9465wy3o=";
   };
 
   postPatch = lib.optionalString (customLogo != null) ''
diff --git a/pkgs/by-name/ma/mailutils/don-t-use-descrypt-password-in-the-test-suite.patch b/pkgs/by-name/ma/mailutils/don-t-use-descrypt-password-in-the-test-suite.patch
index ac85496018ad..7f224c73954b 100644
--- a/pkgs/by-name/ma/mailutils/don-t-use-descrypt-password-in-the-test-suite.patch
+++ b/pkgs/by-name/ma/mailutils/don-t-use-descrypt-password-in-the-test-suite.patch
@@ -31,7 +31,7 @@ index 930861d8a..3b67844d2 100644
  }
  
  set POP3D_ETC_DIR "$MU_DATA_DIR/etc"
-+set MU_PASSWD_HASH [exec mkpasswd --method=yescrypt guessme]
++set MU_PASSWD_HASH [exec mkpasswd -m yescrypt guessme]
  mu_makespool "$MU_RC_DIR" "$POP3D_ETC_DIR"
  mu_create_config pop3d
  
diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 7defb66efee7..abb2695d21a1 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-dZIcUaHPdXNgzUhSUld2TAKJVfktRahc7OtOwYRlKSQ=";
+    hash = "sha256-2WiQtNuhuCJfKIoRKNFaX50Jah4nn2aqlAGrRq/+kww=";
   };
 
-  cargoHash = "sha256-tmImZOGERNvAI4I8H4nuJAdrMrMyOYza43+SVdyjFNc=";
+  cargoHash = "sha256-lLWQy9f7vQ+8K0gOCcantAf5644v6Y6MDRvaBvJZJKA=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
diff --git a/pkgs/by-name/md/mdadm4/package.nix b/pkgs/by-name/md/mdadm4/package.nix
index 7806e313f583..f2d69266ac17 100644
--- a/pkgs/by-name/md/mdadm4/package.nix
+++ b/pkgs/by-name/md/mdadm4/package.nix
@@ -8,15 +8,17 @@
   system-sendmail,
   udev,
   udevCheckHook,
+  gitUpdater,
+  nixosTests,
 }:
 
 stdenv.mkDerivation rec {
   pname = "mdadm";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/raid/mdadm/mdadm-${version}.tar.xz";
-    sha256 = "sha256-QWcnrh8QgOpuMJDOo23QdoJvw2kVHjarc2VXupIZb58=";
+    sha256 = "sha256-m0iPNe0VPfmZJLX+Qe7TgOhRLejxihGGKMrN1oGx1XM=";
   };
 
   patches = [
@@ -32,10 +34,6 @@ stdenv.mkDerivation rec {
       url = "https://lore.kernel.org/linux-raid/20240220165158.3521874-1-raj.khem@gmail.com/raw";
       hash = "sha256-JOZ8n7zi+nq236NPpB4e2gUy8I3l3DbcoLhpeL73f98=";
     })
-    (fetchurl {
-      url = "https://github.com/md-raid-utilities/mdadm/commit/9dbd11e091f84eb0bf9d717283774816c4c4453d.patch";
-      hash = "sha256-8GdjP1ceVwejTOFXcHXG8wkIF9/D6hOUGD6btvuqs24=";
-    })
   ];
 
   makeFlags = [
@@ -80,6 +78,17 @@ stdenv.mkDerivation rec {
     grep -r $out $out/bin && false || true
   '';
 
+  passthru = {
+    tests = {
+      inherit (nixosTests) systemd-initrd-swraid;
+      installer-swraid = nixosTests.installer.swraid;
+    };
+    updateScript = gitUpdater {
+      url = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";
+      rev-prefix = "mdadm-";
+    };
+  };
+
   meta = with lib; {
     description = "Programs for managing RAID arrays under Linux";
     homepage = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git";
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 1505f7c2a6b8..98ee0b167f6a 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -16,14 +16,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     tag = version;
-    hash = "sha256-VMLcGtyJIH3jsTkHrIUhCpjwm6ljsRSyRECYhaafjD8=";
+    hash = "sha256-t4a/Zp8rC+DMjskdwVvYIfYDAT57zGVfVu7IApwRNGA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 148b3e32ab9d..94ab92df4a06 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -162,11 +162,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "141.0.3537.85";
+  version = "141.0.3537.92";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-BNLA4FeKxWZ8t5YMPbWK4z2UerjcVpbcBgotSfczVsA=";
+    hash = "sha256-nN/TgbaxOrALzMB56TO9ZbxIjJPTCxxWyr2WOMvY6Kg=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/mo/mountain-duck/package.nix b/pkgs/by-name/mo/mountain-duck/package.nix
index 903147d09706..b2c928db3105 100644
--- a/pkgs/by-name/mo/mountain-duck/package.nix
+++ b/pkgs/by-name/mo/mountain-duck/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mountain-duck";
-  version = "5.0.2.28022";
+  version = "5.0.4.28064";
 
   src = fetchurl {
     url = "https://dist.mountainduck.io/Mountain%20Duck-${finalAttrs.version}.zip";
-    sha256 = "sha256-QismxRiDN6AfzaR8/WZq4O9Wj7knMXhGtIWjkhg/rAQ=";
+    sha256 = "sha256-f69DBNj15dxkNxmFtoxA3d/bSpagpOX7l84fE4a/VWw=";
   };
   dontUnpack = true;
 
diff --git a/pkgs/by-name/mu/multimon-ng/package.nix b/pkgs/by-name/mu/multimon-ng/package.nix
index ce1289e9a50c..fea28eb14143 100644
--- a/pkgs/by-name/mu/multimon-ng/package.nix
+++ b/pkgs/by-name/mu/multimon-ng/package.nix
@@ -7,6 +7,7 @@
   libX11,
   makeWrapper,
   sox,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation rec {
@@ -20,6 +21,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/2NHUlAojDamNq/EVs8hoBYVikPLAFFFu/2syG4Xo4U=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/EliasOenal/multimon-ng/commit/1c111e83053e9e78ba568463cc015edadf77ed5f.diff";
+      hash = "sha256-gW9ihUn3rZcyurbu7+IhkWSotqWlJsHdeFHu12oVld4=";
+    })
+  ];
+
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     libpulseaudio
     libX11
diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index bbd822c31a56..3b2c2fedb72a 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "4.11.4";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-1tJPYLo14LPwd7mtNTvr6YMGz0s+K6aN9Hung/N9lrM=";
+    hash = "sha256-W1k65a67/77f8NBGOzHV4eVzoICnynxNeIYAefq+Fzo=";
   };
 
-  vendorHash = "sha256-k/EeQdThF8pgeY9RI012kjlEZkVVcnanL6L8UBrQTUI=";
+  vendorHash = "sha256-+YMR9Y5iSkpcHEg1IlSN3kB3fZAx5WNcOU71LXHhVV0=";
 
   subPackages = ".";
 
diff --git a/pkgs/by-name/ne/nelm/package.nix b/pkgs/by-name/ne/nelm/package.nix
index d31162a9ef91..17eb53bbe9f2 100644
--- a/pkgs/by-name/ne/nelm/package.nix
+++ b/pkgs/by-name/ne/nelm/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nelm";
-  version = "1.13.2";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "nelm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g/JnFD1TPVKllY1yrODJ9P0bJe2357B11XAn9tQPLE8=";
+    hash = "sha256-yAd+4Up5SDVlrwa/46lQmCS257T16Wf6PSo7an07H8I=";
   };
 
   vendorHash = "sha256-yd9qSQi7ktbI9b5eaTc98TjhxDsBVvh9qrf3+F2Twu4=";
diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 3b9b0098765a..cff35f454d3a 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nghttp3";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "https://github.com/ngtcp2/nghttp3/releases/download/v${finalAttrs.version}/nghttp3-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-AAKlyoVtsFmqbcac9zL7sA2aHnPteISPXUjyYh8gyoo=";
+    hash = "sha256-KFl4NTevIT1npc5Cd923nIlBrUXtv6XM3VLZz0/6Qi0=";
   };
 
   outputs = [
@@ -23,16 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags =
-    if stdenv.hostPlatform.isStatic then
-      [
-        (lib.cmakeBool "ENABLE_SHARED_LIB" false)
-        (lib.cmakeBool "ENABLE_STATIC_LIB" true)
-      ]
-    else
-      [
-        (lib.cmakeBool "ENABLE_STATIC_LIB" false)
-      ];
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_SHARED_LIB" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "ENABLE_STATIC_LIB" stdenv.hostPlatform.isStatic)
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/by-name/nl/nlohmann_json/package.nix b/pkgs/by-name/nl/nlohmann_json/package.nix
index e11fa98c8373..23b36c48cffd 100644
--- a/pkgs/by-name/nl/nlohmann_json/package.nix
+++ b/pkgs/by-name/nl/nlohmann_json/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-cECvDOLxgX7Q9R3IE86Hj9JJUxraDQvhoyPDF03B2CY=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isMusl [
+  patches = [
     # Musl does not support LC_NUMERIC, causing a test failure.
     # Turn the error into a warning to make the test succeed.
     # https://github.com/nlohmann/json/pull/4770
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 42d2bcb886b1..ae63b28381c8 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.18.0";
+  version = "2.20.0";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     tag = "v${version}";
-    hash = "sha256-xIe7CgGzNNYzhkazjrejvZGfuLL4RqFCfXOUtFEgLCA=";
+    hash = "sha256-3jkHwHEuwq+KmPyDqdRsHtU4HJiBSogifufUiFpsYkI=";
   };
 
   vendorHash = "sha256-d5KTDZKfuzv84oMgmsjJoXGO5XYLVKxOB5XehqgRvYw=";
diff --git a/pkgs/by-name/on/onetbb/package.nix b/pkgs/by-name/on/onetbb/package.nix
index 6cebaf75422c..ad181f1464ca 100644
--- a/pkgs/by-name/on/onetbb/package.nix
+++ b/pkgs/by-name/on/onetbb/package.nix
@@ -4,7 +4,9 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
+  hwloc,
   ninja,
+  pkg-config,
   ctestCheckHook,
 }:
 
@@ -55,6 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     ctestCheckHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    hwloc
   ];
 
   doCheck = true;
@@ -74,6 +81,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'tbb_add_test(SUBDIR conformance NAME conformance_resumable_tasks DEPENDENCIES TBB::tbb)' ""
   '';
 
+  cmakeFlags = [
+    (lib.cmakeBool "TBB_DISABLE_HWLOC_AUTOMATIC_SEARCH" false)
+  ];
+
   env = {
     # Fix build with modern gcc
     # In member function 'void std::__atomic_base<_IntTp>::store(__int_type, std::memory_order) [with _ITp = bool]',
@@ -83,6 +94,11 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_LDFLAGS = lib.optionalString (
       stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17"
     ) "--undefined-version";
+
+    # Some test fail because hwloc tries to read /sys on non-x86, which doesn't
+    # work in the build sandbox, so provide fake data to satisfy it
+    # See: https://www-lb.open-mpi.org/projects/hwloc/doc/v2.12.2/synthetic.html
+    HWLOC_SYNTHETIC = "node:1 core:1 pu:1";
   };
 
   meta = {
diff --git a/pkgs/by-name/op/open62541/package.nix b/pkgs/by-name/op/open62541/package.nix
index 18303e4e5a0d..5107a1bf0ab6 100644
--- a/pkgs/by-name/op/open62541/package.nix
+++ b/pkgs/by-name/op/open62541/package.nix
@@ -33,13 +33,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "open62541";
-  version = "1.4.13";
+  version = "1.4.14";
 
   src = fetchFromGitHub {
     owner = "open62541";
     repo = "open62541";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-y4yxdO55fMmkP+nCU6ToabvAPi6hgXHiDXpF3tNEHNw=";
+    hash = "sha256-+gE1wlxAyUVgHnDhkHEu9IwCCIKDuAHUzkThuDgdzdE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/p1/p11-kit/package.nix b/pkgs/by-name/p1/p11-kit/package.nix
index c00c752997c9..d770115b423d 100644
--- a/pkgs/by-name/p1/p11-kit/package.nix
+++ b/pkgs/by-name/p1/p11-kit/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p11-kit";
-  version = "0.25.5";
+  version = "0.25.9";
 
   src = fetchFromGitHub {
     owner = "p11-glue";
     repo = "p11-kit";
     tag = version;
-    hash = "sha256-2xDUvXGsF8x42uezgnvOXLVUdNNHcaE042HDDEJeplc=";
+    hash = "sha256-lvm//lsG5xSz1dBuvp4bJvNS+zCYTuAqXC22Po95JJg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pa/pango/package.nix b/pkgs/by-name/pa/pango/package.nix
index a24383b6d805..aa2a81bfe635 100644
--- a/pkgs/by-name/pa/pango/package.nix
+++ b/pkgs/by-name/pa/pango/package.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pango";
-  version = "1.56.3";
+  version = "1.56.4";
 
   outputs = [
     "bin"
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/pango/${lib.versions.majorMinor finalAttrs.version}/pango-${finalAttrs.version}.tar.xz";
-    hash = "sha256-JgYlK8Jc2NJOG39+ksOicrN6zWc0NHtztHpIKDS6JJE=";
+    hash = "sha256-FwZeL8xfWlvb/8iEyVa/x8RRqW6MT7L4rYN8ZBPLWgE=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/pa/particle-cli/package.nix b/pkgs/by-name/pa/particle-cli/package.nix
index ce2d2164d7e6..5a1a482b7798 100644
--- a/pkgs/by-name/pa/particle-cli/package.nix
+++ b/pkgs/by-name/pa/particle-cli/package.nix
@@ -26,10 +26,6 @@ buildNpmPackage (finalAttrs: {
   dontNpmBuild = true;
   dontNpmPrune = true;
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   postInstall = ''
     install -D -t $out/etc/udev/rules.d \
       $out/lib/node_modules/particle-cli/assets/50-particle.rules
diff --git a/pkgs/by-name/pm/pmtiles/darwin-sandbox-fix.patch b/pkgs/by-name/pm/pmtiles/darwin-sandbox-fix.patch
new file mode 100644
index 000000000000..b390d492467c
--- /dev/null
+++ b/pkgs/by-name/pm/pmtiles/darwin-sandbox-fix.patch
@@ -0,0 +1,20 @@
+--- vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
++++ vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
+@@ -696,7 +696,7 @@ func init() {
+ 	// Load protocols
+ 	data, err := ioutil.ReadFile("/etc/protocols")
+ 	if err != nil {
+-		if !os.IsNotExist(err) {
++		if !os.IsNotExist(err) && !os.IsPermission(err) {
+ 			panic(err)
+ 		}
+ 
+@@ -732,7 +732,7 @@ func init() {
+ 	// Load services
+ 	data, err = ioutil.ReadFile("/etc/services")
+ 	if err != nil {
+-		if !os.IsNotExist(err) {
++		if !os.IsNotExist(err) && !os.IsPermission(err) {
+ 			panic(err)
+ 		}
+ 
diff --git a/pkgs/by-name/pm/pmtiles/package.nix b/pkgs/by-name/pm/pmtiles/package.nix
index cca23b28c474..554fea30290e 100644
--- a/pkgs/by-name/pm/pmtiles/package.nix
+++ b/pkgs/by-name/pm/pmtiles/package.nix
@@ -5,16 +5,23 @@
 }:
 buildGoModule rec {
   pname = "pmtiles";
-  version = "1.28.1";
+  version = "1.28.2";
 
   src = fetchFromGitHub {
     owner = "protomaps";
     repo = "go-pmtiles";
     tag = "v${version}";
-    hash = "sha256-Ti6ljJeC6hqA5edzyUqOShBIbdmrsz4TDnQ44TMJQ8Q=";
+    hash = "sha256-JGsbgBB2T+4SWKQmiSmuMqQ8gw0qhM5c5eFDF/+sndA=";
   };
 
-  vendorHash = "sha256-kfEzpaFMf0W8Ygtl40LBy3AZQSL+9Uo+n2x9OTOavqk=";
+  vendorHash = "sha256-6zsX7rU+D+RUHwXfFZzLQftQ6nSYJhvKIDdsO2vow4A=";
+
+  overrideModAttrs = old: {
+    # https://gitlab.com/cznic/libc/-/merge_requests/10
+    postBuild = ''
+      patch -p0 < ${./darwin-sandbox-fix.patch}
+    '';
+  };
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pp/ppp/package.nix b/pkgs/by-name/pp/ppp/package.nix
index 280fa0522e89..b49ba381d536 100644
--- a/pkgs/by-name/pp/ppp/package.nix
+++ b/pkgs/by-name/pp/ppp/package.nix
@@ -2,6 +2,7 @@
   autoreconfHook,
   bash,
   fetchFromGitHub,
+  fetchpatch,
   lib,
   libpcap,
   libxcrypt,
@@ -25,6 +26,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-NV8U0F8IhHXn0YuVbfFr992ATQZaXA16bb5hBIwm9Gs=";
   };
 
+  patches = [
+    # Fix build with gcc15
+    # https://github.com/ppp-project/ppp/pull/548
+    (fetchpatch {
+      url = "https://github.com/ppp-project/ppp/commit/05361692ee7d6260ce5c04c9fa0e5a1aa7565323.patch";
+      hash = "sha256-ybuWyA1t9IJ1Sg06a0b0tin4qssr0qzmenfGoA1X0BE=";
+    })
+  ];
+
   configureFlags = [
     "--localstatedir=/var"
     "--sysconfdir=/etc"
diff --git a/pkgs/by-name/py/pyright/package-lock.json b/pkgs/by-name/py/pyright/package-lock.json
index 221d0e3ff742..4505415580bf 100644
--- a/pkgs/by-name/py/pyright/package-lock.json
+++ b/pkgs/by-name/py/pyright/package-lock.json
@@ -6,7 +6,7 @@
     "": {
       "name": "pyright-root",
       "devDependencies": {
-        "glob": "^7.2.3",
+        "glob": "^8.1.0",
         "jsonc-parser": "^3.3.1"
       }
     },
@@ -18,23 +18,15 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
+        "balanced-match": "^1.0.0"
       }
     },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
@@ -43,9 +35,9 @@
       "license": "ISC"
     },
     "node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
+      "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
       "deprecated": "Glob versions prior to v9 are no longer supported",
       "dev": true,
       "license": "ISC",
@@ -53,12 +45,11 @@
         "fs.realpath": "^1.0.0",
         "inflight": "^1.0.4",
         "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "minimatch": "^5.0.1",
+        "once": "^1.3.0"
       },
       "engines": {
-        "node": "*"
+        "node": ">=12"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -91,16 +82,16 @@
       "license": "MIT"
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
+      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^1.1.7"
+        "brace-expansion": "^2.0.1"
       },
       "engines": {
-        "node": "*"
+        "node": ">=10"
       }
     },
     "node_modules/once": {
@@ -113,16 +104,6 @@
         "wrappy": "1"
       }
     },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
index 9e649914c0bd..dea2ba75cea0 100644
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -7,13 +7,13 @@
 }:
 
 let
-  version = "1.1.403";
+  version = "1.1.406";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "pyright";
     tag = version;
-    hash = "sha256-vqE/3wK0rtFT9f399djm4QElRccXdOXyODsQMQySa9k=";
+    hash = "sha256-hSPnUjIZf9od1u7PwgEFDXGWmizjdqSiXjb45wZIM9Q=";
   };
 
   patchedPackageJSON = runCommand "package.json" { } ''
@@ -27,7 +27,7 @@ let
     pname = "pyright-root";
     inherit version src;
     sourceRoot = "${src.name}"; # required for update.sh script
-    npmDepsHash = "sha256-1OrUBARwNvT8pTH66W7GAKG8B5fX8/6jtOOYVU6IgSw=";
+    npmDepsHash = "sha256-4DVWWoLnNXoJ6eWeQuOzAVjcvo75Y2nM/HwQvAEN4ME=";
     dontNpmBuild = true;
     postPatch = ''
       cp ${patchedPackageJSON} ./package.json
@@ -44,7 +44,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-Tc7v6sDu0PR//ukvw9hULX0KGpRkA0hEaeuKlPnpYl4=";
+    npmDepsHash = "sha256-BzyZEJUOEqPBpPrVNhf/kDOBS3Q4Hgkpfz+JDccHr4g=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -58,7 +58,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-wzjdeZr6tbaBuOWDJXeTFkQRUHnxYryvI7sfGsSEpVQ=";
+  npmDepsHash = "sha256-Ye8r7m4755GfU74G8Neetu+BlrHQWoQe7y2TyOjvBOo=";
 
   postPatch = ''
     chmod +w ../../
diff --git a/pkgs/by-name/qa/qadwaitadecorations/package.nix b/pkgs/by-name/qa/qadwaitadecorations/package.nix
index 7a1f1abb2037..0517d0a13cbd 100644
--- a/pkgs/by-name/qa/qadwaitadecorations/package.nix
+++ b/pkgs/by-name/qa/qadwaitadecorations/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   cmake,
   qt5,
   qt6,
@@ -30,6 +31,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Zg2G3vuRD/kK5C2fFq6Cft218uFyBvfXtO1DHKQECFQ=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/FedoraQt/QAdwaitaDecorations/pull/88
+      name = "Fix build with Qt 6.10";
+      url = "https://github.com/FedoraQt/QAdwaitaDecorations/commit/e6da80a440218b87e441c8a698014ef3962af98b.patch?full_index=1";
+      hash = "sha256-7ZmceoOzUDHvvCX+8SwuX+DIi65d6hYIYfpikMiN0wM=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/by-name/qv/qview/package.nix b/pkgs/by-name/qv/qview/package.nix
index d3c1fcea9d0d..58b7f1c92e74 100644
--- a/pkgs/by-name/qv/qview/package.nix
+++ b/pkgs/by-name/qv/qview/package.nix
@@ -2,42 +2,51 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  libsForQt5,
+  qt6,
+  nix-update-script,
+  kdePackages,
   x11Support ? true,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qview";
   version = "7.1";
 
   src = fetchFromGitHub {
     owner = "jurplel";
     repo = "qView";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-EcXhwJcgBLdXa/FQ5LuENlzwnLw4Gt2BGlBO1p5U8tI=";
   };
 
-  qmakeFlags = lib.optionals (!x11Support) [ "CONFIG+=NO_X11" ];
-
   nativeBuildInputs = [
-    libsForQt5.qmake
-    libsForQt5.wrapQtAppsHook
+    qt6.qmake
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
-    libsForQt5.qtbase
-    libsForQt5.qttools
-    libsForQt5.qtimageformats
-    libsForQt5.qtsvg
-  ]
-  ++ lib.optionals x11Support [ libsForQt5.qtx11extras ];
+    qt6.qtbase
+    qt6.qttools
+    qt6.qtimageformats
+    qt6.qtsvg
+    kdePackages.kimageformats
+  ];
 
-  meta = with lib; {
+  qmakeFlags = [
+    # See https://github.com/NixOS/nixpkgs/issues/214765
+    "QT_TOOL.lrelease.binary=${lib.getDev qt6.qttools}/bin/lrelease"
+  ]
+  ++ lib.optionals (!x11Support) [ "CONFIG+=NO_X11" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Practical and minimal image viewer";
     mainProgram = "qview";
+    changelog = "https://github.com/jurplel/qView/releases/tag/${finalAttrs.version}";
     homepage = "https://interversehq.com/qview/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ acowley ];
-    platforms = platforms.all;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ acowley ];
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/re/retool/package.nix b/pkgs/by-name/re/retool/package.nix
index ff7747e7e112..7bab9561e755 100644
--- a/pkgs/by-name/re/retool/package.nix
+++ b/pkgs/by-name/re/retool/package.nix
@@ -8,7 +8,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "retool";
-  version = "2.4.2";
+  version = "2.4.3";
 
   pyproject = true;
   disabled = python3.pkgs.pythonOlder "3.10";
@@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "unexpectedpanda";
     repo = "retool";
     tag = "v${version}";
-    hash = "sha256-jb2HJjXBxfdOY9TI37D5xwtySlYoSJwckrLC+h7YqoM=";
+    hash = "sha256-uYzsHraA5LX+5wZWSAO7lOFhssd7LojftLP5pufgUcc=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/rs/rssguard/package.nix b/pkgs/by-name/rs/rssguard/package.nix
index 8eed1049eac5..700967b0557b 100644
--- a/pkgs/by-name/rs/rssguard/package.nix
+++ b/pkgs/by-name/rs/rssguard/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  qt6,
   kdePackages,
   wrapGAppsHook4,
 }:
@@ -19,20 +20,28 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    kdePackages.qtwebengine
-    kdePackages.qttools
+    qt6.qtbase
+    qt6.qtmultimedia
+    qt6.qtwebengine
+    qt6.qttools
+    qt6.qt5compat
     kdePackages.mpvqt
-    kdePackages.full
   ];
   nativeBuildInputs = [
     cmake
     wrapGAppsHook4
-    kdePackages.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
   cmakeFlags = with lib; [
     (cmakeFeature "CMAKE_BUILD_TYPE" "\"Release\"")
   ];
 
+  dontWrapGApps = true;
+
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   meta = {
     description = "Simple RSS/Atom feed reader with online synchronization";
     mainProgram = "rssguard";
diff --git a/pkgs/by-name/ru/rure/Cargo.lock b/pkgs/by-name/ru/rure/Cargo.lock
index 112698c1c39c..e467ee4229ca 100644
--- a/pkgs/by-name/ru/rure/Cargo.lock
+++ b/pkgs/by-name/ru/rure/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 4
+version = 3
 
 [[package]]
 name = "aho-corasick"
@@ -13,21 +13,21 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.175"
+version = "0.2.177"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
 
 [[package]]
 name = "memchr"
-version = "2.7.5"
+version = "2.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
 
 [[package]]
 name = "regex"
-version = "1.11.2"
+version = "1.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -37,9 +37,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.10"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
+checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -48,13 +48,13 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.6"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
+checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
 
 [[package]]
 name = "rure"
-version = "0.2.3"
+version = "0.2.4"
 dependencies = [
  "libc",
  "regex",
diff --git a/pkgs/by-name/ru/rure/pin.json b/pkgs/by-name/ru/rure/pin.json
index 5078676c08ca..7fc7680099f9 100644
--- a/pkgs/by-name/ru/rure/pin.json
+++ b/pkgs/by-name/ru/rure/pin.json
@@ -1,5 +1,5 @@
 {
   "pname": "rure",
-  "version": "0.2.3",
-  "hash": "sha256:0d8r0fv93ganqi9iyrgljbkvrvys33n0zrkaf11zsb23b2hwcsxa"
+  "version": "0.2.4",
+  "hash": "sha256:02wgpjllvlqhcpj8w59qwfjhxch3qy5i2qg3a1v1555dhhzqnnwl"
 }
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index b09f5e031e9e..6d8aa7a2c2f9 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.7-unstable-2025-10-14";
+  version = "11.7-unstable-2025-10-20";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "e338a5d36920e006d45880d9a89a2fb85068b0aa";
-    hash = "sha256-UpjJf45xuyn7zIMK/vj8UMmRYUuDcYe7GpLaOuxctNM=";
+    rev = "479045bf9445789c6a0a0252dd6fc092f2b0b507";
+    hash = "sha256-F7IPAjIlfZcuj9Of0wDYQWPTAWWZO9z6/FbjHwZlJAo=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/sc/sccache/package.nix b/pkgs/by-name/sc/sccache/package.nix
index 9dc1834f5b29..f7648cf09e26 100644
--- a/pkgs/by-name/sc/sccache/package.nix
+++ b/pkgs/by-name/sc/sccache/package.nix
@@ -8,17 +8,17 @@
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
-  version = "0.11.0";
+  version = "0.12.0";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-x+TeFJa15eLmdUAAL4GH+bz6LWJZ/8Z0C1NcJ04MWc8=";
+    sha256 = "sha256-QNLcA31SJf7XmxYvzDC5LCKVu5ZWiw7U249KjUAGIZw=";
   };
 
-  cargoHash = "sha256-FyzeSiewKZhw1iIT6831W/FAx9IrG+Kswi5QWkQ0zQk=";
+  cargoHash = "sha256-tJGGS6Zpsz9nye2VKdZRuFeeqJ71MsXn3C9ytqeEW5I=";
 
   buildFeatures = lib.optionals distributed [
     "dist-client"
diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index b03ebd819ddd..8488b5345258 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -62,7 +62,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.2.22";
+  version = "3.2.24";
 
   outputs = [
     "lib"
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-4jGfw2hNZTGuae2DMLz8xJBtfNu5abIN5GlNIKDOUpw=";
+    hash = "sha256-LUkj9Rrf+zOW0IdV7aGccb/5bKh3TWf1IGtQkCDHd4k=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index 7eda4bf32f0f..0a3d216255e5 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -25,8 +25,17 @@ python.pkgs.toPythonModule (
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
 
-    # upstream pins every dependency
-    pythonRelaxDeps = true;
+    pythonRelaxDeps = [
+      "certifi"
+      "flask"
+      "flask-babel"
+      "httpx-socks"
+      "lxml"
+      "setproctitle"
+      "typer-slim"
+      "typing-extensions"
+      "whitenoise"
+    ];
 
     preBuild =
       let
diff --git a/pkgs/by-name/sh/shotwell/package.nix b/pkgs/by-name/sh/shotwell/package.nix
index 54484d5979e0..b865347be5ff 100644
--- a/pkgs/by-name/sh/shotwell/package.nix
+++ b/pkgs/by-name/sh/shotwell/package.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     export GDK_PIXBUF_MODULE_FILE="${
       gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
         extraLoaders = [
-          libheif.out
+          libheif.lib
         ];
       }
     }"
diff --git a/pkgs/by-name/si/sitespeed-io/package.nix b/pkgs/by-name/si/sitespeed-io/package.nix
index e273ba9ce236..143035076af9 100644
--- a/pkgs/by-name/si/sitespeed-io/package.nix
+++ b/pkgs/by-name/si/sitespeed-io/package.nix
@@ -35,10 +35,6 @@ buildNpmPackage rec {
     hash = "sha256-45lvEM8vkoXdbZNJamUR94PD0EwtoNEhWSNyV68yzPo=";
   };
 
-  postPatch = ''
-    ln -s npm-shrinkwrap.json package-lock.json
-  '';
-
   # Don't try to download the browser drivers
   CHROMEDRIVER_SKIP_DOWNLOAD = true;
   GECKODRIVER_SKIP_DOWNLOAD = true;
diff --git a/pkgs/by-name/so/softhsm/package.nix b/pkgs/by-name/so/softhsm/package.nix
index 9a7d3746d7cf..77a2e6a56f07 100644
--- a/pkgs/by-name/so/softhsm/package.nix
+++ b/pkgs/by-name/so/softhsm/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  botan2,
+  openssl,
   sqlite,
   autoreconfHook,
 }:
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--with-crypto-backend=botan"
-    "--with-botan=${lib.getDev botan2}"
+    "--with-crypto-backend=openssl"
+    "--with-openssl=${lib.getDev openssl}"
     "--with-objectstore-backend-db"
     "--sysconfdir=$out/etc"
     "--localstatedir=$out/var"
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    botan2
+    openssl
     sqlite
   ];
 
diff --git a/pkgs/by-name/sp/spirv-cross/package.nix b/pkgs/by-name/sp/spirv-cross/package.nix
index 4f721392245f..ecc7dd1219fe 100644
--- a/pkgs/by-name/sp/spirv-cross/package.nix
+++ b/pkgs/by-name/sp/spirv-cross/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-qmJK29PtjDE4+6uF8Mj6noAcRoeM3rHWRbUvcr6JzI0=";
+    hash = "sha256-Fq2Kw8KOlh35hRZy5EnPtWAjazun4vdTk/HyhY76GRM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/spirv-headers/package.nix b/pkgs/by-name/sp/spirv-headers/package.nix
index 8a4f92e9dfb2..400c8244a344 100644
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -5,18 +5,15 @@
   cmake,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-headers";
-  version = "1.4.321.0-unstable-2025-06-24";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
-    # The release for Vulkan SDK 1.4.321.0 is missing a PR required for
-    # LLVM 21 support in SPIRV-LLVM-Translator; return to the
-    # `vulkan-sdk-*` tags on the next stable release.
-    rev = "9e3836d7d6023843a72ecd3fbf3f09b1b6747a9e";
-    hash = "sha256-N8NBAkkpOcbgap4loPJJW6E5bjG+TixCh/HN259RyjI=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-gewCQvcVRw+qdWPWRlYUMTt/aXrZ7Lea058WyqL5c08=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -27,4 +24,4 @@ stdenv.mkDerivation {
     license = licenses.mit;
     maintainers = [ maintainers.ralith ];
   };
-}
+})
diff --git a/pkgs/by-name/sp/spirv-tools/package.nix b/pkgs/by-name/sp/spirv-tools/package.nix
index afd55c4dc742..03b10d0abcd9 100644
--- a/pkgs/by-name/sp/spirv-tools/package.nix
+++ b/pkgs/by-name/sp/spirv-tools/package.nix
@@ -7,18 +7,15 @@
   spirv-headers,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-tools";
-  version = "1.4.321.0-unstable-2025-06-25";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
-    # The SPIRV-Headers release for Vulkan SDK 1.4.321.0 is missing
-    # a PR required for LLVM 21 support in SPIRV-LLVM-Translator;
-    # return to the `vulkan-sdk-*` tags on the next stable release.
-    rev = "28a883ba4c67f58a9540fb0651c647bb02883622";
-    hash = "sha256-yRzpEBGyTr9oovsh3TUnJsR/luHNAPkotcJFWh7R1Fc=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-NXxC5XLvEEIAlA0sym6l7vWj+g8pJ4trsJI3pmZwRxU=";
   };
 
   # The cmake options are sufficient for turning on static building, but not
@@ -60,4 +57,4 @@ stdenv.mkDerivation {
     platforms = with platforms; unix ++ windows;
     maintainers = [ maintainers.ralith ];
   };
-}
+})
diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index bb08112461f0..23b9b4b359e8 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "6.16";
+  version = "6.17";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-PXrufk8ESy9n89UainbtoYB26fsndN5UrDUdd31Ov/o=";
+    hash = "sha256-Cnx77cfvwHbzJCoDEK8q5jwpKjbdQjbweeiKk+mMucA=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/ta/tangerine/package.nix b/pkgs/by-name/ta/tangerine/package.nix
index 394c5bb331ed..98d324d770b3 100644
--- a/pkgs/by-name/ta/tangerine/package.nix
+++ b/pkgs/by-name/ta/tangerine/package.nix
@@ -37,6 +37,14 @@ stdenv.mkDerivation {
     libX11
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.24)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace third_party/glm-0.9.9.8/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.2 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)" \
+      --replace-fail "cmake_policy(VERSION 3.2)" "cmake_policy(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     description = "System for creating 3D models procedurally from a set of Signed Distance Function (SDF) primitive shapes and combining operators";
     homepage = "https://github.com/Aeva/tangerine";
diff --git a/pkgs/by-name/tb/tbls/package.nix b/pkgs/by-name/tb/tbls/package.nix
index 2515e5067f71..588da1a82ca5 100644
--- a/pkgs/by-name/tb/tbls/package.nix
+++ b/pkgs/by-name/tb/tbls/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.89.1";
+  version = "1.90.0";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     tag = "v${version}";
-    hash = "sha256-fGaH9766OjPNz0eVG4M1hKdqRaEkAzwz1lL2o4TxyAo=";
+    hash = "sha256-1CiiRmooy1KG6WsdRyLkttiEGX0ObPyJ/s97DcQXwUU=";
   };
 
   vendorHash = "sha256-hupOff2cJ+UrJFgMyDu3XYvEjyE/XvvyqiQq408wJsw=";
diff --git a/pkgs/by-name/to/todoman/package.nix b/pkgs/by-name/to/todoman/package.nix
index 49c38c8b9210..6460fdd606a8 100644
--- a/pkgs/by-name/to/todoman/package.nix
+++ b/pkgs/by-name/to/todoman/package.nix
@@ -32,18 +32,20 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   dependencies = with python3.pkgs; [
-    atomicwrites
     click
     click-log
-    click-repl
     humanize
     icalendar
     parsedatetime
+    python-dateutil
     pyxdg
-    tabulate
     urwid
   ];
 
+  optional-dependencies = with python3.pkgs; {
+    repl = [ click-repl ];
+  };
+
   nativeCheckInputs = with python3.pkgs; [
     freezegun
     hypothesis
diff --git a/pkgs/by-name/tr/trufflehog/package.nix b/pkgs/by-name/tr/trufflehog/package.nix
index 4d5a074dc4f9..fd83c2e7ef11 100644
--- a/pkgs/by-name/tr/trufflehog/package.nix
+++ b/pkgs/by-name/tr/trufflehog/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.90.9";
+  version = "3.90.11";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${version}";
-    hash = "sha256-XxFgki6haUbfHkhOMuYJW8zNBsJ6a8Rir7s6GqLTbho=";
+    hash = "sha256-X2mqmUjdKHIp/w393hLvD6k7LTBIY9FEb1fI+SckIe4=";
   };
 
-  vendorHash = "sha256-pP8dT211fq/y5Z0poLqJngCY45ba1vJilmkpgnCUHhY=";
+  vendorHash = "sha256-XTjKaRNqSnyLVag5/nBMmKZ6XeTDmd03ujeeMCJCB9Y=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/ud/udevCheckHook/hook.sh b/pkgs/by-name/ud/udevCheckHook/hook.sh
index bdb8e9c1f746..06740394a277 100644
--- a/pkgs/by-name/ud/udevCheckHook/hook.sh
+++ b/pkgs/by-name/ud/udevCheckHook/hook.sh
@@ -12,7 +12,7 @@ udevCheckHook() {
     for output in $(getAllOutputNames); do
         for path in etc lib ; do
             if [ -d "${!output}/$path/udev/rules.d" ]; then
-                @udevadm@ verify --resolve-names=never --no-style "${!output}/$path/udev/rules.d"
+                @udevadm@ verify --resolve-names=late --no-style "${!output}/$path/udev/rules.d"
             fi
         done
     done
diff --git a/pkgs/by-name/ut/utf8cpp/package.nix b/pkgs/by-name/ut/utf8cpp/package.nix
index ebaff9ecb83d..b609e22aab5a 100644
--- a/pkgs/by-name/ut/utf8cpp/package.nix
+++ b/pkgs/by-name/ut/utf8cpp/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "utf8cpp";
-  version = "4.0.6";
+  version = "4.0.8";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-e8qH4eygLnQw7B8x+HN+vH8cr8fkxnTFz+PKtFJ8dGE=";
+    hash = "sha256-9lfs2tqsSDbf1appDC+S3qdmS4DipHhXoiJQluKytbM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index 70303a99050e..ac034405d500 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -41,11 +41,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "util-linux" + lib.optionalString isMinimal "-minimal";
-  version = "2.41.1";
+  version = "2.41.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor finalAttrs.version}/util-linux-${finalAttrs.version}.tar.xz";
-    hash = "sha256-vprZonb0MFq33S9SJci+H/VDUvVl/03t6WKMGqp97Fc=";
+    hash = "sha256-YGKh2JtXGmGTLm/AIR82BgxBg1aLge6GbPNjvOn2WD4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index f77377765b65..8122b1afea86 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.8.19";
+  version = "0.8.23";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-TbCkkZQoRItBmzwn7B8JbXWs72lYiqWV5mOfkvRarsg=";
+    hash = "sha256-5L/FipR5MPsscpWfpDURbC5qwn6XB5KoOrjedk1HzDo=";
   };
 
-  cargoHash = "sha256-09A40qwbRex8WEgCFC2yRZoq+6UnxurJAX8e27G+Rhg=";
+  cargoHash = "sha256-JHfqsT/W7RvoHx9WbA4fdQZw2/+BOSRuGV3mcMx1FN4=";
 
   buildInputs = [
     rust-jemalloc-sys
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index 76d774d12bd7..1f08a8b343fd 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.18.6";
+  version = "0.18.9";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9qRdikwZcTEZEQON2/n3dy9FA34Bu8YTfNfssOcUwgg=";
+    hash = "sha256-uXNSwp+Qqw8drSt+SN20AjoJG9Pmaz0WCozFq8jEv2o=";
   };
 
   vendorHash = "sha256-+GkxN20mZD/ZBTCjmjiDcEAJix2Ssn9HsNrUtQkrI18=";
diff --git a/pkgs/by-name/va/vacuum-tube/package.nix b/pkgs/by-name/va/vacuum-tube/package.nix
index 8762b242f770..b3dcc291ae01 100644
--- a/pkgs/by-name/va/vacuum-tube/package.nix
+++ b/pkgs/by-name/va/vacuum-tube/package.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   buildNpmPackage,
   fetchFromGitHub,
   lib,
@@ -68,5 +69,7 @@ buildNpmPackage rec {
     mainProgram = "VacuumTube";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ theCapypara ];
+    # https://github.com/NixOS/nixpkgs/pull/453698#issuecomment-3422020307
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/vu/vulkan-extension-layer/package.nix b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
index b64bfb519150..057589a9a18c 100644
--- a/pkgs/by-name/vu/vulkan-extension-layer/package.nix
+++ b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-tWUi+yCI7wNLVeGg/h5a+yvKWAu8KZqtgEujfCUtYQ4=";
+    hash = "sha256-J9l20abn7meSF0WnCh3cepYKQh10ezb0mAKzc0HAo1w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-headers/package.nix b/pkgs/by-name/vu/vulkan-headers/package.nix
index c1b118fc6cef..cd719a2021ce 100644
--- a/pkgs/by-name/vu/vulkan-headers/package.nix
+++ b/pkgs/by-name/vu/vulkan-headers/package.nix
@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   # Adding `ninja` here to enable Ninja backend. Otherwise on gcc-14 or
   # later the build fails as:
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-Yznjiiu/EEW7B37hbO0aw8Lvc6aVxOy7J/zSwmGxVc0=";
+    hash = "sha256-Sg/zp6UhRC5wqBS3vdfs0sQL8cBgLiwvfG0oY0v9MWU=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/by-name/vu/vulkan-loader/package.nix b/pkgs/by-name/vu/vulkan-loader/package.nix
index 323dbd95dcbe..97cfc1168acf 100644
--- a/pkgs/by-name/vu/vulkan-loader/package.nix
+++ b/pkgs/by-name/vu/vulkan-loader/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-loader";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-i06il1GRkjSlhY36XpIUCcd1Wy+If+Eennzbb//1dzk=";
+    hash = "sha256-+cuKdhdCMIL4b+GzIpCNrDBmC7cVX0iX2QW7BQIj9Tc=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
index 47bd85ab67b8..b4ec722ca336 100644
--- a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "VulkanTools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-Wd37AYfZ8Ia5kXS9Nvxyj7s+W2DPHUONtqD+tX45XGk=";
+    hash = "sha256-kywAcpBYLSlhEbgssXGwMoXQC03QUEz4dwsvI0I8Nh4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-tools/package.nix b/pkgs/by-name/vu/vulkan-tools/package.nix
index dfd2fc523697..122e75d0e40b 100644
--- a/pkgs/by-name/vu/vulkan-tools/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-cd7aLDhXiZ4Wlnrx2dfCQG3j+9vosM3SeohhCNvVN48=";
+    hash = "sha256-QoqlHrhgaV1SRLAxmYUXaKxH1IdbnxqkcJklDy20ORg=";
   };
 
   patches = [ ./wayland-scanner.patch ];
@@ -70,9 +70,6 @@ stdenv.mkDerivation rec {
   env.PKG_CONFIG_WAYLAND_SCANNER_WAYLAND_SCANNER = lib.getExe buildPackages.wayland-scanner;
 
   cmakeFlags = [
-    # Temporarily disabled, see https://github.com/KhronosGroup/Vulkan-Tools/issues/1130
-    # FIXME: remove when fixed upstream
-    "-DBUILD_CUBE=OFF"
     # Don't build the mock ICD as it may get used instead of other drivers, if installed
     "-DBUILD_ICD=OFF"
     # vulkaninfo loads libvulkan using dlopen, so we have to add it manually to RPATH
diff --git a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
index 71601060ee97..03066b567ef5 100644
--- a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
+++ b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-MaEn0qVTnhp5kKCbyMhFXysIcAnZF+ba4+KaVD4wSPY=";
+    hash = "sha256-qcCATZWM0YJ02Dl5VxjvbFYoE2b0r7Ku+ELr2is2VIg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-validation-layers/package.nix b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
index 5ec68fa4c0b1..9a363aacc58d 100644
--- a/pkgs/by-name/vu/vulkan-validation-layers/package.nix
+++ b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-aTO8AIwN6/oOcxu6AgYBoOQiUHQkT6MJGAYNgP5js9I=";
+    hash = "sha256-iz6kWvnfVnznn78XNHJqSvIW4TYkp2KgEFT302VAiaY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/vu/vulkan-volk/package.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
index 22be9032106e..5168ba77f452 100644
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
-  version = "1.4.321.0";
+  version = "1.4.328.0";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "volk";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-Revi0OVvLI23yh1R6mNfcUCo1DXlACLjIw+k6EZQb/U=";
+    hash = "sha256-7JhTLhCqdn/zDIYdIb2xJnjJVk57i+6M5OXk0KvfpDk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/x1/x11perf/package.nix b/pkgs/by-name/x1/x11perf/package.nix
new file mode 100644
index 000000000000..f707af8810e3
--- /dev/null
+++ b/pkgs/by-name/x1/x11perf/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxft,
+  libxmu,
+  libxrender,
+  freetype,
+  fontconfig,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "x11perf";
+  version = "1.7.0";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/test/x11perf-${finalAttrs.version}.tar.xz";
+    hash = "sha256-JPgNhLDpYXGpmJMv8Adpj9F3bamXXtQuUdV7nPypGCg=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxft
+    libxmu
+    libxrender
+    freetype
+    fontconfig
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/bin/x11perfcomp \
+      --replace-fail "/bin/cat" "cat"
+  '';
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/test/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "X11 server performance test program";
+    homepage = "https://gitlab.freedesktop.org/xorg/test/x11perf";
+    license = lib.licenses.hpnd;
+    mainProgram = "x11perf";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/x2/x2t/package.nix b/pkgs/by-name/x2/x2t/package.nix
index e067a41fbe46..3fbc08b902e4 100644
--- a/pkgs/by-name/x2/x2t/package.nix
+++ b/pkgs/by-name/x2/x2t/package.nix
@@ -164,10 +164,6 @@ let
     };
     sourceRoot = "${finalAttrs.src.name}/build";
 
-    postPatch = ''
-      cp npm-shrinkwrap.json package-lock.json
-    '';
-
     npmDepsHash = "sha256-Hpf+z3RGqZ1LTdow6xP00hNmWf4xs+KnVBj4NbPW4uM=";
 
     dontNpmBuild = true;
diff --git a/pkgs/by-name/xc/xcalc/package.nix b/pkgs/by-name/xc/xcalc/package.nix
new file mode 100644
index 000000000000..a784ed745d13
--- /dev/null
+++ b/pkgs/by-name/xc/xcalc/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  wrapWithXFileSearchPathHook,
+  libx11,
+  libxaw,
+  libxt,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xcalc";
+  version = "1.1.2";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xcalc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-hXjfoUV+lCifbW7WFGcUMH2Kc6G1TS9CrxMhtiX8HNQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapWithXFileSearchPathHook
+  ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxaw
+    libxt
+  ];
+
+  installFlags = [ "appdefaultdir=$(out)/share/X11/app-defaults" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Scientific calculator X11 client that can emulate a TI-30 or an HP-10C";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xcalc";
+    license = with lib.licenses; [
+      x11
+      hpndSellVariant
+    ];
+    mainProgram = "xcalc";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/xc/xcompmgr/package.nix b/pkgs/by-name/xc/xcompmgr/package.nix
new file mode 100644
index 000000000000..e40cc7b807f3
--- /dev/null
+++ b/pkgs/by-name/xc/xcompmgr/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxrender,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xcompmgr";
+  version = "1.1.10";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xcompmgr-${finalAttrs.version}.tar.xz";
+    hash = "sha256-eCT3CcTyJDLq6nVC7JM4Tl3Uj2/LhcEv+C1yFCOwuY8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libxcomposite
+    libxdamage
+    libxext
+    libxfixes
+    libxrender
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Sample X11 compositing manager";
+    longDescription = ''
+      xcompmgr is a sample compositing manager for X servers supporting the XFIXES, DAMAGE, RENDER
+      and COMPOSITE extensions. It enables basic eye-candy effects.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xcompmgr";
+    license = lib.licenses.hpndSellVariant;
+    mainProgram = "xcompmgr";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
index d82a321cd69c..3264cf67b9e8 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.0-beta.1.1";
+  version = "1.0.0-beta.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "xdg-desktop-portal-cosmic";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-EkhOa1Tircgyta98Zf4ZaV/tR4zZh4/bU35xjn3xU8c=";
+    hash = "sha256-3FmNaT9tfDttINSbkwEaNW5i5hk9jH+fmMAg0UagttA=";
   };
 
-  cargoHash = "sha256-uJKwwESkzqweM4JunnMIsDE8xhCyjFFZs1GiJAwnbG8=";
+  cargoHash = "sha256-gaDVt/0QPFZHnt9veUo5bvZECxKZcIrja/QdLBn/Xi4=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/xd/xdummy/package.nix b/pkgs/by-name/xd/xdummy/package.nix
index 33b8087ad225..92d9355fb31f 100644
--- a/pkgs/by-name/xd/xdummy/package.nix
+++ b/pkgs/by-name/xd/xdummy/package.nix
@@ -34,9 +34,9 @@ let
       FontPath "${xorg.fontmiscmisc}/lib/X11/fonts/misc"
       FontPath "${xorg.fontcursormisc}/lib/X11/fonts/misc"
     ${lib.optionalString unfreeFonts ''
-      FontPath "${xorg.fontbhlucidatypewriter75dpi}/lib/X11/fonts/75dpi"
-      FontPath "${xorg.fontbhlucidatypewriter100dpi}/lib/X11/fonts/100dpi"
-      FontPath "${xorg.fontbh100dpi}/lib/X11/fonts/100dpi"
+      FontPath "${xorg.fontbhlucidatypewriter75dpi}/share/fonts/X11/75dpi"
+      FontPath "${xorg.fontbhlucidatypewriter100dpi}/share/fonts/X11/100dpi"
+      FontPath "${xorg.fontbh100dpi}/share/fonts/X11/100dpi"
     ''}
     EndSection
 
diff --git a/pkgs/by-name/xe/xeyes/package.nix b/pkgs/by-name/xe/xeyes/package.nix
new file mode 100644
index 000000000000..b23c50e764ae
--- /dev/null
+++ b/pkgs/by-name/xe/xeyes/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxcb,
+  libxext,
+  libxi,
+  libxmu,
+  libxrender,
+  libxt,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xeyes";
+  version = "1.3.1";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/xeyes-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VgjXa3sarF7X8i8ba1rXTvmMhpMiDzK0uH3M7kqVbqo=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxcb
+    libxext
+    libxi
+    libxmu
+    libxrender
+    libxt
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "A \"follow the mouse\" X demo, using the X SHAPE extension";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/xeyes";
+    license = lib.licenses.x11;
+    mainProgram = "xeyes";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/xm/xmlsec/package.nix b/pkgs/by-name/xm/xmlsec/package.nix
index f1b8f9b472e3..2a2b52ee337a 100644
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   fetchurl,
+  fetchpatch,
   libxml2,
   gnutls,
   libxslt,
@@ -33,6 +34,11 @@ lib.fix (
     patches = [
       ./lt_dladdsearchdir.patch
       ./remove_bsd_base64_decode_flag.patch
+      (fetchpatch {
+        # xmlDoc.encoding is no longer const in libxml 2.15, so fetch the fix
+        url = "https://github.com/lsh123/xmlsec/commit/ef0e3b5cac04db13ce070b1e5bcad7dd7b0eb49b.patch?full_index=1";
+        hash = "sha256-Hv8PaJXkXLq++NuCAJ4IvsYBPj8wkN7dBTniYucq18o=";
+      })
     ];
 
     postPatch = ''
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index ffa93b6fe1c7..89eb02b392a5 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -101,7 +101,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.208.5";
+  version = "0.208.6";
 
   outputs = [
     "out"
@@ -114,7 +114,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6B0A6cMCTFGYRrAekTjHo667WcS9aTZbrjaGxKP6QfA=";
+    hash = "sha256-EzfeLSalC4pTtaiDWXYib5jDDKGVZ+PzFjgMjIGrUDg=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-wOhzHMh1nhWTpzzw7phOmhHMV4h7S+e+2SUkK4RK2b8=";
+  cargoHash = "sha256-PxreCKshDvzLQzPvNpGyNz3jOPIDiz7JHy/9nEujnKg=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/desktops/xfce/applications/ristretto/default.nix b/pkgs/desktops/xfce/applications/ristretto/default.nix
index 153c9051b8b5..4c27e4d0056c 100644
--- a/pkgs/desktops/xfce/applications/ristretto/default.nix
+++ b/pkgs/desktops/xfce/applications/ristretto/default.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     export GDK_PIXBUF_MODULE_FILE="${
       gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
         extraLoaders = [
-          libheif.out
+          libheif.lib
           libjxl
           librsvg
           webp-pixbuf-loader
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index eb902364dee6..93a1d4eb5cf3 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -222,7 +222,7 @@ optionals noSysDirs (
   .${majorVersion} or [ ]
 )
 
-++ optional targetPlatform.isCygwin (fetchpatch {
+++ optional (targetPlatform.isWindows || targetPlatform.isCygwin) (fetchpatch {
   name = "libstdc-fix-compilation-in-freestanding-win32.patch";
   url = "https://inbox.sourceware.org/gcc-patches/20250922182808.2599390-2-corngood@gmail.com/raw";
   hash = "sha256-+EYW9lG8CviVX7RyNHp+iX+8BRHUjt5b07k940khbbY=";
diff --git a/pkgs/development/compilers/ghc/common-hadrian.nix b/pkgs/development/compilers/ghc/common-hadrian.nix
index 250147021e16..9de5636d43a3 100644
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@@ -261,6 +261,22 @@
           hash = "sha256-L3FQvcm9QB59BOiR2g5/HACAufIG08HiT53EIOjj64g=";
         })
       ]
+      # Fix build with gcc15
+      # https://gitlab.haskell.org/ghc/ghc/-/issues/25662
+      # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13863
+      ++
+        lib.optionals
+          (
+            lib.versionOlder version "9.12.3"
+            && !(lib.versionAtLeast version "9.10.2" && lib.versionOlder version "9.12")
+          )
+          [
+            (fetchpatch {
+              name = "ghc-hp2ps-c-gnu17.patch";
+              url = "https://src.fedoraproject.org/rpms/ghc/raw/9c26d7c3c3de73509a25806e5663b37bcf2e0b4e/f/hp2ps-C-gnu17.patch";
+              hash = "sha256-Vr5wkiSE1S5e+cJ8pWUvG9KFpxtmvQ8wAy08ElGNp5E=";
+            })
+          ]
       # Fixes stack overrun in rts which crashes an process whenever
       # freeHaskellFunPtr is called with nixpkgs' hardening flags.
       # https://gitlab.haskell.org/ghc/ghc/-/issues/25485
diff --git a/pkgs/development/compilers/ghc/common-make-native-bignum.nix b/pkgs/development/compilers/ghc/common-make-native-bignum.nix
index 82bb830cd860..401a65a11ded 100644
--- a/pkgs/development/compilers/ghc/common-make-native-bignum.nix
+++ b/pkgs/development/compilers/ghc/common-make-native-bignum.nix
@@ -345,6 +345,17 @@ stdenv.mkDerivation (
       })
     ]
 
+    # Fix build with gcc15
+    # https://gitlab.haskell.org/ghc/ghc/-/issues/25662
+    # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13863
+    ++ lib.optionals (lib.versions.majorMinor version == "9.4") [
+      (fetchpatch {
+        name = "ghc-hp2ps-c-gnu17.patch";
+        url = "https://src.fedoraproject.org/rpms/ghc/raw/9c26d7c3c3de73509a25806e5663b37bcf2e0b4e/f/hp2ps-C-gnu17.patch";
+        hash = "sha256-Vr5wkiSE1S5e+cJ8pWUvG9KFpxtmvQ8wAy08ElGNp5E=";
+      })
+    ]
+
     ++ [
       # Don't generate code that doesn't compile when --enable-relocatable is passed to Setup.hs
       # Can be removed if the Cabal library included with ghc backports the linked fix
diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index b25f60b3d5ae..0908ef39dec9 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.1";
+  version = "1.25.2";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-0BDBCc7pTYDv5oHqtGvepJGskGv0ZYPDLp8NuwvRpZQ=";
+    hash = "sha256-NxEUDPuH/Oj3oT982GDfBB5sEvdhD0DKxuxvorZeluQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index 9005a9627346..b08194a435db 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -95,16 +95,17 @@ stdenv.mkDerivation (
       (lib.cmakeFeature "CLANG_INSTALL_PACKAGE_DIR" "${placeholder "dev"}/lib/cmake/clang")
       (lib.cmakeBool "CLANGD_BUILD_XPC" false)
       (lib.cmakeBool "LLVM_ENABLE_RTTI" true)
+      (lib.cmakeBool "LLVM_INCLUDE_TESTS" false)
       (lib.cmakeFeature "LLVM_TABLEGEN_EXE" "${buildLlvmTools.tblgen}/bin/llvm-tblgen")
       (lib.cmakeFeature "CLANG_TABLEGEN" "${buildLlvmTools.tblgen}/bin/clang-tblgen")
+      (lib.cmakeFeature "CLANG_TIDY_CONFUSABLE_CHARS_GEN" "${buildLlvmTools.tblgen}/bin/clang-tidy-confusable-chars-gen")
     ]
+    ++ lib.optional (lib.versionAtLeast release_version "20") (
+      lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm"
+    )
     ++ lib.optionals (lib.versionAtLeast release_version "21") [
       (lib.cmakeFeature "CLANG_RESOURCE_DIR" "${placeholder "lib"}/lib/clang/${lib.versions.major release_version}")
     ]
-    # TODO: Clean up on `staging`.
-    ++ [
-      (lib.cmakeBool "LLVM_INCLUDE_TESTS" false)
-    ]
     ++ lib.optionals enableManpages [
       (lib.cmakeBool "CLANG_INCLUDE_DOCS" true)
       (lib.cmakeBool "LLVM_ENABLE_SPHINX" true)
@@ -112,20 +113,10 @@ stdenv.mkDerivation (
       (lib.cmakeBool "SPHINX_OUTPUT_HTML" false)
       (lib.cmakeBool "SPHINX_WARNINGS_AS_ERRORS" false)
     ]
-    # TODO: Clean up on `staging`.
-    ++ [
-      # Added in LLVM15:
-      # `clang-tidy-confusable-chars-gen`: https://github.com/llvm/llvm-project/commit/c3574ef739fbfcc59d405985a3a4fa6f4619ecdb
-      # `clang-pseudo-gen`: https://github.com/llvm/llvm-project/commit/cd2292ef824591cc34cc299910a3098545c840c7
-      (lib.cmakeFeature "CLANG_TIDY_CONFUSABLE_CHARS_GEN" "${buildLlvmTools.tblgen}/bin/clang-tidy-confusable-chars-gen")
-    ]
     ++ lib.optionals (lib.versionOlder release_version "20") [
       # clang-pseudo removed in LLVM20: https://github.com/llvm/llvm-project/commit/ed8f78827895050442f544edef2933a60d4a7935
       (lib.cmakeFeature "CLANG_PSEUDO_GEN" "${buildLlvmTools.tblgen}/bin/clang-pseudo-gen")
     ]
-    ++ lib.optional (lib.versionAtLeast release_version "20") (
-      lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm"
-    )
     ++ devExtraCmakeFlags;
 
     postPatch = ''
@@ -173,20 +164,13 @@ stdenv.mkDerivation (
       patchShebangs $python/bin
 
       mkdir -p $dev/bin
-    ''
-    # TODO(@LunNova): Clean up this rebuild avoidance in staging
-    + lib.optionalString enableClangToolsExtra (
-      if lib.versionOlder release_version "20" then
-        ''
-          cp bin/{clang-tblgen,clang-tidy-confusable-chars-gen,clang-pseudo-gen} $dev/bin
-        ''
-      else
-        ''
-          cp bin/{clang-tblgen,clang-tidy-confusable-chars-gen} $dev/bin
-        ''
-    )
-    + lib.optionalString (!enableClangToolsExtra) ''
       cp bin/clang-tblgen $dev/bin
+    ''
+    + lib.optionalString enableClangToolsExtra ''
+      cp bin/clang-tidy-confusable-chars-gen $dev/bin
+    ''
+    + lib.optionalString (enableClangToolsExtra && lib.versionOlder release_version "20") ''
+      cp bin/clang-pseudo-gen $dev/bin
     '';
 
     env =
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
index 4b4b2212e264..a81e79aad26c 100644
--- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
@@ -15,7 +15,6 @@
   libcxx,
   linuxHeaders,
   freebsd,
-  libxcrypt,
 
   # Some platforms have switched to using compiler-rt, but still want a
   # libgcc.a for ABI compat purposes. The use case would be old code that
@@ -123,9 +122,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CMAKE_C_COMPILER_TARGET" stdenv.hostPlatform.config)
     (lib.cmakeFeature "CMAKE_ASM_COMPILER_TARGET" stdenv.hostPlatform.config)
   ]
-  ++ lib.optionals (haveLibc && stdenv.hostPlatform.libc == "glibc") [
-    (lib.cmakeFeature "SANITIZER_COMMON_CFLAGS" "-I${libxcrypt}/include")
-  ]
   ++ lib.optionals (useLLVM && haveLibc && stdenv.cc.libcxx == libcxx) [
     (lib.cmakeFeature "SANITIZER_CXX_ABI" "libcxxabi")
     (lib.cmakeFeature "SANITIZER_CXX_ABI_LIBNAME" "libcxxabi")
diff --git a/pkgs/development/compilers/llvm/common/default.nix b/pkgs/development/compilers/llvm/common/default.nix
index df2f95aa0a1e..bb6631b60f5b 100644
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@@ -373,18 +373,14 @@ let
 
       # This is an "oddly ordered" bootstrap just for Darwin. Probably
       # don't want it otherwise.
-      clangNoCompilerRtWithLibc =
-        wrapCCWith rec {
-          cc = tools.clang-unwrapped;
-          libcxx = null;
-          bintools = bintools';
-          extraPackages = [ ];
-          extraBuildCommands = mkExtraBuildCommands0 cc;
-        }
-        # FIXME: This should be inside the `wrapCCWith` call.
-        // lib.optionalAttrs stdenv.targetPlatform.isWasm {
-          nixSupport.cc-cflags = [ "-fno-exceptions" ];
-        };
+      clangNoCompilerRtWithLibc = wrapCCWith rec {
+        cc = tools.clang-unwrapped;
+        libcxx = null;
+        bintools = bintools';
+        extraPackages = [ ];
+        extraBuildCommands = mkExtraBuildCommands0 cc;
+        nixSupport.cc-cflags = lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      };
 
       # Aliases
       clangNoCompilerRt = tools.clangNoLibcNoRt;
@@ -428,11 +424,6 @@ let
           {
             inherit stdenv;
           }
-          // lib.optionalAttrs (stdenv.hostPlatform.useLLVM or false) {
-            libxcrypt = (libxcrypt.override { inherit stdenv; }).overrideAttrs (old: {
-              configureFlags = old.configureFlags ++ [ "--disable-symvers" ];
-            });
-          }
         );
 
         compiler-rt-no-libc = callPackage ./compiler-rt {
diff --git a/pkgs/development/compilers/llvm/common/libcxx/default.nix b/pkgs/development/compilers/llvm/common/libcxx/default.nix
index b59161683842..be38ae92d8ec 100644
--- a/pkgs/development/compilers/llvm/common/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/common/libcxx/default.nix
@@ -143,9 +143,6 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs utils/cat_files.py
   '';
 
-  # TODO: Remove on `staging`.
-  patches = [ ];
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/development/compilers/llvm/common/libunwind/default.nix b/pkgs/development/compilers/llvm/common/libunwind/default.nix
index f0e39e7ed391..bbd33110149f 100644
--- a/pkgs/development/compilers/llvm/common/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/common/libunwind/default.nix
@@ -21,9 +21,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   inherit version;
 
-  # TODO: Remove on `staging`.
-  patches = [ ];
-
   src =
     if monorepoSrc != null then
       runCommand "libunwind-src-${version}" { inherit (monorepoSrc) passthru; } ''
@@ -60,10 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ devExtraCmakeFlags;
 
-  # TODO: Remove on `staging`.
-  prePatch = "";
-  postPatch = "";
-
   postInstall =
     lib.optionalString (enableShared && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows)
       ''
diff --git a/pkgs/development/compilers/llvm/common/lld/default.nix b/pkgs/development/compilers/llvm/common/lld/default.nix
index e9c0ee543437..5e82ae65b357 100644
--- a/pkgs/development/compilers/llvm/common/lld/default.nix
+++ b/pkgs/development/compilers/llvm/common/lld/default.nix
@@ -63,9 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ devExtraCmakeFlags;
 
-  # TODO: Remove on `staging`.
-  postPatch = "";
-
   # Musl's default stack size is too small for lld to be able to link Firefox.
   LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-Wl,-z,stack-size=2097152";
 
diff --git a/pkgs/development/compilers/llvm/common/lldb/default.nix b/pkgs/development/compilers/llvm/common/lldb/default.nix
index 9fbcbb0f3839..f67da5042667 100644
--- a/pkgs/development/compilers/llvm/common/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/common/lldb/default.nix
@@ -74,6 +74,7 @@ stdenv.mkDerivation (
 
     nativeBuildInputs = [
       cmake
+      ninja
       python3
       which
       swig
@@ -84,10 +85,6 @@ stdenv.mkDerivation (
     ++ lib.optionals enableManpages [
       python3.pkgs.sphinx
       python3.pkgs.myst-parser
-    ]
-    # TODO: Clean up on `staging`.
-    ++ [
-      ninja
     ];
 
     buildInputs = [
@@ -112,6 +109,7 @@ stdenv.mkDerivation (
       (lib.cmakeBool "LLVM_ENABLE_RTTI" false)
       (lib.cmakeFeature "Clang_DIR" "${lib.getDev libclang}/lib/cmake")
       (lib.cmakeFeature "LLVM_EXTERNAL_LIT" "${lit}/bin/lit")
+      (lib.cmakeFeature "CLANG_RESOURCE_DIR" "../../../../${lib.getLib libclang}")
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       (lib.cmakeBool "LLDB_USE_SYSTEM_DEBUGSERVER" true)
@@ -119,10 +117,6 @@ stdenv.mkDerivation (
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       (lib.cmakeFeature "LLDB_CODESIGN_IDENTITY" "") # codesigning makes nondeterministic
     ]
-    # TODO: Clean up on `staging`.
-    ++ [
-      (lib.cmakeFeature "CLANG_RESOURCE_DIR" "../../../../${lib.getLib libclang}")
-    ]
     ++ lib.optionals enableManpages [
       (lib.cmakeBool "LLVM_ENABLE_SPHINX" true)
       (lib.cmakeBool "SPHINX_OUTPUT_MAN" true)
@@ -184,9 +178,6 @@ stdenv.mkDerivation (
   // lib.optionalAttrs enableManpages {
     pname = "lldb-manpages";
 
-    # TODO: Remove on `staging`.
-    buildPhase = "";
-
     ninjaFlags = [ "docs-lldb-man" ];
 
     propagatedBuildInputs = [ ];
diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index ceb7b35688de..09f335244d68 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -85,9 +85,6 @@ stdenv.mkDerivation (
     pname = "llvm";
     inherit version;
 
-    # TODO: Remove on `staging`.
-    shortVersion = lib.concatStringsSep "." (lib.take 1 (lib.splitString "." release_version));
-
     src =
       if monorepoSrc != null then
         runCommand "llvm-src-${version}" { inherit (monorepoSrc) passthru; } (
diff --git a/pkgs/development/compilers/llvm/common/openmp/default.nix b/pkgs/development/compilers/llvm/common/openmp/default.nix
index 322031df1938..2e293d41d8c9 100644
--- a/pkgs/development/compilers/llvm/common/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/common/openmp/default.nix
@@ -46,9 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  # TODO: Remove on `staging`.
-  patchFlags = null;
-
   patches =
     lib.optional (lib.versionOlder release_version "19") (getVersionFile "openmp/fix-find-tool.patch")
     ++ [
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 1c970c62b91c..c24f97a97400 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -25,7 +25,7 @@ let
     "18.1.8".officialRelease.sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE=";
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
-    "21.1.1".officialRelease.sha256 = "sha256-IB9Z3bIMwfgw2W2Vxo89CmtCM9DfOyV2Ei64nqgHrgc=";
+    "21.1.2".officialRelease.sha256 = "sha256-SgZdBL0ivfv6/4EqmPQ+I57qT2t6i/rqnm20+T1BsFY=";
     "22.0.0-git".gitRelease = {
       rev = "6afccac4148253d4f9a90ad0a51cba0995f92fad";
       rev-version = "22.0.0-unstable-2025-10-19";
diff --git a/pkgs/development/compilers/openjdk/11/source.json b/pkgs/development/compilers/openjdk/11/source.json
index f6a4db45ee48..ab37d28ec1be 100644
--- a/pkgs/development/compilers/openjdk/11/source.json
+++ b/pkgs/development/compilers/openjdk/11/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-yJljuO6jflh6kbe4ipflPiNDbKvKyA4grMAFu4UCM+Y=",
+  "hash": "sha256-u8SWC0T4rmQVV3TKfEW1/rCT8KWNsL5hZtUW3pXBIfA=",
   "owner": "openjdk",
   "repo": "jdk11u",
-  "rev": "refs/tags/jdk-11.0.28+6"
+  "rev": "refs/tags/jdk-11.0.29+5"
 }
diff --git a/pkgs/development/compilers/openjdk/17/source.json b/pkgs/development/compilers/openjdk/17/source.json
index 5a27a56c4714..2b5813a3fd68 100644
--- a/pkgs/development/compilers/openjdk/17/source.json
+++ b/pkgs/development/compilers/openjdk/17/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-YN9mPfi3oMGjeRIren2cdWWySpYXsIcOnP29Zh3ym8c=",
+  "hash": "sha256-xwi7Co0DiEx9IohwiQHpislv/50NdGuHVQINJcasBdY=",
   "owner": "openjdk",
   "repo": "jdk17u",
-  "rev": "refs/tags/jdk-17.0.16+8"
+  "rev": "refs/tags/jdk-17.0.17+8"
 }
diff --git a/pkgs/development/compilers/openjdk/21/source.json b/pkgs/development/compilers/openjdk/21/source.json
index a514f2dc908e..438a484ff2b6 100644
--- a/pkgs/development/compilers/openjdk/21/source.json
+++ b/pkgs/development/compilers/openjdk/21/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-8wUwxjhAGIp1bzny2e86vPH9q4vw1kLDoTjO7FrJbx4=",
+  "hash": "sha256-NgunrSUchIlHkaXM9h75U4xcf44ukCuhhPPHHGVOKXo=",
   "owner": "openjdk",
   "repo": "jdk21u",
-  "rev": "refs/tags/jdk-21.0.8+9"
+  "rev": "refs/tags/jdk-21.0.9+8"
 }
diff --git a/pkgs/development/cuda-modules/_cuda/fixups/nsight_compute.nix b/pkgs/development/cuda-modules/_cuda/fixups/nsight_compute.nix
index 2865b0e2fecc..bc7c5f1784db 100644
--- a/pkgs/development/cuda-modules/_cuda/fixups/nsight_compute.nix
+++ b/pkgs/development/cuda-modules/_cuda/fixups/nsight_compute.nix
@@ -32,7 +32,7 @@ in
     ++ [
       qtwayland
       qtwebview
-      (qt6.qtwebengine or qt6.full)
+      qt6.qtwebengine
       rdma-core
     ]
     ++ lib.optionals (cudaOlder "12.7") [
diff --git a/pkgs/development/cuda-modules/_cuda/fixups/nsight_systems.nix b/pkgs/development/cuda-modules/_cuda/fixups/nsight_systems.nix
index 9983f880b58b..2967fa89470a 100644
--- a/pkgs/development/cuda-modules/_cuda/fixups/nsight_systems.nix
+++ b/pkgs/development/cuda-modules/_cuda/fixups/nsight_systems.nix
@@ -87,14 +87,14 @@ in
   buildInputs =
     prevAttrs.buildInputs or [ ]
     ++ [
-      (qt6.qtdeclarative or qt6.full)
-      (qt6.qtsvg or qt6.full)
-      (qt6.qtimageformats or qt6.full)
-      (qt6.qtpositioning or qt6.full)
-      (qt6.qtscxml or qt6.full)
-      (qt6.qttools or qt6.full)
-      (qt6.qtwebengine or qt6.full)
-      (qt6.qtwayland or qt6.full)
+      qt6.qtdeclarative
+      qt6.qtsvg
+      qt6.qtimageformats
+      qt6.qtpositioning
+      qt6.qtscxml
+      qt6.qttools
+      qt6.qtwebengine
+      qt6.qtwayland
       boost178
       cuda_cudart.stubs
       e2fsprogs
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 77aa797f0ff5..74c5f2a2b3c9 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -580,7 +580,7 @@ builtins.intersectAttrs super {
   gi-gtk-declarative = dontCheck super.gi-gtk-declarative;
   gi-gtk-declarative-app-simple = dontCheck super.gi-gtk-declarative-app-simple;
   hsqml = dontCheck (
-    addExtraLibraries [ pkgs.libGLU pkgs.libGL ] (super.hsqml.override { qt5 = pkgs.qt5Full; })
+    addExtraLibraries [ pkgs.libGLU pkgs.libGL ] (super.hsqml.override { qt5 = pkgs.qt5.qtbase; })
   );
   monomer = dontCheck super.monomer;
 
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index 6bcc21de75d7..9e8953079690 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -549,8 +549,10 @@ let
   }
   // env
   # Implicit pointer to integer conversions are errors by default since clang 15.
-  # Works around https://gitlab.haskell.org/ghc/ghc/-/issues/23456.
-  // optionalAttrs (stdenv.hasCC && stdenv.cc.isClang) {
+  # Works around https://gitlab.haskell.org/ghc/ghc/-/issues/23456. krank:ignore-line
+  # A fix was included in GHC 9.10.* and backported to 9.6.5 and 9.8.2 (but we no longer
+  # ship 9.8.1).
+  // optionalAttrs (lib.versionOlder ghc.version "9.6.5" && stdenv.hasCC && stdenv.cc.isClang) {
     NIX_CFLAGS_COMPILE =
       "-Wno-error=int-conversion"
       + lib.optionalString (env ? NIX_CFLAGS_COMPILE) (" " + env.NIX_CFLAGS_COMPILE);
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 46a283bd5b2c..e75fb0b193c0 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -323,7 +323,8 @@ stdenv.mkDerivation (
 
     env.NIX_CFLAGS_COMPILE =
       lib.optionalString (stdenv.targetPlatform.system == "x86_64-darwin") "-msse2"
-      + lib.optionalString stdenv.hostPlatform.isMusl " -DTHREAD_STACK_SIZE=0x100000";
+      + lib.optionalString stdenv.hostPlatform.isMusl " -DTHREAD_STACK_SIZE=0x100000"
+      + " -std=gnu17";
     DETERMINISTIC_BUILD = 1;
 
     setupHook = python-setup-hook sitePackages;
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 2764e6a95344..8dd797dc5f43 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
         sourceVersion = {
           major = "3";
           minor = "13";
-          patch = "7";
+          patch = "8";
           suffix = "";
         };
-        hash = "sha256-VGL5CZ39MOI43vg8cdkYl9jKpf9uvHpQ8U1IAs2qp5o=";
+        hash = "sha256-uZEHMFJrKYKZtGs1WVztkFVyLfYMBq1jAfak4scoolI=";
       };
     };
 
@@ -36,9 +36,9 @@
         major = "2";
         minor = "7";
         patch = "18";
-        suffix = ".8"; # ActiveState's Python 2 extended support
+        suffix = ".12"; # ActiveState's Python 2 extended support
       };
-      hash = "sha256-HUOzu3uJbtd+3GbmGD35KOk/CDlwL4S7hi9jJGRFiqI=";
+      hash = "sha256-RuEgfpags9wJm9Xe0daotqUx4knABEUc7DvtgnQXEfE=";
       inherit passthruFun;
     };
 
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 17f0f3df04e1..3da85518af64 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -187,13 +187,36 @@ let
           # make: *** [uncommon.mk:373: do-install-all] Error 1
           enableParallelInstalling = false;
 
-          patches = op useBaseRuby ./do-not-update-gems-baseruby-3.2.patch ++ [
-            # When using a baseruby, ruby always sets "libdir" to the build
-            # directory, which nix rejects due to a reference in to /build/ in
-            # the final product. Removing this reference doesn't seem to break
-            # anything and fixes cross compilation.
-            ./dont-refer-to-build-dir.patch
-          ];
+          patches =
+            op useBaseRuby ./do-not-update-gems-baseruby-3.2.patch
+            ++ [
+              # When using a baseruby, ruby always sets "libdir" to the build
+              # directory, which nix rejects due to a reference in to /build/ in
+              # the final product. Removing this reference doesn't seem to break
+              # anything and fixes cross compilation.
+              ./dont-refer-to-build-dir.patch
+            ]
+            # TODO: drop the isClang condition
+            ++ ops (lib.versionOlder ver.majMin "3.4" && stdenv.cc.isClang) [
+              (fetchpatch {
+                name = "ruby-3.3-fix-llvm-21.patch";
+                url = "https://github.com/ruby/ruby/commit/5a8d7642168f4ea0d9331fded3033c225bbc36c5.patch";
+                excludes = [ "version.h" ];
+                hash = "sha256-dV98gXXTSKM2ZezTvhVXNaKaXJxiWKEeUbqqL360cWw=";
+              })
+            ]
+            ++ ops (lib.versionAtLeast ver.majMin "3.4" && lib.versionOlder ver.majMin "3.5") [
+              (fetchpatch {
+                name = "ruby-3.4-fix-gcc-15-llvm-21-1.patch";
+                url = "https://github.com/ruby/ruby/commit/846bb760756a3bf1ab12d56d8909e104f16e6940.patch";
+                hash = "sha256-+f0mzHsGAe9FT9NWE345BxzaB6vmWzMTvEfWF84uFOs=";
+              })
+              (fetchpatch {
+                name = "ruby-3.4-fix-gcc-15-llvm-21-2.patch";
+                url = "https://github.com/ruby/ruby/commit/18e176659e8afe402cab7d39972f2d56f2cf378f.patch";
+                hash = "sha256-TKPG1hcC1G2WmUkvNV6QSnvUpTEDqrYKrIk/4fAS8QE=";
+              })
+            ];
 
           cargoRoot = opString yjitSupport "yjit";
 
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 58295fb55547..0e676a64c2d3 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-dQyMdxGA1B7SNYNE5UYe3ugxWMCoG3eZaaEzmWG8EWM=";
+    hash = "sha256-7+zgEiWlMvS1LPh2TSCgDg0p7W+Fsz2TAt9IlqkPpas=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/botan/default.nix b/pkgs/development/libraries/botan/default.nix
index acf68d135c38..9cfa9570b7f9 100644
--- a/pkgs/development/libraries/botan/default.nix
+++ b/pkgs/development/libraries/botan/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   fetchurl,
   pkgsStatic,
   python3,
@@ -172,5 +173,13 @@ in
   botan2 = common {
     version = "2.19.5";
     hash = "sha256-3+6g4KbybWckxK8B2pp7iEh62y2Bunxy/K9S21IsmtQ=";
+    patches = [
+      # Fix build with gcc15
+      (fetchpatch {
+        name = "botan2-add-include-cstdint-gcc15.patch";
+        url = "https://src.fedoraproject.org/rpms/botan2/raw/c3fb7a3800df117e7ef8a7617ac8eacb31a4464a/f/f765f0b312f2998498f629d93369babfb2c975b4.patch";
+        hash = "sha256-8Yhxd5TCgxUMtRiv3iq5sQaVjDF+b9slppm38/6l6lw=";
+      })
+    ];
   };
 }
diff --git a/pkgs/development/libraries/glibc/0001-localedata-allow-reproducible-parallel-install-of-lo.patch b/pkgs/development/libraries/glibc/0001-localedata-allow-reproducible-parallel-install-of-lo.patch
new file mode 100644
index 000000000000..276e9cc0bf32
--- /dev/null
+++ b/pkgs/development/libraries/glibc/0001-localedata-allow-reproducible-parallel-install-of-lo.patch
@@ -0,0 +1,50 @@
+From 38e9742ed794febbc8caa4177df14d097607a2d9 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Sun, 5 Oct 2025 12:45:25 +0200
+Subject: [PATCH 1/2] localedata: allow reproducible & parallel install of
+ locale-archive
+
+The problem with the current approach is that N processes are compiling
+a locale and updating the locale-archive at the same time. Hence,
+there's a race which process gets to update the archive first and thus
+the build is not reproducible[1].
+
+This patch changes that by adding the `--no-archive` flag to the
+`$(LOCALEDEF)` invocation in `build-one-locale` to parallelize the build
+process in a race-free manner. A single `localedef --add-to-archive`
+then adds all previously built locales to the archive.
+
+[1] https://github.com/NixOS/nixpkgs/issues/245360
+---
+ localedata/Makefile | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/localedata/Makefile b/localedata/Makefile
+index 01b32348d4..13f7d3a2c4 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -538,8 +538,13 @@ LOCALEDEF=I18NPATH=. GCONV_PATH=$(common-objpfx)iconvdata LC_ALL=C \
+ $(rtld-prefix) $(common-objpfx)locale/localedef
+ install-locales: install-locale-archive
+ 
++define install-all-locales
++  $(LOCALEDEF) $$flags --add-to-archive `find $(inst_complocaledir) -maxdepth 1 -mindepth 1 -type d | sort`
++endef
++
+ # Create and install the locale-archive file.
+ install-locale-archive: $(INSTALL-SUPPORTED-LOCALE-ARCHIVE)
++	$(install-all-locales)
+ # Create and install the locales individually (no archive).
+ install-locale-files: $(INSTALL-SUPPORTED-LOCALE-FILES)
+ 
+@@ -565,6 +570,7 @@ define build-one-locale
+ 	$(LOCALEDEF) $$flags --alias-file=../intl/locale.alias \
+ 		     -i locales/$$input -f charmaps/$$charset \
+ 		     $(addprefix --prefix=,$(install_root)) $$locale \
++		     --no-archive \
+ 	&& echo ' done';
+ endef
+ 
+-- 
+2.50.1
+
diff --git a/pkgs/development/libraries/glibc/0002-Makeconfig-make-inst_complocaledir-overridable.patch b/pkgs/development/libraries/glibc/0002-Makeconfig-make-inst_complocaledir-overridable.patch
new file mode 100644
index 000000000000..c727912a6d84
--- /dev/null
+++ b/pkgs/development/libraries/glibc/0002-Makeconfig-make-inst_complocaledir-overridable.patch
@@ -0,0 +1,42 @@
+From 887cb6906afa2b2d8abf35ccfc33ce7b8dc902f8 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Sun, 5 Oct 2025 12:48:43 +0200
+Subject: [PATCH 2/2] Makeconfig: make inst_complocaledir overridable
+
+On NixOS, we build the locales in a separate package from glibc itself.
+Also, packages aren't installed into a common location such as `/usr`,
+but each package has its own unique prefix below `/nix/store`.
+
+For us, the current state is a problem because `localedef` is built
+in a different package and expects DESTDIR to be the unique
+package-prefix of `glibc` itself. Our current workaround is to
+invoke `localedef` with `--prefix=$TMPDIR` and copy the contents
+to the correct prefix. This was doable without patching when
+`localedef` was doing build & locale-archive creation at the
+same time.
+
+With the previous patch, the Makefile uses `$(inst_complocaledir)` to
+tell localedef where the previously built locales are. In NixOS, we now
+need to override `$(inst_complocaledir)` to point to
+`$TMPDIR/$(glibc.out)`. Hence, this patch makes the variable overridable
+from env.
+---
+ Makeconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makeconfig b/Makeconfig
+index 9eda4fa528..43d88325bc 100644
+--- a/Makeconfig
++++ b/Makeconfig
+@@ -197,7 +197,7 @@ inst_zonedir = $(install_root)$(zonedir)
+ ifndef complocaledir
+ complocaledir = $(libdir)/locale
+ endif
+-inst_complocaledir = $(install_root)$(complocaledir)
++inst_complocaledir ?= $(install_root)$(complocaledir)
+ 
+ # Where to install the message catalog data files (which are
+ # machine-independent).
+-- 
+2.50.1
+
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index a35e5085f87c..5293c6579c5d 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -111,6 +111,10 @@ stdenv.mkDerivation (
         & https://github.com/NixOS/nixpkgs/pull/188492#issuecomment-1233802991
       */
       ./reenable_DT_HASH.patch
+
+      # enable parallel & reproducible build of glibcLocales
+      ./0001-localedata-allow-reproducible-parallel-install-of-lo.patch
+      ./0002-Makeconfig-make-inst_complocaledir-overridable.patch
     ]
     /*
       NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost
diff --git a/pkgs/development/libraries/glibc/locales-builder.sh b/pkgs/development/libraries/glibc/locales-builder.sh
deleted file mode 100644
index 6f10476f1089..000000000000
--- a/pkgs/development/libraries/glibc/locales-builder.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-# Glibc cannot have itself in its RPATH.
-export NIX_NO_SELF_RPATH=1
-
-postConfigure() {
-    # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
-    # This has to be done *after* `configure' because it builds some
-    # test binaries.
-    export NIX_CFLAGS_LINK=
-    export NIX_LDFLAGS_BEFORE=
-
-    export NIX_DONT_SET_RPATH=1
-    unset CFLAGS
-}
-
-genericBuild
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index bd61f72fc28e..98f04f22dbcd 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -31,13 +31,25 @@
   (
     finalAttrs: previousAttrs: {
 
-      builder = ./locales-builder.sh;
-
       outputs = [ "out" ];
 
-      LOCALEDEF_FLAGS = [
-        (if stdenv.hostPlatform.isLittleEndian then "--little-endian" else "--big-endian")
-      ];
+      env = (previousAttrs.env or { }) // {
+        LOCALEDEF_FLAGS = if stdenv.hostPlatform.isLittleEndian then "--little-endian" else "--big-endian";
+
+        # Glibc cannot have itself in its RPATH.
+        NIX_NO_SELF_RPATH = 1;
+      };
+
+      postConfigure = (previousAttrs.postConfigure or "") + ''
+        # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
+        # This has to be done *after* `configure' because it builds some
+        # test binaries.
+        export NIX_CFLAGS_LINK=
+        export NIX_LDFLAGS_BEFORE=
+
+        export NIX_DONT_SET_RPATH=1
+        unset CFLAGS
+      '';
 
       preBuild =
         (previousAttrs.preBuild or "")
@@ -49,12 +61,14 @@
           # $TMPDIR/nix/store/...-glibc-.../lib/locale/locale-archive.
           LOCALEDEF_FLAGS+=" --prefix=$TMPDIR"
 
-          mkdir -p $TMPDIR/"${buildPackages.glibc.out}/lib/locale"
+          export inst_complocaledir="$TMPDIR/"${buildPackages.glibc.out}/lib/locale
+          mkdir -p "$inst_complocaledir"
 
           echo 'C.UTF-8/UTF-8 \' >> ../glibc-2*/localedata/SUPPORTED
 
           # Hack to allow building of the locales (needed since glibc-2.12)
-          sed -i -e 's,^$(rtld-prefix) $(common-objpfx)locale/localedef,localedef $(LOCALEDEF_FLAGS),' ../glibc-2*/localedata/Makefile
+          substituteInPlace ../glibc-2*/localedata/Makefile \
+            --replace-fail '$(rtld-prefix) $(common-objpfx)locale/localedef' 'localedef $(LOCALEDEF_FLAGS)'
         ''
         + lib.optionalString (!allLocales) ''
           # Check that all locales to be built are supported
@@ -75,12 +89,6 @@
           echo SUPPORTED-LOCALES='${toString locales}' > ../glibc-2*/localedata/SUPPORTED
         '';
 
-      # Current `nixpkgs` way of building locales is not compatible with
-      # parallel install. `locale-archive` is updated in parallel with
-      # multiple `localedef` processes and causes non-deterministic result:
-      #   https://github.com/NixOS/nixpkgs/issues/245360
-      enableParallelBuilding = false;
-
       makeFlags = (previousAttrs.makeFlags or [ ]) ++ [
         "localedata/install-locales"
         "localedir=${placeholder "out"}/lib/locale"
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 65db7cc102e9..e5e09c02cbc5 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   bootstrap_cmds,
   byacc, # can also use bison, but byacc has fewer dependencies
   keyutils,
@@ -42,6 +43,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-GogyuMrZI+u/E5T2fi789B46SfRgKFpm41reyPoAU68=";
   };
 
+  patches = lib.optionals stdenv.hostPlatform.isFreeBSD [
+    (fetchpatch {
+      name = "fix-missing-ENODATA.patch";
+      url = "https://cgit.freebsd.org/ports/plain/security/krb5-122/files/patch-lib_krad_packet.c?id=0501f716c4aff7880fde56e42d641ef504593b7d";
+      extraPrefix = "";
+      hash = "sha256-l8ev+WrDKbTqwgBRYhfJGELkCCE8mJTqVHFBvvCPvgE=";
+    })
+  ];
+
   outputs = [
     "out"
     "lib"
diff --git a/pkgs/development/libraries/libcxxrt/default.nix b/pkgs/development/libraries/libcxxrt/default.nix
index e79779980e1d..d048102849ba 100644
--- a/pkgs/development/libraries/libcxxrt/default.nix
+++ b/pkgs/development/libraries/libcxxrt/default.nix
@@ -17,6 +17,11 @@ stdenv.mkDerivation {
     sha256 = "+oTjU/DgOEIwJebSVkSEt22mJSdeONozB8FfzEiESHU=";
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   outputs = [
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 1d703fa5f89f..43db16eb28f6 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -22,11 +22,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libunistring";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchurl {
     url = "mirror://gnu/libunistring/libunistring-${finalAttrs.version}.tar.gz";
-    hash = "sha256-jqjM+GwJ3YAcjKwZh46ATlT3B89piENxEw0gveaDhrc=";
+    hash = "sha256-9+Od3soYhY7N0Cxg0dU3T83LvNtraKOR+El8scss8/c=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/libxml2/common.nix b/pkgs/development/libraries/libxml2/common.nix
index eb16734eede4..4b2f04bbc8f0 100644
--- a/pkgs/development/libraries/libxml2/common.nix
+++ b/pkgs/development/libraries/libxml2/common.nix
@@ -5,19 +5,11 @@
   pkg-config,
   autoreconfHook,
   python3,
+  doxygen,
   ncurses,
   findXMLCatalogs,
   libiconv,
-  # Python limits cross-compilation to an allowlist of host OSes.
-  # https://github.com/python/cpython/blob/dfad678d7024ab86d265d84ed45999e031a03691/configure.ac#L534-L562
-  pythonSupport ?
-    enableShared
-    && (
-      stdenv.hostPlatform == stdenv.buildPlatform
-      || stdenv.hostPlatform.isCygwin
-      || stdenv.hostPlatform.isLinux
-      || stdenv.hostPlatform.isWasi
-    ),
+  pythonSupport ? false,
   icuSupport ? false,
   icu,
   zlibSupport ? false,
@@ -52,27 +44,21 @@ stdenv'.mkDerivation (finalAttrs: {
     "bin"
     "dev"
     "out"
-    "devdoc"
   ]
   ++ lib.optional pythonSupport "py"
   ++ lib.optional (enableStatic && enableShared) "static";
   outputMan = "bin";
 
-  patches = [
-    # Unmerged ABI-breaking patch required to fix the following security issues:
-    # - https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
-    # - https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
-    # See also https://gitlab.gnome.org/GNOME/libxml2/-/issues/906
-    # Source: https://github.com/chromium/chromium/blob/4fb4ae8ce3daa399c3d8ca67f2dfb9deffcc7007/third_party/libxml/chromium/xml-attr-extra.patch
-    ./xml-attr-extra.patch
-  ]
-  ++ extraPatches;
+  patches = [ ] ++ extraPatches;
 
   strictDeps = true;
 
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
+  ]
+  ++ lib.optionals pythonSupport [
+    doxygen
   ];
 
   buildInputs =
@@ -101,10 +87,10 @@ stdenv'.mkDerivation (finalAttrs: {
     (lib.withFeature icuSupport "icu")
     (lib.withFeature pythonSupport "python")
     (lib.optionalString pythonSupport "PYTHON=${python3.pythonOnBuildForHost.interpreter}")
-  ]
-  # avoid rebuilds, can be merged into list in version bumps
-  ++ lib.optional enableHttp "--with-http"
-  ++ lib.optional zlibSupport "--with-zlib";
+    (lib.withFeature enableHttp "http")
+    (lib.withFeature zlibSupport "zlib")
+    (lib.withFeature false "docs") # docs are built with xsltproc, which would be a cyclic dependency
+  ];
 
   installFlags = lib.optionals pythonSupport [
     "pythondir=\"${placeholder "py"}/${python3.sitePackages}\""
@@ -159,6 +145,19 @@ stdenv'.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     pkgConfigModules = [ "libxml-2.0" ];
+    # Python limits cross-compilation to an allowlist of host OSes.
+    # https://github.com/python/cpython/blob/dfad678d7024ab86d265d84ed45999e031a03691/configure.ac#L534-L562
+    broken =
+      pythonSupport
+      && !(
+        enableShared
+        && (
+          stdenv.hostPlatform == stdenv.buildPlatform
+          || stdenv.hostPlatform.isCygwin
+          || stdenv.hostPlatform.isLinux
+          || stdenv.hostPlatform.isWasi
+        )
+      );
   }
   // extraMeta;
 })
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 08c1cbe5fd03..8c4c1c653092 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -2,7 +2,7 @@
   lib,
   callPackage,
   fetchFromGitLab,
-  fetchpatch2,
+  fetchpatch,
 }:
 
 let
@@ -20,20 +20,27 @@ let
         # same as upstream patch but fixed conflict and added required import:
         # https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0.diff
         ./CVE-2025-6021.patch
-        (fetchpatch2 {
+        (fetchpatch {
           name = "CVE-2025-49794-49796.patch";
           url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/f7ebc65f05bffded58d1e1b2138eb124c2e44f21.patch";
-          hash = "sha256-k+IGq6pbv9EA7o+uDocEAUqIammEjLj27Z+2RF5EMrs=";
+          hash = "sha256-p5Vc/lkakHKsxuFNnCQtFczjqFJBeLnCwIwv2GnrQco=";
         })
-        (fetchpatch2 {
+        (fetchpatch {
           name = "CVE-2025-49795.patch";
           url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c24909ba2601848825b49a60f988222da3019667.patch";
-          hash = "sha256-r7PYKr5cDDNNMtM3ogNLsucPFTwP/uoC7McijyLl4kU=";
+          hash = "sha256-vICVSb+X89TTE4QY92/v/6fRk77Hy9vzEWWsADHqMlk=";
           excludes = [ "runtest.c" ]; # tests were rewritten in C and are on schematron for 2.13.x, meaning this does not apply
         })
         # same as upstream, fixed conflicts
         # https://gitlab.gnome.org/GNOME/libxml2/-/commit/c340e419505cf4bf1d9ed7019a87cc00ec200434
         ./CVE-2025-6170.patch
+
+        # Unmerged ABI-breaking patch required to fix the following security issues:
+        # - https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
+        # - https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
+        # See also https://gitlab.gnome.org/GNOME/libxml2/-/issues/906
+        # Source: https://github.com/chromium/chromium/blob/4fb4ae8ce3daa399c3d8ca67f2dfb9deffcc7007/third_party/libxml/chromium/xml-attr-extra.patch
+        ./xml-attr-extra.patch
       ];
       freezeUpdateScript = true;
       extraMeta = {
@@ -43,14 +50,23 @@ let
       };
     };
     libxml2 = callPackage ./common.nix {
-      version = "2.14.6";
+      version = "2.15.0";
       src = fetchFromGitLab {
         domain = "gitlab.gnome.org";
         owner = "GNOME";
         repo = "libxml2";
         tag = "v${packages.libxml2.version}";
-        hash = "sha256-EIcNL5B/o74hyc1N+ShrlKsPL5tHhiGgkCR1D7FcDjw=";
+        hash = "sha256-jumHSiIMDzqG2hvPUdcBP8LsszcU+loOY+vqEh/0Yqo=";
       };
+      extraPatches = [
+        # Fixes a regression in attribute normalization.
+        # Also see https://www.postgresql.org/message-id/flat/0756AC61-FBA3-46E2-B3C2-19B58B65EBDC%2540yesql.se
+        # To be removed with 2.15.1.
+        (fetchpatch {
+          url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/da45a190f718e8e2f0e3d2a6325ffa23abc8b90c.patch";
+          hash = "sha256-wqmFszr7w1Lte12YR6Ug7Ng7fXABzizwUsJU1EhylgU=";
+        })
+      ];
       extraMeta = {
         maintainers = with lib.maintainers; [
           jtojnar
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index 9de9314dc37d..1f88deb6363f 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -36,19 +36,13 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withJemalloc jemalloc;
 
-  cmakeFlags =
-    if stdenv.hostPlatform.isStatic then
-      [
-        # The examples try to link against `ngtcp2_crypto_ossl` and `ngtcp2` libraries.
-        # This works in the dynamic case where the targets have the same name, but not here where they're suffixed with `_static`.
-        (lib.cmakeBool "ENABLE_LIB_ONLY" true)
-        (lib.cmakeBool "ENABLE_SHARED_LIB" false)
-        (lib.cmakeBool "ENABLE_STATIC_LIB" true)
-      ]
-    else
-      [
-        (lib.cmakeBool "ENABLE_STATIC_LIB" false)
-      ];
+  cmakeFlags = [
+    # The examples try to link against `ngtcp2_crypto_ossl` and `ngtcp2` libraries.
+    # This works in the dynamic case where the targets have the same name, but not here where they're suffixed with `_static`.
+    (lib.cmakeBool "ENABLE_LIB_ONLY" stdenv.hostPlatform.isStatic)
+    (lib.cmakeBool "ENABLE_SHARED_LIB" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "ENABLE_STATIC_LIB" stdenv.hostPlatform.isStatic)
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index 88b97a28d545..c7e53ae11ab6 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "3.112.1";
-  hash = "sha256-NpvE/WH+oY231uDKxXJptDojfU4rNsXySpOduWszzjQ=";
+  version = "3.112.2";
+  hash = "sha256-hK0TovR0LrVkB96BwCnhwaljDSElR85fnobzCa9+uKo=";
   filename = "esr.nix";
   versionRegex = "NSS_(3)_(112)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/libraries/opencv/0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch b/pkgs/development/libraries/opencv/0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch
new file mode 100644
index 000000000000..03f912cef39a
--- /dev/null
+++ b/pkgs/development/libraries/opencv/0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch
@@ -0,0 +1,34 @@
+From fcc689e1887bcbeb9d1c4441266a63ea2114ae9f Mon Sep 17 00:00:00 2001
+From: Connor Baker <ConnorBaker01@gmail.com>
+Date: Thu, 18 Sep 2025 13:15:43 -0700
+Subject: [PATCH] cmake/OpenCVUtils.cmake: invalidate Nix store paths before
+ including in version_string.inc
+
+Signed-off-by: Connor Baker <ConnorBaker01@gmail.com>
+---
+ cmake/OpenCVUtils.cmake | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/cmake/OpenCVUtils.cmake b/cmake/OpenCVUtils.cmake
+index 5886f4f3cb..9f3a3a74e9 100644
+--- a/cmake/OpenCVUtils.cmake
++++ b/cmake/OpenCVUtils.cmake
+@@ -956,6 +956,15 @@ function(ocv_output_status msg)
+     message(WARNING "String to be inserted to version_string.inc has an unexpected line break: '${msg}'")
+     string(REPLACE "\n" "\\n" msg "${msg}")
+   endif()
++  # The hash portion of Nix store paths are 32 characters long. Replace them with an invalid hash to avoid bloating
++  # the runtime closure by includnig references to the compiler and other build tools.
++  # https://fzakaria.com/2025/03/28/what-s-in-a-nix-store-path
++  # NOTE: This assumes the name of the Nix store is always /nix/store.
++  # NOTE: The regex [a-z0-9] is larger than Nix's base32, but it simplifies things.
++  # NOTE: This assumes all Nix store paths have additional characters after the hash.
++  # NOTE: CMake doesn't support fixed-length matching. See:
++  # https://cmake.org/cmake/help/latest/command/string.html#regex-specification
++  string(REGEX REPLACE "/nix/store/[a-z0-9]+-" "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-" msg "${msg}")
+   set(OPENCV_BUILD_INFO_STR "${OPENCV_BUILD_INFO_STR}\"${msg}\\n\"\n" CACHE INTERNAL "")
+ endfunction()
+ 
+-- 
+2.48.1
+
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 532513e1fe42..f3a264cf2644 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -298,6 +298,7 @@ effectiveStdenv.mkDerivation {
   # Ensures that we use the system OpenEXR rather than the vendored copy of the source included with OpenCV.
   patches = [
     ./cmake-don-t-use-OpenCVFindOpenEXR.patch
+    ./0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch
   ]
   ++ optionals enableCuda [
     ./cuda_opt_flow.patch
@@ -321,11 +322,6 @@ effectiveStdenv.mkDerivation {
       ${installExtraFiles wechat_qrcode}
     '');
 
-  postConfigure = ''
-    [ -e modules/core/version_string.inc ]
-    echo '"(build info elided)"' > modules/core/version_string.inc
-  '';
-
   buildInputs = [
     boost
     gflags
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 8d6a847b235f..0d4e99a4394b 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -87,7 +87,15 @@ let
         substituteInPlace Configurations/unix-Makefile.tmpl \
           --replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \
                     'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}'
-      '';
+      ''
+      # This test will fail if the error strings between the build libc and host
+      # libc mismatch, e.g. when cross-compiling from glibc to musl
+      +
+        lib.optionalString
+          (finalAttrs.finalPackage.doCheck && stdenv.hostPlatform.libc != stdenv.buildPlatform.libc)
+          ''
+            rm test/recipes/02-test_errstr.t
+          '';
 
       outputs = [
         "bin"
@@ -244,6 +252,11 @@ let
 
       enableParallelBuilding = true;
 
+      doCheck = true;
+      preCheck = ''
+        patchShebangs util
+      '';
+
       postInstall =
         (
           if static then
@@ -364,16 +377,19 @@ in
   };
 
   openssl_3 = common {
-    version = "3.0.17";
-    hash = "sha256-39135OobV/86bb3msL3D8x21rJnn/dTq+eH7tuwtuM4=";
+    version = "3.0.18";
+    hash = "sha256-2Aw09c+QLczx8bXfXruG0DkuNwSeXXPfGzq65y5P/os=";
 
     patches = [
+      # Support for NIX_SSL_CERT_FILE, motivation:
+      # https://github.com/NixOS/nixpkgs/commit/942dbf89c6120cb5b52fb2ab456855d1fbf2994e
       ./3.0/nix-ssl-cert-file.patch
 
       # openssl will only compile in KTLS if the current kernel supports it.
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
+      # Look up SSL certificates in /etc rather than the immutable installation directory
       (
         if stdenv.hostPlatform.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch
       )
@@ -386,17 +402,20 @@ in
     };
   };
 
-  openssl_3_5 = common {
-    version = "3.5.2";
-    hash = "sha256-xTpH5eRByTDDkoz3v2+wDl0Sm2MOCqhzsIJYZW5zRew=";
+  openssl_3_6 = common {
+    version = "3.6.0";
+    hash = "sha256-tqX0S362nj+jXb8VUkQFtEg3pIHUPYHa3d4/8h/LuOk=";
 
     patches = [
+      # Support for NIX_SSL_CERT_FILE, motivation:
+      # https://github.com/NixOS/nixpkgs/commit/942dbf89c6120cb5b52fb2ab456855d1fbf2994e
       ./3.0/nix-ssl-cert-file.patch
 
       # openssl will only compile in KTLS if the current kernel supports it.
       # This patch disables build-time detection.
       ./3.0/openssl-disable-kernel-detection.patch
 
+      # Look up SSL certificates in /etc rather than the immutable installation directory
       (
         if stdenv.hostPlatform.isDarwin then
           ./3.5/use-etc-ssl-certs-darwin.patch
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index ae018111a2c3..bb889da7ea81 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -77,7 +77,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pipewire";
-  version = "1.4.8";
+  version = "1.4.9";
 
   outputs = [
     "out"
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     rev = finalAttrs.version;
-    sha256 = "sha256-o4puApKXW4pQ0DRcLgZTDor8CAxKehn7Zi56/PzrSLU=";
+    sha256 = "sha256-380KY17l6scVchZAoSHswTvceYl427e79eU11JQallc=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 9c34451b9e84..14e1fbef6863 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -65,9 +65,6 @@ let
       ./qtdeclarative-default-disable-qmlcache.patch
       # add version specific QML import path
       ./qtdeclarative-qml-paths.patch
-    ]
-    # FIXME: Make unconditional on next staging cycle
-    ++ lib.optionals (stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isDarwin) [
       # Fix an undefined behavior, and fix random-seeming build error with Clang. See:
       # - https://codereview.qt-project.org/c/qt/qtdeclarative/+/354847
       # - https://github.com/llvm/llvm-project/issues/74070
@@ -352,42 +349,6 @@ let
       qtxmlpatterns = callPackage ../modules/qtxmlpatterns.nix { };
 
       env = callPackage ../qt-env.nix { };
-      full =
-        callPackage ({ env, qtbase }: env "qt-full-${qtbase.version}") { }
-          # `with self` is ok to use here because having these spliced is unnecessary
-          (
-            with self;
-            [
-              qt3d
-              qtcharts
-              qtconnectivity
-              qtdeclarative
-              qtdoc
-              qtgraphicaleffects
-              qtimageformats
-              qtlocation
-              qtmultimedia
-              qtquickcontrols
-              qtquickcontrols2
-              qtscript
-              qtsensors
-              qtserialport
-              qtsvg
-              qttools
-              qttranslations
-              qtvirtualkeyboard
-              qtwebchannel
-              qtwebengine
-              qtwebsockets
-              qtwebview
-              qtx11extras
-              qtxmlpatterns
-              qtlottie
-              qtdatavis3d
-            ]
-            ++ lib.optional (!stdenv.hostPlatform.isDarwin) qtwayland
-            ++ lib.optional (stdenv.hostPlatform.isDarwin) qtmacextras
-          );
 
       qmake = callPackage (
         { qtbase }:
@@ -422,6 +383,9 @@ let
           ++ lib.optional stdenv.hostPlatform.isLinux qtwayland.dev;
         } ../hooks/wrap-qt-apps-hook.sh
       ) { };
+    }
+    // lib.optionalAttrs config.allowAliases {
+      full = throw "libsForQt5.full has been removed. Please use individual packages instead."; # Added 2025-10-18
     };
 
   baseScope = makeScopeWithSplicing' {
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index e24c2c825240..2236001ad901 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -67,58 +67,6 @@ let
         inherit (srcs.qtbase) src version;
       };
       env = callPackage ./qt-env.nix { };
-      full = callPackage (
-        { env, qtbase }:
-        env "qt-full-${qtbase.version}"
-          # `with self` is ok to use here because having these spliced is unnecessary
-          (
-            with self;
-            [
-              qt3d
-              qt5compat
-              qtcharts
-              qtconnectivity
-              qtdatavis3d
-              qtdeclarative
-              qtdoc
-              qtgraphs
-              qtgrpc
-              qthttpserver
-              qtimageformats
-              qtlanguageserver
-              qtlocation
-              qtlottie
-              qtmultimedia
-              qtmqtt
-              qtnetworkauth
-              qtpositioning
-              qtsensors
-              qtserialbus
-              qtserialport
-              qtshadertools
-              qtspeech
-              qtquick3d
-              qtquick3dphysics
-              qtquickeffectmaker
-              qtquicktimeline
-              qtremoteobjects
-              qtsvg
-              qtscxml
-              qttools
-              qttranslations
-              qtvirtualkeyboard
-              qtwebchannel
-              qtwebengine
-              qtwebsockets
-              qtwebview
-            ]
-            ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-              qtwayland
-              libglvnd
-            ]
-          )
-      ) { };
-
       qt3d = callPackage ./modules/qt3d.nix { };
       qt5compat = callPackage ./modules/qt5compat.nix { };
       qtcharts = callPackage ./modules/qtcharts.nix { };
@@ -213,6 +161,9 @@ let
           };
         } ./hooks/qmake-hook.sh
       ) { };
+    }
+    // lib.optionalAttrs config.allowAliases {
+      full = throw "qt6.full has been removed. Please use individual packages instead."; # Added 2025-10-21
     };
 
   baseScope = makeScopeWithSplicing' {
diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 87d5916f3e38..9c161baa005d 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.9/6.9.2/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.10/6.10.0/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index df8286ee8f46..ab35d1906f73 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -29,6 +29,7 @@
   vulkan-loader,
   libthai,
   libdrm,
+  libgbm,
   libdatrie,
   lttng-ust,
   libepoxy,
@@ -78,6 +79,9 @@
   gtk3,
   withLibinput ? false,
   libinput,
+  withWayland ? lib.meta.availableOn stdenv.hostPlatform wayland,
+  wayland,
+  wayland-scanner,
   # options
   qttranslations ? null,
 }:
@@ -133,6 +137,7 @@ stdenv.mkDerivation rec {
     lttng-ust
     libthai
     libdrm
+    libgbm
     libdatrie
     udev
     # Text rendering
@@ -156,7 +161,11 @@ stdenv.mkDerivation rec {
     xorg.xcbutilcursor
     libepoxy
   ]
-  ++ lib.optional (cups != null && lib.meta.availableOn stdenv.hostPlatform cups) cups;
+  ++ lib.optional (cups != null && lib.meta.availableOn stdenv.hostPlatform cups) cups
+  ++ lib.optionals withWayland [
+    wayland
+    wayland-scanner
+  ];
 
   buildInputs =
     lib.optionals (lib.meta.availableOn stdenv.hostPlatform at-spi2-core) [
@@ -186,7 +195,14 @@ stdenv.mkDerivation rec {
   ]
   # I’m not sure if this is necessary, but the macOS mkspecs stuff
   # tries to call `xcrun xcodebuild`, so better safe than sorry.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ]
+  # wayland-scanner needs to be propagated as both build
+  # (for the wayland-scanner binary) and host (for the
+  # actual wayland.xml protocol definition)
+  ++ lib.optionals withWayland [
+    wayland
+    wayland-scanner
+  ];
 
   strictDeps = true;
 
@@ -251,6 +267,9 @@ stdenv.mkDerivation rec {
   qtQmlPrefix = "lib/qt-6/qml";
 
   cmakeFlags = [
+    # makes Qt print the configure summary
+    "--log-level=STATUS"
+
     "-DQT_EMBED_TOOLCHAIN_COMPILER=OFF"
     "-DINSTALL_PLUGINSDIR=${qtPluginPrefix}"
     "-DINSTALL_QMLDIR=${qtQmlPrefix}"
diff --git a/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix b/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
index 627454f85a51..7fc3c4ca3c5d 100644
--- a/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtconnectivity.nix
@@ -5,15 +5,20 @@
   qtbase,
   qtdeclarative,
   bluez,
+  pcsclite,
   pkg-config,
 }:
 
 qtModule {
   pname = "qtconnectivity";
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ bluez ];
+  buildInputs = [ pcsclite ] ++ lib.optionals stdenv.hostPlatform.isLinux [ bluez ];
   propagatedBuildInputs = [
     qtbase
     qtdeclarative
   ];
+
+  postPatch = ''
+    substituteInPlace src/nfc/configure.cmake --replace-fail "qt_configure_add_summary_entry(ARGS pcslite)" "qt_configure_add_summary_entry(ARGS pcsclite)"
+  '';
 }
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 26423ac73e7c..91671df7294b 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -1,4 +1,5 @@
 {
+  fetchpatch,
   qtModule,
   qtbase,
   qtlanguageserver,
@@ -29,27 +30,26 @@ qtModule {
   ];
 
   patches = [
-    # invalidates qml caches created from nix applications at different
-    # store paths and disallows saving caches of bare qml files in the store.
-    (replaceVars ./invalidate-caches-from-mismatched-store-paths.patch {
+    # don't cache bytecode of bare qml files in the store, as that never gets cleaned up
+    (replaceVars ./dont-cache-nix-store-paths.patch {
       nixStore = builtins.storeDir;
-      nixStoreLength = toString ((builtins.stringLength builtins.storeDir) + 1); # trailing /
     })
     # add version specific QML import path
     ./use-versioned-import-path.patch
+    # Fix common crash
+    # https://bugreports.qt.io/browse/QTBUG-140018
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtdeclarative/-/commit/2b7f93da38d41ffaeb5322a7dca40ec26fc091a1.diff";
+      hash = "sha256-AOXey18lJlswpZ8tpTTZeFb0VE9k1louXy8TPPGNiA4=";
+    })
+    # Fix another common crash
+    # https://bugreports.qt.io/browse/QTBUG-139626
+    (fetchpatch {
+      url = "https://invent.kde.org/qt/qt/qtdeclarative/-/commit/0de0b0ffdb44d73c605e20f00934dfb44bdf7ad9.diff";
+      hash = "sha256-DCoaSxH1MgywGXmmK21LLzCBi2KAmJIv5YKpFS6nw7M=";
+    })
   ];
 
-  preConfigure =
-    let
-      storePrefixLen = toString ((builtins.stringLength builtins.storeDir) + 1);
-    in
-    ''
-      # "NIX:" is reserved for saved qmlc files in patch 0001, "QTDHASH:" takes the place
-      # of the old tag, which is otherwise the qt version, invalidating caches from other
-      # qtdeclarative store paths.
-      echo "QTDHASH:''${out:${storePrefixLen}:32}" > .tag
-    '';
-
   cmakeFlags = [
     "-DQt6ShaderToolsTools_DIR=${pkgsBuildBuild.qt6.qtshadertools}/lib/cmake/Qt6ShaderTools"
     # for some reason doesn't get found automatically on Darwin
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/dont-cache-nix-store-paths.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/dont-cache-nix-store-paths.patch
new file mode 100644
index 000000000000..ef5d108db10c
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/dont-cache-nix-store-paths.patch
@@ -0,0 +1,17 @@
+--- a/src/qml/common/qv4compileddata.cpp
++++ b/src/qml/common/qv4compileddata.cpp
+@@ -178,6 +178,14 @@ bool CompilationUnit::saveToDisk(const QUrl &unitUrl, QString *errorString)
+         return false;
+     }
+ 
++    if (unitUrl.path().startsWith(QStringLiteral("@nixStore@"))) {
++        // We don't store bytecode for bare QML files in the nix store as the
++        // paths will change every time the application updates, filling caches
++        // endlessly with junk.
++        *errorString = QStringLiteral("Refusing to save bytecode for bare @nixStore@ path.");
++        return false;
++    }
++
+     return SaveableUnitPointer(unitData()).saveToDisk<char>(
+             [&unitUrl, errorString](const char *data, quint32 size) {
+                 const QString cachePath = localCacheFilePath(unitUrl);
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/invalidate-caches-from-mismatched-store-paths.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/invalidate-caches-from-mismatched-store-paths.patch
deleted file mode 100644
index 364c3ed838e6..000000000000
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/invalidate-caches-from-mismatched-store-paths.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-diff --git a/src/qml/common/qv4compileddata.cpp b/src/qml/common/qv4compileddata.cpp
-index 9dee91f713..9dec5cae67 100644
---- a/src/qml/common/qv4compileddata.cpp
-+++ b/src/qml/common/qv4compileddata.cpp
-@@ -15,6 +15,8 @@
- #include <QtCore/qscopeguard.h>
- #include <QtCore/qstandardpaths.h>
- 
-+#include <QtCore/qcoreapplication.h>
-+
- static_assert(QV4::CompiledData::QmlCompileHashSpace > QML_COMPILE_HASH_LENGTH);
- 
- #if defined(QML_COMPILE_HASH) && defined(QML_COMPILE_HASH_LENGTH) && QML_COMPILE_HASH_LENGTH > 0
-@@ -26,6 +28,35 @@ __attribute__((section(".qml_compile_hash")))
- const char qml_compile_hash[QV4::CompiledData::QmlCompileHashSpace] = QML_COMPILE_HASH;
- static_assert(sizeof(QV4::CompiledData::Unit::libraryVersionHash) > QML_COMPILE_HASH_LENGTH,
-               "Compile hash length exceeds reserved size in data structure. Please adjust and bump the format version");
-+
-+bool nix__isNixApplication() {
-+    static const bool value = QCoreApplication::applicationFilePath().startsWith(QStringLiteral("@nixStore@"));
-+    return value;
-+}
-+
-+static_assert(sizeof(QV4::CompiledData::Unit::libraryVersionHash) >
-+                  /*sha1*/ 20 + /*NIX:*/ 4,
-+              "Nix compile hash length exceeds the reserved space in data "
-+              "structure. Please review the patch.");
-+
-+const QByteArray &nix__applicationHash() {
-+    static const QByteArray value = [](){
-+        QCryptographicHash applicationHash(QCryptographicHash::Sha1);
-+        applicationHash.addData(QByteArrayView(qml_compile_hash, QML_COMPILE_HASH_LENGTH));
-+
-+        // We only care about the package, not the specific file path.
-+        auto view = QCoreApplication::applicationFilePath().sliced(@nixStoreLength@);
-+        auto pkgEndIdx = view.indexOf(QStringLiteral("/"));
-+        if (pkgEndIdx != -1) view = view.sliced(0, pkgEndIdx);
-+
-+        applicationHash.addData(view.toUtf8());
-+
-+        return QByteArray("NIX:") + applicationHash.result();
-+    }();
-+
-+    return value;
-+}
-+
- #else
- #  error "QML_COMPILE_HASH must be defined for the build of QtDeclarative to ensure version checking for cache files"
- #endif
-@@ -69,13 +100,29 @@ bool Unit::verifyHeader(QDateTime expectedSourceTimeStamp, QString *errorString)
-     }
- 
- #if defined(QML_COMPILE_HASH) && defined(QML_COMPILE_HASH_LENGTH) && QML_COMPILE_HASH_LENGTH > 0
--    if (qstrncmp(qml_compile_hash, libraryVersionHash, QML_COMPILE_HASH_LENGTH) != 0) {
-+    const bool nixUnit = qstrncmp("NIX:", this->libraryVersionHash, 4) == 0;
-+
-+    if (nixUnit && !nix__isNixApplication()) {
-+        *errorString = QStringLiteral("QML compile hash is for a nix store application.");
-+        return false;
-+    }
-+
-+    const char *targetHash = qml_compile_hash;
-+    size_t targetHashLength = QML_COMPILE_HASH_LENGTH;
-+
-+    if (nixUnit) {
-+        const auto &applicationHash = nix__applicationHash();
-+        targetHash = applicationHash.constData();
-+        targetHashLength = applicationHash.length();
-+    }
-+
-+    if (qstrncmp(targetHash, this->libraryVersionHash, targetHashLength) != 0) {
-         *errorString = QStringLiteral("QML compile hashes don't match. Found %1 expected %2")
-                                .arg(QString::fromLatin1(
--                                            QByteArray(libraryVersionHash, QML_COMPILE_HASH_LENGTH)
-+                                            QByteArray(this->libraryVersionHash, targetHashLength)
-                                                     .toPercentEncoding()),
-                                     QString::fromLatin1(
--                                            QByteArray(qml_compile_hash, QML_COMPILE_HASH_LENGTH)
-+                                            QByteArray(targetHash, targetHashLength)
-                                                     .toPercentEncoding()));
-         return false;
-     }
-@@ -213,6 +260,29 @@ bool CompilationUnit::saveToDisk(const QUrl &unitUrl, QString *errorString)
-         return false;
-     }
- 
-+#if defined(QML_COMPILE_HASH) && defined(QML_COMPILE_HASH_LENGTH) && QML_COMPILE_HASH_LENGTH > 0
-+    if (nix__isNixApplication() && unitUrl.scheme() == QStringLiteral("qrc")) {
-+        // If the application is running from the nix store, we can safely save
-+        // bytecode for its embedded QML files as long as we hash the
-+        // application path into the version. This will invalidate the caches
-+        // when the store path changes.
-+        const auto &applicationHash = nix__applicationHash();
-+
-+        memcpy(const_cast<char *>(unitData()->libraryVersionHash),
-+               applicationHash.constData(), applicationHash.length());
-+    } else if (unitUrl.path().startsWith(QStringLiteral("@nixStore@"))) {
-+        // We don't store bytecode for bare QML files in the nix store as the
-+        // paths will change every time the application updates, filling caches
-+        // endlessly with junk.
-+        *errorString = QStringLiteral("Refusing to save bytecode for bare @nixStore@ path.");
-+        return false;
-+    } else {
-+        // If the QML file is loaded from a normal file path it doesn't matter
-+        // if the application itself is running from a nix path, so we fall back
-+        // to the default Qt behavior.
-+    }
-+#endif
-+
-     return SaveableUnitPointer(unitData()).saveToDisk<char>(
-             [&unitUrl, errorString](const char *data, quint32 size) {
-                 const QString cachePath = localCacheFilePath(unitUrl);
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/use-versioned-import-path.patch b/pkgs/development/libraries/qt-6/modules/qtdeclarative/use-versioned-import-path.patch
index 7efd9c9cdb70..6de31fae7a77 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/use-versioned-import-path.patch
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/use-versioned-import-path.patch
@@ -1,10 +1,14 @@
---- a/src/qml/qml/qqmlimport.cpp
-+++ b/src/qml/qml/qqmlimport.cpp
-@@ -1520,6 +1520,7 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+diff --git a/src/qml/qml/qqmltypeloader.cpp b/src/qml/qml/qqmltypeloader.cpp
+index 5d09bf21c6..eacc8ccaea 100644
+--- a/src/qml/qml/qqmltypeloader.cpp
++++ b/src/qml/qml/qqmltypeloader.cpp
+@@ -1235,7 +1235,8 @@ QQmlTypeLoader::QQmlTypeLoader(QQmlEngine *engine)
      // env import paths
      addEnvImportPath("QML_IMPORT_PATH");
      addEnvImportPath("QML2_IMPORT_PATH");
+-
 +    addEnvImportPath("NIXPKGS_QT6_QML_IMPORT_PATH");
- 
++ 
      addImportPath(QStringLiteral("qrc:/qt/qml"));
      addImportPath(QStringLiteral("qrc:/qt-project.org/imports"));
+ 
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index 6b7385bd8e71..eec3ee8f7a8d 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.9.2";
+  version = "6.10.0";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-/qz93JmMkJW3+lzT+QKvb/VL+xmbg5H8kKaXK+XN2nE=";
+    hash = "sha256-0o0zC8SUlug5xOV5AX9PiTim1td8NA4fq6WfBR5aSXA=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/modules/qttools/default.nix b/pkgs/development/libraries/qt-6/modules/qttools/default.nix
index 4fb69db29359..58ef182fff2c 100644
--- a/pkgs/development/libraries/qt-6/modules/qttools/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qttools/default.nix
@@ -6,7 +6,7 @@
   qtbase,
   qtdeclarative,
   cups,
-  llvmPackages_20,
+  llvmPackages,
   # clang-based c++ parser for qdoc and lupdate
   withClang ? false,
 }:
@@ -30,10 +30,9 @@ qtModule {
     "-DNIX_OUTPUT_OUT=\"${placeholder "out"}\""
   ];
 
-  # FIXME: update to LLVM 21 with Qt 6.10
   buildInputs = lib.optionals withClang [
-    llvmPackages_20.libclang
-    llvmPackages_20.llvm
+    llvmPackages.libclang
+    llvmPackages.llvm
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/qt-6/modules/qttools/paths.patch b/pkgs/development/libraries/qt-6/modules/qttools/paths.patch
index ec306ecc480a..6b1eca682c59 100644
--- a/pkgs/development/libraries/qt-6/modules/qttools/paths.patch
+++ b/pkgs/development/libraries/qt-6/modules/qttools/paths.patch
@@ -18,8 +18,8 @@
 +
  static QString qtToolFilePath(const QString &toolName, QLibraryInfo::LibraryPath location)
  {
--    QString filePath = QLibraryInfo::path(location) + QLatin1Char('/') + toolName;
-+    QString filePath = qtBasePath(location) + QLatin1Char('/') + toolName;
+-    QString filePath = QLibraryInfo::path(location) + u'/' + toolName;
++    QString filePath = qtBasePath(location) + u'/' + toolName;
  #ifdef Q_OS_WIN
      filePath.append(QLatin1String(".exe"));
  #endif
diff --git a/pkgs/development/libraries/qt-6/modules/qtwayland.nix b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
index ae34492453c5..54fc9cac7e3c 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwayland.nix
@@ -5,8 +5,6 @@
   qtModule,
   qtbase,
   qtdeclarative,
-  wayland,
-  wayland-scanner,
   pkg-config,
   libdrm,
 }:
@@ -14,24 +12,15 @@
 qtModule {
   pname = "qtwayland";
 
-  # wayland-scanner needs to be propagated as both build
-  # (for the wayland-scanner binary) and host (for the
-  # actual wayland.xml protocol definition)
   propagatedBuildInputs = [
     qtbase
     qtdeclarative
-    wayland
-    wayland-scanner
-  ];
-  propagatedNativeBuildInputs = [
-    wayland
-    wayland-scanner
   ];
   buildInputs = [ libdrm ];
   nativeBuildInputs = [ pkg-config ];
 
   cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-    "-DQt6WaylandScannerTools_DIR=${pkgsBuildBuild.qt6.qtwayland}/lib/cmake/Qt6WaylandScannerTools"
+    "-DQt6WaylandScannerTools_DIR=${pkgsBuildBuild.qt6.qtbase}/lib/cmake/Qt6WaylandScannerTools"
   ];
 
   meta = {
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
index 9e18d253ddb8..df88eb6d473e 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix
@@ -7,6 +7,7 @@
   buildPackages,
   bison,
   coreutils,
+  fetchpatch2,
   flex,
   gperf,
   ninja,
@@ -37,7 +38,6 @@
   libopus,
   jsoncpp,
   protobuf,
-  libvpx,
   srtp,
   snappy,
   nss,
@@ -59,13 +59,12 @@
   lcms2,
   libkrb5,
   libgbm,
+  libva,
   enableProprietaryCodecs ? true,
   # darwin
   bootstrap_cmds,
   cctools,
   xcbuild,
-
-  fetchpatch,
 }:
 
 qtModule {
@@ -112,14 +111,14 @@ qtModule {
 
     # Reproducibility QTBUG-136068
     ./gn-object-sorted.patch
-
-    # Revert "Create EGLImage with eglCreateDRMImageMESA() for exporting dma_buf"
-    # Mesa 25.2 dropped eglCreateDRMImageMESA, so this no longer works.
-    # There are better ways to do this, but this is the easy fix for now.
-    (fetchpatch {
-      url = "https://invent.kde.org/qt/qt/qtwebengine/-/commit/ddcd30454aa6338d898c9d20c8feb48f36632e16.diff";
-      revert = true;
-      hash = "sha256-ht7C3GIEaPtmMGLzQKOtMqE9sLKdqqYCgi/W6b430YU=";
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    # https://chromium-review.googlesource.com/c/chromium/src/+/6633292
+    (fetchpatch2 {
+      url = "https://github.com/chromium/chromium/commit/b0ff8c3b258a8816c05bdebf472dbba719d3c491.patch?full_index=1";
+      stripLen = 1;
+      extraPrefix = "src/3rdparty/chromium/";
+      hash = "sha256-zDIlHd8bBtrThkFnrcyA13mhXYIQt6sKsi6qAyQ34yo=";
     })
   ];
 
@@ -210,7 +209,6 @@ qtModule {
 
     # Video formats
     srtp
-    libvpx
 
     # Audio formats
     libopus
@@ -269,6 +267,7 @@ qtModule {
 
     libkrb5
     libgbm
+    libva
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/qt-6/qtModule.nix b/pkgs/development/libraries/qt-6/qtModule.nix
index ac37bfd4f96e..07aa27e13abf 100644
--- a/pkgs/development/libraries/qt-6/qtModule.nix
+++ b/pkgs/development/libraries/qt-6/qtModule.nix
@@ -37,18 +37,21 @@ stdenv.mkDerivation (
       (lib.warnIf (args ? qtInputs) "qt6.qtModule's qtInputs argument is deprecated" args.qtInputs or [ ])
       ++ (args.propagatedBuildInputs or [ ]);
 
-    cmakeFlags =
+    cmakeFlags = [
+      # be more verbose
+      "--log-level=STATUS"
       # don't leak OS version into the final output
       # https://bugreports.qt.io/browse/QTBUG-136060
-      [ "-DCMAKE_SYSTEM_VERSION=" ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        "-DQT_NO_XCODE_MIN_VERSION_CHECK=ON"
-        # This is only used for the min version check, which we disabled above.
-        # When this variable is not set, cmake tries to execute xcodebuild
-        # to query the version.
-        "-DQT_INTERNAL_XCODE_VERSION=0.1"
-      ]
-      ++ args.cmakeFlags or [ ];
+      "-DCMAKE_SYSTEM_VERSION="
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-DQT_NO_XCODE_MIN_VERSION_CHECK=ON"
+      # This is only used for the min version check, which we disabled above.
+      # When this variable is not set, cmake tries to execute xcodebuild
+      # to query the version.
+      "-DQT_INTERNAL_XCODE_VERSION=0.1"
+    ]
+    ++ args.cmakeFlags or [ ];
 
     moveToDev = false;
 
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 190e64e037d9..58d46a69ea56 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,315 +4,315 @@
 
 {
   qt3d = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qt3d-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0ndn5fbsfj2vbcq3siq1gnk2rgblicd6ri2jrh9g41anicxh4vma";
-      name = "qt3d-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qt3d-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1dz9g3nlwgwfycwl5a0c7h339s7azq2xvq99kd76wjqzfkrmz25x";
+      name = "qt3d-everywhere-src-6.10.0.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qt5compat-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0q2vly836wgs462czw7lg0ysf2h48iwbdy43wwf2gz49qq2rja6b";
-      name = "qt5compat-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qt5compat-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0zibn0kq8grlpkvfasjciz71bv6x4cgz02v5l5giyplbcnfwa9fh";
+      name = "qt5compat-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtactiveqt-everywhere-src-6.9.2.tar.xz";
-      sha256 = "003vgfxswi6cpdp9i8kdzm1n34cbrbzlap4sg9h1ap0i9is51s1w";
-      name = "qtactiveqt-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtactiveqt-everywhere-src-6.10.0.tar.xz";
+      sha256 = "15m7g4h4aa3fk5q4an3apd0bdqkxdknnx64p72brrmah773mmlpm";
+      name = "qtactiveqt-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtbase = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtbase-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0h149x8l2ywfr5m034n20z6cjxnldary39x0vv22jhg0ryg9rgj4";
-      name = "qtbase-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtbase-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0v84f9pw387m0ghd4n6s9ipwjvniqspabqxkqmbj58slrcxn5m7a";
+      name = "qtbase-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtcharts-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0jzzlh0jq5fidgs9r4aqpilyj0nan30r1d0pigp1hgz7cigz20cz";
-      name = "qtcharts-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtcharts-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0svz8frryxv811xyg8cawn5icjcin6909mw4k6hlvgz7429m5zqv";
+      name = "qtcharts-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtconnectivity-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0qq4d8hn6s8bb9r2gglb6gzq6isbb13knqh7n2s2wsnx8rqwdzwa";
-      name = "qtconnectivity-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtconnectivity-everywhere-src-6.10.0.tar.xz";
+      sha256 = "16gs86zyaq8rvzd9jribgg51hanas15gpy8zh45n58004v7xa2jn";
+      name = "qtconnectivity-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdatavis3d-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0p6bvia085hx3jb1la06c2q48m9i897r1a1mf6bi2hbmm2hirzsx";
-      name = "qtdatavis3d-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtdatavis3d-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1qinrrk1j9qknwq2x7rl9aw8ajrp1h7kpfg29wcvaklbz9jj5xpx";
+      name = "qtdatavis3d-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdeclarative-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0r16qima008y2999r1djvwry01l295nmwwhqg081d2fr1cn2szs7";
-      name = "qtdeclarative-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtdeclarative-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1c7nar7q92w8l7wkmwbl0f6j4g1c8kw8jbn1bf35sf821593bzbf";
+      name = "qtdeclarative-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtdoc-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0qng2lsqmrrj8n85aqh8vl4nlzc23va9hynvvf6gqr35anvbpniz";
-      name = "qtdoc-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtdoc-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0fvx690kap3s2h9lg4d4w3nsiks6h2idggskisg1r1gpwks2brgc";
+      name = "qtdoc-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtgraphs-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0wsa4iar52dhiilyl053j7lmsw3xdn47b0pjrylb5a0ij1izp057";
-      name = "qtgraphs-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtgraphs-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1shllyk4f5lidw0hij9zhgapck3rf3hm6qw4m1nn79mynfrz3j3f";
+      name = "qtgraphs-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtgrpc-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0r1z6lbjcsgxhvzylpr8z8wl44ql14ajf99n1hfvf4gy4f43qgd4";
-      name = "qtgrpc-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtgrpc-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0id4j4xgamx9wndc3cgnf5m42ax257xyfy2khq4aw0b10s4j4wpv";
+      name = "qtgrpc-everywhere-src-6.10.0.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qthttpserver-everywhere-src-6.9.2.tar.xz";
-      sha256 = "06a0f7j1b309xffw3rwydz8lpzxnf5jg67savswskzbd3lfzlhqk";
-      name = "qthttpserver-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qthttpserver-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1i8z4l1is5xashh5lq9afj1syhvvz15zgcr5f27mwhjzvc0mfw74";
+      name = "qthttpserver-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtimageformats-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0fciahs4i0nn5z0j624gkfncqg6byxswj45bw81drpjp5xz3y0la";
-      name = "qtimageformats-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtimageformats-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1shcghzjn3v9mbgms0ykk5d91q7hdm8mxv8n6vjhsm3wa190lib4";
+      name = "qtimageformats-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlanguageserver-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1vlb0qn53y1b4zf7zkpxdvdh5ikr1cidq5gv8blvf6pyw6pnw6vq";
-      name = "qtlanguageserver-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtlanguageserver-everywhere-src-6.10.0.tar.xz";
+      sha256 = "19i151qxh2fw2h5w6082bh0myk6skz3dihhs4mahhb1rkzh077jc";
+      name = "qtlanguageserver-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlocation-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1ybk3ig69p6zyrxabcfkb4pcyc251gy1m2brkf4q52cmcwcysias";
-      name = "qtlocation-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtlocation-everywhere-src-6.10.0.tar.xz";
+      sha256 = "007qbni20qajdq6villwp7bc7hqzjlppc30yw3ccqb2bzf3kxm6b";
+      name = "qtlocation-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtlottie-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1iiigsb4p1zwkxm1x9c4pbx5rgwz35krdqi3vkql4nawvp997px4";
-      name = "qtlottie-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtlottie-everywhere-src-6.10.0.tar.xz";
+      sha256 = "09bvm3jr2s0hg14dq8b7604hfgxj3cm1i93lkkbjh2n2bfpi793h";
+      name = "qtlottie-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtmultimedia-everywhere-src-6.9.2.tar.xz";
-      sha256 = "04mbwl1mg4rjgai027chldslpjnqrx52c3jxn20j2hx7ayda3y3v";
-      name = "qtmultimedia-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtmultimedia-everywhere-src-6.10.0.tar.xz";
+      sha256 = "09hixwp8sq771rfp4c8bvmpzl6jd906k2rsrkxwij78drwhl0hh4";
+      name = "qtmultimedia-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtnetworkauth-everywhere-src-6.9.2.tar.xz";
-      sha256 = "114c65gyg56v70byyl3if1q7mzhp5kkv1g8sp4y9zaxqirbdjr91";
-      name = "qtnetworkauth-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtnetworkauth-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1j5k6dn0zc5rq82k89nyz5w0ny89mg1pg5aw0h41ybg2f5fqaq04";
+      name = "qtnetworkauth-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtpositioning-everywhere-src-6.9.2.tar.xz";
-      sha256 = "06mwzlyprwz11ks6fsvzh03ilk5fxy3scr1gqqb4p85xzw0ri6j8";
-      name = "qtpositioning-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtpositioning-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1q8yd9sjbm1vzcda1i21x0qf0n4md0k6wwbmr5jrvqbbcf8brgzc";
+      name = "qtpositioning-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquick3d-everywhere-src-6.9.2.tar.xz";
-      sha256 = "002888xfnkxmvn8413fllidl3mm2fcwc4gbzdnbvpjlysaq9f3ig";
-      name = "qtquick3d-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtquick3d-everywhere-src-6.10.0.tar.xz";
+      sha256 = "126lxiizd4pxxp43zzwv3k4i73806bgg329qsygz5qbnm0g8q9cq";
+      name = "qtquick3d-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquick3dphysics-everywhere-src-6.9.2.tar.xz";
-      sha256 = "12yc0lswcmyaw19yyxzy73j95ncgqw8mlx8svhrwsllgcf2n9z47";
-      name = "qtquick3dphysics-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtquick3dphysics-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0hj90pdxh6x6zm1b4iflhr89sy13qrbwc79pv9z9m7gdwyzhid62";
+      name = "qtquick3dphysics-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquickeffectmaker-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1yfq1pp0k2d6438x8pn2y73y29bqwg45bjh6msiy64fldr4z31br";
-      name = "qtquickeffectmaker-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtquickeffectmaker-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0vmr5s6b4cqxpw5kl5shzydj3if89znm3izj5nrhzsgbic11vhk4";
+      name = "qtquickeffectmaker-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtquicktimeline-everywhere-src-6.9.2.tar.xz";
-      sha256 = "09n51qw0y8v1q83xs1ybwwm4a49j2qhshqrasdkzz25mij6nhrdw";
-      name = "qtquicktimeline-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtquicktimeline-everywhere-src-6.10.0.tar.xz";
+      sha256 = "182bn72mifx8s867hsmramjfl9qr8szpla9fqw7bi3ywb1fiig6z";
+      name = "qtquicktimeline-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtremoteobjects-everywhere-src-6.9.2.tar.xz";
-      sha256 = "09lby6dqc2sfig1krcszg6fkypgxlz2r7hgjjfi95g7g9gqlwqnz";
-      name = "qtremoteobjects-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtremoteobjects-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1616dagpzs68rhi1wiq1dwl1kbgf2c1mmrb3c7ni204k0rcjsh5i";
+      name = "qtremoteobjects-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtscxml-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1dpb687zbw4akx42kfpbb5cpdlq3hcqn8l3l0x7sd5i9061z2sp0";
-      name = "qtscxml-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtscxml-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1r1ic7kr3xzrg0vyrj4smj2vzyidazwrb5jqn2l6irg1bx06r55m";
+      name = "qtscxml-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtsensors-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0qj4674vim2p34mq3kp99spjyf82qvs75w625namzqp274pshk4n";
-      name = "qtsensors-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtsensors-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0fc7cq067sddfwcn43j5v4h6xzjrvj5gvi08l9bfag43s4d5wlk7";
+      name = "qtsensors-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtserialbus-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0xia9xcz7sjrbf1c4m63qnhz3ggdxr06pycslmsnqizlzb10f7lm";
-      name = "qtserialbus-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtserialbus-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0c7cljc555vcs7jkm63mczxxpg085b161b6vpd9vnrz2zyzv49y6";
+      name = "qtserialbus-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtserialport-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0sz2dkas4qjdd6lkfb9g89vi94q18aiq9xdchlqb2yn0qbqb544b";
-      name = "qtserialport-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtserialport-everywhere-src-6.10.0.tar.xz";
+      sha256 = "01gqv6hc2ycd877jhq6ffnfgizh9pgnzc1gn6m6cfp8ximwa07jg";
+      name = "qtserialport-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtshadertools-everywhere-src-6.9.2.tar.xz";
-      sha256 = "158lpzb1nqspwm0n48d3nfr81q85zka1igrjp6xj8cjlv7wqlrqp";
-      name = "qtshadertools-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtshadertools-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1xpvzmpisglbk3nnczqvj0n1dv6zd79phvczqwpqc9yq7y64gfl7";
+      name = "qtshadertools-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtspeech-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1cc8l2h1frlraay0m40r5a91nsc7b53n6vksa52pwqqia4vngdmj";
-      name = "qtspeech-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtspeech-everywhere-src-6.10.0.tar.xz";
+      sha256 = "07m59akg31010khz82lvbrgjwwacavra5qsi17jqpk0chdk300qk";
+      name = "qtspeech-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtsvg-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1985asvnkd2ar30nh2zyi490qz0vkz6z1f752lfald33yawcm16r";
-      name = "qtsvg-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtsvg-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0cr5vaz485n23fvw4kvh1ykqny61bpdr5vd2q9szywsy9phc1ljy";
+      name = "qtsvg-everywhere-src-6.10.0.tar.xz";
     };
   };
   qttools = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qttools-everywhere-src-6.9.2.tar.xz";
-      sha256 = "12d4czfwvh9rfjwnkpsiwzrpx4ga69c6vz85aabhpk3hx7lggdyq";
-      name = "qttools-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qttools-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0anhvd7yqs9l3dryl43f0f7zq22rwrvz93g16ygmjgiyryc50vfq";
+      name = "qttools-everywhere-src-6.10.0.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qttranslations-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1mky3xj2yhcsrmpz8m28v7pky6ryn7hvdcglakww0rfk3qlbcfy7";
-      name = "qttranslations-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qttranslations-everywhere-src-6.10.0.tar.xz";
+      sha256 = "1pkc0a5kigcp0jcq3ny1ykl0rqw0vabz45w14d2mgjyhrx9q4vij";
+      name = "qttranslations-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtvirtualkeyboard-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1qqizh7kyqbqqnrm1mmlf2709rm1rnflbqdl1bi75yms07d00hbv";
-      name = "qtvirtualkeyboard-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtvirtualkeyboard-everywhere-src-6.10.0.tar.xz";
+      sha256 = "108klc6cr2ihaka9gnqaqv9i8r4lr8m39yviic3nviibd3r6gcmb";
+      name = "qtvirtualkeyboard-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwayland-everywhere-src-6.9.2.tar.xz";
-      sha256 = "10bpxwpam56gvymz9vjxkppbqsj1369ddzl3k4pz2s2maq39imya";
-      name = "qtwayland-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwayland-everywhere-src-6.10.0.tar.xz";
+      sha256 = "07vnfd0xmzg8vc68g9j2i88lilmic5vhv22gn47vs94v4l52ngv0";
+      name = "qtwayland-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebchannel-everywhere-src-6.9.2.tar.xz";
-      sha256 = "0rcf7i1wamdf1qynq3yi88r77ch5dg1jinxywlfjlb2dmlvn72l7";
-      name = "qtwebchannel-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwebchannel-everywhere-src-6.10.0.tar.xz";
+      sha256 = "02ahm7cz8wgvfcgyq85sc2v566x4ihymalmv5xi0wn5zz9j5h5kl";
+      name = "qtwebchannel-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebengine-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1aq35nkgbvhlsmglnjizbkavr7kb0ymf5n3kkllrpqy2mf90gjwr";
-      name = "qtwebengine-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwebengine-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0765a5kfkxxi7rq58pivi32xwb17pvg3h2ix88dx3y9h3jqpfk64";
+      name = "qtwebengine-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebsockets-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1vh82w96436pqrp4daf324mqs2zjvn51z78b3ksc5mnqgrk3z0xy";
-      name = "qtwebsockets-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwebsockets-everywhere-src-6.10.0.tar.xz";
+      sha256 = "0vl091wnzqjpnp0i0l2dqlbhlwcfzw2ry1p48aifxf63lmyjw2fi";
+      name = "qtwebsockets-everywhere-src-6.10.0.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.9.2";
+    version = "6.10.0";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.9/6.9.2/submodules/qtwebview-everywhere-src-6.9.2.tar.xz";
-      sha256 = "1w8z3d7w7z2xjfb5l15gb37v9w6pa7d71jalkrqda8l2wr5d3ksc";
-      name = "qtwebview-everywhere-src-6.9.2.tar.xz";
+      url = "${mirror}/official_releases/qt/6.10/6.10.0/submodules/qtwebview-everywhere-src-6.10.0.tar.xz";
+      sha256 = "03rszbcr3lnf9cnk7hz99ibxx8na4l3i98q19fahj36ilpk68dd9";
+      name = "qtwebview-everywhere-src-6.10.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 5a25cb3571d7..768e4a0ec359 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   llvmPackages,
+  fetchpatch,
   fetchurl,
   pkg-config,
   freetype,
@@ -39,7 +40,14 @@ stdenv.mkDerivation (finalAttrs: {
     }
   );
 
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
+  patches = [
+    # Fix build with gcc15
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/graphite2/raw/deba28323b0a3b7a3dcfd06df1efc2195b102ed7/f/graphite2-1.3.14-gcc15.patch";
+      hash = "sha256-vkkGkHkcsj1mD3OHCHLWWgpcmFDv8leC4YQm+TsbIUw=";
+    })
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
   postPatch = ''
     # disable broken 'nametabletest' test, fails on gcc-13:
     #   https://github.com/silnrsi/graphite/pull/74
diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 99fd7ff5dcab..f5e02b9d2067 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "4.10.0";
+  version = "4.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "agronholm";
     repo = "anyio";
     tag = version;
-    hash = "sha256-9nOGQTqdO3VzA9c97BpZqqwpll5O5+3gRvF/l2Y2ars=";
+    hash = "sha256-TOXg9J/Z2S5/X7OBgU+J0HZNB3BDluaWTqDiqp3O4ek=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/arelle/test-cli.nix b/pkgs/development/python-modules/arelle/test-cli.nix
new file mode 100644
index 000000000000..90b1572015a7
--- /dev/null
+++ b/pkgs/development/python-modules/arelle/test-cli.nix
@@ -0,0 +1,117 @@
+# Run with:
+#   cd nixpkgs
+#   nix-build -A python3Packages.arelle.passthru.tests.cli
+#
+# Note: These are uninteresting generated smoke tests to verify basic functionality
+{
+  lib,
+  runCommand,
+  arelle,
+}:
+
+runCommand "arelle-test-cli${lib.optionalString (!arelle.hasGUI) "-headless"}"
+  {
+    nativeBuildInputs = [ arelle ];
+  }
+  ''
+    # Set up temporary home directory
+    export HOME=$(mktemp -d)
+
+    # Test basic CLI commands work with proper assertions
+    arelleCmdLine --version --disablePersistentConfig 2>&1 | grep "Arelle(r) ${arelle.version}" > /dev/null
+    arelleCmdLine --help --disablePersistentConfig 2>&1 | grep "Usage: arelleCmdLine \[options\]" > /dev/null
+    arelleCmdLine --about --disablePersistentConfig 2>&1 | grep "An open source XBRL platform" > /dev/null
+
+    ${lib.optionalString arelle.hasGUI ''
+      # check if the arelleGUI command is available
+      command -v arelleGUI
+    ''}
+
+    # Create a simple but valid XBRL instance for testing validation functionality
+    cat > test-instance.xbrl << 'EOF'
+    <?xml version="1.0" encoding="UTF-8"?>
+    <xbrl xmlns="http://www.xbrl.org/2003/instance"
+          xmlns:link="http://www.xbrl.org/2003/linkbase"
+          xmlns:xlink="http://www.w3.org/1999/xlink">
+
+      <link:schemaRef xlink:href="http://www.xbrl.org/2003/xbrl-instance-2003-12-31.xsd" xlink:type="simple"/>
+
+      <context id="test_context">
+        <entity>
+          <identifier scheme="http://example.com/entities">TEST_ENTITY</identifier>
+        </entity>
+        <period>
+          <instant>2023-12-31</instant>
+        </period>
+      </context>
+
+    </xbrl>
+    EOF
+
+    # Also create a minimal test schema for more comprehensive testing
+    cat > test-schema.xsd << 'EOF'
+    <?xml version="1.0" encoding="UTF-8"?>
+    <schema xmlns="http://www.w3.org/2001/XMLSchema"
+            xmlns:xbrli="http://www.xbrl.org/2003/instance"
+            xmlns:link="http://www.xbrl.org/2003/linkbase"
+            xmlns:xlink="http://www.w3.org/1999/xlink"
+            xmlns:test="http://example.com/test"
+            targetNamespace="http://example.com/test"
+            elementFormDefault="qualified">
+
+      <import namespace="http://www.xbrl.org/2003/instance"
+              schemaLocation="http://www.xbrl.org/2003/xbrl-instance-2003-12-31.xsd"/>
+
+      <element name="TestElement" type="xbrli:stringItemType"
+                substitutionGroup="xbrli:item" xbrli:periodType="instant"/>
+
+    </schema>
+    EOF
+
+    # Test XBRL validation functionality
+    arelleCmdLine \
+      --file test-instance.xbrl \
+      --validate \
+      --disablePersistentConfig \
+      --internetConnectivity=offline \
+      --logLevel=info 2>&1 | grep "\[info\] validated in .* secs - .*test-instance.xbrl" > /dev/null
+
+    # Test with the built-in empty instance from arelle config
+    arelleCmdLine \
+      --file "${arelle}/lib/python3.13/site-packages/arelle/config/empty-instance.xml" \
+      --validate \
+      --disablePersistentConfig \
+      --internetConnectivity=offline \
+      --logLevel=info 2>&1 | grep "\[info\] validated in .* secs - .*empty-instance.xml" > /dev/null
+
+    # Test formula functionality (without running - just checking it loads)
+    arelleCmdLine \
+      --file test-instance.xbrl \
+      --formula=none \
+      --disablePersistentConfig \
+      --internetConnectivity=offline 2>&1 | grep "\[info\] loaded in .* secs.*test-instance.xbrl" > /dev/null
+
+    # Test facts output functionality
+    TEMP_DIR=$(mktemp -d)
+    arelleCmdLine \
+      --file test-instance.xbrl \
+      --facts="$TEMP_DIR/test-facts.csv" \
+      --disablePersistentConfig \
+      --internetConnectivity=offline 2>&1 | grep "\[info\] loaded in .* secs.*test-instance.xbrl" > /dev/null
+
+    # Test schema validation
+    arelleCmdLine \
+      --file test-schema.xsd \
+      --validate \
+      --disablePersistentConfig \
+      --internetConnectivity=offline \
+      --logLevel=info 2>&1 | grep "\[info\] validated in .* secs - .*test-schema.xsd" > /dev/null
+
+    # Test disclosure system validation option
+    arelleCmdLine \
+      --disclosureSystem=help \
+      --disablePersistentConfig 2>&1 | grep "Disclosure system choices:" > /dev/null
+
+    # Create success marker
+    touch $out
+  ''
diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index 99ff9c25fb95..afd13b3844d2 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -9,6 +9,7 @@
   click-plugins,
   click-repl,
   click,
+  cryptography,
   fetchFromGitHub,
   gevent,
   google-cloud-firestore,
@@ -29,6 +30,9 @@
   pyyaml,
   setuptools,
   vine,
+  # The AMQP REPL depends on click-repl, which is incompatible with our version
+  # of click.
+  withAmqpRepl ? false,
 }:
 
 buildPythonPackage rec {
@@ -43,6 +47,10 @@ buildPythonPackage rec {
     hash = "sha256-+sickqRfSkBxhcO0W9na6Uov4kZ7S5oqpXXKX0iRQ0w=";
   };
 
+  patches = lib.optionals (!withAmqpRepl) [
+    ./remove-amqp-repl.patch
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -50,13 +58,16 @@ buildPythonPackage rec {
     click
     click-didyoumean
     click-plugins
-    click-repl
     kombu
     python-dateutil
     vine
+  ]
+  ++ lib.optionals withAmqpRepl [
+    click-repl
   ];
 
   optional-dependencies = {
+    auth = [ cryptography ];
     azureblockblob = [
       azure-identity
       azure-storage-blob
diff --git a/pkgs/development/python-modules/celery/remove-amqp-repl.patch b/pkgs/development/python-modules/celery/remove-amqp-repl.patch
new file mode 100644
index 000000000000..6a9dcd641bf4
--- /dev/null
+++ b/pkgs/development/python-modules/celery/remove-amqp-repl.patch
@@ -0,0 +1,32 @@
+diff --git a/celery/bin/celery.py b/celery/bin/celery.py
+index e1fae1a77..cf05a927a 100644
+--- a/celery/bin/celery.py
++++ b/celery/bin/celery.py
+@@ -12,7 +12,6 @@ from click_plugins import with_plugins
+ 
+ from celery import VERSION_BANNER
+ from celery.app.utils import find_app
+-from celery.bin.amqp import amqp
+ from celery.bin.base import CeleryCommand, CeleryOption, CLIContext
+ from celery.bin.beat import beat
+ from celery.bin.call import call
+@@ -186,7 +185,6 @@ celery.add_command(control)
+ celery.add_command(graph)
+ celery.add_command(upgrade)
+ celery.add_command(logtool)
+-celery.add_command(amqp)
+ celery.add_command(shell)
+ celery.add_command(multi)
+ 
+diff --git a/requirements/default.txt b/requirements/default.txt
+index 185b6eddd..fbfc59fd7 100644
+--- a/requirements/default.txt
++++ b/requirements/default.txt
+@@ -3,7 +3,6 @@ kombu>=5.6.0rc1,<5.7
+ vine>=5.1.0,<6.0
+ click>=8.1.2,<9.0
+ click-didyoumean>=0.3.0
+-click-repl>=0.2.0
+ click-plugins>=1.1.1
+ backports.zoneinfo[tzdata]>=0.2.1; python_version < '3.9'
+ python-dateutil>=2.8.2
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index b7a5c901435a..0c837d51ffce 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -1,75 +1,46 @@
 {
-  lib,
-  stdenv,
   buildPythonPackage,
-  isPyPy,
-  fetchPypi,
-  setuptools,
-  pytestCheckHook,
+  fetchFromGitHub,
+  lib,
   libffi,
   pkg-config,
   pycparser,
+  pytestCheckHook,
+  setuptools,
+  stdenv,
 }:
 
-let
-  version = "1.17.1";
-in
-if isPyPy then
-  buildPythonPackage {
-    pname = "cffi";
-    inherit version;
-    pyproject = false;
+buildPythonPackage rec {
+  pname = "cffi";
+  version = "2.0.0";
+  pyproject = true;
 
-    # cffi is bundled with PyPy.
-    dontUnpack = true;
+  src = fetchFromGitHub {
+    owner = "python-cffi";
+    repo = "cffi";
+    tag = "v${version}";
+    hash = "sha256-7Mzz3KmmmE2xQru1GA4aY0DZqn6vxykWiExQvnA1bjM=";
+  };
 
-    # Some dependent packages expect to have pycparser available when using cffi.
-    dependencies = [ pycparser ];
+  nativeBuildInputs = [ pkg-config ];
 
-    meta = {
-      description = "Foreign Function Interface for Python calling C code (bundled with PyPy, placeholder package)";
-      homepage = "https://cffi.readthedocs.org/";
-      license = lib.licenses.mit;
-      teams = [ lib.teams.python ];
-    };
-  }
-else
-  buildPythonPackage rec {
-    pname = "cffi";
-    inherit version;
-    pyproject = true;
+  build-system = [ setuptools ];
 
-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-HDnGAWwyvEjdVFYZUOvWg24WcPKuRhKPZ89J54nFKCQ=";
-    };
+  buildInputs = [ libffi ];
 
-    nativeBuildInputs = [ pkg-config ];
+  # Some dependent packages expect to have pycparser available when using cffi.
+  dependencies = [ pycparser ];
 
-    build-system = [ setuptools ];
+  doCheck = !(stdenv.hostPlatform.isMusl || stdenv.hostPlatform.useLLVM or false);
 
-    buildInputs = [ libffi ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
-    dependencies = [ pycparser ];
-
-    # The tests use -Werror but with python3.6 clang detects some unreachable code.
-    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument -Wno-unreachable-code -Wno-c++11-narrowing";
-
-    doCheck = !(stdenv.hostPlatform.isMusl || stdenv.hostPlatform.useLLVM or false);
-
-    nativeCheckInputs = [ pytestCheckHook ];
-
-    disabledTests = lib.optionals stdenv.hostPlatform.isFreeBSD [
-      # https://github.com/python-cffi/cffi/pull/144
-      "test_dlopen_handle"
-    ];
-
-    meta = with lib; {
-      changelog = "https://github.com/python-cffi/cffi/releases/tag/v${version}";
-      description = "Foreign Function Interface for Python calling C code";
-      downloadPage = "https://github.com/python-cffi/cffi";
-      homepage = "https://cffi.readthedocs.org/";
-      license = licenses.mit;
-      teams = [ teams.python ];
-    };
-  }
+  meta = {
+    changelog = "https://github.com/python-cffi/cffi/releases/tag/v${version}";
+    description = "Foreign Function Interface for Python calling C code";
+    downloadPage = "https://github.com/python-cffi/cffi";
+    homepage = "https://cffi.readthedocs.org/";
+    license = lib.licenses.mit0;
+    teams = [ lib.teams.python ];
+  };
+}
diff --git a/pkgs/development/python-modules/click-repl/default.nix b/pkgs/development/python-modules/click-repl/default.nix
index 201e0d8d4253..00b8221e3bc9 100644
--- a/pkgs/development/python-modules/click-repl/default.nix
+++ b/pkgs/development/python-modules/click-repl/default.nix
@@ -42,6 +42,8 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    # https://github.com/click-contrib/click-repl/issues/128
+    broken = lib.versionAtLeast click.version "8.2.0";
     homepage = "https://github.com/click-contrib/click-repl";
     description = "Subcommand REPL for click apps";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index ec105f1ef7d5..e028343fbb65 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   importlib-metadata,
   pytestCheckHook,
@@ -17,24 +16,24 @@
 
 buildPythonPackage rec {
   pname = "click";
-  version = "8.1.8";
+  version = "8.2.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "pallets";
     repo = "click";
     tag = version;
-    hash = "sha256-pAAqf8jZbDfVZUoltwIFpov/1ys6HSYMyw3WV2qcE/M=";
+    hash = "sha256-3FfLKwpfkiGfY2+H2fQoZwLBqfPlV46xw2Bc4YEsyps=";
   };
 
   build-system = [ flit-core ];
-  dependencies = lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
+    # for some reason the tests fail to execute cat, even though they run with less just fine,
+    # even adding coreutils to nativeCheckInputs explicitly does not change anything
+    "test_echo_via_pager"
     # test fails with filename normalization on zfs
     "test_file_surrogates"
   ];
@@ -49,14 +48,15 @@ buildPythonPackage rec {
       ;
   };
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/pallets/click/blob/${src.tag}/CHANGES.rst";
     homepage = "https://click.palletsprojects.com/";
     description = "Create beautiful command line interfaces in Python";
     longDescription = ''
       A Python package for creating beautiful command line interfaces in a
       composable way, with as little code as necessary.
     '';
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ nickcao ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nickcao ];
   };
 }
diff --git a/pkgs/development/python-modules/commoncode/default.nix b/pkgs/development/python-modules/commoncode/default.nix
index 5a90c3bd3a4a..a107a6fd888d 100644
--- a/pkgs/development/python-modules/commoncode/default.nix
+++ b/pkgs/development/python-modules/commoncode/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "commoncode";
-  version = "32.2.1";
+  version = "32.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "nexB";
     repo = "commoncode";
     tag = "v${version}";
-    hash = "sha256-dCiERdNVup95UnvmJEzkpQsRvpk2eKqvwD6jkEBrXfE=";
+    hash = "sha256-FL9t8r53AJLR5D2XSEOq7qVHgvvHIbtPW5iVpSQCVsQ=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 030d2bad3028..7dd1e7d6fa5f 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.10.6";
+  version = "7.10.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nedbat";
     repo = "coveragepy";
     tag = version;
-    hash = "sha256-16t29ftyYBkGvzlV6+imjO+HM1UD/Nrhn+n4pK3h5iU=";
+    hash = "sha256-u62kfYE1yk/cIfyklWJz8vehPe9PL9uN+03bZZraw/U=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 074a18526902..11f6406d4238 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "45.0.4"; # Also update the hash in vectors.nix
+  version = "46.0.1"; # Also update the hash in vectors.nix
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -31,12 +31,12 @@ buildPythonPackage rec {
     owner = "pyca";
     repo = "cryptography";
     tag = version;
-    hash = "sha256-rKgMUVj5IdeWIdLWQ4E6zhC6dwJMi+BRHCh2JG73Zgc=";
+    hash = "sha256-saTHFKSJa9gjtEp6uGAHsvzFE3yPeck1WGdIE1+9kgs=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-dKwNnWBzBM9QEcRbbvkNhFJnFxFakqZ/MS7rqE8/tNQ=";
+    hash = "sha256-aCQzY2gBjVVwiqlqAxkH4y6yf4lqdQuSEnQSIjLPRJg=";
   };
 
   postPatch = ''
@@ -98,6 +98,6 @@ buildPythonPackage rec {
       bsd3
       psfl
     ];
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [ mdaniels5757 ];
   };
 }
diff --git a/pkgs/development/python-modules/cryptography/vectors.nix b/pkgs/development/python-modules/cryptography/vectors.nix
index 73e4f2c75f70..0a9a1a5d5894 100644
--- a/pkgs/development/python-modules/cryptography/vectors.nix
+++ b/pkgs/development/python-modules/cryptography/vectors.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   cryptography,
-  flit-core,
+  uv-build,
 }:
 
 buildPythonPackage rec {
@@ -15,10 +15,10 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "cryptography_vectors";
     inherit version;
-    hash = "sha256-+7BAjfj/LSs9vSkovFt/7r/dNvsJL6h5DVd4qbmh+e8=";
+    hash = "sha256-B40Sh84rRdJGtCxs+545Dh96+hdsGZsL1t6p1s6Jou4=";
   };
 
-  build-system = [ flit-core ];
+  build-system = [ uv-build ];
 
   # No tests included
   doCheck = false;
@@ -33,6 +33,6 @@ buildPythonPackage rec {
       asl20
       bsd3
     ];
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [ mdaniels5757 ];
   };
 }
diff --git a/pkgs/development/python-modules/cython/default.nix b/pkgs/development/python-modules/cython/default.nix
index c31044550c72..c7ccfa5295cc 100644
--- a/pkgs/development/python-modules/cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "cython";
-  version = "3.1.2";
+  version = "3.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cython";
     repo = "cython";
     tag = version;
-    hash = "sha256-lP8ILCzAZuoPzFhCqGXwIpifN8XoWz93SJ7c3XVe69Y=";
+    hash = "sha256-qFj7w0fQY6X1oADLsAgwFefzx92/Pmgv9j5S6v0sdPg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 6cba9d6d9b65..a661b22f939f 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "4.2.24";
+  version = "4.2.25";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-zDPK30u2QFbHCqnlTMqF1w9iN2sPDphhyKU1u+Mp5ho=";
+    hash = "sha256-HUNKvLDLZ1VmcyIN0QVMUJZgmd1zBulhzGzGgkZ/84E=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/dnspython/default.nix b/pkgs/development/python-modules/dnspython/default.nix
index 469838fe4f2b..6204b0dd25e3 100644
--- a/pkgs/development/python-modules/dnspython/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "dnspython";
-  version = "2.7.0";
+  version = "2.8.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zpxDLtoNyRz2GKXO3xpOFCZRGWu80sgOie1akH5c+vE=";
+    hash = "sha256-GB08aZZFLLEYnEBGxhWZuEpahuCZVi/9530mmE/ybQ8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/flasgger/default.nix b/pkgs/development/python-modules/flasgger/default.nix
index 1cc0d1fb7648..7cd1174589c9 100644
--- a/pkgs/development/python-modules/flasgger/default.nix
+++ b/pkgs/development/python-modules/flasgger/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -31,6 +32,15 @@ buildPythonPackage rec {
     hash = "sha256-ULEf9DJiz/S2wKlb/vjGto8VCI0QDcm0pkU5rlOwtiE=";
   };
 
+  patches = [
+    # https://github.com/flasgger/flasgger/pull/633
+    (fetchpatch {
+      name = "fix-tests-with-click-8.2.patch";
+      url = "https://github.com/flasgger/flasgger/commit/08591b60e988c0002fcf1b1e9f98b78e041d2732.patch";
+      hash = "sha256-DHaaY9W+cta3M2VA8S+ZQWacmgSpeyP03SKTiIlfBRM=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/geopandas/default.nix b/pkgs/development/python-modules/geopandas/default.nix
index 3c9c36b0311b..a7f5a5012ac7 100644
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   pytestCheckHook,
   setuptools,
 
@@ -38,6 +39,15 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
+  patches = [
+    # fix tests for geos 3.14
+    # see https://github.com/geopandas/geopandas/pull/3645
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/geopandas/geopandas/pull/3645.patch";
+      hash = "sha256-TLJixFRR+g739PLgwhTGuwYTVJ4SRr2BMGD14CLgmcY=";
+    })
+  ];
+
   dependencies = [
     packaging
     pandas
diff --git a/pkgs/development/python-modules/greynoise/default.nix b/pkgs/development/python-modules/greynoise/default.nix
index 0b9631179569..2ffdbcc4c8de 100644
--- a/pkgs/development/python-modules/greynoise/default.nix
+++ b/pkgs/development/python-modules/greynoise/default.nix
@@ -17,6 +17,9 @@
   pytestCheckHook,
   mock,
   pythonOlder,
+  # The REPL depends on click-repl, which is incompatible with our version of
+  # click.
+  withRepl ? false,
 }:
 
 buildPythonPackage rec {
@@ -33,22 +36,32 @@ buildPythonPackage rec {
     hash = "sha256-wJDO666HC3EohfR+LbG5F0Cp/eL7q4kXniWhJfc7C3s=";
   };
 
+  patches = lib.optionals (!withRepl) [
+    ./remove-repl.patch
+  ];
+
   build-system = [
     hatchling
   ];
 
+  pythonRelaxDeps = [
+    "click"
+  ];
+
   dependencies = [
     click
     ansimarkup
     cachetools
     colorama
     click-default-group
-    click-repl
     dict2xml
     jinja2
     more-itertools
     requests
     six
+  ]
+  ++ lib.optionals withRepl [
+    click-repl
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/greynoise/remove-repl.patch b/pkgs/development/python-modules/greynoise/remove-repl.patch
new file mode 100644
index 000000000000..88f46af3bdc3
--- /dev/null
+++ b/pkgs/development/python-modules/greynoise/remove-repl.patch
@@ -0,0 +1,37 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index 9c5950e..f19a5db 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -33,7 +33,6 @@ dependencies = [
+     "cachetools",
+     "colorama",
+     "click-default-group",
+-    "click-repl",
+     "dict2xml",
+     "jinja2",
+     "more-itertools>=8.14.0",
+@@ -53,4 +52,4 @@ greynoise = "greynoise.cli:main"
+ packages = ["src/greynoise"]
+ 
+ [tool.hatch.build.targets.wheel.shared-data]
+-"src/greynoise/cli/templates/*.j2" = "greynoise/cli/templates" 
+\ No newline at end of file
++"src/greynoise/cli/templates/*.j2" = "greynoise/cli/templates"
+diff --git a/src/greynoise/cli/__init__.py b/src/greynoise/cli/__init__.py
+index a7c22ea..9d26d3e 100644
+--- a/src/greynoise/cli/__init__.py
++++ b/src/greynoise/cli/__init__.py
+@@ -2,7 +2,6 @@
+ 
+ import click
+ from click_default_group import DefaultGroup
+-from click_repl import register_repl
+ 
+ from greynoise.cli import subcommand
+ 
+@@ -24,5 +23,3 @@ SUBCOMMAND_FUNCTIONS = [
+ 
+ for subcommand_function in SUBCOMMAND_FUNCTIONS:
+     main.add_command(subcommand_function)
+-
+-register_repl(main)
diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index 8503cf2e76ce..012af3877b96 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_channelz";
     inherit version;
-    hash = "sha256-1SGXOjQ4Bqg4S/h86uk88unxD4+rAsEr56Lj1dDk5o8=";
+    hash = "sha256-4MqgbU3j62LT/cVOXJ3JADqj7iHpxQ9dNTiuqFTSdvI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index 419872582d45..fe84d0817569 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.75.0";
+  version = "1.75.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_health_checking";
     inherit version;
-    hash = "sha256-TeXrJwlihA9g4Ynr3b/P4jK17Pz2GN1TQRam9mhLQL8=";
+    hash = "sha256-iI6huGrWXALIVHSG6VJjVi4UU2Pj1UAPUkT38sUyPmM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 3d5886bfc494..4b6290afd791 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_reflection";
     inherit version;
-    hash = "sha256-YLuYZfVBGtWJQg6tzdfgwzjAqr7fXUzQc2PVv32pyXI=";
+    hash = "sha256-K+PyC3uT5uaRoLx2H9fpmWqUC0yWxo9spPf7xHw/S2Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 4c26accf3eba..51294793b639 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -13,7 +13,7 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.75.0";
+  version = "1.75.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "grpcio_status";
     inherit version;
-    hash = "sha256-adW5G+G4uSbwhsHEg1GalowUZAdzoMzdbAQoJRXb7fc=";
+    hash = "sha256-gWKvohgzoghckQicw5WtiA+sE3ih1gIz2XZkntcky/g=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 5537e6a1caca..6edd72430bfa 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -13,7 +13,7 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "grpcio_testing";
     inherit version;
-    hash = "sha256-UuDE9gL6rQAK4a/PnZVDdyd+t8lhTMXJ+CspAHbEBbs=";
+    hash = "sha256-RUF4XosbetXbFVEyGsFE3WOM/z0fsC+St9ZRHFhLmKg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index c8af7dfff691..254f2f94b5ed 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_tools";
     inherit version;
-    hash = "sha256-615AJQNNkto8gf1eNGjDPVrnVxsHpyw4W17BdGZYVz8=";
+    hash = "sha256-u3iWDPPViUHh/scMvazPJVkYvu0Tw0ESppFabY+s69E=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 81a5e604af72..f8d67db96e64 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -19,14 +19,14 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.75.0";
+  version = "1.75.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uYnosJSJR4wtGf7MdEopiTD0DYsnw2OK+/6E0i82zk4=";
+    hash = "sha256-PoHYns6ZuaziOmkWiAusphPAOnmZJa+yhXiH76ixs9I=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index f1ba73092291..986d4bd3711b 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202510191";
+  version = "0.1.202510201";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-sMKlZGaEkzoOhpAOsKBqSUDRe6j7iL2sBivABSCAEA8=";
+    hash = "sha256-E9yFns1sRSyiFqQA3jXTSvMK7a7nj/UfUFUzh1PlUhM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/inkex/default.nix b/pkgs/development/python-modules/inkex/default.nix
index 534aa8ae551d..2a77286bd94d 100644
--- a/pkgs/development/python-modules/inkex/default.nix
+++ b/pkgs/development/python-modules/inkex/default.nix
@@ -72,6 +72,9 @@ buildPythonPackage {
     "tests/test_inkex_gui_window.py"
     # Failed to find pixmap 'image-missing' in /build/source/tests/data/
     "tests/test_inkex_gui_pixmaps.py"
+    # Fails with libxml2 >= 2.15 with "lxml.etree was compiled without Schematron support"
+    "inkex/tester/test_inx_file.py"
+    "tests/test_inkex_inx.py"
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/isal/default.nix b/pkgs/development/python-modules/isal/default.nix
index bd3f11ac014b..d1344d106f54 100644
--- a/pkgs/development/python-modules/isal/default.nix
+++ b/pkgs/development/python-modules/isal/default.nix
@@ -2,11 +2,10 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  replaceVars,
 
   # build-system
   setuptools,
-  versioningit,
+  setuptools-scm,
 
   # native dependencies
   isa-l,
@@ -18,25 +17,19 @@
 
 buildPythonPackage rec {
   pname = "isal";
-  version = "1.7.2";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pycompression";
     repo = "python-isal";
-    rev = "v${version}";
-    hash = "sha256-gvUVSGarPA4KupQTd61x75CfqNVqZfFC1zq0R21Clf8=";
+    tag = "v${version}";
+    hash = "sha256-703uXty3a0N+yXfv/7nVIAnU7PaqMtNO0ScltNLJq3g=";
   };
 
-  patches = [
-    (replaceVars ./version.patch {
-      inherit version;
-    })
-  ];
-
   build-system = [
     setuptools
-    versioningit
+    setuptools-scm
   ];
 
   buildInputs = [ isa-l ];
diff --git a/pkgs/development/python-modules/isal/version.patch b/pkgs/development/python-modules/isal/version.patch
deleted file mode 100644
index 9a8500a12d46..000000000000
--- a/pkgs/development/python-modules/isal/version.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index bf5fe99..b559255 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -2,9 +2,8 @@
- requires = ["setuptools>=64", "versioningit>=1.1.0"]
- build-backend = "setuptools.build_meta"
- 
--[tool.versioningit.vcs]
--method="git"
--default-tag = "v0.0.0"
-+[tool.versioningit]
-+default-version = "@version@"
- 
- [tool.versioningit.write]
- file = "src/isal/_version.py"
diff --git a/pkgs/development/python-modules/langchain-tests/default.nix b/pkgs/development/python-modules/langchain-tests/default.nix
index 485477679311..79528751b939 100644
--- a/pkgs/development/python-modules/langchain-tests/default.nix
+++ b/pkgs/development/python-modules/langchain-tests/default.nix
@@ -49,6 +49,7 @@ buildPythonPackage rec {
     # That prevents us from updating individual components.
     "langchain-core"
     "numpy"
+    "syrupy"
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/libpass/default.nix b/pkgs/development/python-modules/libpass/default.nix
index 80480c9e22c8..834d0b512b9e 100644
--- a/pkgs/development/python-modules/libpass/default.nix
+++ b/pkgs/development/python-modules/libpass/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "libpass";
-  version = "1.9.1.post0";
+  version = "1.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ThirVondukr";
     repo = "passlib";
     tag = version;
-    hash = "sha256-4J18UktqllRA8DVdHL4AJUuAkjZRdUjiql9a71XXhCA=";
+    hash = "sha256-xL+92LdZxCH+yu2vz2AC44b4EYiGJbWfPkoSO3mSSjw=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index fee77d75aa2e..8780137b1c04 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -17,16 +17,21 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "6.0.1";
+  version = "6.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
     tag = "lxml-${version}";
-    hash = "sha256-iY47nhAbA8ScnjmK2/7lVCBP8f65v1zOs3TcgQULlQ0=";
+    hash = "sha256-Ri5SzfQJFghRcMAKHS5QKD365OZlio895fSlumq83vs=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'Cython>=3.1.4' 'Cython'
+  '';
+
   build-system = [
     cython
     setuptools
diff --git a/pkgs/development/python-modules/markupsafe/default.nix b/pkgs/development/python-modules/markupsafe/default.nix
index 7e82d24685e4..afc0b824b38d 100644
--- a/pkgs/development/python-modules/markupsafe/default.nix
+++ b/pkgs/development/python-modules/markupsafe/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "markupsafe";
-  version = "3.0.2";
+  version = "3.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "pallets";
     repo = "markupsafe";
     tag = version;
-    hash = "sha256-BqCkQqPhjEx3qB/k3d3fSirR/HDBa7e4kpx3/VSwXJM=";
+    hash = "sha256-2d64cItemqVM25WJIKrjExKz6v4UW2wVxM6phH1g1sE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 926dd2467971..4c23466b9880 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -4,7 +4,6 @@
   fetchPypi,
   buildPythonPackage,
   isPyPy,
-  pythonAtLeast,
   pythonOlder,
 
   # build-system
@@ -53,8 +52,7 @@
 
   # Tk
   # Darwin has its own "MacOSX" backend, PyPy has tkagg backend and does not support tkinter
-  # tkinter fails to build on Python 3.11
-  enableTk ? (!stdenv.hostPlatform.isDarwin && !isPyPy && pythonAtLeast "3.12"),
+  enableTk ? (!stdenv.hostPlatform.isDarwin && !isPyPy),
   tkinter,
 
   # Qt
diff --git a/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch b/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch
new file mode 100644
index 000000000000..2217168cc026
--- /dev/null
+++ b/pkgs/development/python-modules/mozilla-django-oidc/cryptography.patch
@@ -0,0 +1,11 @@
+--- a/tests/test_auth.py
++++ b/tests/test_auth.py
+@@ -1234,7 +1234,7 @@ class OIDCAuthenticationBackendES256WithJwksEndpointTestCase(TestCase):
+         self.backend = OIDCAuthenticationBackend()
+ 
+         # Generate a private key to create a test token with
+-        private_key = ec.generate_private_key(ec.SECP256R1, default_backend())
++        private_key = ec.generate_private_key(ec.SECP256R1(), default_backend())
+         private_key_pem = private_key.private_bytes(
+             serialization.Encoding.PEM,
+             serialization.PrivateFormat.PKCS8,
diff --git a/pkgs/development/python-modules/mozilla-django-oidc/default.nix b/pkgs/development/python-modules/mozilla-django-oidc/default.nix
index cd44808efc57..d3eb5ead33d9 100644
--- a/pkgs/development/python-modules/mozilla-django-oidc/default.nix
+++ b/pkgs/development/python-modules/mozilla-django-oidc/default.nix
@@ -22,6 +22,12 @@ buildPythonPackage rec {
     hash = "sha256-72F1aLLIId+YClTrpOz3bL8LSq6ZhZjjtv8V/GJGkqs=";
   };
 
+  # Fix test with latest cryptography
+  # Upstream PR: https://github.com/mozilla/mozilla-django-oidc/pull/556
+  patches = [
+    ./cryptography.patch
+  ];
+
   nativeBuildInputs = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 397b071909e8..46b338fb2ff1 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchPypi,
+  fetchFromGitHub,
   python,
   numpy_2,
   pythonAtLeast,
@@ -59,15 +59,17 @@ let
 in
 buildPythonPackage rec {
   pname = "numpy";
-  version = "2.3.2";
+  version = "2.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
-  src = fetchPypi {
-    inherit pname version;
-    extension = "tar.gz";
-    hash = "sha256-4EhqEewwzey1PxhNSW0caiB4bIHlXkFkAnATAFb47kg=";
+  src = fetchFromGitHub {
+    owner = "numpy";
+    repo = "numpy";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-6RMzF5vOWSX7gL3mps9ECClJF3mNqL1mexM6j8/yfdc=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
@@ -176,7 +178,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/numpy/numpy/releases/tag/v${version}";
+    changelog = "https://github.com/numpy/numpy/releases/tag/${src.tag}";
     description = "Scientific tools for Python";
     homepage = "https://numpy.org/";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/python-modules/parsel/default.nix b/pkgs/development/python-modules/parsel/default.nix
index 750b61b13d48..e78c495f90c5 100644
--- a/pkgs/development/python-modules/parsel/default.nix
+++ b/pkgs/development/python-modules/parsel/default.nix
@@ -42,6 +42,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "parsel" ];
 
+  disabledTests = [
+    # asserts on the exact output format of an error message
+    "test_set_xpathfunc"
+  ];
+
   meta = with lib; {
     description = "Python library to extract data from HTML and XML using XPath and CSS selectors";
     homepage = "https://github.com/scrapy/parsel";
diff --git a/pkgs/development/python-modules/pip-tools/default.nix b/pkgs/development/python-modules/pip-tools/default.nix
index a5a04a886480..594d00194db2 100644
--- a/pkgs/development/python-modules/pip-tools/default.nix
+++ b/pkgs/development/python-modules/pip-tools/default.nix
@@ -5,6 +5,7 @@
   build,
   click,
   fetchPypi,
+  fetchpatch,
   pep517,
   pip,
   pytest-xdist,
@@ -29,7 +30,22 @@ buildPythonPackage rec {
     hash = "sha256-hkgm9Qc4ZEUOJNvuuFzjkgzfsJhIo9aev1N7Uh8UvMk=";
   };
 
-  patches = [ ./fix-setup-py-bad-syntax-detection.patch ];
+  patches = [
+    ./fix-setup-py-bad-syntax-detection.patch
+
+    # Backport click 8.2 + 8.3 compatibility from 7.5.1
+    # We can't update to 7.5.1 because of https://github.com/jazzband/pip-tools/issues/2231,
+    # which breaks home-assisstant-chip-wheels.
+    (fetchpatch {
+      url = "https://github.com/jazzband/pip-tools/commit/c7f128e7c533033c2436b52c972eee521fe3890c.diff";
+      excludes = [ "pyproject.toml" ];
+      hash = "sha256-cIFAE/VKyyDWVQktPtPPuxY85DtTvH6pK539WD2cDn4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/jazzband/pip-tools/commit/816ee196c543be53ddba0ea33fb4c7e84217b3b3.diff";
+      hash = "sha256-3GTUNWoy/AmpWv7NUCWIZ+coxb1vUgg6CZhwh6FehZo=";
+    })
+  ];
 
   build-system = [ setuptools-scm ];
 
diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index c26bd164c72c..3cc932fa292f 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = "poetry-core";
     tag = version;
-    hash = "sha256-WLPG8BiM+927qSC+ly5H2IAE2Htm8+wLEjK2AFnMJ58=";
+    hash = "sha256-l5WTjKa+A66QfWLmrjCQq7ZrSaeuylGIRZr8jsiYq+A=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 76f178a3d65f..20e3bf06c1d3 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "7.0.0";
+  version = "7.1.0";
   pyproject = true;
 
   inherit stdenv;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-e+nD66OL7Mtkleozr9mCpEB0t48oxDSh9RzAf9MVxFY=";
+    hash = "sha256-ZVcIs8BpOHyLd7By/EKaV9DiFCIdAcCnct99/tyzvNI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/py-vapid/cryptography.patch b/pkgs/development/python-modules/py-vapid/cryptography.patch
new file mode 100644
index 000000000000..d38088931b44
--- /dev/null
+++ b/pkgs/development/python-modules/py-vapid/cryptography.patch
@@ -0,0 +1,270 @@
+--- a/py_vapid/__init__.py
++++ b/py_vapid/__init__.py
+@@ -25,6 +25,7 @@
+ 
+ class VapidException(Exception):
+     """An exception wrapper for Vapid."""
++
+     pass
+ 
+ 
+@@ -34,6 +35,7 @@ class Vapid01(object):
+     https://tools.ietf.org/html/draft-ietf-webpush-vapid-01
+ 
+     """
++
+     _private_key = None
+     _public_key = None
+     _schema = "WebPush"
+@@ -65,14 +67,14 @@ def from_raw(cls, private_raw):
+         key = ec.derive_private_key(
+             int(binascii.hexlify(b64urldecode(private_raw)), 16),
+             curve=ec.SECP256R1(),
+-            backend=default_backend())
++            backend=default_backend(),
++        )
+         return cls(key)
+ 
+     @classmethod
+     def from_raw_public(cls, public_raw):
+         key = ec.EllipticCurvePublicKey.from_encoded_point(
+-            curve=ec.SECP256R1(),
+-            data=b64urldecode(public_raw)
++            curve=ec.SECP256R1(), data=b64urldecode(public_raw)
+         )
+         ss = cls()
+         ss._public_key = key
+@@ -87,8 +89,7 @@ def from_pem(cls, private_key):
+ 
+         """
+         # not sure why, but load_pem_private_key fails to deserialize
+-        return cls.from_der(
+-            b''.join(private_key.splitlines()[1:-1]))
++        return cls.from_der(b"".join(private_key.splitlines()[1:-1]))
+ 
+     @classmethod
+     def from_der(cls, private_key):
+@@ -98,9 +99,9 @@ def from_der(cls, private_key):
+         :type private_key: bytes
+ 
+         """
+-        key = serialization.load_der_private_key(b64urldecode(private_key),
+-                                                 password=None,
+-                                                 backend=default_backend())
++        key = serialization.load_der_private_key(
++            b64urldecode(private_key), password=None, backend=default_backend()
++        )
+         return cls(key)
+ 
+     @classmethod
+@@ -118,13 +119,13 @@ def from_file(cls, private_key_file=None):
+             vapid.generate_keys()
+             vapid.save_key(private_key_file)
+             return vapid
+-        with open(private_key_file, 'r') as file:
++        with open(private_key_file, "r") as file:
+             private_key = file.read()
+         try:
+             if "-----BEGIN" in private_key:
+-                vapid = cls.from_pem(private_key.encode('utf8'))
++                vapid = cls.from_pem(private_key.encode("utf8"))
+             else:
+-                vapid = cls.from_der(private_key.encode('utf8'))
++                vapid = cls.from_der(private_key.encode("utf8"))
+             return vapid
+         except Exception as exc:
+             logging.error("Could not open private key file: %s", repr(exc))
+@@ -156,11 +157,10 @@ def verify(cls, key, auth):
+         type key: str
+ 
+         """
+-        tokens = auth.rsplit(' ', 1)[1].rsplit('.', 1)
++        tokens = auth.rsplit(" ", 1)[1].rsplit(".", 1)
+         kp = cls().from_raw_public(key.encode())
+         return kp.verify_token(
+-            validation_token=tokens[0].encode(),
+-            verification_token=tokens[1]
++            validation_token=tokens[0].encode(), verification_token=tokens[1]
+         )
+ 
+     @property
+@@ -197,20 +197,19 @@ def public_key(self):
+ 
+     def generate_keys(self):
+         """Generate a valid ECDSA Key Pair."""
+-        self.private_key = ec.generate_private_key(ec.SECP256R1,
+-                                                   default_backend())
++        self.private_key = ec.generate_private_key(curve=ec.SECP256R1(), backend=default_backend())
+ 
+     def private_pem(self):
+         return self.private_key.private_bytes(
+             encoding=serialization.Encoding.PEM,
+             format=serialization.PrivateFormat.PKCS8,
+-            encryption_algorithm=serialization.NoEncryption()
++            encryption_algorithm=serialization.NoEncryption(),
+         )
+ 
+     def public_pem(self):
+         return self.public_key.public_bytes(
+             encoding=serialization.Encoding.PEM,
+-            format=serialization.PublicFormat.SubjectPublicKeyInfo
++            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+         )
+ 
+     def save_key(self, key_file):
+@@ -245,14 +244,14 @@ def verify_token(self, validation_token, verification_token):
+         :rtype: boolean
+ 
+         """
+-        hsig = b64urldecode(verification_token.encode('utf8'))
++        hsig = b64urldecode(verification_token.encode("utf8"))
+         r = int(binascii.hexlify(hsig[:32]), 16)
+         s = int(binascii.hexlify(hsig[32:]), 16)
+         try:
+             self.public_key.verify(
+                 ecutils.encode_dss_signature(r, s),
+                 validation_token,
+-                signature_algorithm=ec.ECDSA(hashes.SHA256())
++                signature_algorithm=ec.ECDSA(hashes.SHA256()),
+             )
+             return True
+         except InvalidSignature:
+@@ -260,23 +259,25 @@ def verify_token(self, validation_token, verification_token):
+ 
+     def _base_sign(self, claims):
+         cclaims = copy.deepcopy(claims)
+-        if not cclaims.get('exp'):
+-            cclaims['exp'] = int(time.time()) + 86400
+-        if not self.conf.get('no-strict', False):
+-            valid = _check_sub(cclaims.get('sub', ''))
++        if not cclaims.get("exp"):
++            cclaims["exp"] = int(time.time()) + 86400
++        if not self.conf.get("no-strict", False):
++            valid = _check_sub(cclaims.get("sub", ""))
+         else:
+-            valid = cclaims.get('sub') is not None
++            valid = cclaims.get("sub") is not None
+         if not valid:
+             raise VapidException(
+                 "Missing 'sub' from claims. "
+-                "'sub' is your admin email as a mailto: link.")
+-        if not re.match(r"^https?://[^/:]+(:\d+)?$",
+-                        cclaims.get("aud", ""),
+-                        re.IGNORECASE):
++                "'sub' is your admin email as a mailto: link."
++            )
++        if not re.match(
++            r"^https?://[^/:]+(:\d+)?$", cclaims.get("aud", ""), re.IGNORECASE
++        ):
+             raise VapidException(
+                 "Missing 'aud' from claims. "
+                 "'aud' is the scheme, host and optional port for this "
+-                "transaction e.g. https://example.com:8080")
++                "transaction e.g. https://example.com:8080"
++            )
+         return cclaims
+ 
+     def sign(self, claims, crypto_key=None):
+@@ -292,19 +293,22 @@ def sign(self, claims, crypto_key=None):
+ 
+         """
+         sig = sign(self._base_sign(claims), self.private_key)
+-        pkey = 'p256ecdsa='
++        pkey = "p256ecdsa="
+         pkey += b64urlencode(
+             self.public_key.public_bytes(
+                 serialization.Encoding.X962,
+-                serialization.PublicFormat.UncompressedPoint
+-            ))
++                serialization.PublicFormat.UncompressedPoint,
++            )
++        )
+         if crypto_key:
+-            crypto_key = crypto_key + ';' + pkey
++            crypto_key = crypto_key + ";" + pkey
+         else:
+             crypto_key = pkey
+ 
+-        return {"Authorization": "{} {}".format(self._schema, sig.strip('=')),
+-                "Crypto-Key": crypto_key}
++        return {
++            "Authorization": "{} {}".format(self._schema, sig.strip("=")),
++            "Crypto-Key": crypto_key,
++        }
+ 
+ 
+ class Vapid02(Vapid01):
+@@ -313,6 +317,7 @@ class Vapid02(Vapid01):
+     https://tools.ietf.org/html/rfc8292
+ 
+     """
++
+     _schema = "vapid"
+ 
+     def sign(self, claims, crypto_key=None):
+@@ -329,14 +334,11 @@ def sign(self, claims, crypto_key=None):
+         """
+         sig = sign(self._base_sign(claims), self.private_key)
+         pkey = self.public_key.public_bytes(
+-                serialization.Encoding.X962,
+-                serialization.PublicFormat.UncompressedPoint
+-            )
+-        return{
++            serialization.Encoding.X962, serialization.PublicFormat.UncompressedPoint
++        )
++        return {
+             "Authorization": "{schema} t={t},k={k}".format(
+-                schema=self._schema,
+-                t=sig,
+-                k=b64urlencode(pkey)
++                schema=self._schema, t=sig, k=b64urlencode(pkey)
+             )
+         }
+ 
+@@ -349,27 +351,23 @@ def verify(cls, auth):
+         :rtype: bool
+ 
+         """
+-        pref_tok = auth.rsplit(' ', 1)
+-        assert pref_tok[0].lower() == cls._schema, (
+-                "Incorrect schema specified")
++        pref_tok = auth.rsplit(" ", 1)
++        assert pref_tok[0].lower() == cls._schema, "Incorrect schema specified"
+         parts = {}
+-        for tok in pref_tok[1].split(','):
+-            kv = tok.split('=', 1)
++        for tok in pref_tok[1].split(","):
++            kv = tok.split("=", 1)
+             parts[kv[0]] = kv[1]
+-        assert 'k' in parts.keys(), (
+-                "Auth missing public key 'k' value")
+-        assert 't' in parts.keys(), (
+-                "Auth missing token set 't' value")
+-        kp = cls().from_raw_public(parts['k'].encode())
+-        tokens = parts['t'].rsplit('.', 1)
++        assert "k" in parts.keys(), "Auth missing public key 'k' value"
++        assert "t" in parts.keys(), "Auth missing token set 't' value"
++        kp = cls().from_raw_public(parts["k"].encode())
++        tokens = parts["t"].rsplit(".", 1)
+         return kp.verify_token(
+-            validation_token=tokens[0].encode(),
+-            verification_token=tokens[1]
++            validation_token=tokens[0].encode(), verification_token=tokens[1]
+         )
+ 
+ 
+ def _check_sub(sub):
+-    """ Check to see if the `sub` is a properly formatted `mailto:`
++    """Check to see if the `sub` is a properly formatted `mailto:`
+ 
+     a `mailto:` should be a SMTP mail address. Mind you, since I run
+     YouFailAtEmail.com, you have every right to yell about how terrible
+@@ -382,9 +380,7 @@ def _check_sub(sub):
+     :rtype: bool
+ 
+     """
+-    pattern = (
+-        r"^(mailto:.+@((localhost|[%\w-]+(\.[%\w-]+)+|([0-9a-f]{1,4}):+([0-9a-f]{1,4})?)))|https:\/\/(localhost|[\w-]+\.[\w\.-]+|([0-9a-f]{1,4}:+)+([0-9a-f]{1,4})?)$" # noqa
+-        )
++    pattern = r"^(mailto:.+@((localhost|[%\w-]+(\.[%\w-]+)+|([0-9a-f]{1,4}):+([0-9a-f]{1,4})?)))|https:\/\/(localhost|[\w-]+\.[\w\.-]+|([0-9a-f]{1,4}:+)+([0-9a-f]{1,4})?)$"  # noqa
+     return re.match(pattern, sub, re.IGNORECASE) is not None
diff --git a/pkgs/development/python-modules/py-vapid/default.nix b/pkgs/development/python-modules/py-vapid/default.nix
index 494afb7008d3..83042bf54525 100644
--- a/pkgs/development/python-modules/py-vapid/default.nix
+++ b/pkgs/development/python-modules/py-vapid/default.nix
@@ -22,6 +22,12 @@ buildPythonPackage rec {
     hash = "sha256-PIlzts+DhK0MmuZNYnDMxIDguSxwLY9eoswD5rUSR/k=";
   };
 
+  patches = [
+    # Fix tests with latest cryptography
+    # Upstream PR: https://github.com/web-push-libs/vapid/pull/110
+    ./cryptography.patch
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [ cryptography ];
diff --git a/pkgs/development/python-modules/pycparser/default.nix b/pkgs/development/python-modules/pycparser/default.nix
index fb2e5cbda0e0..9f2068a0e72f 100644
--- a/pkgs/development/python-modules/pycparser/default.nix
+++ b/pkgs/development/python-modules/pycparser/default.nix
@@ -1,36 +1,44 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  gitUpdater,
   setuptools,
   unittestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "pycparser";
-  version = "2.22";
+  version = "2.23";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-SRyL6cBA9TkPW/RKWwd1K9B/Vu35kjgbBccBQ57sEPY=";
+  src = fetchFromGitHub {
+    owner = "eliben";
+    repo = "pycparser";
+    tag = "release_v${version}";
+    hash = "sha256-dkteM8VizYf9ZLPOe8od5CZgg7a3fs4Hy+t8bGLV/GI=";
   };
 
   build-system = [ setuptools ];
 
+  pythonImportsCheck = [ "pycparser" ];
+
   nativeCheckInputs = [ unittestCheckHook ];
-  disabled = pythonOlder "3.8";
 
   unittestFlagsArray = [
     "-s"
     "tests"
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "release_v";
+  };
+
+  meta = {
+    changelog = "https://github.com/eliben/pycparser/releases/tag/${src.tag}";
     description = "C parser in Python";
     homepage = "https://github.com/eliben/pycparser";
-    license = licenses.bsd3;
-    maintainers = [ ];
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/pyopenssl/default.nix b/pkgs/development/python-modules/pyopenssl/default.nix
index ebbfcaff6c1f..aab03cea1990 100644
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@@ -64,6 +64,8 @@ buildPythonPackage rec {
     "test_wantWriteError"
     # https://github.com/pyca/pyopenssl/issues/1043
     "test_alpn_call_failure"
+    # https://github.com/pyca/pyopenssl/issues/1455
+    "test_client_receives_servers_data"
   ]
   ++ lib.optionals (lib.hasPrefix "libressl" openssl.meta.name) [
     # https://github.com/pyca/pyopenssl/issues/791
diff --git a/pkgs/development/python-modules/pyside6/default.nix b/pkgs/development/python-modules/pyside6/default.nix
index bcd90f6b0475..0a9621aaa2d2 100644
--- a/pkgs/development/python-modules/pyside6/default.nix
+++ b/pkgs/development/python-modules/pyside6/default.nix
@@ -10,6 +10,7 @@
   shiboken6,
   llvmPackages,
   symlinkJoin,
+  fetchpatch,
 }:
 let
   packages = with python.pkgs.qt6; [
@@ -56,7 +57,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   inherit (shiboken6) version src;
 
-  sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/pyside6";
+  sourceRoot = "${finalAttrs.src.name}/sources/pyside6";
+
+  patches = [
+    # revert commit that breaks generated cmake files
+    (fetchpatch {
+      url = "https://code.qt.io/cgit/pyside/pyside-setup.git/patch/?id=05e328476f2d6ef8a0f3f44aca1e5b1cdb7499fc";
+      revert = true;
+      stripLen = 2;
+      hash = "sha256-PPLV5K+xp7ZdG0Tah1wpBdNWN7fsXvZh14eBzO0R55c=";
+    })
+  ];
 
   # Qt Designer plugin moved to a separate output to reduce closure size
   # for downstream things
@@ -115,6 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     cd ../../..
+    chmod +w .
     ${python.pythonOnBuildForHost.interpreter} setup.py egg_info --build-type=pyside6
     cp -r PySide6.egg-info $out/${python.sitePackages}/
 
diff --git a/pkgs/development/python-modules/pytest-archon/default.nix b/pkgs/development/python-modules/pytest-archon/default.nix
index 643d1ae988c7..9a5637f6bbc6 100644
--- a/pkgs/development/python-modules/pytest-archon/default.nix
+++ b/pkgs/development/python-modules/pytest-archon/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-archon";
-  version = "0.0.6";
+  version = "0.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jwbargsten";
     repo = "pytest-archon";
     tag = "v${version}";
-    hash = "sha256-ZKs7ifqgazEywszPGxkcPCf2WD2tEpEsbh8kHN/PL7s=";
+    hash = "sha256-0YBujBUBpW/FSIlJDRjL5mvYZfirHW07bRyygyoapw8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pytest-celery/default.nix b/pkgs/development/python-modules/pytest-celery/default.nix
index 568159010c9d..524388907301 100644
--- a/pkgs/development/python-modules/pytest-celery/default.nix
+++ b/pkgs/development/python-modules/pytest-celery/default.nix
@@ -11,7 +11,6 @@
   pytest-docker-tools,
   pytest,
   pythonOlder,
-  setuptools,
   tenacity,
 }:
 
@@ -37,21 +36,23 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "debugpy"
-    "setuptools"
+  ];
+
+  pythonRemoveDeps = [
+    "celery" # cyclic dependency
+    "setuptools" # https://github.com/celery/pytest-celery/pull/464
   ];
 
   build-system = [ poetry-core ];
 
-  buildInput = [ pytest ];
+  buildInputs = [ pytest ];
 
   dependencies = [
-    (celery.overridePythonAttrs { doCheck = false; })
     debugpy
     docker
     kombu
     psutil
     pytest-docker-tools
-    setuptools
     tenacity
   ];
 
diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index a219cb3752f4..afd0505c9dee 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "15.1";
+  version = "16.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pytest-dev";
     repo = "pytest-rerunfailures";
     tag = version;
-    hash = "sha256-ab3n61zCf9ok2PWvKTwmaeoeGuMxl0sYE25djk/NDLk=";
+    hash = "sha256-4/BgvfVcs7MdULlhafZypNzzag4ITALStHI1tIoAPL4=";
   };
 
   build-system = [ setuptools ];
@@ -34,6 +34,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pytest plugin to re-run tests to eliminate flaky failures";
     homepage = "https://github.com/pytest-dev/pytest-rerunfailures";
+    changelog = "https://github.com/pytest-dev/pytest-rerunfailures/blob/${src.tag}/CHANGES.rst";
     license = licenses.mpl20;
     maintainers = with maintainers; [ das-g ];
   };
diff --git a/pkgs/development/python-modules/pytest-xdist/default.nix b/pkgs/development/python-modules/pytest-xdist/default.nix
index 3fd5f57fc93c..55fcd3b06162 100644
--- a/pkgs/development/python-modules/pytest-xdist/default.nix
+++ b/pkgs/development/python-modules/pytest-xdist/default.nix
@@ -1,8 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
+  fetchFromGitHub,
   setuptools,
   setuptools-scm,
   pytestCheckHook,
@@ -16,14 +15,13 @@
 buildPythonPackage rec {
   pname = "pytest-xdist";
   version = "3.8.0";
-  disabled = pythonOlder "3.7";
-
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "pytest_xdist";
-    inherit version;
-    hash = "sha256-fleBJeybxgUIYaqT8tWfHY0IVZXWVRwskLb0+tjTqfE=";
+  src = fetchFromGitHub {
+    owner = "pytest-dev";
+    repo = "pytest-xdist";
+    tag = "v${version}";
+    hash = "sha256-2x3znm92wo8DCshf5sYK0stnESg0oVXbxsWRAaTj6oQ=";
   };
 
   build-system = [
@@ -66,11 +64,11 @@ buildPythonPackage rec {
 
   setupHook = ./setup-hook.sh;
 
-  meta = with lib; {
-    changelog = "https://github.com/pytest-dev/pytest-xdist/blob/v${version}/CHANGELOG.rst";
-    description = "Pytest xdist plugin for distributed testing and loop-on-failing modes";
+  meta = {
+    changelog = "https://github.com/pytest-dev/pytest-xdist/blob/${src.tag}/CHANGELOG.rst";
+    description = "Pytest plugin for distributed testing";
     homepage = "https://github.com/pytest-dev/pytest-xdist";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index 81599579f703..e332672444ea 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -29,12 +29,12 @@
 
 buildPythonPackage rec {
   pname = "pytest";
-  version = "8.4.1";
+  version = "8.4.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fGf9aRdIdzWe2Tcew6+KPSsEdBgYxR5emcwXQiUfqTw=";
+    hash = "sha256-hsDQuTMGuWHVjWKk20h58n/iVRPUuWnfNRq93bPDDgE=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index 141fe5570f5b..51c2eecdacb8 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyyaml";
-  version = "6.0.2";
+  version = "6.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "yaml";
     repo = "pyyaml";
     tag = version;
-    hash = "sha256-IQoZd9Lp0ZHLAQN3PFwMsZVTsIVJyIaT9D6fpkzA8IA=";
+    hash = "sha256-jUooIBp80cLxvdU/zLF0X8Yjrf0Yp9peYeiFjuV8AHA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 92151e468259..663389069579 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -50,8 +50,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.16.1";
-  srcHash = "sha256-/LgYQUMGoQjSWMCWBgnekNGzEc0LVg2qiN2tV399rQU=";
+  version = "1.16.2";
+  srcHash = "sha256-vWXJyLvOqCC5jwDawWHF6K2GVU2gnvW4a85lF/6tVYg=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
diff --git a/pkgs/development/python-modules/setproctitle/default.nix b/pkgs/development/python-modules/setproctitle/default.nix
index e9aeda152d3e..e99a26990139 100644
--- a/pkgs/development/python-modules/setproctitle/default.nix
+++ b/pkgs/development/python-modules/setproctitle/default.nix
@@ -1,35 +1,42 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
   pytestCheckHook,
+  procps,
+  stdenv,
 }:
 
 buildPythonPackage rec {
   pname = "setproctitle";
-  version = "1.3.6";
+  version = "1.3.7";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-yfMrlscAuzhPM/fPB5VLtgnTXdgnUs71f7LuCWhAkWk=";
+  src = fetchFromGitHub {
+    owner = "dvarrazzo";
+    repo = "py-setproctitle";
+    tag = "version-${version}";
+    hash = "sha256-dfOdtfOXRAoCQLW307+YMsFIWRv4CupbKUxckev1oUw=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    procps
+  ];
 
-  # tries to compile programs with dependencies that aren't available
-  disabledTestPaths = [ "tests/setproctitle_test.py" ];
+  # Setting the process title fails on macOS in the Nix builder environment (regardless of sandboxing)
+  disabledTests = if stdenv.hostPlatform.isDarwin then [ "test_setproctitle_darwin" ] else null;
 
-  meta = with lib; {
+  pythonImportsCheck = [ "setproctitle" ];
+
+  meta = {
     description = "Allows a process to change its title (as displayed by system tools such as ps and top)";
     homepage = "https://github.com/dvarrazzo/py-setproctitle";
-    license = licenses.bsdOriginal;
-    maintainers = with maintainers; [ exi ];
+    changelog = "https://github.com/dvarrazzo/py-setproctitle/blob/${src.tag}/HISTORY.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ exi ];
   };
 }
diff --git a/pkgs/development/python-modules/shapely/default.nix b/pkgs/development/python-modules/shapely/default.nix
index ccad45bbac48..ecfe86b2e352 100644
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   pytestCheckHook,
   pythonOlder,
 
@@ -27,6 +28,18 @@ buildPythonPackage rec {
     hash = "sha256-qIITlPym92wfq0byqjRxofpmYYg7vohbi1qPVEu6hRg=";
   };
 
+  patches = [
+    # Fix tests for GEOS 3.14
+    (fetchpatch {
+      url = "https://github.com/shapely/shapely/commit/a561132c4e13c1fde597f56a8a7133c3c09b9928.patch";
+      hash = "sha256-a9gDfw2Dw+fd82T9f0BufYd/+gxE+ALvWyLm4vHygzU=";
+    })
+    (fetchpatch {
+      url = "https://github.com/shapely/shapely/commit/56e16e6eb27c54c6c24b9a251c12414e289fb7d0.patch";
+      hash = "sha256-JyjPVcJswEozF4C73QotKsPou55H41Ct9oVgkxhDhbk=";
+    })
+  ];
+
   nativeBuildInputs = [
     cython
     geos # for geos-config
diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix
index b55f3aa58c36..0267a3ad2974 100644
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  fetchurl,
+  fetchgit,
   llvmPackages,
   python,
   cmake,
@@ -13,14 +13,15 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "shiboken6";
-  version = "6.9.2";
+  version = "6.10.0";
 
-  src = fetchurl {
-    url = "mirror://qt/official_releases/QtForPython/pyside6/PySide6-${finalAttrs.version}-src/pyside-setup-everywhere-src-${finalAttrs.version}.tar.xz";
-    hash = "sha256-nsCHRlNCvcnb5JKjDlj9u8VEhlXerPWYKg/nEj9ZIi0=";
+  src = fetchgit {
+    url = "https://code.qt.io/pyside/pyside-setup.git";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zJV4rrqr2bzWFEG1CWOI+y6wbfQDvWAst6T3aSssj6M=";
   };
 
-  sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/shiboken6";
+  sourceRoot = "${finalAttrs.src.name}/sources/shiboken6";
 
   patches = [ ./fix-include-qt-headers.patch ];
 
@@ -48,10 +49,17 @@ stdenv'.mkDerivation (finalAttrs: {
   # variable available in this file.
   postPatch = ''
     substituteInPlace cmake/ShibokenHelpers.cmake --replace-fail '#!/bin/bash' '#!''${BASH}'
+
+    # raise ValueError('ZIP does not support timestamps before 1980')
+    find \
+      shibokenmodule/files.dir/shibokensupport/ \
+      libshiboken/embed/signature_bootstrap.py \
+      -exec touch -d "1980-01-01T00:00Z" {} \;
   '';
 
   postInstall = ''
     cd ../../..
+    chmod +w .
     ${python.pythonOnBuildForHost.interpreter} setup.py egg_info --build-type=shiboken6
     cp -r shiboken6.egg-info $out/${python.sitePackages}/
   '';
diff --git a/pkgs/development/python-modules/shiboken6/fix-include-qt-headers.patch b/pkgs/development/python-modules/shiboken6/fix-include-qt-headers.patch
index bfa035b92b52..c9b2d51a94df 100644
--- a/pkgs/development/python-modules/shiboken6/fix-include-qt-headers.patch
+++ b/pkgs/development/python-modules/shiboken6/fix-include-qt-headers.patch
@@ -1,14 +1,14 @@
 --- a/ApiExtractor/clangparser/compilersupport.cpp
 +++ b/ApiExtractor/clangparser/compilersupport.cpp
-@@ -16,6 +16,7 @@
+@@ -18,6 +18,7 @@
+ #include <QtCore/qprocess.h>
  #include <QtCore/qstandardpaths.h>
  #include <QtCore/qstringlist.h>
- #include <QtCore/qversionnumber.h>
 +#include <QtCore/qregularexpression.h>
  
  #include <clang-c/Index.h>
  
-@@ -341,6 +342,13 @@ QByteArrayList emulatedCompilerOptions()
+@@ -638,6 +639,13 @@ QByteArrayList emulatedCompilerOptions(LanguageLevel level)
  {
      QByteArrayList result;
      HeaderPaths headerPaths;
@@ -21,20 +21,18 @@
 +
      switch (compiler()) {
      case Compiler::Msvc:
-         result.append(QByteArrayLiteral("-fms-compatibility-version=19.26.28806"));
-@@ -352,9 +360,30 @@ QByteArrayList emulatedCompilerOptions()
+         result.append("-fms-compatibility-version="_ba + msvcCompatVersion());
+@@ -651,10 +659,27 @@ QByteArrayList emulatedCompilerOptions(LanguageLevel level)
              appendClangBuiltinIncludes(&headerPaths);
          break;
      case Compiler::Clang:
--        headerPaths.append(gppInternalIncludePaths(compilerFromCMake(u"clang++"_s)));
-+    // fix: error: cannot jump from switch statement to this case label: case Compiler::Gpp
-+    // note: jump bypasses variable initialization: const HeaderPaths clangPaths =
+-        headerPaths.append(gppInternalIncludePaths(compilerFromCMake(u"clang++"_s),
+-                                                   _compilerArguments));
 +    {
-+        //headerPaths.append(gppInternalIncludePaths(compilerFromCMake(u"clang++"_s)));
 +        // fix: qt.shiboken: x is specified in typesystem, but not defined. This could potentially lead to compilation errors.
 +        // PySide requires that Qt headers are not -isystem
 +        // https://bugreports.qt.io/browse/PYSIDE-787
-+        const HeaderPaths clangPaths = gppInternalIncludePaths(compilerFromCMake(u"clang++"_qs));
++        const HeaderPaths clangPaths = gppInternalIncludePaths(compilerFromCMake(u"clang++"_s), _compilerArguments);
 +        for (const HeaderPath &h : clangPaths) {
 +            auto match = qtHeaderRegex.match(QString::fromUtf8(h.path));
 +            if (!match.hasMatch()) {
@@ -54,9 +52,9 @@
      case Compiler::Gpp:
          if (needsClangBuiltinIncludes())
              appendClangBuiltinIncludes(&headerPaths);
-@@ -363,8 +392,20 @@ QByteArrayList emulatedCompilerOptions()
-         // <type_traits> etc (g++ 11.3).
-         const HeaderPaths gppPaths = gppInternalIncludePaths(compilerFromCMake(u"g++"_qs));
+@@ -664,8 +689,20 @@ QByteArrayList emulatedCompilerOptions(LanguageLevel level)
+         const HeaderPaths gppPaths = gppInternalIncludePaths(compilerFromCMake(u"g++"_s),
+                                                              _compilerArguments);
          for (const HeaderPath &h : gppPaths) {
 -            if (h.path.contains("c++") || h.path.contains("sysroot"))
 +            // fix: qt.shiboken: x is specified in typesystem, but not defined. This could potentially lead to compilation errors.
@@ -76,5 +74,3 @@
          }
          break;
      }
--- 
-2.39.0
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 5d4b4d581fa4..7402fa2b3103 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -135,6 +135,7 @@ buildPythonPackage rec {
     # Racy local networking
     "test_load_mappings_cache"
     "test_load_mappings_cache_update"
+    "test_load_mappings_cache_revert_update"
   ]
   ++ lib.optionals (pythonAtLeast "3.12") [
     # https://github.com/sphinx-doc/sphinx/issues/12430
diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index 36f4c0b81a71..a213f3a3f547 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "syrupy";
-  version = "4.9.1";
+  version = "5.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "syrupy-project";
     repo = "syrupy";
     tag = "v${version}";
-    hash = "sha256-AK4cB7MiL52oRUV6ArNj94srMsEpk/YQdjJ5tnjrAYM=";
+    hash = "sha256-TRwU9+2RvZB2gbVm82DzLge8QoDflxjavcRdYZUgVfs=";
   };
 
   build-system = [ poetry-core ];
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/syrupy-project/syrupy/blob/${src.tag}/CHANGELOG.md";
     description = "Pytest Snapshot Test Utility";
     homepage = "https://github.com/syrupy-project/syrupy";
-    license = lib.licenses.asl20;
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/tkinter/default.nix b/pkgs/development/python-modules/tkinter/default.nix
index 7933c994356a..233b2b2b0e4a 100644
--- a/pkgs/development/python-modules/tkinter/default.nix
+++ b/pkgs/development/python-modules/tkinter/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   replaceVars,
   setuptools,
@@ -8,7 +9,6 @@
   tcl,
   tclPackages,
   tk,
-  tkinter,
   xvfb-run,
 }:
 
@@ -27,23 +27,28 @@ buildPythonPackage {
     cp -rv Modules/clinic ../tkinter/
     cp -rv Lib/tkinter ../tkinter/
 
-    pushd $NIX_BUILD_TOP/tkinter
-
     # install our custom pyproject.toml
     cp ${
       replaceVars ./pyproject.toml {
         python_version = python.version;
         python_internal_dir = "${python}/include/${python.libPrefix}/internal";
       }
-    } ./pyproject.toml
+    } $NIX_BUILD_TOP/tkinter/pyproject.toml
 
   ''
   + lib.optionalString (pythonOlder "3.13") ''
-    substituteInPlace "tkinter/tix.py" --replace-fail \
+    substituteInPlace "$NIX_BUILD_TOP/tkinter/tkinter/tix.py" --replace-fail \
       "os.environ.get('TIX_LIBRARY')" \
       "os.environ.get('TIX_LIBRARY') or '${tclPackages.tix}/lib'"
   '';
 
+  # Adapted from https://github.com/python/cpython/pull/124542
+  patches = lib.optional (pythonOlder "3.12") ./fix-ttk-notebook-test.patch;
+
+  preConfigure = ''
+    pushd $NIX_BUILD_TOP/tkinter
+  '';
+
   build-system = [ setuptools ];
 
   buildInputs = [
@@ -64,29 +69,46 @@ buildPythonPackage {
     ];
   };
 
-  doCheck = false;
-
-  nativeCheckInputs = [ xvfb-run ];
+  nativeCheckInputs = lib.optional stdenv.hostPlatform.isLinux xvfb-run;
 
   preCheck = ''
     cd $NIX_BUILD_TOP/Python-*/Lib
     export HOME=$TMPDIR
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    xvfb-run -w 10 -s "-screen 0 1920x1080x24" \
-      python -m unittest test.test_tkinter
-
-    runHook postCheck
-  '';
-
-  passthru.tests.unittests = tkinter.overridePythonAttrs { doCheck = true; };
+  checkPhase =
+    let
+      testsNoGui = [
+        "test.test_tcl"
+        "test.test_ttk_textonly"
+      ];
+      testsGui =
+        if pythonOlder "3.12" then
+          [
+            "test.test_tk"
+            "test.test_ttk_guionly"
+          ]
+        else
+          [
+            "test.test_tkinter"
+            "test.test_ttk"
+          ];
+    in
+    ''
+      runHook preCheck
+      ${python.interpreter} -m unittest ${lib.concatStringsSep " " testsNoGui}
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      xvfb-run -w 10 -s "-screen 0 1920x1080x24" \
+        ${python.interpreter} -m unittest ${lib.concatStringsSep " " testsGui}
+    ''
+    + ''
+      runHook postCheck
+    '';
 
   pythonImportsCheck = [ "tkinter" ];
 
   meta = {
-    broken = pythonOlder "3.12"; # tommath.h: No such file or directory
     # Based on first sentence from https://docs.python.org/3/library/tkinter.html
     description = "Standard Python interface to the Tcl/Tk GUI toolkit";
     longDescription = ''
diff --git a/pkgs/development/python-modules/tkinter/fix-ttk-notebook-test.patch b/pkgs/development/python-modules/tkinter/fix-ttk-notebook-test.patch
new file mode 100644
index 000000000000..cf2ca0f7acdf
--- /dev/null
+++ b/pkgs/development/python-modules/tkinter/fix-ttk-notebook-test.patch
@@ -0,0 +1,24 @@
+--- a/Lib/tkinter/test/test_ttk/test_widgets.py
++++ b/Lib/tkinter/test/test_ttk/test_widgets.py
+@@ -911,12 +911,20 @@ class ScrollbarTest(AbstractWidgetTest, unittest.TestCase):
+         return ttk.Scrollbar(self.root, **kwargs)
+ 
+ 
+-@add_standard_options(IntegerSizeTests, StandardTtkOptionsTests)
++@add_standard_options(StandardTtkOptionsTests)
+ class NotebookTest(AbstractWidgetTest, unittest.TestCase):
+     OPTIONS = (
+         'class', 'cursor', 'height', 'padding', 'style', 'takefocus', 'width',
+     )
+ 
++    def test_configure_height(self):
++        widget = self.create()
++        self.checkPixelsParam(widget, 'height', '10c', 402, -402, 0, conv=False)
++
++    def test_configure_width(self):
++        widget = self.create()
++        self.checkPixelsParam(widget, 'width', '10c', 402, -402, 0, conv=False)
++
+     def setUp(self):
+         super().setUp()
+         self.nb = self.create(padding=0)
diff --git a/pkgs/development/python-modules/tkinter/pyproject.toml b/pkgs/development/python-modules/tkinter/pyproject.toml
index 770331a7ef4f..a53ccd8c72a2 100644
--- a/pkgs/development/python-modules/tkinter/pyproject.toml
+++ b/pkgs/development/python-modules/tkinter/pyproject.toml
@@ -11,6 +11,5 @@ requires-python = ">=@python_version@"
 [tool.setuptools]
 packages = ["tkinter"]
 ext-modules = [
-  { name = "_tkinter", sources = ["_tkinter.c"], libraries = ["tcl9.0", "tcl9tk9.0"], include-dirs = ["@python_internal_dir@/"] }
+  { name = "_tkinter", sources = ["_tkinter.c"], libraries = ["tcl", "tk"], include-dirs = ["@python_internal_dir@/"] }
 ]
-
diff --git a/pkgs/development/python-modules/trio/default.nix b/pkgs/development/python-modules/trio/default.nix
index 0dc38d643bf3..99a6a5e5d221 100644
--- a/pkgs/development/python-modules/trio/default.nix
+++ b/pkgs/development/python-modules/trio/default.nix
@@ -21,6 +21,7 @@
   pyopenssl,
   pytestCheckHook,
   pytest-trio,
+  pyyaml,
   trustme,
 }:
 
@@ -35,7 +36,7 @@ let
 in
 buildPythonPackage rec {
   pname = "trio";
-  version = "0.30.0";
+  version = "0.31.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -44,7 +45,7 @@ buildPythonPackage rec {
     owner = "python-trio";
     repo = "trio";
     tag = "v${version}";
-    hash = "sha256-spYHwVq3iNhnZQf2z7aTyDuSCiSl3X5PD6siXqLC4EA=";
+    hash = "sha256-cl1GstWVHDD3nWx835k2hnswt/+AnoTLXjxVIfLP6Es=";
   };
 
   build-system = [ setuptools ];
@@ -66,6 +67,7 @@ buildPythonPackage rec {
     pyopenssl
     pytestCheckHook
     pytest-trio'
+    pyyaml
     trustme
   ];
 
diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 5cea96d34d29..2b5ec73544c3 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -10,13 +10,13 @@
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2025.8.26.11";
+    version = "2025.9.11.17";
     pyproject = true;
 
     src = fetchPypi {
       pname = "trove_classifiers";
       inherit version;
-      hash = "sha256-5z7/8xfEkqeZAJL5wSZ2xwW/bP5AolipP2P0tMmUFDI=";
+      hash = "sha256-kxyphBpenJQIvCrme1DSis+FvvViGbVoYIdt0fLQJN0=";
     };
 
     postPatch = ''
diff --git a/pkgs/development/python-modules/typer/default.nix b/pkgs/development/python-modules/typer/default.nix
index 7b8d2a1b2289..c8ee4e01a9ef 100644
--- a/pkgs/development/python-modules/typer/default.nix
+++ b/pkgs/development/python-modules/typer/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = package;
-  version = "0.17.4";
+  version = "0.19.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastapi";
     repo = "typer";
     tag = version;
-    hash = "sha256-gd4GgoRnQVVmwmW5DprmNRxgjFiRRa8HB6xO9U9wHI8=";
+    hash = "sha256-mMsOEI4FpLkLkpjxjnUdmKdWD65Zx3Z1+L+XsS79k44=";
   };
 
   env.TIANGOLO_BUILD_PACKAGE = package;
@@ -80,12 +80,6 @@ buildPythonPackage rec {
     "test_install_completion"
   ];
 
-  disabledTestPaths = [
-    # likely click 8.2 compat issue
-    "tests/test_tutorial/test_parameter_types/test_bool/test_tutorial002_an.py"
-    "tests/test_tutorial/test_parameter_types/test_bool/test_tutorial002.py"
-  ];
-
   pythonImportsCheck = [ "typer" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/typing-extensions/default.nix b/pkgs/development/python-modules/typing-extensions/default.nix
index 662ad9c5eb9a..a85bb0348976 100644
--- a/pkgs/development/python-modules/typing-extensions/default.nix
+++ b/pkgs/development/python-modules/typing-extensions/default.nix
@@ -11,17 +11,17 @@
 
 buildPythonPackage rec {
   pname = "typing-extensions";
-  version = "4.14.1";
+  version = "4.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python";
     repo = "typing_extensions";
     tag = version;
-    hash = "sha256-KzfxVUgPN1cLg73A3TC2zQjYfeLc8x9TtbLmOfmlOkY=";
+    hash = "sha256-3oAlwvNSJ7NhPiHekh4SJI99cPFh29KCCR9314QzsvQ=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
   pythonImportsCheck = [ "typing_extensions" ];
 
diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix
index 9c09a8fdcfec..ce85c5b0d5b6 100644
--- a/pkgs/development/python-modules/typing-inspection/default.nix
+++ b/pkgs/development/python-modules/typing-inspection/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "typing-inspection";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "typing-inspection";
     tag = "v${version}";
-    hash = "sha256-MzOXl1i+rmr08TSH3Nxc0fFkcjATY6i9dFRLsYp+5m0=";
+    hash = "sha256-aGScO+FLEJ5IyI6hBqdsiKJRN7vEG36V5131nhVZEbc=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index bde90d49d258..9c4be78c1c72 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -80,6 +80,8 @@ buildPythonPackage rec {
     "tests/test_base.py::TestBaseUV.test_call_at"
     # Pointless and flaky (at least on darwin, depending on the sandbox perhaps)
     "tests/test_dns.py"
+    # Asserts on exact wording of error message
+    "tests/test_tcp.py::Test_AIO_TCP::test_create_connection_open_con_addr"
   ]
   ++ lib.optionals (pythonOlder "3.11") [
     "tests/test_tcp.py::Test_UV_TCPSSL::test_create_connection_ssl_failed_certificat"
diff --git a/pkgs/development/python-modules/voluptuous-openapi/default.nix b/pkgs/development/python-modules/voluptuous-openapi/default.nix
index 98d29e05eece..215c495de805 100644
--- a/pkgs/development/python-modules/voluptuous-openapi/default.nix
+++ b/pkgs/development/python-modules/voluptuous-openapi/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "voluptuous-openapi";
-  version = "0.1.0";
+  version = "0.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "voluptuous-openapi";
-    tag = "v${version}";
-    hash = "sha256-cfunRVEFz8gMLEtZ6nhH7w/rW5ea0JaaV+W/4gm4mwo=";
+    tag = version;
+    hash = "sha256-uIW+WyfSNdGxD7tA6ERf3nTp1tFhWd+lxFUNQM0O3nU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/zlib-ng/default.nix b/pkgs/development/python-modules/zlib-ng/default.nix
index 15380edc65fa..f17959460b61 100644
--- a/pkgs/development/python-modules/zlib-ng/default.nix
+++ b/pkgs/development/python-modules/zlib-ng/default.nix
@@ -2,12 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  replaceVars,
 
   # build-system
   cmake,
   setuptools,
-  versioningit,
+  setuptools-scm,
 
   # native dependencies
   zlib-ng,
@@ -18,26 +17,20 @@
 
 buildPythonPackage rec {
   pname = "zlib-ng";
-  version = "0.5.1";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pycompression";
     repo = "python-zlib-ng";
     rev = "v${version}";
-    hash = "sha256-UsdZgpRI7h6GemT1+1g/cP/8uhLykZ//saH4JMwwlY4=";
+    hash = "sha256-t/PSby1LUTyp+7XXKZTWjRrPvAei1ZrGSGU2CIcAQBc=";
   };
 
-  patches = [
-    (replaceVars ./version.patch {
-      inherit version;
-    })
-  ];
-
   build-system = [
     cmake
     setuptools
-    versioningit
+    setuptools-scm
   ];
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/zlib-ng/version.patch b/pkgs/development/python-modules/zlib-ng/version.patch
deleted file mode 100644
index e1f335525646..000000000000
--- a/pkgs/development/python-modules/zlib-ng/version.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index 28ae41d..05ad409 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -2,9 +2,8 @@
- requires = ["setuptools>=64", "versioningit>=1.1.0"]
- build-backend = "setuptools.build_meta"
- 
--[tool.versioningit.vcs]
--method="git"
--default-tag = "v0.0.0"
-+[tool.versioningit]
-+default-version = "@version@"
- 
- [tool.versioningit.write]
- file = "src/zlib_ng/_version.py"
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/development/tools/hotdoc/default.nix
index 505182bc06aa..b6ee390228d9 100644
--- a/pkgs/development/tools/hotdoc/default.nix
+++ b/pkgs/development/tools/hotdoc/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   buildPythonApplication,
+  fetchpatch,
   fetchPypi,
   replaceVars,
   clang,
@@ -45,6 +46,13 @@ buildPythonApplication rec {
       clang = lib.getExe clang;
       libclang = "${lib.getLib libclang}/lib/libclang${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
+
+    # Fix build with gcc15
+    (fetchpatch {
+      name = "hotdoc-fix-c_comment_scanner-function-prototypes-gcc15.patch";
+      url = "https://github.com/hotdoc/hotdoc/commit/adf8518431fafb78c9b47862a0a9a58824b6a421.patch";
+      hash = "sha256-5y50Yk+AjV3aSk8H3k9od/Yvy09FyQQOcVOAcstQnw8=";
+    })
   ];
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/misc/binutils/CVE-2025-5244.diff b/pkgs/development/tools/misc/binutils/CVE-2025-5244.diff
new file mode 100644
index 000000000000..947172f2866a
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2025-5244.diff
@@ -0,0 +1,13 @@
+Backported patch originally targeted against 2.45.
+--- a/bfd/elflink.c
++++ b/bfd/elflink.c
+@@ -14356,5 +14356,6 @@ elf_gc_sweep (bfd *abfd, struct bfd_link_info *info)
+	  if (o->flags & SEC_GROUP)
+	    {
+	      asection *first = elf_next_in_group (o);
+-	      o->gc_mark = first->gc_mark;
++	      if (first != NULL)
++	        o->gc_mark = first->gc_mark;
+	    }
+
+	  if (o->gc_mark)
diff --git a/pkgs/development/tools/misc/binutils/CVE-2025-5245.diff b/pkgs/development/tools/misc/binutils/CVE-2025-5245.diff
new file mode 100644
index 000000000000..27592a8d0e87
--- /dev/null
+++ b/pkgs/development/tools/misc/binutils/CVE-2025-5245.diff
@@ -0,0 +1,26 @@
+Backported patch originally targeted against 2.45.
+--- a/binutils/debug.c
++++ b/binutils/debug.c
+@@ -2554,9 +2554,6 @@ debug_write_type (struct debug_handle *info,
+     case DEBUG_KIND_UNION_CLASS:
+       return debug_write_class_type (info, fns, fhandle, type, tag);
+     case DEBUG_KIND_ENUM:
+-      if (type->u.kenum == NULL)
+-	return (*fns->enum_type) (fhandle, tag, (const char **) NULL,
+-				  (bfd_signed_vma *) NULL);
+       return (*fns->enum_type) (fhandle, tag, type->u.kenum->names,
+ 				type->u.kenum->values);
+     case DEBUG_KIND_POINTER:
+@@ -3097,9 +3094,9 @@ debug_type_samep (struct debug_handle *info, struct debug_type_s *t1,
+       break;
+
+     case DEBUG_KIND_ENUM:
+-      if (t1->u.kenum == NULL)
+-	ret = t2->u.kenum == NULL;
+-      else if (t2->u.kenum == NULL)
++      if (t1->u.kenum->names == NULL)
++	ret = t2->u.kenum->names == NULL;
++      else if (t2->u.kenum->names == NULL)
+ 	ret = false;
+       else
+ 	{
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 04e311bf38a1..2dee9eb4f572 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -118,6 +118,14 @@ stdenv.mkDerivation (finalAttrs: {
     ./avr-size.patch
 
     ./windres-locate-gcc.patch
+
+    # Backported against CVE patched in the 2.45 series. See:
+    # https://nvd.nist.gov/vuln/detail/CVE-2025-5244
+    ./CVE-2025-5244.diff
+
+    # Backported against CVE patched in the 2.45 series. See:
+    # https://nvd.nist.gov/vuln/detail/CVE-2025-5245
+    ./CVE-2025-5245.diff
   ];
 
   outputs = [
diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 542d0ac8be25..69f72f57d4e2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -30,8 +30,8 @@ let
   # 2) nix-build -A tree-sitter.updater.update-all-grammars
   # 3) Set GITHUB_TOKEN env variable to avoid api rate limit (Use a Personal Access Token from https://github.com/settings/tokens It does not need any permissions)
   # 4) run the ./result script that is output by that (it updates ./grammars)
-  version = "0.25.6";
-  hash = "sha256-2/DF2xyiKi5HAqqeGt1TIMvAWFfZgcfVccK4zrTqq88=";
+  version = "0.25.10";
+  hash = "sha256-aHszbvLCLqCwAS4F4UmM3wbSb81QuG9FM7BDHTu1ZvM=";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
@@ -171,7 +171,7 @@ rustPlatform.buildRustPackage {
   pname = "tree-sitter";
   inherit src version;
 
-  cargoHash = "sha256-sGh16M7cbT5ct1sT2FcUUoIQFcoOftTuQ0aSCjtkTEs=";
+  cargoHash = "sha256-4R5Y9yancbg/w3PhACtsWq0+gieUd2j8YnmEj/5eqkg=";
 
   buildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
index 36bccb90e009..2e65733a096f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-beancount.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/polarmutex/tree-sitter-beancount",
-  "rev": "321b12d0b02923c36e8cd9768afe6db5ced98e33",
-  "date": "2024-07-19T21:09:17-04:00",
-  "path": "/nix/store/v8yv84fm0n134mr5vmwbpr4cpyl71vxz-tree-sitter-beancount",
-  "sha256": "1milrdb8ka5vkypl0b44xgfdn0haydg2fz7489djcwpjkx7gfrsg",
-  "hash": "sha256-T2f3Tp/yciZbQuR8J17zCgLb3OuELECvn7uoiVbLNNY=",
+  "rev": "07bfb0ec6d9e255d776cdd3362128364d2b0bb2f",
+  "date": "2025-07-20T21:33:46-04:00",
+  "path": "/nix/store/7q88wczdhi0ralm2fzdz7y42mxnsc34c-tree-sitter-beancount",
+  "sha256": "0r2ql0n4wkwbcdjpklxhsk91xm8q8dl9n9rdlqk585xagmxf1w4b",
+  "hash": "sha256-i/Dgen2qF1Qmpi0nm2hDGNUe0tSw03llY4tPTiygWGQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
index 582ed02c1412..cb8c9dbc93db 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bitbake.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bqn.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bqn.json
index 65414bf90a02..13bb6ec8a2e4 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bqn.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-bqn.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
index b29372cbc061..9d898a553715 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-c-sharp.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-clojure.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-clojure.json
index e38432e27045..47467756a54b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-clojure.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-clojure.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/sogaiu/tree-sitter-clojure",
-  "rev": "40c5fc2e2a0f511a802a82002553c5de00feeaf4",
-  "date": "2025-05-26T17:10:02+09:00",
-  "path": "/nix/store/lkzsixjxwr6b2gwxsba0qah3k121axgi-tree-sitter-clojure",
-  "sha256": "163jm1qgrh9ha1xbjlbkcffcxkdbhsvj5kplknq4gcb080wlp6dp",
-  "hash": "sha256-t5lLOUBgsUewnfTOIreGq83OnGNzUbl6UDDB/HCocpg=",
+  "rev": "e43eff80d17cf34852dcd92ca5e6986d23a7040f",
+  "date": "2025-08-26T15:59:05+09:00",
+  "path": "/nix/store/gpvw9wn3mg5j7mzj91qvkxm8l5rlgid6-tree-sitter-clojure",
+  "sha256": "0bmclmbjk58w8092q52yra5axrr3q22v73yva9wvqh5fif81x2cf",
+  "hash": "sha256-jokekIuuQLx5UtuPs4XAI+euispeFCwSQByVKVelrC4=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
index 07b7b433cd5a..419cfe5c0ca4 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cmake.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
index a13d53821c8c..3b056e466f03 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-commonlisp.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
index b62ff93df2c3..ddee6bf64d8d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cpp.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-crystal.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-crystal.json
index eb5e7cb50ed3..0085e157c80f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-crystal.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-crystal.json
@@ -1,12 +1,14 @@
 {
   "url": "https://github.com/crystal-lang-tools/tree-sitter-crystal",
-  "rev": "cf69a6504a82fecc55ee1680983744a94a9edfaa",
-  "date": "2025-03-28T11:48:18-04:00",
-  "path": "/nix/store/c20hqk12him4k0675y3l5f53lfnaa37d-tree-sitter-crystal",
-  "sha256": "0jzmkjfhrz1f5pw274dj0f7avazsyhx0h6vbg4p5xxzkqch19wah",
-  "hash": "sha256-UPEUIMPz914ueWsbCDr0+qutjgOykSP4LS78DJ2c9Us=",
+  "rev": "f0ada43161f77d5bad18c4ce0b21d1dc9310e408",
+  "date": "2025-09-08T23:42:35-04:00",
+  "path": "/nix/store/q97l67605207fyavx1kdsnfylf49aj44-tree-sitter-crystal",
+  "sha256": "0j3xb6j67v4i4wdn14y1ac2004r71v4m0r01qfzhfv4cqwad3lz4",
+  "hash": "sha256-5NPRFMeMbAe/wwFkUMkOJxMABFPBk2AbJ5HsY6RZfUg=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
-  "leaveDotGit": false
+  "fetchTags": false,
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
index e9e4a52ddf0c..4054f5f8b63a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-css.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
index 36413eb77f40..753f05604b87 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cuda.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/thehamsta/tree-sitter-cuda",
-  "rev": "014628ae8d2df391b88ddb9fa0260fd97f770829",
-  "date": "2025-03-16T17:20:16+01:00",
-  "path": "/nix/store/w0cl4ga4bis992vyfmj8l0pq385z0cka-tree-sitter-cuda",
-  "sha256": "1qyh00rapch29czvnqs3364bx0bi4gyapfxb0v8m4r2m8kybnlff",
-  "hash": "sha256-zlG7/ERVZFLRBqu7q/wjcYG+iBlDY7s/SwKyqzIA0OM=",
+  "rev": "48b066f334f4cf2174e05a50218ce2ed98b6fd01",
+  "date": "2025-09-18T22:53:12+02:00",
+  "path": "/nix/store/01cw4243h6xyhg6nn8fgz7gjajkh0hjg-tree-sitter-cuda",
+  "sha256": "116fa26bjh6a88kdshqq5hp6fq4ik95dpaiidw8rn90xxwwl0zxi",
+  "hash": "sha256-sX9AOe8dJJsRbzGq20qakWBnLiwYQ90mQspAuYxQzoQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
index f98691b115b0..96ddd49800cf 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-cue.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
index d3424c21a17a..f65fae97f629 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dart.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
index 069c8263f262..fe826138a3e0 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-devicetree.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dockerfile.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dockerfile.json
index 045280a60371..def7d28b4a6b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dockerfile.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dockerfile.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
index 10d9408ec72d..96e220464cd5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-dot.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-earthfile.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-earthfile.json
index 945336f543ac..9117f8c0ae71 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-earthfile.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-earthfile.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-eex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-eex.json
index 799c8f70ca52..0e7efcc84c04 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-eex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-eex.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
index 0a784c3ab43b..b8eb1a40bfe2 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elisp.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
index ea4fd28a9576..5af61d399026 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elixir.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
index a0163c06c5fb..4ff1421304f5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-elm.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
index c60ca6e00877..6c6e366f9c6c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-embedded-template.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-embedded-template",
-  "rev": "332262529bc51abf5746317b2255ccc2fff778f8",
-  "date": "2024-11-11T01:51:07-05:00",
-  "path": "/nix/store/qfrdm02qnlllw3ric8pyv5gs0ahwnlbl-tree-sitter-embedded-template",
-  "sha256": "1vq9dywd9vcy59f6i5mk5n7vwk67g8j5x77czg7avpznskgfhqhb",
-  "hash": "sha256-C2Lo3tT2363O++ycXiR6x0y+jy2zlmhcKp7t1LhvCe8=",
+  "rev": "c70c1de07dedd532089c0c90835c8ed9fa694f5c",
+  "date": "2025-08-28T20:40:04-04:00",
+  "path": "/nix/store/l73zsvkpnrjpzncpwb4qcvhgqvx5zd35-tree-sitter-embedded-template",
+  "sha256": "0w1vkk1m2a52nqqx7agwcik7kbdb6bwpw18479inswqbgn51l54w",
+  "hash": "sha256-nBQain0Lc21jOgQFfvkyq615ZmT8qdMxtqIoUcOcO3A=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-erlang.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-erlang.json
index 72ac83411a6e..1aac15dac9f8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-erlang.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-erlang.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json
index 5d8bd9e2b65d..c7cde5b69b2d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-factor.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
index 5364cadfcc4c..bc474c396b55 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fennel.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/travonted/tree-sitter-fennel",
-  "rev": "15e4f8c417281768db17080c4447297f8ff5343a",
-  "date": "2024-02-02T09:37:06-05:00",
-  "path": "/nix/store/cjqnj1i2z7s3xwivba9vgpqrs0lcinil-tree-sitter-fennel",
-  "sha256": "059avw3yhadqbfallflc5xxfzla81d5mc9wrc3ag09xj5w6n1n05",
-  "hash": "sha256-BdhgDS+yJ/DUYJknVksLSNHvei+MOkqVW7gp6AffKhU=",
+  "rev": "36eb796a84b4f57bdf159d0a99267260d4960c89",
+  "date": "2025-09-06T23:17:11-04:00",
+  "path": "/nix/store/jz4l1j6yy6ly6pgjhmjrqq0lhab1gb8l-tree-sitter-fennel",
+  "sha256": "0pg76nby16i7wvvhc9n7ahbg4l4rlldzw7ggm8szlxx40lz16mv8",
+  "hash": "sha256-aFcTPgWkd/o1qu8d/hulmVDyFlTHJgb35iea4Jc1510=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
index 907447c4ab30..a6744378376d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-fish.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/ram02z/tree-sitter-fish",
-  "rev": "70640c0696abde32622afc43291a385681afbd32",
-  "date": "2025-01-18T10:06:56Z",
-  "path": "/nix/store/f3yngwj4xrr9v6nchnl9sj3q7bx2463y-tree-sitter-fish",
-  "sha256": "12gga8gm7dyfa6srvi5sympszy647qcw7a9warrld5z71vgziv3p",
-  "hash": "sha256-d+z43w7nl0ZzVjypwxk+xPivb/W6xJ21Uc63Ux9S74k=",
+  "rev": "aa074a0bacde8b5823c592574d7138f156a95776",
+  "date": "2025-06-13T20:17:14+01:00",
+  "path": "/nix/store/8z4vmmfhxbc529rkjs84aij12xa8ag1w-tree-sitter-fish",
+  "sha256": "1l8qmmligfcpf4amqghdv9c4nvs5wbhiifhl7016l7793rfzl235",
+  "hash": "sha256-ZQj6XR7pHGoCOBS6GOHiRW9LWNoNPlwVcZe5F2mtGNE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
index 5091a489397e..45f484e3fa86 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gdscript.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/prestonknopp/tree-sitter-gdscript",
-  "rev": "e964ce912b5b835f1caedb600df9d5be77e803a8",
-  "date": "2025-05-14T11:22:28-07:00",
-  "path": "/nix/store/ab2prhn6ckp7kyfnxnymx8zvbna4jda2-tree-sitter-gdscript",
-  "sha256": "19rdpyd05x29b7isv8jnc8jlawlpzh91b11yggiqgjz6il0vkdww",
-  "hash": "sha256-nLe5AY3my4fjez6EFRL8l3JFJWJWoq3jWUn0Apq/Lac=",
+  "rev": "c370d711dc9ead679d40bb7e9364ceed0b3bfc28",
+  "date": "2025-07-17T11:29:39-07:00",
+  "path": "/nix/store/yzmn7h0mqpphjnwmrnnrijz6dmhl2rmq-tree-sitter-gdscript",
+  "sha256": "0qma5ffmfwh81dk4wafz9qqkqw6pyk18bg20sg70v7s3r7m0bq2b",
+  "hash": "sha256-S+AF6slDnw3O00C8hcL013A8MU7fKU5mCwhyV50rqmI=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gemini.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gemini.json
index e63a56c69a16..f4206540b737 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gemini.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gemini.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
index 1f4c1e5ab620..c8455e82214d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gleam.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/gleam-lang/tree-sitter-gleam",
-  "rev": "6ece453acf8b14568c10f629f8cd25d3dde3794f",
-  "date": "2025-05-17T12:51:15Z",
-  "path": "/nix/store/aahaa06y7w5in76pfp787k5gyamx7599-tree-sitter-gleam",
-  "sha256": "00f481cjn1mz0319jq89775a81nlmqnkc6fvv3qblpiq37fplzcz",
-  "hash": "sha256-n3163Rk4Xrrw2NsZNi2u1AakyjkJYZnCAL8GK1lAxAE=",
+  "rev": "dae1551a9911b24f41d876c23f2ab05ece0a9d4c",
+  "date": "2025-07-21T17:56:49Z",
+  "path": "/nix/store/v0dwdaqlr17b6jry9ysd15m342ha8hxb-tree-sitter-gleam",
+  "sha256": "0d7z5bk6x0qi3wy4d8174a69wxsc4287c7fcdfabkn8dixpa920q",
+  "hash": "sha256-GIikbo8N2bmUa8wddpAgTHeejCInoEY8HxGDbuYq/zQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
index 83e5e7b9c1c4..2c04f80d2f1e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glimmer.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
index adb5bb72ba90..2263a37af864 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-glsl.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go-template.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go-template.json
index 4032f124945d..1ea8ff82bfa9 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go-template.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go-template.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/ngalaiko/tree-sitter-go-template",
-  "rev": "5f19a36bb1eebb30454e277b222b278ceafed0dd",
-  "date": "2025-01-29T18:19:22Z",
-  "path": "/nix/store/lcgn1hzzsf5jhliy7454lxx7phkmrjfb-tree-sitter-go-template",
-  "sha256": "1nm9ybwb4if6g7cs911i6msb3q2f1plbl70k2y4icbxk2p57k5ka",
-  "hash": "sha256-apZ5yhWzLxaJFxMcuugNTuCxdDUxhKTZecZFsvjyqdo=",
+  "rev": "65f4f86c3aaa9dabab36e3482584e8a111cf7db1",
+  "date": "2025-08-23T12:29:37Z",
+  "path": "/nix/store/f5palcms6bafi6yc77z2yqa3yhb0pbhz-tree-sitter-go-template",
+  "sha256": "1wf0fswkd1fd2f0x6xz2qqvr7sdyz3h93vac9z6jad41sqx4w9md",
+  "hash": "sha256-rSZOOtaBNCXNT0ztkeD4vumTN8bid9OBE82FNrl2wPE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
index db3cc5ace052..bff23a280218 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-go.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-go",
-  "rev": "3c3775faa968158a8b4ac190a7fda867fd5fb748",
-  "date": "2024-11-24T14:34:38-05:00",
-  "path": "/nix/store/zqi5mm5lx2jq40650gljdvn3sq0y34c1-tree-sitter-go",
-  "sha256": "0yi8if9mqzzcs4qflflz90hhaxkzlq54wia3s0iiqzfqxk24a61g",
-  "hash": "sha256-LxhFxOzYfRwj0ENFTgqmf3YFIUifOuow0ex/XJOLKHo=",
+  "rev": "1547678a9da59885853f5f5cc8a99cc203fa2e2c",
+  "date": "2025-08-29T02:17:40-04:00",
+  "path": "/nix/store/nb47mmxl1lwd2bgnv8w1m7zr04rpp326-tree-sitter-go",
+  "sha256": "0ag5cksnvrb8fg7b05pg1rq31sv6l8k985bk7qrzg91j7w8x7dnb",
+  "hash": "sha256-y7bTET8ypPczPnMVlCaiZuswcA7vFrDOc2jlbfVk5Sk=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-godot-resource.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-godot-resource.json
index dded3a02e446..cb0e4e446359 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-godot-resource.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-godot-resource.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
index fdb0a4efeb8c..e03e7b89f738 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gomod.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gowork.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gowork.json
index 92cff1e75067..4e5d2de4853c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gowork.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-gowork.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-graphql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-graphql.json
index 55c44102e945..f90c78ea33f1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-graphql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-graphql.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
index 15f39a70a440..a78b0c4fe7e1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-haskell.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-heex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-heex.json
index af406a845f16..9ac36a85bcb3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-heex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-heex.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-hjson.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-hjson.json
index e4c8d8263c4e..80b0b2a1f471 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-hjson.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-hjson.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
index 23a679566782..57e69ad93101 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-html.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
index 2e05e32a1b6d..66a8fdf28dfa 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-http.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
index 0687cb404e24..99fa73b63fb5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-janet-simple.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
index b7aed2572e37..adad6e67b406 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-java.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
index a0290d215193..964acc360643 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-javascript.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-javascript",
-  "rev": "3a837b6f3658ca3618f2022f8707e29739c91364",
-  "date": "2024-11-10T00:38:27-05:00",
-  "path": "/nix/store/hpvzw8l06lbvxsh0szkj44gshiqrjb02-tree-sitter-javascript",
-  "sha256": "03v1gpr5lnifrk4lns690fviid8p02wn7hfdwp3ynp7lh1cid63a",
-  "hash": "sha256-apgWWYD0XOvH5c3BY7kAF7UYtwPJaEvJzC5aWvJ9YQ8=",
+  "rev": "44c892e0be055ac465d5eeddae6d3e194424e7de",
+  "date": "2025-09-01T03:10:57-04:00",
+  "path": "/nix/store/l0h8gv70fj33dqcpkpclbv0khjgnhk8z-tree-sitter-javascript",
+  "sha256": "1qdjpfxw9z1icx3jc3k006yj76lcqydkvbk4ji3wk4xy854zz66q",
+  "hash": "sha256-2Jj/SUG+k8lHlGSuPZvHjJojvQFgDiZHZzH8xLu7suE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
index 5153927b22df..a3d1f78d20cd 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsdoc.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-jsdoc",
-  "rev": "b253abf68a73217b7a52c0ec254f4b6a7bb86665",
-  "date": "2024-11-11T01:54:33-05:00",
-  "path": "/nix/store/w2hks666pc8yb031ydclz0qn7k0qsfa1-tree-sitter-jsdoc",
-  "sha256": "0vpvy5hnnr9l4ggii6fp6svv35l659b3n13028dzq0b363dxng03",
-  "hash": "sha256-Azzb2zBjAfwbEmAEO1YqhpaxtzbXmRjfIzRla2Hx+24=",
+  "rev": "658d18dcdddb75c760363faa4963427a7c6b52db",
+  "date": "2025-09-13T00:24:14-04:00",
+  "path": "/nix/store/l7zh6vli87n3bj7cq9lnfklkcwsay1am-tree-sitter-jsdoc",
+  "sha256": "1qrgan1xpj717qmwdbgb3lqjgffyhsw0qxhjwhdhqfv2lgkw4cn6",
+  "hash": "sha256-xjLC56NiOwwb5BJ2DLiG3rknMR3rrcYrPuHI24NVL+M=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
index 10187c1f9699..ea3673775726 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
index 28f4996486d0..5c8bcfa51b89 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-json5.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/joakker/tree-sitter-json5",
-  "rev": "ab0ba8229d639ec4f3fa5f674c9133477f4b77bd",
-  "date": "2024-04-30T19:40:01-04:00",
-  "path": "/nix/store/3ag1lv1h8wg3cvbjbigyqmvqr0jy1i48-tree-sitter-json5",
-  "sha256": "0n33v04d5q79j1qp1l26ygfqywl7vxfam38dap78g6i7ys78581d",
-  "hash": "sha256-LaCCjvYnmofOVQ2Nqlzfh3KP3fNG0HBxkOng0gjYY1g=",
+  "rev": "8cb4114a4d7e5bab75d74466422e032de31d83df",
+  "date": "2025-09-20T19:19:04-03:00",
+  "path": "/nix/store/gmjjsjdj4xrkw89zq1asva5pdw455dnd-tree-sitter-json5",
+  "sha256": "0ckxr80dbzaxkasn9dldwcl0klkyxs8kiiqibk82y9mx8x2ymz21",
+  "hash": "sha256-QfzqRUe9Ji/QXBHHOJHuftIJKOONtmS1ml391QDKfTI=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsonnet.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsonnet.json
index a8bd511ad98b..5194ddd86da7 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsonnet.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-jsonnet.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
index 2d0e55210dca..c38a9d18fead 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-julia.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
index 961b173484ff..b84d6322d66f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-just.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kdl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kdl.json
index e218e748c0ad..78b834fb5824 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kdl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kdl.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-koka.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-koka.json
index ce53103c667c..7a61e28411f1 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-koka.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-koka.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/mtoohey31/tree-sitter-koka",
-  "rev": "33c333f7ff4cac4138c0786198481b33d2880656",
-  "date": "2025-01-26T11:30:06-05:00",
-  "path": "/nix/store/dh0v9y2qc9dz8lqqpspnwbxvpikfjzpv-tree-sitter-koka",
-  "sha256": "12vr8xdsy8gpgwzcnvc2p5mzd4fsgv0lgqdwmzhs1b9hy7bvdkd6",
-  "hash": "sha256-ps221/EwraDhr7zhR8F+2pH2a7mCbcs+f/chr1tHeYs=",
+  "rev": "6dce132911ac375ac1a3591c868c47a2a84b30aa",
+  "date": "2025-07-26T15:26:41-04:00",
+  "path": "/nix/store/xvk32hz6j2yidxq4sj78phs4i1mqlwv8-tree-sitter-koka",
+  "sha256": "1l50l8m3ql2j6q772pgb8x3v1awvng12fd9rpv6p3cva1mg9ywj1",
+  "hash": "sha256-QXKfXg1qs3HNvjk1J8Kzm6uwR0frXXEONlJQPCqioNA=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
index 8b67459fe23d..304b38c8f162 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-kotlin.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
index 810b0acc9964..87bac66f83d0 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-latex.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/latex-lsp/tree-sitter-latex",
-  "rev": "a834712c5e04029a451a262456bf6290b8ef6f37",
-  "date": "2024-04-01T14:31:04+02:00",
-  "path": "/nix/store/kn3vkfnysm170wc1dbjmb5y69hdlmyb4-tree-sitter-latex",
-  "sha256": "18dyda7299imb6i2jnjpr7z2jdrjn804c3958nkkpxzzfhbq39h7",
-  "hash": "sha256-B6aBF3T/9zunRSUNRgCyMjcp/slXWimiWTWmJI5qvqE=",
+  "rev": "7e0ecdc02926c7b9b2e0c76003d4fe7b0944f957",
+  "date": "2025-09-19T09:03:38+02:00",
+  "path": "/nix/store/jn7pw9992kbriq3z7nv27jh9yknqjsfq-tree-sitter-latex",
+  "sha256": "0sxxydq0lmfybvwfkzkvy5mp8hyqmadpl6pqxwqb5h6s44wnkgcx",
+  "hash": "sha256-nb1pOSHawLIw7/gaepuq2EN0a/F7/un4Xt5VCnDzvWs=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ledger.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ledger.json
index 24ea0a0a6df7..840281cc9ac5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ledger.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ledger.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
index 6b29c432c482..443c60090119 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-lua.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-make.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-make.json
index 5fa65cec3ea8..46a604c4a472 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-make.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-make.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-netlinx.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-netlinx.json
index fc5819800286..c9793de08e6c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-netlinx.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-netlinx.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
index 13d0c4d6e287..4e96fa190a1e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nickel.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
index 3db68fc6a0a6..7c69366c118c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/nix-community/tree-sitter-nix",
-  "rev": "ea1d87f7996be1329ef6555dcacfa63a69bd55c6",
-  "date": "2025-07-18T19:46:47+02:00",
-  "path": "/nix/store/mvq8m0v2cr2xns4807cby54h3wc7xjxr-tree-sitter-nix",
-  "sha256": "1aaq5yv1s8qq3abm0jm884hi4k6n2w0nzd1j3wizv1x1xk6qzlsl",
-  "hash": "sha256-VNOPzeyhh/0jHzK0bwEX1kwSIUGoSlCXGhgjHbYvWKk=",
+  "rev": "ff4e2b4c5a3598e8be3edf16bc69f6677af32145",
+  "date": "2025-08-11T14:30:35Z",
+  "path": "/nix/store/pv5yjrasf1k8pigwl0gnvbm7bwsg205q-tree-sitter-nix",
+  "sha256": "0bv38na2i53229lzkndbvchfgg8gmwdgpcw1ajq9rcqar8m1gyal",
+  "hash": "sha256-VPkXKsoKs5ywVIGz+xqvD73nINur2flpEmKUKJRFYy8=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
index 93a878458f14..6c96638394e3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg-meta.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
index b81123a662d8..d4cb96ea314e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-norg.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
index a455eaf1e630..b07ea1915d63 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nu.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/nushell/tree-sitter-nu",
-  "rev": "100d06e29d13a8ebfc3f29173c07a5c4f2050586",
-  "date": "2025-06-03T11:43:38Z",
-  "path": "/nix/store/3a41rx3rs29c625ywqv0pw7s7am4gwn5-tree-sitter-nu",
-  "sha256": "07aa73flw0z56fqgqv4y7xyf0akh50ydavjyzyczwc7hyl15mak4",
-  "hash": "sha256-ZKpaAvXwMP6Z/15u1TwocCrgfD+ebPywM+UDTt04Sh0=",
+  "rev": "0e6c59c46db3c246eaf86ce5b325da1247e971a5",
+  "date": "2025-09-19T12:13:52-05:00",
+  "path": "/nix/store/hzys3qbx0162dma003g6n4wzl5j8b4d1-tree-sitter-nu",
+  "sha256": "1l6l4s6w5dc1yrdwz9k1l4xzdzbkch8q4fr69461piibsd6r0qm8",
+  "hash": "sha256-qGKQTdMrxhsMSSY7ghFkc/32O6Fhps9b9oG1wo0m1NA=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
index a7d178462936..fe29aa1e29cc 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ocaml.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org-nvim.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org-nvim.json
index 0dba72be49a3..792216e7f848 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org-nvim.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-org-nvim.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
index 35b384620faf..cdaf509a9ca8 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-perl.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pgn.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pgn.json
index 7255f39b0e4a..56a78fac161a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pgn.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pgn.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/rolandwalker/tree-sitter-pgn",
-  "rev": "f86a119d21d01f6bf0dcd3247a366554e98dbbe5",
-  "date": "2024-09-14T21:47:45Z",
-  "path": "/nix/store/09rxvhnmdq63n4ghk00ngbdgnmqqs1k4-tree-sitter-pgn",
-  "sha256": "1ahl979ika0pyq4glz6am71hq6y360hcmwhxikn2l2gl8415701k",
-  "hash": "sha256-M4BTAkH0CSrsjB3yyiAwwxsMw6nKfPoI9heoGdNJFKo=",
+  "rev": "c5de0ccc528e1c36d354c00df422ed39fc582073",
+  "date": "2025-07-29T11:58:18-04:00",
+  "path": "/nix/store/laqz0v4pk90hqiy6apbxjf2lhbrf9n2h-tree-sitter-pgn",
+  "sha256": "0mazy9y80pd20a3a76b0nfxswh7xxdsnya0y0lzl86sh4w95f52p",
+  "hash": "sha256-VxRXEidQG0Q/BR4ob3Xr/UCuu7NgmaOGAqJdgHzyX1U=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
index c64e2aedce34..86b2f91a6705 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-php.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-php",
-  "rev": "f7cf7348737d8cff1b13407a0bfedce02ee7b046",
-  "date": "2025-02-27T03:54:39-06:00",
-  "path": "/nix/store/6hwqa10mfcs32cqq5ab48c444yihm106-tree-sitter-php",
-  "sha256": "05qhz14vvqgwpxgdfr1skwgrv041zwc3wxjyx6y679965nn0lrji",
-  "hash": "sha256-UWYKrC0mpWO86V52Phj/gYCdH586ZNdev/zhvUn4EBc=",
+  "rev": "5b5627faaa290d89eb3d01b9bf47c3bb9e797dea",
+  "date": "2025-08-18T00:11:55-05:00",
+  "path": "/nix/store/sxyqch4xwnm2a1g5r7h9drp4x9bszzi8-tree-sitter-php",
+  "sha256": "1zf98g6zn29xci37scp3bmjl9dynhf3272aaqm6znjq7rb6z53lc",
+  "hash": "sha256-jI7yzcoHS/tNxUqJI4aD1rdEZV3jMn1GZD0J+81Dyf0=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pioasm.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pioasm.json
index f9e43499a03a..040c110a9b17 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pioasm.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pioasm.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-prisma.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-prisma.json
index bbdf72a731cc..e5229a3327c3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-prisma.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-prisma.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-proto.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-proto.json
index 7d14348180b8..98175e48e9d3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-proto.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-proto.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pug.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pug.json
index e69c0abcd1c3..eccf11601570 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pug.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-pug.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
index 208f595116b1..91102dc7402b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-python.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-python",
-  "rev": "bffb65a8cfe4e46290331dfef0dbf0ef3679de11",
-  "date": "2024-12-22T18:06:13-05:00",
-  "path": "/nix/store/qr60c80rwd98hzbhlsfjbk0fninvbjr4-tree-sitter-python",
-  "sha256": "0a108sfqcsxrp54lapk7k3kq6fmz8745z5q99wpn3i1cqpi9slzg",
-  "hash": "sha256-71Od4sUsxGEvTwmXX8hBvzqD55hnXkVJublrhp1GICg=",
+  "rev": "293fdc02038ee2bf0e2e206711b69c90ac0d413f",
+  "date": "2025-09-11T02:45:17-04:00",
+  "path": "/nix/store/zka1fqm6l03k2z4ghiffkcisvcw96d5m-tree-sitter-python",
+  "sha256": "05kk1wlm5fgpgwqxw3m68sipkinw0gf2jq19cgq9cgp3agdwg58p",
+  "hash": "sha256-F5XH21PjPpbwYylgKdwD3MZ5o0amDt4xf/e5UikPcxY=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql-dbscheme.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql-dbscheme.json
index 68fa4bd7f0da..6a433a1b517f 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql-dbscheme.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql-dbscheme.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
index f00559186659..2741011aa215 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ql.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-r.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-r.json
index f7dda61658e5..76b2d4f83d4a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-r.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-r.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/r-lib/tree-sitter-r",
-  "rev": "ac939363ced63a5fd39a8bd5e7891bbe06b5738d",
-  "date": "2024-09-06T16:53:09-04:00",
-  "path": "/nix/store/qj9nyda5grkjqkh23m9a3q3sgkmkgcdh-tree-sitter-r",
-  "sha256": "1jf14nvrfcznsnmxmlkbnn59bdykpsawxm5grph65p8vghi4fik7",
-  "hash": "sha256-Z0ZHInwb3WLgza/UzpW+07eVirVr0tqr1fYzl7clwck=",
+  "rev": "e9944e9801595ad484f49be492daf0c4c81547ef",
+  "date": "2025-06-05T15:17:25-04:00",
+  "path": "/nix/store/qdqwb87naqr211y5zps16abnv97a3430-tree-sitter-r",
+  "sha256": "15g5bkndhqv8vbiakl1vvsarl4kcqz3k9fc9hgnn899ghla8nh2a",
+  "hash": "sha256-SkCLFIUvJWTtg4m5NMfHbBKald470Kni2mhj2Oxc5ZU=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
index 0ddb5f97a963..27aca2758514 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-regex.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-regex",
-  "rev": "4470c59041416e8a2a9fa343595ca28ed91f38b8",
-  "date": "2024-11-11T00:48:15-05:00",
-  "path": "/nix/store/2iwwqdj0zjxxqqc6aw2hwqi55aczbf5x-tree-sitter-regex",
-  "sha256": "098pkjicnw3a8bypb7f2xqwhqjlfvicibcmgx5nsb0icdyvagm8q",
-  "hash": "sha256-GNWntm8sgqVt6a+yFVncjkoMOe7CnXX9Qmpwy6KcFyU=",
+  "rev": "b2ac15e27fce703d2f37a79ccd94a5c0cbe9720b",
+  "date": "2025-09-13T00:57:50-04:00",
+  "path": "/nix/store/wx4xlyvffsgkvjy88r955f5lrps9r1iz-tree-sitter-regex",
+  "sha256": "0nhn94skvac3wid2xbxa456m1mgbi7h768imq280pxbm4klhl7bd",
+  "hash": "sha256-bR0K6SR19QuQwDUic+CJ69VQTSGqry5a5IOpPTVJFlo=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
index 962eac562dad..df313c6d6f4c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rego.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-river.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-river.json
index d58e72454870..87bf364f26d7 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-river.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-river.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
index c2db9a7aedcc..bf815e548d2a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-rst.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
index 6f6d6eb72802..b39f33c3a159 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-ruby.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
index c4e47bf15191..1b06a4e99317 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scala.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/tree-sitter/tree-sitter-scala",
-  "rev": "d3b9553b47d7ab413a146c4b6498e527265b966e",
-  "date": "2024-12-26T23:42:00-05:00",
-  "path": "/nix/store/qzbrl51l89izishri72bjc59al88dy0a-tree-sitter-scala",
-  "sha256": "02awiraj5mmgyi31yzxyxarkkl41qksm3lm41pq9c6bmyqpir2y6",
-  "hash": "sha256-xoscL/Z1GZbwDaTSUfXEgdA5s+q+fx9G9K/WIlWOXAk=",
+  "rev": "2d55e74b0485fe05058ffe5e8155506c9710c767",
+  "date": "2025-06-08T14:05:03-04:00",
+  "path": "/nix/store/0ns5c1i34vlyrbvyajclw5dc0qyqmx0c-tree-sitter-scala",
+  "sha256": "16674bmcwp0r8y9xgfc0n5jmgk9bb0975kcqhkg1pnprjs7b6kv4",
+  "hash": "sha256-ZE+zjpb52hvehJjNchJYK81XZbGAudeTRxlczuoix5g=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
index d03302900db6..c85551d0a92b 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scheme.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/6cdh/tree-sitter-scheme",
-  "rev": "e35b41a183164f4a12e10da3d0c430e837c3d75a",
-  "date": "2025-05-25T19:18:44+08:00",
-  "path": "/nix/store/lg0zvr4w9pryyz725vd5hdf7gvg7idx1-tree-sitter-scheme",
-  "sha256": "12dclaaj4snar68hcwfc1kmnbww4ykf1ab2q81r3k9989m7f1ckn",
-  "hash": "sha256-drLgTk0opTlyQFgsFdz0hPNl6wzMcQaRycpqIpWirIk=",
+  "rev": "67b5c8d6ce19fd5265f13204fec0a3efa9e095d9",
+  "date": "2025-09-17T19:40:43+08:00",
+  "path": "/nix/store/019pq24f1wpqi9n9z5h3ih4w83am5sp4-tree-sitter-scheme",
+  "sha256": "12z3grdc92cvdvkcbk981nn976fscmdbc4fhrsrq2q0h03wfqcwy",
+  "hash": "sha256-njPs+AAQYIGzztARtlpl2pmTrA0ozcXmbpuJxFp+44s=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scss.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scss.json
index f25d2196fb47..512d80fbbb50 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scss.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-scss.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-smithy.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-smithy.json
index f63a144843fd..787003e93392 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-smithy.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-smithy.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
index 80e7839df85f..b0e2dea9eacb 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-solidity.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sparql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sparql.json
index a4d4f7bfe956..b9ad674d5f66 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sparql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sparql.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
index 9c3c7898b0cf..10de150ee9a7 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-sql.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/derekstride/tree-sitter-sql",
-  "rev": "8a4578bd200fd1ed73e8cbecbe3c5053a4bcf2f8",
-  "date": "2025-02-13T11:02:24-05:00",
-  "path": "/nix/store/jd7y0qspfvy7sc01i7awjwkr8dl3cnj0-tree-sitter-sql",
-  "sha256": "0cp0iaryxmshqdc4x8xg98ck096bqpk1xjg34dycbvkw7mpmn1zj",
-  "hash": "sha256-8gdbbz187sV8I+PJHubFyyQwGUqvo05Yw1DX7rOK4DI=",
+  "rev": "64d6707541898bf17a306033050b1932524e215f",
+  "date": "2025-09-23T13:22:41-04:00",
+  "path": "/nix/store/hgby3annavhkca58d82ixd1i0dgb4a3g-tree-sitter-sql",
+  "sha256": "0qv5pyz7yzy8bnvs8sc1wdp6wgl1wq4imynzwsihjg8yrxkdqbhc",
+  "hash": "sha256-DC7cZs8ePQmj5t/6GgnmgT5ubuOBaaS3Xch/f76/ZWM=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-supercollider.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-supercollider.json
index 7f47d64fd963..646b61115996 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-supercollider.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-supercollider.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/madskjeldgaard/tree-sitter-supercollider",
-  "rev": "1a8ee0da9a4f2df5a8a22f4d637ac863623a78a7",
-  "date": "2024-09-21T12:39:28+02:00",
-  "path": "/nix/store/c94cwr855ai3b48ajw7nkxgrk6bs2n88-tree-sitter-supercollider",
-  "sha256": "051m7anq0w14qaj271x5ic4ilamrijx5f8np2g8kpgbkxmjc0v8v",
-  "hash": "sha256-G23AZO1zvTvRE9ciV7qMuSoaCYulhyOkwiRwgK06NRQ=",
+  "rev": "76b3cab1773f08bb7d3a185420b0a44c6da8c294",
+  "date": "2025-09-17T20:52:30+02:00",
+  "path": "/nix/store/hmc2f1w3xzdhas9gf0m6yz9bbp6ivpqa-tree-sitter-supercollider",
+  "sha256": "1lb8fbx0hhd6lmhjvszm96hrd802mgq6phj4977ag6qdi15zbfbn",
+  "hash": "sha256-drn1S4gNm6fOSUTCa/CrAqCWoUn16y1hpaZBCPpyaNE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-surface.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-surface.json
index 4e693c88f96c..9e8861cc1f7d 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-surface.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-surface.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
index d7e1dce60b16..46825eab17b4 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-svelte.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-talon.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-talon.json
index 967abcd46f39..826b26d04e41 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-talon.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-talon.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
index 634c62d4e732..6ac7d582118c 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-templ.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/vrischmann/tree-sitter-templ",
-  "rev": "de35706f89beed5087670a9c4421b7794ef02411",
-  "date": "2025-06-01T21:02:54+02:00",
-  "path": "/nix/store/9m1jydr3j1m876dmazg9kzvs7878a7ly-tree-sitter-templ",
-  "sha256": "0vbhks5879b7bpygxr9zba142zsb760j4im1gzbgcl6yj6q59j30",
-  "hash": "sha256-YMhUsJHeUPbWf6FGIoE5S39Bglo/5f78XWelg4qecG0=",
+  "rev": "27a1fc62c8dd4c49669e03629491f66449c6c435",
+  "date": "2025-09-14T18:21:44+02:00",
+  "path": "/nix/store/zvhrnj22cjvykp2xpgs3dill5mb2p13x-tree-sitter-templ",
+  "sha256": "1lwvyvvdkyy2anckz284fqkl5w26v6ppdwm8ajfkkdbf1cyls7fs",
+  "hash": "sha256-2h1NPQtutTmdVKjydq/ZRvBCJ3YEiT+ZVcL72fb2m9M=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tera.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tera.json
index eaa3810597b8..35a64f282e31 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tera.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tera.json
@@ -1,13 +1,14 @@
 {
   "url": "https://github.com/uncenter/tree-sitter-tera",
-  "rev": "d006172998fa8b81f96b0f2fc7fa2bf25207c46b",
-  "date": "2025-04-16T08:51:56-04:00",
-  "path": "/nix/store/364masbjrvf29v30h4hbzwds1j438k7a-tree-sitter-tera",
-  "sha256": "0cwihdzlm8jk8g006j234pjnw0apv3l8ixn4kmdc60hzh3bb9ypr",
-  "hash": "sha256-+fq01oAfAsNancT2iOjYVwFu5SVDSAPAQ1OiSn+DkTM=",
+  "rev": "692937d52c8dfd91ce0dde722b9b4febbc9bc712",
+  "date": "2025-07-22T07:31:49-04:00",
+  "path": "/nix/store/yk1s71npnbz0vvfkpl4q6gs26xbcfjh3-tree-sitter-tera",
+  "sha256": "0zqkxiybrqrkj55cnpp5xbpw82c99zr752qb4wk7yj159yp1m5fx",
+  "hash": "sha256-3ZUark8lSH8mJwuLcvJPiQnE7+rlXstKkTPjvHzsE38=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tiger.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tiger.json
index f8c71de32cc2..624aeb633dd3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tiger.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tiger.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
index 31f805c26b87..d37e5a6b9f41 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tlaplus.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-toml.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-toml.json
index 46c62e91c5ae..9e9bc79672da 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-toml.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-toml.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
index b38bdb4efa69..7076b788e36a 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-tsq.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-turtle.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-turtle.json
index cf7e1a6389c6..48be60fc7096 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-turtle.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-turtle.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-twig.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-twig.json
index d832cc784436..8bfe5d5eeafc 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-twig.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-twig.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
index 1dedf08f9884..d0a0ed3fcea5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typescript.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
index ff9c3b0644a2..5ad8f460b6db 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
index a6e730e442ed..1af3e2b44c60 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-uiua.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
index ee51cfb86568..e2327dcd4a51 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-verilog.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
index fced9927e7c0..28989fd89ea5 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vim.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vue.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vue.json
index e54a956a0316..4241e897b642 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vue.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-vue.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wgsl.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wgsl.json
index 5aaece48adf5..e01d33e4fc00 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wgsl.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wgsl.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
index 55c6653c18da..f0ad17112a21 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-wing.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yang.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yang.json
index e9f5b2ba1e62..82e6259a3fe3 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yang.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-yang.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
index 8363525841c7..52cd35bef573 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-zig.json
@@ -9,5 +9,6 @@
   "fetchSubmodules": false,
   "deepClone": false,
   "fetchTags": false,
-  "leaveDotGit": false
+  "leaveDotGit": false,
+  "rootDir": ""
 }
diff --git a/pkgs/development/tools/rust/bindgen/unwrapped.nix b/pkgs/development/tools/rust/bindgen/unwrapped.nix
index 39b4de40b83b..c78eeb55be78 100644
--- a/pkgs/development/tools/rust/bindgen/unwrapped.nix
+++ b/pkgs/development/tools/rust/bindgen/unwrapped.nix
@@ -11,15 +11,15 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rust-bindgen-unwrapped";
-  version = "0.72.0";
+  version = "0.72.1";
 
   src = fetchCrate {
     pname = "bindgen-cli";
     inherit version;
-    hash = "sha256-0hIxXKq7zu/gq0QAs2Ffuq584a9w1RWctPs9SBfc0/I=";
+    hash = "sha256-rhdQZcnlqVSUqvFDg0Scs1+DHGcKyazeS5H9HH7u8Fk=";
   };
 
-  cargoHash = "sha256-K/iM79RfNU+3f2ae6wy/FMFAD68vfqzSUebqALPJpJY=";
+  cargoHash = "sha256-YNpqVB+zdZ76Av2L+yQuBrxKvNML9+3H7ES4+7mED0E=";
 
   preConfigure = ''
     export LIBCLANG_PATH="${lib.getLib clang.cc}/lib"
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index fad46782599c..208ded114973 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -380,6 +380,10 @@ let
               "test-runner-run"
               "test-runner-watch-mode"
               "test-watch-mode-files_watcher"
+
+              # fail on openssl 3.6.0
+              "test-http2-server-unknown-protocol"
+              "test-tls-ocsp-callback"
             ]
             ++ lib.optionals (!lib.versionAtLeast version "22") [
               "test-tls-multi-key"
@@ -420,6 +424,12 @@ let
             ]
             # Those are annoyingly flaky, but not enough to be marked as such upstream.
             ++ lib.optional (majorVersion == "22") "test-child-process-stdout-flush-exit"
+            ++ lib.optionals (majorVersion == "22" && stdenv.buildPlatform.isDarwin) [
+              "test-cluster-dgram-1"
+              "test/sequential/test-http-server-request-timeouts-mixed.js"
+            ]
+            # This is failing on newer macOS versions, no fix has yet been provided upstream:
+            ++ lib.optional (majorVersion == "24" && stdenv.buildPlatform.isDarwin) "test-cluster-dgram-1"
           )
         }"
       ];
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 0a794f6e3e41..182103df4262 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -15,12 +15,16 @@ let
     python = python3;
   };
 
-  gypPatches = if stdenv.buildPlatform.isDarwin then callPackage ./gyp-patches.nix { } else [ ];
+  gypPatches =
+    if stdenv.buildPlatform.isDarwin then
+      callPackage ./gyp-patches.nix { patch_tools = false; }
+    else
+      [ ];
 in
 buildNodejs {
   inherit enableNpm;
-  version = "22.19.0";
-  sha256 = "0272acfce50ce9ad060288321b1092719a7f19966f81419835410c59c09daa46";
+  version = "22.20.0";
+  sha256 = "ff7a6a6e8a1312af5875e40058351c4f890d28ab64c32f12b2cc199afa22002d";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -53,11 +57,5 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
-
-      # TODO: remove when included in a release
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/499a5c345165f0d4a94b98d08f1ace7268781564.patch?full_index=1";
-        hash = "sha256-wF4+CytC1OB5egJGOfLm1USsYY12f9kADymVrxotezE=";
-      })
     ];
 }
diff --git a/pkgs/games/dwarf-fortress/df.lock.json b/pkgs/games/dwarf-fortress/df.lock.json
index 4e4c5f3e8bc8..f27b80fea6c5 100644
--- a/pkgs/games/dwarf-fortress/df.lock.json
+++ b/pkgs/games/dwarf-fortress/df.lock.json
@@ -1,28 +1,28 @@
 {
   "game": {
     "latest": {
-      "linux": "52.04",
+      "linux": "52.05",
       "darwin": "0.47.05"
     },
     "versions": {
-      "52.04": {
+      "52.05": {
         "df": {
-          "version": "52.04",
+          "version": "52.05",
           "urls": {
             "linux": {
-              "url": "https://www.bay12games.com/dwarves/df_52_04_linux.tar.bz2",
-              "outputHash": "sha256-x/v4yWuojnbea0N7KUAINBdhPBjl0DoWy8Pi/eDCpec="
+              "url": "https://www.bay12games.com/dwarves/df_52_05_linux.tar.bz2",
+              "outputHash": "sha256-LPbkt9s/Lx/0tvN5bac6d0r7+nr4P+u3xmDNo+EXHkw="
             }
           }
         },
         "hack": {
-          "version": "52.04-r1",
+          "version": "52.05-r2",
           "git": {
             "url": "https://github.com/DFHack/dfhack.git",
-            "revision": "52.04-r1",
-            "outputHash": "sha256-DPW+fvurUYnwfGrEqV3JEN1TfllOJPHqGIlNJ3Wha90="
+            "revision": "52.05-r2",
+            "outputHash": "sha256-wv/4sRAIkb90uStGJ6eMdd/cAMVX5Uqtoe0BR+CDy7s="
           },
-          "xmlRev": "7b691d256f9427036e7ff24fa795a0f9334739e7"
+          "xmlRev": "df0ec27701a2aeaa1ccfb81323f4be55b78e1c10"
         }
       },
       "51.13": {
@@ -116,12 +116,12 @@
     }
   },
   "therapist": {
-    "version": "42.1.18",
-    "maxDfVersion": "52.03",
+    "version": "42.1.20",
+    "maxDfVersion": "52.05",
     "git": {
       "url": "https://github.com/Dwarf-Therapist/Dwarf-Therapist.git",
-      "revision": "v42.1.18",
-      "outputHash": "sha256-RdBUpVkjvsNjTowHpQ2FQUCtJiwfqls4dnoUIwKoXGg="
+      "revision": "v42.1.20",
+      "outputHash": "sha256-nKMQSDrxhqRRaCDUK7GbexFHdxeD/P9c2UDkiMdWsyU="
     }
   }
 }
diff --git a/pkgs/kde/frameworks/kio/default.nix b/pkgs/kde/frameworks/kio/default.nix
index 3e6e6ab0ec74..f2ee6fb684e3 100644
--- a/pkgs/kde/frameworks/kio/default.nix
+++ b/pkgs/kde/frameworks/kio/default.nix
@@ -2,6 +2,7 @@
   mkKdeDerivation,
   qt5compat,
   qttools,
+  kauth,
   acl,
   attr,
 }:
@@ -16,6 +17,7 @@ mkKdeDerivation {
   extraBuildInputs = [
     qt5compat
     qttools
+    kauth
     acl
     attr
   ];
diff --git a/pkgs/kde/frameworks/kwallet/default.nix b/pkgs/kde/frameworks/kwallet/default.nix
index 3ba43cd40e3e..6f78a1b9d4fe 100644
--- a/pkgs/kde/frameworks/kwallet/default.nix
+++ b/pkgs/kde/frameworks/kwallet/default.nix
@@ -1,6 +1,7 @@
 {
   mkKdeDerivation,
   pkg-config,
+  gpgme,
   libgcrypt,
   libsecret,
   kdoctools,
@@ -13,6 +14,7 @@ mkKdeDerivation {
   ];
 
   extraBuildInputs = [
+    gpgme
     libgcrypt
     libsecret
     kdoctools
diff --git a/pkgs/kde/gear/kdeconnect-kde/default.nix b/pkgs/kde/gear/kdeconnect-kde/default.nix
index d81c487e452f..a9c95f7b6fb5 100644
--- a/pkgs/kde/gear/kdeconnect-kde/default.nix
+++ b/pkgs/kde/gear/kdeconnect-kde/default.nix
@@ -3,9 +3,9 @@
   mkKdeDerivation,
   replaceVars,
   sshfs,
+  qtbase,
   qtconnectivity,
   qtmultimedia,
-  qtwayland,
   pkg-config,
   wayland,
   wayland-protocols,
@@ -30,13 +30,12 @@ mkKdeDerivation {
   extraBuildInputs = [
     qtconnectivity
     qtmultimedia
-    qtwayland
     wayland
     wayland-protocols
     libfakekey
   ];
 
   extraCmakeFlags = [
-    "-DQtWaylandScanner_EXECUTABLE=${qtwayland}/libexec/qtwaylandscanner"
+    "-DQtWaylandScanner_EXECUTABLE=${qtbase}/libexec/qtwaylandscanner"
   ];
 }
diff --git a/pkgs/kde/gear/kdenetwork-filesharing/default.nix b/pkgs/kde/gear/kdenetwork-filesharing/default.nix
index 597cb8cc80de..b72f4af7b955 100644
--- a/pkgs/kde/gear/kdenetwork-filesharing/default.nix
+++ b/pkgs/kde/gear/kdenetwork-filesharing/default.nix
@@ -2,9 +2,10 @@
   lib,
   mkKdeDerivation,
   replaceVars,
+  qtdeclarative,
+  kauth,
   samba,
   shadow,
-  qtdeclarative,
 }:
 mkKdeDerivation {
   pname = "kdenetwork-filesharing";
@@ -19,7 +20,10 @@ mkKdeDerivation {
     ./samba-hint.patch
   ];
 
-  extraBuildInputs = [ qtdeclarative ];
+  extraBuildInputs = [
+    qtdeclarative
+    kauth
+  ];
 
   # We can't actually install samba via PackageKit, so let's not confuse users any more than we have to
   extraCmakeFlags = [ "-DSAMBA_INSTALL=OFF" ];
diff --git a/pkgs/kde/gear/kontrast/default.nix b/pkgs/kde/gear/kontrast/default.nix
index 6d3ef5d3adb9..4ef2889cc1a0 100644
--- a/pkgs/kde/gear/kontrast/default.nix
+++ b/pkgs/kde/gear/kontrast/default.nix
@@ -1,14 +1,12 @@
 {
   mkKdeDerivation,
   qtsvg,
-  qcoro,
 }:
 mkKdeDerivation {
   pname = "kontrast";
 
   extraBuildInputs = [
     qtsvg
-    qcoro
   ];
   meta.mainProgram = "kontrast";
 }
diff --git a/pkgs/kde/gear/krfb/default.nix b/pkgs/kde/gear/krfb/default.nix
index 808067fb0000..d2be34808082 100644
--- a/pkgs/kde/gear/krfb/default.nix
+++ b/pkgs/kde/gear/krfb/default.nix
@@ -1,7 +1,7 @@
 {
   mkKdeDerivation,
   pkg-config,
-  qtwayland,
+  qtbase,
   libvncserver,
   pipewire,
   xorg,
@@ -10,12 +10,11 @@ mkKdeDerivation {
   pname = "krfb";
 
   extraCmakeFlags = [
-    "-DQtWaylandScanner_EXECUTABLE=${qtwayland}/libexec/qtwaylandscanner"
+    "-DQtWaylandScanner_EXECUTABLE=${qtbase}/libexec/qtwaylandscanner"
   ];
 
   extraNativeBuildInputs = [ pkg-config ];
   extraBuildInputs = [
-    qtwayland
     libvncserver
     pipewire
     xorg.libXdamage
diff --git a/pkgs/kde/gear/okular/default.nix b/pkgs/kde/gear/okular/default.nix
index b6048d9611d4..d55b5cd4bb0b 100644
--- a/pkgs/kde/gear/okular/default.nix
+++ b/pkgs/kde/gear/okular/default.nix
@@ -3,6 +3,7 @@
   pkg-config,
   qtspeech,
   qtsvg,
+  plasma-activities,
   poppler,
   libtiff,
   libspectre,
@@ -19,6 +20,8 @@ mkKdeDerivation {
     qtspeech
     qtsvg
 
+    plasma-activities
+
     poppler
     libtiff
     libspectre
diff --git a/pkgs/kde/generated/dependencies.json b/pkgs/kde/generated/dependencies.json
index 58f03bb030f1..bf2aada9b34b 100644
--- a/pkgs/kde/generated/dependencies.json
+++ b/pkgs/kde/generated/dependencies.json
@@ -18,6 +18,8 @@
       "kcrash",
       "ki18n",
       "kiconthemes",
+      "kirigami",
+      "kirigami-addons",
       "kitemmodels",
       "kwidgetsaddons",
       "kwindowsystem",
@@ -366,6 +368,7 @@
       "extra-cmake-modules",
       "karchive",
       "kcmutils",
+      "kcolorscheme",
       "kcompletion",
       "kconfig",
       "kconfigwidgets",
@@ -379,14 +382,14 @@
       "ki18n",
       "kiconthemes",
       "kio",
+      "kjobwidgets",
       "knotifications",
       "kparts",
       "kservice",
       "ktextwidgets",
       "kwidgetsaddons",
       "kwindowsystem",
-      "kxmlgui",
-      "phonon"
+      "kxmlgui"
     ],
     "blinken": [
       "extra-cmake-modules",
@@ -570,6 +573,9 @@
     ],
     "cervisia": [
       "extra-cmake-modules",
+      "kcompletion",
+      "kcoreaddons",
+      "kdbusaddons",
       "kdesu",
       "kdoctools",
       "ki18n",
@@ -949,6 +955,13 @@
       "wayland",
       "wayland-protocols"
     ],
+    "hana": [
+      "extra-cmake-modules",
+      "kconfig",
+      "ki18n",
+      "kio",
+      "kirigami"
+    ],
     "haruna": [
       "extra-cmake-modules",
       "kconfig",
@@ -971,6 +984,7 @@
       "kdbusaddons",
       "ki18n",
       "kirigami",
+      "kirigami-addons",
       "kwindowsystem",
       "libkleo",
       "qqc2-desktop-style"
@@ -1077,6 +1091,7 @@
     "k3b": [
       "extra-cmake-modules",
       "karchive",
+      "kauth",
       "kcmutils",
       "kconfig",
       "kcoreaddons",
@@ -1128,7 +1143,6 @@
       "kio",
       "kservice",
       "kwidgetsaddons",
-      "kwindowsystem",
       "kxmlgui"
     ],
     "kaddressbook": [
@@ -1158,7 +1172,6 @@
     ],
     "kaichat": [
       "extra-cmake-modules",
-      "kcompletion",
       "kconfig",
       "kcoreaddons",
       "kcrash",
@@ -1167,12 +1180,14 @@
       "ki18n",
       "kiconthemes",
       "kio",
-      "kitemviews",
+      "knotifications",
+      "knotifyconfig",
       "kstatusnotifieritem",
       "ktextaddons",
       "kwidgetsaddons",
       "kxmlgui",
-      "purpose"
+      "purpose",
+      "sonnet"
     ],
     "kaidan": [
       "extra-cmake-modules",
@@ -1738,6 +1753,7 @@
       "kiconthemes",
       "kitemviews",
       "kwidgetsaddons",
+      "kwindowsystem",
       "kxmlgui"
     ],
     "kdeclarative": [
@@ -1953,9 +1969,7 @@
     ],
     "kdesdk-thumbnailers": [
       "extra-cmake-modules",
-      "kconfig",
       "kcoreaddons",
-      "ki18n",
       "kio"
     ],
     "kdesu": [
@@ -2180,6 +2194,20 @@
       "kwidgetsaddons",
       "kwindowsystem"
     ],
+    "keepsecret": [
+      "extra-cmake-modules",
+      "kcolorscheme",
+      "kconfig",
+      "kcoreaddons",
+      "kcrash",
+      "kdbusaddons",
+      "ki18n",
+      "kiconthemes",
+      "kirigami",
+      "kirigami-addons",
+      "kitemmodels",
+      "qqc2-desktop-style"
+    ],
     "keurocalc": [
       "extra-cmake-modules",
       "kconfig",
@@ -2591,7 +2619,6 @@
     "kio": [
       "extra-cmake-modules",
       "karchive",
-      "kauth",
       "kbookmarks",
       "kcolorscheme",
       "kcompletion",
@@ -2688,11 +2715,14 @@
     ],
     "kirigami-addons": [
       "extra-cmake-modules",
+      "kcolorscheme",
       "kconfig",
       "kcoreaddons",
+      "kcrash",
       "kglobalaccel",
       "kguiaddons",
       "ki18n",
+      "kiconthemes",
       "kirigami"
     ],
     "kirigami-gallery": [
@@ -2731,7 +2761,8 @@
       "ki18n",
       "kpackage",
       "libkscreen",
-      "plasma-desktop"
+      "plasma-desktop",
+      "plasma-workspace"
     ],
     "kitemmodels": [
       "extra-cmake-modules"
@@ -3040,8 +3071,7 @@
       "kstatusnotifieritem",
       "kwidgetsaddons",
       "kwindowsystem",
-      "kxmlgui",
-      "phonon"
+      "kxmlgui"
     ],
     "kmouth": [
       "extra-cmake-modules",
@@ -3084,6 +3114,7 @@
       "kxmlgui"
     ],
     "kmymoney": [
+      "akonadi",
       "alkimia",
       "extra-cmake-modules",
       "kcmutils",
@@ -3097,6 +3128,7 @@
       "kholidays",
       "ki18n",
       "kiconthemes",
+      "kidentitymanagement",
       "kio",
       "kitemmodels",
       "kitemviews",
@@ -3277,6 +3309,7 @@
       "kconfig",
       "kcoreaddons",
       "kdbusaddons",
+      "kdoctools",
       "kguiaddons",
       "ki18n",
       "kiconthemes",
@@ -3398,7 +3431,8 @@
       "kdoctools",
       "ki18n",
       "kirigami",
-      "kirigami-addons"
+      "kirigami-addons",
+      "qcoro"
     ],
     "konversation": [
       "extra-cmake-modules",
@@ -3490,6 +3524,7 @@
     ],
     "kosmindoormap": [
       "extra-cmake-modules",
+      "kcontacts",
       "ki18n",
       "kirigami",
       "kirigami-addons",
@@ -3596,6 +3631,8 @@
       "kguiaddons",
       "ki18n",
       "kirigami",
+      "kirigami-addons",
+      "kitemmodels",
       "knotifications",
       "kunifiedpush",
       "kweathercore"
@@ -3614,7 +3651,8 @@
       "extra-cmake-modules"
     ],
     "kquickimageeditor": [
-      "extra-cmake-modules"
+      "extra-cmake-modules",
+      "kconfig"
     ],
     "krdc": [
       "extra-cmake-modules",
@@ -3801,6 +3839,8 @@
       "kcoreaddons",
       "kdbusaddons",
       "ki18n",
+      "kimageformats",
+      "kirigami",
       "kpackage",
       "kservice",
       "ksvg",
@@ -3939,7 +3979,6 @@
       "extra-cmake-modules",
       "kconfig",
       "kcrash",
-      "kdoctools",
       "kguiaddons",
       "ki18n",
       "knewstuff",
@@ -4027,6 +4066,7 @@
       "kcoreaddons",
       "ki18n",
       "kio",
+      "kitemviews",
       "ktextwidgets",
       "qtkeychain",
       "sonnet",
@@ -4231,7 +4271,6 @@
     ],
     "kwallet": [
       "extra-cmake-modules",
-      "gpgme",
       "kcolorscheme",
       "kconfig",
       "kcoreaddons",
@@ -4312,12 +4351,13 @@
       "extra-cmake-modules"
     ],
     "kwin": [
+      "aurorae",
       "breeze",
       "breeze-icons",
       "extra-cmake-modules",
       "kcmutils",
+      "kcolorscheme",
       "kconfig",
-      "kconfigwidgets",
       "kcoreaddons",
       "kcrash",
       "kdeclarative",
@@ -4329,6 +4369,7 @@
       "kidletime",
       "kirigami",
       "knewstuff",
+      "knighttime",
       "knotifications",
       "kpackage",
       "kpipewire",
@@ -4347,6 +4388,7 @@
       "wayland-protocols"
     ],
     "kwin-x11": [
+      "aurorae",
       "breeze",
       "breeze-icons",
       "extra-cmake-modules",
@@ -4364,9 +4406,9 @@
       "kidletime",
       "kirigami",
       "knewstuff",
+      "knighttime",
       "knotifications",
       "kpackage",
-      "kpipewire",
       "kscreenlocker",
       "kservice",
       "ksvg",
@@ -4616,7 +4658,6 @@
     "libplasma": [
       "extra-cmake-modules",
       "karchive",
-      "kcmutils",
       "kcolorscheme",
       "kconfig",
       "kcoreaddons",
@@ -4872,6 +4913,7 @@
     "mimetreeparser": [
       "extra-cmake-modules",
       "kcalendarcore",
+      "kirigami",
       "kmbox",
       "kmime",
       "kwidgetsaddons",
@@ -4970,7 +5012,6 @@
       "kxmlgui",
       "libkexiv2",
       "phonon",
-      "plasma-activities",
       "purpose",
       "threadweaver"
     ],
@@ -5244,7 +5285,6 @@
       "baloo",
       "breeze",
       "extra-cmake-modules",
-      "kaccounts-integration",
       "kactivitymanagerd",
       "kauth",
       "kcmutils",
@@ -5379,6 +5419,7 @@
       "bluedevil",
       "bluez-qt",
       "extra-cmake-modules",
+      "kauth",
       "kconfig",
       "kcoreaddons",
       "ki18n",
@@ -5424,11 +5465,13 @@
       "kconfigwidgets",
       "kcoreaddons",
       "kdbusaddons",
+      "kdeclarative",
       "ki18n",
       "kio",
       "kjobwidgets",
       "knotifications",
       "kpackage",
+      "kquickcharts",
       "kservice",
       "ksvg",
       "kwallet",
@@ -5437,6 +5480,7 @@
       "libplasma",
       "modemmanager-qt",
       "networkmanager-qt",
+      "prison",
       "qcoro",
       "solid"
     ],
@@ -5449,6 +5493,7 @@
       "kglobalaccel",
       "ki18n",
       "kirigami-addons",
+      "kitemmodels",
       "kpackage",
       "kstatusnotifieritem",
       "ksvg",
@@ -5503,6 +5548,7 @@
       "kcompletion",
       "kconfig",
       "kcoreaddons",
+      "kcrash",
       "kdbusaddons",
       "ki18n",
       "kiconthemes",
@@ -5591,6 +5637,7 @@
     ],
     "plasma-welcome": [
       "extra-cmake-modules",
+      "kcmutils",
       "kcoreaddons",
       "kdbusaddons",
       "ki18n",
@@ -5616,6 +5663,7 @@
       "kbookmarks",
       "kcmutils",
       "kcodecs",
+      "kcolorscheme",
       "kcompletion",
       "kconfig",
       "kconfigwidgets",
@@ -5624,7 +5672,6 @@
       "kdbusaddons",
       "kdeclarative",
       "kded",
-      "kdesu",
       "kfilemetadata",
       "kglobalaccel",
       "kglobalacceld",
@@ -5639,6 +5686,7 @@
       "kitemviews",
       "kjobwidgets",
       "knewstuff",
+      "knighttime",
       "knotifications",
       "knotifyconfig",
       "kpackage",
@@ -5686,10 +5734,12 @@
       "kconfig",
       "kcoreaddons",
       "kguiaddons",
+      "kholidays",
       "ki18n",
       "kidletime",
       "kio",
       "knotifications",
+      "kunitconversion",
       "libksysguard",
       "networkmanager-qt",
       "plasma-activities",
@@ -5730,6 +5780,7 @@
       "kcrash",
       "kdbusaddons",
       "ki18n",
+      "knotifications",
       "kwindowsystem",
       "polkit-qt-1"
     ],
@@ -5784,7 +5835,6 @@
       "kcoreaddons",
       "kdbusaddons",
       "ki18n",
-      "kiconthemes",
       "kio",
       "kirigami",
       "knotifications",
@@ -5806,6 +5856,7 @@
       "ki18n",
       "kio",
       "kirigami",
+      "kitemmodels",
       "kservice"
     ],
     "pvfviewer": [
@@ -5831,7 +5882,6 @@
       "kcodecs",
       "kcolorscheme",
       "kconfig",
-      "kcoreaddons",
       "kguiaddons",
       "kiconthemes",
       "kirigami"
@@ -5910,6 +5960,7 @@
       "ki18n",
       "kitemviews",
       "ktexteditor",
+      "ktexttemplate",
       "kxmlgui"
     ],
     "rolisteam": [
@@ -6219,6 +6270,7 @@
     "systemsettings": [
       "extra-cmake-modules",
       "kcmutils",
+      "kcolorscheme",
       "kconfig",
       "kcrash",
       "kdbusaddons",
@@ -6241,6 +6293,7 @@
     ],
     "tellico": [
       "extra-cmake-modules",
+      "kcolorscheme",
       "kconfig",
       "kconfigwidgets",
       "kcrash",
@@ -6249,6 +6302,7 @@
       "ki18n",
       "kiconthemes",
       "kio",
+      "kio-extras",
       "kitemmodels",
       "knewstuff",
       "kwidgetsaddons",
@@ -6317,9 +6371,6 @@
       "kconfig",
       "kcoreaddons",
       "kcrash",
-      "kdev-php",
-      "kdevelop",
-      "kdevelop-pg-qt",
       "kdoctools",
       "ki18n",
       "kiconthemes",
@@ -6405,6 +6456,7 @@
       "kconfigwidgets",
       "kcoreaddons",
       "kcrash",
+      "kdeclarative",
       "ki18n",
       "kiconthemes",
       "kio",
@@ -6418,6 +6470,7 @@
       "kwidgetsaddons",
       "kwindowsystem",
       "kxmlgui",
+      "plasma-workspace",
       "solid",
       "wayland",
       "wayland-protocols"
@@ -6462,5 +6515,5 @@
       "kwindowsystem"
     ]
   },
-  "version": "723afe12"
+  "version": "4fa0d47e"
 }
\ No newline at end of file
diff --git a/pkgs/kde/generated/licenses.json b/pkgs/kde/generated/licenses.json
index d474fff199eb..b218ff318e9d 100644
--- a/pkgs/kde/generated/licenses.json
+++ b/pkgs/kde/generated/licenses.json
@@ -350,7 +350,6 @@
     "BSD-3-Clause",
     "CC0-1.0",
     "GPL-2.0-only",
-    "GPL-2.0-or-later",
     "GPL-3.0-only",
     "LGPL-2.0-or-later",
     "LGPL-2.1-only",
@@ -452,6 +451,7 @@
   "flatpak-kcm": [
     "BSD-2-Clause",
     "BSD-3-Clause",
+    "CC-BY-SA-4.0",
     "CC0-1.0",
     "GPL-2.0-only",
     "GPL-2.0-or-later",
@@ -638,7 +638,9 @@
     "LicenseRef-KDE-Accepted-GPL"
   ],
   "karchive": [
+    "Apache-2.0",
     "BSD-2-Clause",
+    "CC-BY-SA-4.0",
     "CC0-1.0",
     "LGPL-2.0-or-later"
   ],
@@ -761,6 +763,9 @@
     "LicenseRef-KDE-Accepted-LGPL"
   ],
   "kcodecs": [
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "CC-BY-SA-4.0",
     "CC0-1.0",
     "GPL-2.0-or-later",
     "LGPL-2.0-only",
@@ -1004,6 +1009,7 @@
     "LicenseRef-KDE-Accepted-LGPL"
   ],
   "kdeplasma-addons": [
+    "BSD-2-Clause",
     "BSD-3-Clause",
     "CC0-1.0",
     "GPL-2.0-only",
@@ -1170,10 +1176,7 @@
   ],
   "kglobalacceld": [
     "CC0-1.0",
-    "LGPL-2.0-or-later",
-    "LGPL-2.1-only",
-    "LGPL-3.0-only",
-    "LicenseRef-KDE-Accepted-LGPL"
+    "LGPL-2.0-or-later"
   ],
   "kgoldrunner": [
     "BSD-3-Clause",
@@ -1296,6 +1299,7 @@
     "GPL-2.0-or-later"
   ],
   "kimageformats": [
+    "Apache-2.0",
     "BSD-2-Clause",
     "BSD-3-Clause",
     "CC0-1.0",
@@ -1437,6 +1441,7 @@
     "LGPL-2.0-only",
     "LGPL-2.0-or-later",
     "LGPL-2.1-only",
+    "LGPL-2.1-or-later",
     "LGPL-3.0-only",
     "LicenseRef-KDE-Accepted-LGPL"
   ],
@@ -1597,6 +1602,17 @@
     "GPL-3.0-only",
     "LicenseRef-KDE-Accepted-GPL"
   ],
+  "knighttime": [
+    "BSD-3-Clause",
+    "CC0-1.0",
+    "GPL-2.0-only",
+    "GPL-3.0-only",
+    "LGPL-2.1-only",
+    "LGPL-3.0-only",
+    "LicenseRef-KDE-Accepted-GPL",
+    "LicenseRef-KDE-Accepted-LGPL",
+    "MIT"
+  ],
   "knotifications": [
     "BSD-2-Clause",
     "BSD-3-Clause",
@@ -1850,6 +1866,7 @@
   ],
   "krdp": [
     "BSD-2-Clause",
+    "BSD-3-Clause",
     "CC0-1.0",
     "GPL-2.0-or-later",
     "LGPL-2.0-or-later",
@@ -2342,6 +2359,7 @@
     "MIT"
   ],
   "libplasma": [
+    "BSD-2-Clause",
     "BSD-3-Clause",
     "CC0-1.0",
     "GPL-2.0-only",
@@ -2457,7 +2475,6 @@
     "Qt-Commercial-exception-1.0"
   ],
   "milou": [
-    "BSD-2-Clause",
     "CC0-1.0",
     "GPL-2.0-only",
     "GPL-3.0-only",
@@ -2701,6 +2718,8 @@
   ],
   "plasma-mobile": [
     "Apache-2.0",
+    "BSD-2-Clause",
+    "CC-BY-SA-4.0",
     "CC0-1.0",
     "GPL-2.0-only",
     "GPL-2.0-or-later",
@@ -2720,7 +2739,7 @@
     "LGPL-2.0-or-later"
   ],
   "plasma-nm": [
-    "BSD-2-Clauses",
+    "BSD-2-Clause",
     "CC0-1.0",
     "GPL-2.0-only",
     "GPL-2.0-or-later",
@@ -2868,9 +2887,11 @@
     "BSD-3-Clause",
     "CC0-1.0",
     "GPL-2.0-or-later",
+    "GPL-3.0-only",
     "LGPL-2.0-or-later",
     "LGPL-2.1-only",
     "LGPL-3.0-only",
+    "LicenseRef-KDE-Accepted-GPL",
     "LicenseRef-KDE-Accepted-LGPL"
   ],
   "prison": [
diff --git a/pkgs/kde/generated/projects.json b/pkgs/kde/generated/projects.json
index 2125ea7bc26c..ec7937b31351 100644
--- a/pkgs/kde/generated/projects.json
+++ b/pkgs/kde/generated/projects.json
@@ -1265,6 +1265,12 @@
     "project_path": "unmaintained/jovie",
     "repo_path": "unmaintained/jovie"
   },
+  "jp-archives": {
+    "description": "Patches for KDE and Qt created by the members of Japan KDE Users Group (JKUG)",
+    "name": "jp-archives",
+    "project_path": "unmaintained/jp-archives",
+    "repo_path": "unmaintained/jp-archives"
+  },
   "jsmoke": {
     "description": "Smoke bindings for QtScript.",
     "name": "jsmoke",
@@ -2477,6 +2483,12 @@
     "project_path": "applications/keditbookmarks",
     "repo_path": "utilities/keditbookmarks"
   },
+  "keepsecret": {
+    "description": "Password manager",
+    "name": "keepsecret",
+    "project_path": "utilities/keepsecret",
+    "repo_path": "utilities/keepsecret"
+  },
   "kemoticons": {
     "description": "KEmoticons",
     "name": "kemoticons",
@@ -2864,8 +2876,8 @@
   "kiss": {
     "description": "KDE Initial System Setup",
     "name": "kiss",
-    "project_path": "system/kiss",
-    "repo_path": "system/kiss"
+    "project_path": "plasma/kiss",
+    "repo_path": "plasma/kiss"
   },
   "kitemmodels": {
     "description": "KItemModels",
@@ -6875,6 +6887,12 @@
     "project_path": "sysadmin/sentry-bugzilla-bridge",
     "repo_path": "sysadmin/sentry-bugzilla-bridge"
   },
+  "sysadmin-token-service": {
+    "description": "Service for issuing short lived access tokens for those presenting valid credentials",
+    "name": "sysadmin-token-service",
+    "project_path": "sysadmin/token-service",
+    "repo_path": "sysadmin/token-service"
+  },
   "sysadmin-webstats": {
     "description": "Scripts and templates used to manage web statistics on KDE servers",
     "name": "sysadmin-webstats",
diff --git a/pkgs/kde/generated/sources/plasma.json b/pkgs/kde/generated/sources/plasma.json
index 876d9609b9bc..c070b4587fa8 100644
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@@ -1,347 +1,352 @@
 {
   "aurorae": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/aurorae-6.4.5.tar.xz",
-    "hash": "sha256-MYPuvEdtZ2N0FUnGvQB8ZQZJkT1kjMr6MDZpCC2L83g="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/aurorae-6.5.0.tar.xz",
+    "hash": "sha256-jlHm8t9NPAclO06UtVo+FY3B72OARKaNrKaB7oKw+1s="
   },
   "bluedevil": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/bluedevil-6.4.5.tar.xz",
-    "hash": "sha256-+zoHx56pgM1V+SrQO4zrJZX9ehjXD2/SxNnjU4qE1x4="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/bluedevil-6.5.0.tar.xz",
+    "hash": "sha256-N2W9EvEPVChFR750P8mcECLLvzjg7lbYYxY7iWm7jZg="
   },
   "breeze": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/breeze-6.4.5.tar.xz",
-    "hash": "sha256-3LhDPTmVEVRpWPTIwaj65e0i8qaY8FOWjUEO51vW2LQ="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/breeze-6.5.0.tar.xz",
+    "hash": "sha256-Sa9bwnEicCjfcLIhSf5vz7FbbUuObz6zKd7N465N82k="
   },
   "breeze-grub": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/breeze-grub-6.4.5.tar.xz",
-    "hash": "sha256-ToJe6Vg3k/11W0E6R8QTpfnNFBKBL3tGrO7t5TgwZGs="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/breeze-grub-6.5.0.tar.xz",
+    "hash": "sha256-UumPPwodqDVRAfGeTzxz7tzst0imxyKVkk5sp2+cAJg="
   },
   "breeze-gtk": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/breeze-gtk-6.4.5.tar.xz",
-    "hash": "sha256-dx6IyhlCGkcvX0I1+ye6JYi36iZ+jyZH5eIxw1HwOpg="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/breeze-gtk-6.5.0.tar.xz",
+    "hash": "sha256-ul8FewjjgtngeQq1HXqhzFAXyVLrxGdlQAgVUn3IFHA="
   },
   "breeze-plymouth": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/breeze-plymouth-6.4.5.tar.xz",
-    "hash": "sha256-DhuDkj8JOCHd72/VsRtW2wVxtBCfTyYCFIAfscbfcAQ="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/breeze-plymouth-6.5.0.tar.xz",
+    "hash": "sha256-nK75hcMHirIp3u7DBFmw+Ms2mY8c63OuKpeMPipGGd8="
   },
   "discover": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/discover-6.4.5.tar.xz",
-    "hash": "sha256-kgjU43rSrkzR2nzTsB7eYQcaE4mOxMFO3/6YO5cvhXY="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/discover-6.5.0.tar.xz",
+    "hash": "sha256-k+Q7823cRxPLTsxtDwCkT9rmQmp9pScPcmRX5joPKD0="
   },
   "drkonqi": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/drkonqi-6.4.5.tar.xz",
-    "hash": "sha256-63ydNHXvQpiiotmKivIysvtw7kqnHE9R3RYVMXC7E7I="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/drkonqi-6.5.0.tar.xz",
+    "hash": "sha256-MQaismj2cY82kH02+sol8RlFg5oW/2uLdKE81wjvjLE="
   },
   "flatpak-kcm": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/flatpak-kcm-6.4.5.tar.xz",
-    "hash": "sha256-PxhYcHEkMFvCMYbzNLuvY8WivC2Jder/EnTUAuYRuLE="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/flatpak-kcm-6.5.0.tar.xz",
+    "hash": "sha256-0zqrUc9bpv37EvY4vH6LhSW55nMNFO7hRISN4XalGEU="
   },
   "kactivitymanagerd": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kactivitymanagerd-6.4.5.tar.xz",
-    "hash": "sha256-3lJRi5Ab7rWKYycxb82jRbNVIwVVbIWhxLETP5q3pCQ="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kactivitymanagerd-6.5.0.tar.xz",
+    "hash": "sha256-owsjDL3o7SGwtJQjVRXrv+7JFvf+TxW7uSdUaEZ4Ppg="
   },
   "kde-cli-tools": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kde-cli-tools-6.4.5.tar.xz",
-    "hash": "sha256-PMMnRw79Y85nmPMQACNGdNaUmHLIVxwHLcsjlWoneyY="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kde-cli-tools-6.5.0.tar.xz",
+    "hash": "sha256-3qIPn6Ni5ZBog7X4yZnuplGQYPEka9LyFJLYX17+QS0="
   },
   "kde-gtk-config": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kde-gtk-config-6.4.5.tar.xz",
-    "hash": "sha256-96gcHv1Tm2CMxkCpmf2xhLu4PPyWANQH0aTzMsOIDsI="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kde-gtk-config-6.5.0.tar.xz",
+    "hash": "sha256-7fdYusB3N9/l394LeXuGRqhmnINp8PnUoroaAv5GLg4="
   },
   "kdecoration": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kdecoration-6.4.5.tar.xz",
-    "hash": "sha256-+dPsQlbPcSWjsLwIx3N69xUjXVwitpuil5e7BsXvSkw="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kdecoration-6.5.0.tar.xz",
+    "hash": "sha256-+a4ZT+UfpkbSyGU++tU2KgrZJT48KLcOjkKpwDKLnBs="
   },
   "kdeplasma-addons": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kdeplasma-addons-6.4.5.tar.xz",
-    "hash": "sha256-S9vcKJK79iEcO+bAIXf3/9zhCrFUbYEaS1kCQZK3e84="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kdeplasma-addons-6.5.0.tar.xz",
+    "hash": "sha256-zApdSDB9URDAE8CLLsOCqrqfZsNwyOSrRuxxq2aTuQs="
   },
   "kgamma": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kgamma-6.4.5.tar.xz",
-    "hash": "sha256-mW69YL9QgkjtwpPZ7J2kybg4s/sbzNgqTbMFnvJ6uxY="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kgamma-6.5.0.tar.xz",
+    "hash": "sha256-woA1Ln611Ot95e3uNtv6I1plpbtetNk9rxblD1TaC/M="
   },
   "kglobalacceld": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kglobalacceld-6.4.5.tar.xz",
-    "hash": "sha256-pxLR96hpYCkv62l5/iyS8ufVz7zRB/Tv45eeGkwyzXM="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kglobalacceld-6.5.0.tar.xz",
+    "hash": "sha256-XcstQngVKSCOy/TS6yMfmuwp79EsLSTsn4ppBKxvddU="
   },
   "kinfocenter": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kinfocenter-6.4.5.tar.xz",
-    "hash": "sha256-bCeofeJPbF6dvYDNemGLVMHSiRRmWBz8CZoCP9BxZgs="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kinfocenter-6.5.0.tar.xz",
+    "hash": "sha256-3Dy9o60aZax+vbAvaTer1UZ9M9STjWDDO1tIeP442Ds="
   },
   "kmenuedit": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kmenuedit-6.4.5.tar.xz",
-    "hash": "sha256-YQ8HzTomwWGOKnwxzpARsos68N9dpl6wEAp+jwjIlC8="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kmenuedit-6.5.0.tar.xz",
+    "hash": "sha256-WmGVESlpgfw3f/ASnIZYtMS5BDc+/XpjUahqPUxgXjg="
+  },
+  "knighttime": {
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/knighttime-6.5.0.tar.xz",
+    "hash": "sha256-rHrxaKAcoZv8cchJ11hyPdgcHxz+THs8ijYCGtXRuq8="
   },
   "kpipewire": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kpipewire-6.4.5.tar.xz",
-    "hash": "sha256-0KcEpqAw7bW09da5nDK8TkbhpqtSff3pCJ4RCUtrGpI="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kpipewire-6.5.0.tar.xz",
+    "hash": "sha256-BlG46jhi/+PqTwiiRDGrRnJXQCIfBSxDKAMzYr4iC6c="
   },
   "krdp": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/krdp-6.4.5.tar.xz",
-    "hash": "sha256-OBwsAl22ti0tcWVVgsTJJyrgTUIlrqX4oDB2Gb+ZCkU="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/krdp-6.5.0.tar.xz",
+    "hash": "sha256-cQZct0KurdNq4k4pxb8eiDzQhNMPsjlCFcWJJ0AStYs="
   },
   "kscreen": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kscreen-6.4.5.tar.xz",
-    "hash": "sha256-uSvegjix5/PWUhzEsbqLumAEemT/8SmyAR3/X/NDEDc="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kscreen-6.5.0.tar.xz",
+    "hash": "sha256-kesy8PcBFlWqOXK2wjXQaOI6/GugivBKMerJkt5zHZ4="
   },
   "kscreenlocker": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kscreenlocker-6.4.5.tar.xz",
-    "hash": "sha256-+sT51T1jy5sG6Q/rgsKPRxlx0V3v1KBoux59KIa3CQ0="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kscreenlocker-6.5.0.tar.xz",
+    "hash": "sha256-DsR9SjPkfIbgnpsIrnaRXfZa+oDSjIm1Tiv7l60uwys="
   },
   "ksshaskpass": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/ksshaskpass-6.4.5.tar.xz",
-    "hash": "sha256-Wy2hGTcHnGGRl1XD1V/5v8W/l+0dvwgLQ8DCr1DjVNo="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/ksshaskpass-6.5.0.tar.xz",
+    "hash": "sha256-MWm4rL+HHSvGYWVAWNjjzhLRJRP9Id3Y8IrD9gT+2kk="
   },
   "ksystemstats": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/ksystemstats-6.4.5.tar.xz",
-    "hash": "sha256-cVsojzmr/ZDKgltPo8OHRenuHLvH9JW6FH1+++BKSdI="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/ksystemstats-6.5.0.tar.xz",
+    "hash": "sha256-wNbYkC8aRQfclV0owhvQhHJQwb+kofAwre5gskljYOo="
   },
   "kwallet-pam": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kwallet-pam-6.4.5.tar.xz",
-    "hash": "sha256-j/vxzELemqMq/JncxdwEgvGWcUVBbwVEmx5ye1WxNz4="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kwallet-pam-6.5.0.tar.xz",
+    "hash": "sha256-M2OXxp7XwhtK0plDQyTHGrBP+J5kagdeeTmal62/3sw="
   },
   "kwayland": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kwayland-6.4.5.tar.xz",
-    "hash": "sha256-C4ddnnzFusTZfTRD/0MRUz4Nja1AGvEkTUdYpfpUKPM="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kwayland-6.5.0.tar.xz",
+    "hash": "sha256-YLfslWNtnsTRbYC8IWEcLD1SVRStCiPwM6IGpTxLJ8E="
   },
   "kwayland-integration": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kwayland-integration-6.4.5.tar.xz",
-    "hash": "sha256-/SvWMFN2O703DJ5XggWDMK1zoUJBt6bj4bjSQwPe1QM="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kwayland-integration-6.5.0.tar.xz",
+    "hash": "sha256-wq2mdIbNFNW2Mr8g/j9vC5q/aRk+bQIOlZXdtvQwNbo="
   },
   "kwin": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kwin-6.4.5.tar.xz",
-    "hash": "sha256-3s8ct5EnwoXH7ado5/9Pl8cvMUc1yCaFdY8LlWrBUfc="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kwin-6.5.0.tar.xz",
+    "hash": "sha256-4OqmeYAmb+J/4y0VyfGPggZ3aRn4HU4aiJ00xfZc+YI="
   },
   "kwin-x11": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kwin-x11-6.4.5.tar.xz",
-    "hash": "sha256-zqkYeUZ6/fosrw7G3XJW6ueN76lwzcmpR/79hdQXrLE="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kwin-x11-6.5.0.tar.xz",
+    "hash": "sha256-p52Pe0YQtI8dj1EylCKyiC7U2q3zjlyQQtJbFZQXZRM="
   },
   "kwrited": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/kwrited-6.4.5.tar.xz",
-    "hash": "sha256-Q0uDsRWkgPVCyX1RnCfy613U0zPPvdoo7ZlIE4kqANE="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/kwrited-6.5.0.tar.xz",
+    "hash": "sha256-IPMgzjtDD2RSppFqQpKQs8xFHZoroGrgh8PP0ZPWMes="
   },
   "layer-shell-qt": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/layer-shell-qt-6.4.5.tar.xz",
-    "hash": "sha256-72uq4iEU8DiviQKfPwB17inDuR/UkQCCjEw6MuFJbpU="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/layer-shell-qt-6.5.0.tar.xz",
+    "hash": "sha256-cg8ZPxGaR+44mktSs23cr+yk6SV/O33LVq4GI52xovc="
   },
   "libkscreen": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/libkscreen-6.4.5.tar.xz",
-    "hash": "sha256-aNJuJ2VrRQ8Vp49EeExQoiA05XwU+WpAIBnVK8Wz4rQ="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/libkscreen-6.5.0.tar.xz",
+    "hash": "sha256-nEJXf6qbuqSBl4KEcJr93DEPUqzJe2YTujxs7pFhzCw="
   },
   "libksysguard": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/libksysguard-6.4.5.tar.xz",
-    "hash": "sha256-x8+M0vCh5RkgHcYoifETWWeoUPkywlL9Juo9iMZWSg8="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/libksysguard-6.5.0.tar.xz",
+    "hash": "sha256-LxyTJGzbBXhlG3CNAP4rbAxkEfSh8shGTlrqyBaXHIU="
   },
   "libplasma": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/libplasma-6.4.5.tar.xz",
-    "hash": "sha256-lFtsVM/sVggPa1WGToKncCCW1oK+zx/Ul513pACcQSQ="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/libplasma-6.5.0.tar.xz",
+    "hash": "sha256-vJ+BSURzEpfhfZPQjxOQUGxdmtVfWoR+CuUHloN7bOg="
   },
   "milou": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/milou-6.4.5.tar.xz",
-    "hash": "sha256-Dq7sigWvw6lvag7vyaBF9JrOi+IBvI9X4e2BM82qEA0="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/milou-6.5.0.tar.xz",
+    "hash": "sha256-zuWqoW96kV0YdrL5GvDNchGmGNJwjle2frTfrs6ngR8="
   },
   "ocean-sound-theme": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/ocean-sound-theme-6.4.5.tar.xz",
-    "hash": "sha256-X140kY7Gn0TBAh2lJg4aXWVkNkYMn+AaXUiEkTAW+iU="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/ocean-sound-theme-6.5.0.tar.xz",
+    "hash": "sha256-yRLlOTCCZELphComNnnxkguaPcO2PZsCIJ/Pt2nXWg4="
   },
   "oxygen": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/oxygen-6.4.5.tar.xz",
-    "hash": "sha256-nBijOiJWC9xQS9HN1t054JGDjGC1R6zsAMUb2KEz62M="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/oxygen-6.5.0.tar.xz",
+    "hash": "sha256-rQGEkahM32n7uiCXUiYRBql+G6oCqp21HXaysSC2GKM="
   },
   "oxygen-sounds": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/oxygen-sounds-6.4.5.tar.xz",
-    "hash": "sha256-HQ+p+HIgXsjSvv5bwCnIsaDQ5UyLOhkHZTItiXeFIis="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/oxygen-sounds-6.5.0.tar.xz",
+    "hash": "sha256-XBJk1xNXsu0OJthXDnly9ZZcEjkROTqn5LTnDvgowm8="
   },
   "plasma-activities": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-activities-6.4.5.tar.xz",
-    "hash": "sha256-MK0jhG6Xvzwu1tOvJd4K4dmB6ocWCEkvzBYVXv0MgWk="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-activities-6.5.0.tar.xz",
+    "hash": "sha256-DbhyvFaqhNIv5lsZxbNkzBT0SkBAHqqvv42iegS4iD8="
   },
   "plasma-activities-stats": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-activities-stats-6.4.5.tar.xz",
-    "hash": "sha256-NcZPckwFUPmWd/YTSEnez3a+R5cSEMqUGFguo4tIDDA="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-activities-stats-6.5.0.tar.xz",
+    "hash": "sha256-YdcjGKwdTN7WFS8Jfuj0SzsyYXkaaELcrYZo59Bj9RU="
   },
   "plasma-browser-integration": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-browser-integration-6.4.5.tar.xz",
-    "hash": "sha256-rZL07B4x2f3Fe1F73C5awQfGLAIJCtN1Ke7N7myvnYs="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-browser-integration-6.5.0.tar.xz",
+    "hash": "sha256-HwFDyglLrMMPtphYVOnI+9ktFJU7O7MSGTIrozFwnf8="
   },
   "plasma-desktop": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-desktop-6.4.5.tar.xz",
-    "hash": "sha256-dVLkx8fMv1t3VnJruaqr00RjCXeq8T9fMFtEd8qhe7c="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-desktop-6.5.0.tar.xz",
+    "hash": "sha256-wn3CwSeVSDp3ohvMcAKbmDRHTtQj3NuT3A6IV9Te3kI="
   },
   "plasma-dialer": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-dialer-6.4.5.tar.xz",
-    "hash": "sha256-o5sUqDi+BNZeVOuD31hAPhj8EVBjeTXTdGZX4nyY/qg="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-dialer-6.5.0.tar.xz",
+    "hash": "sha256-dTUxwFguIe6cJURMOn1gahNZ7MKKn2Ds/jCPS26d6Mg="
   },
   "plasma-disks": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-disks-6.4.5.tar.xz",
-    "hash": "sha256-gBfHSfvIUKE9EdWzU0P4UZStQnagHMBTEd1pgo9R/vM="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-disks-6.5.0.tar.xz",
+    "hash": "sha256-6KThaCHyXGzC74JYcVQHfdfZi3Upiqh/6KxpXmo8+Po="
   },
   "plasma-firewall": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-firewall-6.4.5.tar.xz",
-    "hash": "sha256-hcjyic4DkNVgyZ/Z9KXFC8n6tvfQQ/WqMQuFIpsdg0w="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-firewall-6.5.0.tar.xz",
+    "hash": "sha256-7fZeXA4jfFkyiZMxYx3XK6LZtp6cl/906P/AUEuQ9cs="
   },
   "plasma-integration": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-integration-6.4.5.tar.xz",
-    "hash": "sha256-w+Jx3h+ibIgzRAtpzKxejAlKheR0K/Jvl7y3yqjBeyw="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-integration-6.5.0.tar.xz",
+    "hash": "sha256-AqfgvOVrqpPG9xNrljC5ulEJ19Kcb2wRDMcWEL3SDg4="
   },
   "plasma-mobile": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-mobile-6.4.5.tar.xz",
-    "hash": "sha256-pzz42tiaKEPfQS85X6HcaU4AHM4tZxrsJufoIXT7i+U="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-mobile-6.5.0.tar.xz",
+    "hash": "sha256-Ib9k7bv5RGJuBX3CLpIugWxbVVIuh57rnLYQ/UhYNQU="
   },
   "plasma-nano": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-nano-6.4.5.tar.xz",
-    "hash": "sha256-xPMVP0/ao++XwXX+qW6RRyjqNr8ron5ojZkMCA+2wmE="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-nano-6.5.0.tar.xz",
+    "hash": "sha256-GhFhF6XAaAwycZU6UMmKsN4y9qfwM9i1Zov+WtMr0RY="
   },
   "plasma-nm": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-nm-6.4.5.tar.xz",
-    "hash": "sha256-Sn0ilmiOlZfu3kRN5v5lSBMe1pE2puHEqt76D0oBXRY="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-nm-6.5.0.tar.xz",
+    "hash": "sha256-ZIpHqoghXPIbtsbHnwwgvcqsn5/8VAKiPDQbpAApQZU="
   },
   "plasma-pa": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-pa-6.4.5.tar.xz",
-    "hash": "sha256-FMK6z/DwHAtSjXtxtQYsaLKXK7QVtcJzh901zuREGxo="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-pa-6.5.0.tar.xz",
+    "hash": "sha256-JNdY8tVUhoSluNT+igowS7z23gLkijfLGji6eaQoJYw="
   },
   "plasma-sdk": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-sdk-6.4.5.tar.xz",
-    "hash": "sha256-VjLavtw/dRBtFdPW+lBmpb6drPh6IkxH+v6CrBHP278="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-sdk-6.5.0.tar.xz",
+    "hash": "sha256-vCRMPWMXNepo7uQlrcfWCwnxcSi6ZT986jAxNGBr24E="
   },
   "plasma-systemmonitor": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-systemmonitor-6.4.5.tar.xz",
-    "hash": "sha256-MXtlI0eq6PmNSWF4GSv93FEn3mariLUa1yyK8flqTD0="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-systemmonitor-6.5.0.tar.xz",
+    "hash": "sha256-AFXX6Cs+4VcYf7DHl/KGfD2mLVZJDJ02/VdvAmuTRbQ="
   },
   "plasma-thunderbolt": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-thunderbolt-6.4.5.tar.xz",
-    "hash": "sha256-fB0EOVuEo2h8Q9lASlfaidZNahNmcQe7wkOmHZ8GXzU="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-thunderbolt-6.5.0.tar.xz",
+    "hash": "sha256-1kXh2Tri9kHO1u5fds/6vgTHqj6i3xjbiFyoyTTHIyI="
   },
   "plasma-vault": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-vault-6.4.5.tar.xz",
-    "hash": "sha256-OlEFvplfCSMUUDiGfqb8/kWoLpU37vWoVkPbJP/vcPU="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-vault-6.5.0.tar.xz",
+    "hash": "sha256-umka8KaosOmZYH2UJOu6TVDKQwSgcTA3ypwhf9OrSJQ="
   },
   "plasma-welcome": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-welcome-6.4.5.tar.xz",
-    "hash": "sha256-V867V7XVKCY6nZBtsljjaNzNhCUa6SRKwHviC1n+1gk="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-welcome-6.5.0.tar.xz",
+    "hash": "sha256-TcElW4McRGt+izc1RR/M+j34DCsoJdhQa7NWkM/LhbY="
   },
   "plasma-workspace": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-workspace-6.4.5.tar.xz",
-    "hash": "sha256-GZmevzV09TkUW6cHQBm4jVHyypUtEhOU2vavLmMpEPs="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-workspace-6.5.0.tar.xz",
+    "hash": "sha256-ZJHq+/q8UzXFx6e21ohKEfkQdVh7SRJAHP/oMJZvLyA="
   },
   "plasma-workspace-wallpapers": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma-workspace-wallpapers-6.4.5.tar.xz",
-    "hash": "sha256-tDs9MXcS0MTruegAFiRON4LlsHlXV21qAwSQegfAj78="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma-workspace-wallpapers-6.5.0.tar.xz",
+    "hash": "sha256-MsHBoBVYlfTbU0M/pJKBH0VFth0jfHez0FzYP7b0yX0="
   },
   "plasma5support": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plasma5support-6.4.5.tar.xz",
-    "hash": "sha256-rP37yC+OOve9NdUUsePLtdq6jae6eQzsto+SWg9N+UI="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plasma5support-6.5.0.tar.xz",
+    "hash": "sha256-lyp3VujiH0mkJHnU4PW+tkT4/64V2lI3dk0k28UJ49o="
   },
   "plymouth-kcm": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/plymouth-kcm-6.4.5.tar.xz",
-    "hash": "sha256-K1fR9OJddp7ycA4427pV/np4xuyhP+6SWHWxoo4R5Hs="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/plymouth-kcm-6.5.0.tar.xz",
+    "hash": "sha256-Q2bI4WelqoBhc1wNK+VoNgLxJTMQEBvtc0bLPdMTyUk="
   },
   "polkit-kde-agent-1": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/polkit-kde-agent-1-6.4.5.tar.xz",
-    "hash": "sha256-W113FmD1IJKVplr9yz4RfBzJzXwYk9DJtorQxTEwgwE="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/polkit-kde-agent-1-6.5.0.tar.xz",
+    "hash": "sha256-pLJ7seqVF1jRG3jAhTyB73EigBqkGkSIQk2qWiCM5rE="
   },
   "powerdevil": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/powerdevil-6.4.5.tar.xz",
-    "hash": "sha256-qo6cbzO4rtTtrpycQ4MJZu1O7C+0N88hAjFQvfvYLkg="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/powerdevil-6.5.0.tar.xz",
+    "hash": "sha256-9+fb6mSvwVxd4YEA4zkr3eXM3HNfb1FpcyCBWZMfwYc="
   },
   "print-manager": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/print-manager-6.4.5.tar.xz",
-    "hash": "sha256-4jj9ApLRCsi1xRS9LOC5GNXVsZZsZpUyhb62bhOiQso="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/print-manager-6.5.0.tar.xz",
+    "hash": "sha256-D3R2h6DRWewhVkXY96g0RlDxojwmbEuysN7zH9G8O88="
   },
   "qqc2-breeze-style": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/qqc2-breeze-style-6.4.5.tar.xz",
-    "hash": "sha256-3zV16UPdGEbAeOSnDkV7CHeCDlqpn/XyeEMw8MlwN/8="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/qqc2-breeze-style-6.5.0.tar.xz",
+    "hash": "sha256-Zx3ipLD8F8qCIvkRuK3mxM7X/nb9n2BcIUyx5X72Jtk="
   },
   "sddm-kcm": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/sddm-kcm-6.4.5.tar.xz",
-    "hash": "sha256-BFI/OCv86SWcRzxX2kRyvk+vkvmLbtQKskq2Y6M3ya0="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/sddm-kcm-6.5.0.tar.xz",
+    "hash": "sha256-cfMwxsiQp7LAcYiqnHd8arZvTLHbq4lP0hKkiR6fRSg="
   },
   "spacebar": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/spacebar-6.4.5.tar.xz",
-    "hash": "sha256-y9Kj7g9wXxP4tC3HcA+5K++4jQT37jZ57qJNwWxPieA="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/spacebar-6.5.0.tar.xz",
+    "hash": "sha256-nUU0uHx+lrDB/VSmg21fnKsexoGbmwriysrutBQpdNg="
   },
   "spectacle": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/spectacle-6.4.5.tar.xz",
-    "hash": "sha256-QqVvBZPAxce2YQiO9ubjKg6iSDVPu/20og86IbpVQOc="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/spectacle-6.5.0.tar.xz",
+    "hash": "sha256-4UZXxvHyU4o3lvkVv9K4IV9GfLNqQrwtrYhsqevw3PE="
   },
   "systemsettings": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/systemsettings-6.4.5.tar.xz",
-    "hash": "sha256-kNfwl/GnekAAdiJM26RblMcdD+xD79Ltc3BH8v8quo8="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/systemsettings-6.5.0.tar.xz",
+    "hash": "sha256-u2XQzDPoqguIupyTAKHnGwDi4LoCiMQcFAG0q+g9JZw="
   },
   "wacomtablet": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/wacomtablet-6.4.5.tar.xz",
-    "hash": "sha256-4MdcwKW9KTQfcFzFA/eP3Ul2yxWolBvrt3RIs2iCZyg="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/wacomtablet-6.5.0.tar.xz",
+    "hash": "sha256-jqzMQN1kSaWJCOkJsq7cuJ1vuiVC7F+kbttrJpGYJBc="
   },
   "xdg-desktop-portal-kde": {
-    "version": "6.4.5",
-    "url": "mirror://kde/stable/plasma/6.4.5/xdg-desktop-portal-kde-6.4.5.tar.xz",
-    "hash": "sha256-n+BPBIK78yYIg2nANde29APbDAaupZNEQqd4h5ntzuI="
+    "version": "6.5.0",
+    "url": "mirror://kde/stable/plasma/6.5.0/xdg-desktop-portal-kde-6.5.0.tar.xz",
+    "hash": "sha256-9aRIU7Lm0IWKhigDiu6L/22EsewlsE7nqWHXPpYmGbc="
   }
 }
\ No newline at end of file
diff --git a/pkgs/kde/plasma/default.nix b/pkgs/kde/plasma/default.nix
index 865d667f33af..b51adab7631f 100644
--- a/pkgs/kde/plasma/default.nix
+++ b/pkgs/kde/plasma/default.nix
@@ -18,6 +18,7 @@
   kglobalacceld = callPackage ./kglobalacceld { };
   kinfocenter = callPackage ./kinfocenter { };
   kmenuedit = callPackage ./kmenuedit { };
+  knighttime = callPackage ./knighttime { };
   kpipewire = callPackage ./kpipewire { };
   krdp = callPackage ./krdp { };
   kscreen = callPackage ./kscreen { };
diff --git a/pkgs/kde/plasma/knighttime/default.nix b/pkgs/kde/plasma/knighttime/default.nix
new file mode 100644
index 000000000000..e2604cae53c2
--- /dev/null
+++ b/pkgs/kde/plasma/knighttime/default.nix
@@ -0,0 +1,9 @@
+{
+  mkKdeDerivation,
+  qtpositioning,
+}:
+mkKdeDerivation {
+  pname = "knighttime";
+
+  extraBuildInputs = [ qtpositioning ];
+}
diff --git a/pkgs/kde/plasma/krdp/default.nix b/pkgs/kde/plasma/krdp/default.nix
index 7f1d1bd89a69..197f01162a8c 100644
--- a/pkgs/kde/plasma/krdp/default.nix
+++ b/pkgs/kde/plasma/krdp/default.nix
@@ -3,6 +3,7 @@
   mkKdeDerivation,
   replaceVars,
   openssl,
+  pam,
   pkg-config,
   qtwayland,
   freerdp,
@@ -19,6 +20,8 @@ mkKdeDerivation {
   extraNativeBuildInputs = [ pkg-config ];
   extraBuildInputs = [
     qtwayland
+
     freerdp
+    pam
   ];
 }
diff --git a/pkgs/kde/plasma/krdp/hardcode-openssl-path.patch b/pkgs/kde/plasma/krdp/hardcode-openssl-path.patch
index 8ef18364b72c..21d9db7c0c82 100644
--- a/pkgs/kde/plasma/krdp/hardcode-openssl-path.patch
+++ b/pkgs/kde/plasma/krdp/hardcode-openssl-path.patch
@@ -1,13 +1,13 @@
 diff --git a/src/kcm/kcmkrdpserver.cpp b/src/kcm/kcmkrdpserver.cpp
-index 3af527c..3433a84 100644
+index 2d2c5e8..289c6f1 100644
 --- a/src/kcm/kcmkrdpserver.cpp
 +++ b/src/kcm/kcmkrdpserver.cpp
-@@ -218,7 +218,7 @@ void KRDPServerConfig::generateCertificate()
-     QString certificateKeyPath(QStandardPaths::writableLocation(QStandardPaths::GenericDataLocation) + QStringLiteral("/krdpserver/krdp.key"));
+@@ -293,7 +293,7 @@ void KRDPServerConfig::generateCertificate()
+     QString certificateKeyPath(QStandardPaths::writableLocation(QStandardPaths::GenericDataLocation) + u"/krdpserver/krdp.key"_s);
      qDebug(KRDPKCM) << "Generating certificate files to: " << certificatePath << " and " << certificateKeyPath;
      QProcess sslProcess;
--    sslProcess.start(u"openssl"_qs,
-+    sslProcess.start(u"@openssl@"_qs,
+-    sslProcess.start(u"openssl"_s,
++    sslProcess.start(u"@openssl@"_s,
                       {
-                          u"req"_qs,
-                          u"-nodes"_qs,
+                          u"req"_s,
+                          u"-nodes"_s,
diff --git a/pkgs/kde/plasma/plasma-dialer/default.nix b/pkgs/kde/plasma/plasma-dialer/default.nix
index ca5a7cc22182..8a595c98a8f8 100644
--- a/pkgs/kde/plasma/plasma-dialer/default.nix
+++ b/pkgs/kde/plasma/plasma-dialer/default.nix
@@ -1,7 +1,7 @@
 {
   mkKdeDerivation,
   pkg-config,
-  qtwayland,
+  qtbase,
   callaudiod,
   libphonenumber,
   protobuf,
@@ -11,13 +11,12 @@ mkKdeDerivation {
 
   extraNativeBuildInputs = [ pkg-config ];
   extraBuildInputs = [
-    qtwayland
     callaudiod
     libphonenumber
     protobuf
   ];
 
   extraCmakeFlags = [
-    "-DQtWaylandScanner_EXECUTABLE=${qtwayland}/libexec/qtwaylandscanner"
+    "-DQtWaylandScanner_EXECUTABLE=${qtbase}/libexec/qtwaylandscanner"
   ];
 }
diff --git a/pkgs/kde/plasma/plasma-vault/0003-fusermount-path.patch b/pkgs/kde/plasma/plasma-vault/0003-fusermount-path.patch
index 0d4481c70541..365ac8e3e160 100644
--- a/pkgs/kde/plasma/plasma-vault/0003-fusermount-path.patch
+++ b/pkgs/kde/plasma/plasma-vault/0003-fusermount-path.patch
@@ -1,25 +1,13 @@
-From 63571e28c65935f32567c0b179a096d62726b778 Mon Sep 17 00:00:00 2001
-From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Tue, 2 Nov 2021 06:00:32 -0500
-Subject: [PATCH 3/3] fusermount path
-
----
- kded/engine/fusebackend_p.cpp | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
 diff --git a/kded/engine/fusebackend_p.cpp b/kded/engine/fusebackend_p.cpp
-index 91f3523..1c19d88 100644
+index 714b660..cb384fc 100644
 --- a/kded/engine/fusebackend_p.cpp
 +++ b/kded/engine/fusebackend_p.cpp
-@@ -86,7 +86,7 @@ QProcess *FuseBackend::process(const QString &executable, const QStringList &arg
+@@ -90,7 +90,7 @@ QProcess *FuseBackend::process(const QString &executable, const QStringList &arg
  
  QProcess *FuseBackend::fusermount(const QStringList &arguments) const
  {
--    return process("fusermount", arguments, {});
+-    return process(fusermountExecutable, arguments, {});
 +    return process(NIXPKGS_FUSERMOUNT, arguments, {});
  }
  
  FutureResult<> FuseBackend::initialize(const QString &name, const Device &device, const MountPoint &mountPoint, const Vault::Payload &payload)
--- 
-2.33.1
-
diff --git a/pkgs/kde/plasma/plasma-vault/default.nix b/pkgs/kde/plasma/plasma-vault/default.nix
index f933687143a8..c66377c87069 100644
--- a/pkgs/kde/plasma/plasma-vault/default.nix
+++ b/pkgs/kde/plasma/plasma-vault/default.nix
@@ -21,7 +21,7 @@ mkKdeDerivation {
     ''-DNIXPKGS_ENCFS=\"${lib.getBin encfs}/bin/encfs\"''
     ''-DNIXPKGS_ENCFSCTL=\"${lib.getBin encfs}/bin/encfsctl\"''
     ''-DNIXPKGS_CRYFS=\"${lib.getBin cryfs}/bin/cryfs\"''
-    ''-DNIXPKGS_FUSERMOUNT=\"${lib.getBin fuse}/bin/fusermount\"''
+    ''-DNIXPKGS_FUSERMOUNT=\"${lib.getBin fuse}/bin/fusermount3\"''
     ''-DNIXPKGS_GOCRYPTFS=\"${lib.getBin gocryptfs}/bin/gocryptfs\"''
   ];
 
diff --git a/pkgs/kde/plasma/plasma-workspace/default.nix b/pkgs/kde/plasma/plasma-workspace/default.nix
index a7cd8fc5388f..ebfa90da040d 100644
--- a/pkgs/kde/plasma/plasma-workspace/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace/default.nix
@@ -2,8 +2,6 @@
   lib,
   mkKdeDerivation,
   replaceVars,
-  fetchpatch,
-  dbus,
   fontconfig,
   xorg,
   lsof,
@@ -25,7 +23,6 @@ mkKdeDerivation {
 
   patches = [
     (replaceVars ./dependency-paths.patch {
-      dbusSend = lib.getExe' dbus "dbus-send";
       fcMatch = lib.getExe' fontconfig "fc-match";
       lsof = lib.getExe lsof;
       qdbus = lib.getExe' qttools "qdbus";
@@ -34,12 +31,6 @@ mkKdeDerivation {
       # @QtBinariesDir@ only appears in the *removed* lines of the diff
       QtBinariesDir = null;
     })
-    # Fixes https://github.com/NixOS/nixpkgs/issues/442630, next upstream release should already contain this patch
-    (fetchpatch {
-      name = "fix-media-applet-crash.diff";
-      url = "https://invent.kde.org/plasma/plasma-workspace/-/commit/30273fb2afcc6e304951c8895bb17d38255fed39.diff";
-      sha256 = "sha256-1p1CjxRioCDm5ugoI8l6kDlOse5FbDJ71tTAY9LPvRc=";
-    })
   ];
 
   postInstall = ''
diff --git a/pkgs/kde/plasma/plasma-workspace/dependency-paths.patch b/pkgs/kde/plasma/plasma-workspace/dependency-paths.patch
index b4d46cd869bb..df8c5981dcfb 100644
--- a/pkgs/kde/plasma/plasma-workspace/dependency-paths.patch
+++ b/pkgs/kde/plasma/plasma-workspace/dependency-paths.patch
@@ -1,8 +1,8 @@
-diff --git a/applets/devicenotifier/plugin/deviceerrormonitor_p.cpp b/applets/devicenotifier/plugin/deviceerrormonitor_p.cpp
-index ba214a555d..421d940738 100644
---- a/applets/devicenotifier/plugin/deviceerrormonitor_p.cpp
-+++ b/applets/devicenotifier/plugin/deviceerrormonitor_p.cpp
-@@ -155,7 +155,7 @@ void DeviceErrorMonitor::queryBlockingApps(const QString &devicePath)
+diff --git a/applets/devicenotifier/devicemessagemonitor_p.cpp b/applets/devicenotifier/devicemessagemonitor_p.cpp
+index 173fec78c1..0519424f71 100644
+--- a/applets/devicenotifier/devicemessagemonitor_p.cpp
++++ b/applets/devicenotifier/devicemessagemonitor_p.cpp
+@@ -118,7 +118,7 @@ void DeviceMessageMonitor::queryBlockingApps(const QString &devicePath)
          Q_EMIT blockingAppsReady(blockApps);
          p->deleteLater();
      });
@@ -25,7 +25,7 @@ index e27e21a7bd..abbf7f32e1 100644
      p.write(input);
      p.closeWriteChannel();
 diff --git a/kcms/fonts/fonts.cpp b/kcms/fonts/fonts.cpp
-index 96417c440a..8c9bc2e9ab 100644
+index da28f13837..4af78b7850 100644
 --- a/kcms/fonts/fonts.cpp
 +++ b/kcms/fonts/fonts.cpp
 @@ -137,7 +137,7 @@ void KFonts::save()
@@ -51,7 +51,7 @@ index e4d1ad4311..d45bdfad98 100644
  
  void CFcQuery::procExited()
 diff --git a/kcms/krdb/krdb.cpp b/kcms/krdb/krdb.cpp
-index f3c9956921..09c818739d 100644
+index 53f77d0a18..680e81b6e4 100644
 --- a/kcms/krdb/krdb.cpp
 +++ b/kcms/krdb/krdb.cpp
 @@ -425,7 +425,7 @@ void runRdb(unsigned int flags)
@@ -107,7 +107,7 @@ index 7218628ce9..9126475ea4 100644
 +ExecStart=@qdbus@ org.kde.kcminit /kcminit org.kde.KCMInit.runPhase1
  Slice=session.slice
 diff --git a/startkde/startplasma.cpp b/startkde/startplasma.cpp
-index 4d31c6f408..17418b1ff7 100644
+index b8474dd34f..7d0616e116 100644
 --- a/startkde/startplasma.cpp
 +++ b/startkde/startplasma.cpp
 @@ -57,7 +57,7 @@ void sigtermHandler(int signalNumber)
@@ -119,7 +119,7 @@ index 4d31c6f408..17418b1ff7 100644
  }
  
  QStringList allServices(const QLatin1String &prefix)
-@@ -512,7 +512,7 @@ QProcess *setupKSplash()
+@@ -508,7 +508,7 @@ QProcess *setupKSplash()
          if (ksplashCfg.readEntry("Engine", QStringLiteral("KSplashQML")) == QLatin1String("KSplashQML")) {
              p = new QProcess;
              p->setProcessChannelMode(QProcess::ForwardedChannels);
@@ -128,14 +128,3 @@ index 4d31c6f408..17418b1ff7 100644
          }
      }
      return p;
-diff --git a/startkde/systemd/plasma-ksplash-ready.service.in b/startkde/systemd/plasma-ksplash-ready.service.in
-index 1e903130a9..0861c3d136 100644
---- a/startkde/systemd/plasma-ksplash-ready.service.in
-+++ b/startkde/systemd/plasma-ksplash-ready.service.in
-@@ -6,5 +6,5 @@ PartOf=graphical-session.target
- 
- [Service]
- Type=oneshot
--ExecStart=dbus-send --session --reply-timeout=1 --type=method_call --dest=org.kde.KSplash /KSplash org.kde.KSplash.setStage string:ready
-+ExecStart=@dbusSend@ --session --reply-timeout=1 --type=method_call --dest=org.kde.KSplash /KSplash org.kde.KSplash.setStage string:ready
- Slice=session.slice
diff --git a/pkgs/kde/plasma/polkit-kde-agent-1/default.nix b/pkgs/kde/plasma/polkit-kde-agent-1/default.nix
index 26e9f16d477c..f87d21cd21b8 100644
--- a/pkgs/kde/plasma/polkit-kde-agent-1/default.nix
+++ b/pkgs/kde/plasma/polkit-kde-agent-1/default.nix
@@ -2,7 +2,6 @@
   mkKdeDerivation,
   qtdeclarative,
   kirigami,
-  knotifications,
 }:
 mkKdeDerivation {
   pname = "polkit-kde-agent-1";
@@ -10,6 +9,5 @@ mkKdeDerivation {
   extraBuildInputs = [
     qtdeclarative
     kirigami
-    knotifications
   ];
 }
diff --git a/pkgs/kde/plasma/systemsettings/default.nix b/pkgs/kde/plasma/systemsettings/default.nix
index 7902e83710ff..0773a7f7d428 100644
--- a/pkgs/kde/plasma/systemsettings/default.nix
+++ b/pkgs/kde/plasma/systemsettings/default.nix
@@ -1,5 +1,11 @@
-{ mkKdeDerivation }:
+{
+  mkKdeDerivation,
+  kauth,
+}:
 mkKdeDerivation {
   pname = "systemsettings";
+
+  extraBuildInputs = [ kauth ];
+
   meta.mainProgram = "systemsettings";
 }
diff --git a/pkgs/kde/third-party/applet-window-buttons6/default.nix b/pkgs/kde/third-party/applet-window-buttons6/default.nix
index 33ab54b180cf..da2401736690 100644
--- a/pkgs/kde/third-party/applet-window-buttons6/default.nix
+++ b/pkgs/kde/third-party/applet-window-buttons6/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   cmake,
   extra-cmake-modules,
+  kcmutils,
   kcoreaddons,
   kdeclarative,
   kdecoration,
@@ -23,12 +24,16 @@ stdenv.mkDerivation rec {
 
   dontWrapQtApps = true;
 
+  # kdecoration headers include C++20 spaceship operator
+  env.NIX_CFLAGS_COMPILE = "-std=c++20";
+
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
   ];
 
   buildInputs = [
+    kcmutils
     kcoreaddons
     kdeclarative
     kdecoration
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 15914d94400d..03a8b930bc92 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -320,6 +320,7 @@ let
       IPV6_SEG6_LWTUNNEL = yes;
       IPV6_SEG6_HMAC = yes;
       IPV6_SEG6_BPF = yes;
+      NET_CLS_ACT = yes;
       NET_CLS_BPF = module;
       NET_ACT_BPF = module;
       NET_SCHED = yes;
@@ -487,7 +488,15 @@ let
 
     video =
       let
-        whenHasDevicePrivate = lib.mkIf (!stdenv.hostPlatform.isx86_32);
+        whenHasDevicePrivate = lib.mkIf (
+          with stdenv.hostPlatform;
+          isLoongArch64
+          || isPower64
+          || isS390x
+          || isx86_64
+          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || (lib.versionAtLeast version "6.11" && isRiscV64)
+        );
       in
       {
         # compile in DRM so simpledrm can load before initrd if necessary
@@ -521,9 +530,9 @@ let
         DRM_DP_AUX_CHARDEV = whenOlder "6.10" yes;
         DRM_DISPLAY_DP_AUX_CHARDEV = whenAtLeast "6.10" yes;
         # amdgpu display core (DC) support
-        DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes;
-        DRM_AMD_DC_DCN2_0 = whenOlder "5.6" yes;
-        DRM_AMD_DC_DCN2_1 = whenOlder "5.6" yes;
+        DRM_AMD_DC_DCN1_0 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
+        DRM_AMD_DC_DCN2_0 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
+        DRM_AMD_DC_DCN2_1 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
         DRM_AMD_DC_DCN3_0 = lib.mkIf (with stdenv.hostPlatform; isx86) (whenBetween "5.9" "5.11" yes);
         DRM_AMD_DC_DCN = lib.mkIf (with stdenv.hostPlatform; isx86 || isPower64) (
           whenBetween "5.11" "6.4" yes
@@ -806,7 +815,10 @@ let
 
       SECURITY_DMESG_RESTRICT = yes;
 
-      RANDOM_TRUST_CPU = whenOlder "6.2" yes; # allow RDRAND to seed the RNG
+      RANDOM_TRUST_CPU = lib.mkIf (
+        with stdenv.hostPlatform;
+        isPower64 || isS390 || isx86 || (lib.versionAtLeast version "5.6" && isAarch64)
+      ) (whenOlder "6.2" yes); # allow RDRAND to seed the RNG
       RANDOM_TRUST_BOOTLOADER = whenOlder "6.2" yes; # allow the bootloader to seed the RNG
 
       MODULE_SIG = no; # r13y, generates a random key during build and bakes it in
@@ -1085,7 +1097,11 @@ let
       {
         # stdenv.hostPlatform.linux-kernel.target assumes uncompressed on RISC-V.
         KERNEL_UNCOMPRESSED = lib.mkIf stdenv.hostPlatform.isRiscV yes;
-        KERNEL_XZ = lib.mkIf (!stdenv.hostPlatform.isRiscV && !useZstd) yes;
+
+        KERNEL_XZ = lib.mkIf (
+          with stdenv.hostPlatform; (isAarch32 || isMips || isPower || isS390 || isx86) && !useZstd
+        ) yes;
+
         KERNEL_ZSTD = lib.mkIf (
           with stdenv.hostPlatform;
           (isMips || isS390 || isx86 || (lib.versionAtLeast version "6.1" && isAarch64 || isLoongArch64))
@@ -1255,7 +1271,15 @@ let
         NVME_TARGET_AUTH = whenAtLeast "6.0" yes;
         NVME_TARGET_TCP_TLS = whenAtLeast "6.7" yes;
 
-        PCI_P2PDMA = lib.mkIf (stdenv.hostPlatform.is64bit) yes;
+        PCI_P2PDMA = lib.mkIf (
+          with stdenv.hostPlatform;
+          isLoongArch64
+          || isPower64
+          || isS390x
+          || isx86_64
+          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || (lib.versionAtLeast version "6.11" && isRiscV64)
+        ) yes;
 
         PSI = yes;
 
@@ -1322,12 +1346,21 @@ let
 
         # Enable AMD's ROCm GPU compute stack
         HSA_AMD = lib.mkIf stdenv.hostPlatform.is64bit yes;
+        ZONE_DEVICE = lib.mkIf (
+          with stdenv.hostPlatform;
+          isLoongArch64
+          || isPower64
+          || isS390x
+          || isx86_64
+          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || (lib.versionAtLeast version "6.11" && isRiscV64)
+        ) yes;
+
         # required for P2P DMABUF
         DMABUF_MOVE_NOTIFY = lib.mkIf stdenv.hostPlatform.is64bit (whenAtLeast "6.6" yes);
         # required for P2P transfers between accelerators
         HSA_AMD_P2P = lib.mkIf stdenv.hostPlatform.is64bit (whenAtLeast "6.6" yes);
 
-        ZONE_DEVICE = lib.mkIf stdenv.hostPlatform.is64bit yes;
         HMM_MIRROR = yes;
         DRM_AMDGPU_USERPTR = yes;
 
@@ -1404,7 +1437,15 @@ let
             MEMORY_HOTPLUG = yes;
             MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.14" yes;
             MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.14" yes;
-            MEMORY_HOTREMOVE = yes;
+            MEMORY_HOTREMOVE = lib.mkIf (
+              with stdenv.hostPlatform;
+              isLoongArch64
+              || isPower
+              || isS390
+              || isx86
+              || (lib.versionAtLeast version "5.7" && isAarch64)
+              || (lib.versionAtLeast version "6.11" && isRiscV)
+            ) yes;
             HOTPLUG_CPU = yes;
             MIGRATION = yes;
             SPARSEMEM = yes;
@@ -1423,6 +1464,7 @@ let
             CROS_EC_I2C = module;
             CROS_EC_SPI = module;
             CROS_KBD_LED_BACKLIGHT = module;
+            MFD_CROS_EC = whenOlder "5.10" module;
             TCG_TIS_SPI_CR50 = whenAtLeast "5.5" yes;
           }
       //
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index a16ef1cccabe..cd3fc4a73b21 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -65,7 +65,7 @@ let
       # optionally be compressed with gzip or bzip2.
       kernelPatches ? [ ],
       ignoreConfigErrors ?
-        !lib.elem stdenv.hostPlatform.linux-kernel.name [
+        !lib.elem stdenv.hostPlatform.linux-kernel.name or "" [
           "aarch64-multiplatform"
           "pc"
         ],
@@ -78,7 +78,7 @@ let
       isHardened ? false,
 
       # easy overrides to stdenv.hostPlatform.linux-kernel members
-      autoModules ? stdenv.hostPlatform.linux-kernel.autoModules,
+      autoModules ? stdenv.hostPlatform.linux-kernel.autoModules or true,
       preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false,
       kernelArch ? stdenv.hostPlatform.linuxArch,
       kernelTests ? { },
@@ -205,10 +205,9 @@ let
 
         RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
 
-        platformName = stdenv.hostPlatform.linux-kernel.name;
         # e.g. "defconfig"
         kernelBaseConfig =
-          if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
+          if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig or "defconfig";
 
         makeFlags = import ./common-flags.nix {
           inherit
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 36a70941f046..33dcd77fcbb3 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -160,6 +160,8 @@ lib.makeOverridable (
         isModular = config.isYes "MODULES";
         withRust = config.isYes "RUST";
 
+        target = kernelConf.target or "vmlinux";
+
         buildDTBs = kernelConf.DTB or false;
 
         # Dependencies that are required to build kernel modules
@@ -332,7 +334,7 @@ lib.makeOverridable (
 
         buildFlags = [
           "KBUILD_BUILD_VERSION=1-NixOS"
-          kernelConf.target
+          target
           "vmlinux" # for "perf" and things like that
           "scripts_gdb"
         ]
@@ -413,14 +415,10 @@ lib.makeOverridable (
         # Some image types need special install targets (e.g. uImage is installed with make uinstall on arm)
         installTargets = [
           (kernelConf.installTarget or (
-            if kernelConf.target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then
+            if target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then
               "uinstall"
             else if
-              (
-                kernelConf.target == "zImage"
-                || kernelConf.target == "Image.gz"
-                || kernelConf.target == "vmlinuz.efi"
-              )
+              (target == "zImage" || target == "Image.gz" || target == "vmlinuz.efi")
               && builtins.elem stdenv.hostPlatform.linuxArch [
                 "arm"
                 "arm64"
diff --git a/pkgs/os-specific/linux/scx/default.nix b/pkgs/os-specific/linux/scx/default.nix
index f8d0dbf72f53..2383882a226e 100644
--- a/pkgs/os-specific/linux/scx/default.nix
+++ b/pkgs/os-specific/linux/scx/default.nix
@@ -1,41 +1,10 @@
 {
   lib,
   callPackage,
-  fetchFromGitHub,
 }:
-let
-  scx-common = rec {
-    versionInfo = lib.importJSON ./version.json;
 
-    inherit (versionInfo.scx) version;
-
-    src = fetchFromGitHub {
-      owner = "sched-ext";
-      repo = "scx";
-      tag = "v${versionInfo.scx.version}";
-      inherit (versionInfo.scx) hash;
-    };
-
-    meta = {
-      homepage = "https://github.com/sched-ext/scx";
-      changelog = "https://github.com/sched-ext/scx/releases/tag/v${versionInfo.scx.version}";
-      license = lib.licenses.gpl2Only;
-      platforms = lib.platforms.linux;
-      badPlatforms = [ "aarch64-linux" ];
-      maintainers = with lib.maintainers; [
-        johnrtitor
-        Gliczy
-      ];
-    };
-  };
-
-  schedulers = lib.mergeAttrsList [
-    { cscheds = import ./scx_cscheds.nix; }
-    { rustscheds = import ./scx_rustscheds.nix; }
-    { full = import ./scx_full.nix; }
-  ];
-in
-(lib.mapAttrs (name: scheduler: callPackage scheduler { inherit scx-common; }) schedulers)
-// {
-  inherit scx-common;
+lib.mapAttrs (name: scheduler: callPackage scheduler { }) {
+  cscheds = import ./scx_cscheds.nix;
+  rustscheds = import ./scx_rustscheds.nix;
+  full = import ./scx_full.nix;
 }
diff --git a/pkgs/os-specific/linux/scx/scx_cscheds.nix b/pkgs/os-specific/linux/scx/scx_cscheds.nix
index a487493bad5b..c9f419c59b3c 100644
--- a/pkgs/os-specific/linux/scx/scx_cscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_cscheds.nix
@@ -1,76 +1,30 @@
 {
-  lib,
   llvmPackages,
-  fetchFromGitHub,
-  writeShellScript,
-  bash,
-  meson,
-  ninja,
-  jq,
+  libbpf,
   pkg-config,
   bpftools,
   elfutils,
   zlib,
   zstd,
-  scx-common,
-  protobuf,
+  scx,
   libseccomp,
 }:
 
-llvmPackages.stdenv.mkDerivation (finalAttrs: {
+llvmPackages.stdenv.mkDerivation {
   pname = "scx_cscheds";
-  inherit (scx-common) version src;
-
-  # scx needs specific commits of bpftool and libbpf
-  # can be found in meson.build of scx src
-  # grep 'bpftool_commit =' ./meson.build
-  bpftools_src = fetchFromGitHub {
-    owner = "libbpf";
-    repo = "bpftool";
-    inherit (scx-common.versionInfo.bpftool) rev hash;
-    fetchSubmodules = true;
-  };
-  # grep 'libbpf_commit = ' ./meson.build
-  libbpf_src = fetchFromGitHub {
-    owner = "libbpf";
-    repo = "libbpf";
-    inherit (scx-common.versionInfo.libbpf) rev hash;
-    fetchSubmodules = true;
-  };
-
-  # this imitates the fetch_bpftool and fetch_libbpf script in src/meson-scripts
-  fetchBpftool = writeShellScript "fetch_bpftool" ''
-    [ "$2" == '${finalAttrs.bpftools_src.rev}' ] || exit 1
-    cd "$1"
-    cp --no-preserve=mode,owner -r "${finalAttrs.bpftools_src}/" ./bpftool
-  '';
-  fetchLibbpf = writeShellScript "fetch_libbpf" ''
-    [ "$2" == '${finalAttrs.libbpf_src.rev}' ] || exit 1
-    cd "$1"
-    cp --no-preserve=mode,owner -r "${finalAttrs.libbpf_src}/" ./libbpf
-    mkdir -p ./libbpf/src/usr/include
-  '';
+  inherit (scx.rustscheds) version src;
 
   postPatch = ''
-    rm meson-scripts/fetch_bpftool meson-scripts/fetch_libbpf
-    patchShebangs ./meson-scripts
-    cp ${finalAttrs.fetchBpftool} meson-scripts/fetch_bpftool
-    cp ${finalAttrs.fetchLibbpf} meson-scripts/fetch_libbpf
-    substituteInPlace ./meson-scripts/build_bpftool \
-      --replace-fail '/bin/bash' '${lib.getExe bash}'
+    substituteInPlace ./scheds/c/Makefile \
+      --replace-fail '/usr/local' '${placeholder "out"}'
   '';
 
   nativeBuildInputs = [
-    meson
-    ninja
-    jq
     pkg-config
     zstd
-    protobuf
-    llvmPackages.libllvm
-  ]
-  ++ bpftools.buildInputs
-  ++ bpftools.nativeBuildInputs;
+    bpftools
+    libbpf
+  ];
 
   buildInputs = [
     elfutils
@@ -78,37 +32,21 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     libseccomp
   ];
 
-  mesonFlags = [
-    (lib.mapAttrsToList lib.mesonEnable {
-      # systemd unit is implemented in the nixos module
-      # upstream systemd files are a hassle to patch
-      "systemd" = false;
-      # not for nix
-      "openrc" = false;
-    })
-    (lib.mapAttrsToList lib.mesonBool {
-      # needed libs are already fetched as FOD
-      "offline" = true;
-      # rust based schedulers are built separately
-      "enable_rust" = false;
-    })
-    # Clang to use when compiling .bpf.c
-    (lib.mesonOption "bpf_clang" (lib.getExe llvmPackages.clang))
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
   ];
 
   hardeningDisable = [
-    "stackprotector"
     "zerocallusedregs"
   ];
 
-  outputs = [
-    "bin"
-    "out"
-  ];
-
   doCheck = true;
 
-  meta = scx-common.meta // {
+  passthru = {
+    inherit (scx.rustscheds.passthru) tests;
+  };
+
+  meta = scx.rustscheds.meta // {
     description = "Sched-ext C userspace schedulers";
     longDescription = ''
       This includes C based schedulers such as scx_central, scx_flatcg,
@@ -119,5 +57,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
       It is recommended to use the latest kernel for the best compatibility.
       :::
     '';
+    homepage = "https://github.com/sched-ext/scx/tree/main/scheds/c";
   };
-})
+}
diff --git a/pkgs/os-specific/linux/scx/scx_full.nix b/pkgs/os-specific/linux/scx/scx_full.nix
index f47e92e8b96e..8edcfbee8c70 100644
--- a/pkgs/os-specific/linux/scx/scx_full.nix
+++ b/pkgs/os-specific/linux/scx/scx_full.nix
@@ -1,20 +1,13 @@
 {
   lib,
-  stdenv,
-  scx-common,
   scx,
-  nixosTests,
 }:
 scx.cscheds.overrideAttrs (oldAttrs: {
   pname = "scx_full";
   postInstall = (oldAttrs.postInstall or "") + ''
-    cp ${scx.rustscheds}/bin/* ${placeholder "bin"}/bin/
+    cp ${lib.getBin scx.rustscheds}/bin/* ${placeholder "out"}/bin/
   '';
 
-  passthru.tests.basic = nixosTests.scx;
-
-  passthru.updateScript.command = ./update.sh;
-
   meta = oldAttrs.meta // {
     description = "Sched-ext C and Rust userspace schedulers";
     longDescription = ''
@@ -27,5 +20,6 @@ scx.cscheds.overrideAttrs (oldAttrs: {
       It is recommended to use the latest kernel for the best compatibility.
       :::
     '';
+    homepage = "https://github.com/sched-ext/scx";
   };
 })
diff --git a/pkgs/os-specific/linux/scx/scx_rustscheds.nix b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
index c43bfee59861..87665e5a1c78 100644
--- a/pkgs/os-specific/linux/scx/scx_rustscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
@@ -6,15 +6,24 @@
   elfutils,
   zlib,
   zstd,
-  scx-common,
+  fetchFromGitHub,
   protobuf,
   libseccomp,
+  nix-update-script,
+  nixosTests,
 }:
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "scx_rustscheds";
-  inherit (scx-common) version src;
+  version = "1.0.17";
 
-  inherit (scx-common.versionInfo.scx) cargoHash;
+  src = fetchFromGitHub {
+    owner = "sched-ext";
+    repo = "scx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UhFHT8cSrdjhSqjj4qFzn5UvfPOLPwrBh1ytL2gFhzU=";
+  };
+
+  cargoHash = "sha256-yQM2zx1IzGjegwLK4epsluWl8m5RSP3jB00Lpd8+TLE=";
 
   nativeBuildInputs = [
     pkg-config
@@ -39,7 +48,6 @@ rustPlatform.buildRustPackage {
   };
 
   hardeningDisable = [
-    "stackprotector"
     "zerocallusedregs"
   ];
 
@@ -53,7 +61,10 @@ rustPlatform.buildRustPackage {
     "--skip=proc_data::tests::test_thread_operations"
   ];
 
-  meta = scx-common.meta // {
+  passthru.tests.basic = nixosTests.scx;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Sched-ext Rust userspace schedulers";
     longDescription = ''
       This includes Rust based schedulers such as
@@ -64,5 +75,15 @@ rustPlatform.buildRustPackage {
       It is recommended to use the latest kernel for the best compatibility.
       :::
     '';
+
+    homepage = "https://github.com/sched-ext/scx/tree/main/scheds/rust";
+    changelog = "https://github.com/sched-ext/scx/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    badPlatforms = [ "aarch64-linux" ];
+    maintainers = with lib.maintainers; [
+      johnrtitor
+      Gliczy
+    ];
   };
-}
+})
diff --git a/pkgs/os-specific/linux/scx/update.sh b/pkgs/os-specific/linux/scx/update.sh
deleted file mode 100755
index dd516aebaefd..000000000000
--- a/pkgs/os-specific/linux/scx/update.sh
+++ /dev/null
@@ -1,57 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils moreutils curl jq nix-prefetch-git cargo gnugrep gawk nix
-# shellcheck shell=bash
-
-# You must run it from the root directory of a nixpkgs repo checkout
-
-set -euo pipefail
-
-versionJson="$(realpath "./pkgs/os-specific/linux/scx/version.json")"
-nixFolder="$(dirname "$versionJson")"
-
-localVer=$(jq -r .scx.version <$versionJson)
-latestVer=$(curl -s https://api.github.com/repos/sched-ext/scx/releases/latest | jq -r .tag_name | sed 's/v//g')
-
-if [ "$localVer" == "$latestVer" ]; then
-  exit 0
-fi
-
-latestHash=$(nix-prefetch-git https://github.com/sched-ext/scx.git --rev refs/tags/v$latestVer --quiet | jq -r .hash)
-
-tmp=$(mktemp -d)
-trap 'rm -rf -- "${tmp}"' EXIT
-
-git clone --depth 1 --branch "v$latestVer" https://github.com/sched-ext/scx.git "$tmp/scx"
-
-pushd "$tmp/scx"
-
-bpftoolRev=$(grep 'bpftool_commit =' ./meson.build | awk -F"'" '{print $2}')
-bpftoolHash=$(nix-prefetch-git https://github.com/libbpf/bpftool.git --rev $bpftoolRev --fetch-submodules --quiet | jq -r .hash)
-
-libbpfRev=$(grep 'libbpf_commit =' ./meson.build | awk -F"'" '{print $2}')
-libbpfHash=$(nix-prefetch-git https://github.com/libbpf/libbpf.git --rev $libbpfRev --fetch-submodules --quiet | jq -r .hash)
-
-jq \
-  --arg latestVer "$latestVer" --arg latestHash "$latestHash" \
-  --arg bpftoolRev "$bpftoolRev" --arg bpftoolHash "$bpftoolHash" \
-  --arg libbpfRev "$libbpfRev" --arg libbpfHash "$libbpfHash" \
-  ".scx.version = \$latestVer | .scx.hash = \$latestHash |\
-  .bpftool.rev = \$bpftoolRev | .bpftool.hash = \$bpftoolHash |\
-  .libbpf.rev = \$libbpfRev | .libbpf.hash = \$libbpfHash" \
-  "$versionJson" | sponge $versionJson
-
-echo "scx: $localVer -> $latestVer"
-
-echo "Updating cargoHash. This may take a while..."
-popd
-cargoHash=$((nix-build --attr scx.rustscheds 2>&1 || true) | awk '/got/{print $2}')
-
-if [ -z "$cargoHash" ]; then
-  echo "Failed to get cargoHash, please update it manually"
-  exit 0
-fi
-
-jq \
-  --arg cargoHash "$cargoHash" \
-  ".scx.cargoHash = \$cargoHash" \
-  "$versionJson" | sponge $versionJson
diff --git a/pkgs/os-specific/linux/scx/version.json b/pkgs/os-specific/linux/scx/version.json
deleted file mode 100644
index f655beec2bb9..000000000000
--- a/pkgs/os-specific/linux/scx/version.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "scx": {
-    "version": "1.0.17",
-    "hash": "sha256-UhFHT8cSrdjhSqjj4qFzn5UvfPOLPwrBh1ytL2gFhzU=",
-    "cargoHash": "sha256-yQM2zx1IzGjegwLK4epsluWl8m5RSP3jB00Lpd8+TLE="
-  },
-  "bpftool": {
-    "rev": "183e7010387d1fc9f08051426e9a9fbd5f8d409e",
-    "hash": "sha256-ZZly6csVWOmtLmld1fhSDUqyRgZx2gSMGXTaSASGv7c="
-  },
-  "libbpf": {
-    "rev": "b4fa3e39a77fd65574fb5f899486795fc3d89bd9",
-    "hash": "sha256-wlymVgcLlGCUOC92CkYU6QZZnqx8nidSfhr1pTiS8aM="
-  }
-}
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index d242ff7c9287..02845eb126f6 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,7 +13,7 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 882cda0dcd..8e8d1f04ce 100644
+index bebc4d7d09..60278a0da7 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
 @@ -30,10 +30,6 @@ SUBSYSTEM=="block", ACTION=="add", KERNEL=="dm-*", ENV{DM_NAME}!="?*", ENV{SYSTE
@@ -24,6 +24,6 @@ index 882cda0dcd..8e8d1f04ce 100644
 -# we are probably still calling mke2fs or mkswap on it.
 -SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
 -
- # add symlink to GPT root disk
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
+ # Ignore raid devices that are not yet assembled and started
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 9e3496986859..d1dcbfd37a0f 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -14,10 +14,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index d6a256c4a7..f74d5198f1 100644
+index 57ab68deb6..8e281b8f2c 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -66,6 +66,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -72,6 +72,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -27,10 +27,10 @@ index d6a256c4a7..f74d5198f1 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 84da5eed63..d6e2f36d52 100644
+index 45c6db9245..d7283b7fa6 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -175,8 +175,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
+@@ -178,8 +178,10 @@ int mount_points_list_get(FILE *f, MountPoint **head) {
  static bool nonunmountable_path(const char *path) {
          assert(path);
  
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 7cc2804a05bb..3815c140d495 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 6f90f2f418..74b2a237d3 100644
+index ab8746c442..480a9c55c6 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -6189,6 +6189,7 @@ static int run(int argc, char *argv[]) {
+@@ -6165,6 +6165,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,11 +21,11 @@ index 6f90f2f418..74b2a237d3 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -6208,6 +6209,7 @@ static int run(int argc, char *argv[]) {
+@@ -6184,6 +6185,7 @@ static int run(int argc, char *argv[]) {
                                  log_error_errno(r, "Unable to determine if %s looks like it has an OS tree (i.e. whether /usr/ exists): %m", arg_directory);
                                  goto finish;
                          }
 +#endif
                  }
  
-         } else {
+                 if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index 2657eb9089d1..81d17a57fb2f 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -16,10 +16,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 7 insertions(+), 21 deletions(-)
 
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index f3b85b0190..f7aa5fca50 100644
+index 58f2463104..0c263430a7 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
-@@ -43,10 +43,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
+@@ -46,10 +46,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
  systemd_user_conf_dir=${sysconfdir}/systemd/user
  systemduserconfdir=${systemd_user_conf_dir}
  
@@ -32,7 +32,7 @@ index f3b85b0190..f7aa5fca50 100644
  systemduserunitpath=${systemd_user_unit_path}
  
  systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
-@@ -55,10 +55,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
+@@ -58,10 +58,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
  systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
  systemdusergeneratordir=${systemd_user_generator_dir}
  
@@ -46,10 +46,10 @@ index f3b85b0190..f7aa5fca50 100644
  
  systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
 diff --git a/src/libsystemd/sd-path/path-lookup.c b/src/libsystemd/sd-path/path-lookup.c
-index a3b09208cb..91a085c6bc 100644
+index 3ddbda0e9f..3eddc80c90 100644
 --- a/src/libsystemd/sd-path/path-lookup.c
 +++ b/src/libsystemd/sd-path/path-lookup.c
-@@ -69,11 +69,7 @@ int runtime_directory(RuntimeScope scope, const char *suffix, char **ret) {
+@@ -64,11 +64,7 @@ int runtime_directory(RuntimeScope scope, const char *suffix, char **ret) {
  }
  
  static const char* const user_data_unit_paths[] = {
@@ -61,7 +61,7 @@ index a3b09208cb..91a085c6bc 100644
          NULL
  };
  
-@@ -481,16 +477,13 @@ int lookup_paths_init(
+@@ -476,16 +472,13 @@ int lookup_paths_init(
                                         persistent_config,
                                         SYSTEM_CONFIG_UNIT_DIR,
                                         "/etc/systemd/system",
@@ -79,7 +79,7 @@ index a3b09208cb..91a085c6bc 100644
                                         STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -508,13 +501,10 @@ int lookup_paths_init(
+@@ -503,13 +496,10 @@ int lookup_paths_init(
                          add = strv_new(persistent_config,
                                         USER_CONFIG_UNIT_DIR,
                                         "/etc/systemd/user",
@@ -95,7 +95,7 @@ index a3b09208cb..91a085c6bc 100644
                          break;
  
                  case RUNTIME_SCOPE_USER:
-@@ -653,7 +643,6 @@ void lookup_paths_log(LookupPaths *lp) {
+@@ -648,7 +638,6 @@ void lookup_paths_log(LookupPaths *lp) {
  static const char* const system_generator_paths[] = {
          "/run/systemd/system-generators",
          "/etc/systemd/system-generators",
@@ -103,7 +103,7 @@ index a3b09208cb..91a085c6bc 100644
          SYSTEM_GENERATOR_DIR,
          NULL,
  };
-@@ -661,7 +650,6 @@ static const char* const system_generator_paths[] = {
+@@ -656,7 +645,6 @@ static const char* const system_generator_paths[] = {
  static const char* const user_generator_paths[] = {
          "/run/systemd/user-generators",
          "/etc/systemd/user-generators",
@@ -111,7 +111,7 @@ index a3b09208cb..91a085c6bc 100644
          USER_GENERATOR_DIR,
          NULL,
  };
-@@ -669,7 +657,6 @@ static const char* const user_generator_paths[] = {
+@@ -664,7 +652,6 @@ static const char* const user_generator_paths[] = {
  static const char* const system_env_generator_paths[] = {
          "/run/systemd/system-environment-generators",
          "/etc/systemd/system-environment-generators",
@@ -119,7 +119,7 @@ index a3b09208cb..91a085c6bc 100644
          SYSTEM_ENV_GENERATOR_DIR,
          NULL,
  };
-@@ -677,7 +664,6 @@ static const char* const system_env_generator_paths[] = {
+@@ -672,7 +659,6 @@ static const char* const system_env_generator_paths[] = {
  static const char* const user_env_generator_paths[] = {
          "/run/systemd/user-environment-generators",
          "/etc/systemd/user-environment-generators",
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index 6c4a41ab0609..2f7139911220 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 4ccaba9054..9577b89783 100644
+index d85896577f..2a4782a55e 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1672,7 +1672,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1575,7 +1575,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 44bd2263ddf0..b43dddb3d420 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index ba50b59f92..9827487453 100644
+index 06fb3f2878..b656e511b7 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -1115,6 +1115,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1388,6 +1388,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index ba50b59f92..9827487453 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -1177,6 +1180,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1454,6 +1457,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,10 +35,10 @@ index ba50b59f92..9827487453 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 062744519d..95bde4b1c3 100644
+index 11d9130bbc..dd4d9e59ea 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -226,6 +226,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+@@ -221,6 +221,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
  
          use_localegen = locale_gen_check_available();
  
@@ -48,7 +48,7 @@ index 062744519d..95bde4b1c3 100644
          /* If single locale without variable name is provided, then we assume it is LANG=. */
          if (strv_length(l) == 1 && !strchr(l[0], '=')) {
                  if (!locale_is_valid(l[0]))
-@@ -343,6 +346,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+@@ -338,6 +341,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -58,7 +58,7 @@ index 062744519d..95bde4b1c3 100644
          vc_context_empty_to_null(&in);
  
          r = vc_context_verify_and_warn(&in, LOG_ERR, error);
-@@ -460,6 +466,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+@@ -455,6 +461,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -69,10 +69,10 @@ index 062744519d..95bde4b1c3 100644
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index c79bb864df..cbd30214b7 100644
+index 662cc29ac5..57f3413dc6 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -676,6 +676,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -678,6 +678,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index c79bb864df..cbd30214b7 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -754,6 +758,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -756,6 +760,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index c79bb864df..cbd30214b7 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -948,6 +955,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -954,6 +961,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 1f4184e92836..21589efdd849 100644
--- a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -7,10 +7,10 @@ NixOS uses this path.
 ---
  man/localtime.xml         | 4 ++--
  src/basic/time-util.c     | 8 ++++----
- src/firstboot/firstboot.c | 2 +-
+ src/firstboot/firstboot.c | 9 +++------
  src/nspawn/nspawn.c       | 4 ++--
  src/timedate/timedated.c  | 8 ++++----
- 5 files changed, 13 insertions(+), 13 deletions(-)
+ 5 files changed, 15 insertions(+), 18 deletions(-)
 
 diff --git a/man/localtime.xml b/man/localtime.xml
 index 3a13e04a27..4fd58068a1 100644
@@ -35,10 +35,10 @@ index 3a13e04a27..4fd58068a1 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 29afb08ebc..398ff340cd 100644
+index 55931a2546..2e00bd7539 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1418,7 +1418,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1410,7 +1410,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 29afb08ebc..398ff340cd 100644
          if (!f)
                  return -errno;
  
-@@ -1459,7 +1459,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1451,7 +1451,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 29afb08ebc..398ff340cd 100644
          if (!f)
                  return -errno;
  
-@@ -1570,7 +1570,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1562,7 +1562,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 29afb08ebc..398ff340cd 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1622,7 +1622,7 @@ int get_timezone(char **ret) {
+@@ -1614,7 +1614,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* Return EINVAL if not a symlink */
  
@@ -75,23 +75,38 @@ index 29afb08ebc..398ff340cd 100644
                  return -EINVAL;
          if (!timezone_is_valid(e, LOG_DEBUG))
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index a389eeae10..c817e91991 100644
+index 5ed6d3a9d2..f922d91a9d 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -598,7 +598,7 @@ static int process_timezone(int rfd) {
+@@ -618,7 +618,7 @@ static int prompt_timezone(int rfd) {
+ 
+ static int process_timezone(int rfd) {
+         _cleanup_close_ int pfd = -EBADF;
+-        _cleanup_free_ char *f = NULL, *relpath = NULL;
++        _cleanup_free_ char *f = NULL;
+         const char *e;
+         int r;
+ 
+@@ -664,12 +664,9 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
--        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
+-        e = strjoina("/usr/share/zoneinfo/", arg_timezone);
+-        r = path_make_relative_parent(etc_localtime(), e, &relpath);
+-        if (r < 0)
+-                return r;
 +        e = strjoina("zoneinfo/", arg_timezone);
  
-         r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
+-        r = symlinkat_atomic_full(relpath, pfd, f, SYMLINK_LABEL);
++        r = symlinkat_atomic_full(e, pfd, f, SYMLINK_LABEL);
          if (r < 0)
+                 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
+ 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 74b2a237d3..cf9eabf0f2 100644
+index 480a9c55c6..02c9ae6608 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1851,8 +1851,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1821,8 +1821,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,10 +118,10 @@ index 74b2a237d3..cf9eabf0f2 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index cbd30214b7..b9b2f533a4 100644
+index 57f3413dc6..6a456fe601 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -280,7 +280,7 @@ static int context_read_data(Context *c) {
+@@ -266,7 +266,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -115,24 +130,24 @@ index cbd30214b7..b9b2f533a4 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -304,7 +304,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -290,7 +290,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
 -                if (access("/usr/share/zoneinfo/UTC", F_OK) < 0) {
 +                if (access("/etc/zoneinfo/UTC", F_OK) < 0) {
  
-                         if (unlink("/etc/localtime") < 0 && errno != ENOENT)
+                         if (unlink(etc_localtime()) < 0 && errno != ENOENT)
                                  return -errno;
-@@ -312,9 +312,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -298,9 +298,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
--                source = "../usr/share/zoneinfo/UTC";
-+                source = "../etc/zoneinfo/UTC";
+-                source = "/usr/share/zoneinfo/UTC";
++                source = "/etc/zoneinfo/UTC";
          } else {
--                p = path_join("../usr/share/zoneinfo", c->zone);
-+                p = path_join("../etc/zoneinfo", c->zone);
+-                p = path_join("/usr/share/zoneinfo", c->zone);
++                p = path_join("/etc/zoneinfo", c->zone);
                  if (!p)
                          return -ENOMEM;
  
diff --git a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
index c670f076c34a..6c348219872f 100644
--- a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,15 +10,15 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index 36dbeb9daa..265eda2751 100644
+index c595f81b40..90033f6566 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -301,7 +301,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -302,7 +302,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  
 -        f = fopen("/usr/share/X11/xkb/rules/base.lst", "re");
 +        f = fopen("/etc/X11/xkb/rules/base.lst", "re");
          if (!f)
-                 return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
+                 return log_error_errno(errno, "Failed to open keyboard mapping list: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
index bf9f028d6300..beb8acc61732 100644
--- a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,10 +12,10 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 5aaf8f535c..934175fb51 100644
+index 7a09fbf878..ee3378f109 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -62,13 +62,15 @@
+@@ -40,13 +40,15 @@
          "/etc/" n "\0"                          \
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
diff --git a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 20b4641ac000..b05fc609d6ed 100644
--- a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,7 +10,7 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index e26a8579c5..af814cd551 100644
+index 3317068e47..021a3c0699 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
 @@ -358,6 +358,7 @@ static void notify_supervisor(void) {
diff --git a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 13578115a014..bfded1bba554 100644
--- a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 181bb4ccef..2b1410d8a1 100644
+index 3390ebe0c0..affc823bc4 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -218,6 +218,7 @@ static int execute(
+@@ -248,6 +248,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 9e29c34efcd7..1168d1249858 100644
--- a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,10 +10,10 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index dff5a3a549..01344e5cf6 100644
+index 45518c07e5..94bef2f4b4 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -17,10 +17,10 @@
+@@ -9,10 +9,10 @@
  #define PATH_MERGED_BIN(x) x "bin"
  #define PATH_MERGED_BIN_NULSTR(x) x "bin\0"
  
diff --git a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
index 856fdee93475..1c4ce37dde34 100644
--- a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 9577b89783..9cfd2798b9 100644
+index 2a4782a55e..8dfdc227a1 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4158,9 +4158,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3977,9 +3977,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
index fbaaed99cb61..445b08d2289f 100644
--- a/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
@@ -17,10 +17,10 @@ See also: https://github.com/systemd/systemd/issues/24191
  1 file changed, 8 deletions(-)
 
 diff --git a/src/core/taint.c b/src/core/taint.c
-index b7a1c647a2..c04864c478 100644
+index 8872a224b2..bc736e2ef8 100644
 --- a/src/core/taint.c
 +++ b/src/core/taint.c
-@@ -41,14 +41,6 @@ char** taint_strv(void) {
+@@ -42,14 +42,6 @@ char** taint_strv(void) {
  
          _cleanup_free_ char *bin = NULL, *usr_sbin = NULL, *var_run = NULL;
  
diff --git a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
index fe8ac0ddd913..9f73ff0de547 100644
--- a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,10 +27,10 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index 5b6b3ea93c..8ab04241b6 100644
+index 57e7a91f93..faf45e4807 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -721,7 +721,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -724,7 +724,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
diff --git a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
index 50dd842cc221..de846e9410b3 100644
--- a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+++ b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -30,10 +30,10 @@ are written into `$XDG_CONFIG_HOME/systemd/user`.
  1 file changed, 3 insertions(+)
 
 diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
-index 7165fa1cf7..7498cf9f4c 100644
+index 53bc57186a..0ed12ce931 100644
 --- a/src/systemctl/systemctl-edit.c
 +++ b/src/systemctl/systemctl-edit.c
-@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+@@ -330,6 +330,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
          sd_bus *bus;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
index 65cd257a8a41..2e3ada02a901 100644
--- a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
+++ b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson.build: do not create systemdstatedir
  1 file changed, 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index a4730f0570..b5aaecd669 100644
+index 238b935372..b0b67c9b99 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2815,7 +2815,6 @@ install_data('LICENSE.GPL2',
+@@ -2791,7 +2791,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
diff --git a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch b/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
index da170d869ad7..472bd260caf3 100644
--- a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
+++ b/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson: Don't link ssh dropins
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index b5aaecd669..91b23f2d72 100644
+index b0b67c9b99..4721b7482b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -207,13 +207,13 @@ sshconfdir = get_option('sshconfdir')
+@@ -219,13 +219,13 @@ sshconfdir = get_option('sshconfdir')
  if sshconfdir == ''
          sshconfdir = sysconfdir / 'ssh/ssh_config.d'
  endif
diff --git a/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch b/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
index 4d7ceedcbab0..7372b5214e59 100644
--- a/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
+++ b/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] install: unit_file_exists_full: follow symlinks
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/install.c b/src/shared/install.c
-index 6d87858a3c..8da022eb64 100644
+index 8195436564..dfbc35f357 100644
 --- a/src/shared/install.c
 +++ b/src/shared/install.c
-@@ -3226,7 +3226,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
+@@ -3227,7 +3227,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
                          &c,
                          lp,
                          name,
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
index a1b1575a51d2..be03316306b6 100644
--- a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+++ b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -13,10 +13,10 @@ directly.
  1 file changed, 11 insertions(+)
 
 diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
-index d002501d29..9b835dc031 100644
+index 40305c046b..c3ed57c54e 100644
 --- a/src/timesync/timesyncd.c
 +++ b/src/timesync/timesyncd.c
-@@ -23,6 +23,11 @@
+@@ -25,6 +25,11 @@
  #include "timesyncd-conf.h"
  #include "timesyncd-manager.h"
  #include "user-util.h"
@@ -28,7 +28,7 @@ index d002501d29..9b835dc031 100644
  
  static int advance_tstamp(int fd, usec_t epoch) {
          assert(fd >= 0);
-@@ -201,6 +206,12 @@ static int run(int argc, char *argv[]) {
+@@ -203,6 +208,12 @@ static int run(int argc, char *argv[]) {
          if (r < 0)
                  return log_error_errno(r, "Failed to parse fallback server strings: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index ca3d876d33fe..964ebdf07d2b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -56,7 +56,6 @@
   elfutils,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   gnutls,
-  iptables,
   withSelinux ? false,
   libselinux,
   withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
@@ -200,12 +199,10 @@ let
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
   releaseTimestamp = "1734643670";
-
-  kbd' = if withPam then kbd else kbd.override { withVlock = false; };
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "257.9";
+  version = "258";
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
   # This has proven to be less error-prone than the previous systemd fork.
@@ -213,7 +210,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3Ig5TXhK99iOu41k4c5CgC4R3HhBftSAb9UbXvFY6lo=";
+    hash = "sha256-xtGZaVNsBNxkidgfVBu8xtvj0SxpY6OyJCUE+gq59qE=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -225,6 +222,18 @@ stdenv.mkDerivation (finalAttrs: {
   # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all
   # patches
   patches = [
+    # https://github.com/systemd/systemd/pull/39094
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/0f44a6c64aebc64a0611a605831206afee9cb730.patch";
+      hash = "sha256-DO6q17mE2U8iLezMYt4PX5Ror20N1gCrUbXeQmrW1is=";
+    })
+
+    # https://github.com/systemd/systemd/pull/39069
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/b5fdfedf729712b9824a5cb457a07d5699d2946c.patch";
+      hash = "sha256-0SvAn9Dl4z80PRIvDbIVIjKp5DsT/IUoHa5IiH1HHFY=";
+    })
+
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch
@@ -253,55 +262,39 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ]
-  ++ lib.optionals stdenv.hostPlatform.isMusl (
-    let
-      # NOTE: the master-next branch does not have stable URLs.
-      # If we need patches that aren't in master yet, they'll have to be
-      # vendored.
-      oe-core = fetchzip {
-        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-4891f47cdaf919033bf1c02cc12e4805e5db99a0.tar.gz";
-        hash = "sha256-YKL/oC+rPZ2EEVNidEV+pJihZgUv7vLb0OASplgktn4=";
-      };
-    in
-    map (patch: "${oe-core}/meta/recipes-core/systemd/systemd/${patch}") [
-      "0003-missing_type.h-add-comparison_fn_t.patch"
-      "0004-add-fallback-parse_printf_format-implementation.patch"
-      "0005-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch"
-      "0006-add-missing-FTW_-macros-for-musl.patch"
-      "0007-Use-uintmax_t-for-handling-rlim_t.patch"
-      "0008-Define-glibc-compatible-basename-for-non-glibc-syste.patch"
-      "0009-Do-not-disable-buffering-when-writing-to-oom_score_a.patch"
-      "0010-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch"
-      "0011-avoid-redefinition-of-prctl_mm_map-structure.patch"
-      "0012-do-not-disable-buffer-in-writing-files.patch"
-      "0013-Handle-__cpu_mask-usage.patch"
-      "0014-Handle-missing-gshadow.patch"
-      "0015-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch"
-      "0016-pass-correct-parameters-to-getdents64.patch"
-      "0017-Adjust-for-musl-headers.patch"
-      "0018-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch"
-      "0019-errno-util-Make-STRERROR-portable-for-musl.patch"
-      "0020-sd-event-Make-malloc_trim-conditional-on-glibc.patch"
-      "0021-shared-Do-not-use-malloc_info-on-musl.patch"
-      "0022-avoid-missing-LOCK_EX-declaration.patch"
-      "0023-include-signal.h-to-avoid-the-undeclared-error.patch"
-      "0024-undef-stdin-for-references-using-stdin-as-a-struct-m.patch"
-      "0025-adjust-header-inclusion-order-to-avoid-redeclaration.patch"
-      "0026-build-path.c-avoid-boot-time-segfault-for-musl.patch"
-    ]
-    ++ [
-      # add a missing include
-      (fetchpatch {
-        url = "https://github.com/systemd/systemd/commit/34fcd3638817060c79e1186b370e46d9b3a7409f.patch";
-        hash = "sha256-Uaewo3jPrZGJttlLcqO6cCj1w3IGZmvbur4+TBdIPxc=";
-        excludes = [ "src/udev/udevd.c" ];
-      })
-      (fetchpatch {
-        url = "https://gitlab.postmarketos.org/postmarketOS/systemd/-/commit/5760be33bd26d7e7c66a7294c5f6fd6c7044683f.patch";
-        hash = "sha256-Om+OhGyZJfZNpbtMInm3vGagLbbtOY71fDMZXj6pbPY=";
-      })
-    ]
-  );
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    # Patchset to build with musl by an upstream systemd contributor:
+    # https://github.com/systemd/systemd/pull/37788
+    # This is vendored here because of the lack of permanent patch urls for the unmerged PR
+    ./musl/0001-musl-meson-allow-to-choose-libc-implementation.patch
+    ./musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch
+    ./musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch
+    ./musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch
+    ./musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch
+    ./musl/0006-musl-meson-check-existence-of-renameat2.patch
+    ./musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch
+    ./musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch
+    ./musl/0009-musl-add-fallback-parse_printf_format-implementation.patch
+    ./musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch
+    ./musl/0011-musl-make-strptime-accept-z.patch
+    ./musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch
+    ./musl/0013-musl-introduce-strerrorname_np.patch
+    ./musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch
+    ./musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch
+    ./musl/0016-musl-define-__THROW-when-not-defined.patch
+    ./musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch
+    ./musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch
+    ./musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch
+    ./musl/0020-musl-add-several-missing-statx-macros.patch
+    ./musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch
+    ./musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch
+    ./musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch
+    ./musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch
+    ./musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch
+    ./musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch
+    ./musl/0027-musl-time-util-skip-tm.tm_wday-check.patch
+    ./musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch
+  ];
 
   postPatch = ''
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
@@ -373,6 +366,7 @@ stdenv.mkDerivation (finalAttrs: {
         jinja2
       ]
       ++ lib.optional withEfi ps.pyelftools
+      ++ lib.optional (withUkify && finalAttrs.finalPackage.doCheck) ps.pefile
     ))
   ]
   ++ lib.optionals withLibBPF [
@@ -475,8 +469,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig")
 
     # Keyboard
-    (lib.mesonOption "loadkeys-path" "${kbd'}/bin/loadkeys")
-    (lib.mesonOption "setfont-path" "${kbd'}/bin/setfont")
+    (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
+    (lib.mesonOption "setfont-path" "${kbd}/bin/setfont")
 
     # SBAT
     (lib.mesonOption "sbat-distro" "nixos")
@@ -577,7 +571,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "gnutls" false)
     (lib.mesonEnable "xkbcommon" false)
     (lib.mesonEnable "man" true)
-    # (lib.mesonEnable "nspawn" withNspawn) # nspawn build can be turned off on systemd 258, on 257.x it will just not be installed in systemdLibs but the build is unconditional
+    (lib.mesonEnable "nspawn" withNspawn)
 
     (lib.mesonBool "analyze" withAnalyze)
     (lib.mesonBool "logind" withLogind)
@@ -612,6 +606,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "zshcompletiondir" "no")
   ]
   ++ lib.optionals stdenv.hostPlatform.isMusl [
+    (lib.mesonOption "libc" "musl")
     (lib.mesonBool "gshadow" false)
     (lib.mesonBool "idn" false)
   ];
@@ -854,7 +849,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     ${lib.optionalString (
       !buildLibsOnly
-    ) "$out/bin/udevadm verify --resolve-names=never --no-style $out/lib/udev/rules.d"}
+    ) "$out/bin/udevadm verify --resolve-names=late --no-style $out/lib/udev/rules.d"}
 
     runHook postInstallCheck
   '';
@@ -924,10 +919,9 @@ stdenv.mkDerivation (finalAttrs: {
       withUtmp
       util-linux
       kmod
+      kbd
       ;
 
-    kbd = kbd';
-
     # Many TPM2-related units are only installed if this trio of features are
     # enabled. See https://github.com/systemd/systemd/blob/876ee10e0eb4bbb0920bdab7817a9f06cc34910f/units/meson.build#L521
     withTpm2Units = withTpm2Tss && withBootloader && withOpenSSL;
@@ -988,7 +982,6 @@ stdenv.mkDerivation (finalAttrs: {
             systemd-journal
             systemd-journal-gateway
             systemd-journal-upload
-            systemd-lock-handler
             systemd-machinectl
             systemd-networkd
             systemd-networkd-bridge
diff --git a/pkgs/os-specific/linux/systemd/musl/0001-musl-meson-allow-to-choose-libc-implementation.patch b/pkgs/os-specific/linux/systemd/musl/0001-musl-meson-allow-to-choose-libc-implementation.patch
new file mode 100644
index 000000000000..a40515f9ec29
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0001-musl-meson-allow-to-choose-libc-implementation.patch
@@ -0,0 +1,96 @@
+From 0e2b9909fed24a682c8566f9df8bbac4e9347186 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 7 Jul 2025 14:11:19 +0900
+Subject: [PATCH 01/30] musl: meson: allow to choose libc implementation
+
+This also introduces skelton directories for storing musl specific code.
+---
+ meson.build               | 17 +++++++++++++++--
+ meson_options.txt         |  2 ++
+ src/libc/meson.build      |  2 ++
+ src/libc/musl/meson.build |  5 +++++
+ 4 files changed, 24 insertions(+), 2 deletions(-)
+ create mode 100644 src/libc/musl/meson.build
+
+diff --git a/meson.build b/meson.build
+index 238b935372..bea62f0eb6 100644
+--- a/meson.build
++++ b/meson.build
+@@ -72,7 +72,10 @@ conf.set10('SD_BOOT', false)
+ 
+ # Create a title-less summary section early, so it ends up first in the output.
+ # More items are added later after they have been detected.
+-summary({'build mode' : get_option('mode')})
++summary({
++        'libc'       : get_option('libc'),
++        'build mode' : get_option('mode'),
++})
+ 
+ #####################################################################
+ 
+@@ -2042,7 +2045,14 @@ dbus_programs = []
+ boot_stubs = []
+ 
+ # This is similar to system_includes below, but for passing custom_target().
+-system_include_args = [
++system_include_args = []
++if get_option('libc') == 'musl'
++        system_include_args += [
++                '-isystem', meson.project_build_root()  / 'src/include/musl',
++                '-isystem', meson.project_source_root() / 'src/include/musl',
++        ]
++endif
++system_include_args += [
+         '-isystem', meson.project_build_root()  / 'src/include/override',
+         '-isystem', meson.project_source_root() / 'src/include/override',
+         '-isystem', meson.project_build_root()  / 'src/include/uapi',
+@@ -2060,6 +2070,9 @@ system_includes = [
+                 is_system : true,
+         ),
+ ]
++if get_option('libc') == 'musl'
++        system_includes += include_directories('src/include/musl', is_system : true)
++endif
+ 
+ basic_includes = [
+         include_directories(
+diff --git a/meson_options.txt b/meson_options.txt
+index d8dec33ec4..ad203ba301 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -397,6 +397,8 @@ option('ima', type : 'boolean',
+ option('ipe', type : 'boolean',
+        description : 'IPE support')
+ 
++option('libc', type : 'combo', choices : ['glibc', 'musl'],
++       description : 'libc implementation to be used')
+ option('acl', type : 'feature', deprecated : { 'true' : 'enabled', 'false' : 'disabled' },
+        description : 'libacl support')
+ option('audit', type : 'feature', deprecated : { 'true' : 'enabled', 'false' : 'disabled' },
+diff --git a/src/libc/meson.build b/src/libc/meson.build
+index eeee98c9d6..306512ffd7 100644
+--- a/src/libc/meson.build
++++ b/src/libc/meson.build
+@@ -16,6 +16,8 @@ libc_wrapper_sources = files(
+         'xattr.c',
+ )
+ 
++subdir('musl')
++
+ sources += libc_wrapper_sources
+ 
+ libc_wrapper_static = static_library(
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+new file mode 100644
+index 0000000000..a876230c67
+--- /dev/null
++++ b/src/libc/musl/meson.build
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: LGPL-2.1-or-later
++
++if get_option('libc') != 'musl'
++        subdir_done()
++endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch b/pkgs/os-specific/linux/systemd/musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch
new file mode 100644
index 000000000000..b59b77dd7712
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0002-musl-meson-do-not-use-libcrypt-libxcrypt.patch
@@ -0,0 +1,38 @@
+From 03010a0716f509b448c84a35bc2723a6f08e0c09 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Wed, 23 Jul 2025 10:24:14 +0900
+Subject: [PATCH 02/30] musl: meson: do not use libcrypt/libxcrypt
+
+Otherwise, when both glibc and musl are installed, libxcrypt or glibc's
+libcrypt may be picked even when we are building systemd with musl.
+Let's not use libcrypt/libxcrypt in that case.
+---
+ meson.build | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index bea62f0eb6..06be36409f 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1013,10 +1013,14 @@ else
+         libatomic = []
+ endif
+ 
+-libcrypt = dependency('libcrypt', 'libxcrypt', required : false)
+-if not libcrypt.found()
+-        # fallback to use find_library() if libcrypt is provided by glibc, e.g. for LibreELEC.
+-        libcrypt = cc.find_library('crypt')
++if get_option('libc') == 'musl'
++        libcrypt = []
++else
++        libcrypt = dependency('libcrypt', 'libxcrypt', required : false)
++        if not libcrypt.found()
++                # fallback to use find_library() if libcrypt is provided by glibc, e.g. for LibreELEC.
++                libcrypt = cc.find_library('crypt')
++        endif
+ endif
+ 
+ foreach func : [
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch b/pkgs/os-specific/linux/systemd/musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch
new file mode 100644
index 000000000000..000c6c65d6f6
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0003-musl-meson-explicitly-link-with-libintl-when-necessa.patch
@@ -0,0 +1,56 @@
+From bf4cb5aeeef23c5f12e6d2258bb8f3d12059f59f Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sat, 6 Sep 2025 16:25:41 +0900
+Subject: [PATCH 03/30] musl: meson: explicitly link with libintl when
+ necessary
+
+On some musl based distributions provides dgettext() by libintl.so.
+Hence, we need to add dependency in that case.
+---
+ meson.build          | 17 +++++++++++++++++
+ src/home/meson.build |  1 +
+ 2 files changed, 18 insertions(+)
+
+diff --git a/meson.build b/meson.build
+index 06be36409f..054752c339 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1002,6 +1002,23 @@ libm = cc.find_library('m')
+ libdl = cc.find_library('dl')
+ libcap = dependency('libcap')
+ 
++# On some distributions that uses musl (e.g. Alpine), libintl.h may be provided by gettext rather than musl.
++# In that case, we need to explicitly link with libintl.so.
++if get_option('libc') == 'musl'
++        if cc.has_function('dgettext', prefix : '''#include <libintl.h>''', args : '-D_GNU_SOURCE')
++                libintl = []
++        else
++                libintl = cc.find_library('intl')
++                if not cc.has_function('dgettext', prefix : '''#include <libintl.h>''', args : '-D_GNU_SOURCE',
++                                       dependencies : libintl)
++                        error('dgettext() not found.')
++                endif
++        endif
++else
++        # When building with glibc, we assume that libintl.h is provided by glibc.
++        libintl = []
++endif
++
+ # On some architectures, libatomic is required. But on some installations,
+ # it is found, but actual linking fails. So let's try to use it opportunistically.
+ # If it is installed, but not needed, it will be dropped because of --as-needed.
+diff --git a/src/home/meson.build b/src/home/meson.build
+index 1937e6f56c..3305334707 100644
+--- a/src/home/meson.build
++++ b/src/home/meson.build
+@@ -115,6 +115,7 @@ modules += [
+                 'sources' : pam_systemd_home_sources,
+                 'dependencies' : [
+                         libcrypt,
++                        libintl,
+                         libpam_misc,
+                         libpam,
+                         threads,
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch b/pkgs/os-specific/linux/systemd/musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch
new file mode 100644
index 000000000000..17de4bd3b5dd
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0004-musl-meson-explicitly-set-_LARGEFILE64_SOURCE.patch
@@ -0,0 +1,32 @@
+From 59f993d1acb069f3f2b7d6c71b91696388692702 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 10 Jun 2025 00:29:46 +0900
+Subject: [PATCH 04/30] musl: meson: explicitly set _LARGEFILE64_SOURCE
+
+glibc sets it when _GNU_SOURCE is defined, however, musl does not.
+Let's explicitly define it to make getdents64() and struct dirent64
+available even when building with musl.
+---
+ meson.build | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/meson.build b/meson.build
+index 054752c339..37fb1c2765 100644
+--- a/meson.build
++++ b/meson.build
+@@ -560,6 +560,12 @@ conf.set10('HAVE_WARNING_ZERO_AS_NULL_POINTER_CONSTANT', have)
+ conf.set('_GNU_SOURCE', 1)
+ conf.set('__SANE_USERSPACE_TYPES__', true)
+ 
++if get_option('libc') == 'musl'
++        # glibc always defines _LARGEFILE64_SOURCE when _GNU_SOURCE is set, but musl does not do that,
++        # and it is necessary for making getdents64() and struct dirent64 exist.
++        conf.set('_LARGEFILE64_SOURCE', 1)
++endif
++
+ conf.set('SIZEOF_DEV_T', cc.sizeof('dev_t', prefix : '#include <sys/types.h>'))
+ conf.set('SIZEOF_INO_T', cc.sizeof('ino_t', prefix : '#include <sys/types.h>'))
+ conf.set('SIZEOF_RLIM_T', cc.sizeof('rlim_t', prefix : '#include <sys/resource.h>'))
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch b/pkgs/os-specific/linux/systemd/musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch
new file mode 100644
index 000000000000..faab7be7ca92
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0005-musl-meson-make-musl-not-define-wchar_t-in-their-hea.patch
@@ -0,0 +1,31 @@
+From a8cc582e42dd9fd6b2304003f3e5ab7637c21b73 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 9 Jun 2025 13:37:38 +0900
+Subject: [PATCH 05/30] musl: meson: make musl not define wchar_t in their
+ header
+
+Otherwise, musl defines wchar_t as int, which conflicts with the
+assumption by sd-boot, i.e. wchar_t is 2 bytes.
+---
+ src/boot/meson.build | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/boot/meson.build b/src/boot/meson.build
+index ba0b309acf..bea96bb2e3 100644
+--- a/src/boot/meson.build
++++ b/src/boot/meson.build
+@@ -179,6 +179,11 @@ if get_option('mode') == 'developer' and get_option('debug')
+         efi_c_args += '-DEFI_DEBUG'
+ endif
+ 
++if get_option('libc') == 'musl'
++        # To make musl not define wchar_t as int, rather than short.
++        efi_c_args += '-D__DEFINED_wchar_t'
++endif
++
+ efi_c_ld_args = [
+         '-nostdlib',
+         '-static-pie',
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0006-musl-meson-check-existence-of-renameat2.patch b/pkgs/os-specific/linux/systemd/musl/0006-musl-meson-check-existence-of-renameat2.patch
new file mode 100644
index 000000000000..9109275b4eb8
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0006-musl-meson-check-existence-of-renameat2.patch
@@ -0,0 +1,91 @@
+From b9904ed6818232d9ad9bb496747b79a6c9606819 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 9 Jun 2025 13:00:37 +0900
+Subject: [PATCH 06/30] musl: meson: check existence of renameat2()
+
+musl-1.2.5 does not provide renameat2(). Note, it is added by
+https://github.com/kraj/musl/commit/05ce67fea99ca09cd4b6625cff7aec9cc222dd5a,
+hence hopefully it will be provided by musl-1.2.6 or newer.
+---
+ meson.build               |  5 +++++
+ src/include/musl/stdio.h  | 13 +++++++++++++
+ src/libc/musl/meson.build |  4 ++++
+ src/libc/musl/stdio.c     | 11 +++++++++++
+ 4 files changed, 33 insertions(+)
+ create mode 100644 src/include/musl/stdio.h
+ create mode 100644 src/libc/musl/stdio.c
+
+diff --git a/meson.build b/meson.build
+index 37fb1c2765..71e422f545 100644
+--- a/meson.build
++++ b/meson.build
+@@ -581,6 +581,7 @@ assert(long_max > 100000)
+ conf.set_quoted('LONG_MAX_STR', '@0@'.format(long_max))
+ 
+ foreach ident : [
++        ['renameat2',         '''#include <stdio.h>''',         get_option('libc') == 'musl'], # since musl-1.2.6
+         ['set_mempolicy',     '''#include <sys/syscall.h>'''],  # declared at numaif.h provided by libnuma, which we do not use
+         ['get_mempolicy',     '''#include <sys/syscall.h>'''],  # declared at numaif.h provided by libnuma, which we do not use
+         ['strerrorname_np',   '''#include <string.h>'''],       # since glibc-2.32
+@@ -614,6 +615,10 @@ foreach ident : [
+         ['pivot_root',        '''#include <unistd.h>'''],       # no known header declares pivot_root
+ ]
+ 
++        if ident.length() >= 3 and not ident[2]
++                continue
++        endif
++
+         have = cc.has_function(ident[0], prefix : ident[1], args : '-D_GNU_SOURCE')
+         conf.set10('HAVE_' + ident[0].to_upper(), have)
+ endforeach
+diff --git a/src/include/musl/stdio.h b/src/include/musl/stdio.h
+new file mode 100644
+index 0000000000..d677201f45
+--- /dev/null
++++ b/src/include/musl/stdio.h
+@@ -0,0 +1,13 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <stdio.h>
++
++#if !HAVE_RENAMEAT2
++#  define RENAME_NOREPLACE (1 << 0)
++#  define RENAME_EXCHANGE  (1 << 1)
++#  define RENAME_WHITEOUT  (1 << 2)
++
++int missing_renameat2(int __oldfd, const char *__old, int __newfd, const char *__new, unsigned __flags);
++#  define renameat2 missing_renameat2
++#endif
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index a876230c67..8d06d919ef 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -3,3 +3,7 @@
+ if get_option('libc') != 'musl'
+         subdir_done()
+ endif
++
++libc_wrapper_sources += files(
++        'stdio.c',
++)
+diff --git a/src/libc/musl/stdio.c b/src/libc/musl/stdio.c
+new file mode 100644
+index 0000000000..102a22cd5c
+--- /dev/null
++++ b/src/libc/musl/stdio.c
+@@ -0,0 +1,11 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <stdio.h>
++#include <sys/syscall.h>
++#include <unistd.h>
++
++#if !HAVE_RENAMEAT2
++int missing_renameat2(int __oldfd, const char *__old, int __newfd, const char *__new, unsigned __flags) {
++        return syscall(__NR_renameat2, __oldfd, __old, __newfd, __new, __flags);
++}
++#endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch b/pkgs/os-specific/linux/systemd/musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch
new file mode 100644
index 000000000000..8f3d16510d20
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0007-musl-meson-gracefully-disable-gshadow-idn-nss-and-ut.patch
@@ -0,0 +1,91 @@
+From 1a5f752e2a80e206474f04fe5c1990fdb08742bd Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 22 Jun 2025 02:16:25 +0900
+Subject: [PATCH 07/30] musl: meson: gracefully disable gshadow, idn, nss, and
+ utmp support
+
+- musl does not support gshadow, and does not provide gshadow.h,
+- musl does not provide NI_IDN flag,
+- musl does not support nss, and does not provide nss.h which is necessary
+  for each nss modules,
+- musl does not support utmp, and all utmp related functions do nothing,
+  see https://github.com/kraj/musl/blob/v1.2.5/src/legacy/utmpx.c
+---
+ meson.build | 33 ++++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 71e422f545..5f235d5113 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1638,11 +1638,9 @@ foreach term : ['analyze',
+                 'efi',
+                 'environment-d',
+                 'firstboot',
+-                'gshadow',
+                 'hibernate',
+                 'hostnamed',
+                 'hwdb',
+-                'idn',
+                 'ima',
+                 'ipe',
+                 'initrd',
+@@ -1654,8 +1652,6 @@ foreach term : ['analyze',
+                 'mountfsd',
+                 'networkd',
+                 'nsresourced',
+-                'nss-myhostname',
+-                'nss-systemd',
+                 'oomd',
+                 'portabled',
+                 'pstore',
+@@ -1671,7 +1667,6 @@ foreach term : ['analyze',
+                 'tmpfiles',
+                 'tpm',
+                 'userdb',
+-                'utmp',
+                 'vconsole',
+                 'xdg-autostart']
+         have = get_option(term)
+@@ -1681,14 +1676,34 @@ endforeach
+ 
+ enable_sysusers = conf.get('ENABLE_SYSUSERS') == 1
+ 
++foreach term : ['gshadow',
++                'idn',
++                'nss-myhostname',
++                'nss-systemd',
++                'utmp']
++
++        have = get_option(term)
++        if have and get_option('libc') == 'musl'
++                warning('@0@ support is requested but it is not supported when building with musl, disabling it.'.format(term))
++                have = false
++        endif
++        name = 'ENABLE_' + term.underscorify().to_upper()
++        conf.set10(name, have)
++endforeach
++
+ foreach tuple : [['nss-mymachines', 'machined'],
+                  ['nss-resolve',    'resolve']]
+         want = get_option(tuple[0])
+-        if want.allowed()
+-                have = get_option(tuple[1])
+-                if want.enabled() and not have
+-                        error('@0@ is requested but @1@ is disabled'.format(tuple[0], tuple[1]))
++        if want.enabled()
++                if get_option('libc') == 'musl'
++                        error('@0@ is requested but it is not supported when building with musl.'.format(tuple[0]))
+                 endif
++                if not get_option(tuple[1])
++                        error('@0@ is requested but @1@ is disabled.'.format(tuple[0], tuple[1]))
++                endif
++                have = true
++        elif want.allowed()
++                have = get_option(tuple[1]) and get_option('libc') != 'musl'
+         else
+                 have = false
+         endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch b/pkgs/os-specific/linux/systemd/musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch
new file mode 100644
index 000000000000..50bc22cfe678
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0008-musl-introduce-dummy-gshadow-header-file-for-userdb.patch
@@ -0,0 +1,44 @@
+From 7e023763fb7f56b7c1ea6fa139d79ec2c3e0164f Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 21 Sep 2025 15:24:06 +0900
+Subject: [PATCH 08/30] musl: introduce dummy gshadow header file for userdb
+
+Even 'gshadow' meson option is disabled, src/shared/userdb.c and
+src/shared/user-record-nss.c include gshadow.h unconditionally.
+Let's introduce dummy header to make them compiled gracefully.
+---
+ src/include/musl/gshadow.h | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+ create mode 100644 src/include/musl/gshadow.h
+
+diff --git a/src/include/musl/gshadow.h b/src/include/musl/gshadow.h
+new file mode 100644
+index 0000000000..b57c74ca83
+--- /dev/null
++++ b/src/include/musl/gshadow.h
+@@ -0,0 +1,22 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include <errno.h>
++#include <stddef.h>
++
++struct sgrp {
++        char *sg_namp;
++        char *sg_passwd;
++        char **sg_adm;
++        char **sg_mem;
++};
++
++static inline int getsgnam_r(
++                const char *__name,
++                struct sgrp *__result_buf,
++                char *__buffer,
++                size_t __buflen,
++                struct sgrp **__result) {
++
++        return EOPNOTSUPP; /* this function returns positive errno in case of error. */
++}
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0009-musl-add-fallback-parse_printf_format-implementation.patch b/pkgs/os-specific/linux/systemd/musl/0009-musl-add-fallback-parse_printf_format-implementation.patch
new file mode 100644
index 000000000000..d4347746067e
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0009-musl-add-fallback-parse_printf_format-implementation.patch
@@ -0,0 +1,447 @@
+From 444acef17881cbc27057bd85b7dc07b332c03d67 Mon Sep 17 00:00:00 2001
+From: Emil Renner Berthing <systemd@esmil.dk>
+Date: Sat, 22 May 2021 20:26:24 +0200
+Subject: [PATCH 09/30] musl: add fallback parse_printf_format() implementation
+
+musl does not provide parse_printf_format(). Let's introduce a fallback
+method.
+
+Co-authored-by: Yu Watanabe <watanabe.yu+github@gmail.com>
+---
+ src/include/musl/printf.h |  35 +++++
+ src/libc/musl/meson.build |   1 +
+ src/libc/musl/printf.c    | 276 ++++++++++++++++++++++++++++++++++++++
+ src/test/meson.build      |   6 +
+ src/test/test-printf.c    |  67 +++++++++
+ 5 files changed, 385 insertions(+)
+ create mode 100644 src/include/musl/printf.h
+ create mode 100644 src/libc/musl/printf.c
+ create mode 100644 src/test/test-printf.c
+
+diff --git a/src/include/musl/printf.h b/src/include/musl/printf.h
+new file mode 100644
+index 0000000000..4242392c89
+--- /dev/null
++++ b/src/include/musl/printf.h
+@@ -0,0 +1,35 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++/* Copyright 2014 Emil Renner Berthing <systemd@esmil.dk> */
++#pragma once
++
++#include <features.h>
++#include <stddef.h>
++
++#ifdef __GLIBC__
++#include_next <printf.h>
++#else
++
++enum {              /* C type: */
++        PA_INT,     /* int */
++        PA_CHAR,    /* int, cast to char */
++        PA_WCHAR,   /* wide char */
++        PA_STRING,  /* const char *, a '\0'-terminated string */
++        PA_WSTRING, /* const wchar_t *, wide character string */
++        PA_POINTER, /* void * */
++        PA_FLOAT,   /* float */
++        PA_DOUBLE,  /* double */
++        PA_LAST,
++};
++
++/* Flag bits that can be set in a type returned by `parse_printf_format'.  */
++#  define PA_FLAG_MASK        0xff00
++#  define PA_FLAG_LONG_LONG   (1 << 8)
++#  define PA_FLAG_LONG_DOUBLE PA_FLAG_LONG_LONG
++#  define PA_FLAG_LONG        (1 << 9)
++#  define PA_FLAG_SHORT       (1 << 10)
++#  define PA_FLAG_PTR         (1 << 11)
++
++#  define parse_printf_format missing_parse_printf_format
++#endif
++
++size_t missing_parse_printf_format(const char *fmt, size_t n, int *types);
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index 8d06d919ef..3e205e1eb1 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -5,5 +5,6 @@ if get_option('libc') != 'musl'
+ endif
+ 
+ libc_wrapper_sources += files(
++        'printf.c',
+         'stdio.c',
+ )
+diff --git a/src/libc/musl/printf.c b/src/libc/musl/printf.c
+new file mode 100644
+index 0000000000..33c4acd27f
+--- /dev/null
++++ b/src/libc/musl/printf.c
+@@ -0,0 +1,276 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++/* Copyright 2014 Emil Renner Berthing <systemd@esmil.dk> */
++
++#include <limits.h>
++#include <../musl/printf.h> /* This file is also compiled when built with glibc. */
++#include <stdint.h>
++#include <string.h>
++
++static const char* consume_nonarg(const char *fmt) {
++        do {
++                if (*fmt == '\0')
++                        return fmt;
++        } while (*fmt++ != '%');
++        return fmt;
++}
++
++static const char* consume_num(const char *fmt) {
++        for (;*fmt >= '0' && *fmt <= '9'; fmt++)
++                /* do nothing */;
++        return fmt;
++}
++
++static const char* consume_argn(const char *fmt, size_t *arg) {
++        const char *p = fmt;
++        size_t val = 0;
++
++        if (*p < '1' || *p > '9')
++                return fmt;
++        do {
++                val = 10*val + (*p++ - '0');
++        } while (*p >= '0' && *p <= '9');
++
++        if (*p != '$')
++                return fmt;
++        *arg = val;
++        return p+1;
++}
++
++static const char* consume_flags(const char *fmt) {
++        for (;;)
++                switch (*fmt) {
++                case '#':
++                case '0':
++                case '-':
++                case ' ':
++                case '+':
++                case '\'':
++                case 'I':
++                        fmt++;
++                        continue;
++                default:
++                        return fmt;
++                }
++}
++
++enum state {
++        BARE,
++        LPRE,
++        LLPRE,
++        HPRE,
++        HHPRE,
++        BIGLPRE,
++        ZTPRE,
++        JPRE,
++        STOP,
++};
++
++enum type {
++        NONE,
++        PTR,
++        STR,
++        WSTR,
++        INT,
++        LONG,
++        LLONG,
++        SHORT,
++        IMAX,
++        SIZET,
++        CHAR,
++        WCHAR,
++        PDIFF,
++        DBL,
++        LDBL,
++        NPTR,
++        MAXTYPE,
++};
++
++static const short pa_types[MAXTYPE] = {
++        [NONE]   = PA_INT,
++        [PTR]    = PA_POINTER,
++        [STR]    = PA_STRING,
++        [WSTR]   = PA_WSTRING,
++        [INT]    = PA_INT,
++        [SHORT]  = PA_INT | PA_FLAG_SHORT,
++        [LONG]   = PA_INT | PA_FLAG_LONG,
++        [CHAR]   = PA_CHAR,
++        [WCHAR]  = PA_WCHAR,
++        [DBL]    = PA_DOUBLE,
++        [LDBL]   = PA_DOUBLE | PA_FLAG_LONG_DOUBLE,
++        [NPTR]   = PA_FLAG_PTR,
++};
++
++static int state_to_pa_type(unsigned state) {
++        switch (state) {
++        case LLONG:
++#if LONG_MAX != LLONG_MAX
++                return PA_INT | PA_FLAG_LONG_LONG;
++#else
++                return PA_INT | PA_FLAG_LONG;
++#endif
++
++        case IMAX:
++#if LONG_MAX != LLONG_MAX
++                if (sizeof(intmax_t) > sizeof(long))
++                        return PA_INT | PA_FLAG_LONG_LONG;
++#endif
++                if (sizeof(intmax_t) > sizeof(int))
++                        return PA_INT | PA_FLAG_LONG;
++                return PA_INT;
++
++        case SIZET:
++#if LONG_MAX != LLONG_MAX
++                if (sizeof(size_t) > sizeof(long))
++                        return PA_INT | PA_FLAG_LONG_LONG;
++#endif
++                if (sizeof(size_t) > sizeof(int))
++                        return PA_INT | PA_FLAG_LONG;
++                return PA_INT;
++        default:
++                return pa_types[state];
++        }
++}
++
++#define S(x) [(x)-'A']
++#define E(x) (STOP + (x))
++
++static const unsigned char states[]['z'-'A'+1] = {
++        { /* 0: bare types */
++                S('d') = E(INT),    S('i') = E(INT),
++                S('o') = E(INT),    S('u') = E(INT),    S('x') = E(INT),    S('X') = E(INT),
++                S('e') = E(DBL),    S('f') = E(DBL),    S('g') = E(DBL),    S('a') = E(DBL),
++                S('E') = E(DBL),    S('F') = E(DBL),    S('G') = E(DBL),    S('A') = E(DBL),
++                S('c') = E(CHAR),   S('C') = E(WCHAR),
++                S('s') = E(STR),    S('S') = E(WSTR),   S('p') = E(PTR),
++                S('n') = E(NPTR),
++                S('m') = E(NONE),
++                S('l') = LPRE,      S('q') = LLPRE,     S('h') = HPRE,      S('L') = BIGLPRE,
++                S('z') = ZTPRE,     S('Z') = ZTPRE,     S('j') = JPRE,      S('t') = ZTPRE,
++        },
++        { /* 1: l-prefixed */
++                S('d') = E(LONG),   S('i') = E(LONG),
++                S('o') = E(LONG),   S('u') = E(LONG),   S('x') = E(LONG),   S('X') = E(LONG),
++                S('e') = E(DBL),    S('f') = E(DBL),    S('g') = E(DBL),    S('a') = E(DBL),
++                S('E') = E(DBL),    S('F') = E(DBL),    S('G') = E(DBL),    S('A') = E(DBL),
++                S('c') = E(CHAR),   S('s') = E(STR),
++                S('n') = E(NPTR),
++                S('l') = LLPRE,
++        },
++        { /* 2: ll-prefixed */
++                S('d') = E(LLONG),  S('i') = E(LLONG),
++                S('o') = E(LLONG),  S('u') = E(LLONG),  S('x') = E(LLONG),  S('X') = E(LLONG),
++                S('n') = E(NPTR),
++        },
++        { /* 3: h-prefixed */
++                S('d') = E(SHORT),  S('i') = E(SHORT),
++                S('o') = E(SHORT),  S('u') = E(SHORT),  S('x') = E(SHORT),  S('X') = E(SHORT),
++                S('n') = E(NPTR),
++                S('h') = HHPRE,
++        },
++        { /* 4: hh-prefixed */
++                S('d') = E(CHAR),   S('i') = E(CHAR),
++                S('o') = E(CHAR),   S('u') = E(CHAR),   S('x') = E(CHAR),   S('X') = E(CHAR),
++                S('n') = E(NPTR),
++        },
++        { /* 5: L-prefixed */
++                S('e') = E(LDBL),   S('f') = E(LDBL),   S('g') = E(LDBL),   S('a') = E(LDBL),
++                S('E') = E(LDBL),   S('F') = E(LDBL),   S('G') = E(LDBL),   S('A') = E(LDBL),
++        },
++        { /* 6: z- or t-prefixed (assumed to be same size) */
++                S('d') = E(SIZET),  S('i') = E(SIZET),
++                S('o') = E(SIZET),  S('u') = E(SIZET),  S('x') = E(SIZET),  S('X') = E(SIZET),
++                S('n') = E(NPTR),
++        },
++        { /* 7: j-prefixed */
++                S('d') = E(IMAX),   S('i') = E(IMAX),
++                S('o') = E(IMAX),   S('u') = E(IMAX),   S('x') = E(IMAX),   S('X') = E(IMAX),
++                S('n') = E(NPTR),
++        },
++};
++
++size_t missing_parse_printf_format(const char *fmt, size_t n, int *types) {
++        size_t i = 0;
++        size_t last = 0;
++
++        memset(types, 0, n);
++
++        for (;;) {
++                size_t arg;
++
++                fmt = consume_nonarg(fmt);
++                if (*fmt == '\0')
++                        break;
++                if (*fmt == '%') {
++                        fmt++;
++                        continue;
++                }
++                arg = 0;
++                fmt = consume_argn(fmt, &arg);
++                /* flags */
++                fmt = consume_flags(fmt);
++                /* width */
++                if (*fmt == '*') {
++                        size_t warg = 0;
++                        fmt = consume_argn(fmt+1, &warg);
++                        if (warg == 0)
++                                warg = ++i;
++                        if (warg > last)
++                                last = warg;
++                        if (warg <= n && types[warg-1] == NONE)
++                                types[warg-1] = INT;
++                } else
++                        fmt = consume_num(fmt);
++                /* precision */
++                if (*fmt == '.') {
++                        fmt++;
++                        if (*fmt == '*') {
++                                size_t parg = 0;
++                                fmt = consume_argn(fmt+1, &parg);
++                                if (parg == 0)
++                                        parg = ++i;
++                                if (parg > last)
++                                        last = parg;
++                                if (parg <= n && types[parg-1] == NONE)
++                                        types[parg-1] = INT;
++                        } else {
++                                if (*fmt == '-')
++                                        fmt++;
++                                fmt = consume_num(fmt);
++                        }
++                }
++                /* length modifier and conversion specifier */
++                unsigned state = BARE;
++                for (;;) {
++                        unsigned char c = *fmt;
++
++                        if (c == '\0')
++                                break;
++
++                        fmt++;
++
++                        if (c < 'A' || c > 'z')
++                                break;
++
++                        state = states[state]S(c);
++                        if (state == 0 || state >= STOP)
++                                break;
++                }
++
++                if (state <= STOP) /* %m or invalid format */
++                        continue;
++
++                if (arg == 0)
++                        arg = ++i;
++                if (arg > last)
++                        last = arg;
++                if (arg <= n)
++                        types[arg-1] = state - STOP;
++        }
++
++        if (last > n)
++                last = n;
++        for (i = 0; i < last; i++)
++                types[i] = state_to_pa_type(types[i]);
++
++        return last;
++}
+diff --git a/src/test/meson.build b/src/test/meson.build
+index da04b82d47..1dd61effc0 100644
+--- a/src/test/meson.build
++++ b/src/test/meson.build
+@@ -403,6 +403,12 @@ executables += [
+                 'dependencies' : libacl,
+                 'type' : 'manual',
+         },
++        test_template + {
++                'sources' : files(
++                        'test-printf.c',
++                        '../libc/musl/printf.c'
++                ),
++        },
+         test_template + {
+                 'sources' : files('test-process-util.c'),
+                 'dependencies' : threads,
+diff --git a/src/test/test-printf.c b/src/test/test-printf.c
+new file mode 100644
+index 0000000000..28497e902d
+--- /dev/null
++++ b/src/test/test-printf.c
+@@ -0,0 +1,67 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <../musl/printf.h>
++
++#include "memory-util.h"
++#include "strv.h"
++#include "tests.h"
++
++static void test_parse_printf_format_one(const char *fmt) {
++        int arg_types_x[128] = {}, arg_types_y[128] = {};
++        size_t x, y;
++
++        log_debug("/* %s(%s) */", __func__, fmt);
++
++        x = parse_printf_format(fmt, ELEMENTSOF(arg_types_x), arg_types_x);
++        y = missing_parse_printf_format(fmt, ELEMENTSOF(arg_types_y), arg_types_y);
++
++        for (size_t i = 0; i < x; i++)
++                log_debug("x[%zu]=%i", i, arg_types_x[i]);
++        for (size_t i = 0; i < y; i++)
++                log_debug("y[%zu]=%i", i, arg_types_y[i]);
++
++        ASSERT_EQ(memcmp_nn(arg_types_x, x * sizeof(int), arg_types_y, y * sizeof(int)), 0);
++}
++
++TEST(parse_printf_format) {
++        FOREACH_STRING(s, "d", "i", "o", "u", "x", "X", "n")
++                FOREACH_STRING(p, "", "hh", "h", "l", "ll", "j", "z", "Z", "t") {
++                        _cleanup_free_ char *fmt = NULL;
++
++                        ASSERT_NOT_NULL(fmt = strjoin("%", p, s));
++                        test_parse_printf_format_one(fmt);
++                }
++
++        FOREACH_STRING(s, "e", "E", "f", "F", "g", "G", "a", "A")
++                FOREACH_STRING(p, "", "L") {
++                        _cleanup_free_ char *fmt = NULL;
++
++                        ASSERT_NOT_NULL(fmt = strjoin("%", p, s));
++                        test_parse_printf_format_one(fmt);
++                }
++
++        FOREACH_STRING(s, "c", "s")
++                FOREACH_STRING(p, "", "l") {
++                        _cleanup_free_ char *fmt = NULL;
++
++                        ASSERT_NOT_NULL(fmt = strjoin("%", p, s));
++                        test_parse_printf_format_one(fmt);
++                }
++
++        FOREACH_STRING(s, "C", "S", "p", "m", "%") {
++                _cleanup_free_ char *fmt = NULL;
++
++                ASSERT_NOT_NULL(fmt = strjoin("%", s));
++                test_parse_printf_format_one(fmt);
++        }
++
++        test_parse_printf_format_one("asfhghejmlahpgakdmsalc");
++        test_parse_printf_format_one("%d%i%o%u%x%X");
++        test_parse_printf_format_one("%e%E%f%F%g%G%a%A");
++        test_parse_printf_format_one("%c%s%C%S%p%n%m%%");
++        test_parse_printf_format_one("%03d%-05d%+i%hhu%hu%hx%lx");
++        test_parse_printf_format_one("%llx%x%LE%ji%zi%zu%zi%zu%Zi%Zu%tu");
++        test_parse_printf_format_one("%l");
++}
++
++DEFINE_TEST_MAIN(LOG_DEBUG);
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch b/pkgs/os-specific/linux/systemd/musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch
new file mode 100644
index 000000000000..dd09c69ce95f
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0010-musl-introduce-GNU-specific-version-of-strerror_r.patch
@@ -0,0 +1,74 @@
+From 8fd471ff028cd3d5df5ee944fdbcefc7e77abc3d Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 23 Jan 2023 23:39:46 -0800
+Subject: [PATCH 10/30] musl: introduce GNU specific version of strerror_r()
+
+musl provides XSI compliant strerror_r(), and it is slightly different
+from the one by glibc.
+Let's introduce a tiny wrapper to convert XSI strerror_r() to GNU one.
+---
+ src/include/musl/string.h |  7 +++++++
+ src/libc/musl/meson.build |  1 +
+ src/libc/musl/string.c    | 26 ++++++++++++++++++++++++++
+ 3 files changed, 34 insertions(+)
+ create mode 100644 src/include/musl/string.h
+ create mode 100644 src/libc/musl/string.c
+
+diff --git a/src/include/musl/string.h b/src/include/musl/string.h
+new file mode 100644
+index 0000000000..cc3da63012
+--- /dev/null
++++ b/src/include/musl/string.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <string.h>
++
++char* strerror_r_gnu(int errnum, char *buf, size_t buflen);
++#define strerror_r strerror_r_gnu
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index 3e205e1eb1..a64f292081 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -7,4 +7,5 @@ endif
+ libc_wrapper_sources += files(
+         'printf.c',
+         'stdio.c',
++        'string.c',
+ )
+diff --git a/src/libc/musl/string.c b/src/libc/musl/string.c
+new file mode 100644
+index 0000000000..c2a9f4a169
+--- /dev/null
++++ b/src/libc/musl/string.c
+@@ -0,0 +1,26 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <errno.h>
++#include <stdio.h>
++#include <string.h>
++
++/* The header errno.h overrides strerror_r with strerror_r_gnu, hence we need to undef it here. */
++#undef strerror_r
++
++char* strerror_r_gnu(int errnum, char *buf, size_t buflen) {
++        int saved_errno = errno;
++        const char *msg = strerror(errnum);
++        size_t l = strlen(msg);
++        if (l >= buflen) {
++                if (buflen > 0) {
++                        if (buflen > 1)
++                                memcpy(buf, msg, buflen - 1);
++                        buf[buflen - 1] = '\0';
++                }
++                errno = ERANGE;
++        } else {
++                memcpy(buf, msg, l + 1);
++                errno = saved_errno;
++        }
++        return buf;
++}
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0011-musl-make-strptime-accept-z.patch b/pkgs/os-specific/linux/systemd/musl/0011-musl-make-strptime-accept-z.patch
new file mode 100644
index 000000000000..bbffbc8c8a53
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0011-musl-make-strptime-accept-z.patch
@@ -0,0 +1,137 @@
+From bf670a5af2a78f81ee9396b5b5da49b2df07fcfd Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 9 Sep 2025 08:31:22 +0900
+Subject: [PATCH 11/30] musl: make strptime() accept "%z"
+
+musl v1.2.5 does not support %z specifier in strptime(). Since
+https://github.com/kraj/musl/commit/fced99e93daeefb0192fd16304f978d4401d1d77
+%z is supported, but it only supports strict RFC-822/ISO 8601 format,
+that is, 4 digits with sign (e.g. +0900 or -1400), but does not support
+extended format: 2 digits or colon separated 4 digits (e.g. +09 or -14:00).
+Let's add fallback logic to make it support the extended timezone spec.
+---
+ src/include/musl/time.h   |  7 ++++
+ src/libc/musl/meson.build |  1 +
+ src/libc/musl/time.c      | 86 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 94 insertions(+)
+ create mode 100644 src/include/musl/time.h
+ create mode 100644 src/libc/musl/time.c
+
+diff --git a/src/include/musl/time.h b/src/include/musl/time.h
+new file mode 100644
+index 0000000000..349f9a3577
+--- /dev/null
++++ b/src/include/musl/time.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <time.h>
++
++char* strptime_fallback(const char *s, const char *format, struct tm *tm);
++#define strptime strptime_fallback
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index a64f292081..5fb590e868 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -8,4 +8,5 @@ libc_wrapper_sources += files(
+         'printf.c',
+         'stdio.c',
+         'string.c',
++        'time.c',
+ )
+diff --git a/src/libc/musl/time.c b/src/libc/musl/time.c
+new file mode 100644
+index 0000000000..12108166b2
+--- /dev/null
++++ b/src/libc/musl/time.c
+@@ -0,0 +1,86 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <stdbool.h>
++#include <string.h>
++#include <time.h>
++
++/* The header time.h overrides strptime with strerror_fallback, hence we need to undef it here. */
++#undef strptime
++
++char* strptime_fallback(const char *s, const char *format, struct tm *tm) {
++        /* First try native strptime() as is, and if it succeeds, return the resuit as is. */
++        char *k = strptime(s, format, tm);
++        if (k)
++                return k;
++
++        /* Check inputs for safety. */
++        if (!s || !format || !tm)
++                return NULL;
++
++        /* We only fallback if the format is exactly "%z". */
++        if (strcmp(format, "%z") != 0)
++                return NULL;
++
++        /* In the below, we parse timezone specifiction compatible with RFC-822/ISO 8601 and its extensions
++         * (e.g. +06, +0900, or -03:00). */
++
++        bool positive;
++        switch (*s) {
++        case '+':
++                positive = true;
++                break;
++        case '-':
++                positive = false;
++                break;
++        default:
++                return NULL;
++        }
++
++        s++;
++
++        if (*s < '0' || *s > '9')
++                return NULL;
++        long t = (*s - '0') * 10 * 60 * 60;
++
++        s++;
++
++        if (*s < '0' || *s > '9')
++                return NULL;
++        t += (*s - '0') * 60 * 60;
++
++        s++;
++
++        if (*s == '\0') /* 2 digits case */
++                goto finalize;
++
++        if (*s == ':') /* skip colon */
++                s++;
++
++        if (*s < '0' || *s >= '6') /* refuse minutes equal to or larger than 60 */
++                return NULL;
++        t += (*s - '0') * 10 * 60;
++
++        s++;
++
++        if (*s < '0' || *s > '9')
++                return NULL;
++        t += (*s - '0') * 60;
++
++        s++;
++
++        if (*s != '\0')
++                return NULL;
++
++finalize:
++        if (t > 24 * 60 * 60) /* refuse larger than 24 hours */
++                return NULL;
++
++        if (!positive)
++                t = -t;
++
++        *tm = (struct tm) {
++                .tm_gmtoff = t,
++        };
++
++        return (char*) s;
++}
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch b/pkgs/os-specific/linux/systemd/musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch
new file mode 100644
index 000000000000..2833a951a3d2
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0012-musl-make-strtoll-accept-strings-start-with-dot.patch
@@ -0,0 +1,69 @@
+From d97f38a2ffd0aca2a1d7b8a5bbbd1994e786c7bc Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 9 Sep 2025 09:10:44 +0900
+Subject: [PATCH 12/30] musl: make strtoll() accept strings start with dot
+
+glibc accepts strings start with '.' and returns 0, but musl refuses
+them. Let's accept them, as our code assumes the function accept such
+strings.
+---
+ src/include/musl/stdlib.h |  7 +++++++
+ src/libc/musl/meson.build |  1 +
+ src/libc/musl/stdlib.c    | 19 +++++++++++++++++++
+ 3 files changed, 27 insertions(+)
+ create mode 100644 src/include/musl/stdlib.h
+ create mode 100644 src/libc/musl/stdlib.c
+
+diff --git a/src/include/musl/stdlib.h b/src/include/musl/stdlib.h
+new file mode 100644
+index 0000000000..ecfd6ccb43
+--- /dev/null
++++ b/src/include/musl/stdlib.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <stdlib.h>
++
++long long strtoll_fallback(const char *nptr, char **endptr, int base);
++#define strtoll strtoll_fallback
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index 5fb590e868..ea09af9fa5 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -7,6 +7,7 @@ endif
+ libc_wrapper_sources += files(
+         'printf.c',
+         'stdio.c',
++        'stdlib.c',
+         'string.c',
+         'time.c',
+ )
+diff --git a/src/libc/musl/stdlib.c b/src/libc/musl/stdlib.c
+new file mode 100644
+index 0000000000..d4e2714217
+--- /dev/null
++++ b/src/libc/musl/stdlib.c
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <stdlib.h>
++
++/* The header stdlib.h overrides strtoll with strtoll_fallback, hence we need to undef it here. */
++#undef strtoll
++
++long long strtoll_fallback(const char *nptr, char **endptr, int base) {
++        /* glibc returns 0 if the first character is '.' without error, but musl returns as an error.
++         * As our code assumes the glibc behavior, let's accept string starts with '.'. */
++        if (nptr && *nptr == '.') {
++                if (endptr)
++                        *endptr = (char*) nptr;
++                return 0;
++        }
++
++        /* Otherwise, use the native strtoll(). */
++        return strtoll(nptr, endptr, base);
++}
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0013-musl-introduce-strerrorname_np.patch b/pkgs/os-specific/linux/systemd/musl/0013-musl-introduce-strerrorname_np.patch
new file mode 100644
index 000000000000..5203caf09f3d
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0013-musl-introduce-strerrorname_np.patch
@@ -0,0 +1,86 @@
+From 96b9f85d08be6f60768d1ebcdaf77e8e5dafebf6 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Fri, 5 Sep 2025 09:20:50 +0900
+Subject: [PATCH 13/30] musl: introduce strerrorname_np()
+
+musl does not provide strerrorname_np(). Thus, we need to implement it.
+---
+ src/include/musl/string.h                 |  2 ++
+ src/libc/musl/generate-strerrorname_np.sh | 39 +++++++++++++++++++++++
+ src/libc/musl/meson.build                 |  7 ++++
+ 3 files changed, 48 insertions(+)
+ create mode 100755 src/libc/musl/generate-strerrorname_np.sh
+
+diff --git a/src/include/musl/string.h b/src/include/musl/string.h
+index cc3da63012..7317c8dea0 100644
+--- a/src/include/musl/string.h
++++ b/src/include/musl/string.h
+@@ -5,3 +5,5 @@
+ 
+ char* strerror_r_gnu(int errnum, char *buf, size_t buflen);
+ #define strerror_r strerror_r_gnu
++
++const char* strerrorname_np(int errnum);
+diff --git a/src/libc/musl/generate-strerrorname_np.sh b/src/libc/musl/generate-strerrorname_np.sh
+new file mode 100755
+index 0000000000..0e0fb8b187
+--- /dev/null
++++ b/src/libc/musl/generate-strerrorname_np.sh
+@@ -0,0 +1,39 @@
++#!/usr/bin/env bash
++# SPDX-License-Identifier: LGPL-2.1-or-later
++set -eu
++set -o pipefail
++
++# This is based on src/basic/generate-errno-list.sh.
++
++# ECANCELLED, EDEADLOCK, ENOTSUP, EREFUSED, and EWOULDBLOCK are defined as aliases of
++# ECANCELED, EDEADLK, EOPNOTSUPP, ECONNREFUSED, and EAGAIN, respectively. Let's drop them.
++
++CC=${1:?}
++shift
++
++cat <<'EOF'
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++
++#include <errno.h>
++#include <stddef.h>
++#include <string.h>
++
++static const char * const errno_table[] = {
++EOF
++
++$CC -dM -include errno.h - </dev/null | \
++    grep -Ev '^#define[[:space:]]+(ECANCELLED|EDEADLOCK|ENOTSUP|EREFUSED|EWOULDBLOCK)' | \
++    awk '/^#define[ \t]+E[^ _]+[ \t]+/ { printf "        [%s] = \"%s\",\n", $2, $2; }' | \
++    sort
++
++cat <<'EOF'
++};
++
++const char* strerrorname_np(int errnum) {
++        if (errnum < 0)
++                errnum = -errnum;
++        if ((size_t) errnum >= sizeof(errno_table) / sizeof(errno_table[0]))
++                return NULL;
++        return errno_table[errnum];
++}
++EOF
+diff --git a/src/libc/musl/meson.build b/src/libc/musl/meson.build
+index ea09af9fa5..1cb6bf28c1 100644
+--- a/src/libc/musl/meson.build
++++ b/src/libc/musl/meson.build
+@@ -11,3 +11,10 @@ libc_wrapper_sources += files(
+         'string.c',
+         'time.c',
+ )
++
++generator= files('generate-strerrorname_np.sh')
++libc_wrapper_sources += custom_target(
++        input : generator,
++        output : 'strerrorname_np.c',
++        command : [env, 'bash', generator, cpp],
++        capture : true)
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch b/pkgs/os-specific/linux/systemd/musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch
new file mode 100644
index 000000000000..41a8c6b4e2aa
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0014-musl-introduce-dummy-functions-for-mallinfo-malloc_i.patch
@@ -0,0 +1,60 @@
+From 331e8b9158f1bb3b4ff5db2c17a16a60640e0c12 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 10 Jun 2025 00:40:59 +0900
+Subject: [PATCH 14/30] musl: introduce dummy functions for mallinfo(),
+ malloc_info(), and malloc_trim()
+
+These functions are not provided by musl.
+---
+ src/include/musl/malloc.h | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+ create mode 100644 src/include/musl/malloc.h
+
+diff --git a/src/include/musl/malloc.h b/src/include/musl/malloc.h
+new file mode 100644
+index 0000000000..9d15d4bf91
+--- /dev/null
++++ b/src/include/musl/malloc.h
+@@ -0,0 +1,39 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include <errno.h>
++#include <stdio.h>
++
++/* struct mallinfo2 will be defined and struct mallinfo is converted to struct mallinfo2 in
++ * override/malloc.h. Hence, here we define struct mallinfo. */
++
++struct mallinfo {
++        int arena;    /* non-mmapped space allocated from system */
++        int ordblks;  /* number of free chunks */
++        int smblks;   /* number of fastbin blocks */
++        int hblks;    /* number of mmapped regions */
++        int hblkhd;   /* space in mmapped regions */
++        int usmblks;  /* always 0, preserved for backwards compatibility */
++        int fsmblks;  /* space available in freed fastbin blocks */
++        int uordblks; /* total allocated space */
++        int fordblks; /* total free space */
++        int keepcost; /* top-most, releasable (via malloc_trim) space */
++};
++
++static inline struct mallinfo mallinfo(void) {
++        return (struct mallinfo) {};
++}
++
++static inline int malloc_info(int options, FILE *stream) {
++        if (options != 0)
++                errno = EINVAL;
++        else
++                errno = EOPNOTSUPP;
++        return -1;
++}
++
++static inline int malloc_trim(size_t pad) {
++        return 0;
++}
++
++#include_next <malloc.h>
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch b/pkgs/os-specific/linux/systemd/musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch
new file mode 100644
index 000000000000..4ec71eb7e25a
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0015-musl-introduce-dummy-function-for-gnu_get_libc_versi.patch
@@ -0,0 +1,86 @@
+From 5067b1cfac07dbb50d7813b2a900b1b6f8e6e4bd Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 8 Jun 2025 10:07:54 +0900
+Subject: [PATCH 15/30] musl: introduce dummy function for
+ gnu_get_libc_version()
+
+As the header gnu/libc-version.h and gnu_get_libc_version() function
+are glibc specific, and musl does not provide them.
+---
+ src/include/musl/gnu/libc-version.h | 8 ++++++++
+ src/shared/condition.c              | 9 +++++++--
+ src/test/test-condition.c           | 8 +++++---
+ 3 files changed, 20 insertions(+), 5 deletions(-)
+ create mode 100644 src/include/musl/gnu/libc-version.h
+
+diff --git a/src/include/musl/gnu/libc-version.h b/src/include/musl/gnu/libc-version.h
+new file mode 100644
+index 0000000000..8ad0ed16b8
+--- /dev/null
++++ b/src/include/musl/gnu/libc-version.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include <stddef.h>
++
++static inline const char* gnu_get_libc_version(void) {
++        return NULL;
++}
+diff --git a/src/shared/condition.c b/src/shared/condition.c
+index b09eff1bfb..b27b24aba7 100644
+--- a/src/shared/condition.c
++++ b/src/shared/condition.c
+@@ -255,8 +255,13 @@ static int condition_test_version(Condition *c, char **env) {
+         if (streq(word, "systemd"))
+                 return condition_test_version_cmp(p, STRINGIFY(PROJECT_VERSION));
+ 
+-        if (streq(word, "glibc"))
+-                return condition_test_version_cmp(p, gnu_get_libc_version());
++        if (streq(word, "glibc")) {
++                const char *v = gnu_get_libc_version();
++                if (!v)
++                        return false; /* built with musl */
++
++                return condition_test_version_cmp(p, v);
++        }
+ 
+         /* if no predicate has been set, default to "kernel" and use the whole parameter as condition */
+         if (!streq(word, "kernel"))
+diff --git a/src/test/test-condition.c b/src/test/test-condition.c
+index 11b3a42418..898c111ffe 100644
+--- a/src/test/test-condition.c
++++ b/src/test/test-condition.c
+@@ -669,8 +669,10 @@ TEST(condition_test_version) {
+         condition_free(condition);
+ 
+         /* Test glibc version */
++        bool expected = !!gnu_get_libc_version();
++
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, "glibc > 1", false, false)));
+-        ASSERT_OK_POSITIVE(condition_test(condition, environ));
++        ASSERT_OK_EQ(condition_test(condition, environ), expected);
+         condition_free(condition);
+ 
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, "glibc < 2", false, false)));
+@@ -678,7 +680,7 @@ TEST(condition_test_version) {
+         condition_free(condition);
+ 
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, "glibc < 9999", false, false)));
+-        ASSERT_OK_POSITIVE(condition_test(condition, environ));
++        ASSERT_OK_EQ(condition_test(condition, environ), expected);
+         condition_free(condition);
+ 
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, "glibc > 9999", false, false)));
+@@ -688,7 +690,7 @@ TEST(condition_test_version) {
+         v = strjoina("glibc = ", gnu_get_libc_version());
+ 
+         ASSERT_NOT_NULL((condition = condition_new(CONDITION_VERSION, v, false, false)));
+-        ASSERT_OK_POSITIVE(condition_test(condition, environ));
++        ASSERT_OK_EQ(condition_test(condition, environ), expected);
+         condition_free(condition);
+ 
+         v = strjoina("glibc != ", gnu_get_libc_version());
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0016-musl-define-__THROW-when-not-defined.patch b/pkgs/os-specific/linux/systemd/musl/0016-musl-define-__THROW-when-not-defined.patch
new file mode 100644
index 000000000000..16fc6570320a
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0016-musl-define-__THROW-when-not-defined.patch
@@ -0,0 +1,30 @@
+From 65a6110f75e3bcf980aa4138ad18c06f351b78f5 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 9 Jun 2025 14:00:55 +0900
+Subject: [PATCH 16/30] musl: define __THROW when not defined
+
+__THROW is internally used by glibc headers, hence our implementation of
+net/if.h and sys/mount.h also use it. However, musl does not provide
+the macro. Let's define it when not defined.
+---
+ src/include/musl/features.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+ create mode 100644 src/include/musl/features.h
+
+diff --git a/src/include/musl/features.h b/src/include/musl/features.h
+new file mode 100644
+index 0000000000..bd6d00a9d4
+--- /dev/null
++++ b/src/include/musl/features.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <features.h>
++
++#ifndef __THROW
++#define __THROW
++#endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch b/pkgs/os-specific/linux/systemd/musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch
new file mode 100644
index 000000000000..4d733f000d47
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0017-musl-replace-sys-prctl.h-with-our-own-implementation.patch
@@ -0,0 +1,29 @@
+From 75aa46c9399664d2a1cdabefcad2899ebfabc741 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 23 Jun 2025 16:00:21 +0900
+Subject: [PATCH 17/30] musl: replace sys/prctl.h with our own implementation
+
+To avoid conflicts between musl's sys/prctl.h and linux/prctl.h.
+---
+ src/include/musl/sys/prctl.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+ create mode 100644 src/include/musl/sys/prctl.h
+
+diff --git a/src/include/musl/sys/prctl.h b/src/include/musl/sys/prctl.h
+new file mode 100644
+index 0000000000..2c830d2649
+--- /dev/null
++++ b/src/include/musl/sys/prctl.h
+@@ -0,0 +1,9 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++/* This is for avoiding conflicts between musl's sys/prctl.h and linux/prctl.h. */
++
++#include <features.h>
++#include <linux/prctl.h>        /* IWYU pragma: export */
++
++int prctl(int, ...);
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch b/pkgs/os-specific/linux/systemd/musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch
new file mode 100644
index 000000000000..c0044956ad0f
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0018-musl-replace-netinet-if_ether.h-with-our-own-impleme.patch
@@ -0,0 +1,72 @@
+From 6e77a74ca91e689a43651d9eeb5f8f40893eed76 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 23 Jun 2025 16:08:37 +0900
+Subject: [PATCH 18/30] musl: replace netinet/if_ether.h with our own
+ implementation
+
+musl's netinet/if_ether.h conflicts with linux/if_ether.h.
+The reimplementation is mostly equivalent with what glibc does.
+
+This also unset __UAPI_DEF_ETHHDR before including linux/if_ether.h,
+otherwise struct ethhdr may not be defined by the header when it is
+defined.
+---
+ src/include/musl/linux/if_ether.h   |  5 +++++
+ src/include/musl/netinet/if_ether.h | 33 +++++++++++++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+ create mode 100644 src/include/musl/linux/if_ether.h
+ create mode 100644 src/include/musl/netinet/if_ether.h
+
+diff --git a/src/include/musl/linux/if_ether.h b/src/include/musl/linux/if_ether.h
+new file mode 100644
+index 0000000000..e28cd4a014
+--- /dev/null
++++ b/src/include/musl/linux/if_ether.h
+@@ -0,0 +1,5 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#undef __UAPI_DEF_ETHHDR
++#include_next <linux/if_ether.h>
+diff --git a/src/include/musl/netinet/if_ether.h b/src/include/musl/netinet/if_ether.h
+new file mode 100644
+index 0000000000..62f4ac03b3
+--- /dev/null
++++ b/src/include/musl/netinet/if_ether.h
+@@ -0,0 +1,33 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++/* glibc's netinet/if_ether.h does the following:
++ * - include linux/if_ether.h, net/ethernet.h, and net/if_arp.h,
++ * - define struct ether_arp, and relevant macros,
++ * - define ETHER_MAP_IP_MULTICAST() macro (currently we do not use it).
++ * However, musl's netinet/if_ether.h conflicts with linux/if_ether.h.
++ * Let's use the same way that glibc uses. */
++
++#include <linux/if_ether.h>     /* IWYU pragma: export */
++#include <net/ethernet.h>       /* IWYU pragma: export */
++#include <net/if_arp.h>         /* IWYU pragma: export */
++
++/*
++ * Ethernet Address Resolution Protocol.
++ *
++ * See RFC 826 for protocol description.  Structure below is adapted
++ * to resolving internet addresses.  Field names used correspond to
++ * RFC 826.
++ */
++struct  ether_arp {
++        struct  arphdr ea_hdr;          /* fixed-size header */
++        uint8_t arp_sha[ETH_ALEN];      /* sender hardware address */
++        uint8_t arp_spa[4];             /* sender protocol address */
++        uint8_t arp_tha[ETH_ALEN];      /* target hardware address */
++        uint8_t arp_tpa[4];             /* target protocol address */
++};
++#define arp_hrd ea_hdr.ar_hrd
++#define arp_pro ea_hdr.ar_pro
++#define arp_hln ea_hdr.ar_hln
++#define arp_pln ea_hdr.ar_pln
++#define arp_op  ea_hdr.ar_op
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch b/pkgs/os-specific/linux/systemd/musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch
new file mode 100644
index 000000000000..24855be78c21
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0019-musl-add-missing-FTW_CONTINUE-macro.patch
@@ -0,0 +1,35 @@
+From 7d4b4e49729f7c7d5164ba2c5040ed522d68ee7a Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Mon, 25 Feb 2019 15:00:06 +0800
+Subject: [PATCH 19/30] musl: add missing FTW_CONTINUE macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is to avoid build failures like below for musl.
+
+  test-recurse-dir.c:23:24: error: ‘FTW_CONTINUE’ undeclared
+
+Co-authored-by: Yu Watanabe <watanabe.yu+github@gmail.com>
+---
+ src/include/musl/ftw.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+ create mode 100644 src/include/musl/ftw.h
+
+diff --git a/src/include/musl/ftw.h b/src/include/musl/ftw.h
+new file mode 100644
+index 0000000000..fd153734d0
+--- /dev/null
++++ b/src/include/musl/ftw.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <ftw.h>
++
++#ifndef FTW_CONTINUE
++#define FTW_CONTINUE 0
++#endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0020-musl-add-several-missing-statx-macros.patch b/pkgs/os-specific/linux/systemd/musl/0020-musl-add-several-missing-statx-macros.patch
new file mode 100644
index 000000000000..6dd1589019b0
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0020-musl-add-several-missing-statx-macros.patch
@@ -0,0 +1,90 @@
+From c306693ac26aef3d5fb06fa0981d911bda9b93d7 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 22 Jun 2025 00:38:58 +0900
+Subject: [PATCH 20/30] musl: add several missing statx macros
+
+glibc's sys/stat.h includes linux/stat.h, and we have copy of it from
+the latest kernel, hence all new flags are always defined.
+However, musl's sys/stat.h does not include linux/stat.h, and moreover,
+they conflict with each other, hence we cannot include both header
+simultaneously. Let's define missing macros to support musl.
+---
+ src/include/musl/sys/stat.h | 66 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 66 insertions(+)
+ create mode 100644 src/include/musl/sys/stat.h
+
+diff --git a/src/include/musl/sys/stat.h b/src/include/musl/sys/stat.h
+new file mode 100644
+index 0000000000..610dd3e699
+--- /dev/null
++++ b/src/include/musl/sys/stat.h
+@@ -0,0 +1,66 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <sys/stat.h>
++
++#include <assert.h>
++#include <stddef.h>
++
++/* musl's sys/stat.h does not include linux/stat.h, and unfortunately they conflict with each other.
++ * Hence, some relatively new macros need to be explicitly defined here. */
++
++/* Before 23ab04a8630225371455d5f4538fd078665bb646, statx.stx_mnt_id is not defined. */
++#ifndef STATX_MNT_ID
++static_assert(offsetof(struct statx, __pad1) == offsetof(struct statx, stx_dev_minor) + sizeof(uint32_t), "");
++#define stx_mnt_id __pad1[0]
++#endif
++
++#ifndef STATX_MNT_ID
++#define STATX_MNT_ID            0x00001000U
++#endif
++#ifndef STATX_DIOALIGN
++#define STATX_DIOALIGN          0x00002000U
++#endif
++#ifndef STATX_MNT_ID_UNIQUE
++#define STATX_MNT_ID_UNIQUE     0x00004000U
++#endif
++#ifndef STATX_SUBVOL
++#define STATX_SUBVOL            0x00008000U
++#endif
++#ifndef STATX_WRITE_ATOMIC
++#define STATX_WRITE_ATOMIC      0x00010000U
++#endif
++#ifndef STATX_DIO_READ_ALIGN
++#define STATX_DIO_READ_ALIGN    0x00020000U
++#endif
++
++#ifndef STATX_ATTR_COMPRESSED
++#define STATX_ATTR_COMPRESSED   0x00000004
++#endif
++#ifndef STATX_ATTR_IMMUTABLE
++#define STATX_ATTR_IMMUTABLE    0x00000010
++#endif
++#ifndef STATX_ATTR_APPEND
++#define STATX_ATTR_APPEND       0x00000020
++#endif
++#ifndef STATX_ATTR_NODUMP
++#define STATX_ATTR_NODUMP       0x00000040
++#endif
++#ifndef STATX_ATTR_ENCRYPTED
++#define STATX_ATTR_ENCRYPTED    0x00000800
++#endif
++#ifndef STATX_ATTR_AUTOMOUNT
++#define STATX_ATTR_AUTOMOUNT    0x00001000
++#endif
++#ifndef STATX_ATTR_MOUNT_ROOT
++#define STATX_ATTR_MOUNT_ROOT   0x00002000
++#endif
++#ifndef STATX_ATTR_VERITY
++#define STATX_ATTR_VERITY       0x00100000
++#endif
++#ifndef STATX_ATTR_DAX
++#define STATX_ATTR_DAX          0x00200000
++#endif
++#ifndef STATX_ATTR_WRITE_ATOMIC
++#define STATX_ATTR_WRITE_ATOMIC 0x00400000
++#endif
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch b/pkgs/os-specific/linux/systemd/musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch
new file mode 100644
index 000000000000..a024e58f2d25
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0021-musl-avoid-conflict-between-fcntl.h-and-our-forward..patch
@@ -0,0 +1,36 @@
+From a8209a45e73f4c8b1f4e4e174d2d5fbc8a9ac4df Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 22 Jul 2025 03:37:37 +0900
+Subject: [PATCH 21/30] musl: avoid conflict between fcntl.h and our forward.h
+
+glibc defines AT_FDCWD as -100, but musl defines it as (-100).
+In forward.h, we also define AT_FDCWD as -100, hence musl's fcntl.h
+conflicts with forward.h. This is for avoiding the conflict.
+---
+ src/include/musl/fcntl.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+ create mode 100644 src/include/musl/fcntl.h
+
+diff --git a/src/include/musl/fcntl.h b/src/include/musl/fcntl.h
+new file mode 100644
+index 0000000000..e69f13087d
+--- /dev/null
++++ b/src/include/musl/fcntl.h
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++/* glibc defines AT_FDCWD as -100, but musl defines it as (-100). Hence, musl's fcntl.h conflicts with
++ * forward.h. To avoid the conflict, here temporary undef AT_FDCWD before including fcntl.h. */
++#ifdef AT_FDCWD
++#undef AT_FDCWD
++#endif
++
++#include_next <fcntl.h>
++
++/* Then, undef AT_FDCWD by fcntl.h and redefine it as consistent with forward.h */
++#undef AT_FDCWD
++#define AT_FDCWD -100
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch b/pkgs/os-specific/linux/systemd/musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch
new file mode 100644
index 000000000000..4e47c4c14e1d
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0022-musl-redefine-HOST_NAME_MAX-as-64.patch
@@ -0,0 +1,29 @@
+From 4a06464ea72d06859c54fca4d7bc361e2f4b069c Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 7 Sep 2025 06:16:02 +0900
+Subject: [PATCH 22/30] musl: redefine HOST_NAME_MAX as 64
+
+glibc defines HOST_NAME_MAX as 64 and our code rely on that, but musl
+defines the constant as 255. Let's redefine it.
+---
+ src/include/musl/limits.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+ create mode 100644 src/include/musl/limits.h
+
+diff --git a/src/include/musl/limits.h b/src/include/musl/limits.h
+new file mode 100644
+index 0000000000..fadf71d66f
+--- /dev/null
++++ b/src/include/musl/limits.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <limits.h>
++
++/* HOST_NAME_MAX should be 64 on linux, but musl uses the one by POSIX (255). */
++#undef HOST_NAME_MAX
++#define HOST_NAME_MAX 64
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch b/pkgs/os-specific/linux/systemd/musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch
new file mode 100644
index 000000000000..a397f554fb89
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0023-musl-avoid-multiple-evaluations-in-CPU_ISSET_S-macro.patch
@@ -0,0 +1,62 @@
+From 1aecd86536aef53e92a4903794259300815a9e62 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 1 Jul 2025 12:53:14 +0900
+Subject: [PATCH 23/30] musl: avoid multiple evaluations in CPU_ISSET_S() macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+musl's CPU_ISSET_S() macro does not avoid multiple evaluations, and it
+only accepts simple variable or constant.
+
+Fixes the following error.
+```
+../src/shared/cpu-set-util.c: In function ‘cpu_set_to_mask_string’:
+../src/shared/cpu-set-util.c:101:41: warning: operation on ‘i’ may be undefined [-Werror=sequence-point]
+  101 |                         if (CPU_ISSET_S(--i, c->allocated, c->set))
+      |                                         ^
+```
+---
+ src/include/musl/sched.h | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+ create mode 100644 src/include/musl/sched.h
+
+diff --git a/src/include/musl/sched.h b/src/include/musl/sched.h
+new file mode 100644
+index 0000000000..d6e7100ee4
+--- /dev/null
++++ b/src/include/musl/sched.h
+@@ -0,0 +1,30 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <sched.h>
++
++/* This is for avoiding multiple evaluations in musl's __CPU_op_S() macro. */
++
++#undef __CPU_op_S
++#undef CPU_SET_S
++#undef CPU_CLR_S
++#undef CPU_ISSET_S
++#undef CPU_SET
++#undef CPU_CLR
++#undef CPU_ISSET
++
++#define __CPU_op_S(i, size, set, op) \
++        ({                           \
++                typeof(i) _i = (i);                                     \
++                                                                        \
++                _i / 8U >= (size) ? 0 :                                 \
++                        (((unsigned long*) (set))[_i / 8 / sizeof(long)] op (1UL << (_i % (8 * sizeof(long))))); \
++        })
++
++#define CPU_SET_S(i, size, set) __CPU_op_S(i, size, set, |=)
++#define CPU_CLR_S(i, size, set) __CPU_op_S(i, size, set, &=~)
++#define CPU_ISSET_S(i, size, set) __CPU_op_S(i, size, set, &)
++
++#define CPU_SET(i, set) CPU_SET_S(i, sizeof(cpu_set_t), set)
++#define CPU_CLR(i, set) CPU_CLR_S(i, sizeof(cpu_set_t), set)
++#define CPU_ISSET(i, set) CPU_ISSET_S(i, sizeof(cpu_set_t), set)
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch b/pkgs/os-specific/linux/systemd/musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch
new file mode 100644
index 000000000000..5a173be962be
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0024-musl-core-there-is-one-less-usable-signal-when-built.patch
@@ -0,0 +1,57 @@
+From c00d31373a8f5b922dd947a6d6d6098df0429762 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sun, 7 Sep 2025 08:53:07 +0900
+Subject: [PATCH 24/30] musl: core: there is one less usable signal when built
+ with musl
+
+musl internally reserves one more signal, hence we can only use 29
+signals.
+---
+ src/core/manager.c          | 4 ++--
+ src/test/test-signal-util.c | 7 ++++++-
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index d85896577f..86cb11905f 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -526,7 +526,7 @@ static int manager_setup_signals(Manager *m) {
+         assert_se(sigaction(SIGCHLD, &sa, NULL) == 0);
+ 
+         /* We make liberal use of realtime signals here. On Linux/glibc we have 30 of them, between
+-         * SIGRTMIN+0 ... SIGRTMIN+30 (aka SIGRTMAX). */
++         * SIGRTMIN+0 ... SIGRTMIN+30 (aka SIGRTMAX). When musl is used SIGRTMAX is SIGRTMIN+29. */
+ 
+         assert_se(sigemptyset(&mask) == 0);
+         sigset_add_many(&mask,
+@@ -571,7 +571,7 @@ static int manager_setup_signals(Manager *m) {
+                         SIGRTMIN+28, /* systemd: set log target to kmsg */
+                         SIGRTMIN+29, /* systemd: set log target to syslog-or-kmsg (obsolete) */
+ 
+-                        /* ... one free signal here SIGRTMIN+30 ... */
++                        /* ... one free signal here SIGRTMIN+30 (glibc only) ... */
+                         -1);
+         assert_se(sigprocmask(SIG_SETMASK, &mask, NULL) == 0);
+ 
+diff --git a/src/test/test-signal-util.c b/src/test/test-signal-util.c
+index 7d069a7fb2..f26b48f3f2 100644
+--- a/src/test/test-signal-util.c
++++ b/src/test/test-signal-util.c
+@@ -13,8 +13,13 @@ TEST(rt_signals) {
+         info(SIGRTMIN);
+         info(SIGRTMAX);
+ 
+-        /* We use signals SIGRTMIN+0 to SIGRTMIN+30 unconditionally */
++        /* We use signals SIGRTMIN+0 to SIGRTMIN+29 unconditionally. SIGRTMIN+30 can be used only when
++         * built with glibc. */
++#ifdef __GLIBC__
+         assert_se(SIGRTMAX - SIGRTMIN >= 30);
++#else
++        assert_se(SIGRTMAX - SIGRTMIN >= 29);
++#endif
+ }
+ 
+ static void test_signal_to_string_one(int val) {
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch b/pkgs/os-specific/linux/systemd/musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch
new file mode 100644
index 000000000000..4a78440837ed
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0025-musl-build-path-fix-reading-DT_RUNPATH-or-DT_RPATH.patch
@@ -0,0 +1,33 @@
+From 7cade54777e9b715ca5b1023dd8fead64d1f4b3e Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Sat, 6 Sep 2025 12:06:06 +0900
+Subject: [PATCH 25/30] musl: build-path: fix reading DT_RUNPATH or DT_RPATH
+
+musl records DT_STRTAB as offset, rather than address. So, need to add
+obtained bias to read runpath or rpath.
+---
+ src/basic/build-path.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/basic/build-path.c b/src/basic/build-path.c
+index 577ff72bce..3212089379 100644
+--- a/src/basic/build-path.c
++++ b/src/basic/build-path.c
+@@ -34,11 +34,11 @@ static int get_runpath_from_dynamic(const ElfW(Dyn) *d, ElfW(Addr) bias, const c
+                         break;
+ 
+                 case DT_STRTAB:
+-                        /* On MIPS and RISC-V DT_STRTAB records an offset, not a valid address, so it has to be adjusted
+-                         * using the bias calculated earlier. */
++                        /* On MIPS, RISC-V, or with musl, DT_STRTAB records an offset, not a valid address,
++                         * so it has to be adjusted using the bias calculated earlier. */
+                         if (d->d_un.d_val != 0)
+                                 strtab = (const char *) ((uintptr_t) d->d_un.d_val
+-#if defined(__mips__) || defined(__riscv)
++#if defined(__mips__) || defined(__riscv) || !defined(__GLIBC__)
+                                          + bias
+ #endif
+                                 );
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch b/pkgs/os-specific/linux/systemd/musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch
new file mode 100644
index 000000000000..e59e6aeae62c
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0026-musl-format-util-use-llu-for-formatting-rlim_t.patch
@@ -0,0 +1,57 @@
+From 65cd003563fe1b8f1f1b3e1c1198b3d63f993820 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 9 Jun 2025 12:00:01 +0900
+Subject: [PATCH 26/30] musl: format-util: use %llu for formatting rlim_t
+
+glibc uses uint32_t or uint64_t for rlim_t, while musl uses unsigned long long.
+---
+ meson.build             |  7 +++++++
+ src/basic/format-util.h | 14 ++++++++------
+ 2 files changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 5f235d5113..66579b9182 100644
+--- a/meson.build
++++ b/meson.build
+@@ -572,6 +572,13 @@ conf.set('SIZEOF_RLIM_T', cc.sizeof('rlim_t', prefix : '#include <sys/resource.h
+ conf.set('SIZEOF_TIME_T', cc.sizeof('time_t', prefix : '#include <sys/time.h>'))
+ conf.set('SIZEOF_TIMEX_MEMBER', cc.sizeof('typeof(((struct timex *)0)->freq)', prefix : '#include <sys/timex.h>'))
+ 
++if get_option('libc') == 'musl'
++        if conf.get('SIZEOF_RLIM_T') != 8
++                error('Unexpected size of rlim_t: @0@'.format(conf.get('SIZEOF_RLIM_T')))
++        endif
++        conf.set_quoted('RLIM_FMT', '%llu')
++endif
++
+ long_max = cc.compute_int(
+         'LONG_MAX',
+         prefix : '#include <limits.h>',
+diff --git a/src/basic/format-util.h b/src/basic/format-util.h
+index e42f788ce6..d40ca5818a 100644
+--- a/src/basic/format-util.h
++++ b/src/basic/format-util.h
+@@ -39,12 +39,14 @@ assert_cc(sizeof(gid_t) == sizeof(uint32_t));
+ #  error Unknown timex member size
+ #endif
+ 
+-#if SIZEOF_RLIM_T == 8
+-#  define RLIM_FMT "%" PRIu64
+-#elif SIZEOF_RLIM_T == 4
+-#  define RLIM_FMT "%" PRIu32
+-#else
+-#  error Unknown rlim_t size
++#ifndef RLIM_FMT
++#  if SIZEOF_RLIM_T == 8
++#    define RLIM_FMT "%" PRIu64
++#  elif SIZEOF_RLIM_T == 4
++#    define RLIM_FMT "%" PRIu32
++#  else
++#    error Unknown rlim_t size
++#  endif
+ #endif
+ 
+ #if SIZEOF_DEV_T == 8
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0027-musl-time-util-skip-tm.tm_wday-check.patch b/pkgs/os-specific/linux/systemd/musl/0027-musl-time-util-skip-tm.tm_wday-check.patch
new file mode 100644
index 000000000000..fd9a00fb3b5d
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0027-musl-time-util-skip-tm.tm_wday-check.patch
@@ -0,0 +1,47 @@
+From 524396a3058a08955683038dae86cf5aaaf10847 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 8 Sep 2025 15:08:49 +0900
+Subject: [PATCH 27/30] musl: time-util: skip tm.tm_wday check
+
+musl does not set tm_wday when it is explicitly requested.
+The check is not necessary at all, it is just for safety.
+Let's skip it when built with musl.
+---
+ src/basic/time-util.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/src/basic/time-util.c b/src/basic/time-util.c
+index 38591b0604..c890141a99 100644
+--- a/src/basic/time-util.c
++++ b/src/basic/time-util.c
+@@ -668,10 +668,14 @@ static int parse_timestamp_impl(
+         _cleanup_free_ char *t_alloc = NULL;
+         usec_t usec, plus = 0, minus = 0;
+         bool with_tz = false;
+-        int r, weekday = -1;
+         unsigned fractional = 0;
+         const char *k;
+         struct tm tm, copy;
++        int r;
++#ifndef __GLIBC__
++        _unused_
++#endif
++        int weekday = -1;
+ 
+         /* Allowed syntaxes:
+          *
+@@ -921,8 +925,11 @@ from_tm:
+         assert(plus == 0);
+         assert(minus == 0);
+ 
++#ifdef __GLIBC__
++        /* musl does not set tm_wday field and set 0 unless it is explicitly requested by %w or so. */
+         if (weekday >= 0 && tm.tm_wday != weekday)
+                 return -EINVAL;
++#endif
+ 
+         if (gmtoff < 0) {
+                 plus = -gmtoff * USEC_PER_SEC;
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch b/pkgs/os-specific/linux/systemd/musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch
new file mode 100644
index 000000000000..de2b0a251f02
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0028-musl-glob-util-filter-out-.-and-.-even-if-GLOB_ALTDI.patch
@@ -0,0 +1,205 @@
+From d59cd7edd78901db8fd88c86258f6830e35e91df Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Mon, 25 Feb 2019 14:56:21 +0800
+Subject: [PATCH 28/30] musl: glob-util: filter out . and .. even if
+ GLOB_ALTDIRFUNC is not supported
+
+musl neither support GLOB_ALTDIRFUNC nor GLOB_BRACE.
+Let's make safe_glob() work even when GLOB_ALTDIRFUNC is not supported.
+Currently, GLOB_BRACE is simply ignored when it is not supported.
+---
+ src/basic/glob-util.c     | 75 +++++++++++++++++++++++++++++++++++++--
+ src/basic/glob-util.h     |  9 ++++-
+ src/include/musl/glob.h   | 21 +++++++++++
+ src/test/test-glob-util.c | 10 ++++++
+ 4 files changed, 112 insertions(+), 3 deletions(-)
+ create mode 100644 src/include/musl/glob.h
+
+diff --git a/src/basic/glob-util.c b/src/basic/glob-util.c
+index 5843ef088f..84b369be87 100644
+--- a/src/basic/glob-util.c
++++ b/src/basic/glob-util.c
+@@ -9,9 +9,42 @@
+ #include "string-util.h"
+ #include "strv.h"
+ 
++static bool safe_glob_verify(const char *p, const char *prefix) {
++        if (isempty(p))
++                return false; /* should not happen, but for safey. */
++
++        if (prefix) {
++                /* Skip the prefix, as we allow dots in prefix.
++                 * Note, glob() does not normalize paths, hence do not use path_startswith(). */
++                p = startswith(p, prefix);
++                if (!p)
++                        return false; /* should not happen, but for safety. */
++        }
++
++        for (;;) {
++                p += strspn(p, "/");
++                if (*p == '\0')
++                        return true;
++                if (*p == '.') {
++                        p++;
++                        if (IN_SET(*p, '/', '\0'))
++                                return false; /* refuse dot */
++                        if (*p == '.') {
++                                p++;
++                                if (IN_SET(*p, '/', '\0'))
++                                        return false; /* refuse dot dot */
++                        }
++                }
++
++                p += strcspn(p, "/");
++                if (*p == '\0')
++                        return true;
++        }
++}
++
+ DEFINE_TRIVIAL_DESTRUCTOR(closedir_wrapper, void, closedir);
+ 
+-int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***ret) {
++int safe_glob_internal(const char *path, int flags, bool use_gnu_extension, opendir_t opendir_func, char ***ret) {
+         _cleanup_(globfree) glob_t g = {
+                 .gl_closedir = closedir_wrapper,
+                 .gl_readdir = (struct dirent* (*)(void *)) readdir_no_dot,
+@@ -23,8 +56,16 @@ int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***
+ 
+         assert(path);
+ 
++        // TODO: expand braces if GLOB_BRACE is specified but not supported.
++
++#if GLOB_ALTDIRFUNC == 0
++        use_gnu_extension = false;
++#else
++        SET_FLAG(flags, GLOB_ALTDIRFUNC, use_gnu_extension);
++#endif
++
+         errno = 0;
+-        r = glob(path, flags | GLOB_ALTDIRFUNC, NULL, &g);
++        r = glob(path, flags, NULL, &g);
+         if (r == GLOB_NOMATCH)
+                 return -ENOENT;
+         if (r == GLOB_NOSPACE)
+@@ -32,6 +73,36 @@ int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***
+         if (r != 0)
+                 return errno_or_else(EIO);
+ 
++        if (!use_gnu_extension) {
++                _cleanup_free_ char *prefix = NULL;
++                r = glob_non_glob_prefix(path, &prefix);
++                if (r < 0 && r != -ENOENT)
++                        return r;
++
++                _cleanup_strv_free_ char **filtered = NULL;
++                size_t n_filtered = 0;
++                STRV_FOREACH(p, g.gl_pathv) {
++                        if (!safe_glob_verify(*p, prefix))
++                                continue;
++
++                        if (!ret)
++                                return 0; /* Found at least one entry, let's return earlier. */
++
++                        /* When musl is used, each entry is not a head of allocated memory. Hence, it is
++                         * necessary to copy the string. */
++                        r = strv_extend_with_size(&filtered, &n_filtered, *p);
++                        if (r < 0)
++                                return r;
++                }
++
++                if (n_filtered == 0)
++                        return -ENOENT;
++
++                assert(ret);
++                *ret = TAKE_PTR(filtered);
++                return 0;
++        }
++
+         if (strv_isempty(g.gl_pathv))
+                 return -ENOENT;
+ 
+diff --git a/src/basic/glob-util.h b/src/basic/glob-util.h
+index ea3e869319..36bfd6716c 100644
+--- a/src/basic/glob-util.h
++++ b/src/basic/glob-util.h
+@@ -7,7 +7,14 @@
+ 
+ typedef DIR* (*opendir_t)(const char *);
+ 
+-int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***ret);
++int safe_glob_internal(const char *path, int flags, bool use_gnu_extension, opendir_t opendir_func, char ***ret);
++static inline int safe_glob_test(const char *path, int flags, char ***ret) {
++        /* This is for testing the fallback logic for the case GLOB_ALTDIRFUNC is not supported. */
++        return safe_glob_internal(path, flags, false, NULL, ret);
++}
++static inline int safe_glob_full(const char *path, int flags, opendir_t opendir_func, char ***ret) {
++        return safe_glob_internal(path, flags, true, opendir_func, ret);
++}
+ static inline int safe_glob(const char *path, int flags, char ***ret) {
+         return safe_glob_full(path, flags, NULL, ret);
+ }
+diff --git a/src/include/musl/glob.h b/src/include/musl/glob.h
+new file mode 100644
+index 0000000000..58e6c50678
+--- /dev/null
++++ b/src/include/musl/glob.h
+@@ -0,0 +1,21 @@
++/* SPDX-License-Identifier: LGPL-2.1-or-later */
++#pragma once
++
++#include_next <glob.h>
++
++/* Here, we set 0 to GLOB_ALTDIRFUNC and GLOB_BRACE, rather than the values used by glibc,
++ * to indicate that glob() does not support these flags. */
++
++#ifndef GLOB_ALTDIRFUNC
++#define GLOB_ALTDIRFUNC 0
++#define gl_flags    __dummy1
++#define gl_closedir __dummy2[0]
++#define gl_readdir  __dummy2[1]
++#define gl_opendir  __dummy2[2]
++#define gl_lstat    __dummy2[3]
++#define gl_stat     __dummy2[4]
++#endif
++
++#ifndef GLOB_BRACE
++#define GLOB_BRACE 0
++#endif
+diff --git a/src/test/test-glob-util.c b/src/test/test-glob-util.c
+index a9880f15c8..730961d172 100644
+--- a/src/test/test-glob-util.c
++++ b/src/test/test-glob-util.c
+@@ -61,20 +61,30 @@ TEST(safe_glob) {
+ 
+         fn = strjoina(template, "/*");
+         ASSERT_ERROR(safe_glob(fn, /* flags = */ 0, &v), ENOENT);
++        ASSERT_ERROR(safe_glob_test(fn, /* flags = */ 0, &v), ENOENT);
+ 
+         fn2 = strjoina(template, "/.*");
+         ASSERT_ERROR(safe_glob(fn2, GLOB_NOSORT|GLOB_BRACE, &v), ENOENT);
++        ASSERT_ERROR(safe_glob_test(fn2, GLOB_NOSORT|GLOB_BRACE, &v), ENOENT);
+ 
+         fname = strjoina(template, "/.foobar");
+         ASSERT_OK(touch(fname));
+ 
+         ASSERT_ERROR(safe_glob(fn, /* flags = */ 0, &v), ENOENT);
++        ASSERT_ERROR(safe_glob_test(fn, /* flags = */ 0, &v), ENOENT);
+ 
+         ASSERT_OK(safe_glob(fn2, GLOB_NOSORT|GLOB_BRACE, &v));
+         ASSERT_EQ(strv_length(v), 1u);
+         ASSERT_STREQ(v[0], fname);
+         ASSERT_NULL(v[1]);
+ 
++        v = strv_free(v);
++
++        ASSERT_OK(safe_glob_test(fn2, GLOB_NOSORT|GLOB_BRACE, &v));
++        ASSERT_EQ(strv_length(v), 1u);
++        ASSERT_STREQ(v[0], fname);
++        ASSERT_NULL(v[1]);
++
+         (void) rm_rf(template, REMOVE_ROOT|REMOVE_PHYSICAL);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0029-musl-test-several-random-fixlets-for-unit-tests.patch b/pkgs/os-specific/linux/systemd/musl/0029-musl-test-several-random-fixlets-for-unit-tests.patch
new file mode 100644
index 000000000000..4e8fa289dd41
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0029-musl-test-several-random-fixlets-for-unit-tests.patch
@@ -0,0 +1,380 @@
+From 2c3c84939b930986b31bc0f28e9a08bf43786255 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 9 Sep 2025 13:34:31 +0900
+Subject: [PATCH 29/30] musl: test: several random fixlets for unit tests
+
+---
+ src/boot/test-efi-string.c             | 36 ++++++++++++++++++++------
+ src/libsystemd/sd-bus/test-bus-error.c |  6 +++++
+ src/test/meson.build                   |  1 +
+ src/test/test-errno-util.c             | 12 ++++++++-
+ src/test/test-fileio.c                 | 10 ++++++-
+ src/test/test-locale-util.c            |  7 ++++-
+ src/test/test-os-util.c                |  6 ++++-
+ src/test/test-seccomp.c                |  8 ++++--
+ src/test/test-time-util.c              | 24 +++++++++++++++++
+ test/meson.build                       |  2 ++
+ test/test-sysusers.sh.in               | 22 +++++++++++++++-
+ 11 files changed, 119 insertions(+), 15 deletions(-)
+
+diff --git a/src/boot/test-efi-string.c b/src/boot/test-efi-string.c
+index e0d3bd9b71..af6dd1fb64 100644
+--- a/src/boot/test-efi-string.c
++++ b/src/boot/test-efi-string.c
+@@ -410,13 +410,27 @@ TEST(startswith8) {
+         ASSERT_NULL(startswith8(NULL, ""));
+ }
+ 
+-#define TEST_FNMATCH_ONE(pattern, haystack, expect)                                     \
+-        ({                                                                              \
+-                ASSERT_EQ(fnmatch(pattern, haystack, 0), expect ? 0 : FNM_NOMATCH);     \
+-                ASSERT_EQ(efi_fnmatch(u##pattern, u##haystack), expect);                \
++#define TEST_FNMATCH_ONE_FULL(pattern, haystack, expect, skip_libc)     \
++        ({                                                              \
++                if (!skip_libc)                                         \
++                        ASSERT_EQ(fnmatch(pattern, haystack, 0), expect ? 0 : FNM_NOMATCH); \
++                ASSERT_EQ(efi_fnmatch(u##pattern, u##haystack), expect); \
+         })
+ 
++#define TEST_FNMATCH_ONE(pattern, haystack, expect)             \
++        TEST_FNMATCH_ONE_FULL(pattern, haystack, expect, false)
++
+ TEST(efi_fnmatch) {
++        bool skip_libc;
++
++#ifdef __GLIBC__
++        skip_libc = false;
++#else
++        /* It seems musl is too strict in handling "[]" (or has a bug?). Anyway, let's skip some test cases
++         * when built with musl. The behavior of efi_fnmatch() does not need to match musl's fnmatch(). */
++        skip_libc = true;
++#endif
++
+         TEST_FNMATCH_ONE("", "", true);
+         TEST_FNMATCH_ONE("abc", "abc", true);
+         TEST_FNMATCH_ONE("aBc", "abc", false);
+@@ -447,18 +461,18 @@ TEST(efi_fnmatch) {
+         TEST_FNMATCH_ONE("[abc", "a", false);
+         TEST_FNMATCH_ONE("[][!] [][!] [][!]", "[ ] !", true);
+         TEST_FNMATCH_ONE("[]-] []-]", "] -", true);
+-        TEST_FNMATCH_ONE("[1\\]] [1\\]]", "1 ]", true);
++        TEST_FNMATCH_ONE_FULL("[1\\]] [1\\]]", "1 ]", true, skip_libc);
+         TEST_FNMATCH_ONE("[$-\\+]", "&", true);
+         TEST_FNMATCH_ONE("[1-3A-C] [1-3A-C]", "2 B", true);
+         TEST_FNMATCH_ONE("[3-5] [3-5] [3-5]", "3 4 5", true);
+         TEST_FNMATCH_ONE("[f-h] [f-h] [f-h]", "f g h", true);
+-        TEST_FNMATCH_ONE("[a-c-f] [a-c-f] [a-c-f] [a-c-f] [a-c-f]", "a b c - f", true);
+-        TEST_FNMATCH_ONE("[a-c-f]", "e", false);
++        TEST_FNMATCH_ONE_FULL("[a-c-f] [a-c-f] [a-c-f] [a-c-f] [a-c-f]", "a b c - f", true, skip_libc);
++        TEST_FNMATCH_ONE_FULL("[a-c-f]", "e", false, skip_libc);
+         TEST_FNMATCH_ONE("[--0] [--0] [--0]", "- . 0", true);
+         TEST_FNMATCH_ONE("[+--] [+--] [+--]", "+ , -", true);
+         TEST_FNMATCH_ONE("[f-l]", "m", false);
+         TEST_FNMATCH_ONE("[b]", "z-a", false);
+-        TEST_FNMATCH_ONE("[a\\-z]", "b", false);
++        TEST_FNMATCH_ONE_FULL("[a\\-z]", "b", false, skip_libc);
+         TEST_FNMATCH_ONE("?a*b[.-0]c", "/a/b/c", true);
+         TEST_FNMATCH_ONE("debian-*-*-*.*", "debian-jessie-2018-06-17-kernel-image-5.10.0-16-amd64.efi", true);
+ 
+@@ -674,8 +688,14 @@ TEST(xvasprintf_status) {
+         test_printf_one("string");
+         test_printf_one("%%-%%%%");
+ 
++#ifdef __GLIBC__
+         test_printf_one("%p %p %32p %*p %*p", NULL, (void *) 0xF, &errno, 0, &saved_argc, 20, &saved_argv);
+         test_printf_one("%-10p %-32p %-*p %-*p", NULL, &errno, 0, &saved_argc, 20, &saved_argv);
++#else
++        /* musl prints NULL as 0, while glibc and our implementation print it as (nil). */
++        test_printf_one("%p %32p %*p %*p", (void *) 0xF, &errno, 0, &saved_argc, 20, &saved_argv);
++        test_printf_one("%-32p %-*p %-*p", &errno, 0, &saved_argc, 20, &saved_argv);
++#endif
+ 
+         test_printf_one("%c %3c %*c %*c %-8c", '1', '!', 0, 'a', 9, '_', '>');
+ 
+diff --git a/src/libsystemd/sd-bus/test-bus-error.c b/src/libsystemd/sd-bus/test-bus-error.c
+index c6b86be621..d69eb984dc 100644
+--- a/src/libsystemd/sd-bus/test-bus-error.c
++++ b/src/libsystemd/sd-bus/test-bus-error.c
+@@ -232,7 +232,13 @@ TEST(sd_bus_error_set_errnof) {
+         errno = EACCES;
+         assert_se(asprintf(&str, "%m") >= 0);
+         assert_se(streq(error.message, str));
++#ifdef __GLIBC__
+         assert_se(error._need_free == 0);
++#else
++        /* musl's strerror_l() always writes error message in the given buffer, hence the we need to
++         * free it. */
++        assert_se(error._need_free == 1);
++#endif
+ 
+         str = mfree(str);
+         sd_bus_error_free(&error);
+diff --git a/src/test/meson.build b/src/test/meson.build
+index 1dd61effc0..4bdfc65f04 100644
+--- a/src/test/meson.build
++++ b/src/test/meson.build
+@@ -16,6 +16,7 @@ test_env = {
+         'PROJECT_BUILD_ROOT' : meson.project_build_root(),
+         'SYSTEMD_SLOW_TESTS' : want_slow_tests ? '1' : '0',
+         'PYTHONDONTWRITEBYTECODE' : '1',
++        'SYSTEMD_LIBC' : get_option('libc'),
+ }
+ if conf.get('ENABLE_LOCALED') == 1
+         test_env += {'SYSTEMD_LANGUAGE_FALLBACK_MAP' : language_fallback_map}
+diff --git a/src/test/test-errno-util.c b/src/test/test-errno-util.c
+index 1a0154fb05..1ad067b2c7 100644
+--- a/src/test/test-errno-util.c
++++ b/src/test/test-errno-util.c
+@@ -26,18 +26,28 @@ TEST(STRERROR) {
+         log_info("STRERROR(%d), STRERROR(%d) → %s, %s", 200, 201, STRERROR(200), STRERROR(201));
+ 
+         const char *a = STRERROR(200), *b = STRERROR(201);
++#ifdef __GLIBC__
+         ASSERT_NOT_NULL(strstr(a, "200"));
+         ASSERT_NOT_NULL(strstr(b, "201"));
++#else
++        /* musl provides catch all error message for unknown error number. */
++        ASSERT_STREQ(a, "No error information");
++        ASSERT_STREQ(b, "No error information");
++#endif
+ 
+         /* Check with negative values */
+         ASSERT_STREQ(a, STRERROR(-200));
+         ASSERT_STREQ(b, STRERROR(-201));
+ 
+         const char *c = STRERROR(INT_MAX);
++        log_info("STRERROR(%d) → %s", INT_MAX, c);
++#ifdef __GLIBC__
+         char buf[DECIMAL_STR_MAX(int)];
+         xsprintf(buf, "%d", INT_MAX);  /* INT_MAX is hexadecimal, use printf to convert to decimal */
+-        log_info("STRERROR(%d) → %s", INT_MAX, c);
+         ASSERT_NOT_NULL(strstr(c, buf));
++#else
++        ASSERT_STREQ(c, "No error information");
++#endif
+ }
+ 
+ TEST(STRERROR_OR_ELSE) {
+diff --git a/src/test/test-fileio.c b/src/test/test-fileio.c
+index e0ae30bbb9..ad572056c2 100644
+--- a/src/test/test-fileio.c
++++ b/src/test/test-fileio.c
+@@ -400,7 +400,15 @@ TEST(write_string_stream) {
+ 
+         f = fdopen(fd, "r");
+         assert_se(f);
+-        assert_se(write_string_stream(f, "boohoo", 0) < 0);
++#ifdef __GLIBC__
++        ASSERT_ERROR(write_string_stream(f, "boohoo", 0), EBADF);
++#else
++        /* Even the file is opened with the read-only mode, fputs() and fputc() by musl succeed but nothing
++         * actually written, thus write_string_stream() also succeeds. */
++        ASSERT_OK(write_string_stream(f, "boohoo", 0));
++        rewind(f);
++        ASSERT_NULL(fgets(buf, sizeof(buf), f));
++#endif
+         f = safe_fclose(f);
+ 
+         f = fopen(fn, "r+");
+diff --git a/src/test/test-locale-util.c b/src/test/test-locale-util.c
+index e264cff5dd..faa7ac4211 100644
+--- a/src/test/test-locale-util.c
++++ b/src/test/test-locale-util.c
+@@ -50,7 +50,12 @@ TEST(locale_is_installed) {
+         assert_se(locale_is_installed("\x01gar\x02 bage\x03") == 0);
+ 
+         /* Definitely not installed */
+-        assert_se(locale_is_installed("zz_ZZ") == 0);
++#ifdef __GLIBC__
++        ASSERT_OK_ZERO(locale_is_installed("zz_ZZ"));
++#else
++        /* musl seems to return a non-null locale object even if it is not installed. */
++        ASSERT_OK_POSITIVE(locale_is_installed("zz_ZZ"));
++#endif
+ }
+ 
+ TEST(keymaps) {
+diff --git a/src/test/test-os-util.c b/src/test/test-os-util.c
+index fcab1139c2..902062560f 100644
+--- a/src/test/test-os-util.c
++++ b/src/test/test-os-util.c
+@@ -127,7 +127,11 @@ TEST(os_release_support_ended) {
+ 
+         ASSERT_TRUE(os_release_support_ended("1999-01-01", false, NULL));
+         ASSERT_FALSE(os_release_support_ended("2037-12-31", false, NULL));
+-        assert_se(os_release_support_ended("-1-1-1", true, NULL) == -EINVAL);
++#ifdef __GLIBC__
++        ASSERT_ERROR(os_release_support_ended("-1-1-1", true, NULL), EINVAL);
++#else
++        ASSERT_ERROR(os_release_support_ended("-1-1-1", true, NULL), ERANGE);
++#endif
+ 
+         r = os_release_support_ended(NULL, false, NULL);
+         if (r < 0)
+diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c
+index 13c65a93cd..a9953b2c98 100644
+--- a/src/test/test-seccomp.c
++++ b/src/test/test-seccomp.c
+@@ -553,9 +553,13 @@ TEST(memory_deny_write_execute_mmap) {
+                 assert_se(seccomp_memory_deny_write_execute() >= 0);
+ 
+                 p = mmap(NULL, page_size(), PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+-#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__) || defined(__loongarch_lp64)
++#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc64__) || defined(__arm__) || defined(__aarch64__) || defined(__loongarch_lp64) || !defined(__GLIBC__)
+                 assert_se(p == MAP_FAILED);
+-                assert_se(errno == EPERM);
++#  ifdef __GLIBC__
++                ASSERT_EQ(errno, EPERM);
++#  else
++                ASSERT_EQ(errno, ENOMEM);
++#  endif
+ #endif
+                 /* Depending on kernel, libseccomp, and glibc versions, other architectures
+                  * might fail or not. Let's not assert success. */
+diff --git a/src/test/test-time-util.c b/src/test/test-time-util.c
+index 7569f89ca0..203f8a148d 100644
+--- a/src/test/test-time-util.c
++++ b/src/test/test-time-util.c
+@@ -406,6 +406,25 @@ static void test_format_timestamp_impl(usec_t x) {
+         const char *xx = FORMAT_TIMESTAMP(x);
+         ASSERT_NOT_NULL(xx);
+ 
++#ifndef __GLIBC__
++        /* Because of the timezone change, format_timestamp() may set timezone that is currently unused.
++         * E.g. Africa/Juba may set EAT, but currently it uses CAT/CAST. */
++        const char *space;
++        ASSERT_NOT_NULL(space = strrchr(xx, ' '));
++        const char *tz = space + 1;
++        if (!streq_ptr(tz, tzname[0]) &&
++            !streq_ptr(tz, tzname[1]) &&
++            parse_gmtoff(tz, NULL) < 0) {
++
++                log_warning("@" USEC_FMT " → %s, timezone '%s' is currently unused, ignoring.", x, xx, tz);
++
++                /* Verify the generated string except for the timezone part. Of course, in most cases, parsed
++                 * time does not match with the input, hence only check if it is parsable. */
++                ASSERT_OK(parse_timestamp(strndupa_safe(xx, space - xx), NULL));
++                return;
++        }
++#endif
++
+         usec_t y;
+         ASSERT_OK(parse_timestamp(xx, &y));
+         const char *yy = FORMAT_TIMESTAMP(y);
+@@ -1116,7 +1135,12 @@ TEST(in_utc_timezone) {
+         assert_se(setenv("TZ", ":UTC", 1) >= 0);
+         assert_se(in_utc_timezone());
+         ASSERT_STREQ(tzname[0], "UTC");
++#ifdef __GLIBC__
+         ASSERT_STREQ(tzname[1], "UTC");
++#else
++        /* musl sets an empty string to tzname[1] when DST is not used by the timezone. */
++        ASSERT_STREQ(tzname[1], "");
++#endif
+         assert_se(timezone == 0);
+         assert_se(daylight == 0);
+ 
+diff --git a/test/meson.build b/test/meson.build
+index 505a14aa81..1f1ec0a0e1 100644
+--- a/test/meson.build
++++ b/test/meson.build
+@@ -13,6 +13,7 @@ if conf.get('ENABLE_SYSUSERS') == 1
+                      # https://github.com/mesonbuild/meson/issues/2681
+                      args : exe.full_path(),
+                      depends : exe,
++                     env : test_env,
+                      suite : 'sysusers')
+ 
+                 if have_standalone_binaries
+@@ -22,6 +23,7 @@ if conf.get('ENABLE_SYSUSERS') == 1
+                              # https://github.com/mesonbuild/meson/issues/2681
+                              args : exe.full_path(),
+                              depends : exe,
++                             env : test_env,
+                              suite : 'sysusers')
+                 endif
+         endif
+diff --git a/test/test-sysusers.sh.in b/test/test-sysusers.sh.in
+index 3218923590..ae7bfee2fe 100755
+--- a/test/test-sysusers.sh.in
++++ b/test/test-sysusers.sh.in
+@@ -13,6 +13,12 @@ TESTDIR=$(mktemp --tmpdir --directory "test-sysusers.XXXXXXXXXX")
+ # shellcheck disable=SC2064
+ trap "rm -rf '$TESTDIR'" EXIT INT QUIT PIPE
+ 
++skip_nis() {
++    # musl seems to not support NIS entries. Let's skip the test case for NIS entries.
++    local path=${1:?}
++    [[ "${SYSTEMD_LIBC:-}" == musl && "${path##*/}" == "test-11.input" ]]
++}
++
+ prepare_testdir() {
+     mkdir -p "$TESTDIR/etc/sysusers.d/"
+     mkdir -p "$TESTDIR/usr/lib/sysusers.d/"
+@@ -50,6 +56,7 @@ rm -f "$TESTDIR"/etc/sysusers.d/* "$TESTDIR"/usr/lib/sysusers.d/*
+ 
+ # happy tests
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f"
+     prepare_testdir "${f%.input}"
+     cp "$f" "$TESTDIR/usr/lib/sysusers.d/test.conf"
+@@ -59,6 +66,7 @@ for f in $(find "$SOURCE"/test-*.input | sort -V); do
+ done
+ 
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f on stdin"
+     prepare_testdir "${f%.input}"
+     touch "$TESTDIR/etc/sysusers.d/test.conf"
+@@ -68,6 +76,7 @@ for f in $(find "$SOURCE"/test-*.input | sort -V); do
+ done
+ 
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f on stdin with --replace"
+     prepare_testdir "${f%.input}"
+     touch "$TESTDIR/etc/sysusers.d/test.conf"
+@@ -133,6 +142,7 @@ SYS_GID_MAX999
+ EOF
+ 
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f (with login.defs)"
+     prepare_testdir "${f%.input}"
+     cp "$f" "$TESTDIR/usr/lib/sysusers.d/test.conf"
+@@ -149,6 +159,7 @@ mv "$TESTDIR/etc/login.defs" "$TESTDIR/etc/login.defs.moved"
+ ln -s ../../../../../etc/login.defs.moved "$TESTDIR/etc/login.defs"
+ 
+ for f in $(find "$SOURCE"/test-*.input | sort -V); do
++    skip_nis "$f" && continue
+     echo "*** Running $f (with login.defs symlinked)"
+     prepare_testdir "${f%.input}"
+     cp "$f" "$TESTDIR/usr/lib/sysusers.d/test.conf"
+@@ -161,13 +172,22 @@ done
+ 
+ rm -f "$TESTDIR"/etc/sysusers.d/* "$TESTDIR"/usr/lib/sysusers.d/*
+ 
++preprocess_error() {
++    # Convert error message for ERANGE from glibc to musl.
++    if [[ "${SYSTEMD_LIBC:-}" == musl ]]; then
++        sed -e 's/Numerical result out of range/Result not representable/' "${1:?}"
++    else
++        cat "${1:?}"
++    fi
++}
++
+ # tests for error conditions
+ for f in $(find "$SOURCE"/unhappy-*.input | sort -V); do
+     echo "*** Running test $f"
+     prepare_testdir "${f%.input}"
+     cp "$f" "$TESTDIR/usr/lib/sysusers.d/test.conf"
+     SYSTEMD_LOG_LEVEL=info "$SYSUSERS" --root="$TESTDIR" 2>&1 | tail -n1 | sed -r 's/^[^:]+:[^:]+://' >"$TESTDIR/err"
+-    if ! diff -u "$TESTDIR/err"  "${f%.*}.expected-err" >&2; then
++    if ! diff -u "$TESTDIR/err"  <(preprocess_error "${f%.*}.expected-err") >&2; then
+         echo >&2 "**** Unexpected error output for $f"
+         cat >&2 "$TESTDIR/err"
+         exit 1
+-- 
+2.51.0
+
diff --git a/pkgs/os-specific/linux/systemd/musl/0030-musl-ci-add-build-test-and-unit-tests.patch b/pkgs/os-specific/linux/systemd/musl/0030-musl-ci-add-build-test-and-unit-tests.patch
new file mode 100644
index 000000000000..51eec7e78ac3
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/musl/0030-musl-ci-add-build-test-and-unit-tests.patch
@@ -0,0 +1,352 @@
+From b9a6cd49a4d4c6a40968224f5aac20586273b171 Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 9 Sep 2025 13:42:24 +0900
+Subject: [PATCH 30/30] musl: ci: add build test and unit tests
+
+---
+ .github/workflows/build-test-musl.sh  | 125 ++++++++++++++++++++++++++
+ .github/workflows/linter.yml          |   9 ++
+ .github/workflows/unit-tests-musl.sh  |  55 ++++++++++++
+ .github/workflows/unit-tests-musl.yml | 112 +++++++++++++++++++++++
+ 4 files changed, 301 insertions(+)
+ create mode 100755 .github/workflows/build-test-musl.sh
+ create mode 100755 .github/workflows/unit-tests-musl.sh
+ create mode 100644 .github/workflows/unit-tests-musl.yml
+
+diff --git a/.github/workflows/build-test-musl.sh b/.github/workflows/build-test-musl.sh
+new file mode 100755
+index 0000000000..bc38924666
+--- /dev/null
++++ b/.github/workflows/build-test-musl.sh
+@@ -0,0 +1,125 @@
++#!/bin/bash
++# SPDX-License-Identifier: LGPL-2.1-or-later
++
++set -eux
++
++if ! command -v musl-gcc 2>/dev/null; then
++    echo "musl-gcc is not installed, skipping the test."
++    exit 0
++fi
++
++. /etc/os-release
++
++TMPDIR=$(mktemp -d)
++
++cleanup() (
++    set +e
++
++    if [[ -d "$TMPDIR" ]]; then
++        rm -rf "$TMPDIR"
++    fi
++)
++
++trap cleanup EXIT ERR INT TERM
++
++mkdir -p "${TMPDIR}/build"
++mkdir -p "${TMPDIR}/include"
++
++CFLAGS="-idirafter ${TMPDIR}/include"
++
++LINKS=(
++    acl
++    archive.h
++    archive_entry.h
++    asm-generic
++    audit-records.h
++    audit_logging.h
++    bpf
++    bzlib.h
++    dwarf.h
++    elfutils
++    fido.h
++    gcrypt.h
++    gelf.h
++    gnutls
++    idn2.h
++    libaudit.h
++    libcryptsetup.h
++    libelf.h
++    libkmod.h
++    lz4.h
++    lz4frame.h
++    lz4hc.h
++    lzma
++    lzma.h
++    microhttpd.h
++    mtd
++    openssl
++    pcre2.h
++    pwquality.h
++    qrencode.h
++    seccomp-syscalls.h
++    seccomp.h
++    security
++    sys/acl.h
++    sys/capability.h
++    tss2
++    xen
++    xkbcommon
++    zconf.h
++    zlib.h
++    zstd.h
++    zstd_errors.h
++)
++
++if [[ "$ID" == arch ]]; then
++    LINKS+=(
++        asm
++        curl
++        gpg-error.h
++        libiptc
++        linux
++    )
++elif [[ "$ID" == centos ]]; then
++    LINKS+=(
++        asm
++        curl
++        gpg-error.h
++        linux
++        selinux
++    )
++elif [[ "$ID" == fedora ]]; then
++    LINKS+=(
++        asm
++        curl
++        gpg-error.h
++        libiptc
++        linux
++        selinux
++    )
++elif [[ "$ID" == debian ]] || [[ "$ID" == ubuntu ]]; then
++    # Currently, debian/ubuntu does not provide crypt.h for musl. Hence, this does not work.
++
++    CFLAGS="$CFLAGS -idirafter /usr/include/$(uname -m)-linux-gnu"
++
++    LINKS+=(
++        linux
++        selinux
++        sys/apparmor.h
++    )
++fi
++
++for t in "${LINKS[@]}"; do
++    [[ -e "/usr/include/$t" ]]
++    link="${TMPDIR}/include/${t}"
++    mkdir -p "${link%/*}"
++    ln -s "/usr/include/$t" "$link"
++done
++
++env CC=musl-gcc \
++    CXX=musl-gcc \
++    CFLAGS="$CFLAGS" \
++    CXXFLAGS="$CFLAGS" \
++    meson setup --werror -Ddbus-interfaces-dir=no -Dlibc=musl "${TMPDIR}/build"
++
++ninja -v -C "${TMPDIR}/build"
+diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
+index c107b2da1e..b92a00478c 100644
+--- a/.github/workflows/linter.yml
++++ b/.github/workflows/linter.yml
+@@ -49,6 +49,12 @@ jobs:
+           [Build]
+           ToolsTreeDistribution=fedora
+           ToolsTreeRelease=rawhide
++
++          [Content]
++          Packages=
++                libgcrypt-devel
++                libgpg-error-devel
++                musl-gcc
+           EOF
+ 
+           mkosi -f box -- true
+@@ -77,3 +83,6 @@ jobs:
+ 
+       - name: Run clang-tidy
+         run: mkosi box -- meson test -C build --suite=clang-tidy --print-errorlogs --no-stdsplit
++
++      - name: Build with musl
++        run: mkosi box -- .github/workflows/build-test-musl.sh
+diff --git a/.github/workflows/unit-tests-musl.sh b/.github/workflows/unit-tests-musl.sh
+new file mode 100755
+index 0000000000..f6e2b2f536
+--- /dev/null
++++ b/.github/workflows/unit-tests-musl.sh
+@@ -0,0 +1,55 @@
++#!/usr/bin/env bash
++# SPDX-License-Identifier: LGPL-2.1-or-later
++
++# shellcheck disable=SC2206
++PHASES=(${@:-SETUP BUILD RUN CLEANUP})
++
++function info() {
++    echo -e "\033[33;1m$1\033[0m"
++}
++function run_meson() {
++    if ! meson "$@"; then
++        find . -type f -name meson-log.txt -exec cat '{}' +
++        return 1
++    fi
++}
++
++set -ex
++
++for phase in "${PHASES[@]}"; do
++    case $phase in
++        SETUP)
++            info "Setup phase"
++            # Alpine still uses split-usr.
++            for i in /bin/* /sbin/*; do
++                ln -rs "$i" "/usr/$i";
++            done
++            ;;
++        BUILD)
++            info "Build phase"
++            run_meson setup --werror -Dtests=unsafe -Dslow-tests=true -Dfuzz-tests=true -Dlibc=musl build
++            ninja -C build -v
++            ;;
++        RUN)
++            info "Run phase"
++            # Create dummy machine ID.
++            echo '052e58f661f94bd080e258b96aea3f7b' > /etc/machine-id
++
++            # Start dbus for several unit tests.
++            mkdir -p /var/run/dbus
++            /usr/bin/dbus-daemon --system || :
++
++            # Here, we explicitly set SYSTEMD_IN_CHROOT=yes as unfortunately runnin_in_chroot() does not
++            # correctly detect the environment.
++            env \
++                SYSTEMD_IN_CHROOT=yes \
++                meson test -C build -v
++            ;;
++        CLEANUP)
++            info "Cleanup phase"
++            ;;
++        *)
++            echo >&2 "Unknown phase '$phase'"
++            exit 1
++    esac
++done
+diff --git a/.github/workflows/unit-tests-musl.yml b/.github/workflows/unit-tests-musl.yml
+new file mode 100644
+index 0000000000..e30974254c
+--- /dev/null
++++ b/.github/workflows/unit-tests-musl.yml
+@@ -0,0 +1,112 @@
++---
++# vi: ts=2 sw=2 et:
++# SPDX-License-Identifier: LGPL-2.1-or-later
++#
++name: Unit tests (musl)
++on:
++  pull_request:
++    paths:
++      - '**/meson.build'
++      - '.github/workflows/**'
++      - 'meson_options.txt'
++      - 'src/**'
++      - 'test/fuzz/**'
++
++permissions:
++  contents: read
++
++jobs:
++  build:
++    runs-on: ubuntu-latest
++    steps:
++      - name: Repository checkout
++        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
++
++      - name: Install build dependencies
++        uses: jirutka/setup-alpine@v1
++        with:
++          arch: x86_64
++          branch: edge
++          packages: >
++            acl
++            acl-dev
++            audit-dev
++            bash
++            bash-completion-dev
++            bpftool
++            build-base
++            bzip2-dev
++            coreutils
++            cryptsetup-dev
++            curl-dev
++            dbus
++            dbus-dev
++            elfutils-dev
++            gettext-dev
++            git
++            glib-dev
++            gnutls-dev
++            gperf
++            grep
++            iproute2
++            iptables-dev
++            kbd
++            kexec-tools
++            kmod
++            kmod-dev
++            libapparmor-dev
++            libarchive-dev
++            libbpf-dev
++            libcap-dev
++            libcap-utils
++            libfido2-dev
++            libgcrypt-dev
++            libidn2-dev
++            libmicrohttpd-dev
++            libpwquality-dev
++            libqrencode-dev
++            libseccomp-dev
++            libselinux-dev
++            libxkbcommon-dev
++            linux-pam-dev
++            lz4-dev
++            meson
++            openssl
++            openssl-dev
++            p11-kit-dev
++            pcre2-dev
++            pkgconf
++            polkit-dev
++            py3-elftools
++            py3-jinja2
++            py3-pefile
++            py3-pytest
++            py3-lxml
++            quota-tools
++            rsync
++            sfdisk
++            tpm2-tss-dev
++            tpm2-tss-esys
++            tpm2-tss-rc
++            tpm2-tss-tcti-device
++            tzdata
++            util-linux-dev
++            util-linux-login
++            util-linux-misc
++            valgrind-dev
++            xen-dev
++            zlib-dev
++            zstd-dev
++
++      - name: Setup
++        run: .github/workflows/unit-tests-musl.sh SETUP
++        shell: alpine.sh --root {0}
++      - name: Build
++        run: .github/workflows/unit-tests-musl.sh BUILD
++        shell: alpine.sh {0}
++      - name: Run
++        run: .github/workflows/unit-tests-musl.sh RUN
++        shell: alpine.sh --root {0}
++      - name: Cleanup
++        run: .github/workflows/unit-tests-musl.sh CLEANUP
++        shell: alpine.sh --root {0}
+-- 
+2.51.0
+
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 4a4346b32639..4a81c1319463 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -58,6 +58,38 @@ let
     submodule
     ;
 
+  /*
+    Creates a structured value type suitable for serialization formats.
+
+    Parameters:
+    - typeName: String describing the format (e.g. "JSON", "YAML", "XML")
+    - nullable: Whether the structured value type allows `null` values.
+
+    Returns a type suitable for structured data formats that supports:
+    - Basic types: boolean, integer, float, string, path
+    - Complex types: attribute sets and lists
+  */
+  mkStructuredType =
+    {
+      typeName,
+      nullable ? true,
+    }:
+    let
+      baseType = oneOf [
+        bool
+        int
+        float
+        str
+        path
+        (attrsOf valueType)
+        (listOf valueType)
+      ];
+      valueType = (if nullable then nullOr baseType else baseType) // {
+        description = "${typeName} value";
+      };
+    in
+    valueType;
+
   # Attributes added accidentally in https://github.com/NixOS/nixpkgs/pull/335232 (2024-08-18)
   # Deprecated in https://github.com/NixOS/nixpkgs/pull/415666 (2025-06)
   allowAliases = pkgs.config.allowAliases or false;
@@ -130,23 +162,7 @@ optionalAttrs allowAliases aliases
     { }:
     {
 
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "JSON value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "JSON"; };
 
       generate =
         name: value:
@@ -160,7 +176,7 @@ optionalAttrs allowAliases aliases
               preferLocalBuild = true;
             }
             ''
-              jq . "$valuePath"> $out
+              jq . "$valuePath" > $out
             ''
         ) { };
 
@@ -187,23 +203,7 @@ optionalAttrs allowAliases aliases
             ''
         ) { };
 
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "YAML 1.1 value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "YAML 1.1"; };
 
     };
 
@@ -226,23 +226,7 @@ optionalAttrs allowAliases aliases
             ''
         ) { };
 
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "YAML 1.2 value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "YAML 1.2"; };
 
     };
 
@@ -503,23 +487,7 @@ optionalAttrs allowAliases aliases
     { }:
     json { }
     // {
-      type =
-        let
-          valueType =
-            oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ]
-            // {
-              description = "TOML value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "TOML"; };
 
       generate =
         name: value:
@@ -552,23 +520,7 @@ optionalAttrs allowAliases aliases
     { }:
     json { }
     // {
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "CDN value";
-            };
-        in
-        valueType;
+      type = mkStructuredType { typeName = "CDN"; };
 
       generate =
         name: value:
@@ -983,23 +935,9 @@ optionalAttrs allowAliases aliases
   pythonVars =
     { }:
     {
-      type =
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              float
-              int
-              path
-              str
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "Python value";
-            };
-        in
-        attrsOf valueType;
+      type = attrsOf (mkStructuredType {
+        typeName = "Python";
+      });
 
       lib = {
         mkRaw = value: {
@@ -1079,23 +1017,7 @@ optionalAttrs allowAliases aliases
     }:
     if format == "badgerfish" then
       {
-        type =
-          let
-            valueType =
-              nullOr (oneOf [
-                bool
-                int
-                float
-                str
-                path
-                (attrsOf valueType)
-                (listOf valueType)
-              ])
-              // {
-                description = "XML value";
-              };
-          in
-          valueType;
+        type = mkStructuredType { typeName = "XML"; };
 
         generate =
           name: value:
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index d07f97e9840c..836b48664aa5 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -6,6 +6,7 @@ let
       stdenv,
       fetchFromGitHub,
       fetchurl,
+      fetchpatch2,
       lib,
       replaceVars,
       writeShellScriptBin,
@@ -424,6 +425,12 @@ let
       ]
       ++ lib.optionals (stdenv'.hostPlatform.isDarwin && olderThan "16") [
         ./patches/export-dynamic-darwin-15-.patch
+      ]
+      ++ lib.optionals (atLeast "17") [
+        (fetchpatch2 {
+          url = "https://github.com/postgres/postgres/commit/a48d1ef58652229521ba4b5070e19f857608b22e.patch";
+          hash = "sha256-3FKQS1Vpu+p6z6c1GWs6GlrLl2Bgm9paEU/z81LrEus=";
+        })
       ];
 
       installTargets = [ "install-world" ];
diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index f71d254ae7b6..3048e467397b 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -20,6 +20,15 @@
   postgresql,
   buildPackages,
 
+  # Curl
+  curlSupport ?
+    lib.meta.availableOn stdenv.hostPlatform curl
+    # Building statically fails with:
+    # configure: error: library 'curl' does not provide curl_multi_init
+    # https://www.postgresql.org/message-id/487dacec-6d8d-46c0-a36f-d5b8c81a56f1%40technowledgy.de
+    && !stdenv.hostPlatform.isStatic,
+  curl,
+
   # GSSAPI
   gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic,
   libkrb5,
@@ -31,14 +40,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpq";
-  version = "17.6";
+  version = "18.0";
 
   src = fetchFromGitHub {
     owner = "postgres";
     repo = "postgres";
     # rev, not tag, on purpose: see generic.nix.
-    rev = "refs/tags/REL_17_6";
-    hash = "sha256-/7C+bjmiJ0/CvoAc8vzTC50vP7OsrM6o0w+lmmHvKvU=";
+    rev = "refs/tags/REL_18_0";
+    hash = "sha256-xA6gbJe4tIV9bYRFrdI4Rfy20ZwTkvyyjt7ZxvCFEec=";
   };
 
   __structuredAttrs = true;
@@ -61,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
     openssl
   ]
+  ++ lib.optionals curlSupport [ curl ]
   ++ lib.optionals gssSupport [ libkrb5 ]
   ++ lib.optionals nlsSupport [ gettext ];
 
@@ -109,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-perl"
     "--without-readline"
   ]
+  ++ lib.optionals curlSupport [ "--with-libcurl" ]
   ++ lib.optionals gssSupport [ "--with-gssapi" ]
   ++ lib.optionals nlsSupport [ "--enable-nls" ];
 
@@ -134,6 +145,11 @@ stdenv.mkDerivation (finalAttrs: {
     make -C src/common install pg_config.env
     make -C src/include install
     make -C src/interfaces/libpq install
+  ''
+  + lib.optionalString curlSupport ''
+    make -C src/interfaces/libpq-oauth install
+  ''
+  + ''
     make -C src/port install
 
     substituteInPlace src/common/pg_config.env \
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 3e348cfcef79..dcd8341ee0fd 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1,6 +1,7 @@
 # THIS IS A GENERATED FILE.  DO NOT EDIT!
 {
   lib,
+  appres,
   bdftopcf,
   font-adobe-100dpi,
   font-adobe-75dpi,
@@ -8,11 +9,29 @@
   font-adobe-utopia-75dpi,
   font-adobe-utopia-type1,
   font-alias,
+  font-bh-100dpi,
+  font-bh-75dpi,
+  font-bh-lucidatypewriter-100dpi,
+  font-bh-lucidatypewriter-75dpi,
   font-bh-ttf,
   font-bh-type1,
+  font-bitstream-100dpi,
+  font-bitstream-75dpi,
+  font-bitstream-type1,
+  font-cronyx-cyrillic,
   font-encodings,
+  font-isas-misc,
+  font-micro-misc,
+  font-misc-cyrillic,
+  font-misc-ethiopic,
   font-mutt-misc,
+  font-schumacher-misc,
+  font-screen-cyrillic,
+  font-sony-misc,
+  font-sun-misc,
   font-util,
+  font-winitzki-cyrillic,
+  font-xfree86-type1,
   gccmakedep,
   ico,
   imake,
@@ -24,6 +43,7 @@
   libpciaccess,
   libpthread-stubs,
   libsm,
+  libwindowswm,
   libx11,
   libxau,
   libxaw,
@@ -35,16 +55,30 @@
   libxcb-render-util,
   libxcb-util,
   libxcb-wm,
-  libxcvt,
+  libxcomposite,
   libxcursor,
+  libxcvt,
+  libxdamage,
   libxdmcp,
   libxext,
   libxfixes,
+  libxfont_1,
+  libxfont_2,
+  libxft,
+  libxi,
+  libxinerama,
+  libxkbfile,
   libxmu,
+  libxp,
   libxpm,
+  libxpresent,
   libxrandr,
   libxrender,
+  libxres,
+  libxscrnsaver,
+  libxshmfence,
   libxt,
+  libxtst,
   libxv,
   libxvmc,
   libxxf86dga,
@@ -62,16 +96,20 @@
   transset,
   util-macros,
   viewres,
+  x11perf,
   xauth,
   xbacklight,
   xbitmaps,
+  xcalc,
   xcb-proto,
   xcmsdb,
+  xcompmgr,
   xconsole,
   xcursorgen,
   xcursor-themes,
   xdriinfo,
   xev,
+  xeyes,
   xfontsel,
   xfsinfo,
   xgamma,
@@ -107,6 +145,7 @@
 self: with self; {
 
   inherit
+    appres
     bdftopcf
     gccmakedep
     ico
@@ -116,6 +155,8 @@ self: with self; {
     libpciaccess
     libxcb
     libxcvt
+    libxkbfile
+    libxshmfence
     listres
     lndir
     luit
@@ -126,14 +167,18 @@ self: with self; {
     smproxy
     transset
     viewres
+    x11perf
     xauth
     xbacklight
     xbitmaps
+    xcalc
     xcmsdb
+    xcompmgr
     xconsole
     xcursorgen
     xdriinfo
     xev
+    xeyes
     xfontsel
     xfsinfo
     xgamma
@@ -168,27 +213,58 @@ self: with self; {
   fontadobeutopia75dpi = font-adobe-utopia-75dpi;
   fontadobeutopiatype1 = font-adobe-utopia-type1;
   fontalias = font-alias;
+  fontbh100dpi = font-bh-100dpi;
+  fontbh75dpi = font-bh-75dpi;
+  fontbhlucidatypewriter100dpi = font-bh-lucidatypewriter-100dpi;
+  fontbhlucidatypewriter75dpi = font-bh-lucidatypewriter-75dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
+  fontbitstream100dpi = font-bitstream-100dpi;
+  fontbitstream75dpi = font-bitstream-75dpi;
+  fontbitstreamtype1 = font-bitstream-type1;
+  fontcronyxcyrillic = font-cronyx-cyrillic;
+  fontisasmisc = font-isas-misc;
+  fontmicromisc = font-micro-misc;
+  fontmisccyrillic = font-misc-cyrillic;
+  fontmiscethiopic = font-misc-ethiopic;
   fontmuttmisc = font-mutt-misc;
+  fontschumachermisc = font-schumacher-misc;
+  fontscreencyrillic = font-screen-cyrillic;
+  fontsonymisc = font-sony-misc;
+  fontsunmisc = font-sun-misc;
   fontutil = font-util;
+  fontwinitzkicyrillic = font-winitzki-cyrillic;
+  fontxfree86type1 = font-xfree86-type1;
   libAppleWM = libapplewm;
   libFS = libfs;
   libICE = libice;
   libpthreadstubs = libpthread-stubs;
   libSM = libsm;
+  libWindowsWM = libwindowswm;
   libX11 = libx11;
   libXau = libxau;
   libXaw = libxaw;
+  libXcomposite = libxcomposite;
   libXcursor = libxcursor;
+  libXdamage = libxdamage;
   libXdmcp = libxdmcp;
   libXext = libxext;
   libXfixes = libxfixes;
+  libXfont2 = libxfont_2;
+  libXfont = libxfont_1;
+  libXft = libxft;
+  libXi = libxi;
+  libXinerama = libxinerama;
   libXmu = libxmu;
+  libXp = libxp;
   libXpm = libxpm;
+  libXpresent = libxpresent;
   libXrandr = libxrandr;
   libXrender = libxrender;
+  libXres = libxres;
+  libXScrnSaver = libxscrnsaver;
   libXt = libxt;
+  libXtst = libxtst;
   libXv = libxv;
   libXvMC = libxvmc;
   libXxf86dga = libxxf86dga;
@@ -210,44 +286,6 @@ self: with self; {
   xorgdocs = xorg-docs;
   xorgsgmldoctools = xorg-sgml-doctools;
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  appres = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      xorgproto,
-      libXt,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "appres";
-      version = "1.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/appres-1.0.7.tar.xz";
-        sha256 = "17w17gqnfmpfmqgbjci1j4lnsd468k5yscxl3n6pmn4z4f4v250i";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        xorgproto
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   bitmap = callPackage (
     {
@@ -384,366 +422,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbh100dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-100dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-100dpi-1.0.4.tar.xz";
-        sha256 = "07mb9781c9yxzp3ifw317v4fbnmg9qyqv0244zfspylihkz5x3zx";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbh75dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-75dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-75dpi-1.0.4.tar.xz";
-        sha256 = "1nkwkqdl946xc4xknhi1pnxdww6rxrv013c7nk5x6ganfg0dh9k0";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhlucidatypewriter100dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-lucidatypewriter-100dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-1.0.4.tar.xz";
-        sha256 = "1wp87pijbydkpcmawsyas7vwhad2xg1mkkwigga2jjh9lknhkv3n";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbhlucidatypewriter75dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bh-lucidatypewriter-75dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.4.tar.xz";
-        sha256 = "1xg86mb9qigf5v0wx0q2shn8qaabsapamj627xllzw31mhwjqkl6";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstream100dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bitstream-100dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bitstream-100dpi-1.0.4.tar.xz";
-        sha256 = "19y1j1v65890x8yn6a47jqljfax3ihfrd25xbzgypxz4xy1cc71d";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstream75dpi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bitstream-75dpi";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz";
-        sha256 = "09pq7dvyyxj6kvps1dm3qr15pjwh9iq9118fryqc5a94fkc39sxa";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstreamspeedo = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bitstream-speedo";
-      version = "1.0.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz";
-        sha256 = "0wmy58cd3k7w2j4v20icnfs8z3b61qj3vqdx958z18w00h9mzsmf";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontbitstreamtype1 = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-bitstream-type1";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-bitstream-type1-1.0.4.tar.xz";
-        sha256 = "0a669193ivi2lxk3v692kq1pqavaswlpi9hbi8ib8bfp9j5j6byy";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontcronyxcyrillic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-cronyx-cyrillic";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-cronyx-cyrillic-1.0.4.tar.xz";
-        sha256 = "12dpsvif85z1m6jvq9g91lmzj0rll5rh3871mbvdpzyb1p7821yw";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontcursormisc = callPackage (
     {
@@ -902,46 +580,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontisasmisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-isas-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-isas-misc-1.0.4.tar.xz";
-        sha256 = "1z1qqi64hbp297f6ryiswa4ikfn7mcwnb8nadyglni6swsxrbra7";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontjismisc = callPackage (
     {
@@ -982,124 +620,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmicromisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-micro-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-micro-misc-1.0.4.tar.xz";
-        sha256 = "0hzryqyml0bzzw91vqdmzdlb7dm18jmyz0mxy6plks3sppbbkq1f";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmisccyrillic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-misc-cyrillic";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz";
-        sha256 = "14z9x174fidjn65clkd2y1l6pxspmvphizap9a8h2h06adzil0kn";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontmiscethiopic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-misc-ethiopic";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz";
-        sha256 = "04mnd620s9wkdid9wnf181yh5vf0n7l096nc3z4zdvm1w7kafja7";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontmiscmeltho = callPackage (
     {
@@ -1179,167 +699,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontschumachermisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-schumacher-misc";
-      version = "1.1.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-schumacher-misc-1.1.3.tar.xz";
-        sha256 = "0w40lr214n39al449fnm4k1bpyj3fjrhz2yxqd6a6m8yvc69z14b";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        fontutil
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontscreencyrillic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-screen-cyrillic";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-screen-cyrillic-1.0.5.tar.xz";
-        sha256 = "1h75zn1rp7bdv6av4cnrajpaq6fkd7dx1lc7aijpw32qrnw8nxcg";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontsonymisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-sony-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-sony-misc-1.0.4.tar.xz";
-        sha256 = "0swlhjmmagrfkip4i9yq7cr56hains1j41mjs05nxc6c7y19zc76";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontsunmisc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-sun-misc";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz";
-        sha256 = "17yvhk1hlajm3q57r09q8830zz7cnckrg8hgzajgyyljdl8xv16x";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fonttosfnt = callPackage (
     {
@@ -1378,84 +737,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontwinitzkicyrillic = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      bdftopcf,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-winitzki-cyrillic";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz";
-        sha256 = "1a4pz8f7hz6nn9xirz2k1j81ykl3lwrpi1ydmzipciy15l984v9v";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        bdftopcf
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontxfree86type1 = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontutil,
-      mkfontscale,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-xfree86-type1";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz";
-        sha256 = "0ds8xbgxy9h0bqn2p38vylfzn8cqkp7n51kwmw1c18ayi9w2qg59";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        mkfontscale
-      ];
-      buildInputs = [ fontutil ];
-      configureFlags = [ "--with-fontrootdir=$(out)/lib/X11/fonts" ];
-      postPatch = ''substituteInPlace configure --replace 'MAPFILES_PATH=`pkg-config' 'MAPFILES_PATH=`$PKG_CONFIG' '';
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   iceauth = callPackage (
     {
@@ -1492,82 +773,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libWindowsWM = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libWindowsWM";
-      version = "1.0.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2";
-        sha256 = "1p0flwb67xawyv6yhri9w17m1i4lji5qnd0gq8v1vsfb8zw7rw15";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "windowswm" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXScrnSaver = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXScrnSaver";
-      version = "1.2.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXScrnSaver-1.2.5.tar.xz";
-        sha256 = "004drphnsckx30g8xn554a1nr17p1zhl2547fpif0lvjhigkcmsh";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xscrnsaver" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXTrap = callPackage (
     {
@@ -1608,514 +813,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXcomposite = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXfixes,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXcomposite";
-      version = "0.4.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz";
-        sha256 = "11rcvk380l5540gfqy9p8mbzw3l1p5g8l214p870f28smvqbqh7y";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXfixes
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xcomposite" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXdamage = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXfixes,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXdamage";
-      version = "1.1.6";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz";
-        sha256 = "04axzdx75w0wcb4na7lfpa0ai0fddw60dmg7cigs7z32a8gkqwsj";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXfixes
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xdamage" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXfont = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libfontenc,
-      xorgproto,
-      freetype,
-      xtrans,
-      zlib,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXfont";
-      version = "1.5.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2";
-        sha256 = "0hiji1bvpl78aj3a3141hkk353aich71wv8l5l2z51scfy878zqs";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libfontenc
-        xorgproto
-        freetype
-        xtrans
-        zlib
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xfont" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXfont2 = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libfontenc,
-      xorgproto,
-      freetype,
-      xtrans,
-      zlib,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXfont2";
-      version = "2.0.7";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXfont2-2.0.7.tar.xz";
-        sha256 = "1ywfwpirvi7fmd3my3cb6szzd9c4p7xy7s1kjjv6k1x4xgyq4ywb";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libfontenc
-        xorgproto
-        freetype
-        xtrans
-        zlib
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xfont2" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXft = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      fontconfig,
-      freetype,
-      libX11,
-      xorgproto,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXft";
-      version = "2.3.9";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXft-2.3.9.tar.xz";
-        sha256 = "1xbn77zqjzx2zdzqcsbf8pvivlqplnciifxk6lk97mjyjiw5p8k0";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        fontconfig
-        freetype
-        libX11
-        xorgproto
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xft" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      libXfixes,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXi";
-      version = "1.8.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXi-1.8.2.tar.xz";
-        sha256 = "0161qsac0dgvkkcihpm2062p1lk2l5mj4i7smd713qnnadg5bq6h";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-        libXfixes
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xi" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXinerama = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXinerama";
-      version = "1.1.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz";
-        sha256 = "0p08q8q1wg0sixhizl2l1i935bk6x3ckj3bdd6qqr0n1zkqd352h";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xinerama" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXp = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXau,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXp";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXp-1.0.4.tar.xz";
-        sha256 = "197iklxwyd4naryc6mzv0g5qi1dy1apxk9w9k3yshd1ax2wf668z";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXau
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xp" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXpresent = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      libXfixes,
-      libXrandr,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXpresent";
-      version = "1.0.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXpresent-1.0.2.tar.xz";
-        sha256 = "00knsc4hrxzq3rx7ff1h0k0h418p66p0cdh14fra81i2h6s22nsf";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-        libXfixes
-        libXrandr
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xpresent" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXres = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXres";
-      version = "1.2.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXres-1.2.3.tar.xz";
-        sha256 = "1p39xfpgckp22v60h36wvy2zbpmqgra585krja4nmj6n05a8zpnj";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xres" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libXtst = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      libXext,
-      libXi,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libXtst";
-      version = "1.2.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz";
-        sha256 = "0hljblisw72fk60y7zf9214ydn7lk32kj43cf12af2bhp4jlq3dm";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-        libXext
-        libXi
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xtst" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libxkbfile = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libX11,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libxkbfile";
-      version = "1.1.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz";
-        sha256 = "1v2bhw1q1cj3wjfs0igq393iz10whcavbyxlm3k9xfvsk7m3xdm9";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libX11
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xkbfile" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libxshmfence = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libxshmfence";
-      version = "1.3.3";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz";
-        sha256 = "046y7zn8agp8kdr1lg11yyvpx90i9sjf77h25jhgx5msd84xz96l";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ xorgproto ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "xshmfence" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   oclock = callPackage (
     {
@@ -2200,94 +897,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  x11perf = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXext,
-      libXft,
-      libXmu,
-      xorgproto,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "x11perf";
-      version = "1.6.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/x11perf-1.6.1.tar.bz2";
-        sha256 = "0d3wh6z6znwhfdiv0zaggfj0xgish98xa10yy76b9517zj7hnzhw";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libXext
-        libXft
-        libXmu
-        xorgproto
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcalc = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libXaw,
-      xorgproto,
-      libXt,
-      wrapWithXFileSearchPathHook,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcalc";
-      version = "1.1.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xcalc-1.1.2.tar.xz";
-        sha256 = "1m0wzhjvc88kmx12ykdml5rqlz9h2iki9mkfdngji53y8nhxyy45";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [
-        pkg-config
-        wrapWithXFileSearchPathHook
-      ];
-      buildInputs = [
-        libX11
-        libXaw
-        xorgproto
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xclock = callPackage (
     {
@@ -2340,50 +949,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xcompmgr = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libXcomposite,
-      libXdamage,
-      libXext,
-      libXfixes,
-      xorgproto,
-      libXrender,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xcompmgr";
-      version = "1.1.10";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xcompmgr-1.1.10.tar.xz";
-        sha256 = "13xrn0ii8widz0pw31fbdy7x8paf729yqhkmxbm3497jqh4zf93q";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libXcomposite
-        libXdamage
-        libXext
-        libXfixes
-        xorgproto
-        libXrender
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xdm = callPackage (
     {
@@ -2502,54 +1067,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xeyes = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libX11,
-      libxcb,
-      libXext,
-      libXi,
-      libXmu,
-      xorgproto,
-      libXrender,
-      libXt,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xeyes";
-      version = "1.3.0";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/app/xeyes-1.3.0.tar.xz";
-        sha256 = "08rhfp5xlmdbyxkvxhgjxdn6vwzrbrjyd7jkk8b7wi1kpw0ccl09";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libX11
-        libxcb
-        libXext
-        libXi
-        libXmu
-        xorgproto
-        libXrender
-        libXt
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86inputevdev = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 87ce0a89df21..d87b1ad6879d 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -62,17 +62,31 @@ $pcMap{"xcb-cursor"} = "xcbutilcursor";
 $pcMap{"xcb-proto"} = "xcbproto";
 $pcMap{"xcb-renderutil"} = "xcbutilrenderutil";
 $pcMap{"xcb-util"} = "xcbutil";
+$pcMap{"xcomposite"} = "libXcomposite";
 $pcMap{"xcursor"} = "libXcursor";
+$pcMap{"xdamage"} = "libXdamage";
 $pcMap{"xdmcp"} = "libXdmcp";
 $pcMap{"xext"} = "libXext";
 $pcMap{"xfixes"} = "libXfixes";
+$pcMap{"xfont"} = "libXfont";
+$pcMap{"xfont2"} = "libXfont2";
+$pcMap{"xft"} = "libXft";
+$pcMap{"xi"} = "libXi";
+$pcMap{"xinerama"} = "libXinerama";
+$pcMap{"xkbfile"} = "libxkbfile";
 $pcMap{"xmu"} = "libXmu";
 $pcMap{"xmuu"} = "libXmu";
+$pcMap{"xp"} = "libXp";
 $pcMap{"xpm"} = "libXpm";
+$pcMap{"xpresent"} = "libXpresent";
 $pcMap{"xrandr"} = "libXrandr";
 $pcMap{"xrender"} = "libXrender";
+$pcMap{"xres"} = "libXres";
+$pcMap{"xscrnsaver"} = "libXScrnSaver";
+$pcMap{"xshmfence"} = "libxshmfence";
 $pcMap{"xt"} = "libXt";
 $pcMap{"xtrans"} = "xtrans";
+$pcMap{"xtst"} = "libXtst";
 $pcMap{"xv"} = "libXv";
 $pcMap{"xvmc"} = "libXvMC";
 $pcMap{"xvmc-wrapper"} = "libXvMC";
@@ -318,6 +332,7 @@ print OUT <<EOF;
 # THIS IS A GENERATED FILE.  DO NOT EDIT!
 {
   lib,
+  appres,
   bdftopcf,
   font-adobe-100dpi,
   font-adobe-75dpi,
@@ -325,11 +340,29 @@ print OUT <<EOF;
   font-adobe-utopia-75dpi,
   font-adobe-utopia-type1,
   font-alias,
+  font-bh-100dpi,
+  font-bh-75dpi,
+  font-bh-lucidatypewriter-100dpi,
+  font-bh-lucidatypewriter-75dpi,
   font-bh-ttf,
   font-bh-type1,
+  font-bitstream-100dpi,
+  font-bitstream-75dpi,
+  font-bitstream-type1,
+  font-cronyx-cyrillic,
   font-encodings,
+  font-isas-misc,
+  font-micro-misc,
+  font-misc-cyrillic,
+  font-misc-ethiopic,
   font-mutt-misc,
+  font-schumacher-misc,
+  font-screen-cyrillic,
+  font-sony-misc,
+  font-sun-misc,
   font-util,
+  font-winitzki-cyrillic,
+  font-xfree86-type1,
   gccmakedep,
   ico,
   imake,
@@ -341,6 +374,7 @@ print OUT <<EOF;
   libpciaccess,
   libpthread-stubs,
   libsm,
+  libwindowswm,
   libx11,
   libxau,
   libxaw,
@@ -352,16 +386,30 @@ print OUT <<EOF;
   libxcb-render-util,
   libxcb-util,
   libxcb-wm,
-  libxcvt,
+  libxcomposite,
   libxcursor,
+  libxcvt,
+  libxdamage,
   libxdmcp,
   libxext,
   libxfixes,
+  libxfont_1,
+  libxfont_2,
+  libxft,
+  libxi,
+  libxinerama,
+  libxkbfile,
   libxmu,
+  libxp,
   libxpm,
+  libxpresent,
   libxrandr,
   libxrender,
+  libxres,
+  libxscrnsaver,
+  libxshmfence,
   libxt,
+  libxtst,
   libxv,
   libxvmc,
   libxxf86dga,
@@ -379,16 +427,20 @@ print OUT <<EOF;
   transset,
   util-macros,
   viewres,
+  x11perf,
   xauth,
   xbacklight,
   xbitmaps,
+  xcalc,
   xcb-proto,
   xcmsdb,
+  xcompmgr,
   xconsole,
   xcursorgen,
   xcursor-themes,
   xdriinfo,
   xev,
+  xeyes,
   xfontsel,
   xfsinfo,
   xgamma,
@@ -424,6 +476,7 @@ print OUT <<EOF;
 self: with self; {
 
   inherit
+    appres
     bdftopcf
     gccmakedep
     ico
@@ -433,6 +486,8 @@ self: with self; {
     libpciaccess
     libxcb
     libxcvt
+    libxkbfile
+    libxshmfence
     listres
     lndir
     luit
@@ -443,14 +498,18 @@ self: with self; {
     smproxy
     transset
     viewres
+    x11perf
     xauth
     xbacklight
     xbitmaps
+    xcalc
     xcmsdb
+    xcompmgr
     xconsole
     xcursorgen
     xdriinfo
     xev
+    xeyes
     xfontsel
     xfsinfo
     xgamma
@@ -485,27 +544,58 @@ self: with self; {
   fontadobeutopia75dpi = font-adobe-utopia-75dpi;
   fontadobeutopiatype1 = font-adobe-utopia-type1;
   fontalias = font-alias;
+  fontbh100dpi = font-bh-100dpi;
+  fontbh75dpi = font-bh-75dpi;
+  fontbhlucidatypewriter100dpi = font-bh-lucidatypewriter-100dpi;
+  fontbhlucidatypewriter75dpi = font-bh-lucidatypewriter-75dpi;
   fontbhttf = font-bh-ttf;
   fontbhtype1 = font-bh-type1;
+  fontbitstream100dpi = font-bitstream-100dpi;
+  fontbitstream75dpi = font-bitstream-75dpi;
+  fontbitstreamtype1 = font-bitstream-type1;
+  fontcronyxcyrillic = font-cronyx-cyrillic;
+  fontisasmisc = font-isas-misc;
+  fontmicromisc = font-micro-misc;
+  fontmisccyrillic = font-misc-cyrillic;
+  fontmiscethiopic = font-misc-ethiopic;
   fontmuttmisc = font-mutt-misc;
+  fontschumachermisc = font-schumacher-misc;
+  fontscreencyrillic = font-screen-cyrillic;
+  fontsonymisc = font-sony-misc;
+  fontsunmisc = font-sun-misc;
   fontutil = font-util;
+  fontwinitzkicyrillic = font-winitzki-cyrillic;
+  fontxfree86type1 = font-xfree86-type1;
   libAppleWM = libapplewm;
   libFS = libfs;
   libICE = libice;
   libpthreadstubs = libpthread-stubs;
   libSM = libsm;
+  libWindowsWM = libwindowswm;
   libX11 = libx11;
   libXau = libxau;
   libXaw = libxaw;
+  libXcomposite = libxcomposite;
   libXcursor = libxcursor;
+  libXdamage = libxdamage;
   libXdmcp = libxdmcp;
   libXext = libxext;
   libXfixes = libxfixes;
+  libXfont2 = libxfont_2;
+  libXfont = libxfont_1;
+  libXft = libxft;
+  libXi = libxi;
+  libXinerama = libxinerama;
   libXmu = libxmu;
+  libXp = libxp;
   libXpm = libxpm;
+  libXpresent = libxpresent;
   libXrandr = libxrandr;
   libXrender = libxrender;
+  libXres = libxres;
+  libXScrnSaver = libxscrnsaver;
   libXt = libxt;
+  libXtst = libxtst;
   libXv = libxv;
   libXvMC = libxvmc;
   libXxf86dga = libxxf86dga;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 7ebd6f9ed6e8..3150f98fe76a 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1,6 +1,7 @@
 {
   callPackage,
   lib,
+  config,
   stdenv,
   makeWrapper,
   fetchurl,
@@ -112,16 +113,6 @@ self: super:
       )
   ) { };
 
-  appres = super.appres.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [
-      meson
-      ninja
-    ];
-    meta = attrs.meta // {
-      mainProgram = "appres";
-    };
-  });
-
   bitmap = addMainProgram super.bitmap { };
 
   editres = super.editres.overrideAttrs (attrs: {
@@ -150,26 +141,6 @@ self: super:
 
   mkfontdir = xorg.mkfontscale;
 
-  libXtst = super.libXtst.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      pkgConfigModules = [ "xtst" ];
-    };
-  });
-
-  libXfont = super.libXfont.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ freetype ]; # propagate link reqs. like bzip2
-    # prevents "misaligned_stack_error_entering_dyld_stub_binder"
-    configureFlags = lib.optional isDarwin "CFLAGS=-O0";
-  });
-
-  libWindowsWM = super.libWindowsWM.overrideAttrs (attrs: {
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
   xdpyinfo = super.xdpyinfo.overrideAttrs (attrs: {
     configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
     preConfigure =
@@ -202,113 +173,6 @@ self: super:
     };
   });
 
-  libXcomposite = super.libXcomposite.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.libXfixes ];
-  });
-
-  libXdamage = super.libXdamage.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-  });
-
-  libXft = super.libXft.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [
-      xorg.libXrender
-      freetype
-      fontconfig
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-
-    # the include files need ft2build.h, and Requires.private isn't enough for us
-    postInstall = ''
-      sed "/^Requires:/s/$/, freetype2/" -i "$dev/lib/pkgconfig/xft.pc"
-    '';
-    passthru = attrs.passthru // {
-      inherit freetype fontconfig;
-    };
-  });
-
-  libXi = super.libXi.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "man"
-      "doc"
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [
-      xorg.libXfixes
-      xorg.libXext
-    ];
-    configureFlags =
-      lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-        "xorg_cv_malloc0_returns_null=no"
-      ]
-      ++ lib.optional stdenv.hostPlatform.isStatic "--disable-shared";
-  });
-
-  libXinerama = super.libXinerama.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
-  libXres = super.libXres.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-      "devdoc"
-    ];
-    buildInputs = attrs.buildInputs ++ [ xorg.utilmacros ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
-  libXScrnSaver = super.libXScrnSaver.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [ xorg.utilmacros ];
-    configureFlags = attrs.configureFlags or [ ] ++ malloc0ReturnsNullCrossFlag;
-  });
-
-  libXp = super.libXp.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ];
-  });
-
-  libXpresent = super.libXpresent.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXrandr
-    ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ xorg.libXfixes ];
-  });
-
-  libxkbfile = super.libxkbfile.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to avoid propagation
-  });
-
-  libxshmfence = super.libxshmfence.overrideAttrs (attrs: {
-    outputs = [
-      "out"
-      "dev"
-    ]; # mainly to avoid propagation
-  });
-
   setxkbmap = super.setxkbmap.overrideAttrs (attrs: {
     postInstall = ''
       mkdir -p $out/share/man/man7
@@ -322,18 +186,6 @@ self: super:
 
   oclock = addMainProgram super.oclock { };
 
-  x11perf = super.x11perf.overrideAttrs (attrs: {
-    buildInputs = attrs.buildInputs ++ [
-      freetype
-      fontconfig
-    ];
-    meta = attrs.meta // {
-      mainProgram = "x11perf";
-    };
-  });
-
-  xcalc = addMainProgram super.xcalc { };
-
   xf86inputevdev = super.xf86inputevdev.overrideAttrs (attrs: {
     outputs = [
       "out"
@@ -528,8 +380,6 @@ self: super:
     };
   });
 
-  xeyes = addMainProgram super.xeyes { };
-
   xkbcomp = super.xkbcomp.overrideAttrs (attrs: {
     configureFlags = [ "--with-xkb-config-root=${xorg.xkeyboardconfig}/share/X11/xkb" ];
     meta = attrs.meta // {
@@ -837,7 +687,6 @@ self: super:
   });
 
   xclock = addMainProgram super.xclock { };
-  xcompmgr = addMainProgram super.xcompmgr { };
 
   xinit =
     (super.xinit.override {
@@ -939,27 +788,6 @@ self: super:
   });
 
   xwd = addMainProgram super.xwd { };
-
-  # convert Type1 vector fonts to OpenType fonts
-  fontbitstreamtype1 = super.fontbitstreamtype1.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [ fontforge ];
-
-    postBuild = ''
-      # convert Postscript (Type 1) font to otf
-      for i in $(find -type f -name '*.pfa' -o -name '*.pfb'); do
-          name=$(basename $i | cut -d. -f1)
-          fontforge -lang=ff -c "Open(\"$i\"); Generate(\"$name.otf\")"
-      done
-    '';
-
-    postInstall = ''
-      # install the otf fonts
-      fontDir="$out/lib/X11/fonts/misc/"
-      install -D -m 644 -t "$fontDir" *.otf
-      mkfontscale "$fontDir"
-    '';
-  });
-
 }
 
 # mark some packages as unfree
@@ -968,13 +796,6 @@ self: super:
     # unfree but redistributable
     redist = [
       "fontibmtype1"
-      "fontbh100dpi"
-      "fontbh75dpi"
-
-      # Bigelow & Holmes fonts
-      # https://www.x.org/releases/current/doc/xorg-docs/License.html#Bigelow_Holmes_Inc_and_URW_GmbH_Luxi_font_license
-      "fontbhlucidatypewriter100dpi"
-      "fontbhlucidatypewriter75dpi"
     ];
 
     # unfree, possibly not redistributable
@@ -1000,3 +821,8 @@ self: super:
   mapNamesToAttrs (setLicense lib.licenses.unfreeRedistributable) redist
   // mapNamesToAttrs (setLicense lib.licenses.unfree) unfree
 )
+
+# deprecate some packages
+// lib.optionalAttrs config.allowAliases {
+  fontbitstreamspeedo = throw "Bitstream Speedo is an obsolete font format that hasn't been supported by Xorg since 2005"; # added 2025-09-24
+}
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index fc60f6a79529..5307be640d4b 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -1,17 +1,12 @@
-mirror://xorg/individual/app/appres-1.0.7.tar.xz
 mirror://xorg/individual/app/bitmap-1.1.1.tar.xz
 mirror://xorg/individual/app/editres-1.0.9.tar.xz
 mirror://xorg/individual/app/fonttosfnt-1.2.4.tar.xz
 mirror://xorg/individual/app/iceauth-1.0.10.tar.xz
 mirror://xorg/individual/app/oclock-1.0.6.tar.xz
 mirror://xorg/individual/app/setxkbmap-1.3.4.tar.xz
-mirror://xorg/individual/app/x11perf-1.6.1.tar.bz2
-mirror://xorg/individual/app/xcalc-1.1.2.tar.xz
 mirror://xorg/individual/app/xclock-1.1.1.tar.xz
-mirror://xorg/individual/app/xcompmgr-1.1.10.tar.xz
 mirror://xorg/individual/app/xdm-1.1.17.tar.xz
 mirror://xorg/individual/app/xdpyinfo-1.3.4.tar.xz
-mirror://xorg/individual/app/xeyes-1.3.0.tar.xz
 mirror://xorg/individual/app/xfd-1.1.4.tar.xz
 mirror://xorg/individual/app/xfs-1.2.2.tar.xz
 mirror://xorg/individual/app/xinit-1.4.4.tar.xz
@@ -74,46 +69,12 @@ mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-75dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-100dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-lucidatypewriter-75dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bh-lucidatypewriter-100dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bitstream-75dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bitstream-100dpi-1.0.4.tar.xz
-mirror://xorg/individual/font/font-bitstream-speedo-1.0.2.tar.gz
-mirror://xorg/individual/font/font-bitstream-type1-1.0.4.tar.xz
-mirror://xorg/individual/font/font-cronyx-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-cursor-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-daewoo-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-dec-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-ibm-type1-1.0.4.tar.xz
-mirror://xorg/individual/font/font-isas-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-jis-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-micro-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-misc-cyrillic-1.0.4.tar.xz
-mirror://xorg/individual/font/font-misc-ethiopic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-misc-meltho-1.0.4.tar.xz
 mirror://xorg/individual/font/font-misc-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-schumacher-misc-1.1.3.tar.xz
-mirror://xorg/individual/font/font-screen-cyrillic-1.0.5.tar.xz
-mirror://xorg/individual/font/font-sony-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
-mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
-mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXcomposite-0.4.6.tar.xz
-mirror://xorg/individual/lib/libXdamage-1.1.6.tar.xz
-mirror://xorg/individual/lib/libXfont-1.5.4.tar.bz2
-mirror://xorg/individual/lib/libXfont2-2.0.7.tar.xz
-mirror://xorg/individual/lib/libXft-2.3.9.tar.xz
-mirror://xorg/individual/lib/libXi-1.8.2.tar.xz
-mirror://xorg/individual/lib/libXinerama-1.1.5.tar.xz
-mirror://xorg/individual/lib/libxkbfile-1.1.3.tar.xz
-mirror://xorg/individual/lib/libXp-1.0.4.tar.xz
-mirror://xorg/individual/lib/libXpresent-1.0.2.tar.xz
-mirror://xorg/individual/lib/libXres-1.2.3.tar.xz
-mirror://xorg/individual/lib/libXScrnSaver-1.2.5.tar.xz
-mirror://xorg/individual/lib/libxshmfence-1.3.3.tar.xz
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
-mirror://xorg/individual/lib/libXtst-1.2.5.tar.xz
 mirror://xorg/individual/xserver/xorg-server-21.1.18.tar.xz
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 1a91fda9a536..4fa9b5454aed 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -1121,6 +1121,7 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
             with prevStage;
             [
               apple-sdk
+              apple-sdk.cups-headers
               bashNonInteractive
               bzip2.bin
               bzip2.out
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 07c50a683d3f..b27e59860e39 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -706,19 +706,14 @@ let
               __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
             }
           )
-          // optionalAttrs (isWindows || isCygwin) (
-            let
-              dlls =
-                allowedImpureDLLs
-                ++ lib.optionals isCygwin [
-                  "KERNEL32.dll"
-                  "cygwin1.dll"
-                ];
-            in
-            {
-              allowedImpureDLLs = if dlls != [ ] then dlls else null;
-            }
-          )
+          // optionalAttrs (isWindows || isCygwin) {
+            allowedImpureDLLs =
+              allowedImpureDLLs
+              ++ lib.optionals isCygwin [
+                "KERNEL32.dll"
+                "cygwin1.dll"
+              ];
+          }
           // (
             if !__structuredAttrs then
               makeOutputChecks attrs
diff --git a/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix b/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
index 38d7e112fa61..f10d285617a7 100644
--- a/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
+++ b/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
@@ -109,10 +109,12 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # save compute time by not running benchmarks
     "tests/bench"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     # aarch64-darwin forbids W+X memory, but this tests depends on it:
     # * https://cffi.readthedocs.io/en/latest/using.html#callbacks
+    # furthermore, this test fails with OpenSSL 3.6.0, probably due to:
+    # * https://github.com/openssl/openssl/issues/28757
+    # * https://github.com/openssl/openssl/issues/28770
+    # * https://github.com/openssl/openssl/issues/28888
     "tests/hazmat/backends/test_openssl_memleak.py"
   ];
 
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-configtool.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-configtool.nix
index f0e1482b8579..caf4dc8be63c 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-configtool.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-configtool.nix
@@ -15,6 +15,7 @@
   kitemviews,
   kwidgetsaddons,
   qtquickcontrols2 ? null,
+  kcmutils,
   kcoreaddons,
   kdeclarative,
   kirigami ? null,
@@ -78,6 +79,7 @@ stdenv.mkDerivation rec {
       kirigami2
     ]
     ++ lib.optionals (lib.versions.major qtbase.version == "6") [
+      kcmutils
       libplasma
       kirigami
     ]
diff --git a/pkgs/tools/misc/coreutils/CVE-2025-5278.patch b/pkgs/tools/misc/coreutils/CVE-2025-5278.patch
deleted file mode 100644
index 197a77020fe2..000000000000
--- a/pkgs/tools/misc/coreutils/CVE-2025-5278.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 8c9602e3a145e9596dc1a63c6ed67865814b6633 Mon Sep 17 00:00:00 2001
-From: Pádraig Brady <P@draigBrady.com>
-Date: Tue, 20 May 2025 16:03:44 +0100
-Subject: sort: fix buffer under-read (CWE-127)
-
-* src/sort.c (begfield): Check pointer adjustment
-to avoid Out-of-range pointer offset (CWE-823).
-(limfield): Likewise.
-* tests/sort/sort-field-limit.sh: Add a new test,
-which triggers with ASAN or Valgrind.
-* tests/local.mk: Reference the new test.
-* NEWS: Mention bug fix introduced in v7.2 (2009).
-Fixes https://bugs.gnu.org/78507
----
- NEWS                           |  5 +++++
- src/sort.c                     | 12 ++++++++++--
- tests/local.mk                 |  1 +
- tests/sort/sort-field-limit.sh | 35 +++++++++++++++++++++++++++++++++++
- 4 files changed, 51 insertions(+), 2 deletions(-)
- create mode 100755 tests/sort/sort-field-limit.sh
-
-The new tests is NOT added in NixOS.
-
-diff --git a/NEWS b/NEWS
-index 6ff403206..923aa72f8 100644
---- a/NEWS
-+++ b/NEWS
-@@ -8,6 +8,11 @@ GNU coreutils NEWS                                    -*- outline -*-
-   copying to non-NFS files from NFSv4 files with trivial ACLs.
-   [bug introduced in coreutils-9.6]
- 
-+  sort with key character offsets of SIZE_MAX, could induce
-+  a read of 1 byte before an allocated heap buffer. For example:
-+  'sort +0.18446744073709551615R input' on 64 bit systems.
-+  [bug introduced in coreutils-7.2]
-+
- 
- * Noteworthy changes in release 9.7 (2025-04-09) [stable]
- 
-diff --git a/src/sort.c b/src/sort.c
-index b10183b6f..7af1a2512 100644
---- a/src/sort.c
-+++ b/src/sort.c
-@@ -1644,7 +1644,11 @@ begfield (struct line const *line, struct keyfield const *key)
-       ++ptr;
- 
-   /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
--  ptr = MIN (lim, ptr + schar);
-+  size_t remaining_bytes = lim - ptr;
-+  if (schar < remaining_bytes)
-+    ptr += schar;
-+  else
-+    ptr = lim;
- 
-   return ptr;
- }
-@@ -1746,7 +1750,11 @@ limfield (struct line const *line, struct keyfield const *key)
-           ++ptr;
- 
-       /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
--      ptr = MIN (lim, ptr + echar);
-+      size_t remaining_bytes = lim - ptr;
-+      if (echar < remaining_bytes)
-+        ptr += echar;
-+      else
-+        ptr = lim;
-     }
- 
-   return ptr;
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index ee01ad87f88f..4f94c41dcf42 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -48,24 +48,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "coreutils" + (optionalString (!minimal) "-full");
-  version = "9.7";
+  version = "9.8";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz";
-    hash = "sha256-6LsmrQKT+bWh/EP7QrqXDjEsZs6SwbCxZxPXUA2yUb8=";
+    hash = "sha256-5tT9LYUskUGhwqGKE9FGoM1+RRlfcik6TkwETsbMyhU=";
   };
 
-  patches = [
-    # Heap buffer overflow that's been here since coreutils 7.2 in 2009:
-    # https://www.openwall.com/lists/oss-security/2025/05/27/2
-    ./CVE-2025-5278.patch
-
-    # Fixes test-float-h failure on ppc64 with C23
-    # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
-    # Multiple upstream commits squashed with adjustments, see header
-    ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
-  ];
-
   postPatch = ''
     # The test tends to fail on btrfs, f2fs and maybe other unusual filesystems.
     sed '2i echo Skipping dd sparse test && exit 77' -i ./tests/dd/sparse.sh
@@ -218,6 +207,9 @@ stdenv.mkDerivation rec {
     # Work around a bogus warning in conjunction with musl.
     ++ optional stdenv.hostPlatform.isMusl "-Wno-error"
     ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0"
+    # gnulib does not consider Clang-specific warnings to be bugs:
+    # https://lists.gnu.org/r/bug-gnulib/2025-06/msg00325.html
+    ++ optional stdenv.cc.isClang "-Wno-error=format-security"
   );
 
   # Works around a bug with 8.26:
diff --git a/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch b/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
deleted file mode 100644
index 1b1e210efadd..000000000000
--- a/pkgs/tools/misc/coreutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-Applies the following incremental gnulib commits:
-
-- 55a366a06fbd98bf13adc531579e3513cee97a32
-- 65ed9d3b24ad09fd61d326c83e7f1b05f6e9d65f
-- ce8e9de0bf34bc63dffc67ab384334c509175f64
-- 6164b4cb0887b5331a4e64449107decd37d32735
-
-With adjustments specific to the structure & differences in coreutils:
-
-- gnulib code is split across lib and gnulib-tests
-- A Makefile.in is used for the test flags instead of the fancy automake modules
-  in the upstream gnulib project, so we add -lm to the float test there.
-  Surrounding texts in this file are slightly different in every project.
----
-diff '--color=auto' -ruN a/gnulib-tests/Makefile.in b/gnulib-tests/Makefile.in
---- a/gnulib-tests/Makefile.in	2025-04-09 10:05:54.000000000 +0000
-+++ b/gnulib-tests/Makefile.in	2025-07-09 10:00:23.767927263 +0000
-@@ -1496,7 +1496,7 @@
- 	$(am__DEPENDENCIES_1)
- test_float_h_SOURCES = test-float-h.c
- test_float_h_OBJECTS = test-float-h.$(OBJEXT)
--test_float_h_LDADD = $(LDADD)
-+test_float_h_LDADD = $(LDADD) -lm
- test_float_h_DEPENDENCIES = libtests.a ../lib/libcoreutils.a \
- 	libtests.a ../lib/libcoreutils.a libtests.a \
- 	$(am__DEPENDENCIES_1)
-diff '--color=auto' -ruN a/gnulib-tests/test-float-h.c b/gnulib-tests/test-float-h.c
---- a/gnulib-tests/test-float-h.c	2025-01-01 09:32:30.000000000 +0000
-+++ b/gnulib-tests/test-float-h.c	2025-07-09 10:00:13.837937094 +0000
-@@ -101,6 +101,8 @@
- 
- /* ------------------------------------------------------------------------- */
- 
-+#include <math.h>
-+
- #include "fpucw.h"
- #include "isnanf-nolibm.h"
- #include "isnand-nolibm.h"
-@@ -396,6 +398,44 @@
- 
- /* -------------------- Check macros for 'long double' -------------------- */
- 
-+static int
-+test_isfinitel (long double volatile x)
-+{
-+  if (x != x)
-+    return 0;
-+  long double volatile zero = x * 0;
-+  return zero == 0;
-+}
-+
-+/* Return X after normalization.  This makes a difference on platforms
-+   where long double can represent unnormalized values.  For example,
-+   suppose x = 1 + 2**-106 on PowerPC with IBM long double where
-+   FLT_RADIX = 2, LDBL_MANT_DIG = 106, and LDBL_EPSILON = 2**-105.
-+   Then 1 < x < 1 + LDBL_EPSILON, and normalize_long_double (x) returns 1.  */
-+static long double
-+normalize_long_double (long double volatile x)
-+{
-+  if (FLT_RADIX == 2 && test_isfinitel (x))
-+    {
-+      int xexp;
-+      long double volatile
-+        frac = frexpl (x, &xexp),
-+        significand = frac * pow2l (LDBL_MANT_DIG),
-+        normalized_significand = truncl (significand),
-+        normalized_x = normalized_significand * pow2l (xexp - LDBL_MANT_DIG);
-+
-+      /* The test_isfinitel defends against PowerPC with IBM long double,
-+         which fritzes out near LDBL_MAX.  */
-+      if (test_isfinitel (normalized_x))
-+        x = normalized_x;
-+    }
-+  else
-+    {
-+      /* Hope that X is already normalized.  */
-+    }
-+  return x;
-+}
-+
- static void
- test_long_double (void)
- {
-@@ -455,7 +495,7 @@
-     for (n = 0; n <= 2 * LDBL_MANT_DIG; n++)
-       {
-         volatile long double half_n = pow2l (- n); /* 2^-n */
--        volatile long double x = me - half_n;
-+        volatile long double x = normalize_long_double (me - half_n);
-         if (x < me)
-           ASSERT (x <= 1.0L);
-       }
-@@ -483,8 +523,12 @@
-   ASSERT (!LDBL_IS_IEC_60559);
- #endif
- 
-+  printf("LDBL_NORM_MAX: %LF\n", LDBL_NORM_MAX);
-+  printf("LDBL_MAX: %LF\n", LDBL_MAX);
-+  printf("normalize_long_double(LDBL_MAX): %LF\n", normalize_long_double(LDBL_MAX));
-+
-   /* Check the value of LDBL_NORM_MAX.  */
--  ASSERT (LDBL_NORM_MAX == LDBL_MAX);
-+  ASSERT (LDBL_NORM_MAX == normalize_long_double (LDBL_MAX));
- 
-   /* Check the value of LDBL_SNAN.  */
-   ASSERT (isnanl (LDBL_SNAN));
-diff '--color=auto' -ruN a/lib/float.c b/lib/float.c
---- a/lib/float.c	2025-01-01 09:32:29.000000000 +0000
-+++ b/lib/float.c	2025-07-09 10:00:13.837937094 +0000
-@@ -23,7 +23,7 @@
- #if GNULIB_defined_long_double_union
- # if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
- const union gl_long_double_union gl_LDBL_MAX =
--  { { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL } };
-+  { { DBL_MAX, DBL_MAX / 0x1p53 } };
- # elif defined __i386__
- const union gl_long_double_union gl_LDBL_MAX =
-   { { 0xFFFFFFFF, 0xFFFFFFFF, 32766 } };
-diff '--color=auto' -ruN a/lib/float.in.h b/lib/float.in.h
---- a/lib/float.in.h	2025-01-01 09:32:29.000000000 +0000
-+++ b/lib/float.in.h	2025-07-09 10:00:13.837937094 +0000
-@@ -113,44 +113,38 @@
- # define LDBL_MAX_10_EXP 4932
- #endif
- 
--/* On AIX 7.1 with gcc 4.2, the values of LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX are
--   wrong.
--   On Linux/PowerPC with gcc 4.4, the value of LDBL_MAX is wrong.  */
--#if (defined _ARCH_PPC || defined _POWER) && defined _AIX && (LDBL_MANT_DIG == 106) && defined __GNUC__
-+/* On PowerPC with gcc 15 when using __ibm128 long double, the value of
-+   LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX, and LDBL_NORM_MAX are wrong.  */
-+#if ((defined _ARCH_PPC || defined _POWER) && LDBL_MANT_DIG == 106 \
-+     && defined __GNUC__)
- # undef LDBL_MIN_EXP
- # define LDBL_MIN_EXP DBL_MIN_EXP
- # undef LDBL_MIN_10_EXP
- # define LDBL_MIN_10_EXP DBL_MIN_10_EXP
- # undef LDBL_MIN
- # define LDBL_MIN 2.22507385850720138309023271733240406422e-308L /* DBL_MIN = 2^-1022 */
--#endif
--#if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
- # undef LDBL_MAX
--/* LDBL_MAX is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xFFFFFFFF }.
--   It is not easy to define:
--     #define LDBL_MAX 1.79769313486231580793728971405302307166e308L
--   is too small, whereas
--     #define LDBL_MAX 1.79769313486231580793728971405302307167e308L
--   is too large.  Apparently a bug in GCC decimal-to-binary conversion.
--   Also, I can't get values larger than
--     #define LDBL63 ((long double) (1ULL << 63))
--     #define LDBL882 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL945 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL1008 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL_MAX (LDBL1008 * 65535.0L + LDBL945 * (long double) 9223372036821221375ULL + LDBL882 * (long double) 4611686018427387904ULL)
--   which is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xF8000000 }.
--   So, define it like this through a reference to an external variable
-+/* LDBL_MAX is 2**1024 - 2**918, represented as: { 0x7FEFFFFF, 0xFFFFFFFF,
-+                                                   0x7C9FFFFF, 0xFFFFFFFF }.
-+
-+   Do not write it as a constant expression, as GCC would likely treat
-+   that as infinity due to the vagaries of this platform's funky arithmetic.
-+   Instead, define it through a reference to an external variable.
-+   Like the following, but using a union to avoid type mismatches:
- 
--     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL };
-+     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / 0x1p53 };
-      extern const long double LDBL_MAX;
- 
--   or through a pointer cast
-+   The following alternative would not work as well when GCC is optimizing:
-+
-+     #define LDBL_MAX (*(long double const *) (double[])
-+                       { DBL_MAX, DBL_MAX / 0x1p53 })
- 
--     #define LDBL_MAX \
--       (*(const long double *) (double[]) { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL })
-+   The following alternative would require GCC 6 or later:
- 
--   Unfortunately, this is not a constant expression, and the latter expression
--   does not work well when GCC is optimizing..  */
-+     #define LDBL_MAX __builtin_pack_longdouble (DBL_MAX, DBL_MAX / 0x1p53)
-+
-+   Unfortunately none of the alternatives are constant expressions.  */
- # if !GNULIB_defined_long_double_union
- union gl_long_double_union
-   {
-@@ -161,6 +155,8 @@
- # endif
- extern const union gl_long_double_union gl_LDBL_MAX;
- # define LDBL_MAX (gl_LDBL_MAX.ld)
-+# undef LDBL_NORM_MAX
-+# define LDBL_NORM_MAX LDBL_MAX
- #endif
- 
- /* On IRIX 6.5, with cc, the value of LDBL_MANT_DIG is wrong.
-@@ -181,6 +177,21 @@
- # endif
- #endif
- 
-+/* On PowerPC platforms, 'long double' has a double-double representation.
-+   Up to ISO C 17, this was outside the scope of ISO C because it can represent
-+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits>, such as
-+   1.0L + 4.94065645841246544176568792868221e-324L = 1 + 2^-1074; see
-+   ISO C 17 § 5.2.4.2.2.(3).
-+   In ISO C 23, wording has been included that makes this 'long double'
-+   representation compliant; see ISO C 23 § 5.2.5.3.3.(8)-(9).  In this setting,
-+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits> are
-+   called "unnormalized".  And since LDBL_EPSILON must be normalized (per
-+   ISO C 23 § 5.2.5.3.3.(33)), it must be 2^-105.  */
-+#if defined __powerpc__ && LDBL_MANT_DIG == 106
-+# undef LDBL_EPSILON
-+# define LDBL_EPSILON 2.46519032881566189191165176650870696773e-32L /* 2^-105 */
-+#endif
-+
- /* ============================ ISO C11 support ============================ */
- 
- /* 'float' properties */
-@@ -309,7 +320,11 @@
- # endif
- #endif
- #ifndef LDBL_NORM_MAX
--# define LDBL_NORM_MAX LDBL_MAX
-+# ifdef __LDBL_NORM_MAX__
-+#  define LDBL_NORM_MAX __LDBL_NORM_MAX__
-+# else
-+#  define LDBL_NORM_MAX LDBL_MAX
-+# endif
- #endif
- #ifndef LDBL_SNAN
- /* For sh, beware of <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111814>.  */
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index 5b672b6d6b7a..5f495f89f11a 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -144,7 +144,8 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
   ]
   ++ lib.optional (!stdenv.hostPlatform.isDarwin) hostname
-  ++ lib.optional (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl) softhsm;
+  # TODO: softhsm is currently breaking the tests; see #453782
+  ++ lib.optional (false && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl) softhsm;
 
   preCheck = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) (
     ''
@@ -193,11 +194,15 @@ stdenv.mkDerivation (finalAttrs: {
       # set up NIX_REDIRECTS for direct invocations
       set -a; source ~/.ssh/environment.base; set +a
     ''
-    + lib.optionalString (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl) ''
-      # The extra tests check PKCS#11 interactions, which softhsm emulates with software only
-      substituteInPlace regress/test-exec.sh \
-        --replace /usr/local/lib/softhsm/libsofthsm2.so ${lib.getLib softhsm}/lib/softhsm/libsofthsm2.so
-    ''
+    # See softhsm in nativeCheckInputs above.
+    +
+      lib.optionalString
+        (!finalAttrs.doCheck && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isMusl)
+        ''
+          # The extra tests check PKCS#11 interactions, which softhsm emulates with software only
+          substituteInPlace regress/test-exec.sh \
+            --replace /usr/local/lib/softhsm/libsofthsm2.so ${lib.getLib softhsm}/lib/softhsm/libsofthsm2.so
+        ''
   );
   # integration tests hard to get working on darwin with its shaky
   # sandbox
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 690794bf5ec6..ef9b03f25b5c 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -25,11 +25,11 @@ in
 {
   openssh = common rec {
     pname = "openssh";
-    version = "10.0p2";
+    version = "10.1p1";
 
     src = fetchurl {
       url = urlFor version;
-      hash = "sha256-AhoucJoO30JQsSVr1anlAEEakN3avqgw7VnO+Q652Fw=";
+      hash = "sha256-ufx6K4JXlGem8vQ+SoHI4d/aYU3bT5slWq/XAgu/B1g=";
     };
 
     extraPatches = [
diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/tools/text/diffutils/default.nix
index d82686d98c3e..aa42eeaf0b9f 100644
--- a/pkgs/tools/text/diffutils/default.nix
+++ b/pkgs/tools/text/diffutils/default.nix
@@ -31,8 +31,7 @@ stdenv.mkDerivation rec {
     # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
     # Multiple upstream commits squashed with adjustments, see header
     ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.useLLVM [
+
     ./musl-llvm.patch
   ];
 
diff --git a/pkgs/tools/wayland/xwaylandvideobridge/default.nix b/pkgs/tools/wayland/xwaylandvideobridge/default.nix
deleted file mode 100644
index fcc46987c74a..000000000000
--- a/pkgs/tools/wayland/xwaylandvideobridge/default.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  cmake,
-  extra-cmake-modules,
-  pkg-config,
-  qtbase,
-  qtdeclarative,
-  qtx11extras ? null, # qt5 only
-  kcoreaddons,
-  ki18n,
-  knotifications,
-  kpipewire,
-  kstatusnotifieritem ? null, # qt6 only
-  kwindowsystem,
-  wrapQtAppsHook,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "xwaylandvideobridge";
-  version = "0.4.0";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/xwaylandvideobridge/xwaylandvideobridge-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6nKseypnV46ZlNywYZYC6tMJekb7kzZmHaIA5jkn6+Y=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    extra-cmake-modules
-    pkg-config
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    qtbase
-    qtdeclarative
-    qtx11extras
-    kcoreaddons
-    ki18n
-    knotifications
-    kpipewire
-    kstatusnotifieritem
-    kwindowsystem
-  ];
-
-  cmakeFlags = [ "-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}" ];
-
-  meta = {
-    description = "Utility to allow streaming Wayland windows to X applications";
-    homepage = "https://invent.kde.org/system/xwaylandvideobridge";
-    license = with lib.licenses; [
-      bsd3
-      cc0
-      gpl2Plus
-    ];
-    maintainers = with lib.maintainers; [ stepbrobd ];
-    platforms = lib.platforms.linux;
-    mainProgram = "xwaylandvideobridge";
-  };
-})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8260613264d6..4b7c42542c5f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2260,6 +2260,7 @@ mapAliases {
   qt-video-wlr = throw "'qt-video-wlr' has been removed, as it depends on KDE Gear 5, which has reached EOL"; # Added 2025-08-20
   qt515 = qt5; # Added 2022-11-24
   qt5ct = throw "'qt5ct' has been renamed to/replaced by 'libsForQt5.qt5ct'"; # Converted to throw 2024-10-17
+  qt5Full = throw "qt5Full has been removed. Please use individual packages instead."; # Added 2025-10-18
   qt6ct = qt6Packages.qt6ct; # Added 2023-03-07
   qtchan = throw "'qtchan' has been removed due to lack of maintenance upstream"; # Added 2025-07-01
   qtcurve = throw "'qtcurve' has been renamed to/replaced by 'libsForQt5.qtcurve'"; # Converted to throw 2024-10-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 77425fcf52c9..d065d7a589e7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3193,6 +3193,8 @@ with pkgs;
 
   kbfs = callPackage ../tools/security/keybase/kbfs.nix { };
 
+  kbdVlock = callPackage ../../pkgs/by-name/kb/kbd/package.nix { withVlock = true; };
+
   keybase-gui = callPackage ../tools/security/keybase/gui.nix { };
 
   kio-fuse = libsForQt5.callPackage ../tools/filesystems/kio-fuse { };
@@ -8316,13 +8318,12 @@ with pkgs;
   zunclient = with python313Packages; toPythonApplication python-zunclient;
 
   inherit (callPackages ../by-name/li/libressl { })
-    libressl_3_9
     libressl_4_0
     libressl_4_1
     libressl_4_2
     ;
 
-  openssl = openssl_3_5;
+  openssl = openssl_3_6;
 
   openssl_legacy = openssl.override {
     conf = ../development/libraries/openssl/3.0/legacy.cnf;
@@ -8331,7 +8332,7 @@ with pkgs;
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_1
     openssl_3
-    openssl_3_5
+    openssl_3_6
     ;
 
   pcre = callPackage ../development/libraries/pcre { };
@@ -8481,7 +8482,6 @@ with pkgs;
   plasma5Packages = libsForQt5;
 
   qtEnv = qt5.env;
-  qt5Full = qt5.full;
 
   qt6 = recurseIntoAttrs (callPackage ../development/libraries/qt-6 { });
 
@@ -12956,8 +12956,6 @@ with pkgs;
 
   xca = qt6Packages.callPackage ../applications/misc/xca { };
 
-  inherit (xorg) xcompmgr;
-
   xdg-desktop-portal = callPackage ../development/libraries/xdg-desktop-portal { };
 
   xdg-desktop-portal-hyprland =
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index dab8b23d37f1..fb2349387f69 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -238,7 +238,7 @@ mapAliases {
   doctest-ignore-unicode = throw "doctest-ignore-unicode has been removed since it has been unmaintained for 11 years"; # added 2024-05-20
   dogpile_cache = dogpile-cache; # added 2021-10-28
   dogpile-core = throw "dogpile-core is no longer maintained, use dogpile-cache instead"; # added 2021-11-20
-  duckduckgo-search = ddgs; # added 2025-10-20
+  duckduckgo-search = throw "duckduckgo-search was renamed to ddgs, use ddgs instead"; # added 2025-10-20
   dugong = throw "dugong is unmaintained since 2022 and has therefore been removed"; # added 2024-12-12
   editdistance-s = throw "editdistance-s has been removed since it was added solely for the identity package, which has moved on to ukkonen"; # added 2025-08-04
   easyeda2ato = throw "easyeda2ato as been removed in favor of atopile-easyda2kicad"; # added 2025-06-08
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 25030c7b96a6..9523371a1569 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2475,7 +2475,7 @@ self: super: with self; {
 
   cffconvert = callPackage ../development/python-modules/cffconvert { };
 
-  cffi = callPackage ../development/python-modules/cffi { };
+  cffi = if isPyPy then null else callPackage ../development/python-modules/cffi { };
 
   cffsubr = callPackage ../development/python-modules/cffsubr { };
 
@@ -18499,8 +18499,11 @@ self: super: with self; {
       null
     else
       callPackage ../development/python-modules/tkinter {
-        tcl = pkgs.tcl-9_0;
-        tk = pkgs.tk-9_0;
+        # Tcl/Tk 9.0 support in Tkinter is not quite ready yet:
+        # - https://github.com/python/cpython/issues/124111
+        # - https://github.com/python/cpython/issues/104568
+        tcl = pkgs.tcl-8_6;
+        tk = pkgs.tk-8_6;
       };
 
   tkinter-gl = callPackage ../development/python-modules/tkinter-gl { };
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 6aae3abf5efd..1f47e74579e3 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -151,8 +151,6 @@ makeScopeWithSplicing' {
       waylib = callPackage ../development/libraries/waylib { };
 
       wayqt = callPackage ../development/libraries/wayqt { };
-
-      xwaylandvideobridge = kdePackages.callPackage ../tools/wayland/xwaylandvideobridge { };
     }
   );
 }