diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index 854c1f730bda..9f19a4c382eb 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -73,7 +73,7 @@ let
           (lib.unsafeGetAttrPos "pname" drv)
           (lib.unsafeGetAttrPos "version" drv)
         ]
-        ++ lib.optionals (drv.meta.position or null != null) [
+        ++ lib.optionals (drv ? meta.position) [
           # Use ".meta.position" for cases when most of the package is
           # defined in a "common" section and the only place where
           # reference to the file with a derivation the "pos"
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0948524fc6a4..94f4899b4d51 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13989,6 +13989,12 @@
     name = "Tomas Krupka";
     matrix = "@krupkat:matrix.org";
   };
+  kruziikrel13 = {
+    github = "kruziikrel13";
+    name = "Michael Petersen";
+    email = "dev@michaelpetersen.io";
+    githubId = 72793125;
+  };
   krzaczek = {
     name = "Pawel Krzaczkowski";
     email = "pawel@printu.pl";
@@ -28959,6 +28965,11 @@
     githubId = 1329212;
     name = "Andy Zhang";
   };
+  zhaithizaliel = {
+    name = "Zhaith Izaliel";
+    github = "Zhaith-Izaliel";
+    githubId = 39216756;
+  };
   zhaofengli = {
     email = "hello@zhaofeng.li";
     matrix = "@zhaofeng:zhaofeng.li";
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index bf39afd98627..40a1a37483d7 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -166,6 +166,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
 
+- [iio-niri](https://github.com/Zhaith-Izaliel/iio-niri), a utils that listens to `iio-sensor-proxy` and updates Niri output orientation depending on the accelerometer orientation.
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
 - The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 3f5c3bb2140a..cdbe8df4cfcf 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -243,6 +243,8 @@
 
 - The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream.
 
+- `services.nixseparatedebuginfod.enable = true;` has been replaced by `services.nixseparatedebuginfod2.enable = true`. If you only use the official binary cache `https://cache.nixos.org` then no further configuration should be needed. If you have other https substituters, you can add them to `services.nixseparatedebuginfod2.subsituters`. SSH substituters are not supported by nixseparatedebuginfod2. Consider running nixseparatedebuginfod2 on the substituter instead, and pointing to it with the new option `environment.debuginfodServers`.
+
 - The `services.snapserver` module has been migrated to use the settings option and render a configuration file instead of passing every option over the command line.
 
 - The `services.meilisearch` module now always defaults to the latest version of meilisearch, as the previous `meilisearch_1_11` package was removed. This is only an issue if you were using the old version.
@@ -340,6 +342,8 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 - `services.dnscrypt-proxy` gains a `package` option to specify dnscrypt-proxy package to use.
 
+- `boot.plymouth` now has a [`package`](#opt-boot.plymouth.package) option to specify the package used in the module.
+
 - `services.limesurvey` now supports nginx as reverse-proxy. Available through [services.limesurvey.webserver](#opt-services.limesurvey.webserver).
 
 - `services.nextcloud.configureRedis` now defaults to `true` in accordance with upstream recommendations to have caching for file locking. See the [upstream doc](https://docs.nextcloud.com/server/31/admin_manual/configuration_files/files_locking_transactional.html) for further details.
diff --git a/nixos/modules/hardware/facter/default.nix b/nixos/modules/hardware/facter/default.nix
index 0d3163185b98..471bee49b95b 100644
--- a/nixos/modules/hardware/facter/default.nix
+++ b/nixos/modules/hardware/facter/default.nix
@@ -4,6 +4,10 @@
   ...
 }:
 {
+  imports = [
+    ./system.nix
+  ];
+
   meta.maintainers = with lib.maintainers; [ mic92 ];
 
   options.hardware.facter = with lib; {
diff --git a/nixos/modules/hardware/facter/lib.nix b/nixos/modules/hardware/facter/lib.nix
new file mode 100644
index 000000000000..099254cbce8d
--- /dev/null
+++ b/nixos/modules/hardware/facter/lib.nix
@@ -0,0 +1,59 @@
+# Internal library functions for hardware.facter modules
+# Eventually we can think about moving this under lib/
+# These are facter-specific helpers for querying nixos-facter reports
+lib:
+let
+
+  inherit (lib) assertMsg;
+
+  # Query if a facter report contains a CPU with the given vendor name
+  hasCpu =
+    name:
+    {
+      hardware ? { },
+      ...
+    }:
+    let
+      cpus = hardware.cpu or [ ];
+    in
+    assert assertMsg (hardware != { }) "no hardware entries found in the report";
+    assert assertMsg (cpus != [ ]) "no cpu entries found in the report";
+    builtins.any (
+      {
+        vendor_name ? null,
+        ...
+      }:
+      assert assertMsg (vendor_name != null) "detail.vendor_name not found in cpu entry";
+      vendor_name == name
+    ) cpus;
+
+  # Extract all driver_modules from a list of hardware entries
+  collectDrivers = list: lib.catAttrs "driver_modules" list;
+
+  # Convert number to zero-padded 4-digit hex string (for USB device IDs)
+  toZeroPaddedHex =
+    n:
+    let
+      hex = lib.toHexString n;
+      len = builtins.stringLength hex;
+    in
+    if len == 1 then
+      "000${hex}"
+    else if len == 2 then
+      "00${hex}"
+    else if len == 3 then
+      "0${hex}"
+    else
+      hex;
+in
+{
+  inherit
+    hasCpu
+    collectDrivers
+    toZeroPaddedHex
+    ;
+
+  hasAmdCpu = hasCpu "AuthenticAMD";
+  hasIntelCpu = hasCpu "GenuineIntel";
+
+}
diff --git a/nixos/modules/hardware/facter/system.nix b/nixos/modules/hardware/facter/system.nix
new file mode 100644
index 000000000000..02e329f8e162
--- /dev/null
+++ b/nixos/modules/hardware/facter/system.nix
@@ -0,0 +1,15 @@
+{
+  config,
+  options,
+  lib,
+  ...
+}:
+{
+  # Skip setting hostPlatform in test VMs where it's read-only
+  # Tests have virtualisation.test options and import read-only.nix
+  config.nixpkgs = lib.optionalAttrs (!(options ? virtualisation.test)) {
+    hostPlatform = lib.mkIf (
+      config.hardware.facter.report.system or null != null && !options.nixpkgs.pkgs.isDefined
+    ) (lib.mkDefault config.hardware.facter.report.system);
+  };
+}
diff --git a/nixos/modules/hardware/keyboard/qmk.nix b/nixos/modules/hardware/keyboard/qmk.nix
index 6690deca3506..b3fb02858b1d 100644
--- a/nixos/modules/hardware/keyboard/qmk.nix
+++ b/nixos/modules/hardware/keyboard/qmk.nix
@@ -8,15 +8,18 @@
 let
   cfg = config.hardware.keyboard.qmk;
   inherit (lib) mkEnableOption mkIf;
-
 in
 {
   options.hardware.keyboard.qmk = {
     enable = mkEnableOption "non-root access to the firmware of QMK keyboards";
+    keychronSupport = mkEnableOption "udev rules for keychron QMK based keyboards";
   };
 
   config = mkIf cfg.enable {
-    services.udev.packages = [ pkgs.qmk-udev-rules ];
+    services.udev.packages = [
+      pkgs.qmk-udev-rules
+    ]
+    ++ lib.optionals cfg.keychronSupport [ pkgs.keychron-udev-rules ];
     users.groups.plugdev = { };
   };
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2b98c1cc23e1..2f84328f30d4 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -240,6 +240,7 @@
   ./programs/iay.nix
   ./programs/iftop.nix
   ./programs/iio-hyprland.nix
+  ./programs/iio-niri.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
   ./programs/java.nix
@@ -599,7 +600,6 @@
   ./services/development/livebook.nix
   ./services/development/lorri.nix
   ./services/development/nixseparatedebuginfod2.nix
-  ./services/development/nixseparatedebuginfod.nix
   ./services/development/rstudio-server/default.nix
   ./services/development/vsmartcard-vpcd.nix
   ./services/development/zammad.nix
diff --git a/nixos/modules/programs/iio-niri.nix b/nixos/modules/programs/iio-niri.nix
new file mode 100644
index 000000000000..2c2810b0ee0f
--- /dev/null
+++ b/nixos/modules/programs/iio-niri.nix
@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkPackageOption
+    mkOption
+    types
+    mkIf
+    getExe
+    escapeShellArgs
+    mkDefault
+    ;
+  cfg = config.services.iio-niri;
+in
+{
+  options.services.iio-niri = {
+    enable = mkEnableOption "IIO-Niri";
+
+    package = mkPackageOption pkgs "iio-niri" { };
+
+    niriUnit = mkOption {
+      type = types.nonEmptyStr;
+      default = "niri.service";
+      description = "The Niri **user** service unit to bind IIO-Niri's **user** service unit to.";
+    };
+
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "Extra arguments to pass to IIO-Niri.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    hardware.sensor.iio.enable = mkDefault true;
+
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.user.services.iio-niri = {
+      description = "IIO-Niri";
+      wantedBy = [ cfg.niriUnit ];
+      bindsTo = [ cfg.niriUnit ];
+      partOf = [ cfg.niriUnit ];
+      after = [ cfg.niriUnit ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${getExe cfg.package} ${escapeShellArgs cfg.extraArgs}";
+        Restart = "on-failure";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ zhaithizaliel ];
+}
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 5e22da2b19c2..d500d5df8963 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -228,6 +228,9 @@ in
       "services.morty has been removed from NixOS. As the morty package was unmaintained and removed and searxng, its main consumer, dropped support for it."
     )
     (mkRemovedOptionModule [ "services" "mwlib" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "nixseparatedebuginfod" ]
+      "Use `services.nixseparatedebuginfod2.enable = true;` instead. If you only use the official binary cache, no additional configuration should be needed."
+    )
     (mkRemovedOptionModule [ "services" "pantheon" "files" ] ''
       This module was removed, please add pkgs.pantheon.elementary-files to environment.systemPackages directly.
     '')
diff --git a/nixos/modules/services/development/nixseparatedebuginfod.nix b/nixos/modules/services/development/nixseparatedebuginfod.nix
deleted file mode 100644
index db16b052c65f..000000000000
--- a/nixos/modules/services/development/nixseparatedebuginfod.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-let
-  cfg = config.services.nixseparatedebuginfod;
-  url = "127.0.0.1:${toString cfg.port}";
-in
-{
-  options = {
-    services.nixseparatedebuginfod = {
-      enable = lib.mkEnableOption "separatedebuginfod, a debuginfod server providing source and debuginfo for nix packages";
-      port = lib.mkOption {
-        description = "port to listen";
-        default = 1949;
-        type = lib.types.port;
-      };
-      nixPackage = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.nix;
-        defaultText = lib.literalExpression "pkgs.nix";
-        description = ''
-          The version of nix that nixseparatedebuginfod should use as client for the nix daemon. It is strongly advised to use nix version >= 2.18, otherwise some debug info may go missing.
-        '';
-      };
-      allowOldNix = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Do not fail evaluation when {option}`services.nixseparatedebuginfod.nixPackage` is older than nix 2.18.
-        '';
-      };
-    };
-  };
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.allowOldNix || (lib.versionAtLeast cfg.nixPackage.version "2.18");
-        message = "nixseparatedebuginfod works better when `services.nixseparatedebuginfod.nixPackage` is set to nix >= 2.18 (instead of ${cfg.nixPackage.name}). Set `services.nixseparatedebuginfod.allowOldNix` to bypass.";
-      }
-    ];
-
-    systemd.services.nixseparatedebuginfod = {
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "nix-daemon.service" ];
-      after = [ "nix-daemon.service" ];
-      path = [ cfg.nixPackage ];
-      serviceConfig = {
-        ExecStart = [ "${pkgs.nixseparatedebuginfod}/bin/nixseparatedebuginfod -l ${url}" ];
-        Restart = "on-failure";
-        CacheDirectory = "nixseparatedebuginfod";
-        # nix does not like DynamicUsers in allowed-users
-        User = "nixseparatedebuginfod";
-        Group = "nixseparatedebuginfod";
-
-        # hardening
-        # Filesystem stuff
-        ProtectSystem = "strict"; # Prevent writing to most of /
-        ProtectHome = true; # Prevent accessing /home and /root
-        PrivateTmp = true; # Give an own directory under /tmp
-        PrivateDevices = true; # Deny access to most of /dev
-        ProtectKernelTunables = true; # Protect some parts of /sys
-        ProtectControlGroups = true; # Remount cgroups read-only
-        RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
-        PrivateMounts = true; # Give an own mount namespace
-        RemoveIPC = true;
-        UMask = "0077";
-
-        # Capabilities
-        CapabilityBoundingSet = ""; # Allow no capabilities at all
-        NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
-
-        # Kernel stuff
-        ProtectKernelModules = true; # Prevent loading of kernel modules
-        SystemCallArchitectures = "native"; # Usually no need to disable this
-        ProtectKernelLogs = true; # Prevent access to kernel logs
-        ProtectClock = true; # Prevent setting the RTC
-
-        # Networking
-        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
-
-        # Misc
-        LockPersonality = true; # Prevent change of the personality
-        ProtectHostname = true; # Give an own UTS namespace
-        RestrictRealtime = true; # Prevent switching to RT scheduling
-        MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
-        RestrictNamespaces = true;
-      };
-    };
-
-    users.users.nixseparatedebuginfod = {
-      isSystemUser = true;
-      group = "nixseparatedebuginfod";
-    };
-
-    users.groups.nixseparatedebuginfod = { };
-
-    nix.settings = lib.optionalAttrs (lib.versionAtLeast config.nix.package.version "2.4") {
-      extra-allowed-users = [ "nixseparatedebuginfod" ];
-    };
-
-    environment.debuginfodServers = [ "http://${url}" ];
-  };
-}
diff --git a/nixos/modules/services/development/nixseparatedebuginfod2.nix b/nixos/modules/services/development/nixseparatedebuginfod2.nix
index 3cea2261ca1a..c9174f61b1be 100644
--- a/nixos/modules/services/development/nixseparatedebuginfod2.nix
+++ b/nixos/modules/services/development/nixseparatedebuginfod2.nix
@@ -10,20 +10,27 @@ let
   url = "127.0.0.1:${toString cfg.port}";
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "nixseparatedebuginfod2" "substituter" ] ''
+      Instead of `services.nixseparatedebuginfod2.substituter = "foo"`, set `services.nixseparatedebuginfod2.substituters = [ "foo" ]` (possibly with mkForce to override the default value).
+    '')
+  ];
   options = {
     services.nixseparatedebuginfod2 = {
       enable = lib.mkEnableOption "nixseparatedebuginfod2, a debuginfod server providing source and debuginfo for nix packages";
       port = lib.mkOption {
         description = "port to listen";
-        default = 1950;
+        default = 1949;
         type = lib.types.port;
       };
       package = lib.mkPackageOption pkgs "nixseparatedebuginfod2" { };
-      substituter = lib.mkOption {
-        description = "nix substituter to fetch debuginfo from. Either http/https substituters, or `local:` to use debuginfo present in the local store.";
-        default = "https://cache.nixos.org";
-        example = "local:";
-        type = lib.types.str;
+      substituters = lib.mkOption {
+        description = "nix substituter to fetch debuginfo from. Either http/https/file substituters, or `local:` to use debuginfo present in the local store.";
+        default = [
+          "local:"
+          "https://cache.nixos.org"
+        ];
+        type = lib.types.listOf lib.types.str;
       };
       cacheExpirationDelay = lib.mkOption {
         description = "keep unused cache entries for this long. A number followed by a unit";
@@ -38,15 +45,19 @@ in
       path = [ config.nix.package ];
       serviceConfig = {
         ExecStart = [
-          (utils.escapeSystemdExecArgs [
-            (lib.getExe cfg.package)
-            "--listen-address"
-            url
-            "--substituter"
-            cfg.substituter
-            "--expiration"
-            cfg.cacheExpirationDelay
-          ])
+          (utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe cfg.package)
+              "--listen-address"
+              url
+              "--expiration"
+              cfg.cacheExpirationDelay
+            ]
+            ++ (lib.lists.concatMap (s: [
+              "--substituter"
+              s
+            ]) cfg.substituters)
+          ))
         ];
         Restart = "on-failure";
         CacheDirectory = "nixseparatedebuginfod2";
diff --git a/nixos/modules/services/monitoring/librenms.nix b/nixos/modules/services/monitoring/librenms.nix
index ef3593cf038c..3d8d3dbd8296 100644
--- a/nixos/modules/services/monitoring/librenms.nix
+++ b/nixos/modules/services/monitoring/librenms.nix
@@ -668,6 +668,9 @@ in
           ${artisanWrapper}/bin/librenms-artisan optimize
           echo "${package}" > ${cfg.dataDir}/package
         fi
+
+        # to make sure to not read an outdated .env file
+        ${artisanWrapper}/bin/librenms-artisan config:cache
       '';
     };
 
diff --git a/nixos/modules/services/networking/zeronet.nix b/nixos/modules/services/networking/zeronet.nix
index fd85f29e300e..9dc737bd7d0d 100644
--- a/nixos/modules/services/networking/zeronet.nix
+++ b/nixos/modules/services/networking/zeronet.nix
@@ -134,6 +134,6 @@ with lib;
   ];
 
   meta = {
-    inherit (pkgs.zeronet) maintainers;
+    inherit (pkgs.zeronet.meta) maintainers;
   };
 }
diff --git a/nixos/modules/system/boot/plymouth.nix b/nixos/modules/system/boot/plymouth.nix
index 395632466f27..3636503992c5 100644
--- a/nixos/modules/system/boot/plymouth.nix
+++ b/nixos/modules/system/boot/plymouth.nix
@@ -6,13 +6,20 @@
   ...
 }:
 
-with lib;
-
 let
-
-  plymouth = pkgs.plymouth.override {
-    systemd = config.boot.initrd.systemd.package;
-  };
+  inherit (lib)
+    mkOption
+    mkEnableOption
+    optional
+    mkIf
+    mkBefore
+    mkAfter
+    literalExpression
+    types
+    literalMD
+    getExe'
+    escapeShellArg
+    ;
 
   cfg = config.boot.plymouth;
   opt = options.boot.plymouth;
@@ -53,7 +60,7 @@ let
   themesEnv = pkgs.buildEnv {
     name = "plymouth-themes";
     paths = [
-      plymouth
+      cfg.package
       plymouthLogos
     ]
     ++ cfg.themePackages;
@@ -85,7 +92,7 @@ let
   preStartQuitFixup = {
     serviceConfig.ExecStartPre = [
       ""
-      "${plymouth}/bin/plymouth quit --wait"
+      "${getExe' cfg.package "plymouth"} quit --wait"
     ];
   };
 
@@ -99,6 +106,19 @@ in
 
       enable = mkEnableOption "Plymouth boot splash screen";
 
+      package = mkOption {
+        description = "The plymouth package to use.";
+        type = types.package;
+        default = pkgs.plymouth.override {
+          systemd = config.boot.initrd.systemd.package;
+        };
+        defaultText = literalExpression ''
+          pkgs.plymouth.override {
+            systemd = config.boot.initrd.systemd.package;
+          }
+        '';
+      };
+
       font = mkOption {
         default = "${pkgs.dejavu_fonts.minimal}/share/fonts/truetype/DejaVuSans.ttf";
         defaultText = literalExpression ''"''${pkgs.dejavu_fonts.minimal}/share/fonts/truetype/DejaVuSans.ttf"'';
@@ -109,7 +129,7 @@ in
       };
 
       themePackages = mkOption {
-        default = lib.optional (cfg.theme == "breeze") nixosBreezePlymouth;
+        default = optional (cfg.theme == "breeze") nixosBreezePlymouth;
         defaultText = literalMD ''
           A NixOS branded variant of the breeze theme when
           `config.${opt.theme} == "breeze"`, otherwise
@@ -164,15 +184,15 @@ in
     boot.kernelParams = [ "splash" ];
 
     # To be discoverable by systemd.
-    environment.systemPackages = [ plymouth ];
+    environment.systemPackages = [ cfg.package ];
 
     environment.etc."plymouth/plymouthd.conf".source = configFile;
     environment.etc."plymouth/plymouthd.defaults".source =
-      "${plymouth}/share/plymouth/plymouthd.defaults";
+      "${cfg.package}/share/plymouth/plymouthd.defaults";
     environment.etc."plymouth/logo.png".source = cfg.logo;
     environment.etc."plymouth/themes".source = "${themesEnv}/share/plymouth/themes";
     # XXX: Needed because we supply a different set of plugins in initrd.
-    environment.etc."plymouth/plugins".source = "${plymouth}/lib/plymouth";
+    environment.etc."plymouth/plugins".source = "${cfg.package}/lib/plymouth";
 
     systemd.tmpfiles.rules = [
       "d /run/plymouth 0755 root root 0 -"
@@ -181,7 +201,7 @@ in
       "L+ /run/plymouth/plugins - - - - /etc/plymouth/plugins"
     ];
 
-    systemd.packages = [ plymouth ];
+    systemd.packages = [ cfg.package ];
 
     systemd.services.plymouth-kexec.wantedBy = [ "kexec.target" ];
     systemd.services.plymouth-halt.wantedBy = [ "halt.target" ];
@@ -200,13 +220,13 @@ in
     systemd.services.emergency = preStartQuitFixup;
 
     boot.initrd.systemd = {
-      extraBin.plymouth = "${plymouth}/bin/plymouth"; # for the recovery shell
+      extraBin.plymouth = getExe' cfg.package "plymouth"; # for the recovery shell
       storePaths = [
-        "${lib.getBin config.boot.initrd.systemd.package}/bin/systemd-tty-ask-password-agent"
-        "${plymouth}/bin/plymouthd"
-        "${plymouth}/sbin/plymouthd"
+        (getExe' config.boot.initrd.systemd.package "systemd-tty-ask-password-agent")
+        (getExe' cfg.package "plymouthd")
+        "${cfg.package}/sbin/plymouthd"
       ];
-      packages = [ plymouth ]; # systemd units
+      packages = [ cfg.package ]; # systemd units
 
       services.rescue = preStartQuitFixup;
       services.emergency = preStartQuitFixup;
@@ -215,7 +235,7 @@ in
         # Files
         "/etc/plymouth/plymouthd.conf".source = configFile;
         "/etc/plymouth/logo.png".source = cfg.logo;
-        "/etc/plymouth/plymouthd.defaults".source = "${plymouth}/share/plymouth/plymouthd.defaults";
+        "/etc/plymouth/plymouthd.defaults".source = "${cfg.package}/share/plymouth/plymouthd.defaults";
         # Directories
         "/etc/plymouth/plugins".source = pkgs.runCommand "plymouth-initrd-plugins" { } (
           checkIfThemeExists
@@ -225,7 +245,7 @@ in
             mkdir -p $out/renderers
             # module might come from a theme
             cp ${themesEnv}/lib/plymouth/*.so $out
-            cp ${plymouth}/lib/plymouth/renderers/*.so $out/renderers
+            cp ${cfg.package}/lib/plymouth/renderers/*.so $out/renderers
             # useless in the initrd, and adds several megabytes to the closure
             rm $out/renderers/x11.so
           ''
@@ -306,10 +326,10 @@ in
       '')
     ];
 
-    boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) (
+    boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable) (
       ''
-        copy_bin_and_libs ${plymouth}/bin/plymouth
-        copy_bin_and_libs ${plymouth}/bin/plymouthd
+        copy_bin_and_libs ${getExe' cfg.package "plymouth"}
+        copy_bin_and_libs ${getExe' cfg.package "plymouthd"}
 
       ''
       + checkIfThemeExists
@@ -320,12 +340,12 @@ in
         mkdir -p $out/lib/plymouth/renderers
         # module might come from a theme
         cp ${themesEnv}/lib/plymouth/*.so $out/lib/plymouth
-        cp ${plymouth}/lib/plymouth/renderers/*.so $out/lib/plymouth/renderers
+        cp ${cfg.package}/lib/plymouth/renderers/*.so $out/lib/plymouth/renderers
         # useless in the initrd, and adds several megabytes to the closure
         rm $out/lib/plymouth/renderers/x11.so
 
         mkdir -p $out/share/plymouth/themes
-        cp ${plymouth}/share/plymouth/plymouthd.defaults $out/share/plymouth
+        cp ${cfg.package}/share/plymouth/plymouthd.defaults $out/share/plymouth
 
         # Copy themes into working directory for patching
         mkdir themes
diff --git a/nixos/tests/nixseparatedebuginfod.nix b/nixos/tests/nixseparatedebuginfod.nix
deleted file mode 100644
index 7399cb405c07..000000000000
--- a/nixos/tests/nixseparatedebuginfod.nix
+++ /dev/null
@@ -1,83 +0,0 @@
-{ pkgs, lib, ... }:
-let
-  secret-key = "key-name:/COlMSRbehSh6YSruJWjL+R0JXQUKuPEn96fIb+pLokEJUjcK/2Gv8Ai96D7JGay5gDeUTx5wdpPgNvum9YtwA==";
-  public-key = "key-name:BCVI3Cv9hr/AIveg+yRmsuYA3lE8ecHaT4Db7pvWLcA=";
-in
-{
-  name = "nixseparatedebuginfod";
-  # A binary cache with debug info and source for gnumake
-  nodes.cache =
-    { pkgs, ... }:
-    {
-      services.nix-serve = {
-        enable = true;
-        secretKeyFile = builtins.toFile "secret-key" secret-key;
-        openFirewall = true;
-      };
-      system.extraDependencies = [
-        pkgs.gnumake.debug
-        pkgs.gnumake.src
-        pkgs.sl
-      ];
-    };
-  # the machine where we need the debuginfo
-  nodes.machine = {
-    imports = [
-      ../modules/installer/cd-dvd/channel.nix
-    ];
-    services.nixseparatedebuginfod.enable = true;
-    nix.settings = {
-      substituters = lib.mkForce [ "http://cache:5000" ];
-      trusted-public-keys = [ public-key ];
-    };
-    environment.systemPackages = [
-      pkgs.valgrind
-      pkgs.gdb
-      pkgs.gnumake
-      (pkgs.writeShellScriptBin "wait_for_indexation" ''
-        set -x
-        while debuginfod-find debuginfo /run/current-system/sw/bin/make |& grep 'File too large'; do
-          sleep 1;
-        done
-      '')
-    ];
-  };
-  testScript = ''
-    start_all()
-    cache.wait_for_unit("nix-serve.service")
-    cache.wait_for_open_port(5000)
-    machine.wait_for_unit("nixseparatedebuginfod.service")
-    machine.wait_for_open_port(1949)
-
-    with subtest("show the config to debug the test"):
-      machine.succeed("nix --extra-experimental-features nix-command show-config |& logger")
-      machine.succeed("cat /etc/nix/nix.conf |& logger")
-    with subtest("check that the binary cache works"):
-      machine.succeed("nix-store -r ${pkgs.sl}")
-
-    # nixseparatedebuginfod needs .drv to associate executable -> source
-    # on regular systems this would be provided by nixos-rebuild
-    machine.succeed("nix-instantiate '<nixpkgs>' -A gnumake")
-
-    machine.succeed("timeout 600 wait_for_indexation")
-
-    # test debuginfod-find
-    machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/make")
-
-    # test that gdb can fetch source
-    out = machine.succeed("gdb /run/current-system/sw/bin/make --batch -x ${builtins.toFile "commands" ''
-      start
-      l
-    ''}")
-    print(out)
-    assert 'main (int argc, char **argv, char **envp)' in out
-
-    # test that valgrind can display location information
-    # this relies on the fact that valgrind complains about gnumake
-    # because we also ask valgrind to show leak kinds
-    # which are usually false positives.
-    out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all make --version 2>&1")
-    print(out)
-    assert 'main.c' in out
-  '';
-}
diff --git a/nixos/tests/nixseparatedebuginfod2.nix b/nixos/tests/nixseparatedebuginfod2.nix
index 34741ac2fa71..aa35a91971e8 100644
--- a/nixos/tests/nixseparatedebuginfod2.nix
+++ b/nixos/tests/nixseparatedebuginfod2.nix
@@ -32,7 +32,7 @@
   nodes.machine = {
     services.nixseparatedebuginfod2 = {
       enable = true;
-      substituter = "http://cache";
+      substituters = [ "http://cache" ];
     };
     environment.systemPackages = [
       pkgs.valgrind
@@ -45,7 +45,7 @@
     cache.wait_for_unit("nginx.service")
     cache.wait_for_open_port(80)
     machine.wait_for_unit("nixseparatedebuginfod2.service")
-    machine.wait_for_open_port(1950)
+    machine.wait_for_open_port(1949)
 
     with subtest("check that the binary cache works"):
       machine.succeed("nix-store --extra-substituters http://cache --option require-sigs false -r ${pkgs.sl}")
diff --git a/pkgs/applications/emulators/libretro/cores/mame2003.nix b/pkgs/applications/emulators/libretro/cores/mame2003.nix
index 57cce733e2ec..e20163bf9ff0 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2003.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003";
-  version = "0-unstable-2025-08-26";
+  version = "0-unstable-2025-10-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-libretro";
-    rev = "dfddf4db86a3acd5997ce9419c7afd00ff6587a0";
-    hash = "sha256-GJRawFdlHCfBRiErJJ3ZvZDF1gvYVkuQvKXV1qUCCRQ=";
+    rev = "3570605767a447c13b087a5946189bcbafe11e1d";
+    hash = "sha256-BcPiNYEi6uE8aSpPDNgZ8vmzSnZJUparEM3CEdexbPo=";
   };
 
   # Fix build with GCC 14
diff --git a/pkgs/applications/emulators/libretro/cores/ppsspp.nix b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
index 2ac064a36510..7acd6a288f8a 100644
--- a/pkgs/applications/emulators/libretro/cores/ppsspp.nix
+++ b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2025-10-17";
+  version = "0-unstable-2025-10-22";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "4ccf013d3b52314b935d8fc49b70f08d546aa48b";
-    hash = "sha256-e1iqnhJQKYXddp3VwpAPg6eHBnDHOFvo1b4evp8f8X4=";
+    rev = "28790c19af7ddfa822c4152a3cae4a7fb6c06bc7";
+    hash = "sha256-m1qmgr92Ni8wAYer6kIdcu+BUiBSROFcSC/M3v/JOmA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/al/albert/package.nix b/pkgs/by-name/al/albert/package.nix
index 3ad42236da59..e6a9f06ee7eb 100644
--- a/pkgs/by-name/al/albert/package.nix
+++ b/pkgs/by-name/al/albert/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "albert";
-  version = "0.32.1";
+  version = "33.0.1";
 
   src = fetchFromGitHub {
     owner = "albertlauncher";
     repo = "albert";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v2SMY0KGFwwybsiMu1W1wBWdyoDEFF3hWd4LeaT8Nts=";
+    hash = "sha256-zHLyvFzLR7Ryk6eoD+Lp+w4bIj7MAeREK0YzRXYnx6c=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/be/beszel/package.nix b/pkgs/by-name/be/beszel/package.nix
index bdeb319b90f9..bd0a1c254d5c 100644
--- a/pkgs/by-name/be/beszel/package.nix
+++ b/pkgs/by-name/be/beszel/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "beszel";
-  version = "0.13.2";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "henrygd";
     repo = "beszel";
     tag = "v${version}";
-    hash = "sha256-5akfgX3533NkeszP/by9ZfwTmMPdG5/JKFjswP1FRp8=";
+    hash = "sha256-IQ39OtYG2VDyHIPFRR0VNK56czGlJly66Bwb/NYIBxY=";
   };
 
   webui = buildNpmPackage {
@@ -48,7 +48,7 @@ buildGoModule rec {
 
     sourceRoot = "${src.name}/internal/site";
 
-    npmDepsHash = "sha256-7+3K8MhA+FXWRXQR5edUYbL/XcxPmUqWQPxl5k8u1xs=";
+    npmDepsHash = "sha256-Wtq/pesnovOyAnFta/wI+j8rml8XWORvOLz/Q82sy8g=";
   };
 
   vendorHash = "sha256-IfwgL4Ms5Uho1l0yGCyumbr1N/SN+j5HaFl4hACkTsQ=";
diff --git a/pkgs/applications/misc/birdtray/default.nix b/pkgs/by-name/bi/birdtray/package.nix
similarity index 64%
rename from pkgs/applications/misc/birdtray/default.nix
rename to pkgs/by-name/bi/birdtray/package.nix
index ce8673ed6c09..73cd238cd10c 100644
--- a/pkgs/applications/misc/birdtray/default.nix
+++ b/pkgs/by-name/bi/birdtray/package.nix
@@ -1,31 +1,32 @@
 {
-  mkDerivation,
+  stdenv,
   lib,
   fetchFromGitHub,
 
   cmake,
   pkg-config,
-  qtbase,
-  qttools,
-  qtx11extras,
+  libsForQt5,
+
+  nix-update-script,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "birdtray";
   version = "1.11.4";
 
   src = fetchFromGitHub {
     owner = "gyunaev";
     repo = "birdtray";
-    rev = "v${version}";
-    sha256 = "sha256-rj8tPzZzgW0hXmq8c1LiunIX1tO/tGAaqDGJgCQda5M=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rj8tPzZzgW0hXmq8c1LiunIX1tO/tGAaqDGJgCQda5M=";
   };
 
   nativeBuildInputs = [
     cmake
     pkg-config
+    libsForQt5.wrapQtAppsHook
   ];
-  buildInputs = [
+  buildInputs = with libsForQt5; [
     qtbase
     qttools
     qtx11extras
@@ -41,12 +42,14 @@ mkDerivation rec {
   # https://github.com/gyunaev/birdtray/issues/113#issuecomment-621742315
   qtWrapperArgs = [ "--set QT_QPA_PLATFORM xcb" ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Mail system tray notification icon for Thunderbird";
     mainProgram = "birdtray";
     homepage = "https://github.com/gyunaev/birdtray";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ Flakebi ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ Flakebi ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ca/cargo-tauri/package.nix b/pkgs/by-name/ca/cargo-tauri/package.nix
index dedff8b05ab8..119d6352fdfa 100644
--- a/pkgs/by-name/ca/cargo-tauri/package.nix
+++ b/pkgs/by-name/ca/cargo-tauri/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tauri";
-  version = "2.8.4";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "tauri-apps";
     repo = "tauri";
     tag = "tauri-cli-v${finalAttrs.version}";
-    hash = "sha256-fp/ODsbZTQdMkkRu9QqTQfavq0RPfSzZm1l4sE1hacc=";
+    hash = "sha256-MOhcTG8r7kDVTg5PY1rmrkd8U94CqT7RdPSfaakqf2M=";
   };
 
-  cargoHash = "sha256-l1IF9R+KeXAjs8Dy59mZNOCX0eoskotBPbltKU3nHQ8=";
+  cargoHash = "sha256-lWBCMS7xFEqXPpMpBzfZmdwQOq8Yaux83FGFaRyaBNg=";
 
   nativeBuildInputs = lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isLinux) [
     pkg-config
diff --git a/pkgs/by-name/ca/cargo-tauri/test-app.nix b/pkgs/by-name/ca/cargo-tauri/test-app.nix
index fd5f5f359972..ae91d53e172f 100644
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
 
     fetcherVersion = 1;
-    hash = "sha256-7F2vk6WUeXunTuXX9J0rVhl2I0ENYagRdqTy+WAXBB8=";
+    hash = "sha256-gHniZv847JFrmKnTUZcgyWhFl/ovJ5IfKbbM5I21tZc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix
index 23ea89b4c39f..ad34ce6ecf15 100644
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "12.5.1";
+  version = "12.6.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-f7P7m+RBrWxvdBMtPXZLNB4/Alr0ByiEhh9mIcVPfLk=";
+    hash = "sha256-f+2E3pG5c/3yrsvBPJp9QUHcDRY4vmmxeosw/jfQ+mY=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-i0atpv6vtbbpTKuh9aJU6oPILCqdshB0MVbgOn6fppw=";
+  vendorHash = "sha256-NI6x1MIdIHK4OfoqRvnyGxJZaCxLclaU4/rNvDx/Fhc=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/co/comrak/package.nix b/pkgs/by-name/co/comrak/package.nix
index 8773e0922cdc..d704ccfb4132 100644
--- a/pkgs/by-name/co/comrak/package.nix
+++ b/pkgs/by-name/co/comrak/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comrak";
-  version = "0.44.0";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "kivikakk";
     repo = "comrak";
     rev = "v${version}";
-    sha256 = "sha256-qwwROwIFG9/pX8t92EHriaN3O4Z2IpQGylVKhbp/0IU=";
+    sha256 = "sha256-+87K5ITDrF/nH1H4z8zyqQlJnviOlRdNnV8v6xsS0uM=";
   };
 
-  cargoHash = "sha256-Ybyrk+I0nzHFkEaWDovTOGPC26i7BXcNtFgFjmCHIwM=";
+  cargoHash = "sha256-efUiKSEsD+GguhriTpLmsyUxpQYzwr4rHJAC9FHMzdU=";
 
   meta = {
     description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";
diff --git a/pkgs/by-name/co/cosmic-ext-applet-caffeine/package.nix b/pkgs/by-name/co/cosmic-ext-applet-caffeine/package.nix
index a508e77d7565..c5901df0f842 100644
--- a/pkgs/by-name/co/cosmic-ext-applet-caffeine/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-caffeine/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-caffeine";
-  version = "0-unstable-2025-10-16";
+  version = "0-unstable-2025-10-22";
 
   src = fetchFromGitHub {
     owner = "tropicbliss";
     repo = "cosmic-ext-applet-caffeine";
-    rev = "0b50a109495d02ab8c99a501d2dd7575c6fabc1b";
-    hash = "sha256-Z84LqsPVGd7PfOUmC1iJWgTGrl6FicaxZHwTZmgmAyk=";
+    rev = "2d27a3dec13ca455975f39927bad040f36576d03";
+    hash = "sha256-4MP1H3U1sr7+h5Psf6wTiQuJJgEtlRrgQKdF7COkosI=";
   };
 
-  cargoHash = "sha256-TC7WNJUxGZpfDbDgnifBSZM7SvN2/Iw0HRXWPDXnDBM=";
+  cargoHash = "sha256-89/0XEdQ7MCycAkHhTkA5FCj/eKVLgWDhljKB/Lo4+4=";
 
   nativeBuildInputs = [
     libcosmicAppHook
diff --git a/pkgs/by-name/cr/crush/package.nix b/pkgs/by-name/cr/crush/package.nix
index 10165ff07454..24285d6948df 100644
--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@@ -9,16 +9,16 @@
 
 buildGo125Module (finalAttrs: {
   pname = "crush";
-  version = "0.9.2";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VFAGjNtXKNjkv8Ryi28oFN/uLomXXdw6NFtyjT3pMEY=";
+    hash = "sha256-vBjyykNSQ6Mq7OMRS0cCSHa8LUrIcfk9cr66ViU9z54=";
   };
 
-  vendorHash = "sha256-ktF3kIr143uPwiEbgafladZRqIsmG6jI2BeumGSu82U=";
+  vendorHash = "sha256-KaEPF4h5XqCjh91/KmB+AoiQK+fUmGEP0Lnyfe2qEZc=";
 
   # rename TestMain to prevent it from running, as it panics in the sandbox.
   postPatch = ''
diff --git a/pkgs/by-name/di/digikam/package.nix b/pkgs/by-name/di/digikam/package.nix
index d322d8b807bf..122288e15f51 100644
--- a/pkgs/by-name/di/digikam/package.nix
+++ b/pkgs/by-name/di/digikam/package.nix
@@ -62,14 +62,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "digikam";
-  version = "8.7.0";
+  version = "8.8.0";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "graphics";
     repo = "digikam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9t6tXrege3A5x5caUEfho23Pin7dON+e6x94rXC8XYE=";
+    hash = "sha256-yUrB0FXUcm+6QtlB7HMqdPpdhrV2iAo1oRkjgsHJiCU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-dockerfile.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-dockerfile.nix
index 5a14b10c58a9..1b6b85835d3e 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-dockerfile.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-dockerfile.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Dockerfile code formatter";
-  hash = "sha256-gsfMLa4zw8AblOS459ZS9OZrkGCQi5gBN+a3hvOsspk=";
+  hash = "sha256-GaK1sYdZPwQWJmz2ULcsGpWDiKjgPhqNRoGgQfGOkqc=";
   initConfig = {
     configExcludes = [ ];
     configKey = "dockerfile";
@@ -9,6 +9,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-dockerfile";
   updateUrl = "https://plugins.dprint.dev/dprint/dockerfile/latest.json";
-  url = "https://plugins.dprint.dev/dockerfile-0.3.2.wasm";
-  version = "0.3.2";
+  url = "https://plugins.dprint.dev/dockerfile-0.3.3.wasm";
+  version = "0.3.3";
 }
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-ruff.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-ruff.nix
index aeb931ecd58e..d83c0588a4ff 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-ruff.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-ruff.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Ruff (Python) wrapper plugin";
-  hash = "sha256-15InHQgF9c0Js4yUJxmZ1oNj1O16FBU12u/GOoaSAJ8=";
+  hash = "sha256-qT+6zPbX3KrONXshwzLoGTWRXM93VKO0lN9ycJujEDM=";
   initConfig = {
     configExcludes = [ ];
     configKey = "ruff";
@@ -12,6 +12,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-ruff";
   updateUrl = "https://plugins.dprint.dev/dprint/ruff/latest.json";
-  url = "https://plugins.dprint.dev/ruff-0.3.9.wasm";
-  version = "0.3.9";
+  url = "https://plugins.dprint.dev/ruff-0.6.1.wasm";
+  version = "0.6.1";
 }
diff --git a/pkgs/by-name/dp/dprint/plugins/g-plane-malva.nix b/pkgs/by-name/dp/dprint/plugins/g-plane-malva.nix
index 1abaa2a54ea1..89a3b44c0e48 100644
--- a/pkgs/by-name/dp/dprint/plugins/g-plane-malva.nix
+++ b/pkgs/by-name/dp/dprint/plugins/g-plane-malva.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "CSS, SCSS, Sass and Less formatter";
-  hash = "sha256-mFlhfqtglKtKNls96PO/2AWLL1fNC5msQCd9EgdKauE=";
+  hash = "sha256-IAIix6c9/GNDZsRk95T/rpvMh7HqFgBoq5KDVYHHOjU=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "malva";
@@ -14,6 +14,6 @@ mkDprintPlugin {
   };
   pname = "g-plane-malva";
   updateUrl = "https://plugins.dprint.dev/g-plane/malva/latest.json";
-  url = "https://plugins.dprint.dev/g-plane/malva-v0.11.2.wasm";
-  version = "0.11.2";
+  url = "https://plugins.dprint.dev/g-plane/malva-v0.14.3.wasm";
+  version = "0.14.3";
 }
diff --git a/pkgs/by-name/dp/dprint/plugins/g-plane-markup_fmt.nix b/pkgs/by-name/dp/dprint/plugins/g-plane-markup_fmt.nix
index 6c9ea245898e..633820b9ce32 100644
--- a/pkgs/by-name/dp/dprint/plugins/g-plane-markup_fmt.nix
+++ b/pkgs/by-name/dp/dprint/plugins/g-plane-markup_fmt.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "HTML, Vue, Svelte, Astro, Angular, Jinja, Twig, Nunjucks, and Vento formatter";
-  hash = "sha256-fCvurr8f79io/jIjwCfwr/WGjvcKZtptRrx9GFfytSI=";
+  hash = "sha256-TQxHIw5IXZwFA/WzIJ33ZckJNkHwW67lnh0cCGkgmrs=";
   initConfig = {
     configExcludes = [ ];
     configKey = "markup";
@@ -19,6 +19,6 @@ mkDprintPlugin {
   };
   pname = "g-plane-markup_fmt";
   updateUrl = "https://plugins.dprint.dev/g-plane/markup_fmt/latest.json";
-  url = "https://plugins.dprint.dev/g-plane/markup_fmt-v0.19.0.wasm";
-  version = "0.19.0";
+  url = "https://plugins.dprint.dev/g-plane/markup_fmt-v0.24.0.wasm";
+  version = "0.24.0";
 }
diff --git a/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_graphql.nix b/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_graphql.nix
index 6cdea7f70ae7..084bdadbb763 100644
--- a/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_graphql.nix
+++ b/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_graphql.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "GraphQL formatter";
-  hash = "sha256-PlQwpR0tMsghMrOX7is+anN57t9xa9weNtoWpc0E9ec=";
+  hash = "sha256-xEEBnmxxiIPNOePBDS2HG6lfAhR4l53w+QDF2mXdyzg=";
   initConfig = {
     configExcludes = [ ];
     configKey = "graphql";
@@ -12,6 +12,6 @@ mkDprintPlugin {
   };
   pname = "g-plane-pretty_graphql";
   updateUrl = "https://plugins.dprint.dev/g-plane/pretty_graphql/latest.json";
-  url = "https://plugins.dprint.dev/g-plane/pretty_graphql-v0.2.1.wasm";
-  version = "0.2.1";
+  url = "https://plugins.dprint.dev/g-plane/pretty_graphql-v0.2.3.wasm";
+  version = "0.2.3";
 }
diff --git a/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_yaml.nix b/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_yaml.nix
index ca0b4883918b..7667e46621f3 100644
--- a/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_yaml.nix
+++ b/pkgs/by-name/dp/dprint/plugins/g-plane-pretty_yaml.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "YAML formatter";
-  hash = "sha256-6ua021G7ZW7Ciwy/OHXTA1Joj9PGEx3SZGtvaA//gzo=";
+  hash = "sha256-iSh5SRrjQB1hJoKkkup7R+Durcu+cxePa7GDVjwnexU=";
   initConfig = {
     configExcludes = [ ];
     configKey = "yaml";
@@ -12,6 +12,6 @@ mkDprintPlugin {
   };
   pname = "g-plane-pretty_yaml";
   updateUrl = "https://plugins.dprint.dev/g-plane/pretty_yaml/latest.json";
-  url = "https://plugins.dprint.dev/g-plane/pretty_yaml-v0.5.0.wasm";
-  version = "0.5.0";
+  url = "https://plugins.dprint.dev/g-plane/pretty_yaml-v0.5.1.wasm";
+  version = "0.5.1";
 }
diff --git a/pkgs/by-name/dp/dprint/plugins/update-plugins.py b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
index 54eab2a67355..9c1e5c91883c 100755
--- a/pkgs/by-name/dp/dprint/plugins/update-plugins.py
+++ b/pkgs/by-name/dp/dprint/plugins/update-plugins.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i python -p nix 'python3.withPackages (pp: [ pp.requests ])'
+#!nix-shell -i python3 -p nix 'python3.withPackages (ps: [ ps.requests ])'
 
 import json
 import os
@@ -138,7 +138,7 @@ def update_plugins():
             "updateUrl": update_url,
             "pname": pname,
             "version": e["version"],
-            "description": e["description"],
+            "description": e["description"].rstrip("."),
             "initConfig": {
                 "configKey": e["configKey"],
                 "configExcludes": e["configExcludes"],
diff --git a/pkgs/by-name/ds/dsniff/package.nix b/pkgs/by-name/ds/dsniff/package.nix
index 316b728868d3..a37d81216eaf 100644
--- a/pkgs/by-name/ds/dsniff/package.nix
+++ b/pkgs/by-name/ds/dsniff/package.nix
@@ -34,11 +34,23 @@ let
   };
   pcap = symlinkJoin {
     inherit (libpcap) name;
-    paths = [ (libpcap.overrideAttrs { dontDisableStatic = true; }) ];
+    paths =
+      let
+        staticlibpcap = libpcap.overrideAttrs { dontDisableStatic = true; };
+      in
+      [
+        (lib.getInclude staticlibpcap)
+        (lib.getLib staticlibpcap)
+      ];
     postBuild = ''
       cp -rs $out/include/pcap $out/include/net
-      # prevent references to libpcap
-      rm $out/lib/*.so*
+      # check the presence of the files that ./configure expects
+      for i in $out/lib/libpcap.a $out/include/pcap.h $out/include/net/bpf.h; do
+        if ! test -f $i; then
+          echo $i is missing from output
+          exit 1
+        fi
+      done
     '';
   };
   net = symlinkJoin {
@@ -71,8 +83,8 @@ stdenv.mkDerivation rec {
     domain = "salsa.debian.org";
     owner = "pkg-security-team";
     repo = "dsniff";
-    rev = "debian/${version}+debian-34";
-    sha256 = "sha256-CY0+G09KZXtAwKuaYh5/qcmZjuNhdGis3zCG14hWtqw=";
+    tag = "debian/${version}+debian-35";
+    hash = "sha256-RVv9USAHTVYnGgKygIPgfXpfjCYigJvScuzc2+1Uzfw=";
     name = "dsniff.tar.gz";
   };
 
diff --git a/pkgs/by-name/fe/feishu/package.nix b/pkgs/by-name/fe/feishu/package.nix
index acc5593e92a1..a4a945fa3b67 100644
--- a/pkgs/by-name/fe/feishu/package.nix
+++ b/pkgs/by-name/fe/feishu/package.nix
@@ -65,12 +65,12 @@
 let
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/1d078929/Feishu-linux_x64-7.50.13.deb";
-      sha256 = "sha256-wP3Uyz3KiWLADzUhZnPJori2gqdzEm5azUcGv8w1BXM=";
+      url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/e91d15e2/Feishu-linux_x64-7.50.14.deb";
+      sha256 = "sha256-Ywlf3qi4q5nT3gC9r4ymtFYIrg8xmxapIfO2oQoBdC8=";
     };
     aarch64-linux = fetchurl {
-      url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/05ade0ea/Feishu-linux_arm64-7.50.13.deb";
-      sha256 = "sha256-9YTk3Jx1Ap5ym2N/GiN8YcB6XfyVElSWZV3/O6gJWNE=";
+      url = "https://sf3-cn.feishucdn.com/obj/ee-appcenter/f247fca9/Feishu-linux_arm64-7.50.14.deb";
+      sha256 = "sha256-ecpaw0n6jRq1hdDY3rTzRiN8Ck3BTLt+K1DcxrPI4TE=";
     };
   };
 
@@ -133,7 +133,7 @@ let
   ];
 in
 stdenv.mkDerivation {
-  version = "7.50.13";
+  version = "7.50.14";
   pname = "feishu";
 
   src =
diff --git a/pkgs/by-name/fs/fstar/package.nix b/pkgs/by-name/fs/fstar/package.nix
index fc810157836f..55f3433789b4 100644
--- a/pkgs/by-name/fs/fstar/package.nix
+++ b/pkgs/by-name/fs/fstar/package.nix
@@ -17,15 +17,15 @@ let
 
   fstarZ3 = callPackage ./z3 { };
 in
-ocamlPackages.buildDunePackage rec {
+ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "fstar";
-  version = "2025.08.07";
+  version = "2025.10.06";
 
   src = fetchFromGitHub {
     owner = "FStarLang";
     repo = "FStar";
-    rev = "v${version}";
-    hash = "sha256-IfwMLMbyC1+iPIG48zm6bzhKCHKPOpVaHdlLhU5g3co=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-PH3ylEiUS+mfFtYV+KI7xrCewkEutM1c14A+ARsyOQY=";
   };
 
   nativeBuildInputs = [
@@ -114,7 +114,7 @@ ocamlPackages.buildDunePackage rec {
   meta = {
     description = "ML-like functional programming language aimed at program verification";
     homepage = "https://www.fstar-lang.org";
-    changelog = "https://github.com/FStarLang/FStar/raw/v${version}/CHANGES.md";
+    changelog = "https://github.com/FStarLang/FStar/raw/v${finalAttrs.version}/CHANGES.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       numinit
@@ -122,4 +122,4 @@ ocamlPackages.buildDunePackage rec {
     mainProgram = "fstar.exe";
     platforms = with lib.platforms; darwin ++ linux;
   };
-}
+})
diff --git a/pkgs/by-name/gh/gh-markdown-preview/package.nix b/pkgs/by-name/gh/gh-markdown-preview/package.nix
index a6d83efa539a..7507a1343ee1 100644
--- a/pkgs/by-name/gh/gh-markdown-preview/package.nix
+++ b/pkgs/by-name/gh/gh-markdown-preview/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "gh-markdown-preview";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "yusukebe";
     repo = "gh-markdown-preview";
     rev = "v${version}";
-    hash = "sha256-jvdNAxPAr3ieOhUWeALmopeN06mZZJ+zBDFVl7gsYoc=";
+    hash = "sha256-Q6rTkiklSU1lh4mEKYJYXOmGlRkNUYTC/jtMkVVFRu0=";
   };
 
   vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";
diff --git a/pkgs/by-name/ha/harlequin/package.nix b/pkgs/by-name/ha/harlequin/package.nix
index 6a06668e656c..b12abb6b7a03 100644
--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -47,6 +47,7 @@ pythonPackages.buildPythonApplication rec {
   };
 
   pythonRelaxDeps = [
+    "click"
     "numpy"
     "pyarrow"
     "questionary"
@@ -104,6 +105,10 @@ pythonPackages.buildPythonApplication rec {
     # Tests require network access
     "test_connect_extensions"
     "test_connect_prql"
+
+    # Broken since click was updated to 8.2.1 in https://github.com/NixOS/nixpkgs/pull/448189
+    # AssertionError
+    "test_bad_adapter_opt"
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [
     # Test incorrectly tries to load a dylib/so compiled for x86_64
diff --git a/pkgs/by-name/hy/hyfetch/package.nix b/pkgs/by-name/hy/hyfetch/package.nix
index 098d367be445..a258372f80fe 100644
--- a/pkgs/by-name/hy/hyfetch/package.nix
+++ b/pkgs/by-name/hy/hyfetch/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyfetch";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "hykilpikonna";
     repo = "hyfetch";
     tag = finalAttrs.version;
-    hash = "sha256-Y9v2vrpTPlsgFRoo33NDVoyQSgUD/stKQLJXzUxFesA=";
+    hash = "sha256-nqbdkVEKuzuDDK4NivzJ6hfm3KqkFqorETiEaTqgKNY=";
   };
 
-  cargoHash = "sha256-auOeH/1KtxS7a1APOtCMwNTdEQ976BL/jEKj2ADaakQ=";
+  cargoHash = "sha256-Lem/6q0+P+1Hy+ZCJvP+O7kws49ytKEhzytT2+B4aRE=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ii/iio-niri/package.nix b/pkgs/by-name/ii/iio-niri/package.nix
new file mode 100644
index 000000000000..e203e26149a8
--- /dev/null
+++ b/pkgs/by-name/ii/iio-niri/package.nix
@@ -0,0 +1,37 @@
+{
+  rustPlatform,
+  lib,
+  fetchFromGitHub,
+  dbus,
+  pkg-config,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "iio-niri";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "Zhaith-Izaliel";
+    repo = "iio-niri";
+    tag = "v${version}";
+    hash = "sha256-IOMJ1xtjUkUoUgFZ9pxBf5XKdaUHu3WbUH5TlEiNRc4=";
+  };
+
+  cargoHash = "sha256-b05Jy+EKFAUcHR9+SdjHZUcIZG0Ta+ar/qc0GdRlJik=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    dbus
+  ];
+
+  meta = {
+    description = "Listen to iio-sensor-proxy and updates Niri output orientation depending on the accelerometer orientation";
+    homepage = "https://github.com/Zhaith-Izaliel/iio-niri";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ zhaithizaliel ];
+    mainProgram = "iio-niri";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ke/keychron-udev-rules/package.nix b/pkgs/by-name/ke/keychron-udev-rules/package.nix
new file mode 100644
index 000000000000..374ef9ff2a57
--- /dev/null
+++ b/pkgs/by-name/ke/keychron-udev-rules/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenvNoCC,
+  udevCheckHook,
+  writeTextFile,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "keychron-udev-rules";
+  version = "23-10-2025";
+
+  nativeBuildInputs = [ udevCheckHook ];
+
+  src = writeTextFile {
+    name = "69-keychron.rules";
+    text = ''
+      KERNEL=="event*", SUBSYSTEM=="input", ENV{ID_VENDOR_ID}=="3434", ENV{ID_INPUT_JOYSTICK}=="*?", ENV{ID_INPUT_JOYSTICK}=""
+    '';
+  };
+
+  dontConfigure = true;
+  dontUnpack = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 $src $out/lib/udev/rules.d/69-keychron.rules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Keychron Keyboard Udev Rules, fixes issues with keyboard detection on Linux";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kruziikrel13 ];
+  };
+})
diff --git a/pkgs/by-name/ku/kubernetes/package.nix b/pkgs/by-name/ku/kubernetes/package.nix
index 8e817bff3632..02287b57bd73 100644
--- a/pkgs/by-name/ku/kubernetes/package.nix
+++ b/pkgs/by-name/ku/kubernetes/package.nix
@@ -12,6 +12,7 @@
   nix-update-script,
 
   components ? [
+    "cmd/kubeadm"
     "cmd/kubelet"
     "cmd/kube-apiserver"
     "cmd/kube-controller-manager"
@@ -50,12 +51,7 @@ buildGoModule (finalAttrs: {
 
   patches = [ ./fixup-addonmanager-lib-path.patch ];
 
-  WHAT = lib.concatStringsSep " " (
-    [
-      "cmd/kubeadm"
-    ]
-    ++ components
-  );
+  WHAT = lib.concatStringsSep " " components;
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/li/libjson-rpc-cpp/package.nix b/pkgs/by-name/li/libjson-rpc-cpp/package.nix
index b2e3417c0920..39b88c637d67 100644
--- a/pkgs/by-name/li/libjson-rpc-cpp/package.nix
+++ b/pkgs/by-name/li/libjson-rpc-cpp/package.nix
@@ -50,6 +50,10 @@ stdenv.mkDerivation rec {
     done
 
     sed -i -re 's#MATCHES "jsoncpp"#MATCHES ".*/jsoncpp/json$"#g' cmake/FindJsoncpp.cmake
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)" \
+      --replace-fail "cmake_policy(SET CMP0042 OLD)" ""
   '';
 
   preConfigure = ''
diff --git a/pkgs/by-name/li/libkkc-data/package.nix b/pkgs/by-name/li/libkkc-data/package.nix
deleted file mode 100644
index 85e9f3e7d256..000000000000
--- a/pkgs/by-name/li/libkkc-data/package.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  python3,
-  libkkc,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libkkc-data";
-  version = "0.2.7";
-
-  src = fetchurl {
-    url = "${meta.homepage}/releases/download/v${libkkc.version}/${pname}-${version}.tar.xz";
-    sha256 = "16avb50jasq2f1n9xyziky39dhlnlad0991pisk3s11hl1aqfrwy";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "build-python3.patch";
-      url = "https://github.com/ueno/libkkc/commit/ba1c1bd3eb86d887fc3689c3142732658071b5f7.patch";
-      relative = "data/templates/libkkc-data";
-      hash = "sha256-q4zUclJtDQ1E5v2PW00zRZz6GXllLUcp2h3tugufrRU=";
-    })
-  ];
-
-  nativeBuildInputs = [ python3.pkgs.marisa ];
-
-  strictDeps = true;
-
-  meta = with lib; {
-    description = "Language model data package for libkkc";
-    homepage = "https://github.com/ueno/libkkc";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/li/libkkc/package.nix b/pkgs/by-name/li/libkkc/package.nix
deleted file mode 100644
index 0788ab0cc610..000000000000
--- a/pkgs/by-name/li/libkkc/package.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  vala,
-  gobject-introspection,
-  intltool,
-  python3,
-  glib,
-  pkg-config,
-  libgee,
-  json-glib,
-  marisa,
-  libkkc-data,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libkkc";
-  version = "0.3.5";
-
-  src = fetchurl {
-    url = "${meta.homepage}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "89b07b042dae5726d306aaa1296d1695cb75c4516f4b4879bc3781fe52f62aef";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "build-python3.patch";
-      url = "https://github.com/ueno/libkkc/commit/ba1c1bd3eb86d887fc3689c3142732658071b5f7.patch";
-      hash = "sha256-4IVpcJJFrxmxJGNiRHteleAa6trOwbvMHRTE/qyjOPY=";
-    })
-  ];
-
-  nativeBuildInputs = [
-    vala
-    gobject-introspection
-    python3
-    python3.pkgs.marisa
-    intltool
-    glib
-    pkg-config
-  ];
-
-  buildInputs = [
-    marisa
-    libkkc-data
-  ];
-  enableParallelBuilding = true;
-
-  propagatedBuildInputs = [
-    libgee
-    json-glib
-  ];
-
-  postInstall = ''
-    ln -s ${libkkc-data}/lib/libkkc/models $out/share/libkkc/models
-  '';
-
-  meta = with lib; {
-    broken = true;
-    description = "Japanese Kana Kanji conversion input method library";
-    homepage = "https://github.com/ueno/libkkc";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/li/linyaps/package.nix b/pkgs/by-name/li/linyaps/package.nix
index 0feed2bdd45e..b1fdeae4014d 100644
--- a/pkgs/by-name/li/linyaps/package.nix
+++ b/pkgs/by-name/li/linyaps/package.nix
@@ -50,6 +50,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./fix-host-path.patch
+    # Fix for Qt 6.10
+    (fetchpatch {
+      url = "https://github.com/OpenAtom-Linyaps/linyaps/commit/c49e6cfab304ffa2b5b1657da247a6eda6f46c3a.patch";
+      hash = "sha256-lFyPb8YiaXJl2yzPElUR1jYwdOxA0h+db4sv/N70N4E=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index 2447cb920604..1b8e7e4ab3a6 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -19,9 +19,9 @@
     #
     # Ensure you also check ../mattermostLatest/package.nix.
     regex = "^v(10\\.5\\.[0-9]+)$";
-    version = "10.5.11";
-    srcHash = "sha256-2XX6SNWlu+2Kh0rJodp0Ipzu8/gdjygCxeD2BVYDcTc=";
-    vendorHash = "sha256-uryErnXPVd/gmiAk0F2DVaqz368H6j97nBn0eNW7DFk=";
+    version = "10.5.12";
+    srcHash = "sha256-VaW+rA0UeIZhGU9BlYZgyznAOtLN+JI7UPbMRPCwTww=";
+    vendorHash = "sha256-vxUxSkj1EwgMtPpCGJSA9jCDBeLrWhecdwq4KBThhj4=";
     npmDepsHash = "sha256-tIeuDUZbqgqooDm5TRfViiTT5OIyN0BPwvJdI+wf7p0=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index 72f9a283389f..726da1dfb70c 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -11,9 +11,9 @@ mattermost.override {
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
     regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.12.0";
-    srcHash = "sha256-oVZlXprw0NddHrtx1g2WRoGm1ATq/pqncD0mewN12nw=";
-    vendorHash = "sha256-Lqa463LLy41aaRbrtJFclfOj55vLjK4pWFAFLzX3TJE=";
+    version = "10.12.1";
+    srcHash = "sha256-PL55NKypsLA+H19cS99iIsMI3IBb6vLvAbAVLZyg+sE=";
+    vendorHash = "sha256-DS4OC3eQffD/8yLE01gnTJXwV77G7rWk4kqA/rTCtJw=";
     npmDepsHash = "sha256-O9iX6hnwkEHK0kkHqWD6RYXqoSEW6zs+utiYHnt54JY=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
diff --git a/pkgs/by-name/ne/nextcloud-client/package.nix b/pkgs/by-name/ne/nextcloud-client/package.nix
index 44dcf47ce335..f55675dff4ed 100644
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.17.2";
+  version = "4.0.0";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${version}";
-    hash = "sha256-jBlQh5tHP+2LyFCnP0m/ud3nU40i5cWtUwSeM5auQX8=";
+    hash = "sha256-IXX1PdMR3ptgH7AufnGKBeKftZgai7KGvYW+OCkM8jo=";
   };
 
   patches = [
diff --git a/pkgs/by-name/nh/nheko/package.nix b/pkgs/by-name/nh/nheko/package.nix
index c48c23697788..cd012dbd780b 100644
--- a/pkgs/by-name/nh/nheko/package.nix
+++ b/pkgs/by-name/nh/nheko/package.nix
@@ -43,6 +43,11 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-y8aiS6h5CSJYBdsAH4jYhAyrFug7aH2H8L6rBfULnQQ=";
     })
     ./fix-darwin-build.patch
+    # Fix for Qt 6.10
+    (fetchpatch {
+      url = "https://github.com/Nheko-Reborn/nheko/commit/af2ca72030deb14a920a888e807dc732d93e3714.patch";
+      hash = "sha256-tlYrfEoUkdJoVzvfF34IhXdn1AxLO0MOlp9rzuFivws=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ni/nixseparatedebuginfod/package.nix b/pkgs/by-name/ni/nixseparatedebuginfod/package.nix
deleted file mode 100644
index 6d518ff985f4..000000000000
--- a/pkgs/by-name/ni/nixseparatedebuginfod/package.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  rustPlatform,
-  libarchive,
-  openssl,
-  rust-jemalloc-sys,
-  sqlite,
-  pkg-config,
-  nixosTests,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "nixseparatedebuginfod";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner = "symphorien";
-    repo = "nixseparatedebuginfod";
-    rev = "v${version}";
-    hash = "sha256-sVQ6UgQvSTEIxXPxISeTI9tqAdJlxQpLxq1h4I31r6k=";
-  };
-
-  cargoHash = "sha256-vaCmRr1hXF0BSg/dl3LYyd7c1MdPKIv6KgDgGEzqqJQ=";
-
-  # tests need a working nix install with access to the internet
-  doCheck = false;
-
-  buildInputs = [
-    libarchive
-    openssl
-    rust-jemalloc-sys
-    sqlite
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  passthru = {
-    tests = {
-      inherit (nixosTests) nixseparatedebuginfod;
-    };
-  };
-
-  meta = with lib; {
-    description = "Downloads and provides debug symbols and source code for nix derivations to gdb and other debuginfod-capable debuggers as needed";
-    homepage = "https://github.com/symphorien/nixseparatedebuginfod";
-    license = licenses.gpl3Only;
-    maintainers = [ maintainers.symphorien ];
-    platforms = platforms.linux;
-    mainProgram = "nixseparatedebuginfod";
-  };
-}
diff --git a/pkgs/by-name/ni/nixseparatedebuginfod2/package.nix b/pkgs/by-name/ni/nixseparatedebuginfod2/package.nix
index 2cffac191eef..42f9613df285 100644
--- a/pkgs/by-name/ni/nixseparatedebuginfod2/package.nix
+++ b/pkgs/by-name/ni/nixseparatedebuginfod2/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixseparatedebuginfod2";
-  version = "0.1.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "symphorien";
     repo = "nixseparatedebuginfod2";
     tag = "v${version}";
-    hash = "sha256-bk+l/oWAPuWV6mnh9Pr/mru3BZjos08IfzEGUEFSW1E=";
+    hash = "sha256-INY9mLJ+7i3BoShqFZMELm9aXiDbZkuLyokgm42kEbo=";
   };
 
-  cargoHash = "sha256-HmtFso6uF2GsjIA0FPVL4S3S+lwQUrg7N576UaekXpU=";
+  cargoHash = "sha256-6JyC0CLGnkbQWp8l27DXZ04Gt0nsNNSBFfcvAQtllE4=";
 
   buildInputs = [
     libarchive
@@ -41,6 +41,9 @@ rustPlatform.buildRustPackage rec {
 
   passthru.tests = { inherit (nixosTests) nixseparatedebuginfod2; };
 
+  # flaky tests
+  checkFlags = [ "--skip substituter::http" ];
+
   meta = {
     description = "Downloads and provides debug symbols and source code for nix derivations to gdb and other debuginfod-capable debuggers as needed";
     homepage = "https://github.com/symphorien/nixseparatedebuginfod2";
diff --git a/pkgs/by-name/pc/pcloud/package.nix b/pkgs/by-name/pc/pcloud/package.nix
index 8569087b9db8..12dcb5eb4d2f 100644
--- a/pkgs/by-name/pc/pcloud/package.nix
+++ b/pkgs/by-name/pc/pcloud/package.nix
@@ -39,13 +39,13 @@
 
 let
   pname = "pcloud";
-  version = "1.14.16";
-  code = "XZbJvD5ZfXtwygX5xg7F9ywtRup5H5sBvfhy";
+  version = "1.14.17";
+  code = "XZNtR95ZctUIq8zYVD7eSKotwGMx7kDWVtzV";
 
   # Archive link's codes: https://www.pcloud.com/release-notes/linux.html
   src = fetchzip {
     url = "https://api.pcloud.com/getpubzip?code=${code}&filename=pcloud-${version}.zip";
-    hash = "sha256-6K7QPr3MtZvRZt84N8+i8QZBaKHHeTY1bXMdO+wUCr0=";
+    hash = "sha256-Chh8obZHntkiG7IJAW96T9y3KcOwzI18/VALheLcxBA=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/pr/prometheus-storagebox-exporter/package.nix b/pkgs/by-name/pr/prometheus-storagebox-exporter/package.nix
index 9a4dbd6d1a46..f9b5b50b1696 100644
--- a/pkgs/by-name/pr/prometheus-storagebox-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-storagebox-exporter/package.nix
@@ -4,18 +4,18 @@
   fetchFromGitHub,
 }:
 
-buildGoModule {
+buildGoModule rec {
   pname = "prometheus-storagebox-exporter";
-  version = "0-unstable-2025-07-28";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "fleaz";
     repo = "prometheus-storagebox-exporter";
-    hash = "sha256-HGUAvoLIVXwZT/CJ1yj9H6ClNRwiJ8rjjluAQ6GdBME=";
-    rev = "e03cfd5f60f7847b74de2f6f47690bc03b7c157a";
+    hash = "sha256-sufxNnHAdOaYEzKj9vriDrJF6Tq4Eim3Z45FEuuG97Q=";
+    tag = "v${version}";
   };
 
-  vendorHash = "sha256-w2S8LWQyDLnUba7+YnTk7GhRXR/agbF5GFIeOPk8w64=";
+  vendorHash = "sha256-hWM7JnL0x+vsUrQsJZGM3z2jB3F1wtjKWmX8j+WnjKY=";
 
   meta = {
     description = "Prometheus exporter for Hetzner storage boxes";
diff --git a/pkgs/by-name/pr/proxysql/makefiles.patch b/pkgs/by-name/pr/proxysql/makefiles.patch
index cf6328920254..17facc6744c1 100644
--- a/pkgs/by-name/pr/proxysql/makefiles.patch
+++ b/pkgs/by-name/pr/proxysql/makefiles.patch
@@ -1,5 +1,5 @@
 diff --git a/Makefile b/Makefile
-index b9ad6f71..60e71a86 100644
+index 01aa5730..6c71b3a5 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -81,10 +81,7 @@ endif
@@ -35,7 +35,7 @@ index b9ad6f71..60e71a86 100644
  	install -m 0755 etc/init.d/proxysql /etc/init.d
  ifeq ($(DISTRO),"CentOS Linux")
 diff --git a/deps/Makefile b/deps/Makefile
-index 7c8fcc85..4ae0aba1 100644
+index 87d2a20e..505e069a 100644
 --- a/deps/Makefile
 +++ b/deps/Makefile
 @@ -61,27 +61,22 @@ default: $(targets)
@@ -66,7 +66,7 @@ index 7c8fcc85..4ae0aba1 100644
  	cd libhttpserver/libhttpserver && patch -p1 < ../noexcept.patch
  	cd libhttpserver/libhttpserver && patch -p1 < ../re2_regex.patch
  	cd libhttpserver/libhttpserver && patch -p1 < ../final_val_post_process.patch
-@@ -99,58 +94,49 @@ libhttpserver: libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a
+@@ -99,77 +94,66 @@ libhttpserver: libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a
  
  
  libev/libev/.libs/libev.a:
@@ -83,7 +83,8 @@ index 7c8fcc85..4ae0aba1 100644
  	cd coredumper && rm -rf coredumper-*/ || true
  	cd coredumper && tar -zxf coredumper-*.tar.gz
  	cd coredumper/coredumper && patch -p1 < ../includes.patch
- 	cd coredumper/coredumper && cmake . -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Debug
+-	cd coredumper/coredumper && cmake . -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Debug
++	cd coredumper/coredumper && cmake . -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Debug -DCMAKE_POLICY_VERSION_MINIMUM=3.5
  	cd coredumper/coredumper && CC=${CC} CXX=${CXX} ${MAKE}
  coredumper: coredumper/coredumper/src/libcoredumper.a
  
@@ -125,7 +126,18 @@ index 7c8fcc85..4ae0aba1 100644
  	cd lz4/lz4 && CC=${CC} CXX=${CXX} ${MAKE}
  
  lz4: lz4/lz4/lib/liblz4.a
-@@ -168,8 +154,6 @@ clickhouse-cpp: clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-s
+ 
+ 
+ clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-static.a:
+ 	cd clickhouse-cpp && rm -rf clickhouse-cpp-*/ || true
+ 	cd clickhouse-cpp && tar -zxf v2.3.0.tar.gz
+ 	cd clickhouse-cpp && ln -fs clickhouse-cpp-*/ clickhouse-cpp
+ 	cd clickhouse-cpp/clickhouse-cpp && patch clickhouse/base/wire_format.h < ../wire_format.patch
+-	cd clickhouse-cpp/clickhouse-cpp && cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo .
++	cd clickhouse-cpp/clickhouse-cpp && cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_POLICY_VERSION_MINIMUM=3.5 .
+ 	cd clickhouse-cpp/clickhouse-cpp && CC=${CC} CXX=${CXX} ${MAKE}
+ 
+ clickhouse-cpp: clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-static.a
  
  
  libdaemon/libdaemon/libdaemon/.libs/libdaemon.a:
@@ -134,6 +146,15 @@ index 7c8fcc85..4ae0aba1 100644
  	cd libdaemon/libdaemon && patch -p0 < ../daemon_fork_umask.patch
  	cd libdaemon/libdaemon && cp ../config.guess . && chmod +x config.guess && cp ../config.sub . && chmod +x config.sub && ./configure --disable-examples
  	cd libdaemon/libdaemon && CC=${CC} CXX=${CXX} ${MAKE}
+@@ -194,7 +178,7 @@ mariadb-client-library/mariadb_client/libmariadb/libmariadbclient.a:
+ 	cd mariadb-client-library && rm -rf mariadb-connector-c-*/ || true
+ 	cd mariadb-client-library && tar -zxf mariadb-connector-c-3.3.8-src.tar.gz
+ 	cd mariadb-client-library/mariadb_client && patch -p0 < ../plugin_auth_CMakeLists.txt.patch
+-	cd mariadb-client-library/mariadb_client && cmake . -Wno-dev -DCMAKE_BUILD_TYPE=RelWithDebInfo -DOPENSSL_ROOT_DIR=$(SSL_IDIR) -DOPENSSL_LIBRARIES=$(SSL_LDIR) -DICONV_LIBRARIES=$(brew --prefix libiconv)/lib -DICONV_INCLUDE=$(brew --prefix libiconv)/include .
++	cd mariadb-client-library/mariadb_client && cmake . -Wno-dev -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_BUILD_TYPE=RelWithDebInfo -DOPENSSL_ROOT_DIR=$(SSL_IDIR) -DOPENSSL_LIBRARIES=$(SSL_LDIR) -DICONV_LIBRARIES=$(brew --prefix libiconv)/lib -DICONV_INCLUDE=$(brew --prefix libiconv)/include .
+ ifeq ($(PROXYDEBUG),1)
+ 	cd mariadb-client-library/mariadb_client && patch -p0 < ../ma_context.h.patch
+ else ifeq ($(USEVALGRIND),1)
 @@ -253,18 +237,13 @@ sqlite3/sqlite3/sqlite3.o:
  sqlite3: sqlite3/sqlite3/sqlite3.o
  
@@ -170,8 +191,8 @@ index 7c8fcc85..4ae0aba1 100644
 -	cd postgresql && tar -zxf postgresql-*.tar.gz
  	cd postgresql/postgresql && patch -p0 < ../get_result_from_pgconn.patch
  	cd postgresql/postgresql && patch -p0 < ../handle_row_data.patch
- 	#cd postgresql/postgresql && LD_LIBRARY_PATH="$(shell pwd)/libssl/openssl" ./configure --with-ssl=openssl --with-includes="$(shell pwd)/libssl/openssl/include/" --with-libraries="$(shell pwd)/libssl/openssl/" --without-readline --enable-debug  CFLAGS="-ggdb -O0 -fno-omit-frame-pointer" CPPFLAGS="-g -O0"
-@@ -360,4 +335,3 @@ cleanall:
+ 	cd postgresql/postgresql && patch -p0 < ../fmt_err_msg.patch
+@@ -361,4 +336,3 @@ cleanall:
  	cd libusual && rm -rf libusual-*/ || true
  	cd libscram && rm -rf lib/* obj/* || true
  .PHONY: cleanall
diff --git a/pkgs/by-name/pr/proxysql/package.nix b/pkgs/by-name/pr/proxysql/package.nix
index 0d9012a2054a..6efeb676bec4 100644
--- a/pkgs/by-name/pr/proxysql/package.nix
+++ b/pkgs/by-name/pr/proxysql/package.nix
@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proxysql";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "sysown";
     repo = "proxysql";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yGxn46Vm8YdtIvvoTlOHQ1aAP2J/h/kFqr4ehruDsTw=";
+    hash = "sha256-kbfuUulEDPx/5tpp7uOkIXQuyaFYzos3crCvkWHSmHg=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pw/pwvucontrol/package.nix b/pkgs/by-name/pw/pwvucontrol/package.nix
index 35dab5a2f0e9..699f37ee388f 100644
--- a/pkgs/by-name/pw/pwvucontrol/package.nix
+++ b/pkgs/by-name/pw/pwvucontrol/package.nix
@@ -43,18 +43,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pwvucontrol";
-  version = "0.4.9";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "saivert";
     repo = "pwvucontrol";
     tag = finalAttrs.version;
-    hash = "sha256-fmEXVUz3SerVgWijT/CAoelSUzq861AkBVjP5qwS0ao=";
+    hash = "sha256-21TBVDzjrBzNIPkAURGs2ngI8Vj6o/RL3Ael4wwE2Lk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-oQSH4P9WxvkXZ53KM5ZoRAZyQFt60Zz7guBbgT1iiBk=";
+    hash = "sha256-FrPpLbfqM/DtjYu20pwr1AMUHaAuTEt60I3JlFZO4RI=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/qd/qdmr/package.nix b/pkgs/by-name/qd/qdmr/package.nix
index ec24d4032f95..a307759560e1 100644
--- a/pkgs/by-name/qd/qdmr/package.nix
+++ b/pkgs/by-name/qd/qdmr/package.nix
@@ -77,7 +77,10 @@ stdenv.mkDerivation rec {
     description = "GUI application and command line tool for programming DMR radios";
     homepage = "https://dm3mat.darc.de/qdmr/";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ _0x4A6F ];
+    maintainers = with lib.maintainers; [
+      _0x4A6F
+      juliabru
+    ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index 0a3d216255e5..745c3b3b087e 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -13,14 +13,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2025-10-17";
+    version = "0-unstable-2025-10-23";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "57622793bf80b90a651a566178ae139f64ea5d93";
-      hash = "sha256-LKv/WS8aAgD8s1T7aHeHrkDMVy/E5FiuJEoM+80KLb4=";
+      rev = "e363db970c77e9cab8f3611bb6b6f8a59646a035";
+      hash = "sha256-phJRQ+euSTEmsn1wS5dgO8UPwAJ8cr8ov3K3fSzWQVA=";
     };
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
diff --git a/pkgs/by-name/si/signal-desktop/dont-strip-absolute-paths.patch b/pkgs/by-name/si/signal-desktop/dont-strip-absolute-paths.patch
index 103ee8af45b6..ddbc406aa7cc 100644
--- a/pkgs/by-name/si/signal-desktop/dont-strip-absolute-paths.patch
+++ b/pkgs/by-name/si/signal-desktop/dont-strip-absolute-paths.patch
@@ -1,14 +1,14 @@
 diff --git a/node/build_node_bridge.py b/node/build_node_bridge.py
-index c983fc3..2ab06dc 100755
---- a/node/build_node_bridge.py
-+++ b/node/build_node_bridge.py
-@@ -138,9 +138,6 @@ def main(args: Optional[List[str]] = None) -> int:
-     cargo_env['CARGO_PROFILE_RELEASE_LTO'] = 'thin'
-     # Enable ARMv8 cryptography acceleration when available
+index a2da3c8b..cb5d475f 100755
+--- i/node/build_node_bridge.py
++++ w/node/build_node_bridge.py
+@@ -154,9 +154,6 @@ def main(args: Optional[List[str]] = None) -> int:
      cargo_env['RUSTFLAGS'] += ' --cfg aes_armv8'
+     # Access tokio's unstable metrics
+     cargo_env['RUSTFLAGS'] += ' --cfg tokio_unstable'
 -    # Strip absolute paths
 -    for path in build_helpers.rust_paths_to_remap():
 -        cargo_env['RUSTFLAGS'] += f' --remap-path-prefix {path}='
- 
+
      # If set (below), will post-process the build library using this instead of just `cp`-ing it.
      objcopy = None
diff --git a/pkgs/by-name/si/signal-desktop/libsignal-node.nix b/pkgs/by-name/si/signal-desktop/libsignal-node.nix
index 326ea8906e86..599530664cb3 100644
--- a/pkgs/by-name/si/signal-desktop/libsignal-node.nix
+++ b/pkgs/by-name/si/signal-desktop/libsignal-node.nix
@@ -24,23 +24,23 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-node";
-  version = "0.81.1";
+  version = "0.83.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uhxfVFsoB+c1R5MUOgpJFm8ZD3vgU8BIn35QSfbEp5w=";
+    hash = "sha256-lSk9C2RIRsAlSUr8folhdHkHkpAfPM+vwJ/rZ6mys3Q=";
   };
 
-  cargoHash = "sha256-Q3GSeaW3YveLxLeJPpPXUVwlJ0QLRkAmRGSJetxKl4Y=";
+  cargoHash = "sha256-0P89+p0WlQaa48wpgsaapIhEzlAnWVPl9qD+jnBw9mM=";
 
   npmRoot = "node";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-npm-deps";
     inherit (finalAttrs) version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.npmRoot}";
-    hash = "sha256-6Mr3SJn4pO0p6PISXvEOhN9uPk1TIEU03ssclNUg2No=";
+    hash = "sha256-4sd8JVQfCC4dAkksICbb3e4JjNcgplOW26TyRkAFWp0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 27295d8335fb..e4f94e63f7c7 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -52,13 +52,13 @@ let
     '';
   });
 
-  version = "7.73.0";
+  version = "7.75.1";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-5cwGV0WPOS7O/xnQZ38t/hiQppqFFtVQmGuniGsD6H8=";
+    hash = "sha256-l5fMVXwuXHaGcBuemkwzUcEuktTseGL2k13oxoo81+0=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -69,7 +69,7 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname src version;
       fetcherVersion = 1;
-      hash = "sha256-cT7Ixl/V/mesPHvJUsG63Y/wXwKjbjkjdjP3S7uEOa0=";
+      hash = "sha256-WUwclz7dJl+s5zRjWu/HTJ5eZroAFA6vR8mZzwib6Po=";
     };
 
     strictDeps = true;
@@ -134,15 +134,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetcherVersion = 1;
     hash =
       if withAppleEmojis then
-        "sha256-9YvNs925xBUYEpF429rHfMXIGPapVYd8j1jZa/yBuhA="
+        "sha256-b13di3TdaS6CT8gAZfBqlu4WheIHL+X8LvAo148H8kI="
       else
-        "sha256-lcr8EeL+wd6VihKcBgfXNRny8VskX8g7I7WTAkLuBss=";
+        "sha256-/Yy9R+MRN5e5vGU0XgwJa7oFpHn8bi8B0y89aaT2LQI=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1759413120;
+    SOURCE_DATE_EPOCH = 1760633959;
   };
 
   preBuild = ''
@@ -218,12 +218,10 @@ stdenv.mkDerivation (finalAttrs: {
       install -Dm644 $icon $out/share/icons/hicolor/`basename ''${icon%.png}`/apps/signal-desktop.png
     done
 
-    # TODO: Remove --ozone-platform=wayland after next electron update,
-    # see https://github.com/electron/electron/pull/48309
     makeWrapper '${lib.getExe electron}' "$out/bin/signal-desktop" \
       --add-flags "$out/share/signal-desktop/app.asar" \
       --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     runHook postInstall
diff --git a/pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch b/pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch
index 5d235dc80041..4f7f0bebcf26 100644
--- a/pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch
+++ b/pkgs/by-name/si/signal-desktop/replace-apple-emoji-with-noto-emoji.patch
@@ -49,11 +49,11 @@ diff --git a/package.json b/package.json
 index 5755fec..86125ba 100644
 --- a/package.json
 +++ b/package.json
-@@ -137,7 +137,6 @@
+@@ -154,7 +154,6 @@
      "dashdash": "2.0.0",
      "direction": "1.0.4",
-     "emoji-datasource": "15.1.2",
--    "emoji-datasource-apple": "15.1.2",
+     "emoji-datasource": "16.0.0",
+-    "emoji-datasource-apple": "16.0.0",
      "emoji-regex": "10.4.0",
      "encoding": "0.1.13",
      "fabric": "4.6.0",
@@ -64,46 +64,46 @@ index 5755fec..86125ba 100644
 -}
 +}
 \ No newline at end of file
-diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index f04b2b1..070fa0f 100644
---- a/pnpm-lock.yaml
-+++ b/pnpm-lock.yaml
-@@ -184,9 +184,6 @@ importers:
+diff --git i/pnpm-lock.yaml w/pnpm-lock.yaml
+index b162101a8..82ee9d67e 100644
+--- i/pnpm-lock.yaml
++++ w/pnpm-lock.yaml
+@@ -197,9 +197,6 @@ importers:
        emoji-datasource:
-         specifier: 15.1.2
-         version: 15.1.2
+         specifier: 16.0.0
+         version: 16.0.0
 -      emoji-datasource-apple:
--        specifier: 15.1.2
--        version: 15.1.2
+-        specifier: 16.0.0
+-        version: 16.0.0
        emoji-regex:
          specifier: 10.4.0
          version: 10.4.0
-@@ -4817,9 +4814,6 @@ packages:
+@@ -5814,9 +5811,6 @@ packages:
      resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==}
      engines: {node: '>=12'}
- 
--  emoji-datasource-apple@15.1.2:
--    resolution: {integrity: sha512-32UZTK36x4DlvgD1smkmBlKmmJH7qUr5Qut4U/on2uQLGqNXGbZiheq6/LEA8xRQEUrmNrGEy25wpEI6wvYmTg==}
+
+-  emoji-datasource-apple@16.0.0:
+-    resolution: {integrity: sha512-dVYjsK0FnCry9F+PBtnivhG2K0xdwlmqYaSgiUtztUdAGPYiHYhZcVKvNBqC791g2qyEcFNTBO6utg4eQ3uLTw==}
 -
-   emoji-datasource@15.1.2:
-     resolution: {integrity: sha512-tXAqGsrDVhgCRpFePtaD9P4Z8Ro2SUQSL/4MIJBG0SxqQJaMslEbin8J53OaFwEBu6e7JxFaIF6s4mw9+8acAQ==}
- 
-@@ -14990,8 +14984,6 @@ snapshots:
- 
+   emoji-datasource@16.0.0:
+     resolution: {integrity: sha512-/qHKqK5Nr3+8zhgO6kHmF43Fm5C8HNn0AaFRIpgw8HF3+uF0Vfc8jgLI1ZQS5ba1vBzksS8NBCjHejwLb2D/Sg==}
+
+@@ -17037,8 +17031,6 @@ snapshots:
+
    emittery@0.13.1: {}
- 
--  emoji-datasource-apple@15.1.2: {}
+
+-  emoji-datasource-apple@16.0.0: {}
 -
-   emoji-datasource@15.1.2: {}
- 
+   emoji-datasource@16.0.0: {}
+
    emoji-regex@10.4.0: {}
 diff --git a/stylesheets/components/fun/FunEmoji.scss b/stylesheets/components/fun/FunEmoji.scss
-index 78c7563..83d196c 100644
---- a/stylesheets/components/fun/FunEmoji.scss
-+++ b/stylesheets/components/fun/FunEmoji.scss
+index ea029fd5b..0e3563b4f 100644
+--- i/stylesheets/components/fun/FunEmoji.scss
++++ w/stylesheets/components/fun/FunEmoji.scss
 @@ -5,19 +5,9 @@
  $emoji-sprite-sheet-grid-item-count: 62;
- 
+
  @mixin emoji-sprite($sheet, $margin, $scale) {
 -  $size: calc($sheet * 1px * $scale);
 -  $margin-start: calc($margin * $scale);
@@ -123,16 +123,22 @@ index 78c7563..83d196c 100644
 +  background-position: center;
    background-repeat: no-repeat;
  }
- 
+
 diff --git a/ts/components/fun/FunEmoji.tsx b/ts/components/fun/FunEmoji.tsx
-index 08785e8..d25b868 100644
+index ddb30bf6d..5fc39339b 100644
 --- a/ts/components/fun/FunEmoji.tsx
 +++ b/ts/components/fun/FunEmoji.tsx
-@@ -10,7 +10,14 @@ export const FUN_STATIC_EMOJI_CLASS = 'FunStaticEmoji';
- export const FUN_INLINE_EMOJI_CLASS = 'FunInlineEmoji';
- 
- function getEmojiJumboUrl(emoji: EmojiVariantData): string {
--  return `emoji://jumbo?emoji=${encodeURIComponent(emoji.value)}`;
+@@ -20,13 +20,14 @@ function getEmojiJumboBackground(
+   emoji: EmojiVariantData,
+   size: number | undefined
+ ): string | null {
+-  if (size != null && size < MIN_JUMBOMOJI_SIZE) {
+-    return null;
+-  }
+-  if (KNOWN_JUMBOMOJI.has(emoji.value)) {
+-    return `url(emoji://jumbo?emoji=${encodeURIComponent(emoji.value)})`;
+-  }
+-  return null;
 +  const emojiToNotoName = (emoji: string): string =>
 +    `emoji_u${
 +      [...emoji]
@@ -140,7 +146,7 @@ index 08785e8..d25b868 100644
 +        .map(c => c.codePointAt(0)?.toString(16).padStart(4, "0"))
 +        .join("_")
 +    }.png`;
-+  return `file://@noto-emoji-pngs@/${emojiToNotoName(emoji.value)}`;
++  return `url(file://@noto-emoji-pngs@/${emojiToNotoName(emoji.value)})`;
  }
  
  export type FunStaticEmojiSize =
diff --git a/pkgs/by-name/si/signal-desktop/ringrtc.nix b/pkgs/by-name/si/signal-desktop/ringrtc.nix
index b1cf5cbe4644..bd81befd9330 100644
--- a/pkgs/by-name/si/signal-desktop/ringrtc.nix
+++ b/pkgs/by-name/si/signal-desktop/ringrtc.nix
@@ -19,16 +19,21 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ringrtc";
-  version = "2.58.1";
+  version = "2.59.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "ringrtc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HI+HVDv+nuJp2BPIAVY+PI6Pof1pnB8L6CIAgBT+tJA=";
+    hash = "sha256-zgDXkkKJrcD357DxbPq/sL/c4AG8xyMPY5IpcBtvATY=";
   };
 
-  cargoHash = "sha256-n+1pe202U2lljisSRBWeVvuBLyp7jhXG+ovDDi5WV8Q=";
+  cargoHash = "sha256-uwMNJ+PQa/Q7XZ9QONo+vm2wMqGwOEB97Kl/RFQkdhU=";
+
+  preConfigure = ''
+    # Check for matching webrtc version
+    grep 'webrtc.version=${webrtc.version}' config/version.properties
+  '';
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/si/signal-desktop/webrtc-sources.json b/pkgs/by-name/si/signal-desktop/webrtc-sources.json
index d9b28f488ad7..80abcfd66ea1 100644
--- a/pkgs/by-name/si/signal-desktop/webrtc-sources.json
+++ b/pkgs/by-name/si/signal-desktop/webrtc-sources.json
@@ -1,33 +1,25 @@
 {
     "src": {
         "args": {
-            "hash": "sha256-Qj0UFRWfZrBG9WUX4zkyiatIekNSYXsneP5aLvufNh4=",
+            "hash": "sha256-mNj4Sw7EROc2Cn4nPSm789h1je7EOjNAg2s6fQ19Dcc=",
             "owner": "signalapp",
             "repo": "webrtc",
-            "tag": "7204c"
+            "tag": "7339c"
         },
         "fetcher": "fetchFromGitHub"
     },
-    "src/base": {
-        "args": {
-            "hash": "sha256-wKFvb28LeB7/YVGmWKhcvXCEeNB6HaxMgZJLpC5a1Zk=",
-            "rev": "4ba67f727a84a10e32a417dc7e194f4fc6a23390",
-            "url": "https://chromium.googlesource.com/chromium/src/base"
-        },
-        "fetcher": "fetchFromGitiles"
-    },
     "src/build": {
         "args": {
-            "hash": "sha256-Bfd3paXVGon4p85V2UO6vEHG/t1g8EAxvYQ+DdPcuI8=",
-            "rev": "7adbc7e3263f3ab427ba7c5ac7839a69082ff7fb",
+            "hash": "sha256-BFKseH/tEQcQ1UF2YPBcfMLY54qBmM7OboC15NFO9e0=",
+            "rev": "66d076c7ab192991f67891b062b35404f3cb0739",
             "url": "https://chromium.googlesource.com/chromium/src/build"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/buildtools": {
         "args": {
-            "hash": "sha256-adtGyo+wm8+keR0um1fOdChABdBYboGBawD0LfcY00w=",
-            "rev": "1fc7350e65e9d7848c083b83aaf67611e74a5654",
+            "hash": "sha256-c1I0yBRDb9JUkywmJJy0IZp802qJRsoQV72ydinzxVs=",
+            "rev": "0c4bbb0f8a874de0a2a15d196031c7303d04fbb3",
             "url": "https://chromium.googlesource.com/chromium/src/buildtools"
         },
         "fetcher": "fetchFromGitiles"
@@ -43,40 +35,40 @@
     },
     "src/testing": {
         "args": {
-            "hash": "sha256-CQg6fxDz0dk4fD+X53stTwJJ25feYoU9KdsgjTAzbp8=",
-            "rev": "44b0a8d794b28dbd74614e5f5e7da2b407030647",
+            "hash": "sha256-PkTTET3CB1pQLipi0e6m+fVhf7S3MSEqiYeLFg9Pbjs=",
+            "rev": "305de9533d3ee2840af0b3f2c8ed0b32802b0a5d",
             "url": "https://chromium.googlesource.com/chromium/src/testing"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party": {
         "args": {
-            "hash": "sha256-KfIQS+FrzFDAS0B3yfzPj4PqD16H0dBE6z1JgFag/20=",
-            "rev": "8a150db896356cd9b47f8c1a6d916347393f90f2",
+            "hash": "sha256-P0fhs0vabiD7+C2ILX6gE62RKXfXbLmHRjbWLpqY48g=",
+            "rev": "e30091e8987ee0bb0cd30bc467250a96a7614762",
             "url": "https://chromium.googlesource.com/chromium/src/third_party"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/boringssl/src": {
         "args": {
-            "hash": "sha256-+Gs+efB1ZizjMYRSRTQrMDPZsDC+dgNJ9+yHXkzm/ZM=",
-            "rev": "9295969e1dad2c31d0d99481734c1c68dcbc6403",
+            "hash": "sha256-bpsZTEQ2/TE7xxhOtDz5PKzkOClImHtCTgOaINzg8Vk=",
+            "rev": "ddb2ca4b48fca9a1c468d83dc513b837331843ac",
             "url": "https://boringssl.googlesource.com/boringssl.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/breakpad/breakpad": {
         "args": {
-            "hash": "sha256-+Z7KphmQYCeN0aJkqyMrJ4tIi3BhqN16KoPNLb/bMGo=",
-            "rev": "2625edb085169e92cf036c236ac79ab594a7b1cc",
+            "hash": "sha256-8OfbSe+ly/5FFYk8NubAV39ACMr5S4wbLBVdiQHWeok=",
+            "rev": "ff252ff6faf5e3a52dc4955aab0d84831697dc94",
             "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/catapult": {
         "args": {
-            "hash": "sha256-xHe9WoAq1FElMSnu5mlEzrH+EzKiwWXeXMCH69KL5a0=",
-            "rev": "5477c6dfde1132b685c73edc16e1bc71449a691d",
+            "hash": "sha256-khxdFV6fxbTazz195MlxktLlihXytpNYCykLrI8nftM=",
+            "rev": "0fd1415f0cf3219ba097d37336141897fab7c5e9",
             "url": "https://chromium.googlesource.com/catapult.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -107,8 +99,8 @@
     },
     "src/third_party/compiler-rt/src": {
         "args": {
-            "hash": "sha256-FVdcKGwRuno3AzS6FUvI8OTj3mBMRfFR2A8GzYcwIU4=",
-            "rev": "57196dd146582915c955f6d388e31aea93220c51",
+            "hash": "sha256-TANkUmIqP+MirWFmegENuJEFK+Ve/o0A0azuxTzeAo8=",
+            "rev": "dc425afb37a69b60c8c02fef815af29e91b61773",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -123,24 +115,24 @@
     },
     "src/third_party/dav1d/libdav1d": {
         "args": {
-            "hash": "sha256-+DY4p41VuAlx7NvOfXjWzgEhvtpebjkjbFwSYOzSjv4=",
-            "rev": "8d956180934f16244bdb58b39175824775125e55",
+            "hash": "sha256-2J4M6EkfVtPLUpRWwzXdLkvJio4gskC0ihZnM5H3qYc=",
+            "rev": "716164239ad6e6b11c5dcdaa3fb540309d499833",
             "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/depot_tools": {
         "args": {
-            "hash": "sha256-1avxBlK0WLHTru5wUecbiGpSEYv8Epobsl4EfCaWX9A=",
-            "rev": "a8900cc0f023d6a662eb66b317e8ddceeb113490",
+            "hash": "sha256-+jbfCtruv6MR+A/uzw5WaSj2u92W6bB/vmLBCzL39mM=",
+            "rev": "d85491b0a1dcb82dd8e124a876ecd7e3d50dc5e8",
             "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/ffmpeg": {
         "args": {
-            "hash": "sha256-noc3iZ1yCEgkwWyznx48rXC8JuKxla9QgC/CIjRL/y8=",
-            "rev": "dcdd0fa51b65a0b1688ff6b8f0cc81908f09ded2",
+            "hash": "sha256-c5w8CuyE1J0g79lrNq1stdqc1JaAkMbtscdcywmAEMY=",
+            "rev": "d2d06b12c22d27af58114e779270521074ff1f85",
             "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -155,24 +147,24 @@
     },
     "src/third_party/fontconfig/src": {
         "args": {
-            "hash": "sha256-Kz7KY+evfOciKFHIBLG1JxIRgHRTzuBLgxXHv3m/Y1Y=",
-            "rev": "8cf0ce700a8abe0d97ace4bf7efc7f9534b729ba",
+            "hash": "sha256-6HLV0U/MA1XprKJ70TKvwUBdkGQPwgqP4Oj5dINsKp0=",
+            "rev": "86b48ec01ece451d5270d0c5181a43151e45a042",
             "url": "https://chromium.googlesource.com/external/fontconfig.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/freetype/src": {
         "args": {
-            "hash": "sha256-Mt6uJGGHiGYNNLx2xrooYirynL9DW0s05G1GJiqzhi8=",
-            "rev": "e07e56c7f106b600262ab653d696b7b57f320127",
+            "hash": "sha256-oiezGGrPlHVGi24IpLr6UfUs7gT+Epzw37TtAkEixek=",
+            "rev": "08805be530d6820d2bf8a1b7685826de40f06812",
             "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/fuzztest/src": {
         "args": {
-            "hash": "sha256-MHli8sadgC3OMesBGhkjPM/yW49KFOtdFuBII1bcFas=",
-            "rev": "f03aafb7516050ea73f617bf969f03eac641aefc",
+            "hash": "sha256-uWPhInzuidI4smFRjRF95aaVNTsehKd/1y4uRzr12mk=",
+            "rev": "7bab06ff5fbbf8b8cce05a8661369dc2e11cde66",
             "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -187,24 +179,24 @@
     },
     "src/third_party/googletest/src": {
         "args": {
-            "hash": "sha256-md/jPkFrs/0p0BYGyquh57Zxh+1dKaK26PDtUN1+Ce0=",
-            "rev": "09ffd0015395354774c059a17d9f5bee36177ff9",
+            "hash": "sha256-07pEo2gj3n/IOipqz7UpZkBOywZt7FkfZFCnVyp3xYw=",
+            "rev": "373af2e3df71599b87a40ce0e37164523849166b",
             "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/grpc/src": {
         "args": {
-            "hash": "sha256-z96goSSgBUvTjNse/LO88zNIzg+SWEYgVDaoA/elkLU=",
-            "rev": "cadf3c8329377e93b1f5e2d6a43d91f7a4becc28",
+            "hash": "sha256-5vv8V/hEKalfHa2Qo8QIxLvXoamcLxNQ/bcqY8vCvjk=",
+            "rev": "806e186735cc3bf4375f43d2d6a9483c607e4278",
             "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/gtest-parallel": {
         "args": {
-            "hash": "sha256-VUuk5tBTh+aU2dxVWUF1FePWlKUJaWSiGSXk/J5zgHw=",
-            "rev": "96f4f904922f9bf66689e749c40f314845baaac8",
+            "hash": "sha256-uVq+oDrue4sf1JPoeymIIDe79Fv7rcJAVOjxUF42Xo0=",
+            "rev": "cd488bdedc1d2cffb98201a17afc1b298b0b90f1",
             "url": "https://chromium.googlesource.com/external/github.com/google/gtest-parallel"
         },
         "fetcher": "fetchFromGitiles"
@@ -219,8 +211,8 @@
     },
     "src/third_party/icu": {
         "args": {
-            "hash": "sha256-/T7uyzwTCDaamLwSvutvbn6BJuoG1RqeR+xhXI5jmJw=",
-            "rev": "b929596baebf0ab4ac7ec07f38365db4c50a559d",
+            "hash": "sha256-k3z31DhDPoqjcZdUL4vjyUMVpUiNk44+7rCMTDVPH8Q=",
+            "rev": "1b2e3e8a421efae36141a7b932b41e315b089af8",
             "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -243,32 +235,32 @@
     },
     "src/third_party/libFuzzer/src": {
         "args": {
-            "hash": "sha256-Lb+HczYax0T7qvC0/Nwhc5l2szQTUYDouWRMD/Qz7sA=",
-            "rev": "e31b99917861f891308269c36a32363b120126bb",
+            "hash": "sha256-TDi1OvYClJKmEDikanKVTmy8uxUXJ95nuVKo5u+uFPM=",
+            "rev": "bea408a6e01f0f7e6c82a43121fe3af4506c932e",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libaom/source/libaom": {
         "args": {
-            "hash": "sha256-pyLKjLG83Jlx6I+0M8Ah94ku4NIFcrHNYswfVHMvdrc=",
-            "rev": "2cca4aba034f99842c2e6cdc173f83801d289764",
+            "hash": "sha256-cER77Q9cM5rh+oeh1LDyKDZyQK5VbtE/ANNTN2cYzMo=",
+            "rev": "e91b7aa26d6d0979bba2bee5e1c27a7a695e0226",
             "url": "https://aomedia.googlesource.com/aom.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libc++/src": {
         "args": {
-            "hash": "sha256-36ulJk/YTfP5k1sDeA/WQyIO8xaplRKK4cQhfTZdpko=",
-            "rev": "a01c02c9d4acbdae3b7e8a2f3ee58579a9c29f96",
+            "hash": "sha256-34+xTZqWpm+1aks2b4nPD3WRJTkTxNj6ZjTuMveiQ+M=",
+            "rev": "adbb4a5210ae2a8a4e27fa6199221156c02a9b1a",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libc++abi/src": {
         "args": {
-            "hash": "sha256-DkCvfFjMztFTzKf081XyiefW6tMBSZ1AdzcPzXAVPnk=",
-            "rev": "9810fb23f6ba666f017c2b67c67de2bcac2b44bd",
+            "hash": "sha256-wO64dyP1O3mCBh/iiRkSzaWMkiDkb7B98Avd4SpnY70=",
+            "rev": "a6c815c69d55ec59d020abde636754d120b402ad",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -291,32 +283,32 @@
     },
     "src/third_party/libunwind/src": {
         "args": {
-            "hash": "sha256-O1S3ijnoVrTHmZDGmgQQe0MVGsSZL7usXAPflGFmMXY=",
-            "rev": "8575f4ae4fcf8892938bd9766cf1a5c90a0ed04e",
+            "hash": "sha256-GmLreEtoyHMXr6mZgZ7NS1ZaS9leB9eMbISeN7qmfqw=",
+            "rev": "84c5262b57147e9934c0a8f2302d989b44ec7093",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libvpx/source/libvpx": {
         "args": {
-            "hash": "sha256-SFdYF8vnwNHQbZ1N/ZHr4kxfi9o+BAtuqbak80m9uP4=",
-            "rev": "b84ca9b63730e7d4563573a56a66317eb0087ebf",
+            "hash": "sha256-BbXiBbnGwdsbZCZIpurfTzYvDUCysdt+ocRh6xvuUI8=",
+            "rev": "a985e5e847a2fe69bef3e547cf25088132194e39",
             "url": "https://chromium.googlesource.com/webm/libvpx.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libyuv": {
         "args": {
-            "hash": "sha256-J9Wi3aCc6OjtQCP8JnrY7PYrY587dKLaa1KGAMWmE0c=",
-            "rev": "61bdaee13a701d2b52c6dc943ccc5c888077a591",
+            "hash": "sha256-ievGlutmOuuEEhWS82vMqxwqXCq8PF3508N0MCMPQus=",
+            "rev": "cdd3bae84818e78466fec1ce954eead8f403d10c",
             "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/llvm-libc/src": {
         "args": {
-            "hash": "sha256-BsoHIvdqgYzBUkd23++enEHIhq5GeVWrWdVdhXrHh9A=",
-            "rev": "9c3ae3120fe83b998d0498dcc9ad3a56c29fad0c",
+            "hash": "sha256-MgOyCveySgpUoIj6jJGbDjzMVpPDbeKtvpFUC+ocdsY=",
+            "rev": "8ec6b26421b5fa7aa876fdab486fa1decc558326",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -331,8 +323,8 @@
     },
     "src/third_party/nasm": {
         "args": {
-            "hash": "sha256-neYrS4kQ76ihUh22Q3uPR67Ld8+yerA922YSZU1KxJs=",
-            "rev": "9f916e90e6fc34ec302573f6ce147e43e33d68ca",
+            "hash": "sha256-TxzAcp+CoKnnM0lCGjm+L3h6M30vYHjM07vW6zUe/vY=",
+            "rev": "e2c93c34982b286b27ce8b56dd7159e0b90869a2",
             "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -347,8 +339,8 @@
     },
     "src/third_party/perfetto": {
         "args": {
-            "hash": "sha256-kzVsti2tygOMgT61TmCz26AByMd3gIXA6xz8RE0iCz4=",
-            "rev": "dd35b295cd359ba094404218414955f961a0d6ae",
+            "hash": "sha256-JwoqF2VWrkwcokaGY6bo73YJWtO7lDnvOqFCBmIEBXY=",
+            "rev": "0c893ed6bf6b42e3fee58daf3380d301c72550ed",
             "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -363,16 +355,16 @@
     },
     "src/third_party/re2/src": {
         "args": {
-            "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis=",
-            "rev": "c84a140c93352cdabbfb547c531be34515b12228",
+            "hash": "sha256-vjh4HI4JKCMAf5SZeqstb0M01w8ssaTwwrLAUsrFkkQ=",
+            "rev": "8451125897dd7816a5c118925e8e42309d598ecc",
             "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/tools": {
         "args": {
-            "hash": "sha256-j95oiK5+hhKC+NNQ27EVZugZI/n2QZJNRyz2QE4pVXc=",
-            "rev": "901b847deda65d44f1bba16a9f47e2ea68a805be",
+            "hash": "sha256-9CYGP9LI/fSHUAjqvXxyNZZVwxkr5TdEZME4l/7fizM=",
+            "rev": "ec8f1c6113753a31c55b6d6bddfbe198046029a8",
             "url": "https://chromium.googlesource.com/chromium/src/tools"
         },
         "fetcher": "fetchFromGitiles"
diff --git a/pkgs/by-name/si/signal-desktop/webrtc.nix b/pkgs/by-name/si/signal-desktop/webrtc.nix
index 2e586d52cbf7..b0f3968145b0 100644
--- a/pkgs/by-name/si/signal-desktop/webrtc.nix
+++ b/pkgs/by-name/si/signal-desktop/webrtc.nix
@@ -34,7 +34,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "signal-webrtc";
-  version = finalAttrs.gclientDeps."src".path.rev;
+  version = finalAttrs.gclientDeps."src".path.tag;
 
   gclientDeps = gclient2nix.importGclientDeps ./webrtc-sources.json;
   sourceRoot = "src";
@@ -87,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
     "is_clang=false"
     "treat_warnings_as_errors=false"
     "use_llvm_libatomic=false"
+    "use_custom_libcxx=false"
 
     # https://github.com/signalapp/ringrtc/blob/main/bin/build-desktop
     "rtc_build_examples=false"
diff --git a/pkgs/by-name/so/sonobus/package.nix b/pkgs/by-name/so/sonobus/package.nix
index c3de44a3f59f..ccff9bc0cb01 100644
--- a/pkgs/by-name/so/sonobus/package.nix
+++ b/pkgs/by-name/so/sonobus/package.nix
@@ -17,8 +17,10 @@
   libopus,
   curl,
   gtk3,
+  nix-update-script,
+  copyDesktopItems,
+  makeDesktopItem,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "sonobus";
   version = "1.7.2";
@@ -31,10 +33,26 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  desktopItems = [
+    (makeDesktopItem {
+      type = "Application";
+      name = "sonobus";
+      desktopName = "Sonobus";
+      comment = "High-quality network audio streaming";
+      icon = "sonobus";
+      exec = "sonobus";
+      categories = [
+        "Audio"
+        "AudioVideo"
+      ];
+    })
+  ];
+
   nativeBuildInputs = [
     autoPatchelfHook
     cmake
     pkg-config
+    copyDesktopItems
   ];
 
   buildInputs = [
@@ -44,7 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     libopus
     curl
     gtk3
-    # webkitgtk_4_0
   ];
 
   runtimeDependencies = [
@@ -71,17 +88,23 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
     cd ../linux
     ./install.sh "$out"
+
+    install -Dm444 $src/images/sonobus_logo_96.png $out/share/pixmaps/sonobus.png
+
     runHook postInstall
   '';
 
-  meta = with lib; {
-    # webkitgtk_4_0 was removed
-    broken = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "High-quality network audio streaming";
     homepage = "https://sonobus.net/";
-    license = with licenses; [ gpl3Plus ];
-    maintainers = with maintainers; [ PowerUser64 ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      PowerUser64
+      l1npengtul
+    ];
+    platforms = lib.platforms.unix;
     mainProgram = "sonobus";
   };
 })
diff --git a/pkgs/by-name/ur/urn-timer/package.nix b/pkgs/by-name/ur/urn-timer/package.nix
index c56e8686fa98..f8e23e4da99a 100644
--- a/pkgs/by-name/ur/urn-timer/package.nix
+++ b/pkgs/by-name/ur/urn-timer/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "urn-timer";
-  version = "0-unstable-2025-08-07";
+  version = "0-unstable-2025-10-18";
 
   src = fetchFromGitHub {
     owner = "paoloose";
     repo = "urn";
-    rev = "7acdab69eaec05f173d95eff190e5d7a03db8847";
-    hash = "sha256-jFatHlkQr6O9E2pKroFWk6F2BccnfSr1pq43Q5qQbC4=";
+    rev = "cae0763f7d5c0d895faf6d2ab7448d1b05b60dff";
+    hash = "sha256-jG+Xibdsu53/aycUf/TzsQtegGY/buwswJ9ediZIJ4w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 89eb02b392a5..5aade7dcf8d3 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -101,7 +101,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.208.6";
+  version = "0.209.5";
 
   outputs = [
     "out"
@@ -114,7 +114,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EzfeLSalC4pTtaiDWXYib5jDDKGVZ+PzFjgMjIGrUDg=";
+    hash = "sha256-p5qKbNPf7j4HiYv+Ej7df131z8xL09egbyOUwIkYC5Q=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-PxreCKshDvzLQzPvNpGyNz3jOPIDiz7JHy/9nEujnKg=";
+  cargoHash = "sha256-6LBBa6CDLrEkyazZuqDj2wj41KQnhp3NRw5AlaUtxj0=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/desktops/lxqt/libfm-qt/default.nix b/pkgs/desktops/lxqt/libfm-qt/default.nix
index 74a5afc95c60..222b4e839514 100644
--- a/pkgs/desktops/lxqt/libfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/libfm-qt/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   libXdmcp,
   libexif,
@@ -19,22 +20,32 @@
   qtx11extras ? null,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libfm-qt";
   inherit version;
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "libfm-qt";
-    rev = version;
+    tag = finalAttrs.version;
     hash =
       {
         "1.4.0" = "sha256-QxPYSA7537K+/dRTxIYyg+Q/kj75rZOdzlUsmSdQcn4=";
         "2.2.0" = "sha256-xLXHwrcMJ8PObZ2qWVZTf9FREcjUi5qtcCJgNHj391Q=";
       }
-      ."${version}";
+      ."${finalAttrs.version}";
   };
 
+  patches = lib.optionals (finalAttrs.version == "2.2.0") [
+    # fix build against Qt >= 6.10 (https://github.com/lxqt/libfm-qt/pull/1060)
+    # TODO: drop when upgrading beyond version 2.2.0
+    (fetchpatch {
+      name = "cmake-fix-build-with-Qt-6.10.patch";
+      url = "https://github.com/lxqt/libfm-qt/commit/3bcbae5831f5ce3d2f06dc370f0c2ad0026ae82a.patch";
+      hash = "sha256-nTuPXlkP7AzC8R4OHfQx6/kxPsDjaw7tGzQGyiYqQSQ=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -52,15 +63,15 @@ stdenv.mkDerivation rec {
     lxqt-menu-data
     menu-cache
   ]
-  ++ (lib.optionals (lib.versionAtLeast "2.0.0" version) [ qtx11extras ]);
+  ++ (lib.optionals (lib.versionAtLeast "2.0.0" finalAttrs.version) [ qtx11extras ]);
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/lxqt/libfm-qt";
     description = "Core library of PCManFM-Qt (Qt binding for libfm)";
-    license = licenses.lgpl21Plus;
-    platforms = with platforms; unix;
-    teams = [ teams.lxqt ];
+    license = lib.licenses.lgpl21Plus;
+    platforms = lib.platforms.unix;
+    teams = [ lib.teams.lxqt ];
   };
-}
+})
diff --git a/pkgs/desktops/lxqt/libqtxdg/default.nix b/pkgs/desktops/lxqt/libqtxdg/default.nix
index 3ea0a857efe8..b5b23b1569a8 100644
--- a/pkgs/desktops/lxqt/libqtxdg/default.nix
+++ b/pkgs/desktops/lxqt/libqtxdg/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   qtbase,
   qtsvg,
@@ -11,22 +12,32 @@
   version ? "4.2.0",
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libqtxdg";
   inherit version;
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "libqtxdg";
-    rev = version;
+    tag = finalAttrs.version;
     hash =
       {
         "3.12.0" = "sha256-y+3noaHubZnwUUs8vbMVvZPk+6Fhv37QXUb//reedCU=";
         "4.2.0" = "sha256-TSyVYlWsmB/6gxJo+CjROBQaWsmYZAwkM8BwiWP+XBI=";
       }
-      ."${version}";
+      ."${finalAttrs.version}";
   };
 
+  patches = lib.optionals (finalAttrs.version == "4.2.0") [
+    # fix build against Qt >= 6.10 (https://github.com/lxqt/libqtxdg/pull/313)
+    # TODO: drop when upgrading beyond version 4.2.0
+    (fetchpatch {
+      name = "cmake-fix-build-with-Qt-6.10.patch";
+      url = "https://github.com/lxqt/libqtxdg/commit/b01a024921acdfd5b0e97d5fda2933c726826e99.patch";
+      hash = "sha256-njpn6pU9BHlfYfkw/jEwh8w3Wo1F8MlRU8iQB+Tz2zU=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
@@ -48,11 +59,11 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/lxqt/libqtxdg";
     description = "Qt implementation of freedesktop.org xdg specs";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
-    teams = [ teams.lxqt ];
+    license = lib.licenses.lgpl21Plus;
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.lxqt ];
   };
-}
+})
diff --git a/pkgs/desktops/lxqt/lxqt-panel/default.nix b/pkgs/desktops/lxqt/lxqt-panel/default.nix
index 957287946690..b5893196071a 100644
--- a/pkgs/desktops/lxqt/lxqt-panel/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-panel/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   pkg-config,
   alsa-lib,
@@ -33,17 +34,27 @@
   gitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lxqt-panel";
   version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "lxqt-panel";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-ui+HD2igPiyIOgIKPbgfO4dnfm2rFP/R6oG2pH5g5VY=";
   };
 
+  patches = [
+    # fix build against Qt >= 6.10 (https://github.com/lxqt/lxqt-panel/pull/2306)
+    # TODO: drop when upgrading beyond version 2.2.2
+    (fetchpatch {
+      name = "cmake-fix-build-with-Qt-6.10.patch";
+      url = "https://github.com/lxqt/lxqt-panel/commit/fce8cd99a1de0e637e8539c4d8ac68832a40fa6d.patch";
+      hash = "sha256-KXxV6SZqdpvZSn+zbBZ32Qs6XKfFXEej1F4qBt+MzxA=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -80,12 +91,12 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/lxqt/lxqt-panel";
     description = "LXQt desktop panel";
     mainProgram = "lxqt-panel";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
-    teams = [ teams.lxqt ];
+    license = lib.licenses.lgpl21Plus;
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.lxqt ];
   };
-}
+})
diff --git a/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix b/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
index 8f11a11dbb96..db6a8b2ae8bb 100644
--- a/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-qtplugin/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   libdbusmenu-lxqt,
   libfm-qt,
@@ -14,17 +15,27 @@
   wrapQtAppsHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lxqt-qtplugin";
   version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "lxqt-qtplugin";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-qXadz9JBk4TURAWj6ByP/lGV1u0Z6rNJ/VraBh5zY+Q=";
   };
 
+  patches = [
+    # fix build against Qt >= 6.10 (https://github.com/lxqt/lxqt-qtplugin/pull/100)
+    # TODO: drop when upgrading beyond version 2.2.0
+    (fetchpatch {
+      name = "cmake-fix-build-with-Qt-6.10.patch";
+      url = "https://github.com/lxqt/lxqt-qtplugin/commit/90473945206dbf21816a00dfba27426a5b5a9e25.patch";
+      hash = "sha256-cCghOJHsveR5IYisEFv3h8WreRDi0kuyj/2YBD+ATsc=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
@@ -47,11 +58,11 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/lxqt/lxqt-qtplugin";
     description = "LXQt Qt platform integration plugin";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
-    teams = [ teams.lxqt ];
+    license = lib.licenses.lgpl21Plus;
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.lxqt ];
   };
-}
+})
diff --git a/pkgs/desktops/lxqt/screengrab/default.nix b/pkgs/desktops/lxqt/screengrab/default.nix
index f2ef16012680..e93d0afce933 100644
--- a/pkgs/desktops/lxqt/screengrab/default.nix
+++ b/pkgs/desktops/lxqt/screengrab/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   autoPatchelfHook,
   gitUpdater,
@@ -20,17 +21,27 @@
   wrapQtAppsHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "screengrab";
   version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "screengrab";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-6cGj3Ijv4DsAdJjcHKUg5et+yYc5miIHHZOTD2D9ASk=";
   };
 
+  patches = [
+    # fix build against Qt >= 6.10 (https://github.com/lxqt/screengrab/pull/434)
+    # TODO: drop when upgrading beyond version 3.0.0
+    (fetchpatch {
+      name = "cmake-fix-build-with-Qt-6.10.patch";
+      url = "https://github.com/lxqt/screengrab/commit/1621ef5df9461cdd1dcef3faee36e9419f1ca08c.patch";
+      hash = "sha256-+rpCDLnHmgy/1PME3QaN+978W+jR6PDmiZ/5hAx8Djg=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     lxqt-build-tools
@@ -54,12 +65,12 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/lxqt/screengrab";
     description = "Crossplatform tool for fast making screenshots";
     mainProgram = "screengrab";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    teams = [ teams.lxqt ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.lxqt ];
   };
-}
+})
diff --git a/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix b/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
index 52956cd0bc64..2836344f6ddc 100644
--- a/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
+++ b/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   kwindowsystem,
   libexif,
@@ -14,17 +15,27 @@
   extraQtStyles ? [ ],
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal-lxqt";
   version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "xdg-desktop-portal-lxqt";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-y3VqDuFagKcG8O5m5qjRGtlUZXfIXV0tclvZLChhWkg=";
   };
 
+  patches = [
+    # fix build against Qt >= 6.10 (https://github.com/lxqt/xdg-desktop-portal-lxqt/pull/50)
+    # TODO: drop when upgrading beyond version 1.2.0
+    (fetchpatch {
+      name = "cmake-fix-build-with-Qt-6.10.patch";
+      url = "https://github.com/lxqt/xdg-desktop-portal-lxqt/commit/15fae3c57a8e8149ef19a8c919f5728016390e3f.patch";
+      hash = "sha256-oReYMEr+tBDHtnFDZahBwTtzgtL/BABZO64yob9tem4=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     wrapQtAppsHook
@@ -42,11 +53,11 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/lxqt/xdg-desktop-portal-lxqt";
     description = "Backend implementation for xdg-desktop-portal that is using Qt/KF5/libfm-qt";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ romildo ];
+    license = lib.licenses.lgpl21Plus;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.romildo ];
   };
-}
+})
diff --git a/pkgs/development/libraries/science/chemistry/molequeue/default.nix b/pkgs/development/libraries/science/chemistry/molequeue/default.nix
index dba6e33b22e6..122214040a08 100644
--- a/pkgs/development/libraries/science/chemistry/molequeue/default.nix
+++ b/pkgs/development/libraries/science/chemistry/molequeue/default.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ qttools ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.3 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   # Fix the broken CMake files to use the correct paths
   postInstall = ''
     substituteInPlace $out/lib/cmake/molequeue/MoleQueueConfig.cmake \
diff --git a/pkgs/development/python-modules/async-modbus/default.nix b/pkgs/development/python-modules/async-modbus/default.nix
index dcc5a4247a6f..ce18fc2268f2 100644
--- a/pkgs/development/python-modules/async-modbus/default.nix
+++ b/pkgs/development/python-modules/async-modbus/default.nix
@@ -7,23 +7,20 @@
   pytest-asyncio,
   pytest-cov-stub,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
   umodbus,
 }:
 
 buildPythonPackage rec {
   pname = "async-modbus";
-  version = "0.2.2";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.7";
+  version = "0.2.3";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tiagocoutinho";
     repo = "async_modbus";
     tag = "v${version}";
-    hash = "sha256-xms2OfX5bHPXswwhLhyh6HFsm1YqDwKclUirxrgL4i0=";
+    hash = "sha256-d4TTs3TtD/9eFdzXBaY+QeAMeRWTvsWeaxONeG0AXJU=";
   };
 
   patches = [
@@ -39,9 +36,9 @@ buildPythonPackage rec {
       --replace '"--durations=2", "--verbose"' ""
   '';
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     connio
     umodbus
   ];
@@ -57,7 +54,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Modbus communication";
     homepage = "https://github.com/tiagocoutinho/async_modbus";
-    license = with licenses; [ gpl3Plus ];
+    changelog = "https://github.com/tiagocoutinho/async_modbus/releases/tag/${src.tag}";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/asyncer/default.nix b/pkgs/development/python-modules/asyncer/default.nix
index daa9524cf7ea..6047204329b7 100644
--- a/pkgs/development/python-modules/asyncer/default.nix
+++ b/pkgs/development/python-modules/asyncer/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "asyncer";
-  version = "0.0.9";
+  version = "0.0.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastapi";
     repo = "asyncer";
     tag = version;
-    hash = "sha256-1M5MGaxfEfJMCfAoGorNGbRBZdvLue5lHu8DuR96mLo=";
+    hash = "sha256-LjQOhcnCwM4Vcw+lBq6bexPYewRuhkU/R/pkDTEVHWQ=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 0ec58fa99c7a..e9f72aa92c71 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.40.55";
+  version = "1.40.56";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-oRra+OrHfE7Uwbe/ckGwzZrQI9wcF8SbRfNa30wht/8=";
+    hash = "sha256-5WRFI+/39Qut5en0okVEtA+EnpBRlJ41ASA6IGJ/QmM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 6d399c408e44..7857f852ee6d 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.40.55";
+  version = "1.40.56";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-V8iXiwu+QKn6Kf3lZN6KBGeaIj9DCpfQOtpi7BEiMa8=";
+    hash = "sha256-qpU1uKD3E1sGJQTjnny8g/s/ALLU3CurphcENrSUtpY=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/clarifai/default.nix b/pkgs/development/python-modules/clarifai/default.nix
index 0fcfba2485f5..df0b08508270 100644
--- a/pkgs/development/python-modules/clarifai/default.nix
+++ b/pkgs/development/python-modules/clarifai/default.nix
@@ -48,6 +48,7 @@ buildPythonPackage rec {
     "clarifai-protocol"
     "click"
     "fsspec"
+    "psutil"
     "ruff"
     "schema"
     "uv"
diff --git a/pkgs/development/python-modules/disposable-email-domains/default.nix b/pkgs/development/python-modules/disposable-email-domains/default.nix
index a991f326bd7f..267bad65f450 100644
--- a/pkgs/development/python-modules/disposable-email-domains/default.nix
+++ b/pkgs/development/python-modules/disposable-email-domains/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "disposable-email-domains";
-  version = "0.0.140";
+  version = "0.0.143";
   pyproject = true;
 
   # No tags on GitHub
   src = fetchPypi {
     pname = "disposable_email_domains";
     inherit version;
-    hash = "sha256-7BLx7zXb3JsdX8ty9wEfO4CW5zOxIrTyYW2C8k4ZkLg=";
+    hash = "sha256-AOQbmUHx6nQYnKzOlPSh+r/Fzn2r2CtsTGYswnJI05E=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fedora-messaging/default.nix b/pkgs/development/python-modules/fedora-messaging/default.nix
index 6e2af5d98c43..b6a10c0c5059 100644
--- a/pkgs/development/python-modules/fedora-messaging/default.nix
+++ b/pkgs/development/python-modules/fedora-messaging/default.nix
@@ -1,8 +1,13 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   poetry-core,
+
+  # dependencies
   blinker,
   click,
   crochet,
@@ -13,6 +18,8 @@
   service-identity,
   tomli,
   twisted,
+
+  # tests
   pytest-mock,
   pytest-twisted,
   pytestCheckHook,
@@ -55,6 +62,18 @@ buildPythonPackage rec {
 
   enabledTestPaths = [ "tests/unit" ];
 
+  disabledTests = [
+    # Broken since click was updated to 8.2.1 in https://github.com/NixOS/nixpkgs/pull/448189
+    # AssertionError
+    "test_no_conf"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # AttributeError: module 'errno' has no attribute 'EREMOTEIO'. Did you mean: 'EREMOTE'?
+    "test_publish_rejected_message"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "Library for sending AMQP messages with JSON schema in Fedora infrastructure";
     homepage = "https://github.com/fedora-infra/fedora-messaging";
diff --git a/pkgs/development/python-modules/google-cloud-os-config/default.nix b/pkgs/development/python-modules/google-cloud-os-config/default.nix
index 16fa3d531908..3bf88361e6cd 100644
--- a/pkgs/development/python-modules/google-cloud-os-config/default.nix
+++ b/pkgs/development/python-modules/google-cloud-os-config/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-os-config";
-  version = "1.21.0";
+  version = "1.22.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_os_config";
     inherit version;
-    hash = "sha256-NKdb/E9CO1Zp98kHcvqYNIr0L27C+ijQ1ulT3p58qSk=";
+    hash = "sha256-15oxD2+hznRwqqCExw443AXZhTH0aPghs6Um5NM6cOQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-webrisk/default.nix b/pkgs/development/python-modules/google-cloud-webrisk/default.nix
index ad6b545c1306..81a1af721fb0 100644
--- a/pkgs/development/python-modules/google-cloud-webrisk/default.nix
+++ b/pkgs/development/python-modules/google-cloud-webrisk/default.nix
@@ -9,21 +9,18 @@
   protobuf,
   pytest-asyncio,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-webrisk";
-  version = "1.18.1";
+  version = "1.19.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     pname = "google_cloud_webrisk";
     inherit version;
-    hash = "sha256-3OUxiDZtRfmipeyCW8in6+GkVnlilWgE8Hzr6G+1KQU=";
+    hash = "sha256-TuWU+3pfwFt8E06zUDAY8+JJb+2j4l/eHP7Y0dgE0gs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-workflows/default.nix b/pkgs/development/python-modules/google-cloud-workflows/default.nix
index 09c61243b19c..d54d22e75f9f 100644
--- a/pkgs/development/python-modules/google-cloud-workflows/default.nix
+++ b/pkgs/development/python-modules/google-cloud-workflows/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-workflows";
-  version = "1.18.2";
+  version = "1.19.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_workflows";
     inherit version;
-    hash = "sha256-S7k2QZv+EQyfZ6RjG+NA/+a9IBQpnMTE+TIbXlIC1N8=";
+    hash = "sha256-SODiguyX82EPPvm3wvRp7tAcArNINmc9c1+WkkKPNHE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/harlequin-postgres/default.nix b/pkgs/development/python-modules/harlequin-postgres/default.nix
index 28e59ce21a18..baa1d0d4b343 100644
--- a/pkgs/development/python-modules/harlequin-postgres/default.nix
+++ b/pkgs/development/python-modules/harlequin-postgres/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "harlequin-postgres";
-  version = "1.2.0";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "harlequin_postgres";
     inherit version;
-    hash = "sha256-9US0aaXP2F+UVM9pY43KpnB05KC0/uDxrpZAYOJ+RR0=";
+    hash = "sha256-u/x8Jx1yfUtFSYX6oyvOZJmdPWbaOkFn3OGQdqxyK8A=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index ae9b79cabbee..cda7504ab743 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -434,8 +434,8 @@ in
       "sha256-obbn0FjZQDwFucsnH3N1+zfe1aWFE5PWHUWiLAeupqA=";
 
   mypy-boto3-dynamodb =
-    buildMypyBoto3Package "dynamodb" "1.40.44"
-      "sha256-WPo6Y4scrvVkS2D1iU4RgqKVH+swo9xt7bNOGwyd7Zk=";
+    buildMypyBoto3Package "dynamodb" "1.40.56"
+      "sha256-V23RL+ESV1QGbn+kgPksEjIglwqdafdmOlbXAfKXisU=";
 
   mypy-boto3-dynamodbstreams =
     buildMypyBoto3Package "dynamodbstreams" "1.40.40"
@@ -498,8 +498,8 @@ in
       "sha256-TGc78KsQ4y8QSFutN+/cj/gr2iJWi7fYh52OYFCFwho=";
 
   mypy-boto3-emr =
-    buildMypyBoto3Package "emr" "1.40.0"
-      "sha256-crNaa6bqSP7fCsFV5CnAHazDpXrFkkb46ria2LWTDvY=";
+    buildMypyBoto3Package "emr" "1.40.56"
+      "sha256-Khke6Z4btoZe5VlLDLJEmwxDD3o/uOYImj/bUy92Wdc=";
 
   mypy-boto3-emr-containers =
     buildMypyBoto3Package "emr-containers" "1.40.29"
@@ -861,8 +861,8 @@ in
       "sha256-18sD6lfs5Y9BBp3j8c/TVjI/3KZbO6pKuYPYKir1NQY=";
 
   mypy-boto3-mediaconvert =
-    buildMypyBoto3Package "mediaconvert" "1.40.17"
-      "sha256-L2/TEQbnd60RuCaqpNI/xyQ76AqbIUe5KWwZtSf+2I8=";
+    buildMypyBoto3Package "mediaconvert" "1.40.56"
+      "sha256-oxrbkvlpIII2Ib8hMF0UnZ6PNFYnDHceA6V9M1thF18=";
 
   mypy-boto3-medialive =
     buildMypyBoto3Package "medialive" "1.40.45"
@@ -901,8 +901,8 @@ in
       "sha256-f/tGLKRnpzMDLAzQH1W7sUjGljb04Ws5Tidh8lL0pWE=";
 
   mypy-boto3-meteringmarketplace =
-    buildMypyBoto3Package "meteringmarketplace" "1.40.0"
-      "sha256-wbPakhKKDtNY6y84jzqJQlP7IiG5QAKQTRsYP/tndV8=";
+    buildMypyBoto3Package "meteringmarketplace" "1.40.56"
+      "sha256-idAuSb9+u1KVh13BBNSgXYkqKHZHcSfQ3rVxiDBLdVU=";
 
   mypy-boto3-mgh =
     buildMypyBoto3Package "mgh" "1.40.18"
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 31be8adb7114..8b63f53d48a6 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "1.8.0";
+  version = "1.8.2";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     tag = "v${version}";
-    hash = "sha256-a0svh7FyQbuo74gIRxPA8WiFSG7zKkA0oZgztAmfd4o=";
+    hash = "sha256-9mJznR6iUyKBojMaSxlsaP4XjaHtYMPkq/wGr5F90ik=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-rapidjson/default.nix b/pkgs/development/python-modules/python-rapidjson/default.nix
index 7d5e92b9407b..e60e070c8614 100644
--- a/pkgs/development/python-modules/python-rapidjson/default.nix
+++ b/pkgs/development/python-modules/python-rapidjson/default.nix
@@ -10,7 +10,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.21";
+  version = "1.22";
   pname = "python-rapidjson";
   pyproject = true;
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "python-rapidjson";
     repo = "python-rapidjson";
     tag = "v${version}";
-    hash = "sha256-qpq7gNdWDSNTVTqV1rnRffap0VrlHOr4soAY/SXqd1k=";
+    hash = "sha256-q+qIuFD3TboevD88iaBQxwOoOdb6I+yyCsNXIqMcR3g=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/sqlfmt/default.nix b/pkgs/development/python-modules/sqlfmt/default.nix
index 2f1dff47901a..1acdfcfa0664 100644
--- a/pkgs/development/python-modules/sqlfmt/default.nix
+++ b/pkgs/development/python-modules/sqlfmt/default.nix
@@ -1,23 +1,33 @@
 {
   lib,
-  black,
   buildPythonPackage,
-  click,
   fetchFromGitHub,
-  gitpython,
+  pythonOlder,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  click,
   jinja2,
   platformdirs,
-  poetry-core,
+  tqdm,
+
+  # optional-dependencies
+  black,
+  gitpython,
+
+  # tests
+  addBinToPathHook,
   pytest-asyncio,
   pytestCheckHook,
-  pythonOlder,
-  tqdm,
+  versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "sqlfmt";
-  version = "0.27.0";
+  version = "0.28.1";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -26,11 +36,14 @@ buildPythonPackage rec {
     owner = "tconbeer";
     repo = "sqlfmt";
     tag = "v${version}";
-    hash = "sha256-Yel9SB7KrDqtuZxNx4omz6u4AID8Fk5kFYKBEZD1fuU=";
+    hash = "sha256-H896Ey4iJFuvcLLvLilN/6nN4gxpvv3VJKIjivEDwMU=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
+  pythonRelaxDeps = [
+    "click"
+  ];
   dependencies = [
     click
     jinja2
@@ -43,18 +56,23 @@ buildPythonPackage rec {
     sqlfmt_primer = [ gitpython ];
   };
 
+  pythonImportsCheck = [ "sqlfmt" ];
+
   nativeCheckInputs = [
+    addBinToPathHook
     pytest-asyncio
     pytestCheckHook
+    versionCheckHook
     writableTmpDirAsHomeHook
   ]
   ++ lib.flatten (builtins.attrValues optional-dependencies);
+  versionCheckProgramArg = "--version";
 
-  preCheck = ''
-    export PATH="$PATH:$out/bin";
-  '';
-
-  pythonImportsCheck = [ "sqlfmt" ];
+  disabledTestPaths = [
+    # TypeError: CliRunner.__init__() got an unexpected keyword argument 'mix_stderr'
+    "tests/functional_tests/test_end_to_end.py"
+    "tests/unit_tests/test_cli.py"
+  ];
 
   meta = {
     description = "Sqlfmt formats your dbt SQL files so you don't have to";
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 258852bb9976..ef0672e82392 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1476";
+  version = "3.0.1479";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-FzCZT5ZIPdjl568lilb2syJA47FW1jjW7mYLj2cIO4k=";
+    hash = "sha256-RvMQk/8btxQ2c9idSnLmZedM/oDID9OFKcEikHXRIxs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/textual/default.nix b/pkgs/development/python-modules/textual/default.nix
index 4dfe95cadb03..68eee933c737 100644
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@@ -11,6 +11,7 @@
   platformdirs,
   rich,
   typing-extensions,
+  mdit-py-plugins,
 
   # optional-dependencies
   tree-sitter,
@@ -29,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "textual";
-  version = "6.3.0";
+  version = "6.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Textualize";
     repo = "textual";
     tag = "v${version}";
-    hash = "sha256-3KxSuyfczyulbpysAO8mF7wvzd+807Lj6l6g0TygBnI=";
+    hash = "sha256-lwtgPJK62SntL0ThoIpmEq0Ngjf8wl73Q8PXjvut3ps=";
   };
 
   build-system = [ poetry-core ];
@@ -46,6 +47,7 @@ buildPythonPackage rec {
   ];
   dependencies = [
     markdown-it-py
+    mdit-py-plugins
     platformdirs
     rich
     typing-extensions
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index 8f32a4310e89..7c6524367e1a 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -9,6 +9,7 @@
 
   # dependencies
   glib,
+  libxfixes,
   libXinerama,
   catch2,
   gperf,
@@ -129,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional ncursesSupport ncurses
   ++ lib.optionals x11Support [
     freetype
+    libxfixes
     xorg.libICE
     xorg.libX11
     xorg.libXext
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 524ba2fa4c0e..eac1cb5e7ec6 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -19,7 +19,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana";
-  version = "12.2.0";
+  version = "12.2.1";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -31,7 +31,7 @@ buildGoModule (finalAttrs: {
     owner = "grafana";
     repo = "grafana";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EFqR+du+ZeWih7+s4iVVAiwOvTwbF1pNg1TntkoGCEQ=";
+    hash = "sha256-fOlf+NTV1DIotC0JyG+PCMe8uPr+mfe/CLQP7dmRtkg=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@@ -46,12 +46,12 @@ buildGoModule (finalAttrs: {
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry_4.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-BqlkFgWiU5gruDHjkazNy6GKL2KgpcrwaHXDYNBF9EY=";
+    hash = "sha256-aXWi2hriPHm1Gsmd6Zg8eTR//KuI6SrvJAYhTeRZTug=";
   };
 
   disallowedRequisites = [ finalAttrs.offlineCache ];
 
-  vendorHash = "sha256-yoOs9MngUCfvvK9rPUsXCoSc5LiRs0g66KdINLQzO8Q=";
+  vendorHash = "sha256-TvKG/fUBure2wiZDVFD7dHGVDBl8gqWRkv2YBYNcIDQ=";
 
   # Grafana seems to just set it to the latest version available
   # nowadays.
@@ -64,7 +64,7 @@ buildGoModule (finalAttrs: {
   # This is still better than maintaining some list of go.mod files (or exclusions of that)
   # where to patch the go version (and where to not do that).
   postPatch = ''
-    find . -name go.mod -or -name "go.work" -type f -exec sed -i -e 's/^go .*/go ${finalAttrs.passthru.go.version}/g' {} \;
+    find . \( -name go.mod -or -name "go.work" \) -type f -exec sed -i -e 's/^go .*/go ${finalAttrs.passthru.go.version}/g' {} \;
   '';
 
   proxyVendor = true;
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-kkc/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-kkc/default.nix
deleted file mode 100644
index 93cc1b9daa4a..000000000000
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-kkc/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  vala,
-  intltool,
-  pkg-config,
-  libkkc,
-  ibus,
-  skkDictionaries,
-  gtk3,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "ibus-kkc";
-  version = "1.5.22";
-
-  src = fetchurl {
-    url = "${meta.homepage}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "1kj74c9zy9yxkjx7pz96mzqc13cf10yfmlgprr8sfd4ay192bzi2";
-  };
-
-  nativeBuildInputs = [
-    vala
-    intltool
-    pkg-config
-  ];
-
-  buildInputs = [
-    libkkc
-    ibus
-    gtk3
-  ];
-
-  postInstall = ''
-    ln -s ${skkDictionaries.l}/share/skk $out/share/skk
-  '';
-
-  meta = with lib; {
-    isIbusEngine = true;
-    description = "Libkkc (Japanese Kana Kanji input method) engine for ibus";
-    homepage = "https://github.com/ueno/ibus-kkc";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d0ebac05afc5..9f8b8dd7d5ae 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1384,6 +1384,8 @@ mapAliases {
   libiconv-darwin = darwin.libiconv; # Added 2024-09-22
   libixp_hg = libixp; # Added 2022-04-25
   libjpeg_drop = throw "'libjpeg_drop' has been renamed to/replaced by 'libjpeg_original'"; # Converted to throw 2024-10-17
+  libkkc = throw "'libkkc' has been removed due to lack of maintenance. Consider using anthy instead"; # added 2025-08-28
+  libkkc-data = throw "'libkkc-data' has been removed as it depended on libkkc which was removed"; # Added 2025-08-28
   liblastfm = throw "'liblastfm' has been renamed to/replaced by 'libsForQt5.liblastfm'"; # Converted to throw 2024-10-17
   liblinphone = throw "'liblinphone' has been moved to 'linphonePackages.liblinphone'"; # Added 2025-09-20
   libmp3splt = throw "'libmp3splt' has been removed due to lack of maintenance upstream."; # Added 2025-05-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c3525f46c6f9..d3847ee7ae46 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1765,8 +1765,6 @@ with pkgs;
 
   biliass = with python3.pkgs; toPythonApplication biliass;
 
-  birdtray = libsForQt5.callPackage ../applications/misc/birdtray { };
-
   charles = charles5;
   inherit (callPackages ../applications/networking/charles { })
     charles3
@@ -2466,8 +2464,6 @@ with pkgs;
 
     hangul = callPackage ../tools/inputmethods/ibus-engines/ibus-hangul { };
 
-    kkc = callPackage ../tools/inputmethods/ibus-engines/ibus-kkc { };
-
     libpinyin = callPackage ../tools/inputmethods/ibus-engines/ibus-libpinyin { };
 
     libthai = callPackage ../tools/inputmethods/ibus-engines/ibus-libthai { };