diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8d672effcb02..fa03fbb515a4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17322,6 +17322,17 @@
     githubId = 7831184;
     name = "John Mercier";
   };
+  mochienya = {
+    name = "mochienya";
+    github = "mochienya";
+    githubId = 187453775;
+    matrix = "@mochienya:matrix.org";
+    keys = [
+      {
+        fingerprint = "7A49 5110 84F4 EAF1 BE30  5CF0 CC3B E964 564F 9554";
+      }
+    ];
+  };
   mockersf = {
     email = "francois.mockers@vleue.com";
     github = "mockersf";
@@ -18721,6 +18732,12 @@
     github = "noahgitsham";
     githubId = 73707948;
   };
+  nobbele = {
+    name = "nobbele";
+    email = "realnobbele@gmail.com";
+    github = "nobbele";
+    githubId = 17962514;
+  };
   nobbz = {
     name = "Norbert Melzer";
     email = "timmelzer+nixpkgs@gmail.com";
diff --git a/nixos/doc/manual/development/option-types.section.md b/nixos/doc/manual/development/option-types.section.md
index b7b9f04acd95..d2e0c7299415 100644
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@@ -316,22 +316,34 @@ A union of types is a type such that a value is valid when it is valid for at le
 
 If some values are instances of more than one of the types, it is not possible to distinguish which type they are meant to be instances of. If that's needed, consider using a [sum type](#sec-option-types-sums).
 
+<!-- SYNC WITH oneOf BELOW -->
 `types.either` *`t1 t2`*
 
 :   Type *`t1`* or type *`t2`*, e.g. `with types; either int str`.
     Multiple definitions cannot be merged.
 
+    ::: {.warning}
+    `either` and `oneOf` eagerly decide the active type based on the passed types' shallow check method. For composite types like `attrsOf` and `submodule`, which both match all attribute set definitions, the first type argument will be chosen for the returned option value, and this therefore also decides how nested values are checked and merged. For example, `either (attrsOf int) (submodule {...})` will always use `attrsOf int` for any attribute set value, even if it was intended as a submodule. This behavior is a trade-off that keeps the implementation simple and the evaluation order predictable, avoiding unexpected strictness problems such as infinite recursions. When proper type discrimination is needed, consider using a [sum type](#sec-option-types-sums) like `attrTag` instead.
+    :::
+
+<!-- SYNC WITH either ABOVE -->
 `types.oneOf` \[ *`t1 t2`* ... \]
 
 :   Type *`t1`* or type *`t2`* and so forth, e.g.
     `with types; oneOf [ int str bool ]`. Multiple definitions cannot be
     merged.
 
+    ::: {.warning}
+    `either` and `oneOf` eagerly decide the active type based on the passed types' shallow check method. For composite types like `attrsOf` and `submodule`, which both match all attribute set definitions, the first matching type in the list will be chosen for the returned option value, and this therefore also decides how nested values are checked and merged. For example, `oneOf [ (attrsOf int) (submodule {...}) ]` will always use `attrsOf int` for any attribute set value, even if it was intended as a submodule. This behavior is a trade-off that keeps the implementation simple and the evaluation order predictable, avoiding unexpected strictness problems such as infinite recursions. When proper type discrimination is needed, consider using a [sum type](#sec-option-types-sums) like `attrTag` instead.
+    :::
+
 `types.nullOr` *`t`*
 
 :   `null` or type *`t`*. Multiple definitions are merged according to
     type *`t`*.
 
+    This is mostly equivalent to `either (enum [ null ]) t`, but `nullOr` provides a `null` fallback for attribute values with `mkIf false` definitions in `lazyAttrsOf (nullOr t)`, whereas `either` would throw an error when the attribute is accessed.
+
 
 ## Sum types {#sec-option-types-sums}
 
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 9115ca40211f..ade121300c89 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -377,6 +377,8 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
 
+- `services.mattermost` has been updated to use the 10.11 ESR instead of 10.5. While this shouldn't break anyone, we also now package Mattermost 11 as mattermostLatest. Note that Mattermost 11 drops support for MySQL. The Mattermost module will assertion fail if you try to use MySQL with Mattermost 11; support for using MySQL with Mattermost will fully be removed in NixOS 26.
+
 - `simplesamlphp` has been removed since the package was severely outdated, unmaintained in nixpkgs and having known vulnerabilities.
 
 - `networking.wireless.networks.<name>` now has an option to specify SSID, hence allowing duplicated SSID setup. The BSSID option is added along side with this.
diff --git a/nixos/modules/services/misc/rsync.nix b/nixos/modules/services/misc/rsync.nix
index 0a262a076621..f0768bf2771c 100644
--- a/nixos/modules/services/misc/rsync.nix
+++ b/nixos/modules/services/misc/rsync.nix
@@ -119,15 +119,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = lib.all (job: job.sources != [ ]) (lib.attrValues cfg.jobs);
-        message = ''
-          At least one source directory must be provided to rsync.
-        '';
-      }
-    ];
-
     systemd = lib.mkMerge (
       lib.mapAttrsToList (
         jobName: job:
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 39d380b4ed79..412a36c29c90 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -966,6 +966,13 @@ in
             or hostname, and services.mattermost.port to specify the port separately.
           '';
         }
+        {
+          # Can't use MySQL on version 11.
+          assertion = versionAtLeast cfg.package.version "11" -> cfg.database.driver == "postgres";
+          message = ''
+            Only Postgres is supported as the database driver in Mattermost 11 and later.
+          '';
+        }
       ];
     })
     (mkIf cfg.matterircd.enable {
diff --git a/nixos/tests/mattermost/default.nix b/nixos/tests/mattermost/default.nix
index 2783390b9082..bc795c2f5940 100644
--- a/nixos/tests/mattermost/default.nix
+++ b/nixos/tests/mattermost/default.nix
@@ -69,27 +69,11 @@ import ../make-test-python.nix (
         )
         extraConfig
       ];
-
-    makeMysql =
-      mattermostConfig: extraConfig:
-      lib.mkMerge [
-        mattermostConfig
-        (
-          { pkgs, config, ... }:
-          {
-            services.mattermost.database = {
-              driver = lib.mkForce "mysql";
-              peerAuth = lib.mkForce true;
-            };
-          }
-        )
-        extraConfig
-      ];
   in
   {
     name = "mattermost";
 
-    nodes = rec {
+    nodes = {
       postgresMutable = makeMattermost {
         mutableConfig = true;
         preferNixConfig = false;
@@ -174,25 +158,6 @@ import ../make-test-python.nix (
           MM_SUPPORTSETTINGS_ABOUTLINK=https://nixos.org
         '';
       } { };
-
-      mysqlMutable = makeMysql postgresMutable { };
-      mysqlMostlyMutable = makeMysql postgresMostlyMutable { };
-      mysqlImmutable = makeMysql postgresImmutable {
-        # Let's try to use this on MySQL.
-        services.mattermost.database = {
-          peerAuth = lib.mkForce true;
-          user = lib.mkForce "mmuser";
-          name = lib.mkForce "mmuser";
-        };
-      };
-      mysqlEnvironmentFile = makeMysql postgresEnvironmentFile {
-        services.mattermost.environmentFile = lib.mkForce (
-          pkgs.writeText "mattermost-env" ''
-            MM_SQLSETTINGS_DATASOURCE=mattermost@unix(/run/mysqld/mysqld.sock)/mattermost?charset=utf8mb4,utf8&writeTimeout=30s
-            MM_SUPPORTSETTINGS_ABOUTLINK=https://nixos.org
-          ''
-        );
-      };
     };
 
     testScript =
@@ -567,22 +532,6 @@ import ../make-test-python.nix (
             shutdown_queue.task_done()
         threading.Thread(target=shutdown_worker, daemon=True).start()
 
-        ${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isx86_64 ''
-          # Only run the MySQL tests on x86_64 so we don't have to debug MySQL ARM issues.
-          run_mattermost_tests(
-            shutdown_queue,
-            "${nodes.mysqlMutable.system.build.toplevel}",
-            mysqlMutable,
-            "${nodes.mysqlMostlyMutable.system.build.toplevel}",
-            "${nodes.mysqlMostlyMutable.services.mattermost.pluginsBundle}",
-            mysqlMostlyMutable,
-            "${nodes.mysqlImmutable.system.build.toplevel}",
-            mysqlImmutable,
-            "${nodes.mysqlEnvironmentFile.system.build.toplevel}",
-            mysqlEnvironmentFile
-          )
-        ''}
-
         run_mattermost_tests(
           shutdown_queue,
           "${nodes.postgresMutable.system.build.toplevel}",
diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix
index 96e0a2ab8a93..10841acb7672 100644
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.9.0.1";
+  version = "33.9.1";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -173,11 +173,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-QhER20l8GP0wQ0pDVwBZbYb2FImbX0kiUS9RCcR7gvg=";
+          hash = "sha256-muFqS3NpYX0Walhd+RFIZh7pUKQ5ZbPMZJasm9+rqTE=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-13lq59H8xGNbZHalZo87xAaoQg61t2v+B/LXnPoEyoU=";
+          hash = "sha256-lRFXpv+dp3ALVSiEDwE4kiaVjBX5XuVZeugEr+St53I=";
         };
       };
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 8463aec0adc5..cca0d968e74b 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -489,13 +489,13 @@
     "vendorHash": "sha256-MYVkNvJ+rbwGw0htClIbmxk3YX2OK/ZO/QOTyMRFiug="
   },
   "hashicorp_aws": {
-    "hash": "sha256-paVJc2HHtdAoc1KoYj0P5/t990/9nZedqBnjJNvmoOM=",
+    "hash": "sha256-5W5v4j4oBXIfqW75ClXkBtAahgEW6oMiTmILL6++fEc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v6.17.0",
+    "rev": "v6.18.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-93DyqAPi6hirke0KyR6gggC7cgAZOOByUIIA6C+6LZU="
+    "vendorHash": "sha256-Nxw5C4li2kH6MAlyaqHAUL+XYyuVPZYSkQ6PnmL3sV8="
   },
   "hashicorp_awscc": {
     "hash": "sha256-SrJQG1F9V/HThL6TDduT/qEA2x3tzII56+JMVDFpqEk=",
@@ -741,11 +741,11 @@
     "vendorHash": null
   },
   "integrations_github": {
-    "hash": "sha256-OexDIuEHRSOeHq0lRZcaaezdQpm5tgINGcka6jk+bK0=",
+    "hash": "sha256-FVDx8KH7foy1rZigDVEWMEalQ9nJnLkRjkJsFi0aEuM=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v6.7.0",
+    "rev": "v6.7.1",
     "spdx": "MIT",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/al/alfis/package.nix b/pkgs/by-name/al/alfis/package.nix
index 67ff87511302..75de069fe85e 100644
--- a/pkgs/by-name/al/alfis/package.nix
+++ b/pkgs/by-name/al/alfis/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "alfis";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "Revertron";
     repo = "Alfis";
     tag = "v${version}";
-    hash = "sha256-u5luVJRNIuGqqNyh+C7nMSkZgoq/S7gpmsEiz8ntmC4=";
+    hash = "sha256-gRk4kvIV+5cCUFaJvGbTAR44678Twa28iMGZ75lJz2c=";
   };
 
-  cargoHash = "sha256-ittJ/iKcmvd5r8oaBoGhi/E2osq245OWxSC+VH+bme4=";
+  cargoHash = "sha256-Ge0+7ClXlJFT6CyluHF7k4stsX+KuYp/riro1pvrcKM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/an/animdl/package.nix b/pkgs/by-name/an/animdl/package.nix
index 28a2ecab20fd..99dc42e8e962 100644
--- a/pkgs/by-name/an/animdl/package.nix
+++ b/pkgs/by-name/an/animdl/package.nix
@@ -21,6 +21,7 @@ python3Packages.buildPythonApplication {
   ];
 
   pythonRelaxDeps = [
+    "click"
     "cssselect"
     "httpx"
     "lxml"
@@ -55,12 +56,11 @@ python3Packages.buildPythonApplication {
 
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
     description = "Highly efficient, powerful and fast anime scraper";
     homepage = "https://github.com/justfoolingaround/animdl";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
     mainProgram = "animdl";
-    maintainers = with maintainers; [ passivelemon ];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ passivelemon ];
   };
 }
diff --git a/pkgs/by-name/ap/apkeditor/arsclib/default.nix b/pkgs/by-name/ap/apkeditor/arsclib/default.nix
index 37e9d0d9ec59..56625eb1af31 100644
--- a/pkgs/by-name/ap/apkeditor/arsclib/default.nix
+++ b/pkgs/by-name/ap/apkeditor/arsclib/default.nix
@@ -8,8 +8,8 @@
 let
   self = REAndroidLibrary {
     pname = "arsclib";
-    # 1.3.5 is not new enough for APKEditor because of API changes
-    version = "1.3.5-unstable-2024-10-21";
+    # 1.3.8 is not new enough for APKEditor because of API changes
+    version = "1.3.8-unstable-2025-09-23";
     projectName = "ARSCLib";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # This is the latest commit at the time of packaging.
       # It can be changed to a stable release ("V${version}")
       # if it is compatible with APKEditor.
-      rev = "ed6ccf00e56d7cce13e8648ad46a2678a6093248";
-      hash = "sha256-jzd7xkc4O+P9hlGsFGGl2P3pqVvV5+mDyKTRUuGfFSA=";
+      rev = "7238433395dea6f7d0fce3139f1659063ac31f42";
+      hash = "sha256-93eskC/qdkkNAZFYqSzoFxhmWgzTvDyZmZxOvwELGCs=";
     };
 
     mitmCache = gradle.fetchDeps {
diff --git a/pkgs/by-name/ap/apkeditor/jcommand/default.nix b/pkgs/by-name/ap/apkeditor/jcommand/default.nix
index 43b6ce8cae4c..b2e5a0c021ba 100644
--- a/pkgs/by-name/ap/apkeditor/jcommand/default.nix
+++ b/pkgs/by-name/ap/apkeditor/jcommand/default.nix
@@ -8,7 +8,7 @@
 let
   self = REAndroidLibrary {
     pname = "jcommand";
-    version = "0-unstable-2024-09-20";
+    version = "0-unstable-2025-01-21";
     projectName = "JCommand";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # it is hard to determine the actual commit that APKEditor is intended to use,
       # so I think we should use the latest commit that doesn't break compilation or basic functionality.
       # Currently this is the latest commit at the time of packaging.
-      rev = "714b6263c28dabb34adc858951cf4bc60d6c3fed";
-      hash = "sha256-6Em+1ddUkZBCYWs88qtfeGnxISZchFrHgDL8fsgZoQg=";
+      rev = "27d5fd21dc7da268182ea81e59007af890adb06e";
+      hash = "sha256-sbblGrp16rMGGGt7xAFd9F3ACeadYYEymBEL+s5BZ1E=";
     };
 
     mitmCache = gradle.fetchDeps {
diff --git a/pkgs/by-name/ap/apkeditor/package.nix b/pkgs/by-name/ap/apkeditor/package.nix
index 04f1d608a952..8647e87359d1 100644
--- a/pkgs/by-name/ap/apkeditor/package.nix
+++ b/pkgs/by-name/ap/apkeditor/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   callPackage,
+  versionCheckHook,
 
   jre,
   gradle,
@@ -54,7 +55,7 @@ let
   apkeditor =
     let
       pname = "apkeditor";
-      version = "1.4.1";
+      version = "1.4.5";
       projectName = "APKEditor";
     in
     REAndroidLibrary {
@@ -69,8 +70,8 @@ let
       src = fetchFromGitHub {
         owner = "REAndroid";
         repo = "APKEditor";
-        tag = "v${version}";
-        hash = "sha256-a72j9qGjJXnTFeqLez2rhBSArFVYCX+Xs7NQd8CY5Yk=";
+        tag = "V${version}";
+        hash = "sha256-yuNMyEnxTjHPSBPWVD8b+f612hWGGayZHKHxtWtxXDg=";
       };
 
       patches = [
@@ -99,8 +100,15 @@ let
           --add-flags "-jar $out/${apkeditor.outJar}"
       '';
 
+      doInstallCheck = true;
+      nativeInstallCheckInputs = [ versionCheckHook ];
+
+      passthru.updateScript = ./update.sh;
+
       meta = {
         description = "Powerful android apk resources editor";
+        homepage = "https://github.com/REAndroid/APKEditor";
+        changelog = "https://github.com/REAndroid/APKEditor/releases/tag/V${version}";
         maintainers = with lib.maintainers; [ ulysseszhan ];
         license = lib.licenses.asl20;
         platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ap/apkeditor/smali/default.nix b/pkgs/by-name/ap/apkeditor/smali/default.nix
index de6b87c8e82e..ee0032ad27d0 100644
--- a/pkgs/by-name/ap/apkeditor/smali/default.nix
+++ b/pkgs/by-name/ap/apkeditor/smali/default.nix
@@ -8,7 +8,7 @@
 let
   self = REAndroidLibrary {
     pname = "smali";
-    version = "0-unstable-2024-10-15";
+    version = "0-unstable-2024-11-24";
     projectName = "smali";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # it is hard to determine the actual commit that APKEditor is intended to use,
       # so I think we should use the latest commit that doesn't break compilation or basic functionality.
       # Currently this is the latest commit at the time of packaging.
-      rev = "c781eafb31f526abce9fdf406ce2c925fec20d28";
-      hash = "sha256-6tkvikgWMUcKwzsgbfpxlB6NZBAlZtTE34M3qPQw7Y4=";
+      rev = "76b35b4e0c9e8c874ca3e374bb943bba8d280770";
+      hash = "sha256-PhRBjiIKA4EIiafPplZNBErXG8V84Xn0cZLWVPmJelQ=";
     };
 
     patches = [
diff --git a/pkgs/by-name/ap/apkeditor/update.sh b/pkgs/by-name/ap/apkeditor/update.sh
new file mode 100755
index 000000000000..45b43b916690
--- /dev/null
+++ b/pkgs/by-name/ap/apkeditor/update.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -euo pipefail
+
+GITHUB_TOKEN="${GITHUB_TOKEN:-}"
+
+nixpkgs_attr() {
+  nix-instantiate --eval --raw --attr "$1"
+}
+
+github_api() {
+  local token_opt=()
+  if [[ -n "$GITHUB_TOKEN" ]]; then
+    token_opt=(-H "Authorization: Bearer $GITHUB_TOKEN")
+  fi
+  curl -fsS "${token_opt[@]}" "https://api.github.com$1"
+}
+
+update_mitm_cache() {
+  if [[ -z "$(nixpkgs_attr "$1.mitmCache.name")" ]]; then
+    return
+  fi
+  "$(nix-build -A "$1.mitmCache.updateScript")"
+}
+
+update() {
+  echo "Updating $1..." >&2
+
+  local owner="$(nixpkgs_attr "$1.src.owner")"
+  local repo="$(nixpkgs_attr "$1.src.repo")"
+
+  local old_version="$(nixpkgs_attr "$1.version")"
+  local use_last_commit=0
+  if [[ "$old_version" == *unstable* ]]; then
+    use_last_commit=1
+  fi
+
+  if (( use_last_commit )); then
+    local repo_info="$(github_api "/repos/$owner/$repo/commits?per_page=1" | jq ".[0]")"
+    local new_rev="$(echo "$repo_info" | jq -r .sha)"
+    local date="$(echo "$repo_info" | jq -r .commit.author.date)"
+    date="$(date -u -d "$date" +%Y-%m-%d)"
+    local new_version="${old_version%%-unstable*}-unstable-$(date -u -d "$date" +%Y-%m-%d)"
+    update-source-version "$1" "$new_version" --rev="$new_rev" --ignore-same-version --ignore-same-hash
+  else
+    local tag="$(github_api "/repos/$owner/$repo/releases/latest" | jq -r .tag_name)"
+    local new_version="${tag#V}"
+    update-source-version "$1" "$new_version" --ignore-same-version --ignore-same-hash
+  fi
+
+  update_mitm_cache "$1"
+}
+
+update apkeditor.passthru.deps.arsclib
+update apkeditor.passthru.deps.smali
+update apkeditor.passthru.deps.jcommand
+update apkeditor
diff --git a/pkgs/by-name/ba/baidupcs-go/package.nix b/pkgs/by-name/ba/baidupcs-go/package.nix
index 6738a39984ba..57a3993d5dee 100644
--- a/pkgs/by-name/ba/baidupcs-go/package.nix
+++ b/pkgs/by-name/ba/baidupcs-go/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "baidupcs-go";
-  version = "3.9.9";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "qjfoidnh";
     repo = "BaiduPCS-Go";
     rev = "v${version}";
-    hash = "sha256-x0oEuj8LoR0yUkKOzI27u3AIFVDDV7vMHCqvjENHwv8=";
+    hash = "sha256-synfJtYZmIiK2SoTG0rt+qZ0ixXIXDXnrNL2s5eDtQY=";
   };
 
-  vendorHash = "sha256-hW+IrzS5+DublQUIIcecL08xoauTjba9qnAtpzNeDXw=";
+  vendorHash = "sha256-oOZeBCHpAasi9K77xA+8HxZErGWKwb4OaWzWhHagtQE=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index f8ca0692cc0f..92bcd13f2e96 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.31.7";
+  version = "1.32.1";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-mC+qnEI2a7tGjIIZxRzGY+VyfYnTY1brCKGHU3KOf0Q=";
+    hash = "sha256-bxqUH5MYwp8MLD8ve8afgN3qe3hCPRu0l7QO7m1ZSzA=";
   };
 
-  npmDepsHash = "sha256-dwtMl5dFpol+J+cM6EHiwO+F93Iyurwx9Kr317IGtVw=";
+  npmDepsHash = "sha256-zNmZ4wXxe31NnQ+VlTLoPM2zTDmKdw1D28pi/roybdQ=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''
diff --git a/pkgs/by-name/be/beammp-launcher/package.nix b/pkgs/by-name/be/beammp-launcher/package.nix
index 6ef83abe354b..a6dec6c17019 100644
--- a/pkgs/by-name/be/beammp-launcher/package.nix
+++ b/pkgs/by-name/be/beammp-launcher/package.nix
@@ -63,7 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/BeamMP/BeamMP-Launcher";
     license = lib.licenses.agpl3Only;
     mainProgram = "BeamMP-Launcher";
-    maintainers = [ lib.maintainers.Andy3153 ];
+    maintainers = with lib.maintainers; [
+      Andy3153
+      mochienya
+    ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/games/blightmud/default.nix b/pkgs/by-name/bl/blightmud/package.nix
similarity index 89%
rename from pkgs/games/blightmud/default.nix
rename to pkgs/by-name/bl/blightmud/package.nix
index 23595aa070c2..aa9341e472c3 100644
--- a/pkgs/games/blightmud/default.nix
+++ b/pkgs/by-name/bl/blightmud/package.nix
@@ -9,14 +9,14 @@
   withTTS ? false,
   speechd-minimal,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "blightmud";
   version = "5.3.1";
 
   src = fetchFromGitHub {
     owner = "blightmud";
     repo = "blightmud";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-9GUul5EoejcnCQqq1oX+seBtxttYIUhgcexaZk+7chk=";
   };
 
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage rec {
     in
     builtins.concatStringsSep " " (map skipFlag skipList);
 
-  meta = with lib; {
+  meta = {
     description = "Terminal MUD client written in Rust";
     mainProgram = "blightmud";
     longDescription = ''
@@ -72,8 +72,8 @@ rustPlatform.buildRustPackage rec {
       friendly mode.
     '';
     homepage = "https://github.com/Blightmud/Blightmud";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ cpu ];
-    platforms = platforms.linux ++ platforms.darwin;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ cpu ];
+    platforms = with lib.platforms; linux ++ darwin;
   };
-}
+})
diff --git a/pkgs/games/chiaki-ng/default.nix b/pkgs/by-name/ch/chiaki-ng/package.nix
similarity index 82%
rename from pkgs/games/chiaki-ng/default.nix
rename to pkgs/by-name/ch/chiaki-ng/package.nix
index 3ec054b901ed..1545b1a40148 100644
--- a/pkgs/games/chiaki-ng/default.nix
+++ b/pkgs/by-name/ch/chiaki-ng/package.nix
@@ -8,13 +8,6 @@
   python3,
   ffmpeg,
   libopus,
-  wrapQtAppsHook,
-  qtbase,
-  qtmultimedia,
-  qtsvg,
-  qtwayland,
-  qtdeclarative,
-  qtwebengine,
   SDL2,
   libevdev,
   udev,
@@ -33,6 +26,7 @@
   lcms2,
   libdovi,
   xxHash,
+  kdePackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -42,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "streetpea";
     repo = "chiaki-ng";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-7pDQnlElnBkW+Nr6R+NaylZbsGH8dB31nd7jxYD66yQ=";
     fetchSubmodules = true;
   };
@@ -50,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapQtAppsHook
+    kdePackages.wrapQtAppsHook
     protobuf
     python3
     python3.pkgs.wrapPython
@@ -61,12 +55,12 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     ffmpeg
     libopus
-    qtbase
-    qtmultimedia
-    qtsvg
-    qtdeclarative
-    qtwayland
-    qtwebengine
+    kdePackages.qtbase
+    kdePackages.qtmultimedia
+    kdePackages.qtsvg
+    kdePackages.qtdeclarative
+    kdePackages.qtwayland
+    kdePackages.qtwebengine
     protobuf
     SDL2
     curlFull
@@ -108,16 +102,16 @@ stdenv.mkDerivation (finalAttrs: {
     wrapPythonPrograms
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://streetpea.github.io/chiaki-ng/";
     description = "Next-Generation of Chiaki (the open-source remote play client for PlayStation)";
     # Includes OpenSSL linking exception that we currently have no way
     # to represent.
     #
     # See also: <https://github.com/spdx/license-list-XML/issues/939>
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ devusb ];
-    platforms = platforms.linux;
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ devusb ];
+    platforms = lib.platforms.linux;
     mainProgram = "chiaki";
   };
 })
diff --git a/pkgs/games/chiaki/default.nix b/pkgs/by-name/ch/chiaki/package.nix
similarity index 76%
rename from pkgs/games/chiaki/default.nix
rename to pkgs/by-name/ch/chiaki/package.nix
index 03e5c528ac2f..76bba18cd7c4 100644
--- a/pkgs/games/chiaki/default.nix
+++ b/pkgs/by-name/ch/chiaki/package.nix
@@ -6,24 +6,20 @@
   pkg-config,
   ffmpeg,
   libopus,
-  mkDerivation,
-  qtbase,
-  qtmultimedia,
-  qtsvg,
   SDL2,
   libevdev,
   udev,
-  qtmacextras,
   nanopb,
+  libsForQt5,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "chiaki";
   version = "2.2.0";
 
   src = fetchgit {
     url = "https://git.sr.ht/~thestr4ng3r/chiaki";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-mLx2ygMlIuDJt9iT4nIj/dcLGjMvvmneKd49L7C3BQk=";
   };
@@ -31,6 +27,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
+    libsForQt5.wrapQtAppsHook
   ];
 
   postPatch = ''
@@ -42,9 +39,9 @@ mkDerivation rec {
   buildInputs = [
     ffmpeg
     libopus
-    qtbase
-    qtmultimedia
-    qtsvg
+    libsForQt5.qtbase
+    libsForQt5.qtmultimedia
+    libsForQt5.qtsvg
     SDL2
     nanopb
   ]
@@ -53,19 +50,19 @@ mkDerivation rec {
     udev
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    qtmacextras
+    libsForQt5.qtmacextras
   ];
 
   doCheck = true;
 
   installCheckPhase = "$out/bin/chiaki --help";
 
-  meta = with lib; {
+  meta = {
     homepage = "https://git.sr.ht/~thestr4ng3r/chiaki";
     description = "Free and Open Source PlayStation Remote Play Client";
-    license = licenses.agpl3Only;
+    license = lib.licenses.agpl3Only;
     maintainers = [ ];
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
     mainProgram = "chiaki";
   };
-}
+})
diff --git a/pkgs/games/crawl/default.nix b/pkgs/by-name/cr/crawl/package.nix
similarity index 100%
rename from pkgs/games/crawl/default.nix
rename to pkgs/by-name/cr/crawl/package.nix
diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index 0b3d9291048f..0d01d8291ccb 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -21,18 +21,18 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-10-21";
+  version = "0-unstable-2025-10-27";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "f6de423867b914a59d86c54d102831bccc7ed2c8";
-    hash = "sha256-xTuu1tMoFuMcj2RqtGjyDbcFPh3bTCtWpr0fuND4aos=";
+    rev = "4630761f03d5a389d36c22bf685df107b43083a7";
+    hash = "sha256-hp90A/uSXS/RNn1HCCWF4Sv3X8AOtcCOk9DRv95epVc=";
     fetchSubmodules = true;
   };
 
   separateDebugInfo = true;
 
-  cargoHash = "sha256-ROj0qOnePzkuzck6jXgjvOM9ksL/ubZOxOtku1B7dZA=";
+  cargoHash = "sha256-P6vFWs9lVn4EkXUVOi+3s/tptAV/J7tH5GBCQv/dwUA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/cu/cups-filters/package.nix b/pkgs/by-name/cu/cups-filters/package.nix
index a5468f00fecc..0abca6114c34 100644
--- a/pkgs/by-name/cu/cups-filters/package.nix
+++ b/pkgs/by-name/cu/cups-filters/package.nix
@@ -6,6 +6,7 @@
   dbus,
   dejavu_fonts,
   fetchFromGitHub,
+  fetchpatch,
   fontconfig,
   gawk,
   ghostscript,
@@ -62,6 +63,16 @@
         hash = "sha256-bLOl64bdeZ10JLcQ7GbU+VffJu3Lzo0ves7O7GQIOWY=";
       };
 
+      patches = [
+        # Fix build with gcc15
+        # https://github.com/OpenPrinting/cups-filters/pull/618
+        (fetchpatch {
+          name = "cups-filters-fix-build-with-gcc15-c23.patch";
+          url = "https://github.com/OpenPrinting/cups-filters/commit/9871a50b5c1f9c2caa2754aac1f5db70c886021b.patch";
+          hash = "sha256-Hu3nCHzX6K4tD7T5XIt0dh6GPQxmgfuHqbBXWfdXxoA=";
+        })
+      ];
+
       strictDeps = true;
 
       nativeBuildInputs = [
diff --git a/pkgs/by-name/cw/cwltool/package.nix b/pkgs/by-name/cw/cwltool/package.nix
index df62af94dcd7..847d3484f7cf 100644
--- a/pkgs/by-name/cw/cwltool/package.nix
+++ b/pkgs/by-name/cw/cwltool/package.nix
@@ -1,62 +1,39 @@
 {
   lib,
   fetchFromGitHub,
-  git,
   nodejs,
-  python3,
+  python3Packages,
 }:
 
-let
-  py = python3.override {
-    packageOverrides = final: prev: {
-      # Requires "pydot >= 1.4.1, <3",
-      pydot = prev.pydot.overridePythonAttrs (old: rec {
-        version = "2.0.0";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-YCRq8hUSP6Bi8hzXkb5n3aI6bygN8J9okZ5jeh5PMjU=";
-        };
-        doCheck = false;
-      });
-    };
-  };
-in
-with py.pkgs;
-
-py.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cwltool";
-  version = "3.1.20250110105449";
+  version = "3.1.20250925164626";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = "cwltool";
     tag = version;
-    hash = "sha256-V0CQiNkIw81s6e9224qcfbsOqBvMo34q+lRURpRetKs=";
+    hash = "sha256-esY/p7wm0HvLiX+jZENBye4NblYveYAXevYRQxk+u44=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace-fail "prov == 1.5.1" "prov" \
-      --replace-fail '"schema-salad >= 8.7, < 9",' '"schema-salad",' \
       --replace-fail "PYTEST_RUNNER + " ""
     substituteInPlace pyproject.toml \
-      --replace-fail "mypy==1.14.1" "mypy"
+      --replace-fail "mypy==1.18.2" "mypy"
   '';
 
-  build-system = with py.pkgs; [
+  build-system = with python3Packages; [
     setuptools
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ git ];
-
-  dependencies = with py.pkgs; [
+  dependencies = with python3Packages; [
     argcomplete
     bagit
     coloredlogs
     cwl-utils
-    mypy
     mypy-extensions
     prov
     psutil
@@ -74,7 +51,7 @@ py.pkgs.buildPythonApplication rec {
     typing-extensions
   ];
 
-  nativeCheckInputs = with py.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     mock
     nodejs
     pytest-mock
@@ -83,6 +60,8 @@ py.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  pythonRelaxDeps = [ "prov" ];
+
   disabledTests = [
     "test_content_types"
     "test_env_filtering"
diff --git a/pkgs/games/doom-ports/doomseeker/add_gitinfo.patch b/pkgs/by-name/do/doomseeker/add_gitinfo.patch
similarity index 100%
rename from pkgs/games/doom-ports/doomseeker/add_gitinfo.patch
rename to pkgs/by-name/do/doomseeker/add_gitinfo.patch
diff --git a/pkgs/games/doom-ports/doomseeker/dont_update_gitinfo.patch b/pkgs/by-name/do/doomseeker/dont_update_gitinfo.patch
similarity index 100%
rename from pkgs/games/doom-ports/doomseeker/dont_update_gitinfo.patch
rename to pkgs/by-name/do/doomseeker/dont_update_gitinfo.patch
diff --git a/pkgs/games/doom-ports/doomseeker/fix_paths.patch b/pkgs/by-name/do/doomseeker/fix_paths.patch
similarity index 100%
rename from pkgs/games/doom-ports/doomseeker/fix_paths.patch
rename to pkgs/by-name/do/doomseeker/fix_paths.patch
diff --git a/pkgs/games/doom-ports/doomseeker/default.nix b/pkgs/by-name/do/doomseeker/package.nix
similarity index 83%
rename from pkgs/games/doom-ports/doomseeker/default.nix
rename to pkgs/by-name/do/doomseeker/package.nix
index eb1b4dedce92..476c522b4a87 100644
--- a/pkgs/games/doom-ports/doomseeker/default.nix
+++ b/pkgs/by-name/do/doomseeker/package.nix
@@ -3,14 +3,11 @@
   stdenv,
   cmake,
   fetchFromBitbucket,
-  wrapQtAppsHook,
   pkg-config,
-  qtbase,
-  qttools,
-  qtmultimedia,
   zlib,
   bzip2,
   xxd,
+  qt5,
 }:
 
 stdenv.mkDerivation {
@@ -31,15 +28,15 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [
-    wrapQtAppsHook
+    qt5.wrapQtAppsHook
     cmake
-    qttools
+    qt5.qttools
     pkg-config
     xxd
   ];
   buildInputs = [
-    qtbase
-    qtmultimedia
+    qt5.qtbase
+    qt5.qtmultimedia
     zlib
     bzip2
   ];
@@ -52,12 +49,12 @@ stdenv.mkDerivation {
     ln -s $out/lib/doomseeker/doomseeker $out/bin/
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "http://doomseeker.drdteam.org/";
     description = "Multiplayer server browser for many Doom source ports";
     mainProgram = "doomseeker";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/du/dua/package.nix b/pkgs/by-name/du/dua/package.nix
index 4043d4267153..6ec17352a3b2 100644
--- a/pkgs/by-name/du/dua/package.nix
+++ b/pkgs/by-name/du/dua/package.nix
@@ -6,15 +6,15 @@
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dua";
-  version = "2.32.0";
+  version = "2.32.2";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
-    tag = "v${version}";
-    hash = "sha256-u8g7X/70ZsZF6vUiVnisItwSMiNXgiAdOXqGUT34EaY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MB5uePy32jTvOtkQKcP9peFPqwR68E+NZ7UGMuLx8Eo=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -22,19 +22,19 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoHash = "sha256-6WjaKGCnEoHCIDqMHtp/dpdHbrUe2XOxCtstQCuXPyc=";
+  cargoHash = "sha256-6H0x6I3nkCezu4/Hguv0XTdl+3QiyPL8Ue1rqTQU7VA=";
 
   checkFlags = [
     # Skip interactive tests
+    "--skip=interactive::app::tests::journeys_readonly::quit_instantly_when_nothing_marked"
+    "--skip=interactive::app::tests::journeys_readonly::quit_requires_two_presses_when_items_marked"
     "--skip=interactive::app::tests::journeys_readonly::simple_user_journey_read_only"
     "--skip=interactive::app::tests::journeys_with_writes::basic_user_journey_with_deletion"
     "--skip=interactive::app::tests::unit::it_can_handle_ending_traversal_reaching_top_but_skipping_levels"
     "--skip=interactive::app::tests::unit::it_can_handle_ending_traversal_without_reaching_the_top"
   ];
 
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
@@ -43,12 +43,13 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Tool to conveniently learn about the disk usage of directories";
     homepage = "https://github.com/Byron/dua-cli";
-    changelog = "https://github.com/Byron/dua-cli/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Byron/dua-cli/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [
       figsoda
       killercup
+      defelo
     ];
     mainProgram = "dua";
   };
-}
+})
diff --git a/pkgs/by-name/du/duckstation/package.nix b/pkgs/by-name/du/duckstation/package.nix
index 05232359446d..e84c5306363f 100644
--- a/pkgs/by-name/du/duckstation/package.nix
+++ b/pkgs/by-name/du/duckstation/package.nix
@@ -8,7 +8,6 @@
   ninja,
   extra-cmake-modules,
   wayland-scanner,
-  makeBinaryWrapper,
   qt6,
   sdl3,
   zstd,
@@ -29,7 +28,7 @@
   spirv-cross,
   udev,
   libbacktrace,
-  ffmpeg-headless,
+  ffmpeg_8-headless,
   alsa-lib,
   libjack2,
   libpulseaudio,
@@ -47,17 +46,11 @@ let
   meta = {
     description = "Fast PlayStation 1 emulator for x86-64/AArch32/AArch64/RV64";
     longDescription = ''
-      # DISCLAIMER
-      This is an **unofficial** package, do not report any issues to
-      duckstation developers. Instead, please report them to
+      DISCLAIMER: This is an **unofficial** package, do not report any
+      issues to duckstation developers. Instead, please report them to
       <https://github.com/NixOS/nixpkgs> or use the officially
       supported platform build at <https://duckstation.org> or other
-      upstream-approved distribution mechanism not listed here. We
-      (nixpkgs) do not endorse or condone any action taken on your own
-      accord in regards to this package.
-
-      The SDL audio backend must be used as cubeb support is currently
-      non-functional without patches.
+      upstream-approved distribution mechanism not listed here.
     '';
     homepage = "https://duckstation.org";
     license = lib.licenses.cc-by-nc-nd-40;
@@ -71,15 +64,22 @@ let
 
   linuxDrv = llvmPackages.stdenv.mkDerivation (finalAttrs: {
     pname = "duckstation";
-    version = pkgSources.duckstation.version;
+    version = "0.1-9787-unstable-2025-10-13";
 
     src = fetchFromGitHub {
       owner = "stenzek";
       repo = "duckstation";
-      tag = "v${finalAttrs.version}";
-      hash = pkgSources.duckstation.hash_linux;
+      rev = "8f0c9dd171210dfd7f06223a393e2565abbaabf3";
+      hash = "sha256-CzHWdY0RaGBB6CY3PzHHHbq3/Mbf6WtUm6Dizr0IW6I=";
     };
 
+    # TODO: Remove once this is fixed upstream.
+    postPatch = ''
+      substituteInPlace src/util/animated_image.cpp \
+        --replace-fail "png_write_frame_head(png_ptr, info_ptr," \
+                       "png_write_frame_head(png_ptr, info_ptr, 0,"
+    '';
+
     vendorDiscordRPC = llvmPackages.stdenv.mkDerivation {
       pname = "discord-rpc-duckstation";
       inherit (finalAttrs) version;
@@ -190,7 +190,8 @@ let
           - Improving performance.
           - Fixing game-breaking bugs.
           - Unlocking the frame rate (e.g. "60 FPS patches").
-          - Widescreen rendering where the built-in widescreen rendering rendering is insufficient.
+          - Widescreen rendering where the built-in widescreen
+            rendering rendering is insufficient.
         '';
         license = lib.licenses.mit;
         inherit (meta) maintainers;
@@ -209,7 +210,6 @@ let
       ninja
       extra-cmake-modules
       wayland-scanner
-      makeBinaryWrapper
       qt6.wrapQtAppsHook
       qt6.qttools
     ];
@@ -232,7 +232,7 @@ let
       qt6.qtbase
       udev
       libbacktrace
-      ffmpeg-headless
+      ffmpeg_8-headless
       alsa-lib
       libjack2
       pipewire
@@ -244,19 +244,14 @@ let
       finalAttrs.soundtouch
     ];
 
-    cmakeFlags = [
-      (lib.cmakeBool "ALLOW_INSTALL" true)
-      (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/lib/duckstation")
-    ];
+    installPhase = ''
+      runHook preInstall
 
-    postInstall = ''
-      makeWrapper $out/lib/duckstation/duckstation-qt $out/bin/duckstation-qt
-
-      mkdir -p $out/share/applications
+      mkdir -p $out/{lib,bin,share/{applications,icons/hicolor/512x512/apps}}
+      cp -r bin $out/lib/duckstation
+      ln -s $out/lib/duckstation/duckstation-qt $out/bin/duckstation-qt
       ln -s $out/lib/duckstation/resources/org.duckstation.DuckStation.desktop \
             $out/share/applications
-
-      mkdir -p $out/share/icons/hicolor/512x512/apps
       ln -s $out/lib/duckstation/resources/org.duckstation.DuckStation.png \
             $out/share/icons/hicolor/512x512/apps
 
@@ -265,8 +260,19 @@ let
       install -Dm644 README.* -t $out/share/doc/duckstation
       install -Dm644 CONTRIBUTORS.md -t $out/share/doc/duckstation
       popd
+
+      runHook postInstall
     '';
 
+    qtWrapperArgs = [
+      "--prefix LD_LIBRARY_PATH : ${
+        (lib.makeLibraryPath [
+          ffmpeg_8-headless
+          finalAttrs.vendorShaderc
+        ])
+      }"
+    ];
+
     inherit passthru;
 
     meta = meta // {
diff --git a/pkgs/by-name/du/duckstation/sources.json b/pkgs/by-name/du/duckstation/sources.json
index dfca7c572752..a4db277a14d0 100644
--- a/pkgs/by-name/du/duckstation/sources.json
+++ b/pkgs/by-name/du/duckstation/sources.json
@@ -13,8 +13,8 @@
     "hash": "sha256-/o3LPYvMTlKhuvLQITnADmz8BTGXVaVR0aciOWVyFS8="
   },
   "chtdb": {
-    "date": "2025-10-05",
-    "rev": "eab12dde0ddfd03e1260d7111f2a0709144e047e",
-    "hash": "sha256-wRk9BijV52BCcvpeq4CzhLsaWYYrt+vFvdMwlAixBvU="
+    "date": "2025-10-16",
+    "rev": "aff6149c29beae9c52aa35ea5cb53986c8916546",
+    "hash": "sha256-gpJ6Wlo7PGMPraK8Bppb+3qDWZ6Oxd4kvLJEFtGF50U="
   }
 }
diff --git a/pkgs/games/dxx-rebirth/assets.nix b/pkgs/by-name/dx/dxx-rebirth/assets.nix
similarity index 100%
rename from pkgs/games/dxx-rebirth/assets.nix
rename to pkgs/by-name/dx/dxx-rebirth/assets.nix
diff --git a/pkgs/games/dxx-rebirth/full.nix b/pkgs/by-name/dx/dxx-rebirth/full.nix
similarity index 100%
rename from pkgs/games/dxx-rebirth/full.nix
rename to pkgs/by-name/dx/dxx-rebirth/full.nix
diff --git a/pkgs/games/dxx-rebirth/default.nix b/pkgs/by-name/dx/dxx-rebirth/package.nix
similarity index 90%
rename from pkgs/games/dxx-rebirth/default.nix
rename to pkgs/by-name/dx/dxx-rebirth/package.nix
index a0186148e404..8d52835a5457 100644
--- a/pkgs/games/dxx-rebirth/default.nix
+++ b/pkgs/by-name/dx/dxx-rebirth/package.nix
@@ -64,11 +64,11 @@ stdenv.mkDerivation {
 
   passthru.updateScript = unstableGitUpdater { };
 
-  meta = with lib; {
+  meta = {
     description = "Source Port of the Descent 1 and 2 engines";
     homepage = "https://www.dxx-rebirth.com/";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms = with platforms; linux;
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ peterhoeg ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/ej/ejabberd/package.nix b/pkgs/by-name/ej/ejabberd/package.nix
index d6c6534257cb..bd2108bac3cb 100644
--- a/pkgs/by-name/ej/ejabberd/package.nix
+++ b/pkgs/by-name/ej/ejabberd/package.nix
@@ -19,7 +19,6 @@
   gawk,
   fetchFromGitHub,
   fetchgit,
-  fetchpatch2,
   beamPackages,
   nixosTests,
   withMysql ? false,
@@ -141,7 +140,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ejabberd";
-  version = "25.08";
+  version = "25.10";
 
   nativeBuildInputs = [
     makeWrapper
@@ -171,7 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "processone";
     repo = "ejabberd";
     tag = finalAttrs.version;
-    hash = "sha256-nipFr4ezo2prlpLfAW8iu8HAG8nhkIXXiAbsoM7QKTM=";
+    hash = "sha256-dTu3feSOakSHdk+hMDvYQwog64O3e/z5NOsGM3Rq7WY=";
   };
 
   passthru.tests = {
@@ -217,6 +216,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Open-source XMPP application server written in Erlang";
     mainProgram = "ejabberdctl";
+    changelog = "https://github.com/processone/ejabberd/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
     homepage = "https://www.ejabberd.im";
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ej/ejabberd/rebar-deps.nix b/pkgs/by-name/ej/ejabberd/rebar-deps.nix
index 5f102ca8151a..cc082f0cc89d 100644
--- a/pkgs/by-name/ej/ejabberd/rebar-deps.nix
+++ b/pkgs/by-name/ej/ejabberd/rebar-deps.nix
@@ -44,21 +44,21 @@ let
     };
     yconf = builder {
       name = "yconf";
-      version = "1.0.21";
+      version = "1.0.22";
       src = fetchHex {
         pkg = "yconf";
-        version = "1.0.21";
-        sha256 = "sha256-xSSl8f2Gh12FtGnMLjaMIE+XzKHDkYc24h9QAcAdCWw=";
+        version = "1.0.22";
+        sha256 = "sha256-rKg0V86r5wdWSEtch7p7GVX1EdSZFoaH6uqnwwDoV/E=";
       };
       beamDeps = [ fast_yaml ];
     };
     xmpp = builder {
       name = "xmpp";
-      version = "1.11.1";
+      version = "1.11.2";
       src = fetchHex {
         pkg = "xmpp";
-        version = "1.11.1";
-        sha256 = "sha256-pckz35BKs87BVCXaM05BDOhOw657ge/gaeXbNop7NxY=";
+        version = "1.11.2";
+        sha256 = "sha256-u2gWROFePvwACKs6cXlE1nz2EaS340Q4KqY2dEe9UtI=";
       };
       beamDeps = [
         ezlib
@@ -124,11 +124,11 @@ let
     };
     p1_pgsql = builder {
       name = "p1_pgsql";
-      version = "1.1.35";
+      version = "1.1.36";
       src = fetchHex {
         pkg = "p1_pgsql";
-        version = "1.1.35";
-        sha256 = "sha256-6ZWURGxBHGYGlnlbBiM29cS9gARR2PYgu01M4wTiVcI=";
+        version = "1.1.36";
+        sha256 = "sha256-gryouJXIT0YA641gmjLLX91yp/W9k437KReeCMZD/Qk=";
       };
       beamDeps = [ xmpp ];
     };
@@ -154,11 +154,11 @@ let
     };
     p1_acme = builder {
       name = "p1_acme";
-      version = "1.0.28";
+      version = "1.0.29";
       src = fetchHex {
         pkg = "p1_acme";
-        version = "1.0.28";
-        sha256 = "sha256-zmhpht4/nV/Sha/odSPLRTKaNJxsa+eswe2RZyXUZCM=";
+        version = "1.0.29";
+        sha256 = "sha256-CP049/vi3CiiN6obOLMGtzRVaVzIiBo93WoRt8Ufe8c=";
       };
       beamDeps = [
         base64url
diff --git a/pkgs/by-name/ex/exim/package.nix b/pkgs/by-name/ex/exim/package.nix
index beb459c582b5..2ee910bcb939 100644
--- a/pkgs/by-name/ex/exim/package.nix
+++ b/pkgs/by-name/ex/exim/package.nix
@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "exim";
-  version = "4.98.2";
+  version = "4.99";
 
   src = fetchurl {
     url = "https://ftp.exim.org/pub/exim/exim4/${pname}-${version}.tar.xz";
-    hash = "sha256-iLjopnwdtswLHRSBYao25mL0yi/vJdW282lNSQ5C3K4=";
+    hash = "sha256-XfOLBC/6mpyNMbILyEgVWAcONhsG9ldghiKmKjJ63Lo=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ff/fflogs/package.nix b/pkgs/by-name/ff/fflogs/package.nix
index 0bd801ac94b0..8217a17819ff 100644
--- a/pkgs/by-name/ff/fflogs/package.nix
+++ b/pkgs/by-name/ff/fflogs/package.nix
@@ -6,10 +6,10 @@
 
 let
   pname = "fflogs";
-  version = "8.17.83";
+  version = "8.17.85";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-orVUCf7+OzJQ561maIYEBKgSgLuKfuSXFGMLZV/HMjM=";
+    hash = "sha256-vI2WI9CeupQf96GxW89D8Z8R/h1hB5Rfib2A+4Yd6zc=";
   };
   extracted = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/fl/flying-carpet/package.nix b/pkgs/by-name/fl/flying-carpet/package.nix
new file mode 100644
index 000000000000..d2c15aabcac2
--- /dev/null
+++ b/pkgs/by-name/fl/flying-carpet/package.nix
@@ -0,0 +1,84 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  fetchNpmDeps,
+  cargo-tauri,
+  glib-networking,
+  nodejs,
+  npmHooks,
+  openssl,
+  pkg-config,
+  webkitgtk_4_1,
+  wrapGAppsHook4,
+  copyDesktopItems,
+  makeDesktopItem,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "flying-carpet";
+  version = "9.0.0";
+
+  src = fetchFromGitHub {
+    owner = "spieglt";
+    repo = "FlyingCarpet";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xjTypnI6NXG4D3iaSEHcea2as3MSmKVo9x/4JTx9znc=";
+  };
+
+  cargoHash = "sha256-zoZS7rV5Pou9OmodLF8CqcEsAWFjSdtk/S5OXsnKKyg=";
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    nodejs
+    pkg-config
+    wrapGAppsHook4
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    glib-networking
+    openssl
+    webkitgtk_4_1
+  ];
+
+  checkFlags = [
+    "--skip"
+    "network"
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "FlyingCarpet";
+      desktopName = "FlyingCarpet";
+      exec = "FlyingCarpet";
+      icon = "FlyingCarpet";
+      categories = [ "Development" ];
+    })
+  ];
+
+  postInstall = ''
+    install -Dm644 "Flying Carpet/src-tauri/icons/32x32.png" "$out/share/icons/hicolor/32x32/apps/FlyingCarpet.png"
+    install -Dm644 "Flying Carpet/src-tauri/icons/128x128.png" "$out/share/icons/hicolor/128x128/apps/FlyingCarpet.png"
+    install -Dm644 "Flying Carpet/src-tauri/icons/128x128@2x.png" "$out/share/icons/hicolor/256x256@2/apps/FlyingCarpet.png"
+  '';
+
+  preFixup = ''
+    # https://github.com/tauri-apps/tauri/issues/9304
+    gappsWrapperArgs+=(--set WEBKIT_DISABLE_DMABUF_RENDERER 1)
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Send and receive files between Android, iOS, Linux, macOS, and Windows over ad hoc WiFi";
+    homepage = "https://github.com/spieglt/FlyingCarpet";
+    changelog = "https://github.com/spieglt/FlyingCarpet/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ ulysseszhan ];
+    platforms = lib.platforms.linux; # No darwin: https://github.com/spieglt/FlyingCarpet/issues/117
+    mainProgram = "FlyingCarpet";
+  };
+})
diff --git a/pkgs/by-name/ga/gargoyle/package.nix b/pkgs/by-name/ga/gargoyle/package.nix
index 3722c7a16240..63e8fdba53ea 100644
--- a/pkgs/by-name/ga/gargoyle/package.nix
+++ b/pkgs/by-name/ga/gargoyle/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchDebianPatch,
+  fetchpatch,
   cmake,
   pkg-config,
   fluidsynth,
@@ -36,6 +37,11 @@ stdenv.mkDerivation rec {
       patch = "ftbfs_gcc14.patch";
       hash = "sha256-eMx/RlUpq5Ez+1L8VZo40Y3h2ZKkqiQEmKTlkZRMXnI=";
     })
+    (fetchpatch {
+      name = "cmake4-fix";
+      url = "https://github.com/garglk/garglk/commit/8d976852e2db0215e9cf4f926e626f1aa766f751.patch?full_index=1";
+      hash = "sha256-lJAuiOErSp3oDmeoqrfCdnHH816VLYiVthIG4U8BJ5E=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/go/go-judge/package.nix b/pkgs/by-name/go/go-judge/package.nix
index 24877f211833..c106594e9c76 100644
--- a/pkgs/by-name/go/go-judge/package.nix
+++ b/pkgs/by-name/go/go-judge/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-judge";
-  version = "1.9.8";
+  version = "1.9.9";
 
   src = fetchFromGitHub {
     owner = "criyle";
     repo = "go-judge";
     rev = "v${version}";
-    hash = "sha256-hBOH5FDqzUGiCXucbTPBPXdEnHPq7fL0SYlY5b3OMHY=";
+    hash = "sha256-orYfnqtNvTIJLAfjrrRU6WT3wKzQCzYmCNEHC8OBlQo=";
   };
 
-  vendorHash = "sha256-dUJpNGJvvmIJuA6GSWhL4weQEwn5iM9k+y8clHdxhvY=";
+  vendorHash = "sha256-2mCd8ymY9l4A2wAe7+MVCsCqT92qIVHHHfkNJvEMg5k=";
 
   tags = [
     "nomsgpack"
diff --git a/pkgs/by-name/ha/harbor-cli/package.nix b/pkgs/by-name/ha/harbor-cli/package.nix
index 8b46de187513..f9a8e1403259 100644
--- a/pkgs/by-name/ha/harbor-cli/package.nix
+++ b/pkgs/by-name/ha/harbor-cli/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "harbor-cli";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchFromGitHub {
     owner = "goharbor";
     repo = "harbor-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TVuWSbBPRXq9icfMXEg0wONaqD5S2ge5DQiDHSlrADk=";
+    hash = "sha256-86qRXxCLcmVpO/fdmVGxiqVFrAQYIFlNHLxnoBgY9+k=";
   };
 
   vendorHash = "sha256-Pj573V6S2LaytQMK0jGVyLMX/GBZ1GOmYV/LPO1ScS4=";
diff --git a/pkgs/by-name/ig/igv/package.nix b/pkgs/by-name/ig/igv/package.nix
index f15fb382ce18..6806f71193ef 100644
--- a/pkgs/by-name/ig/igv/package.nix
+++ b/pkgs/by-name/ig/igv/package.nix
@@ -10,10 +10,10 @@
 
 stdenv.mkDerivation rec {
   pname = "igv";
-  version = "2.19.6";
+  version = "2.19.7";
   src = fetchzip {
     url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-hemTOCNBfigpvlFStBbxGGLpORYPfh6vn1pyE8hKWHw=";
+    sha256 = "sha256-IkzaQAM+s1boEKo/3ShtbUhihrhxLQCTz8/0lzAyYJA=";
   };
 
   installPhase = ''
diff --git a/pkgs/games/instawow/default.nix b/pkgs/by-name/in/instawow/package.nix
similarity index 84%
rename from pkgs/games/instawow/default.nix
rename to pkgs/by-name/in/instawow/package.nix
index 36d8e6b3cdc4..8a947eff0e16 100644
--- a/pkgs/games/instawow/default.nix
+++ b/pkgs/by-name/in/instawow/package.nix
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "layday";
     repo = "instawow";
     tag = "v${version}";
-    sha256 = "sha256-NFs8+BUXJEn64TDojG/xkH1O+zZurv0PWY+YDhu2mQY=";
+    hash = "sha256-NFs8+BUXJEn64TDojG/xkH1O+zZurv0PWY+YDhu2mQY=";
   };
 
   extras = [ ]; # Disable GUI, most dependencies are not packaged.
@@ -44,11 +44,11 @@ python3.pkgs.buildPythonApplication rec {
     ]
     ++ plugins;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/layday/instawow";
     description = "World of Warcraft add-on manager CLI and GUI";
     mainProgram = "instawow";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ seirl ];
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ seirl ];
   };
 }
diff --git a/pkgs/games/iortcw/default.nix b/pkgs/by-name/io/iortcw/package.nix
similarity index 100%
rename from pkgs/games/iortcw/default.nix
rename to pkgs/by-name/io/iortcw/package.nix
diff --git a/pkgs/games/iortcw/sp.nix b/pkgs/by-name/io/iortcw/sp.nix
similarity index 100%
rename from pkgs/games/iortcw/sp.nix
rename to pkgs/by-name/io/iortcw/sp.nix
diff --git a/pkgs/games/koboredux/default.nix b/pkgs/by-name/ko/koboredux/package.nix
similarity index 98%
rename from pkgs/games/koboredux/default.nix
rename to pkgs/by-name/ko/koboredux/package.nix
index d694266934cf..e51cf8a042e9 100644
--- a/pkgs/games/koboredux/default.nix
+++ b/pkgs/by-name/ko/koboredux/package.nix
@@ -14,7 +14,6 @@
 
 let
   inherit (lib)
-    and
     licenses
     maintainers
     optional
@@ -27,8 +26,8 @@ let
 
   main_src = fetchFromGitHub {
     owner = "olofson";
-    repo = pname;
-    rev = "v${version}";
+    repo = "koboredux";
+    tag = "v${version}";
     sha256 = "09h9r65z8bar2z89s09j6px0gdq355kjf38rmd85xb2aqwnm6xig";
   };
 
diff --git a/pkgs/by-name/le/ledfx/package.nix b/pkgs/by-name/le/ledfx/package.nix
index 68840bed9e5f..4d4ac302d230 100644
--- a/pkgs/by-name/le/ledfx/package.nix
+++ b/pkgs/by-name/le/ledfx/package.nix
@@ -1,19 +1,28 @@
 {
   lib,
-  fetchPypi,
+  fetchFromGitHub,
   python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ledfx";
-  version = "2.0.111";
+  version = "2.1.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-b6WHulQa1er0DpMfeJLqqb4z8glUt1dHvvNigXgrf7Y=";
+  src = fetchFromGitHub {
+    owner = "LedFx";
+    repo = "LedFx";
+    tag = "v${version}";
+    hash = "sha256-N9EHK0GVohFCjEKsm3g4h+4XWfzZO1tzdd2z5IN1YjI=";
   };
 
+  postPatch = ''
+    substituteInPlace tests/conftest.py \
+      --replace-fail '"uv",' "" \
+      --replace-fail '"run",' "" \
+      --replace-fail '"ledfx",' "\"$out/bin/ledfx\","
+  '';
+
   pythonRelaxDeps = true;
 
   pythonRemoveDeps = [
@@ -27,43 +36,49 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   dependencies = with python3.pkgs; [
+    # sorted like in pyproject.toml in upstream
+    numpy
+    cffi
     aiohttp
     aiohttp-cors
     aubio
     certifi
-    flux-led
-    python-dotenv
-    icmplib
-    mss
     multidict
-    netifaces2
-    numpy
     openrgb-python
     paho-mqtt
-    pillow
     psutil
-    pybase64
     pyserial
     pystray
-    python-mbedtls
-    python-osc
     python-rtmidi
-    # rpi-ws281x # not packaged
     requests
     sacn
-    samplerate
     sentry-sdk
-    setuptools
     sounddevice
-    stupidartnet
-    uvloop
-    vnoise
+    samplerate
+    icmplib
     voluptuous
     zeroconf
+    pillow
+    flux-led
+    python-osc
+    pybase64
+    mss
+    uvloop
+    stupidartnet
+    python-dotenv
+    vnoise
+    netifaces2
+    packaging
   ];
 
-  # Project has no tests
-  doCheck = false;
+  optional-dependencies = {
+    hue = with pyproject.pkgs; [ python-mbedtls ];
+  };
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   meta = {
     description = "Network based LED effect controller with support for advanced real-time audio effects";
diff --git a/pkgs/games/linthesia/default.nix b/pkgs/by-name/li/linthesia/package.nix
similarity index 78%
rename from pkgs/games/linthesia/default.nix
rename to pkgs/by-name/li/linthesia/package.nix
index a214c80b7792..013366e8ff40 100644
--- a/pkgs/games/linthesia/default.nix
+++ b/pkgs/by-name/li/linthesia/package.nix
@@ -18,7 +18,7 @@
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "linthesia";
   version = "unstable-2023-05-23";
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "linthesia";
     repo = "linthesia";
     rev = "1f2701241f8865c2f5c14a97b81ae64884cf0396";
-    sha256 = "sha256-3uPcpDUGtAGW9q/u8Cn+0bNqikII1Y/a0PKARW/5nao=";
+    hash = "sha256-3uPcpDUGtAGW9q/u8Cn+0bNqikII1Y/a0PKARW/5nao=";
   };
 
   postPatch = ''
@@ -52,12 +52,12 @@ stdenv.mkDerivation rec {
     gtk3.out # icon cache
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Game of playing music using a MIDI keyboard following a MIDI file";
     mainProgram = "linthesia";
-    inherit (src.meta) homepage;
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    inherit (finalAttrs.src.meta) homepage;
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index e45a22e0aefb..7de7a14e7b25 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -75,13 +75,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "6821";
+  version = "6869";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-HqrX7xOYsF0UUF12c8KgIM2HMeTm1XxiFPuz/PaToI0=";
+    hash = "sha256-LZSeejn1IPybmfoRsOhg1YpTCFl0LrRJZyKT8ECbVjo=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
diff --git a/pkgs/by-name/lz/lzbench/package.nix b/pkgs/by-name/lz/lzbench/package.nix
index a9af016a7097..70403dc903d2 100644
--- a/pkgs/by-name/lz/lzbench/package.nix
+++ b/pkgs/by-name/lz/lzbench/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lzbench";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "inikep";
     repo = "lzbench";
     rev = "v${version}";
-    sha256 = "sha256-JyK5Hah3X4zwmli44HEO62BYfNg7BBd0+DLlljeHmRc=";
+    sha256 = "sha256-CmT+mjFKf8/HE00re1QzU2pwdUYR8Js1kN4y6c2ZiNY=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index 1b8e7e4ab3a6..e2dc15a2ead6 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -18,11 +18,11 @@
     # the version regex here as well.
     #
     # Ensure you also check ../mattermostLatest/package.nix.
-    regex = "^v(10\\.5\\.[0-9]+)$";
-    version = "10.5.12";
-    srcHash = "sha256-VaW+rA0UeIZhGU9BlYZgyznAOtLN+JI7UPbMRPCwTww=";
-    vendorHash = "sha256-vxUxSkj1EwgMtPpCGJSA9jCDBeLrWhecdwq4KBThhj4=";
-    npmDepsHash = "sha256-tIeuDUZbqgqooDm5TRfViiTT5OIyN0BPwvJdI+wf7p0=";
+    regex = "^v(10\\.11\\.[0-9]+)$";
+    version = "10.11.4";
+    srcHash = "sha256-gSVoO0paAwvxEeZkcCP81oxMcSu/H8n3Tr+2OEXuFyM=";
+    vendorHash = "sha256-DS4OC3eQffD/8yLE01gnTJXwV77G7rWk4kqA/rTCtJw=";
+    npmDepsHash = "sha256-p9dq31qw0EZDQIl2ysKE38JgDyLA6XvSv+VtHuRh+8A=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
     '';
diff --git a/pkgs/by-name/ma/mattermost/tests.nix b/pkgs/by-name/ma/mattermost/tests.nix
index 85d3003fa8c8..53ccc82ab558 100644
--- a/pkgs/by-name/ma/mattermost/tests.nix
+++ b/pkgs/by-name/ma/mattermost/tests.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   mattermost,
   gotestsum,
   which,
@@ -12,16 +11,10 @@
   runtimeShell,
 }:
 
-let
-  inherit (lib.lists) optionals;
-  inherit (lib.strings) versionAtLeast;
-  is10 = version: versionAtLeast version "10.0";
-in
 mattermost.overrideAttrs (
   final: prev: {
     doCheck = true;
     checkTargets = [
-      "test-server"
       "test-mmctl"
     ];
     nativeCheckInputs = [
@@ -52,113 +45,17 @@ mattermost.overrideAttrs (
     # X  TestFoo
     # X  TestFoo/TestBar
     # -> TestFoo/TestBar/baz_test
-    disabledTests = [
+    disabledTests = lib.lists.uniqueStrings [
       # All these plugin tests for mmctl reach out to the marketplace, which is impossible in the sandbox
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Plugin/SystemAdminClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Plugin/LocalClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_a_Plugin_without_permissions"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Unknown_Plugin/SystemAdminClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Unknown_Plugin/LocalClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_new_plugins/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_new_plugins/LocalClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_without_force/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_without_force/LocalClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_with_force/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_with_force/LocalClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd/install_a_plugin/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd/install_a_plugin/LocalClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd/List_Marketplace_Plugins_for_Admin_User/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd/List_Marketplace_Plugins_for_Admin_User/LocalClient"
-
-      # Seems to just be broken.
-      "TestMmctlE2ESuite/TestPreferenceUpdateCmd"
-
-      # Has a hardcoded "google.com" test which also verifies that the address isn't loopback,
-      # so we also can't just substituteInPlace to one that will resolve
-      "TestDialContextFilter"
-
-      # No interfaces but loopback in the sandbox, so returns empty
-      "TestGetServerIPAddress"
-
-      # S3 bucket tests (needs Minio)
-      "TestInsecureMakeBucket"
-      "TestMakeBucket"
-      "TestListDirectory"
-      "TestTimeout"
-      "TestStartServerNoS3Bucket"
-      "TestS3TestConnection"
-      "TestS3FileBackendTestSuite"
-      "TestS3FileBackendTestSuiteWithEncryption"
-      "TestWriteFileVideoMimeTypes"
-
-      # Mail tests (needs a SMTP server)
-      "TestSendMailUsingConfig"
-      "TestSendMailUsingConfigAdvanced"
-      "TestSendMailWithEmbeddedFilesUsingConfig"
-      "TestSendCloudWelcomeEmail"
-      "TestMailConnectionAdvanced"
-      "TestMailConnectionFromConfig"
-      "TestEmailTest"
-      "TestBasicAPIPlugins/test_send_mail_plugin"
-
-      # Seems to be unreliable
-      "TestPluginAPIUpdateUserPreferences"
-      "TestPluginAPIGetUserPreferences"
-
-      # These invite tests try to send a welcome email and we don't have a SMTP server up.
-      "TestInviteUsersToTeam"
-      "TestInviteGuestsToTeam"
-      "TestSendInviteEmails"
-      "TestDeliver"
-
-      # https://github.com/mattermost/mattermost/issues/29184
-      "TestUpAndDownMigrations/Should_be_reversible_for_mysql"
-    ]
-    ++ optionals (is10 final.version) [
-      ## mattermostLatest test ignores
-
-      # These bot related tests appear to be broken.
-      "TestCreateBot"
-      "TestPatchBot"
-      "TestGetBot"
-      "TestEnableBot"
-      "TestDisableBot"
-      "TestAssignBot"
-      "TestConvertBotToUser"
-
-      # Need Elasticsearch or Opensearch
-      "TestBlevePurgeIndexes"
-      "TestOpensearchAggregation"
-      "TestOpensearchInterfaceTestSuite"
-      "TestOpenSearchIndexerJobIsEnabled"
-      "TestOpenSearchIndexerPending"
-      "TestBulkProcessor"
-      "TestElasticsearchAggregation"
-      "TestElasticsearchInterfaceTestSuite"
-      "TestElasticSearchIndexerJobIsEnabled"
-      "TestElasticSearchIndexerPending"
-
-      # Broken in the sandbox.
-      "TestVersion"
-      "TestRunServerNoSystemd"
-
-      # Appear to be broken.
-      "TestSessionStore/MySQL"
-      "TestAccessControlPolicyStore/MySQL"
-      "TestAttributesStore/MySQL"
-      "TestBasicAPIPlugins"
-
-      "TestRunExportJobE2EByType"
-      "TestUpdateTeam"
-      "TestSyncSyncableRoles"
-    ]
-    ++ optionals (!stdenv.hostPlatform.isx86_64) [
-      # aarch64: invalid operating system or processor architecture
-      "TestCanIUpgradeToE0"
-
-      # aarch64: thumbnail previews are nondeterministic
-      "TestUploadFiles/multipart_Happy_image_thumbnail"
-      "TestUploadFiles/simple_Happy_image_thumbnail"
+      "TestMmctlE2ESuite/TestPluginInstallURLCmd"
+      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd"
+      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd"
+      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd"
     ];
 
     preCheck = ''
@@ -378,7 +275,7 @@ mattermost.overrideAttrs (
 
       # Ensure we parallelize the tests, and skip the correct ones.
       # Spaces are important here due to how the Makefile works.
-      export GOFLAGS=" -parallel=$NIX_BUILD_CORES -skip='$(echo "$disabledTests" | tr ' ' '|')' "
+      export GOFLAGS=" -p=$NIX_BUILD_CORES -parallel=$NIX_BUILD_CORES -skip='$(echo "$disabledTests" | tr ' ' '|')' "
 
       # ce n'est pas un conteneur
       MMCTL_TESTFLAGS="$GOFLAGS" MM_NO_DOCKER=true make $checkTargets
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index 726da1dfb70c..47305a7125eb 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -10,11 +10,11 @@ mattermost.override {
     # See https://docs.mattermost.com/about/mattermost-server-releases.html
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
-    regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.12.1";
-    srcHash = "sha256-PL55NKypsLA+H19cS99iIsMI3IBb6vLvAbAVLZyg+sE=";
-    vendorHash = "sha256-DS4OC3eQffD/8yLE01gnTJXwV77G7rWk4kqA/rTCtJw=";
-    npmDepsHash = "sha256-O9iX6hnwkEHK0kkHqWD6RYXqoSEW6zs+utiYHnt54JY=";
+    regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
+    version = "11.0.2";
+    srcHash = "sha256-2w9v/ktmqSwzcylq8ayRDZD5BsHo9tBL+9X3GRNlvd0=";
+    vendorHash = "sha256-JkQvj92q5FZjQWB5gGCsAz7EpHO+IckBSFoFEFi3v0A=";
+    npmDepsHash = "sha256-YU6FDsMX0QIGFatUDRos/AkgwljIBeI5w/TJt/lglw0=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
     '';
diff --git a/pkgs/games/mudlet/default.nix b/pkgs/by-name/mu/mudlet/package.nix
similarity index 87%
rename from pkgs/games/mudlet/default.nix
rename to pkgs/by-name/mu/mudlet/package.nix
index f8638aaff306..90cc8791a155 100644
--- a/pkgs/games/mudlet/default.nix
+++ b/pkgs/by-name/mu/mudlet/package.nix
@@ -6,20 +6,16 @@
   cmake,
   git,
   pkg-config,
-  qttools,
   which,
-  wrapQtAppsHook,
   boost,
   hunspell,
   libGLU,
   libsForQt5,
   libsecret,
   libzip,
-  lua,
+  lua5_1,
   pcre,
   pugixml,
-  qtbase,
-  qtmultimedia,
   discord-rpc,
   yajl,
   withDiscordRpc ? false,
@@ -43,7 +39,7 @@ let
         });
       };
     in
-    lua.override { inherit packageOverrides; };
+    lua5_1.override { inherit packageOverrides; };
 
   luaEnv = overrideLua.withPackages (
     ps: with ps; [
@@ -56,14 +52,14 @@ let
     ]
   );
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mudlet";
   version = "4.19.1";
 
   src = fetchFromGitHub {
     owner = "Mudlet";
     repo = "Mudlet";
-    rev = "Mudlet-${version}";
+    rev = "Mudlet-${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-I4RRIfHw9kZwxMlc9pvdtwPpq9EvNJU69WpGgZ+0uiw=";
   };
@@ -81,9 +77,9 @@ stdenv.mkDerivation rec {
     git
     luaEnv
     pkg-config
-    qttools
+    libsForQt5.qttools
     which
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -96,8 +92,8 @@ stdenv.mkDerivation rec {
     luaEnv
     pcre
     pugixml
-    qtbase
-    qtmultimedia
+    libsForQt5.qtbase
+    libsForQt5.qtmultimedia
     yajl
   ]
   ++ lib.optional withDiscordRpc discord-rpc;
@@ -129,7 +125,7 @@ stdenv.mkDerivation rec {
     cp -r src/mudlet.app/ $out/Applications/mudlet.app
     mv $out/Applications/mudlet.app/Contents/MacOS/mudlet $out/Applications/mudlet.app/Contents/MacOS/mudlet-unwrapped
     makeQtWrapper $out/Applications/Mudlet.app/Contents/MacOS/mudlet-unwrapped $out/Applications/Mudlet.app/Contents/MacOS/mudlet \
-      --set LUA_CPATH "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \
+      --set LUA_CPATH "${luaEnv}/lib/lua/${lua5_1.luaversion}/?.so" \
       --prefix LUA_PATH : "$NIX_LUA_PATH" \
       --prefix DYLD_LIBRARY_PATH : "${
         lib.makeLibraryPath (
@@ -146,7 +142,7 @@ stdenv.mkDerivation rec {
     mkdir -pv $out/bin
     cp src/mudlet $out/bin/mudlet-unwrapped
     makeQtWrapper $out/bin/mudlet-unwrapped $out/bin/mudlet \
-      --set LUA_CPATH "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \
+      --set LUA_CPATH "${luaEnv}/lib/lua/${lua5_1.luaversion}/?.so" \
       --prefix LUA_PATH : "$NIX_LUA_PATH" \
       --prefix LD_LIBRARY_PATH : "${
         lib.makeLibraryPath (
@@ -166,18 +162,18 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Crossplatform mud client";
     homepage = "https://www.mudlet.org/";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       wyvie
       pstn
       cpu
       felixalbrigtsen
     ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = with lib.platforms; linux ++ darwin;
     broken = stdenv.hostPlatform.isDarwin;
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
     mainProgram = "mudlet";
   };
-}
+})
diff --git a/pkgs/by-name/my/mymake/package.nix b/pkgs/by-name/my/mymake/package.nix
new file mode 100644
index 000000000000..d30ec4f40f85
--- /dev/null
+++ b/pkgs/by-name/my/mymake/package.nix
@@ -0,0 +1,45 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mymake";
+  version = "2.3.6";
+
+  src = fetchFromGitHub {
+    owner = "fstromback";
+    repo = "mymake";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UQjvxdOvD9O6TrzBFJwh3CistDGZM9HZbcwVPx1n4+A=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    ./compile.sh mm
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 mm $out/bin/mm
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for compiling and running programs with minimal configuration";
+    homepage = "https://github.com/fstromback/mymake";
+    maintainers = [ lib.maintainers.nobbele ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "mm";
+  };
+})
diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix
index c7ed5567b802..22a1752e0df7 100644
--- a/pkgs/by-name/my/mysql84/package.nix
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.4.6";
+  version = "8.4.7";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-oeUj3IvpbRilreEGmYZhKFygG29bRsCLJlQRDkDfL7c=";
+    hash = "sha256-wL8zqUzbkI8UmuoHl6/7GxOSYszw4Ll4ehckYgdULmk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/games/npush/default.nix b/pkgs/by-name/np/npush/package.nix
similarity index 79%
rename from pkgs/games/npush/default.nix
rename to pkgs/by-name/np/npush/package.nix
index 137f8d041165..b8ef0bbe4ad9 100644
--- a/pkgs/games/npush/default.nix
+++ b/pkgs/by-name/np/npush/package.nix
@@ -5,12 +5,12 @@
   ncurses,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "npush";
   version = "0.7";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/npush/${pname}/${version}/${pname}-${version}.tgz";
+    url = "mirror://sourceforge/project/npush/npush/${finalAttrs.version}/npush-${finalAttrs.version}.tgz";
     hash = "sha256-8hbSsyeehzd4T3fUhDyebyI/oTHOHr3a8ArYAquivNk=";
   };
 
@@ -42,13 +42,13 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://npush.sourceforge.net/";
     description = "Sokoban-like game";
     mainProgram = "npush";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
     maintainers = [ ];
-    platforms = with platforms; unix;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/games/npush/run.nix b/pkgs/by-name/np/npush/run.nix
similarity index 100%
rename from pkgs/games/npush/run.nix
rename to pkgs/by-name/np/npush/run.nix
diff --git a/pkgs/by-name/nt/ntfy/package.nix b/pkgs/by-name/nt/ntfy/package.nix
index 5d2d50e9ae06..d21624f41393 100644
--- a/pkgs/by-name/nt/ntfy/package.nix
+++ b/pkgs/by-name/nt/ntfy/package.nix
@@ -1,9 +1,9 @@
 {
   lib,
   stdenv,
-  python3,
+  python3Packages,
   fetchFromGitHub,
-  fetchpatch,
+  writableTmpDirAsHomeHook,
   withXmpp ? false, # sleekxmpp doesn't support python 3.10, see https://github.com/dschep/ntfy/issues/266
   withMatrix ? true,
   withSlack ? true,
@@ -12,74 +12,29 @@
   withDbus ? stdenv.hostPlatform.isLinux,
 }:
 
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      ntfy-webpush = self.callPackage ./webpush.nix { };
-
-      # databases, on which slack-sdk depends, is incompatible with SQLAlchemy 2.0
-      sqlalchemy = super.sqlalchemy_1_4;
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "ntfy";
-  version = "2.7.0";
+  version = "2.7.1";
 
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dschep";
     repo = "ntfy";
-    rev = "v${version}";
-    sha256 = "09f02cn4i1l2aksb3azwfb70axqhn7d0d0vl2r6640hqr74nc1cv";
+    tag = "v${version}";
+    hash = "sha256-EIhoZ2tFJQOc5PyRCazwRhldFxQb65y6h+vYPwV7ReE=";
   };
 
-  patches = [
-    # Fix Slack integration no longer working.
-    # From https://github.com/dschep/ntfy/pull/229 - "Swap Slacker for Slack SDK"
-    (fetchpatch {
-      name = "ntfy-Swap-Slacker-for-Slack-SDK.patch";
-      url = "https://github.com/dschep/ntfy/commit/2346e7cfdca84c8f1afc7462a92145c1789deb3e.patch";
-      sha256 = "13k7jbsdx0jx7l5s8whirric76hml5bznkfcxab5xdp88q52kpk7";
-    })
-    # Add compatibility with emoji 2.0
-    # https://github.com/dschep/ntfy/pull/250
-    (fetchpatch {
-      name = "ntfy-Add-compatibility-with-emoji-2.0.patch";
-      url = "https://github.com/dschep/ntfy/commit/4128942bb7a706117e7154a50a73b88f531631fe.patch";
-      sha256 = "sha256-V8dIy/K957CPFQQS1trSI3gZOjOcVNQLgdWY7g17bRw=";
-    })
-    # Change getargspec to getfullargspec for python 3.11 compatibility
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/commit/71be9766ea041d2df6ebbce2781f980eea002852.patch";
-      hash = "sha256-6OChaTj4g3gxVDScc/JksBISHuq+5fbNQregchSXYaQ=";
-    })
-    # Fix compatibility with Python 3.11
-    # https://github.com/dschep/ntfy/pull/271
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/pull/271/commits/444b60bec7de474d029cac184e82885011dd1474.patch";
-      hash = "sha256-PKTu8cOpws1z6f1T4uIi2iCJAoAwu+X0Pe7XnHYtHuI=";
-    })
-    # Fix compatibility with Python 3.12
-    # https://github.com/dschep/ntfy/pull/271
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/pull/271/commits/d49ab9f9dba4966a44b5f0c6911741edabd35f6b.patch";
-      hash = "sha256-qTUWMS8EXWYCK/ZL0Us7iJp62UIKwYT1BqDy59832ig=";
-    })
-  ];
-
   postPatch = ''
     # We disable the Darwin specific things because it relies on pyobjc, which we don't have.
     substituteInPlace setup.py \
       --replace-fail "':sys_platform == \"darwin\"'" "'darwin'"
   '';
 
-  build-system = with python.pkgs; [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
   dependencies =
-    with python.pkgs;
+    with python3Packages;
     (
       [
         requests
@@ -108,30 +63,32 @@ python.pkgs.buildPythonApplication rec {
       ]
     );
 
-  nativeCheckInputs = with python.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     mock
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   disabledTests = [
+    # AssertionError: {'backends': ['default']} != {}
+    "test_default_config"
+  ]
+  ++ lib.optionals (!withXmpp) [
     "test_xmpp"
   ];
 
-  disabledTestPaths = [
+  disabledTestPaths = lib.optionals (!withXmpp) [
     "tests/test_xmpp.py"
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   pythonImportsCheck = [ "ntfy" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/dschep/ntfy/releases/tag/${src.tag}";
     description = "Utility for sending notifications, on demand and when commands finish";
     homepage = "https://ntfy.readthedocs.io/en/latest/";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ kamilchm ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ kamilchm ];
     mainProgram = "ntfy";
   };
 }
diff --git a/pkgs/by-name/op/openscad-unstable/package.nix b/pkgs/by-name/op/openscad-unstable/package.nix
index 7f64438b8078..0184ab5753c6 100644
--- a/pkgs/by-name/op/openscad-unstable/package.nix
+++ b/pkgs/by-name/op/openscad-unstable/package.nix
@@ -44,33 +44,29 @@
   ctestCheckHook,
 }:
 # clang consume much less RAM than GCC
-clangStdenv.mkDerivation rec {
-  pname = "openscad-unstable";
-  version = "2025-06-04";
-  src = fetchFromGitHub {
-    owner = "openscad";
-    repo = "openscad";
-    rev = "65856c9330f8cc4ffcaccf03d91b4217f2eae28d";
-    hash = "sha256-jozcLFGVSfw8G12oSxHjqUyFtAfENgIByID+omk08mU=";
-    fetchSubmodules = true; # Only really need sanitizers-cmake and MCAD and manifold
-  };
-
-  patches = [ ./test.diff ];
-
-  # fix use of our lib3mf cmake export instead of finder
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace-fail \
-      "Lib3MF" \
-      "lib3mf"
-  '';
-
-  nativeBuildInputs = [
-    (python3.withPackages (
+let
+  python3withPackages = (
+    python3.withPackages (
       ps: with ps; [
         numpy
         pillow
       ]
-    ))
+    )
+  );
+in
+clangStdenv.mkDerivation rec {
+  pname = "openscad-unstable";
+  version = "2021.01-unstable-2025-10-27";
+  src = fetchFromGitHub {
+    owner = "openscad";
+    repo = "openscad";
+    rev = "aa785fe4ab3d52450a5e51eb73585ac9bbcc8798";
+    hash = "sha256-TngfItArYtm8243DdYkQlkfc/MBTZGYrf08hfloWRWk=";
+    fetchSubmodules = true; # Only really need sanitizers-cmake and MCAD and manifold
+  };
+
+  nativeBuildInputs = [
+    python3withPackages
     bison
     cmake
     flex
@@ -134,6 +130,10 @@ clangStdenv.mkDerivation rec {
     # The sources enable this for only apple. We turn it off globally anyway to stay
     # consistent.
     "-DUSE_QT6=OFF"
+
+    # For tests
+    "-DVENV_DIR=${python3withPackages}"
+    "-DVENV_BIN_PATH=${python3withPackages}/bin"
   ];
 
   # tests rely on sysprof which is not available on darwin
@@ -147,6 +147,12 @@ clangStdenv.mkDerivation rec {
       done )
   '';
 
+  postPatch = ''
+    # Take Python3 executable as passed
+    sed -e '/set(VENV_DIR /d' -i tests/cmake/ImageCompare.cmake
+    sed -e '/find_path(VENV_BIN_PATH /d' -i tests/cmake/ImageCompare.cmake
+  '';
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/Applications
     mv $out/bin/*.app $out/Applications
diff --git a/pkgs/by-name/op/openscad-unstable/test.diff b/pkgs/by-name/op/openscad-unstable/test.diff
deleted file mode 100644
index 23b3983daddd..000000000000
--- a/pkgs/by-name/op/openscad-unstable/test.diff
+++ /dev/null
@@ -1,42 +0,0 @@
-diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
-index 5c1b40af4..917451dee 100644
---- a/tests/CMakeLists.txt
-+++ b/tests/CMakeLists.txt
-@@ -59,13 +59,14 @@ if(USE_IMAGE_COMPARE_PY)
- 
-   # Since msys2 on Windows prefers bin/ over Scripts, we need to look for the actual folder to determine
-   # how to utilize the venv
--  find_path(VENV_BIN_PATH activate PATHS "${VENV_DIR}/bin" "${VENV_DIR}/Scripts" NO_DEFAULT_PATH NO_CACHE)
--  if(WIN32)
--    set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python.exe")
--  else()
--    set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python")
--  endif()
--  if(EXISTS "${IMAGE_COMPARE_EXE}")
-+  # find_path(VENV_BIN_PATH activate PATHS "${VENV_DIR}/bin" "${VENV_DIR}/Scripts" NO_DEFAULT_PATH NO_CACHE)
-+  # if(WIN32)
-+  #   set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python.exe")
-+  # else()
-+  #   set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python")
-+  # endif()
-+  set(IMAGE_COMPARE_EXE "python3")
-+  # if(EXISTS "${IMAGE_COMPARE_EXE}")
-     message(STATUS "venv found, testing libraries")
-     execute_process(
-       COMMAND "${IMAGE_COMPARE_EXE}" "${CCSD}/image_compare.py" "--status"
-@@ -77,10 +78,10 @@ if(USE_IMAGE_COMPARE_PY)
-       message(STATUS "venv libraries complete")
-       set(BUILD_VENV FALSE)
-     endif()
--  else()
--    message(STATUS "venv not found")
--    set(BUILD_VENV TRUE)
--  endif()
-+  # else()
-+  #   message(STATUS "venv not found")
-+  #   set(BUILD_VENV TRUE)
-+  # endif()
-   if(BUILD_VENV)
-     message(STATUS "Setting up testing venv for image comparison")
-     execute_process(
-
diff --git a/pkgs/games/openxcom/default.nix b/pkgs/by-name/op/openxcom/package.nix
similarity index 96%
rename from pkgs/games/openxcom/default.nix
rename to pkgs/by-name/op/openxcom/package.nix
index e17ea01a0e8d..275c1191ef8c 100644
--- a/pkgs/games/openxcom/default.nix
+++ b/pkgs/by-name/op/openxcom/package.nix
@@ -7,7 +7,7 @@
   libGL,
   openssl,
   pkg-config,
-  SDL,
+  SDL_compat,
   SDL_image,
   SDL_mixer,
   SDL_gfx,
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     boost
     libGL
     libGLU
-    SDL
+    SDL_compat
     SDL_gfx
     SDL_image
     SDL_mixer
diff --git a/pkgs/by-name/ov/ovftool/package.nix b/pkgs/by-name/ov/ovftool/package.nix
index 23c18565c499..fe4888375a97 100644
--- a/pkgs/by-name/ov/ovftool/package.nix
+++ b/pkgs/by-name/ov/ovftool/package.nix
@@ -33,13 +33,13 @@ let
       fileName,
       version,
       toolId ? ovftoolId,
-      artifactId ? 21342,
+      artifactId ? 29161,
       fileType ? "Download",
       source ? "",
       hash ? "",
     }:
     let
-      requestJson = builtins.toJSON {
+      requestJson = lib.strings.toJSON {
         inherit
           fileName
           artifactId
@@ -73,14 +73,14 @@ let
 
   ovftoolSystems = {
     "x86_64-linux" = rec {
-      version = "4.6.3-24031167";
+      version = "5.0.0-24781994";
       fileName = "VMware-ovftool-${version}-lin.x86_64.zip";
-      hash = "sha256-NEwwgmEh/mrZkMMhI+Kq+SYdd3MJ0+IBLdUhd1+kPow=";
+      hash = "sha256-I389VdRZQH9BJT/qxSyUPlRZC7MHv++TDc8rJ1jY788=";
     };
     "x86_64-darwin" = rec {
-      version = "4.6.3-24031167";
+      version = "5.0.0-24781994";
       fileName = "VMware-ovftool-${version}-mac.x64.zip";
-      hash = "sha256-vhACcc4tjaQhvKwZyWkgpaKaoC+coWGl1zfSIC6WebM=";
+      hash = "sha256-vfhagEOnTGxOsY8kFY555c8EhI12GwQ2JwgTjEz7UT0=";
     };
   };
 
@@ -158,9 +158,7 @@ stdenv.mkDerivation (final: {
     # libgoogleurl and libcurl.
     #
     # FIXME: Replace libgoogleurl? Possibly from Chromium?
-    # FIXME: Tell VMware to use a modern version of OpenSSL on macOS. As of ovftool
-    # v4.6.3 ovftool uses openssl-1.0.2zj which in seems to be the extended
-    # support LTS release: https://www.openssl.org/support/contracts.html
+    # FIXME: Tell VMware to use a modern version of OpenSSL on macOS.
 
     # Install all libs that are not patched in preFixup.
     # Darwin dylibs are under `lib` in the zip.
@@ -174,7 +172,7 @@ stdenv.mkDerivation (final: {
     libvmacore.so \
     libvmomi.so
   ''
-  # macOS still relies on OpenSSL 1.0.2 as of v4.6.3, but Linux is in the clear
+  # macOS still relies on OpenSSL 1.0.2 as of v4.6.3 and later, but Linux is in the clear
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     lib/libcrypto.1.0.2.dylib \
     lib/libgoogleurl.59.0.30.45.2.dylib \
@@ -326,24 +324,24 @@ stdenv.mkDerivation (final: {
       set +x
     '';
 
-  meta = with lib; {
+  meta = {
     description = "VMware tools for working with OVF, OVA, and VMX images";
     homepage = "https://developer.vmware.com/web/tool/ovf-tool/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
       numinit
       thanegill
     ];
-    platforms = builtins.attrNames ovftoolSystems;
+    platforms = lib.attrNames ovftoolSystems;
     mainProgram = "ovftool";
-    knownVulnerabilities = lib.optionals (stdenv.hostPlatform.isDarwin) [
-      "The bundled version of openssl 1.0.2zj in ovftool for Darwin has open vulnerabilities."
+    knownVulnerabilities = lib.optionals stdenv.hostPlatform.isDarwin [
+      "The bundled version of openssl 1.0.2zk in ovftool for Darwin has open vulnerabilities (maximum severity: Moderate)"
       "https://openssl-library.org/news/vulnerabilities-1.0.2/"
-      "CVE-2024-0727"
-      "CVE-2024-5535"
+      "Please nag Broadcom to update to OpenSSL 3 for Darwin."
       "CVE-2024-9143"
       "CVE-2024-13176"
+      "CVE-2025-9230"
     ];
   };
 })
diff --git a/pkgs/by-name/pa/parcellite/package.nix b/pkgs/by-name/pa/parcellite/package.nix
deleted file mode 100644
index a39b4d9f8ac8..000000000000
--- a/pkgs/by-name/pa/parcellite/package.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoreconfHook,
-  gtk2,
-  hicolor-icon-theme,
-  intltool,
-  pkg-config,
-  which,
-  wrapGAppsHook3,
-  xdotool,
-  libappindicator-gtk2,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "parcellite";
-  version = "1.2.1";
-
-  src = fetchFromGitHub {
-    owner = "rickyrockrat";
-    repo = "parcellite";
-    rev = version;
-    sha256 = "19q4x6x984s6gxk1wpzaxawgvly5vnihivrhmja2kcxhzqrnfhiy";
-  };
-
-  nativeBuildInputs = [
-    autoreconfHook
-    intltool
-    pkg-config
-    wrapGAppsHook3
-  ];
-  buildInputs = [
-    gtk2
-    hicolor-icon-theme
-    libappindicator-gtk2
-  ];
-  NIX_LDFLAGS = "-lgio-2.0";
-
-  preFixup = ''
-    # Need which and xdotool on path to fix auto-pasting.
-    gappsWrapperArgs+=(--prefix PATH : "${which}/bin:${xdotool}/bin")
-  '';
-
-  meta = with lib; {
-    description = "Lightweight GTK clipboard manager";
-    homepage = "https://github.com/rickyrockrat/parcellite";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    mainProgram = "parcellite";
-  };
-}
diff --git a/pkgs/games/pegasus-frontend/default.nix b/pkgs/by-name/pe/pegasus-frontend/package.nix
similarity index 62%
rename from pkgs/games/pegasus-frontend/default.nix
rename to pkgs/by-name/pe/pegasus-frontend/package.nix
index 3f5244273c8b..942dc0b24d22 100644
--- a/pkgs/games/pegasus-frontend/default.nix
+++ b/pkgs/by-name/pe/pegasus-frontend/package.nix
@@ -3,15 +3,9 @@
   fetchFromGitHub,
   stdenv,
   cmake,
-  qtbase,
-  qtgraphicaleffects,
-  qtmultimedia,
-  qtsvg,
-  qttools,
-  qtx11extras,
   SDL2,
   sqlite,
-  wrapQtAppsHook,
+  libsForQt5,
 }:
 
 stdenv.mkDerivation {
@@ -28,26 +22,29 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
-    qttools
-    wrapQtAppsHook
+    libsForQt5.qttools
+    libsForQt5.wrapQtAppsHook
   ];
 
-  buildInputs = [
-    qtbase
-    qtmultimedia
-    qtsvg
-    qtgraphicaleffects
-    qtx11extras
-    sqlite
-    SDL2
-  ];
+  buildInputs =
+    (with libsForQt5; [
+      qtbase
+      qtmultimedia
+      qtsvg
+      qtgraphicaleffects
+      qtx11extras
+    ])
+    ++ [
+      sqlite
+      SDL2
+    ];
 
-  meta = with lib; {
+  meta = {
     description = "Cross platform, customizable graphical frontend for launching emulators and managing your game collection";
     mainProgram = "pegasus-fe";
     homepage = "https://pegasus-frontend.org/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ tengkuizdihar ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ tengkuizdihar ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/pr/privatebin/package.nix b/pkgs/by-name/pr/privatebin/package.nix
index 50f973613382..984d544045ca 100644
--- a/pkgs/by-name/pr/privatebin/package.nix
+++ b/pkgs/by-name/pr/privatebin/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "privatebin";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "PrivateBin";
     repo = "PrivateBin";
     tag = finalAttrs.version;
-    hash = "sha256-FspB10F/gz4d5T4TEYyifosgFLvnSMpVsr2t4NvFTqU=";
+    hash = "sha256-ErTB+qUz0CQf+YZZoFH2/ceAHFfgIbKXst6dTTM1pKQ=";
   };
 
   installPhase = ''
diff --git a/pkgs/games/qgo/fix-paths.patch b/pkgs/by-name/qg/qgo/fix-paths.patch
similarity index 100%
rename from pkgs/games/qgo/fix-paths.patch
rename to pkgs/by-name/qg/qgo/fix-paths.patch
diff --git a/pkgs/games/qgo/default.nix b/pkgs/by-name/qg/qgo/package.nix
similarity index 82%
rename from pkgs/games/qgo/default.nix
rename to pkgs/by-name/qg/qgo/package.nix
index 68b4a9325b38..6f3b6384f660 100644
--- a/pkgs/games/qgo/default.nix
+++ b/pkgs/by-name/qg/qgo/package.nix
@@ -1,18 +1,15 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
+  libsForQt5,
   fetchFromGitHub,
-  qmake,
-  qtbase,
-  qtmultimedia,
-  qttools,
 }:
 
-mkDerivation {
+stdenv.mkDerivation {
   pname = "qgo";
   version = "unstable-2017-12-18";
 
-  meta = with lib; {
+  meta = {
     description = "Go client based on Qt5";
     mainProgram = "qgo";
     longDescription = ''
@@ -28,8 +25,8 @@ mkDerivation {
       Chinese, "囲碁(Yi Go)" in Japanese, "바둑(Baduk)" in Korean.
     '';
     homepage = "https://github.com/pzorin/qgo";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ zalakain ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ zalakain ];
   };
 
   src = fetchFromGitHub {
@@ -44,11 +41,12 @@ mkDerivation {
     sed -i 's|@out@|'"''${out}"'|g' src/src.pro src/defines.h
   '';
   nativeBuildInputs = [
-    qmake
-    qttools
+    libsForQt5.qmake
+    libsForQt5.qttools
+    libsForQt5.wrapQtAppsHook
   ];
   buildInputs = [
-    qtbase
-    qtmultimedia
+    libsForQt5.qtbase
+    libsForQt5.qtmultimedia
   ];
 }
diff --git a/pkgs/games/qtads/default.nix b/pkgs/by-name/qt/qtads/package.nix
similarity index 58%
rename from pkgs/games/qtads/default.nix
rename to pkgs/by-name/qt/qtads/package.nix
index 90f6652ac658..ae92c2f70003 100644
--- a/pkgs/games/qtads/default.nix
+++ b/pkgs/by-name/qt/qtads/package.nix
@@ -1,31 +1,31 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
   fetchFromGitHub,
   pkg-config,
-  qmake,
   SDL2,
   fluidsynth,
   libsndfile,
   libvorbis,
   mpg123,
-  qtbase,
+  qt5,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qtads";
   version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "realnc";
     repo = "qtads";
-    rev = "v${version}";
-    sha256 = "sha256-KIqufpvl7zeUtDBXUOAZxBIbfv+s51DoSaZr3jol+bw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-KIqufpvl7zeUtDBXUOAZxBIbfv+s51DoSaZr3jol+bw=";
   };
 
   nativeBuildInputs = [
     pkg-config
-    qmake
+    qt5.qmake
+    qt5.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -34,15 +34,15 @@ mkDerivation rec {
     libsndfile
     libvorbis
     mpg123
-    qtbase
+    qt5.qtbase
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://realnc.github.io/qtads/";
     description = "Multimedia interpreter for TADS games";
     mainProgram = "qtads";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ orivej ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ orivej ];
   };
-}
+})
diff --git a/pkgs/games/quakespasm/default.nix b/pkgs/by-name/qu/quakespasm/package.nix
similarity index 90%
rename from pkgs/games/quakespasm/default.nix
rename to pkgs/by-name/qu/quakespasm/package.nix
index 8b669b489773..d76476cce0e1 100644
--- a/pkgs/games/quakespasm/default.nix
+++ b/pkgs/by-name/qu/quakespasm/package.nix
@@ -20,16 +20,16 @@
   useSDL2 ? stdenv.hostPlatform.isDarwin, # TODO: CoreAudio fails to initialize with SDL 1.x for some reason.
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "quakespasm";
   version = "0.96.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/quakespasm/quakespasm-${version}.tar.gz";
-    sha256 = "sha256-tXjWzkpPf04mokRY8YxLzI04VK5iUuuZgu6B2V5QGA4=";
+    url = "mirror://sourceforge/quakespasm/quakespasm-${finalAttrs.version}.tar.gz";
+    hash = "sha256-tXjWzkpPf04mokRY8YxLzI04VK5iUuuZgu6B2V5QGA4=";
   };
 
-  sourceRoot = "${pname}-${version}/Quake";
+  sourceRoot = "quakespasm-${finalAttrs.version}/Quake";
 
   patches = lib.optionals stdenv.hostPlatform.isDarwin [
     # Makes Darwin Makefile use system libraries instead of ones from app bundle
@@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Engine for iD software's Quake";
     homepage = "https://quakespasm.sourceforge.net/";
     longDescription = ''
@@ -125,8 +125,8 @@ stdenv.mkDerivation rec {
       and smoother mouse input - though no CD support.
     '';
 
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ mikroskeem ];
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ mikroskeem ];
     mainProgram = "quake";
   };
-}
+})
diff --git a/pkgs/games/quakespasm/quakespasm-darwin-makefile-improvements.patch b/pkgs/by-name/qu/quakespasm/quakespasm-darwin-makefile-improvements.patch
similarity index 100%
rename from pkgs/games/quakespasm/quakespasm-darwin-makefile-improvements.patch
rename to pkgs/by-name/qu/quakespasm/quakespasm-darwin-makefile-improvements.patch
diff --git a/pkgs/games/quakespasm/vulkan.nix b/pkgs/by-name/qu/quakespasm/vulkan.nix
similarity index 100%
rename from pkgs/games/quakespasm/vulkan.nix
rename to pkgs/by-name/qu/quakespasm/vulkan.nix
diff --git a/pkgs/by-name/qw/qwen-code/add-missing-resolved-integrity-fields.patch b/pkgs/by-name/qw/qwen-code/add-missing-resolved-integrity-fields.patch
deleted file mode 100644
index 9dade6622787..000000000000
--- a/pkgs/by-name/qw/qwen-code/add-missing-resolved-integrity-fields.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 0735b59eba183574e080d2912347d58e6e3d158e Mon Sep 17 00:00:00 2001
-From: Sergey Volkov <taranarmo@gmail.com>
-Date: Fri, 12 Sep 2025 20:06:24 +0200
-Subject: [PATCH] Add missing resolved and integrity fields to several packages
-
----
- package-lock.json | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/package-lock.json b/package-lock.json
-index 146686dc..9ad9009f 100644
---- a/package-lock.json
-+++ b/package-lock.json
-@@ -12574,6 +12574,8 @@
-     },
-     "packages/cli/node_modules/@testing-library/dom": {
-       "version": "10.4.0",
-+      "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.0.tgz",
-+      "integrity": "sha512-pemlzrSESWbdAloYml3bAJMEfNh1Z7EduzqPKprCH5S341frlpYnUEW0H72dLxa6IsYr+mPno20GiSm+h9dEdQ==",
-       "dev": true,
-       "license": "MIT",
-       "peer": true,
-@@ -12609,6 +12611,8 @@
-     },
-     "packages/cli/node_modules/@testing-library/react": {
-       "version": "16.3.0",
-+      "resolved": "https://registry.npmjs.org/@testing-library/react/-/react-16.3.0.tgz",
-+      "integrity": "sha512-kFSyxiEDwv1WLl2fgsq6pPBbw5aWKrsY2/noi1Id0TK0UParSF62oFQFGHXIyaG4pp2tEub/Zlel+fjjZILDsw==",
-       "dev": true,
-       "license": "MIT",
-       "dependencies": {
-@@ -12660,6 +12664,8 @@
-     },
-     "packages/cli/node_modules/aria-query": {
-       "version": "5.3.0",
-+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
-+      "integrity": "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A==",
-       "dev": true,
-       "license": "Apache-2.0",
-       "peer": true,
-@@ -12669,6 +12675,8 @@
-     },
-     "packages/cli/node_modules/emoji-regex": {
-       "version": "10.4.0",
-+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.4.0.tgz",
-+      "integrity": "sha512-EC+0oUMY1Rqm4O6LLrgjtYDvcVYTy7chDnM4Q7030tP4Kwj3u/pR6gP9ygnp2CJMK5Gq+9Q2oqmrFJAz01DXjw==",
-       "license": "MIT"
-     },
-     "packages/cli/node_modules/react-is": {
-@@ -12681,6 +12689,8 @@
-     },
-     "packages/cli/node_modules/string-width": {
-       "version": "7.2.0",
-+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
-+      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
-       "license": "MIT",
-       "dependencies": {
-         "emoji-regex": "^10.3.0",
-@@ -12815,6 +12825,8 @@
-     },
-     "packages/core/node_modules/ignore": {
-       "version": "7.0.5",
-+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-       "license": "MIT",
-       "engines": {
-         "node": ">= 4"
--- 
-2.51.0
-
diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index 3c087d4a58a7..cf265c7999b5 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -6,46 +6,40 @@
   jq,
   git,
   ripgrep,
+  pkg-config,
+  glib,
+  libsecret,
 }:
 
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.0.14";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Rld6k0MPfOOncK240zOJbcvheV4UKU2yF7luBrTrnFs=";
+    hash = "sha256-5XC4Pwf+vuK1T3/bPptUejg8v9wj3izF80Mt+iqVr9Y=";
   };
 
-  patches = [
-    # similar to upstream gemini-cli some node deps are missing resolved and integrity fields
-    # upstream the problem is solved in master and in v0.4+, eventually the fix should arrive to qwen
-    ./add-missing-resolved-integrity-fields.patch
-  ];
-
-  npmDepsHash = "sha256-43s13HncNKv4uOKVwNvqIF+Ih3rJBWrpVJnE3hCKD2w=";
+  npmDepsHash = "sha256-Psj/5SDWBnsRJVJnJwXGUgVbqUnjoH6HpAqqFruHkYw=";
 
   nativeBuildInputs = [
     jq
+    pkg-config
+    git
   ];
 
   buildInputs = [
-    git
     ripgrep
+    glib
+    libsecret
   ];
 
   postPatch = ''
-    # Remove @lvce-editor/ripgrep dependency (no network on buildPhase
-    substituteInPlace package.json --replace-fail '"@lvce-editor/ripgrep": "^1.6.0",' ""
-    substituteInPlace packages/core/package.json --replace-fail '"@lvce-editor/ripgrep": "^1.6.0",' ""
-    substituteInPlace packages/core/src/tools/ripGrep.ts \
-      --replace-fail "const { rgPath } = await import('@lvce-editor/ripgrep');" "const rgPath = 'rg';"
-
-    # patches below remove node-pty dependency which causes build fail on Darwin
+    # patches below remove node-pty and keytar dependencies which cause build fail on Darwin
     # should be conditional on platform but since package-lock.json is patched it changes its hash
-    # though seems like this dependency is not really required by the package
+    # though seems like these dependencies are not really required by the package
     ${jq}/bin/jq '
       del(.packages."node_modules/node-pty") |
       del(.packages."node_modules/@lydell/node-pty") |
@@ -55,11 +49,18 @@ buildNpmPackage (finalAttrs: {
       del(.packages."node_modules/@lydell/node-pty-linux-x64") |
       del(.packages."node_modules/@lydell/node-pty-win32-arm64") |
       del(.packages."node_modules/@lydell/node-pty-win32-x64") |
+      del(.packages."node_modules/keytar") |
       walk(
         if type == "object" and has("dependencies") then
-          .dependencies |= with_entries(select(.key | contains("node-pty") | not))
+          .dependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
         elif type == "object" and has("optionalDependencies") then
-          .optionalDependencies |= with_entries(select(.key | contains("node-pty") | not))
+          .optionalDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
+        else .
+        end
+      ) |
+      walk(
+        if type == "object" and has("peerDependencies") then
+          .peerDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
         else .
         end
       )
@@ -79,10 +80,14 @@ buildNpmPackage (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/bin $out/share/qwen-code
-    cp -r bundle/* $out/share/qwen-code/
-    cp node_modules/tiktoken/tiktoken_bg.wasm $out/share/qwen-code/
+    cp -r dist/* $out/share/qwen-code/
+    # Install production dependencies only
+    npm prune --production
+    cp -r node_modules $out/share/qwen-code/
+    # Remove broken symlinks that cause issues in Nix environment
+    find $out/share/qwen-code/node_modules -type l -delete || true
     patchShebangs $out/share/qwen-code
-    ln -s $out/share/qwen-code/gemini.js $out/bin/qwen
+    ln -s $out/share/qwen-code/cli.js $out/bin/qwen
 
     runHook postInstall
   '';
diff --git a/pkgs/games/rogue/default.nix b/pkgs/by-name/ro/rogue/package.nix
similarity index 54%
rename from pkgs/games/rogue/default.nix
rename to pkgs/by-name/ro/rogue/package.nix
index dcb16306767a..67209409c59b 100644
--- a/pkgs/games/rogue/default.nix
+++ b/pkgs/by-name/ro/rogue/package.nix
@@ -2,30 +2,30 @@
   lib,
   stdenv,
   fetchurl,
-  ncurses,
+  ncurses5,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rogue";
   version = "5.4.4";
 
   src = fetchurl {
     urls = [
-      "https://src.fedoraproject.org/repo/pkgs/rogue/rogue${version}-src.tar.gz/033288f46444b06814c81ea69d96e075/rogue${version}-src.tar.gz"
-      "http://ftp.vim.org/ftp/pub/ftp/os/Linux/distr/slitaz/sources/packages-cooking/r/rogue${version}-src.tar.gz"
-      "http://rogue.rogueforge.net/files/rogue${lib.versions.majorMinor version}/rogue${version}-src.tar.gz"
+      "https://src.fedoraproject.org/repo/pkgs/rogue/rogue${finalAttrs.version}-src.tar.gz/033288f46444b06814c81ea69d96e075/rogue${finalAttrs.version}-src.tar.gz"
+      "http://ftp.vim.org/ftp/pub/ftp/os/Linux/distr/slitaz/sources/packages-cooking/r/rogue${finalAttrs.version}-src.tar.gz"
+      "http://rogue.rogueforge.net/files/rogue${lib.versions.majorMinor finalAttrs.version}/rogue${finalAttrs.version}-src.tar.gz"
     ];
     sha256 = "18g81274d0f7sr04p7h7irz0d53j6kd9j1y3zbka1gcqq0gscdvx";
   };
 
-  buildInputs = [ ncurses ];
+  buildInputs = [ ncurses5 ];
 
-  meta = with lib; {
+  meta = {
     homepage = "http://rogue.rogueforge.net/rogue-5-4/";
     description = "Final version of the original Rogue game developed for the UNIX operating system";
     mainProgram = "rogue";
-    platforms = platforms.all;
-    license = licenses.bsd3;
+    platforms = lib.platforms.all;
+    license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index 6d8aa7a2c2f9..f4f741529e75 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.7-unstable-2025-10-20";
+  version = "11.7-unstable-2025-10-26";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "479045bf9445789c6a0a0252dd6fc092f2b0b507";
-    hash = "sha256-F7IPAjIlfZcuj9Of0wDYQWPTAWWZO9z6/FbjHwZlJAo=";
+    rev = "6fc94288ed46533527b1ddb24c3b162a9d0f7ab7";
+    hash = "sha256-kJhvgZ/GTSSplmY6bzHxHhtgukssepBsSWD7kwXwnps=";
   };
 
   buildInputs =
diff --git a/pkgs/games/scummvm/games.nix b/pkgs/by-name/sc/scummvm/games.nix
similarity index 100%
rename from pkgs/games/scummvm/games.nix
rename to pkgs/by-name/sc/scummvm/games.nix
diff --git a/pkgs/games/scummvm/default.nix b/pkgs/by-name/sc/scummvm/package.nix
similarity index 88%
rename from pkgs/games/scummvm/default.nix
rename to pkgs/by-name/sc/scummvm/package.nix
index 54e4c74bd414..15831abecef0 100644
--- a/pkgs/games/scummvm/default.nix
+++ b/pkgs/by-name/sc/scummvm/package.nix
@@ -23,14 +23,14 @@
   nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "scummvm";
   version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "scummvm";
     repo = "scummvm";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-+MM47piuXuIBmAQd0g/cAg5t02qSQ0sw/DwFrMUSIAA=";
   };
 
@@ -82,12 +82,12 @@ stdenv.mkDerivation rec {
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Program to run certain classic graphical point-and-click adventure games (such as Monkey Island)";
     mainProgram = "scummvm";
     homepage = "https://www.scummvm.org/";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.peterhoeg ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ peterhoeg ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/se/session-desktop/Info.plist b/pkgs/by-name/se/session-desktop/Info.plist
new file mode 100644
index 000000000000..1be6514e846b
--- /dev/null
+++ b/pkgs/by-name/se/session-desktop/Info.plist
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>CFBundleDisplayName</key>
+    <string>Session</string>
+    <key>CFBundleExecutable</key>
+    <string>Session</string>
+    <key>CFBundleIconFile</key>
+    <string>icon.icns</string>
+    <key>CFBundleIdentifier</key>
+    <string>com.loki-project.messenger-desktop</string>
+    <key>CFBundleInfoDictionaryVersion</key>
+    <string>6.0</string>
+    <key>CFBundleName</key>
+    <string>Session</string>
+    <key>CFBundlePackageType</key>
+    <string>APPL</string>
+    <key>CFBundleShortVersionString</key>
+    <string>@version@</string>
+    <key>CFBundleVersion</key>
+    <string>refs/heads/master</string>
+    <key>LSApplicationCategoryType</key>
+    <string>public.app-category.social-networking</string>
+    <key>LSEnvironment</key>
+    <dict>
+      <key>MallocNanoZone</key>
+      <string>0</string>
+    </dict>
+    <key>LSMinimumSystemVersion</key>
+    <string>11.0</string>
+    <key>NSAppTransportSecurity</key>
+    <dict>
+      <key>NSAllowsArbitraryLoads</key>
+      <true/>
+      <key>NSAllowsLocalNetworking</key>
+      <true/>
+      <key>NSExceptionDomains</key>
+      <dict>
+        <key>127.0.0.1</key>
+        <dict>
+          <key>NSIncludesSubdomains</key>
+          <false/>
+          <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
+          <true/>
+          <key>NSTemporaryExceptionAllowsInsecureHTTPSLoads</key>
+          <false/>
+          <key>NSTemporaryExceptionMinimumTLSVersion</key>
+          <string>1.0</string>
+          <key>NSTemporaryExceptionRequiresForwardSecrecy</key>
+          <false/>
+        </dict>
+        <key>localhost</key>
+        <dict>
+          <key>NSIncludesSubdomains</key>
+          <false/>
+          <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
+          <true/>
+          <key>NSTemporaryExceptionAllowsInsecureHTTPSLoads</key>
+          <false/>
+          <key>NSTemporaryExceptionMinimumTLSVersion</key>
+          <string>1.0</string>
+          <key>NSTemporaryExceptionRequiresForwardSecrecy</key>
+          <false/>
+        </dict>
+      </dict>
+    </dict>
+    <key>NSBluetoothAlwaysUsageDescription</key>
+    <string>This app needs access to Bluetooth</string>
+    <key>NSBluetoothPeripheralUsageDescription</key>
+    <string>This app needs access to Bluetooth</string>
+    <key>NSCameraUsageDescription</key>
+    <string>Session requires camera access to record video.</string>
+    <key>NSHighResolutionCapable</key>
+    <true/>
+    <key>NSHumanReadableCopyright</key>
+    <string>Copyright © 2025 Session Foundation</string>
+    <key>NSMainNibFile</key>
+    <string>MainMenu</string>
+    <key>NSMicrophoneUsageDescription</key>
+    <string>Session requires microphone access to record audio.</string>
+    <key>NSPrefersDisplaySafeAreaCompatibilityMode</key>
+    <false/>
+    <key>NSPrincipalClass</key>
+    <string>AtomApplication</string>
+    <key>NSQuitAlwaysKeepsWindows</key>
+    <false/>
+    <key>NSRequiresAquaSystemAppearance</key>
+    <false/>
+    <key>NSSupportsAutomaticGraphicsSwitching</key>
+    <true/>
+  </dict>
+</plist>
diff --git a/pkgs/by-name/se/session-desktop/fake-git.sh b/pkgs/by-name/se/session-desktop/fake-git.sh
new file mode 100644
index 000000000000..088c718c0f84
--- /dev/null
+++ b/pkgs/by-name/se/session-desktop/fake-git.sh
@@ -0,0 +1,74 @@
+if [ "$1" != "rev-parse" ]; then
+  echo "$@" >&2
+  exit 1
+fi
+shift
+
+short=0
+shortlen=7
+ref=
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --short)
+      short=1
+      if [ $# -gt 1 ] && [ "$2" -eq "$2" ] 2>/dev/null; then
+        shortlen=$2
+        shift
+      else
+        shortlen=7
+      fi
+      ;;
+    --short=*)
+      short=1
+      shortlen=''${1#--short=}
+      ;;
+    --is-inside-work-tree)
+      echo true
+      exit 0
+      ;;
+    HEAD|HEAD:*)
+      ref=$1
+      ;;
+    *)
+      echo "rev-parse $@" >&2
+      exit 1
+      ;;
+  esac
+  shift
+done
+
+if [ -z "$ref" ]; then
+  echo "rev-parse" >&2
+  exit 1
+fi
+
+case "$ref" in
+  HEAD)
+    path=$(pwd)
+    hash=
+    while [ "$path" != "/" ]; do
+      if [ -f "$path/.gitrev" ]; then
+        hash=$(cat "$path/.gitrev")
+        break
+      fi
+      path=$(dirname "$path")
+    done
+    ;;
+  HEAD:*)
+    subpath=''${ref#HEAD:}
+    if [ -f "$PWD/$subpath/.gitrev" ]; then
+      hash=$(cat "$PWD/$subpath/.gitrev")
+    fi
+    ;;
+esac
+
+if [ -z "$hash" ]; then
+  echo "rev-parse $ref" >&2
+  exit 1
+fi
+
+if [ "$short" -eq 1 ]; then
+  printf '%s\n' "$(printf '%s' "$hash" | cut -c1-"$shortlen")"
+else
+  printf '%s\n' "$hash"
+fi
diff --git a/pkgs/by-name/se/session-desktop/package.nix b/pkgs/by-name/se/session-desktop/package.nix
index b9183d1da7e7..4e98a2f9c25c 100644
--- a/pkgs/by-name/se/session-desktop/package.nix
+++ b/pkgs/by-name/se/session-desktop/package.nix
@@ -1,67 +1,336 @@
 {
   lib,
+  fetchFromGitHub,
   makeDesktopItem,
+  writeShellScriptBin,
   copyDesktopItems,
-  stdenvNoCC,
-  fetchurl,
-  appimageTools,
+  stdenv,
   makeWrapper,
+  fetchpatch,
+  replaceVars,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  rustPlatform,
+  nodejs,
+  electron,
+  jq,
+  python3,
+  git,
+  cmake,
+  openssl,
+  tcl,
+  xcodebuild,
+  cctools,
+  darwin,
 }:
 
 let
-  version = "1.15.2";
-  pname = "session-desktop";
+  fake-git = writeShellScriptBin "git" (lib.readFile ./fake-git.sh);
+
+  sqlcipher-src = stdenv.mkDerivation (finalAttrs: {
+    pname = "sqlcipher-src";
+    # when updating: look for the version in deps/download.js of @signalapp/better-sqlite3, whose version is in turn found in yarn.lock
+    version = "4.6.1";
+    src = fetchFromGitHub {
+      owner = "signalapp";
+      repo = "sqlcipher";
+      tag = "v${finalAttrs.version}-f_barrierfsync";
+      hash = "sha256-3fGRPZpJmLbY95DLJ34BK53ZTzJ1dWEzislXsOrTc8k=";
+    };
+
+    patches = [
+      # Needed to reproduce the build artifact from Signal's CI.
+      # TODO: find the actual CI workflow that produces
+      # https://build-artifacts.signal.org/desktop/sqlcipher-v2-4.6.1-signal-patch2--0.2.1-asm2-6253f886c40e49bf892d5cdc92b2eb200b12cd8d80c48ce5b05967cfd01ee8c7.tar.gz
+      # See also: https://github.com/signalapp/better-sqlite3/blob/v9.0.13/deps/defines.gypi#L33
+      # Building @signalapp/better-sqlite3 will require openssl without this patch.
+      (fetchpatch {
+        name = "sqlcipher-crypto-custom.patch";
+        url = "https://github.com/sqlcipher/sqlcipher/commit/702af1ff87528a78f5a9b2091806d3a5642e1d4a.patch";
+        hash = "sha256-OKh6qCGHBQWZyzXfyEveAs71wrNwlWLuG9jNqDeKNG4=";
+      })
+    ];
+
+    buildInputs = [
+      openssl
+      tcl
+    ];
+
+    # see https://github.com/signalapp/node-sqlcipher/blob/v2.4.4/deps/sqlcipher/update.sh
+    configureFlags = [ "--enable-update-limit" ];
+    makeFlags = [
+      "sqlite3.h"
+      "sqlite3.c"
+      "sqlite3ext.h"
+      "shell.c"
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp sqlite3.h sqlite3.c sqlite3ext.h shell.c $out
+
+      runHook postInstall
+    '';
+
+    meta = {
+      homepage = "https://github.com/signalapp/sqlcipher";
+      license = lib.licenses.bsd3;
+    };
+  });
+
+  signal-sqlcipher-extension = rustPlatform.buildRustPackage (finalAttrs: {
+    pname = "signal-sqlcipher-extension";
+    # when updating: look for the version in deps/download.js of @signalapp/better-sqlite3, whose version is in turn found in yarn.lock
+    version = "0.2.1";
+    src = fetchFromGitHub {
+      owner = "signalapp";
+      repo = "Signal-Sqlcipher-Extension";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-INSkm7ZuetPASuIqezzzG/bXoEHClUb9XpxWbxLVXRc=";
+    };
+
+    cargoHash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
+
+    postInstall = ''
+      mkdir -p $out/include
+      cp target/*.h $out/include
+    '';
+
+    meta = {
+      homepage = "https://github.com/signalapp/Signal-Sqlcipher-Extension";
+      license = lib.licenses.agpl3Only;
+    };
+  });
+
+  libsession-util-nodejs = stdenv.mkDerivation (finalAttrs: {
+    pname = "libsession-util-nodejs";
+    version = "0.5.5"; # find version in yarn.lock
+    src = fetchFromGitHub {
+      owner = "session-foundation";
+      repo = "libsession-util-nodejs";
+      tag = "v${finalAttrs.version}";
+      fetchSubmodules = true;
+      deepClone = true; # need git rev for all submodules
+      hash = "sha256-FmI9Xmml+sjXHJ+W6CfBC8QUrQR89H3HWEYlHE2Xsts=";
+      # fetchgit is not reproducible with deepClone + fetchSubmodules:
+      # https://github.com/NixOS/nixpkgs/issues/100498
+      postFetch = ''
+        find $out -name .git -type d -prune | while read -r gitdir; do
+          pushd "$(dirname "$gitdir")"
+          git rev-parse HEAD > .gitrev
+          popd
+        done
+        find $out -name .git -type d -prune -exec rm -rf {} +
+      '';
+    };
+
+    postPatch = ''
+      sed -i -E 's/--runtime-version=[^[:space:]]*/--runtime-version=${electron.version}/' package.json
+    '';
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      yarnBuildHook
+      yarnInstallHook
+      nodejs
+      cmake
+      python3
+      fake-git # used in update_version.sh, libsession-util/external/oxen-libquic/cmake/check_submodule.cmake, etc.
+      jq
+    ];
+
+    dontUseCmakeConfigure = true;
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${finalAttrs.src}/yarn.lock";
+      hash = "sha256-0pH88EOqxG/kg7edaWnaLEs3iqhIoRCJxDdBn4JxYeY=";
+    };
+
+    preBuild = ''
+      # prevent downloading; see https://github.com/cmake-js/cmake-js/blob/v7.3.1/lib/dist.js
+      mkdir -p "$HOME/.cmake-js/electron-${stdenv.hostPlatform.node.arch}"
+      ln -s ${electron.headers} "$HOME/.cmake-js/electron-${stdenv.hostPlatform.node.arch}/v${electron.version}"
+
+      # populate src/version.h
+      yarn update_version
+    '';
+
+    # The install script is the build script.
+    # `yarn install` may be better than `yarn run install`.
+    # However, the former seems to use /bin/bash while the latter uses stdenv.shell,
+    # and the former simply cannot find the cmake-js command, which is pretty weird,
+    # and using `yarn config set script-shell` does not help.
+    yarnBuildScript = "run";
+    yarnBuildFlags = "install";
+
+    postInstall = ''
+      # build is not installed by default because it is in .gitignore
+      cp -r build $out/lib/node_modules/libsession_util_nodejs
+    '';
+
+    meta = {
+      homepage = "https://github.com/session-foundation/libsession-util-nodejs";
+      # No license file, but gpl3Only makes sense because package.json says GPL-3.0,
+      # which is also consistent with session-desktop and libsession-util.
+      license = lib.licenses.gpl3Only;
+    };
+  });
 
-  src = fetchurl {
-    url = "https://github.com/session-foundation/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
-    hash = "sha256-xQ/Fjg04XgXUioCCU0+sOLaTWZV1z05EmzZCqEU++Ok=";
-  };
-  appimage = appimageTools.wrapType2 { inherit version pname src; };
-  appimage-contents = appimageTools.extractType2 { inherit version pname src; };
 in
-stdenvNoCC.mkDerivation {
-  inherit version pname;
-  src = appimage;
+stdenv.mkDerivation (finalAttrs: {
+  pname = "session-desktop";
+  version = "1.16.10";
+  src = fetchFromGitHub {
+    owner = "session-foundation";
+    repo = "session-desktop";
+    tag = "v${finalAttrs.version}";
+    leaveDotGit = true;
+    hash = "sha256-9l5AgG9YNz61lS/1Q/b46UgdyidHH7sQK7ZWz19XWr0=";
+    postFetch = ''
+      pushd $out
+      git rev-parse HEAD > .gitrev
+      rm -rf .git
+      popd
+    '';
+  };
+
+  postPatch = ''
+    jq '
+      del(.engines) # too restrictive Node version requirement
+      # control what files are packed in the install phase
+      + {files: ["**/*.js", "**/*.html", "**/*.node", "_locales", "config", "fonts", "images", "mmdb", "mnemonic_languages", "protos", "sound", "stylesheets"]}
+    ' package.json > package.json.new
+    mv package.json.new package.json
+  '';
 
   nativeBuildInputs = [
     copyDesktopItems
     makeWrapper
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+    jq
+    python3
+    fake-git # see build/updateLocalConfig.js
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    cctools # provides libtool needed for better-sqlite3
+    xcodebuild
+    darwin.autoSignDarwinBinariesHook
   ];
 
+  env = {
+    npm_config_nodedir = electron.headers;
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  };
+
+  dontUseCmakeConfigure = true;
+  yarnOfflineCache = fetchYarnDeps {
+    # Future maintainers: keep in mind that sometimes the upstream deduplicates dependencies
+    # (see the `dedup` script in package.json) before committing yarn.lock,
+    # which may unfortunately break the offline cache (and may not).
+    # If that happens, clone the repo and run `yarn install --ignore-scripts` yourself,
+    # copy the modified yarn.lock here, and use `./yarn.lock` instead of `"${finalAttrs.src}/yarn.lock"`,
+    # and also add `cp ${./yarn.lock} yarn.lock` to postPatch.
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-A2AbKOXWx8+PN467DVpKVTorZDs/UFaxjc7VS0Xdo6k=";
+  };
+
+  preBuild = ''
+    # prevent downloading
+    pushd node_modules/@signalapp/better-sqlite3/deps
+    tar -czf sqlcipher.tar.gz \
+      -C ${signal-sqlcipher-extension} lib include \
+      -C ${sqlcipher-src} . \
+      --transform="s,^lib,./signal-sqlcipher-extension/${stdenv.targetPlatform.rust.cargoShortTarget}," \
+      --transform="s,^include,./signal-sqlcipher-extension/include,"
+    hash=$(sha256sum sqlcipher.tar.gz | cut -d' ' -f1)
+    sed -i "s/^const HASH = '.*';/const HASH = '$hash';/" download.js
+    popd
+
+    export NODE_ENV=production
+
+    # rebuild native modules except libsession_util_nodejs
+    rm -rf node_modules/libsession_util_nodejs
+    npm rebuild --verbose --offline --no-progress --release # why doesn't yarn have `rebuild`?
+    cp -r ${libsession-util-nodejs}/lib/node_modules/libsession_util_nodejs node_modules
+    chmod -R +w node_modules/libsession_util_nodejs
+    rm -rf node_modules/libsession_util_nodejs/node_modules
+
+    # some important things that did not run because of --ignore-scripts
+    yarn run postinstall
+  '';
+
+  preInstall = ''
+    # Do not want yarn prune to remove native modules that we just built.
+    mv node_modules node_modules.dev
+  '';
+
+  postInstall = ''
+    find node_modules.dev -mindepth 2 -maxdepth 3 -type d -name build  | while read -r buildDir; do
+      packageDir=$(dirname ''${buildDir#node_modules.dev/})
+      installPackageDir="$out/lib/node_modules/session-desktop/node_modules/$packageDir"
+      if [ -d "$installPackageDir" ]; then
+        cp -r "$buildDir" "$installPackageDir"
+      fi
+    done
+
+    makeWrapper ${lib.getExe electron} $out/bin/session-desktop \
+      --add-flags $out/lib/node_modules/session-desktop \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --set NODE_ENV production \
+      --inherit-argv0
+
+    for f in build/icons/icon_*.png; do
+      base=$(basename $f .png)
+      size=''${base#icon_}
+      install -Dm644 $f $out/share/icons/hicolor/$size/apps/session-desktop.png
+    done
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications/Session.app/Contents/{MacOS,Resources}
+    ln -s $out/bin/session-desktop $out/Applications/Session.app/Contents/MacOS/Session
+    install -Dm644 build/icon-mac.icns $out/Applications/Session.app/Contents/Resources/icon.icns
+    install -Dm644 ${
+      # Adapted from the dmg package from upstream:
+      # https://github.com/session-foundation/session-desktop/releases/download/v1.16.10/session-desktop-mac-arm64-1.16.10.dmg
+      replaceVars ./Info.plist { inherit (finalAttrs) version; }
+    } $out/Applications/Session.app/Contents/Info.plist
+  '';
+
   desktopItems = [
     (makeDesktopItem {
       name = "Session";
       desktopName = "Session";
       comment = "Onion routing based messenger";
       exec = "session-desktop";
-      icon = "${appimage-contents}/session-desktop.png";
+      icon = "session-desktop";
       terminal = false;
       type = "Application";
       categories = [ "Network" ];
     })
   ];
 
-  installPhase = ''
-    runHook preInstall
+  passthru = {
+    inherit sqlcipher-src signal-sqlcipher-extension libsession-util-nodejs;
+    updateScript = ./update.sh;
+  };
 
-    mkdir -p $out/
-    cp -r bin $out/bin
-
-    wrapProgram $out/bin/session-desktop \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "Onion routing based messenger";
     mainProgram = "session-desktop";
     homepage = "https://getsession.org/";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
+    downloadPage = "https://getsession.org/download";
+    changelog = "https://github.com/session-foundation/session-desktop/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
       alexnortung
+      ulysseszhan
     ];
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/se/session-desktop/update.sh b/pkgs/by-name/se/session-desktop/update.sh
new file mode 100755
index 000000000000..8f6cb10327a8
--- /dev/null
+++ b/pkgs/by-name/se/session-desktop/update.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -euo pipefail
+
+currentVersion="$(nix-instantiate --eval --raw -A session-desktop.version)"
+latestVersion="$(
+  curl -s https://api.github.com/repos/session-foundation/session-desktop/releases/latest \
+    ${GITHUB_TOKEN:+--user ":$GITHUB_TOKEN"} \
+  | jq -r .tag_name | sed 's/^v//'
+)"
+if [ "$currentVersion" = "$latestVersion" ]; then
+  echo "Already up-to-date"
+  exit 0
+fi
+
+yarnLock="$(curl -s https://raw.githubusercontent.com/session-foundation/session-desktop/v$latestVersion/yarn.lock)"
+depVersion() {
+  name="$(echo "$1" | sed 's/\//\\&/g')"
+  echo "$yarnLock" | awk '/^"?'"$name"'@/ {flag=1; next} flag && /^  version "[^"]+"/ {match($0, /^  version "([^"]+)"/, a); print a[1]; exit}' -
+}
+
+update-source-version session-desktop.passthru.libsession-util.nodejs "$(depVersion libsession_util_nodejs)"
+
+downloadJs="$(curl -s https://raw.githubusercontent.com/signalapp/better-sqlite3/v$(depVersion @signalapp/better-sqlite3)/deps/download.js)"
+sqlDepVersion() {
+  echo "$downloadJs" | awk "match(\$0, /^const ${1}_VERSION = '([0-9.]+)['-]/, a) {print a[1]}" -
+}
+
+update-source-version session-desktop.passthru.sqlcipher-src "$(sqlDepVersion SQLCIPHER)"
+update-source-version session-desktop.passthru.signal-sqlcipher-extension "$(sqlDepVersion EXTENSION)"
+
+update-source-version session-desktop "$latestVersion"
diff --git a/pkgs/games/shattered-pixel-dungeon/deps.json b/pkgs/by-name/sh/shattered-pixel-dungeon/deps.json
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/deps.json
rename to pkgs/by-name/sh/shattered-pixel-dungeon/deps.json
diff --git a/pkgs/games/shattered-pixel-dungeon/disable-beryx.patch b/pkgs/by-name/sh/shattered-pixel-dungeon/disable-beryx.patch
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/disable-beryx.patch
rename to pkgs/by-name/sh/shattered-pixel-dungeon/disable-beryx.patch
diff --git a/pkgs/games/shattered-pixel-dungeon/experienced-pixel-dungeon/default.nix b/pkgs/by-name/sh/shattered-pixel-dungeon/experienced-pixel-dungeon/default.nix
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/experienced-pixel-dungeon/default.nix
rename to pkgs/by-name/sh/shattered-pixel-dungeon/experienced-pixel-dungeon/default.nix
diff --git a/pkgs/games/shattered-pixel-dungeon/experienced-pixel-dungeon/deps.json b/pkgs/by-name/sh/shattered-pixel-dungeon/experienced-pixel-dungeon/deps.json
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/experienced-pixel-dungeon/deps.json
rename to pkgs/by-name/sh/shattered-pixel-dungeon/experienced-pixel-dungeon/deps.json
diff --git a/pkgs/games/shattered-pixel-dungeon/generic.nix b/pkgs/by-name/sh/shattered-pixel-dungeon/generic.nix
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/generic.nix
rename to pkgs/by-name/sh/shattered-pixel-dungeon/generic.nix
diff --git a/pkgs/games/shattered-pixel-dungeon/default.nix b/pkgs/by-name/sh/shattered-pixel-dungeon/package.nix
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/default.nix
rename to pkgs/by-name/sh/shattered-pixel-dungeon/package.nix
diff --git a/pkgs/games/shattered-pixel-dungeon/rat-king-adventure/default.nix b/pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/default.nix
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/rat-king-adventure/default.nix
rename to pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/default.nix
diff --git a/pkgs/games/shattered-pixel-dungeon/rat-king-adventure/deps.json b/pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/deps.json
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/rat-king-adventure/deps.json
rename to pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/deps.json
diff --git a/pkgs/games/shattered-pixel-dungeon/rkpd2/default.nix b/pkgs/by-name/sh/shattered-pixel-dungeon/rkpd2/default.nix
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/rkpd2/default.nix
rename to pkgs/by-name/sh/shattered-pixel-dungeon/rkpd2/default.nix
diff --git a/pkgs/games/shattered-pixel-dungeon/rkpd2/deps.json b/pkgs/by-name/sh/shattered-pixel-dungeon/rkpd2/deps.json
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/rkpd2/deps.json
rename to pkgs/by-name/sh/shattered-pixel-dungeon/rkpd2/deps.json
diff --git a/pkgs/games/shattered-pixel-dungeon/shorter-pixel-dungeon/default.nix b/pkgs/by-name/sh/shattered-pixel-dungeon/shorter-pixel-dungeon/default.nix
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/shorter-pixel-dungeon/default.nix
rename to pkgs/by-name/sh/shattered-pixel-dungeon/shorter-pixel-dungeon/default.nix
diff --git a/pkgs/games/shattered-pixel-dungeon/shorter-pixel-dungeon/deps.json b/pkgs/by-name/sh/shattered-pixel-dungeon/shorter-pixel-dungeon/deps.json
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/shorter-pixel-dungeon/deps.json
rename to pkgs/by-name/sh/shattered-pixel-dungeon/shorter-pixel-dungeon/deps.json
diff --git a/pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon/default.nix b/pkgs/by-name/sh/shattered-pixel-dungeon/summoning-pixel-dungeon/default.nix
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon/default.nix
rename to pkgs/by-name/sh/shattered-pixel-dungeon/summoning-pixel-dungeon/default.nix
diff --git a/pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon/deps.json b/pkgs/by-name/sh/shattered-pixel-dungeon/summoning-pixel-dungeon/deps.json
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon/deps.json
rename to pkgs/by-name/sh/shattered-pixel-dungeon/summoning-pixel-dungeon/deps.json
diff --git a/pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon/disable-git-version.patch b/pkgs/by-name/sh/shattered-pixel-dungeon/summoning-pixel-dungeon/disable-git-version.patch
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon/disable-git-version.patch
rename to pkgs/by-name/sh/shattered-pixel-dungeon/summoning-pixel-dungeon/disable-git-version.patch
diff --git a/pkgs/games/shattered-pixel-dungeon/tower-pixel-dungeon/default.nix b/pkgs/by-name/sh/shattered-pixel-dungeon/tower-pixel-dungeon/default.nix
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/tower-pixel-dungeon/default.nix
rename to pkgs/by-name/sh/shattered-pixel-dungeon/tower-pixel-dungeon/default.nix
diff --git a/pkgs/games/shattered-pixel-dungeon/tower-pixel-dungeon/deps.json b/pkgs/by-name/sh/shattered-pixel-dungeon/tower-pixel-dungeon/deps.json
similarity index 100%
rename from pkgs/games/shattered-pixel-dungeon/tower-pixel-dungeon/deps.json
rename to pkgs/by-name/sh/shattered-pixel-dungeon/tower-pixel-dungeon/deps.json
diff --git a/pkgs/by-name/sn/snac2/package.nix b/pkgs/by-name/sn/snac2/package.nix
index 071223850fa7..1ebf78b15a10 100644
--- a/pkgs/by-name/sn/snac2/package.nix
+++ b/pkgs/by-name/sn/snac2/package.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snac2";
-  version = "2.83";
+  version = "2.84";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = "snac2";
     tag = finalAttrs.version;
-    hash = "sha256-5BpJKDXA3PO/ZCfFYMngWaAGns2+ANWCpLgiEi4CAXY=";
+    hash = "sha256-sKxuFG3lqpjGkC0WVPr+4v09LR7BR2FYBOsToNI6M78=";
   };
 
   buildInputs = [
diff --git a/pkgs/games/soi/cmake-4-build.patch b/pkgs/by-name/so/soi/cmake-4-build.patch
similarity index 100%
rename from pkgs/games/soi/cmake-4-build.patch
rename to pkgs/by-name/so/soi/cmake-4-build.patch
diff --git a/pkgs/games/soi/default.nix b/pkgs/by-name/so/soi/package.nix
similarity index 74%
rename from pkgs/games/soi/default.nix
rename to pkgs/by-name/so/soi/package.nix
index d46f093092e1..fdf1a2995284 100644
--- a/pkgs/games/soi/default.nix
+++ b/pkgs/by-name/so/soi/package.nix
@@ -5,27 +5,27 @@
   cmake,
   boost,
   eigen2,
-  lua,
+  lua5_1,
   luabind,
   libGLU,
   libGL,
   SDL,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "soi";
   version = "0.1.2";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/soi/Spheres%20of%20Influence-${version}-Source.tar.bz2";
-    name = "${pname}-${version}.tar.bz2";
+    url = "mirror://sourceforge/project/soi/Spheres%20of%20Influence-${finalAttrs.version}-Source.tar.bz2";
+    name = "soi-${finalAttrs.version}.tar.bz2";
     sha256 = "03c3wnvhd42qh8mi68lybf8nv6wzlm1nx16d6pdcn2jzgx1j2lzd";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     boost
-    lua
+    lua5_1
     luabind
     libGLU
     libGL
@@ -41,12 +41,12 @@ stdenv.mkDerivation rec {
   # https://github.com/NixOS/nixpkgs/issues/445447
   patches = [ ./cmake-4-build.patch ];
 
-  meta = with lib; {
+  meta = {
     description = "Physics-based puzzle game";
     mainProgram = "soi";
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
-    license = licenses.free;
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.free;
     downloadPage = "https://sourceforge.net/projects/soi/files/";
   };
-}
+})
diff --git a/pkgs/by-name/sq/sqlpage/package.nix b/pkgs/by-name/sq/sqlpage/package.nix
index cb20579d8b93..bef63a5b00e4 100644
--- a/pkgs/by-name/sq/sqlpage/package.nix
+++ b/pkgs/by-name/sq/sqlpage/package.nix
@@ -42,13 +42,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sqlpage";
-  version = "0.38.0";
+  version = "0.39.0";
 
   src = fetchFromGitHub {
     owner = "lovasoa";
     repo = "SQLpage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sIbEyW1/EuZuspU9pBOe6y9Ktwvz9ZNEsQ4CU/yU278=";
+    hash = "sha256-M9WtpDc067G/EfRTJBoDxBrdXRMqOwVTdGgyXSdHlhE=";
   };
 
   postPatch = ''
@@ -73,7 +73,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "$(cat ${tomselect})"
   '';
 
-  cargoHash = "sha256-uWdEzuEKxN50OM40i/BedgfoWf3oijks8tM5bs7qUao=";
+  cargoHash = "sha256-lUQ1j2f/LXpqpb6VK4Bq2NI0L9KoyEdlPkENMOKkt0w=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sq/squid/package.nix b/pkgs/by-name/sq/squid/package.nix
index 384dadf43743..ed953ff47fbf 100644
--- a/pkgs/by-name/sq/squid/package.nix
+++ b/pkgs/by-name/sq/squid/package.nix
@@ -16,26 +16,18 @@
   cppunit,
   ipv6 ? true,
   nixosTests,
-  fetchpatch,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "squid";
-  version = "7.2";
+  version = "7.3";
 
   src = fetchurl {
     url = "https://github.com/squid-cache/squid/releases/download/SQUID_${
       builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
     }/squid-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Xgd74dg6nmls6NDZ5yOxJzFSIHoJFAS+aKS5qeGMcAM=";
+    hash = "sha256-2twqmjkmzhs7q+qnp9eyHLsIkCWHbao/XBnn62OR3c0=";
   };
 
-  patches = lib.optional (lib.versionOlder finalAttrs.version "7.2.0") (fetchpatch {
-    # Merged upstream PR; fixes the issue of rejecting domain names starting with digits
-    # To remove when 7.3 is released (or 7.2.1, but that doesn't seem likely)
-    url = "https://patch-diff.githubusercontent.com/raw/squid-cache/squid/pull/2283.patch";
-    hash = "sha256-HLGmzrAH5y1sFfFnVeeegRihyn+N7csGX9lVqmCDIHc=";
-  });
-
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     perl
diff --git a/pkgs/by-name/st/stepmania/ffmpeg-7.patch b/pkgs/by-name/st/stepmania/ffmpeg-7.patch
new file mode 100644
index 000000000000..80b4b8b6a2b7
--- /dev/null
+++ b/pkgs/by-name/st/stepmania/ffmpeg-7.patch
@@ -0,0 +1,11 @@
+--- a/src/arch/MovieTexture/MovieTexture_FFMpeg.cpp
++++ b/src/arch/MovieTexture/MovieTexture_FFMpeg.cpp
+@@ -273,7 +273,7 @@
+ 		bool bSkipThisFrame =
+ 			fTargetTime != -1 &&
+ 			GetTimestamp() + GetFrameDuration() < fTargetTime &&
+-			(m_pStreamCodec->frame_number % 2) == 0;
++			(m_pStreamCodec->frame_num % 2) == 0;
+ 
+ 		int iGotFrame;
+ 		int len;
diff --git a/pkgs/by-name/st/stepmania/package.nix b/pkgs/by-name/st/stepmania/package.nix
index 66cfca7cd573..a447ebb62b07 100644
--- a/pkgs/by-name/st/stepmania/package.nix
+++ b/pkgs/by-name/st/stepmania/package.nix
@@ -6,10 +6,10 @@
   cmake,
   nasm,
   alsa-lib,
-  ffmpeg_6,
+  ffmpeg_7,
   glew,
   glib,
-  gtk2,
+  gtk3,
   libmad,
   libogg,
   libpng,
@@ -32,12 +32,20 @@ stdenv.mkDerivation {
   };
 
   patches = [
-    # https://github.com/stepmania/stepmania/pull/2247
     (fetchpatch {
-      name = "fix-building-with-ffmpeg6.patch";
-      url = "https://github.com/stepmania/stepmania/commit/3fef5ef60b7674d6431f4e1e4ba8c69b0c21c023.patch";
+      # Fix building with newer FFmpeg
+      name = "fix-building-with-newer-ffmpeg.patch";
+      url = "https://github.com/stepmania/stepmania/commit/3fef5ef60b7674d6431f4e1e4ba8c69b0c21c023.patch?full_index=1";
       hash = "sha256-m+5sP+mIpcSjioRBdzChqja5zwNcwdSNAfvSJ2Lww+g=";
     })
+    (fetchpatch {
+      # Fix crash on loading animated previews while using newer FFmpeg
+      name = "fix-crash-newer-ffmpeg.patch";
+      url = "https://github.com/stepmania/stepmania/commit/e0d2a5182dcd855e181fffa086273460c553c7ff.patch?full_index=1";
+      hash = "sha256-XacaMn29FwG3WgFBfB890I8mzVrvuOL4wPWcHHNYfXM=";
+    })
+    # FFmpeg 7 frame_number compatibility fix
+    ./ffmpeg-7.patch
   ];
 
   postPatch = ''
@@ -54,10 +62,10 @@ stdenv.mkDerivation {
 
   buildInputs = [
     alsa-lib
-    ffmpeg_6
+    ffmpeg_7
     glew
     glib
-    gtk2
+    gtk3
     libmad
     libogg
     libpng
@@ -72,8 +80,6 @@ stdenv.mkDerivation {
     "-DWITH_SYSTEM_FFMPEG=1"
     "-DWITH_SYSTEM_PNG=on"
     "-DWITH_SYSTEM_ZLIB=on"
-    "-DGTK2_GDKCONFIG_INCLUDE_DIR=${gtk2.out}/lib/gtk-2.0/include"
-    "-DGTK2_GLIBCONFIG_INCLUDE_DIR=${glib.out}/lib/glib-2.0/include"
   ];
 
   postInstall = ''
@@ -86,12 +92,12 @@ stdenv.mkDerivation {
     install -Dm444 $src/stepmania.desktop -t $out/share/applications
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.stepmania.com/";
     description = "Free dance and rhythm game for Windows, Mac, and Linux";
-    platforms = platforms.linux;
-    license = licenses.mit; # expat version
-    maintainers = with maintainers; [ h7x4 ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.mit; # expat version
+    maintainers = with lib.maintainers; [ h7x4 ];
     mainProgram = "stepmania";
   };
 }
diff --git a/pkgs/by-name/su/superTuxKart/package.nix b/pkgs/by-name/su/superTuxKart/package.nix
index 5b4cf6f8f577..35a74463adff 100644
--- a/pkgs/by-name/su/superTuxKart/package.nix
+++ b/pkgs/by-name/su/superTuxKart/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   fetchsvn,
-  fetchpatch,
   cmake,
   pkg-config,
   makeWrapper,
@@ -29,8 +28,8 @@
 let
   assets = fetchsvn {
     url = "https://svn.code.sf.net/p/supertuxkart/code/stk-assets";
-    rev = "18464";
-    sha256 = "1a84j3psl4cxzkn5ynakpjill7i2f9ki2p729bpmbrvg8fki95aa";
+    rev = "18621";
+    sha256 = "sha256-iqQSezGu0tecA53qhrtYA77SLj28WUUCcL4ZCJbK5C8=";
     name = "stk-assets";
   };
 
@@ -68,29 +67,15 @@ in
 stdenv.mkDerivation rec {
 
   pname = "supertuxkart";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "supertuxkart";
     repo = "stk-code";
-    rev = version;
-    hash = "sha256-gqdaVvgNfCN40ZO/9y8+vTeIJPSq6udKxYZ/MAi4ZMM=";
+    tag = version;
+    hash = "sha256-/fp5iqTHVrVcxRqbTy/3r+dp19oUj9MI2JauvtPWTWA=";
   };
 
-  patches = [
-    # upstreamed patches required to build against cmake 4.0; remove with next release update.
-    (fetchpatch {
-      name = "Require-Cmake-3.6-or-higher";
-      url = "https://github.com/supertuxkart/stk-code/commit/7d4e8433c124c08c62f5335e2a884aeea71cf184.patch?full_index=1";
-      hash = "sha256-5q/Gf1I/maFPQ83NDIa7Sn6gtLfErwxP16fup4SZ+gc=";
-    })
-    (fetchpatch {
-      name = "Fixed-cmake-4.0-warnings";
-      url = "https://github.com/supertuxkart/stk-code/commit/184c80138faf5232c33ff99ffe7706e821be70c2.patch?full_index=1";
-      hash = "sha256-5zoDmKBRBC2rAUjgpmyc0ZCObGofjuImqk07Tr5K7Og=";
-    })
-  ];
-
   postPatch = ''
     # Deletes all bundled libs in stk-code/lib except those
     # That couldn't be replaced with system packages
@@ -162,17 +147,18 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "Free 3D kart racing game";
+    description = "3D open-source arcade racer";
     mainProgram = "supertuxkart";
     longDescription = ''
-      SuperTuxKart is a Free 3D kart racing game, with many tracks,
-      characters and items for you to try, similar in spirit to Mario
-      Kart.
+      Karts. Nitro. Action! SuperTuxKart is a 3D open-source arcade racer
+      with a variety of characters, tracks, and modes to play.
+      It aims to be more fun than realistic, and provides an enjoyable experience for all ages.
     '';
     homepage = "https://supertuxkart.net/";
-    license = lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       peterhoeg
+      SchweGELBin
     ];
     platforms = with lib.platforms; unix;
     changelog = "https://github.com/supertuxkart/stk-code/blob/${version}/CHANGELOG.md";
diff --git a/pkgs/by-name/ta/taskwarrior3/package.nix b/pkgs/by-name/ta/taskwarrior3/package.nix
index 3f100fbb6b7c..9a1c94241827 100644
--- a/pkgs/by-name/ta/taskwarrior3/package.nix
+++ b/pkgs/by-name/ta/taskwarrior3/package.nix
@@ -11,6 +11,7 @@
   installShellFiles,
 
   # buildInputs
+  corrosion,
   libuuid,
 
   # passthru.tests
@@ -24,18 +25,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "taskwarrior";
-  version = "3.4.1";
+  version = "3.4.2";
   src = fetchFromGitHub {
     owner = "GothenburgBitFactory";
     repo = "taskwarrior";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-00HiGju4pIswx8Z+M+ATdBSupiMS2xIm2ZnE52k/RwA=";
+    hash = "sha256-Y0jnAW4OtPI9GCOSFRPf8/wo4qBB6O1FASj40S601+E=";
     fetchSubmodules = true;
   };
   cargoDeps = rustPlatform.fetchCargoVendor {
     name = "${finalAttrs.pname}-${finalAttrs.version}-cargo-deps";
     inherit (finalAttrs) src;
-    hash = "sha256-trc5DIWf68XRBSMjeG/ZchuwFA56wJnLbqm17gE+jYQ=";
+    hash = "sha256-03HG8AGe6PJ516zL23iNjGUYmGOZa8NuFljb1ll2pjs=";
   };
 
   # The CMakeLists files used by upstream issue a `cargo install` command to
@@ -46,6 +47,9 @@ stdenv.mkDerivation (finalAttrs: {
   postUnpack = ''
     export CARGO_HOME=$PWD/.cargo
   '';
+  cmakeFlags = [
+    (lib.cmakeBool "SYSTEM_CORROSION" true)
+  ];
   failingTests = [
     # It would be very hard to make this test succeed, as the bash completion
     # needs to be installed and the builder's `bash` should be aware of it.
@@ -74,12 +78,13 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    corrosion
     libuuid
   ];
 
   doCheck = true;
   # See:
-  # https://github.com/GothenburgBitFactory/taskwarrior/blob/v3.2.0/doc/devel/contrib/development.md#run-the-test-suite
+  # https://github.com/GothenburgBitFactory/taskwarrior/blob/v3.4.1/doc/devel/contrib/development.md#run-the-test-suite
   preCheck = ''
     make test_runner
   '';
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 5b0ecef2daac..475faea34b89 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -8,16 +8,16 @@
 
 buildGo124Module (finalAttrs: {
   pname = "traefik";
-  version = "3.5.3";
+  version = "3.5.4";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-vKpOlB29OJHppQOspIICYgeAtemBGb419TIXIW9zrhU=";
+    hash = "sha256-gA1H2oJXm6l3JQdn1+SMPf3ZzG0pvXRDiVgZu2MAT3E=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-Juf5LYB/o1hyTIZB5NQrJBOLdkEjL1mOsBgndF3vpd8=";
+  vendorHash = "sha256-UziRO6cNgbVRyLWm8i/oOXVktOAt8exCNz2bdpX8yk8=";
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/by-name/tr/trilium-desktop/package.nix b/pkgs/by-name/tr/trilium-desktop/package.nix
index 151a132289ad..09fef4b4181d 100644
--- a/pkgs/by-name/tr/trilium-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-desktop/package.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-desktop";
-  version = "0.99.1";
+  version = "0.99.3";
 
   triliumSource = os: arch: hash: {
     url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip";
@@ -26,10 +26,10 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.hash = "sha256-cn1Y6wMYoVCuNNdAxesNKcZiRo2uKGV8nL6yK1KtNP8=";
-  aarch64-linux.hash = "sha256-KhSSrdITpbGiIAEkdNfRAoIlhC2uUV6+8ZUaEYW7dyA=";
-  x86_64-darwin.hash = "sha256-jKAZnCtNEEnvJ6p6lziOG7+uAyMuEel4dAKRXvMHo8c=";
-  aarch64-darwin.hash = "sha256-1p0rUoZPunP3fRgn/EO3obdGp6l5BbsfZyKMlsgrl80=";
+  x86_64-linux.hash = "sha256-xq0T2Qi6kabKD66eY7GERE4VB5cXy+1Oixh1Q7O4Eh4=";
+  aarch64-linux.hash = "sha256-QjhmvwoX7N8HjUEStUGuJUA2MndrS6RsA68JhZqZLBQ=";
+  x86_64-darwin.hash = "sha256-jXT8EuKn9vmXyFInwvWOjKz92+XdZplHw4zA09mamZk=";
+  aarch64-darwin.hash = "sha256-N0aKPfUd8oV5QQ1IrAdnxff1fB6QCT09QSAqAcCeyHU=";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.hash;
diff --git a/pkgs/by-name/tr/trilium-server/package.nix b/pkgs/by-name/tr/trilium-server/package.nix
index 8aaf775d5145..cca71a873286 100644
--- a/pkgs/by-name/tr/trilium-server/package.nix
+++ b/pkgs/by-name/tr/trilium-server/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.99.1";
+  version = "0.99.3";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.hash = "sha256-4DiPgWKXzVMm6JTBnJGOZrQLOIjQQvxkNvcawkzsg4M=";
+  serverSource_x64.hash = "sha256-WcyLXpVfVzKFj0pvC4j+0Hx3eSUC0euwfkKIQ2qxCN8=";
   serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.hash = "sha256-dyf6t2y1RO6+NCPDAD19DocAYchkIgV+x4Shn3BNEK8=";
+  serverSource_arm64.hash = "sha256-SUcv9N4/mSqDAAWjlB1bG6y7/PQpqwOte7UniN8SwZI=";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then
diff --git a/pkgs/by-name/ty/typescript-go/package.nix b/pkgs/by-name/ty/typescript-go/package.nix
index 92b1ad63fdf7..9835f8f89062 100644
--- a/pkgs/by-name/ty/typescript-go/package.nix
+++ b/pkgs/by-name/ty/typescript-go/package.nix
@@ -10,13 +10,13 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2025-10-22";
+  version = "0-unstable-2025-10-29";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "42241ec50d438ce9ef1f2b90a7b2cdd1bfa5f51d";
-    hash = "sha256-5vm9ht3nZ3ELODN+J5PfAOWrxIUCyvsIxbf29geSYrA=";
+    rev = "6642b0a33b7fbea3594e8c243d9323a1ad945202";
+    hash = "sha256-kvG21V9prb+Brg2wPaXwzd4eEfNE6VfYn8st3hsCsco=";
     fetchSubmodules = false;
   };
 
diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix
index 6b3b676410b6..99be1f986702 100644
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsm";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "uwsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x8Nx0Y4pIOjcN0aYSfTi3WyjzF/wzzgLpNrjpI2s/O0=";
+    hash = "sha256-gX+6fNnndmnEpuKymqVt/5U8RmUq2j9X99L34BJy6LI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/games/vcmi/default.nix b/pkgs/by-name/vc/vcmi/package.nix
similarity index 82%
rename from pkgs/games/vcmi/default.nix
rename to pkgs/by-name/vc/vcmi/package.nix
index 88b26e0a1175..b7aa3e7dbdd9 100644
--- a/pkgs/games/vcmi/default.nix
+++ b/pkgs/by-name/vc/vcmi/package.nix
@@ -16,25 +16,23 @@
   ninja,
   pkg-config,
   python3,
-  qtbase,
-  qttools,
   onetbb,
   unshield,
-  wrapQtAppsHook,
   xz,
   zlib,
   testers,
   vcmi,
+  libsForQt5,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "vcmi";
   version = "1.6.8";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
-    rev = version;
+    tag = finalAttrs.version;
     fetchSubmodules = true;
     hash = "sha256-k6tkylNXEzU+zzYoFWtx+AkoHQzAwbBxPB2DVevsryw=";
   };
@@ -44,7 +42,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -57,8 +55,8 @@ stdenv.mkDerivation rec {
     fuzzylite
     luajit
     minizip
-    qtbase
-    qttools
+    libsForQt5.qtbase
+    libsForQt5.qttools
     onetbb
     xz
     zlib
@@ -97,16 +95,16 @@ stdenv.mkDerivation rec {
     '';
   };
 
-  meta = with lib; {
+  meta = {
     description = "Open-source engine for Heroes of Might and Magic III";
     homepage = "https://vcmi.eu";
-    changelog = "https://github.com/vcmi/vcmi/blob/${src.rev}/ChangeLog.md";
-    license = with licenses; [
+    changelog = "https://github.com/vcmi/vcmi/blob/${finalAttrs.src.rev}/ChangeLog.md";
+    license = with lib.licenses; [
       gpl2Plus
       cc-by-sa-40
     ];
-    maintainers = with maintainers; [ azahi ];
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [ azahi ];
+    platforms = lib.platforms.linux;
     mainProgram = "vcmilauncher";
   };
-}
+})
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
index 6dfac779d3c7..daec6e238113 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-wlr";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "xdg-desktop-portal-wlr";
     rev = "v${version}";
-    sha256 = "sha256-GIIDeZMIGUiZV0IUhcclRVThE5LKaqVc5VwnNT8beNU=";
+    sha256 = "sha256-TAWrDH6kud4eXFJvfihImuEFm2uTOaqAOatG+7JmaEM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/xe/xemu/package.nix b/pkgs/by-name/xe/xemu/package.nix
index 58f9a22aa712..714b539f42cb 100644
--- a/pkgs/by-name/xe/xemu/package.nix
+++ b/pkgs/by-name/xe/xemu/package.nix
@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xemu";
-  version = "0.8.109";
+  version = "0.8.110";
 
   src = fetchFromGitHub {
     owner = "xemu-project";
     repo = "xemu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1SJGcwnDvqEnm2Z9O4TNo+417CJrwHRgzuRzewzIbXY=";
+    hash = "sha256-kb8sAaqPHbVXeddMD/BoUnxph4lLTmRctY+yjhgu4gw=";
 
     nativeBuildInputs = [
       git
diff --git a/pkgs/by-name/xp/xpra/package.nix b/pkgs/by-name/xp/xpra/package.nix
index 3c4db4ba3d84..e8fa28a857d8 100644
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -89,7 +89,7 @@ let
 in
 buildPythonApplication rec {
   pname = "xpra";
-  version = "6.3.3";
+  version = "6.3.4";
   format = "setuptools";
 
   stdenv = if withNvenc then cudaPackages.backendStdenv else args.stdenv;
@@ -98,7 +98,7 @@ buildPythonApplication rec {
     owner = "Xpra-org";
     repo = "xpra";
     tag = "v${version}";
-    hash = "sha256-hk+C6I/QS6ihwmuNlnoNFipJ98SW6LO+Qa3Uh1h1Ji8=";
+    hash = "sha256-Wx8s1e0nhFyNrwHYD2aVutudjNSc8ukTLPqaiYHp8n8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/yu/yubihsm-setup/cargo-lock.patch b/pkgs/by-name/yu/yubihsm-setup/cargo-lock.patch
new file mode 100644
index 000000000000..c24c7c8888af
--- /dev/null
+++ b/pkgs/by-name/yu/yubihsm-setup/cargo-lock.patch
@@ -0,0 +1,403 @@
+From 5acf0a321cd3393d145e7b158d21f790e1e94a39 Mon Sep 17 00:00:00 2001
+From: Morgan Jones <me@numin.it>
+Date: Wed, 22 Oct 2025 21:01:34 -0700
+Subject: [PATCH] Update Cargo.lock
+
+---
+ Cargo.lock | 240 ++++++++++-------------------------------------------
+ 1 file changed, 44 insertions(+), 196 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 1fd1883..f555e92 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1,21 +1,12 @@
+ # This file is automatically @generated by Cargo.
+ # It is not intended for manual editing.
+-version = 3
++version = 4
+ 
+ [[package]]
+ name = "aho-corasick"
+-version = "0.6.10"
++version = "1.1.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "81ce3d38065e618af2d7b77e10c5ad9a069859b4be3c2250f674af3840d9c8a5"
+-dependencies = [
+- "memchr",
+-]
+-
+-[[package]]
+-name = "aho-corasick"
+-version = "0.7.18"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
++checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+ dependencies = [
+  "memchr",
+ ]
+@@ -42,9 +33,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "base64"
+-version = "0.13.0"
++version = "0.13.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "904dfeac50f3cdaba28fc6f57fdcddb75f49ed61346676a78c4ffe55877802fd"
++checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+ 
+ [[package]]
+ name = "bitflags"
+@@ -52,12 +43,6 @@ version = "1.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+ 
+-[[package]]
+-name = "cfg-if"
+-version = "1.0.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+-
+ [[package]]
+ name = "clap"
+ version = "2.34.0"
+@@ -69,7 +54,7 @@ dependencies = [
+  "bitflags",
+  "strsim",
+  "textwrap",
+- "unicode-width",
++ "unicode-width 0.1.14",
+  "vec_map",
+ ]
+ 
+@@ -81,19 +66,13 @@ checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+ 
+ [[package]]
+ name = "getopts"
+-version = "0.2.21"
++version = "0.2.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
++checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
+ dependencies = [
+- "unicode-width",
++ "unicode-width 0.2.2",
+ ]
+ 
+-[[package]]
+-name = "heck"
+-version = "0.4.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+-
+ [[package]]
+ name = "hermit-abi"
+ version = "0.1.19"
+@@ -105,15 +84,15 @@ dependencies = [
+ 
+ [[package]]
+ name = "lazy_static"
+-version = "1.4.0"
++version = "1.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
++checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+ 
+ [[package]]
+ name = "libc"
+-version = "0.2.126"
++version = "0.2.177"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
++checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+ 
+ [[package]]
+ name = "libyubihsm-sys"
+@@ -124,42 +103,21 @@ dependencies = [
+ 
+ [[package]]
+ name = "log"
+-version = "0.3.9"
++version = "0.4.28"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e19e8d5c34a3e0e2223db8e060f9e8264aeeb5c5fc64a4ee9965c062211c024b"
+-dependencies = [
+- "log 0.4.17",
+-]
+-
+-[[package]]
+-name = "log"
+-version = "0.4.17"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+-dependencies = [
+- "cfg-if",
+-]
++checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+ 
+ [[package]]
+ name = "memchr"
+-version = "2.5.0"
++version = "2.7.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
++checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+ 
+ [[package]]
+ name = "pkg-config"
+-version = "0.3.25"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
+-
+-[[package]]
+-name = "proc-macro2"
+-version = "1.0.69"
++version = "0.3.32"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+-dependencies = [
+- "unicode-ident",
+-]
++checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+ 
+ [[package]]
+ name = "quick-error"
+@@ -167,15 +125,6 @@ version = "1.2.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+ 
+-[[package]]
+-name = "quote"
+-version = "1.0.33"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+-dependencies = [
+- "proc-macro2",
+-]
+-
+ [[package]]
+ name = "rand"
+ version = "0.3.23"
+@@ -225,54 +174,38 @@ dependencies = [
+ 
+ [[package]]
+ name = "regex"
+-version = "0.2.11"
++version = "1.12.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9329abc99e39129fcceabd24cf5d85b4671ef7c29c50e972bc5afe32438ec384"
++checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+ dependencies = [
+- "aho-corasick 0.6.10",
++ "aho-corasick",
+  "memchr",
+- "regex-syntax 0.5.6",
+- "thread_local",
+- "utf8-ranges",
++ "regex-automata",
++ "regex-syntax",
+ ]
+ 
+ [[package]]
+-name = "regex"
+-version = "1.5.6"
++name = "regex-automata"
++version = "0.4.13"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d83f127d94bdbcda4c8cc2e50f6f84f4b611f69c902699ca385a39c3a75f9ff1"
++checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+ dependencies = [
+- "aho-corasick 0.7.18",
++ "aho-corasick",
+  "memchr",
+- "regex-syntax 0.6.26",
+-]
+-
+-[[package]]
+-name = "regex-syntax"
+-version = "0.5.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7d707a4fa2637f2dca2ef9fd02225ec7661fe01a53623c1e6515b6916511f7a7"
+-dependencies = [
+- "ucd-util",
++ "regex-syntax",
+ ]
+ 
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.26"
++version = "0.8.8"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "49b3de9ec5dc0a3417da371aab17d729997c15010e7fd24ff707773a33bddb64"
++checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+ 
+ [[package]]
+ name = "rustc-serialize"
+-version = "0.3.24"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "dcf128d1287d2ea9d80910b5f1120d0b8eede3fbf1abe91c40d39ea7d51e6fda"
+-
+-[[package]]
+-name = "rustversion"
+-version = "1.0.14"
++version = "0.3.25"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
++checksum = "fe834bc780604f4674073badbad26d7219cadfb4a2275802db12cbae17498401"
+ 
+ [[package]]
+ name = "rusty_secrets"
+@@ -294,114 +227,32 @@ dependencies = [
+  "quick-error",
+ ]
+ 
+-[[package]]
+-name = "serde"
+-version = "1.0.190"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "91d3c334ca1ee894a2c6f6ad698fe8c435b76d504b13d436f0685d648d6d96f7"
+-dependencies = [
+- "serde_derive",
+-]
+-
+-[[package]]
+-name = "serde_derive"
+-version = "1.0.190"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "67c5609f394e5c2bd7fc51efda478004ea80ef42fee983d5c67a65e34f32c0e3"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "syn 2.0.38",
+-]
+-
+ [[package]]
+ name = "strsim"
+ version = "0.8.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+ 
+-[[package]]
+-name = "strum"
+-version = "0.24.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "063e6045c0e62079840579a7e47a355ae92f60eb74daaf156fb1e84ba164e63f"
+-
+-[[package]]
+-name = "strum_macros"
+-version = "0.24.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1e385be0d24f186b4ce2f9982191e7101bb737312ad61c1f2f984f34bcf85d59"
+-dependencies = [
+- "heck",
+- "proc-macro2",
+- "quote",
+- "rustversion",
+- "syn 1.0.109",
+-]
+-
+-[[package]]
+-name = "syn"
+-version = "1.0.109"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "unicode-ident",
+-]
+-
+-[[package]]
+-name = "syn"
+-version = "2.0.38"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "unicode-ident",
+-]
+-
+ [[package]]
+ name = "textwrap"
+ version = "0.11.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+ dependencies = [
+- "unicode-width",
++ "unicode-width 0.1.14",
+ ]
+ 
+-[[package]]
+-name = "thread_local"
+-version = "0.3.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c6b53e329000edc2b34dbe8545fd20e55a333362d0a321909685a19bd28c3f1b"
+-dependencies = [
+- "lazy_static",
+-]
+-
+-[[package]]
+-name = "ucd-util"
+-version = "0.1.8"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c85f514e095d348c279b1e5cd76795082cf15bd59b93207832abe0b1d8fed236"
+-
+-[[package]]
+-name = "unicode-ident"
+-version = "1.0.12"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+-
+ [[package]]
+ name = "unicode-width"
+-version = "0.1.9"
++version = "0.1.14"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
++checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+ 
+ [[package]]
+-name = "utf8-ranges"
+-version = "1.0.5"
++name = "unicode-width"
++version = "0.2.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7fcfc827f90e53a02eaef5e535ee14266c1d569214c6aa70133a624d8a3164ba"
++checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+ 
+ [[package]]
+ name = "vec_map"
+@@ -433,12 +284,12 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+ 
+ [[package]]
+ name = "yubihsm-setup"
+-version = "2.3.1"
++version = "2.3.3"
+ dependencies = [
+  "base64",
+  "clap",
+  "lazy_static",
+- "regex 1.5.6",
++ "regex",
+  "rusty_secrets",
+  "scan_dir",
+  "yubihsmrs",
+@@ -446,14 +297,11 @@ dependencies = [
+ 
+ [[package]]
+ name = "yubihsmrs"
+-version = "2.1.3"
++version = "2.1.4"
+ dependencies = [
+  "lazy_static",
+  "libyubihsm-sys",
+- "log 0.3.9",
+- "regex 0.2.11",
++ "log",
++ "regex",
+  "rustc-serialize",
+- "serde",
+- "strum",
+- "strum_macros",
+ ]
diff --git a/pkgs/by-name/yu/yubihsm-setup/package.nix b/pkgs/by-name/yu/yubihsm-setup/package.nix
new file mode 100644
index 000000000000..50fedb2c0213
--- /dev/null
+++ b/pkgs/by-name/yu/yubihsm-setup/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  pkg-config,
+  yubihsm-shell,
+}:
+
+rustPlatform.buildRustPackage (finalPackage: {
+  pname = "yubihsm-setup";
+  version = "2.3.3";
+
+  src = fetchFromGitHub {
+    owner = "Yubico";
+    repo = "yubihsm-setup";
+    tag = finalPackage.version;
+    hash = "sha256-ScpcEDNWLhywtcPPG84vZyIAQ5lF07udmGsmsyc3+iU=";
+  };
+
+  yubihsmrs = fetchFromGitHub {
+    owner = "Yubico";
+    repo = "yubihsmrs";
+    tag = "2.1.4";
+    hash = "sha256-MQwp2dkAkPNyclDgRhHWRHZ9y4LC+bGIeLBv8CgMGXY=";
+  };
+
+  prePatch = ''
+    ln -s $yubihsmrs yubihsmrs
+    substituteInPlace Cargo.toml --replace-fail ../yubihsmrs/ ./yubihsmrs/
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ yubihsm-shell ];
+
+  # https://github.com/Yubico/yubihsm-setup/pull/20
+  cargoPatches = [ ./cargo-lock.patch ];
+
+  cargoHash = "sha256-Mk0uGNb0WGygSqocpo566sVHs13zvoFBbAevJj4OSBM=";
+
+  meta = {
+    description = "Tool to easily set up a YubiHSM device";
+    homepage = "https://github.com/Yubico/yubihsm-setup";
+    maintainers = with lib.maintainers; [
+      numinit
+    ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 8bca83223718..ed74dd70f5d8 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -101,7 +101,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.209.6";
+  version = "0.209.7";
 
   outputs = [
     "out"
@@ -114,7 +114,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KHOex6Noths886oE62BN4NE/DCMmU5VjiP+xN2YnVmc=";
+    hash = "sha256-vmHBPpRFSaqj62NZCAKtc3ZiMe8P++Ji57aJ5cuWjWQ=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-u/dD7qHvc+ipKd6Jy9/HtPiLMa537zKUSAbjUFMQorA=";
+  cargoHash = "sha256-UM01zsi/brSyxzAaEUQ+ZUB8j5c6LMHv0eAhyuQ1huA=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/zo/zotero/darwin.nix b/pkgs/by-name/zo/zotero/darwin.nix
index f7aaebb8993f..9a0cec7b3630 100644
--- a/pkgs/by-name/zo/zotero/darwin.nix
+++ b/pkgs/by-name/zo/zotero/darwin.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}.dmg";
-    hash = "sha256-DeiQbg8wMFHsJ/jlbGj3wdXrRsGLJ0tOyGRex2w43lU=";
+    hash = "sha256-YivHBEFPkm79y2R5QIV+trm8O3aFzvXTqVzFr1tcoIo=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/zo/zotero/linux.nix b/pkgs/by-name/zo/zotero/linux.nix
index f0626da413fa..2d84e0bbe7f2 100644
--- a/pkgs/by-name/zo/zotero/linux.nix
+++ b/pkgs/by-name/zo/zotero/linux.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    hash = "sha256-L2Mvi11X4YBU4ezHDJosl7qHClmzUwmghvXG8TChA8c=";
+    hash = "sha256-ce0Lvz0k3DH6rGzdGoqYIW1OBiaJwaxn8pDnMQbqtv4=";
   };
 
   dontPatchELF = true;
diff --git a/pkgs/by-name/zo/zotero/package.nix b/pkgs/by-name/zo/zotero/package.nix
index 7abf2bd8e4e8..1bfda3290939 100644
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -6,7 +6,7 @@
 
 let
   pname = "zotero";
-  version = "7.0.20";
+  version = "7.0.27";
   meta = {
     homepage = "https://www.zotero.org";
     description = "Collect, organize, cite, and share your research sources";
diff --git a/pkgs/development/compilers/openjdk/17/source.json b/pkgs/development/compilers/openjdk/17/source.json
index 2b5813a3fd68..110fdf3a2223 100644
--- a/pkgs/development/compilers/openjdk/17/source.json
+++ b/pkgs/development/compilers/openjdk/17/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-xwi7Co0DiEx9IohwiQHpislv/50NdGuHVQINJcasBdY=",
+  "hash": "sha256-U2/ZQ9m3fi2rni2RAXyr5laDvNq0T5M2wZX+FdmCwFc=",
   "owner": "openjdk",
   "repo": "jdk17u",
-  "rev": "refs/tags/jdk-17.0.17+8"
+  "rev": "refs/tags/jdk-17.0.17+10"
 }
diff --git a/pkgs/development/interpreters/jruby/default.nix b/pkgs/development/interpreters/jruby/default.nix
index af054c353d85..0b8a388d3ea4 100644
--- a/pkgs/development/interpreters/jruby/default.nix
+++ b/pkgs/development/interpreters/jruby/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   callPackage,
   fetchurl,
+  fetchMavenArtifact,
   gitUpdater,
   mkRubyVersion,
   makeBinaryWrapper,
@@ -11,15 +12,15 @@
 
 let
   # The version number here is whatever is reported by the RUBY_VERSION string
-  rubyVersion = mkRubyVersion "3" "1" "4" "";
+  rubyVersion = mkRubyVersion "3" "4" "2" "";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "jruby";
-  version = "10.0.0.0";
+  version = "10.0.2.0";
 
   src = fetchurl {
-    url = "https://s3.amazonaws.com/jruby.org/downloads/${finalAttrs.version}/jruby-bin-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Qn2YJ+0j/mtNEf5hZlx13XR2ujagQ4N26zEM4qjSRzM=";
+    url = "https://repo1.maven.org/maven2/org/jruby/jruby-dist/${finalAttrs.version}/jruby-dist-${finalAttrs.version}-bin.tar.gz";
+    hash = "sha256-uKAm84qphGGgTtCqCyCJHOJX7L5T4SRxnOnuW4BFJfE=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
@@ -27,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     mkdir -pv $out/share/jruby/docs
     mv * $out
-    rm $out/bin/*.{bat,dll,exe,sh}
+    rm $out/bin/*.{bat,dll,exe}
     mv $out/samples $out/share/jruby/
     mv $out/BSDL $out/COPYING $out/LEGAL $out/LICENSE* $out/share/jruby/docs/
 
@@ -36,8 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
         --set JAVA_HOME ${jre.home}
     done
 
-    ln -s $out/bin/jruby $out/bin/ruby
-
     # Bundler tries to create this directory
     mkdir -pv $out/${finalAttrs.passthru.gemPath}
     mkdir -p $out/nix-support
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index 258644febdbe..46ecec7c2901 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  fetchpatch,
   rustPlatform,
   meson,
   ninja,
@@ -33,7 +32,6 @@
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform && plugins == null,
   hotdoc,
-  mopidy,
   apple-sdk_gstreamer,
 }:
 
@@ -137,7 +135,7 @@ assert lib.assertMsg (invalidPlugins == [ ])
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-rs";
-  version = "0.14.1";
+  version = "0.14.2";
 
   outputs = [
     "out"
@@ -149,44 +147,15 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "gstreamer";
     repo = "gst-plugins-rs";
     rev = finalAttrs.version;
-    hash = "sha256-gCT/ZcXR9VePXYtEENXxgBNvA84KT1OYUR8kSyLBzrI=";
-    # TODO: temporary workaround for case-insensitivity problems with color-name crate - https://github.com/annymosse/color-name/pull/2
-    postFetch = ''
-      sedSearch="$(cat <<\EOF | sed -ze 's/\n/\\n/g'
-      \[\[package\]\]
-      name = "color-name"
-      version = "\([^"\n]*\)"
-      source = "registry+https://github.com/rust-lang/crates.io-index"
-      checksum = "[^"\n]*"
-      EOF
-      )"
-      sedReplace="$(cat <<\EOF | sed -ze 's/\n/\\n/g'
-      [[package]]
-      name = "color-name"
-      version = "\1"
-      source = "git+https://github.com/lilyinstarlight/color-name#cac0ed5b7d2e0682c08c9bfd13089d5494e81b9a"
-      EOF
-      )"
-      sed -i -ze "s|$sedSearch|$sedReplace|g" $out/Cargo.lock
-    '';
+    hash = "sha256-mIq8Fo6KoxAo1cL2NQHnSMPgzUWl1eNJUujdaerGjFA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src patches;
+    inherit (finalAttrs) src;
     name = "gst-plugins-rs-${finalAttrs.version}";
-    hash = "sha256-sX3P5qrG0M/vJkvzvJGzv4fcMn6FvrLPOUh++vKJ/gY=";
+    hash = "sha256-Z1mqpVL2SES1v0flykOwoDX2/apZHxg7eI5If4BsP4o=";
   };
 
-  patches = [
-    # Related to https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/issues/723
-    ./ignore-tests.patch
-    (fetchpatch {
-      name = "x264enc-test-fix.patch";
-      url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/commit/c0c9888d66e107f9e0b6d96cd3a85961c7e97d9a.diff";
-      hash = "sha256-/ILdPDjI20k5l9Qf/klglSuhawmFUs9mR+VhBnQqsWw=";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/rs/ignore-tests.patch b/pkgs/development/libraries/gstreamer/rs/ignore-tests.patch
deleted file mode 100644
index 52b231816ce8..000000000000
--- a/pkgs/development/libraries/gstreamer/rs/ignore-tests.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/utils/uriplaylistbin/tests/uriplaylistbin.rs b/utils/uriplaylistbin/tests/uriplaylistbin.rs
-index 3489eaa8..569635d6 100644
---- a/utils/uriplaylistbin/tests/uriplaylistbin.rs
-+++ b/utils/uriplaylistbin/tests/uriplaylistbin.rs
-@@ -388,6 +388,7 @@ fn multi_audio() {
-     assert_eq!(current_uri_index, 2);
- }
- 
-+#[ignore = "Unknown failure"]
- #[test]
- fn multi_audio_video() {
-     let (_events, current_iteration, current_uri_index, eos) = test(
-@@ -403,6 +404,7 @@ fn multi_audio_video() {
-     assert_eq!(current_uri_index, 1);
- }
- 
-+#[ignore = "Unknown failure"]
- #[test]
- fn iterations() {
-     let (_events, current_iteration, current_uri_index, eos) = test(
diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index 3c1ed7d52f8d..b8c2be527e7f 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -33,14 +33,14 @@
 
 buildPythonPackage rec {
   pname = "accelerate";
-  version = "1.10.1";
+  version = "1.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "accelerate";
     tag = "v${version}";
-    hash = "sha256-guUlgNRSgBmi5HZNnwPA6GQ1vq5LzZEW2J9w4Wmqh6o=";
+    hash = "sha256-RdqApMgf5EoiFjNAUhVNS3xaqszl2myMF9B5HJBfHOA=";
   };
 
   buildInputs = [ llvmPackages.openmp ];
diff --git a/pkgs/development/python-modules/aiosomecomfort/default.nix b/pkgs/development/python-modules/aiosomecomfort/default.nix
index 43256333cdcb..98ada059e360 100644
--- a/pkgs/development/python-modules/aiosomecomfort/default.nix
+++ b/pkgs/development/python-modules/aiosomecomfort/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "aiosomecomfort";
-  version = "0.0.34";
+  version = "0.0.35";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkmer";
     repo = "AIOSomecomfort";
     tag = version;
-    hash = "sha256-aHqroDhMYlBF20JNSMZDkfYvio15XTrG+9NANSTC1Fw=";
+    hash = "sha256-zhCpV11nzRpWiCPNgeBfBzXgLM2NAw1p9R0ACD3u/mk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/azure-storage-queue/default.nix b/pkgs/development/python-modules/azure-storage-queue/default.nix
index 8e0814f06fa5..11aa7ee0506d 100644
--- a/pkgs/development/python-modules/azure-storage-queue/default.nix
+++ b/pkgs/development/python-modules/azure-storage-queue/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "azure-storage-queue";
-  version = "12.13.0";
+  version = "12.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "azure_storage_queue";
     inherit version;
-    hash = "sha256-JWkeeVjSSXA5JFETTfpUdjf9Lfz95bNHai4VLlaXP4w=";
+    hash = "sha256-WIhM62wQqF3NIuOJreMr46bzbsWHxC5O/AZO/D7yV0M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/construct-typing/default.nix b/pkgs/development/python-modules/construct-typing/default.nix
index d56525e538fa..071d73658370 100644
--- a/pkgs/development/python-modules/construct-typing/default.nix
+++ b/pkgs/development/python-modules/construct-typing/default.nix
@@ -8,6 +8,7 @@
   typing-extensions,
   arrow,
   cloudpickle,
+  cryptography,
   numpy,
   pytestCheckHook,
   ruamel-yaml,
@@ -15,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "construct-typing";
-  version = "0.6.2";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "timrid";
     repo = "construct-typing";
     tag = "v${version}";
-    hash = "sha256-zXpxu+VUcepEoAPLQnSlMCZkt8fDsMCLS0HBKhaYD20=";
+    hash = "sha256-iiMnt/f1ppciL6AVq3q0wOtoARcNYJycQA5Ev+dIow8=";
   };
 
   build-system = [ setuptools ];
@@ -42,22 +43,12 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     arrow
     cloudpickle
+    cryptography
     numpy
     pytestCheckHook
     ruamel-yaml
   ];
 
-  disabledTests = [
-    # tests fail with construct>=2.10.70
-    "test_bitsinteger"
-    "test_bytesinteger"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.13") [
-    # https://github.com/timrid/construct-typing/issues/31
-    "test_tenum_docstring"
-    "test_tenum_flags_docstring"
-  ];
-
   meta = {
     changelog = "https://github.com/timrid/construct-typing/releases/tag/v${version}";
     description = "Extension for the python package 'construct' that adds typing features";
diff --git a/pkgs/development/python-modules/gmpy2/default.nix b/pkgs/development/python-modules/gmpy2/default.nix
index ff9b834ca501..33712b519afc 100644
--- a/pkgs/development/python-modules/gmpy2/default.nix
+++ b/pkgs/development/python-modules/gmpy2/default.nix
@@ -59,18 +59,6 @@ buildPythonPackage rec {
     mpmath
   ];
 
-  disabledTests =
-    lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
-      # issue with some overflow logic
-      "test_mpz_to_bytes"
-      "test_mpz_from_bytes"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # TypeError: mpq() requires numeric or string argument
-      # not sure why it only fails on Darwin
-      "test_mpq_from_Decimal"
-    ];
-
   pythonImportsCheck = [ "gmpy2" ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/ha-silabs-firmware-client/default.nix b/pkgs/development/python-modules/ha-silabs-firmware-client/default.nix
index dd983d98cdd4..dbe4b27569dd 100644
--- a/pkgs/development/python-modules/ha-silabs-firmware-client/default.nix
+++ b/pkgs/development/python-modules/ha-silabs-firmware-client/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "ha-silabs-firmware-client";
-  version = "0.2.0";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "ha-silabs-firmware-client";
     tag = "v${version}";
-    hash = "sha256-Kip9JL9tuF7OI22elN0w2Z7Xjdaayboo8LThp4FAets=";
+    hash = "sha256-OCDMJtcgBfVKATJQgqH/YuEU8112tSBjqT81jDUu4b8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/nt/ntfy/webpush.nix b/pkgs/development/python-modules/ntfy-webpush/default.nix
similarity index 82%
rename from pkgs/by-name/nt/ntfy/webpush.nix
rename to pkgs/development/python-modules/ntfy-webpush/default.nix
index 9c7adcad3981..0aed4f2c10b8 100644
--- a/pkgs/by-name/nt/ntfy/webpush.nix
+++ b/pkgs/development/python-modules/ntfy-webpush/default.nix
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "dschep";
     repo = "ntfy-webpush";
-    rev = "v${version}";
-    sha256 = "1dxlvq3glf8yjkn1hdk89rx1s4fi9ygg46yn866a9v7a5a83zx2n";
+    tag = "v${version}";
+    hash = "sha256-VvQ/kCrq7KSMQdYb8p5P0REdek5oNhjslB45+gbetLc=";
   };
 
   postPatch = ''
@@ -35,10 +35,10 @@ buildPythonPackage rec {
   # no tests, just a script
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "Cloudbell webpush notification support for ntfy";
     homepage = "https://dschep.github.io/ntfy-webpush/";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/plotly/default.nix b/pkgs/development/python-modules/plotly/default.nix
index ed023d9f8389..cd89a0df1ae9 100644
--- a/pkgs/development/python-modules/plotly/default.nix
+++ b/pkgs/development/python-modules/plotly/default.nix
@@ -38,14 +38,14 @@
 
 buildPythonPackage rec {
   pname = "plotly";
-  version = "6.3.0";
+  version = "6.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "plotly";
     repo = "plotly.py";
     tag = "v${version}";
-    hash = "sha256-s+kWJy/dOqlNqRD/Ytxy/SSRsFJvp13jSvPMd0LQliQ=";
+    hash = "sha256-zwJTesrtLreu7To795wJmowgZ3c4d0mHUaLt3C9Fqd8=";
   };
 
   postPatch = ''
@@ -102,6 +102,8 @@ buildPythonPackage rec {
     "test_lazy_imports"
     # [0.0, 'rgb(252, 255, 164)'] != [0.0, '#fcffa4']
     "test_acceptance_named"
+    # AssertionError: assert '' == 'browser'
+    "test_default_renderer"
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/schedula/default.nix b/pkgs/development/python-modules/schedula/default.nix
index 0f47dfd8d2fa..d247f11c611f 100644
--- a/pkgs/development/python-modules/schedula/default.nix
+++ b/pkgs/development/python-modules/schedula/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "schedula";
-  version = "1.5.64";
+  version = "1.5.65";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vinci1it2000";
     repo = "schedula";
     tag = "v${version}";
-    hash = "sha256-huMhJTMiTVrKyZ5z0dFfw61GHyLbpHNtZGXP4gmUdTs=";
+    hash = "sha256-f67W6oyX7oEZSGXTth+FHOa8efj1tQ+B0taDDqjOSR8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/smolagents/default.nix b/pkgs/development/python-modules/smolagents/default.nix
index 86e6a46ea26a..651f53a55a50 100644
--- a/pkgs/development/python-modules/smolagents/default.nix
+++ b/pkgs/development/python-modules/smolagents/default.nix
@@ -62,15 +62,6 @@ buildPythonPackage rec {
     hash = "sha256-X9tJfNxF2icULyma0dWIQEllY9oKaCB+MQ4JJTdzhz4=";
   };
 
-  # TODO: remove at the next release
-  # ImportError: cannot import name 'require_soundfile' from 'transformers.testing_utils'
-  # Caused by: https://github.com/huggingface/transformers/commit/1ecd52e50a31e7c344c32564e0484d7e9a0f2256
-  # Fixed in: https://github.com/huggingface/smolagents/pull/1625
-  postPatch = ''
-    substituteInPlace tests/test_types.py \
-      --replace-fail "require_soundfile" "require_torchcodec"
-  '';
-
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/triton/bin.nix b/pkgs/development/python-modules/triton/bin.nix
index 7edc81d576a6..74755a13b2fe 100644
--- a/pkgs/development/python-modules/triton/bin.nix
+++ b/pkgs/development/python-modules/triton/bin.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "triton";
-  version = "3.4.0";
+  version = "3.5.0";
   format = "wheel";
 
   src =
@@ -63,6 +63,9 @@ buildPythonPackage rec {
       mit
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ junjihashimoto ];
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+      junjihashimoto
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/triton/binary-hashes.nix b/pkgs/development/python-modules/triton/binary-hashes.nix
index 54eda3494663..39976f373656 100644
--- a/pkgs/development/python-modules/triton/binary-hashes.nix
+++ b/pkgs/development/python-modules/triton/binary-hashes.nix
@@ -7,46 +7,56 @@
 
 version:
 builtins.getAttr version {
-  "3.4.0" = {
+  "3.5.0" = {
     aarch64-linux-310 = {
-      name = "triton-3.4.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.4.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-husMt2NDKM1Xf6UbWTOPGvQZnPmrYjhaxCqCeD2RFqQ=";
+      name = "triton-3.5.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-JTyIky/VWN9S+GxmNynofNOKGacVFYG+W9X0v9WPhpo=";
     };
     x86_64-linux-310 = {
-      name = "triton-3.4.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.4.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-axdYjFnL4dmHEz6nzRzC5SKeBUSgapkIv69oxh9WSVo=";
+      name = "triton-3.5.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-u6PqGcwYGVNIOVmYj0/Xk6dZg+v+z2VH1YOogGq43Pw=";
     };
     aarch64-linux-311 = {
-      name = "triton-3.4.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.4.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-3Y0y0zf1gST+JUBD0oKkvBM8Ksp5ibxjWLLFRtISFRM=";
+      name = "triton-3.5.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-SYEl6jXOSJaaRvp5OdfmgCVAoTlXomIw1mo4t6zn32g=";
     };
     x86_64-linux-311 = {
-      name = "triton-3.4.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.4.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-4rCv5CDSAtlvULhH10Skh7eAVnl1RV5W9ksGEVLulVQ=";
+      name = "triton-3.5.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-JjiByshHffhNOWS+dlt/rBfdP/oK1vywMLhBvXT5QIs=";
     };
     aarch64-linux-312 = {
-      name = "triton-3.4.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.4.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-AOpKHBXwebv0n/AsMSIQ/bj/BbFQPqMIEmEOKjsXHzs=";
+      name = "triton-3.5.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-m4K0bfNa6eC4WjgtmaB25uvqI6Ol26yn3CSnVx5r660=";
     };
     x86_64-linux-312 = {
-      name = "triton-3.4.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.4.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-hVBnKxGE8FGH9BQNsy4z5htZIEb9Ph65B+O321Mht1A=";
+      name = "triton-3.5.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-dvhlGl44wqfab6Ky5By8AKWjLLUr8/UgET/pC3I6MQ0=";
     };
     aarch64-linux-313 = {
-      name = "triton-3.4.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.4.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-WstSjwHcFDYsSoj6Tc+iJ9Ey9uYfJypodOhNZIUDfKQ=";
+      name = "triton-3.5.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-BeFFtRpTVzv/JgQx/0D63OCDitmSjF7hiDtT1ZiE4Zg=";
     };
     x86_64-linux-313 = {
-      name = "triton-3.4.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.4.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-Dlgr/YFHr9Dhf0ELOe4WHfkzoqyp9lPhF42q6Y+H9gE=";
+      name = "triton-3.5.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-tvbbiVAabcSkkv8oFGDBsVVjQgvJCTR3CqanuA/VHJU=";
+    };
+    aarch64-linux-314 = {
+      name = "triton-3.5.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-ThqFbR1zFzTuntYt3lSPNC00yYi41+I1vyA35CjeIlg=";
+    };
+    x86_64-linux-314 = {
+      name = "triton-3.5.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.5.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-jZi3ioPpECVuxwNIa4wnXsU5deWsSoy3zgfGluCPa1o=";
     };
   };
 }
diff --git a/pkgs/development/rocm-modules/6/default.nix b/pkgs/development/rocm-modules/6/default.nix
index ba7a72a117c1..be9b1d2a9174 100644
--- a/pkgs/development/rocm-modules/6/default.nix
+++ b/pkgs/development/rocm-modules/6/default.nix
@@ -134,10 +134,7 @@ let
           ;
       };
 
-      rocblas = self.callPackage ./rocblas {
-        buildTests = true;
-        buildBenchmarks = true;
-      };
+      rocblas = self.callPackage ./rocblas { };
 
       rocsolver = self.callPackage ./rocsolver { };
 
diff --git a/pkgs/development/rocm-modules/6/rocblas/default.nix b/pkgs/development/rocm-modules/6/rocblas/default.nix
index 33d707747056..0c9c2ee5c424 100644
--- a/pkgs/development/rocm-modules/6/rocblas/default.nix
+++ b/pkgs/development/rocm-modules/6/rocblas/default.nix
@@ -25,8 +25,8 @@
   rocm-smi,
   pkg-config,
   buildTensile ? true,
-  buildTests ? true,
-  buildBenchmarks ? true,
+  buildTests ? false,
+  buildBenchmarks ? false,
   tensileSepArch ? true,
   tensileLazyLib ? true,
   withHipBlasLt ? true,
@@ -130,8 +130,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "Tensile_LAZY_LIBRARY_LOADING" tensileLazyLib)
   ];
 
-  passthru.amdgpu_targets = gpuTargets';
-
   patches = [
     (fetchpatch {
       name = "Extend-rocBLAS-HIP-ISA-compatibility.patch";
@@ -150,10 +148,17 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail '0.10' '1.0'
   '';
 
-  passthru.updateScript = rocmUpdateScript {
-    name = finalAttrs.pname;
-    inherit (finalAttrs.src) owner;
-    inherit (finalAttrs.src) repo;
+  passthru = {
+    amdgpu_targets = gpuTargets';
+    tests.rocblas-tests = finalAttrs.finalPackage.override {
+      buildBenchmarks = true;
+      buildTests = true;
+    };
+    updateScript = rocmUpdateScript {
+      name = finalAttrs.pname;
+      inherit (finalAttrs.src) owner;
+      inherit (finalAttrs.src) repo;
+    };
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/servers/sql/mysql/8.0.x.nix b/pkgs/servers/sql/mysql/8.0.x.nix
index 3345c368a6da..9b158fad46d6 100644
--- a/pkgs/servers/sql/mysql/8.0.x.nix
+++ b/pkgs/servers/sql/mysql/8.0.x.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.0.43";
+  version = "8.0.44";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-diUKgQFch49iUhz68w3/DqmyUJeNKx3/AHQIo5jV25M=";
+    hash = "sha256-YJUi7R/vzlqziN7CXg0bzhMjgtom4rd7aPB0HApkE1Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9db231bda185..f04ef428e2d5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1152,6 +1152,7 @@ mapAliases {
   PageEdit = throw "'PageEdit' has been renamed to/replaced by 'pageedit'"; # Converted to throw 2025-10-27
   pal = throw "pal has been removed, as it was broken"; # Added 2025-08-25
   paperless-ng = throw "'paperless-ng' has been renamed to/replaced by 'paperless-ngx'"; # Converted to throw 2025-10-27
+  parcellite = throw "'parcellite' was remove due to lack of maintenance and relying on gtk2"; # Added 2025-10-03
   patchelfStable = throw "'patchelfStable' has been renamed to/replaced by 'patchelf'"; # Converted to throw 2025-10-27
   paup = throw "'paup' has been renamed to/replaced by 'paup-cli'"; # Converted to throw 2025-10-27
   pcp = throw "'pcp' has been removed because the upstream repo was archived and it hasn't been updated since 2021"; # Added 2025-09-23
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fc1d88857705..7d1247c2eb9a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3568,8 +3568,6 @@ with pkgs;
   pandoc-secnos = python3Packages.callPackage ../tools/misc/pandoc-secnos { };
   pandoc-tablenos = python3Packages.callPackage ../tools/misc/pandoc-tablenos { };
 
-  pegasus-frontend = libsForQt5.callPackage ../games/pegasus-frontend { };
-
   pgbadger = perlPackages.callPackage ../tools/misc/pgbadger { };
 
   nifskope = libsForQt5.callPackage ../tools/graphics/nifskope { };
@@ -4148,8 +4146,6 @@ with pkgs;
 
   vacuum = libsForQt5.callPackage ../applications/networking/instant-messengers/vacuum { };
 
-  vcmi = libsForQt5.callPackage ../games/vcmi { };
-
   video2midi = callPackage ../tools/audio/video2midi {
     pythonPackages = python3Packages;
   };
@@ -5028,8 +5024,6 @@ with pkgs;
     indradb-client
     ;
 
-  instawow = callPackage ../games/instawow/default.nix { };
-
   irony-server = callPackage ../development/tools/irony-server {
     # The repository of irony to use -- must match the version of the employed emacs
     # package.  Wishing we could merge it into one irony package, to avoid this issue,
@@ -10009,8 +10003,6 @@ with pkgs;
   libkrun-sev = libkrun.override { variant = "sev"; };
   libkrun-tdx = libkrun.override { variant = "tdx"; };
 
-  linthesia = callPackage ../games/linthesia/default.nix { };
-
   projecteur = libsForQt5.callPackage ../os-specific/linux/projecteur { };
 
   lklWithFirewall = lkl.override { firewallSupport = true; };
@@ -13045,8 +13037,6 @@ with pkgs;
 
   ### GAMES/DOOM-PORTS
 
-  doomseeker = qt5.callPackage ../games/doom-ports/doomseeker { };
-
   enyo-launcher = libsForQt5.callPackage ../games/doom-ports/enyo-launcher { };
 
   zandronum = callPackage ../games/doom-ports/zandronum { };
@@ -13057,8 +13047,6 @@ with pkgs;
 
   fmodex = callPackage ../games/doom-ports/zandronum/fmod.nix { };
 
-  qgo = libsForQt5.callPackage ../games/qgo { };
-
   anki-utils = callPackage ../by-name/an/anki/addons/anki-utils.nix { };
   ankiAddons = recurseIntoAttrs (callPackage ../by-name/an/anki/addons { });
 
@@ -13087,10 +13075,6 @@ with pkgs;
 
   cataclysm-dda-git = cataclysmDDA.git.tiles;
 
-  chiaki = libsForQt5.callPackage ../games/chiaki { };
-
-  chiaki-ng = kdePackages.callPackage ../games/chiaki-ng { };
-
   cockatrice = libsForQt5.callPackage ../games/cockatrice {
     protobuf = protobuf_21;
   };
@@ -13107,12 +13091,10 @@ with pkgs;
     inherit libGL libGLU libglut;
   };
 
-  crawlTiles = callPackage ../games/crawl {
+  crawlTiles = callPackage ../by-name/cr/crawl/package.nix {
     tileMode = true;
   };
 
-  crawl = callPackage ../games/crawl { };
-
   curseofwar = callPackage ../games/curseofwar { SDL = null; };
   curseofwar-sdl = callPackage ../games/curseofwar { ncurses = null; };
 
@@ -13126,14 +13108,12 @@ with pkgs;
 
   dfhack = dwarf-fortress-packages.dwarf-fortress-full;
 
-  dxx-rebirth = callPackage ../games/dxx-rebirth { };
-
-  inherit (callPackages ../games/dxx-rebirth/assets.nix { })
+  inherit (callPackages ../by-name/dx/dxx-rebirth/assets.nix { })
     descent1-assets
     descent2-assets
     ;
 
-  inherit (callPackages ../games/dxx-rebirth/full.nix { })
+  inherit (callPackages ../by-name/dx/dxx-rebirth/full.nix { })
     d1x-rebirth-full
     d2x-rebirth-full
     ;
@@ -13198,13 +13178,10 @@ with pkgs;
 
   gscrabble = python3Packages.callPackage ../games/gscrabble { };
 
-  qtads = qt5.callPackage ../games/qtads { };
-
   ibmcloud-cli = callPackage ../tools/admin/ibmcloud-cli { stdenv = stdenvNoCC; };
 
-  iortcw = callPackage ../games/iortcw { };
   # used as base package for iortcw forks
-  iortcw_sp = callPackage ../games/iortcw/sp.nix { };
+  iortcw_sp = callPackage ../by-name/io/iortcw/sp.nix { };
 
   katagoWithCuda = katago.override {
     backend = "cuda";
@@ -13218,9 +13195,7 @@ with pkgs;
     backend = "tensorrt";
   };
 
-  koboredux = callPackage ../games/koboredux { };
-
-  koboredux-free = callPackage ../games/koboredux {
+  koboredux-free = callPackage ../by-name/ko/koboredux/package.nix {
     useProprietaryAssets = false;
   };
 
@@ -13259,16 +13234,9 @@ with pkgs;
   luanti-client = luanti.override { buildServer = false; };
   luanti-server = luanti.override { buildClient = false; };
 
-  mudlet = libsForQt5.callPackage ../games/mudlet {
-    lua = lua5_1;
-  };
+  blightmud-tts = callPackage ../by-name/bl/blightmud/package.nix { withTTS = true; };
 
-  blightmud = callPackage ../games/blightmud { };
-
-  blightmud-tts = callPackage ../games/blightmud { withTTS = true; };
-
-  npush = callPackage ../games/npush { };
-  run-npush = callPackage ../games/npush/run.nix { };
+  run-npush = callPackage ../by-name/np/npush/run.nix { };
 
   openloco = pkgsi686Linux.callPackage ../games/openloco { };
 
@@ -13296,8 +13264,6 @@ with pkgs;
   openttd-grfcodec = callPackage ../games/openttd/grfcodec.nix { };
   openttd-nml = callPackage ../games/openttd/nml.nix { };
 
-  openxcom = callPackage ../games/openxcom { SDL = SDL_compat; };
-
   openxray = callPackage ../games/openxray {
     # Builds with Clang, but hits an assertion failure unless GCC is used
     # https://github.com/OpenXRay/xray-16/issues/1224
@@ -13333,20 +13299,13 @@ with pkgs;
     quake3hires
     ;
 
-  quakespasm = callPackage ../games/quakespasm { };
-  vkquake = callPackage ../games/quakespasm/vulkan.nix { };
-
-  rogue = callPackage ../games/rogue {
-    ncurses = ncurses5;
-  };
+  vkquake = callPackage ../by-name/qu/quakespasm/vulkan.nix { };
 
   rott-shareware = callPackage ../by-name/ro/rott/package.nix {
     buildShareware = true;
   };
 
-  scummvm = callPackage ../games/scummvm { };
-
-  inherit (callPackage ../games/scummvm/games.nix { })
+  inherit (callPackage ../by-name/sc/scummvm/games.nix { })
     beneath-a-steel-sky
     broken-sword-25
     drascula-the-vampire-strikes-back
@@ -13359,23 +13318,20 @@ with pkgs;
     isMobile = true;
   };
 
-  shattered-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon { };
-  rkpd2 = callPackage ../games/shattered-pixel-dungeon/rkpd2 { };
-  rat-king-adventure = callPackage ../games/shattered-pixel-dungeon/rat-king-adventure { };
+  rkpd2 = callPackage ../by-name/sh/shattered-pixel-dungeon/rkpd2 { };
+  rat-king-adventure = callPackage ../by-name/sh/shattered-pixel-dungeon/rat-king-adventure { };
   experienced-pixel-dungeon =
-    callPackage ../games/shattered-pixel-dungeon/experienced-pixel-dungeon
+    callPackage ../by-name/sh/shattered-pixel-dungeon/experienced-pixel-dungeon
       { };
-  summoning-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon/summoning-pixel-dungeon { };
-  shorter-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon/shorter-pixel-dungeon { };
-  tower-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon/tower-pixel-dungeon { };
+  summoning-pixel-dungeon =
+    callPackage ../by-name/sh/shattered-pixel-dungeon/summoning-pixel-dungeon
+      { };
+  shorter-pixel-dungeon = callPackage ../by-name/sh/shattered-pixel-dungeon/shorter-pixel-dungeon { };
+  tower-pixel-dungeon = callPackage ../by-name/sh/shattered-pixel-dungeon/tower-pixel-dungeon { };
 
   # get binaries without data built by Hydra
   simutrans_binaries = lowPrio simutrans.binaries;
 
-  soi = callPackage ../games/soi {
-    lua = lua5_1;
-  };
-
   steam-run = steam.run;
   steam-run-free = steam.run-free;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a6c1c4bc03fe..f76176309239 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10736,6 +10736,8 @@ self: super: with self; {
 
   ntc-templates = callPackage ../development/python-modules/ntc-templates { };
 
+  ntfy-webpush = callPackage ../development/python-modules/ntfy-webpush { };
+
   ntplib = callPackage ../development/python-modules/ntplib { };
 
   nuclear = callPackage ../development/python-modules/nuclear { };