diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index f5a04ad073bc..14876ecf6294 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: |
-            ci/labels
+            ci/github-script
 
       - name: Install dependencies
         run: npm install @actions/artifact bottleneck
@@ -69,7 +69,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            require('./ci/labels/labels.cjs')({
+            require('./ci/github-script/labels.js')({
               github,
               context,
               core,
diff --git a/ci/github-script/.editorconfig b/ci/github-script/.editorconfig
new file mode 100644
index 000000000000..67d678ef170c
--- /dev/null
+++ b/ci/github-script/.editorconfig
@@ -0,0 +1,3 @@
+[run]
+indent_style = space
+indent_size = 2
diff --git a/ci/labels/.gitignore b/ci/github-script/.gitignore
similarity index 100%
rename from ci/labels/.gitignore
rename to ci/github-script/.gitignore
diff --git a/ci/labels/.npmrc b/ci/github-script/.npmrc
similarity index 100%
rename from ci/labels/.npmrc
rename to ci/github-script/.npmrc
diff --git a/ci/github-script/README.md b/ci/github-script/README.md
new file mode 100644
index 000000000000..caf52eb5bba3
--- /dev/null
+++ b/ci/github-script/README.md
@@ -0,0 +1,13 @@
+# GitHub specific CI scripts
+
+This folder contains [`actions/github-script`](https://github.com/actions/github-script)-based JavaScript code.
+It provides a `nix-shell` environment to run and test these actions locally.
+
+To run any of the scripts locally:
+
+- Enter `nix-shell` in `./ci/github-script`.
+- Ensure `gh` is authenticated.
+
+## Labeler
+
+Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
diff --git a/ci/labels/labels.cjs b/ci/github-script/labels.js
similarity index 85%
rename from ci/labels/labels.cjs
rename to ci/github-script/labels.js
index 809dc4581bb8..7bbe1497d906 100644
--- a/ci/labels/labels.cjs
+++ b/ci/github-script/labels.js
@@ -1,61 +1,12 @@
 module.exports = async function ({ github, context, core, dry }) {
-  const Bottleneck = require('bottleneck')
   const path = require('node:path')
   const { DefaultArtifactClient } = require('@actions/artifact')
   const { readFile, writeFile } = require('node:fs/promises')
+  const withRateLimit = require('./withRateLimit.js')
 
   const artifactClient = new DefaultArtifactClient()
 
-  const stats = {
-    issues: 0,
-    prs: 0,
-    requests: 0,
-    artifacts: 0,
-  }
-
-  // Rate-Limiting and Throttling, see for details:
-  //   https://github.com/octokit/octokit.js/issues/1069#throttling
-  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
-  const allLimits = new Bottleneck({
-    // Avoid concurrent requests
-    maxConcurrent: 1,
-    // Will be updated with first `updateReservoir()` call below.
-    reservoir: 0,
-  })
-  // Pause between mutative requests
-  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
-  github.hook.wrap('request', async (request, options) => {
-    // Requests to the /rate_limit endpoint do not count against the rate limit.
-    if (options.url == '/rate_limit') return request(options)
-    // Search requests are in a different resource group, which allows 30 requests / minute.
-    // We do less than a handful each run, so not implementing throttling for now.
-    if (options.url.startsWith('/search/')) return request(options)
-    stats.requests++
-    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
-      return writeLimits.schedule(request.bind(null, options))
-    else return allLimits.schedule(request.bind(null, options))
-  })
-
-  async function updateReservoir() {
-    let response
-    try {
-      response = await github.rest.rateLimit.get()
-    } catch (err) {
-      core.error(`Failed updating reservoir:\n${err}`)
-      // Keep retrying on failed rate limit requests instead of exiting the script early.
-      return
-    }
-    // Always keep 1000 spare requests for other jobs to do their regular duty.
-    // They normally use below 100, so 1000 is *plenty* of room to work with.
-    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
-    core.info(`Updating reservoir to: ${reservoir}`)
-    allLimits.updateSettings({ reservoir })
-  }
-  await updateReservoir()
-  // Update remaining requests every minute to account for other jobs running in parallel.
-  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
-
-  async function handlePullRequest(item) {
+  async function handlePullRequest({ item, stats }) {
     const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
 
     const pull_number = item.number
@@ -221,7 +172,7 @@ module.exports = async function ({ github, context, core, dry }) {
     return prLabels
   }
 
-  async function handle(item) {
+  async function handle({ item, stats }) {
     try {
       const log = (k, v, skip) => {
         core.info(`#${item.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
@@ -237,7 +188,7 @@ module.exports = async function ({ github, context, core, dry }) {
 
       if (item.pull_request || context.payload.pull_request) {
         stats.prs++
-        Object.assign(itemLabels, await handlePullRequest(item))
+        Object.assign(itemLabels, await handlePullRequest({ item, stats }))
       } else {
         stats.issues++
       }
@@ -326,9 +277,9 @@ module.exports = async function ({ github, context, core, dry }) {
     }
   }
 
-  try {
+  await withRateLimit({ github, core }, async (stats) => {
     if (context.payload.pull_request) {
-      await handle(context.payload.pull_request)
+      await handle({ item: context.payload.pull_request, stats })
     } else {
       const lastRun = (
         await github.rest.actions.listWorkflowRuns({
@@ -447,17 +398,11 @@ module.exports = async function ({ github, context, core, dry }) {
             arr.findIndex((firstItem) => firstItem.number == thisItem.number),
         )
 
-      ;(await Promise.allSettled(items.map(handle)))
+      ;(await Promise.allSettled(items.map((item) => handle({ item, stats }))))
         .filter(({ status }) => status == 'rejected')
         .map(({ reason }) =>
           core.setFailed(`${reason.message}\n${reason.cause.stack}`),
         )
-
-      core.notice(
-        `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
-      )
     }
-  } finally {
-    clearInterval(reservoirUpdater)
-  }
+  })
 }
diff --git a/ci/labels/package-lock.json b/ci/github-script/package-lock.json
similarity index 99%
rename from ci/labels/package-lock.json
rename to ci/github-script/package-lock.json
index 5c5ee09ad67e..538083dcea93 100644
--- a/ci/labels/package-lock.json
+++ b/ci/github-script/package-lock.json
@@ -1,5 +1,5 @@
 {
-  "name": "labels",
+  "name": "github-script",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
@@ -7,7 +7,8 @@
       "dependencies": {
         "@actions/artifact": "2.3.2",
         "@actions/github": "6.0.1",
-        "bottleneck": "2.19.5"
+        "bottleneck": "2.19.5",
+        "commander": "14.0.0"
       }
     },
     "node_modules/@actions/artifact": {
@@ -950,6 +951,15 @@
       "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "license": "MIT"
     },
+    "node_modules/commander": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.0.tgz",
+      "integrity": "sha512-2uM9rYjPvyq39NwLRqaiLtWHyDC1FvryJDa2ATTVims5YAS4PupsEQsDvP14FqhFr0P49CYDugi59xaxJlTXRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/compress-commons": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-6.0.2.tgz",
diff --git a/ci/labels/package.json b/ci/github-script/package.json
similarity index 67%
rename from ci/labels/package.json
rename to ci/github-script/package.json
index e07813aa86b5..4671dd41f0cd 100644
--- a/ci/labels/package.json
+++ b/ci/github-script/package.json
@@ -1,9 +1,9 @@
 {
   "private": true,
-  "type": "module",
   "dependencies": {
     "@actions/artifact": "2.3.2",
     "@actions/github": "6.0.1",
-    "bottleneck": "2.19.5"
+    "bottleneck": "2.19.5",
+    "commander": "14.0.0"
   }
 }
diff --git a/ci/github-script/run b/ci/github-script/run
new file mode 100755
index 000000000000..cbf3ea9315e0
--- /dev/null
+++ b/ci/github-script/run
@@ -0,0 +1,67 @@
+#!/usr/bin/env -S node --import ./run
+import { execSync } from 'node:child_process'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { program } from 'commander'
+import { getOctokit } from '@actions/github'
+
+async function run(action, owner, repo, pull_number, dry) {
+  const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
+
+  const github = getOctokit(token)
+
+  const payload = !pull_number ? {} : {
+    pull_request: (await github.rest.pulls.get({
+      owner,
+      repo,
+      pull_number,
+    })).data
+  }
+
+  const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
+  try {
+    process.env.GITHUB_WORKSPACE = tmp
+    process.chdir(tmp)
+
+    await action({
+      github,
+      context: {
+        payload,
+        repo: {
+          owner,
+          repo,
+        },
+      },
+      core: {
+        getInput() {
+          return token
+        },
+        error: console.error,
+        info: console.log,
+        notice: console.log,
+        setFailed(msg) {
+          console.error(msg)
+          process.exitCode = 1
+        },
+      },
+      dry,
+    })
+  } finally {
+    rmSync(tmp, { recursive: true })
+  }
+}
+
+program
+  .command('labels')
+  .description('Manage labels on pull requests.')
+  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
+  .argument('[pr]', 'Number of the Pull Request to label')
+  .option('--no-dry', 'Make actual modifications')
+  .action(async (owner, repo, pr, options) => {
+    const labels = (await import('./labels.js')).default
+    run(labels, owner, repo, pr, options.dry)
+  })
+
+await program.parse()
diff --git a/ci/labels/shell.nix b/ci/github-script/shell.nix
similarity index 95%
rename from ci/labels/shell.nix
rename to ci/github-script/shell.nix
index dd84ba3ad73d..82f03de4b1a0 100644
--- a/ci/labels/shell.nix
+++ b/ci/github-script/shell.nix
@@ -5,12 +5,14 @@
 
 pkgs.callPackage (
   {
-    mkShell,
+    gh,
     importNpmLock,
+    mkShell,
     nodejs,
   }:
   mkShell {
     packages = [
+      gh
       importNpmLock.hooks.linkNodeModulesHook
       nodejs
     ];
diff --git a/ci/github-script/withRateLimit.js b/ci/github-script/withRateLimit.js
new file mode 100644
index 000000000000..03fbd54291a8
--- /dev/null
+++ b/ci/github-script/withRateLimit.js
@@ -0,0 +1,61 @@
+module.exports = async function ({ github, core }, callback) {
+  const Bottleneck = require('bottleneck')
+
+  const stats = {
+    issues: 0,
+    prs: 0,
+    requests: 0,
+    artifacts: 0,
+  }
+
+  // Rate-Limiting and Throttling, see for details:
+  //   https://github.com/octokit/octokit.js/issues/1069#throttling
+  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
+  const allLimits = new Bottleneck({
+    // Avoid concurrent requests
+    maxConcurrent: 1,
+    // Will be updated with first `updateReservoir()` call below.
+    reservoir: 0,
+  })
+  // Pause between mutative requests
+  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
+  github.hook.wrap('request', async (request, options) => {
+    // Requests to the /rate_limit endpoint do not count against the rate limit.
+    if (options.url == '/rate_limit') return request(options)
+    // Search requests are in a different resource group, which allows 30 requests / minute.
+    // We do less than a handful each run, so not implementing throttling for now.
+    if (options.url.startsWith('/search/')) return request(options)
+    stats.requests++
+    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
+      return writeLimits.schedule(request.bind(null, options))
+    else return allLimits.schedule(request.bind(null, options))
+  })
+
+  async function updateReservoir() {
+    let response
+    try {
+      response = await github.rest.rateLimit.get()
+    } catch (err) {
+      core.error(`Failed updating reservoir:\n${err}`)
+      // Keep retrying on failed rate limit requests instead of exiting the script early.
+      return
+    }
+    // Always keep 1000 spare requests for other jobs to do their regular duty.
+    // They normally use below 100, so 1000 is *plenty* of room to work with.
+    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
+    core.info(`Updating reservoir to: ${reservoir}`)
+    allLimits.updateSettings({ reservoir })
+  }
+  await updateReservoir()
+  // Update remaining requests every minute to account for other jobs running in parallel.
+  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
+
+  try {
+    await callback(stats)
+  } finally {
+    clearInterval(reservoirUpdater)
+    core.notice(
+      `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
+    )
+  }
+}
diff --git a/ci/labels/.editorconfig b/ci/labels/.editorconfig
deleted file mode 100644
index 08ca1a194873..000000000000
--- a/ci/labels/.editorconfig
+++ /dev/null
@@ -1,4 +0,0 @@
-# TODO: Move to <top-level>/.editorconfig, once ci/.editorconfig has made its way through staging.
-[*.cjs]
-indent_style = space
-indent_size = 2
diff --git a/ci/labels/README.md b/ci/labels/README.md
deleted file mode 100644
index 26cd88763fe6..000000000000
--- a/ci/labels/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-To test the labeler locally:
-- Provide `gh` on `PATH` and make sure it's authenticated.
-- Enter `nix-shell` in `./ci/labels`.
-- Run `./run.js OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
diff --git a/ci/labels/run.js b/ci/labels/run.js
deleted file mode 100755
index d7e8e9ff9401..000000000000
--- a/ci/labels/run.js
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-import { execSync } from 'node:child_process'
-import { mkdtempSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { getOctokit } from '@actions/github'
-import labels from './labels.cjs'
-
-if (process.argv.length !== 4)
-  throw new Error('Call this with exactly two arguments: ./run.js OWNER REPO')
-const [, , owner, repo] = process.argv
-
-const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
-
-const tmp = mkdtempSync(join(tmpdir(), 'labels-'))
-try {
-  process.env.GITHUB_WORKSPACE = tmp
-  process.chdir(tmp)
-
-  await labels({
-    github: getOctokit(token),
-    context: {
-      payload: {},
-      repo: {
-        owner,
-        repo,
-      },
-    },
-    core: {
-      getInput() {
-        return token
-      },
-      error: console.error,
-      info: console.log,
-      notice: console.log,
-      setFailed(msg) {
-        console.error(msg)
-        process.exitCode = 1
-      },
-    },
-    dry: true,
-  })
-} finally {
-  rmSync(tmp, { recursive: true })
-}
diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 166e0d4c7266..9dd2af41957e 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -443,8 +443,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "...";
     fetcherVersion = 2;
+    hash = "...";
   };
 })
 ```
@@ -568,8 +568,8 @@ This is the version of the output of `pnpm.fetchDeps`, if you haven't set it alr
   # ...
   pnpmDeps = pnpm.fetchDeps {
     # ...
-    hash = "..."; # you can use your already set hash here
     fetcherVersion = 1;
+    hash = "..."; # you can use your already set hash here
   };
 }
 ```
@@ -581,8 +581,8 @@ After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
   # ...
   pnpmDeps = pnpm.fetchDeps {
     # ...
-    hash = "..."; # clear this hash and generate a new one
     fetcherVersion = 2;
+    hash = "..."; # clear this hash and generate a new one
   };
 }
 ```
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 1f28d5222632..3871e9ad9a57 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -43,6 +43,8 @@
   of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
   make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration.
 
+- `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with it's [upstream support lifecycle](https://vektra.github.io/mockery/
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index aaaeb90e9917..4307ae7684c2 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -327,18 +327,54 @@ Dependency propagation takes cross compilation into account, meaning that depend
 
 To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:
 
-| `host → target`     | attribute name      | offset   |
-| ------------------- | ------------------- | -------- |
-| `build --> build`   | `depsBuildBuild`    | `-1, -1` |
-| `build --> host`    | `nativeBuildInputs` | `-1, 0`  |
-| `build --> target`  | `depsBuildTarget`   | `-1, 1`  |
-| `host --> host`     | `depsHostHost`      | `0, 0`   |
-| `host --> target`   | `buildInputs`       | `0, 1`   |
-| `target --> target` | `depsTargetTarget`  | `1, 1`   |
+| `host → target`     | attribute name      | offset   | typical purpose                               |
+| ------------------- | ------------------- | -------- | --------------------------------------------- |
+| `build --> build`   | `depsBuildBuild`    | `-1, -1` | compilers for build helpers                   |
+| `build --> host`    | `nativeBuildInputs` | `-1, 0`  | build tools, compilers, setup hooks           |
+| `build --> target`  | `depsBuildTarget`   | `-1, 1`  | compilers to build stdlibs to run on target   |
+| `host --> host`     | `depsHostHost`      | `0, 0`   | compilers to build C code at runtime (rare)   |
+| `host --> target`   | `buildInputs`       | `0, 1`   | libraries                                     |
+| `target --> target` | `depsTargetTarget`  | `1, 1`   | stdlibs to run on target                      |
 
 Algorithmically, we traverse propagated inputs, accumulating every propagated dependency’s propagated dependencies and adjusting them to account for the “shift in perspective” described by the current dependency’s platform offsets. This results is sort of a transitive closure of the dependency relation, with the offsets being approximately summed when two dependency links are combined. We also prune transitive dependencies whose combined offsets go out-of-bounds, which can be viewed as a filter over that transitive closure removing dependencies that are blatantly absurd.
 
-We can define the process precisely with [Natural Deduction](https://en.wikipedia.org/wiki/Natural_deduction) using the inference rules. This probably seems a bit obtuse, but so is the bash code that actually implements it! [^footnote-stdenv-find-inputs-location] They’re confusing in very different ways so… hopefully if something doesn’t make sense in one presentation, it will in the other!
+We can define the process precisely with [Natural Deduction](https://en.wikipedia.org/wiki/Natural_deduction) using the inference rules below. This probably seems a bit obtuse, but so is the bash code that actually implements it! [^footnote-stdenv-find-inputs-location] They’re confusing in very different ways so… hopefully if something doesn’t make sense in one presentation, it will in the other!
+
+**Definitions:**
+
+`dep(h_offset, t_offset, X, Y)`
+:    Package X has a direct dependency on Y in a position with host offset `h_offset` and target offset `t_offset`.
+
+     For example, `nativeBuildInputs = [ Y ]` means `dep(-1, 0, X, Y)`.
+
+`propagated-dep(h_offset, t_offset, X, Y)`
+:    Package X has a propagated dependency on Y in a position with host offset `h_offset` and target offset `t_offset`.
+
+     For example, `depsBuildTargetPropagated = [ Y ]` means `propagated-dep(-1, 1, X, Y)`.
+
+`mapOffset(h, t, i) = offs`
+:    In a package X with a dependency on Y in a position with host offset `h` and target offset `t`, Y's transitive dependency Z in a position with offset `i` is mapped to offset `offs` in X.
+
+
+::: {.example}
+# Truth table of `mapOffset(h, t, i)`
+
+`x` means that the dependency was discarded because `h + i ∉ {-1, 0, 1}`.
+
+<!-- This is written as an ascii art table because the CSS was introducing so much space it was unreadable and doesn't support double lines -->
+
+```
+  h |   t  || i=-1 |  i=0 |  i=1
+----|------||------|------|-----
+ -1 |  -1  ||   x  |  -1  |  -1
+ -1 |   0  ||   x  |  -1  |   0
+ -1 |   1  ||   x  |  -1  |   1
+  0 |   0  ||  -1  |   0  |   0
+  0 |   1  ||  -1  |   0  |   1
+  1 |   1  ||   0  |   1  |   x
+```
+
+:::
 
 ```
 let mapOffset(h, t, i) = i + (if i <= 0 then h else t - 1)
@@ -372,7 +408,7 @@ propagated-dep(h, t, A, B)
 dep(h, t, A, B)
 ```
 
-Some explanation of this monstrosity is in order. In the common case, the target offset of a dependency is the successor to the host offset: `t = h + 1`. That means that:
+Some explanation of this monstrosity is in order. In the common case of `nativeBuildInputs` or `buildInputs`, the target offset of a dependency is one greater than the host offset: `t = h + 1`. That means that:
 
 ```
 let f(h, t, i) = i + (if i <= 0 then h else t - 1)
@@ -383,7 +419,11 @@ let f(h, h + 1, i) = i + h
 
 This is where “sum-like” comes in from above: We can just sum all of the host offsets to get the host offset of the transitive dependency. The target offset is the transitive dependency is the host offset + 1, just as it was with the dependencies composed to make this transitive one; it can be ignored as it doesn’t add any new information.
 
-Because of the bounds checks, the uncommon cases are `h = t` and `h + 2 = t`. In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package. In the other case, `h + 1` is skipped over between the host and target offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependencies’ offset is that one.
+Because of the bounds checks, the uncommon cases are `h = t` (`depsBuildBuild`, etc) and `h + 2 = t` (`depsBuildTarget`).
+
+In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package.
+
+In the other case, `h + 1` (0) is skipped over between the host (-1) and target (1) offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependency’s offset is 0.
 
 Overall, the unifying theme here is that propagation shouldn’t be introducing transitive dependencies involving platforms the depending package is unaware of. \[One can imagine the depending package asking for dependencies with the platforms it knows about; other platforms it doesn’t know how to ask for. The platform description in that scenario is a kind of unforgeable capability.\] The offset bounds checking and definition of `mapOffset` together ensure that this is the case. Discovering a new offset is discovering a new platform, and since those platforms weren’t in the derivation “spec” of the needing package, they cannot be relevant. From a capability perspective, we can imagine that the host and target platforms of a package are the capabilities a package requires, and the depending package must provide the capability to the dependency.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 67a635615292..9b0b3417b9d6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7840,6 +7840,12 @@
     name = "Elis Hirwing";
     keys = [ { fingerprint = "67FE 98F2 8C44 CF22 1828  E12F D57E FA62 5C9A 925F"; } ];
   };
+  eu90h = {
+    email = "stefan@eu90h.com";
+    github = "eu90h";
+    githubId = 5161785;
+    name = "Stefan";
+  };
   euank = {
     email = "euank-nixpkg@euank.com";
     github = "euank";
@@ -10946,6 +10952,12 @@
     githubId = 16307070;
     name = "iosmanthus";
   };
+  iqubic = {
+    email = "sophia.b.caspe@gmail.com";
+    github = "iqubic";
+    githubId = 22628816;
+    name = "Sophia Caspe";
+  };
   iquerejeta = {
     github = "iquerejeta";
     githubId = 31273774;
@@ -23100,6 +23112,12 @@
     githubId = 251028;
     name = "Shell Turner";
   };
+  shellhazard = {
+    email = "shellhazard@tutanota.com";
+    github = "shellhazard";
+    githubId = 10951745;
+    name = "shellhazard";
+  };
   shelvacu = {
     name = "Shelvacu";
     email = "nix-maint@shelvacu.com";
diff --git a/maintainers/scripts/kde/generate-sources.py b/maintainers/scripts/kde/generate-sources.py
index f251a737efd1..2966e7ef9675 100755
--- a/maintainers/scripts/kde/generate-sources.py
+++ b/maintainers/scripts/kde/generate-sources.py
@@ -2,6 +2,7 @@
 #!nix-shell -i python3 -p "python3.withPackages(ps: [ ps.beautifulsoup4 ps.click ps.httpx ps.jinja2 ps.packaging ps.pyyaml ])" nix-update
 import base64
 import binascii
+import hashlib
 import json
 import pathlib
 import subprocess
@@ -112,8 +113,17 @@ def main(pkgset: str, version: str, nixpkgs: pathlib.Path, sources_url: str | No
 
         url = urljoin(sources_url, link.attrs["href"])
 
-        hash = client.get(url + ".sha256").text.split(" ", maxsplit=1)[0]
-        assert hash
+        hash = client.get(url + ".sha256").text.strip()
+
+        if hash == "Hash type not supported":
+            print(f"{url} missing hash on CDN, downloading...")
+            hasher = hashlib.sha256()
+            with client.stream("GET", url, follow_redirects=True) as r:
+                for data in r.iter_bytes():
+                    hasher.update(data)
+            hash = hasher.hexdigest()
+        else:
+            hash = hash.split(" ", maxsplit=1)[0]
 
         if existing := results.get(project_name):
             old_version = existing["version"]
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index ea72486c0273..4b0a2c4395d1 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -125,6 +125,11 @@
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 
+- `services.varnish.http_address` has been superseeded by `services.varnish.listen` which is now
+  structured config for all of varnish's `-a` variations.
+
 - [](#opt-services.gnome.gnome-keyring.enable) does not ship with an SSH agent anymore, as this is now handled by the `gcr_4` package instead of `gnome-keyring`. A new module has been added to support this, under [](#opt-services.gnome.gcr-ssh-agent.enable) (its default value has been set to [](#opt-services.gnome.gnome-keyring.enable) to ensure a smooth transition). See the [relevant upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67) for more details.
 
 - The `nettools` package (ifconfig, arp, mii-tool, netstat, route) is not installed by default anymore. The suite is unmaintained and users should migrate to `iproute2` and `ethtool` instead.
+
+- `sparkleshare` has been removed as it no longer builds and has been abandoned upstream.
diff --git a/nixos/modules/hardware/kryoflux.nix b/nixos/modules/hardware/kryoflux.nix
new file mode 100644
index 000000000000..3e3110e5773a
--- /dev/null
+++ b/nixos/modules/hardware/kryoflux.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.hardware.kryoflux;
+
+in
+{
+  options.hardware.kryoflux = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables kryoflux udev rules, ensures 'floppy' group exists. This is a
+        prerequisite to using devices supported by kryoflux without being root,
+        since kryoflux device descriptors will be owned by floppy through udev.
+      '';
+    };
+    package = lib.mkPackageOption pkgs "kryoflux" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.udev.packages = [ cfg.package ];
+    environment.systemPackages = [ cfg.package ];
+    users.groups.floppy = { };
+  };
+
+  meta.maintainers = with lib.maintainers; [ matthewcroughan ];
+}
diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index 5acbc3470820..33c34dafc404 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -121,6 +121,7 @@ in
 
     users.users.spamd = {
       description = "Spam Assassin Daemon";
+      home = "/var/lib/spamassassin";
       uid = config.ids.uids.spamd;
       group = "spamd";
     };
diff --git a/nixos/modules/services/networking/pihole-ftl.md b/nixos/modules/services/networking/pihole-ftl.md
index 4a1b1f986708..0f79fd6101c4 100644
--- a/nixos/modules/services/networking/pihole-ftl.md
+++ b/nixos/modules/services/networking/pihole-ftl.md
@@ -22,6 +22,7 @@ Example configuration:
 {
   services.pihole-ftl = {
     enable = true;
+    openFirewallDNS = true;
     openFirewallDHCP = true;
     queryLogDeleter.enable = true;
     lists = [
diff --git a/nixos/modules/services/networking/pihole-ftl.nix b/nixos/modules/services/networking/pihole-ftl.nix
index bda8ab4fa8c8..5a8c361adfeb 100644
--- a/nixos/modules/services/networking/pihole-ftl.nix
+++ b/nixos/modules/services/networking/pihole-ftl.nix
@@ -56,6 +56,12 @@ in
       example = "3";
     };
 
+    openFirewallDNS = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open ports in the firewall for pihole-FTL's DNS server.";
+    };
+
     openFirewallDHCP = mkOption {
       type = types.bool;
       default = false;
@@ -434,11 +440,15 @@ in
     };
 
     networking.firewall = lib.mkMerge [
-      (mkIf cfg.openFirewallDHCP {
+      (mkIf cfg.openFirewallDNS {
         allowedUDPPorts = [ 53 ];
         allowedTCPPorts = [ 53 ];
       })
 
+      (mkIf cfg.openFirewallDHCP {
+        allowedUDPPorts = [ 67 ];
+      })
+
       (mkIf cfg.openFirewallWebserver {
         allowedTCPPorts = lib.pipe cfg.settings.webserver.port [
           (lib.splitString ",")
diff --git a/nixos/modules/services/web-servers/varnish/default.nix b/nixos/modules/services/web-servers/varnish/default.nix
index 6b3ff33d2348..f42ed39ece80 100644
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@@ -6,6 +6,16 @@
 }:
 
 let
+  inherit (lib)
+    types
+    mkOption
+    hasPrefix
+    concatMapStringsSep
+    optionalString
+    concatMap
+    ;
+  inherit (builtins) isNull;
+
   cfg = config.services.varnish;
 
   # Varnish has very strong opinions and very complicated code around handling
@@ -26,6 +36,91 @@ let
     else
       "/var/run/varnishd";
 
+  # from --help:
+  #   -a [<name>=]address[:port][,proto] # HTTP listen address and port
+  #      [,user=<u>][,group=<g>]   # Can be specified multiple times.
+  #      [,mode=<m>]               #   default: ":80,HTTP"
+  #                                # Proto can be "PROXY" or "HTTP" (default)
+  #                                # user, group and mode set permissions for
+  #                                #   a Unix domain socket.
+  commandLineAddresses =
+    (concatMapStringsSep " " (
+      a:
+      "-a "
+      + optionalString (!isNull a.name) "${a.name}="
+      + a.address
+      + optionalString (!isNull a.port) ":${toString a.port}"
+      + optionalString (!isNull a.proto) ",${a.proto}"
+      + optionalString (!isNull a.user) ",user=${a.user}"
+      + optionalString (!isNull a.group) ",group=${a.group}"
+      + optionalString (!isNull a.mode) ",mode=${a.mode}"
+    ) cfg.listen)
+    + lib.optionalString (!isNull cfg.http_address) " -a ${cfg.http_address}";
+  addressSubmodule = types.submodule {
+    options = {
+      name = mkOption {
+        description = "Name is referenced in logs. If name is not specified, 'a0', 'a1', etc. is used.";
+        default = null;
+        type = with types; nullOr str;
+      };
+      address = mkOption {
+        description = ''
+          If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
+          ("127.0.0.1") or an IPv6  address enclosed in square brackets ("[::1]").
+
+          (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
+          followed by the name of an abstract socket ("@myvarnishd") accept connections
+          on a Unix domain socket.
+
+          The user, group and mode sub-arguments may be used to specify the permissions
+          of the socket file. These sub-arguments do not apply to  abstract sockets.
+        '';
+        type = types.str;
+      };
+      port = mkOption {
+        description = "The port to use for IP sockets. If port is not specified, port 80 (http) is used.";
+        default = null;
+        type = with types; nullOr int;
+      };
+      proto = mkOption {
+        description = "PROTO can be 'HTTP' (the default) or 'PROXY'.  Both version 1 and 2 of the proxy protocol can be used.";
+        type = types.enum [
+          "HTTP"
+          "PROXY"
+        ];
+        default = "HTTP";
+      };
+      user = mkOption {
+        description = "User name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      group = mkOption {
+        description = "Group name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      mode = mkOption {
+        description = "Permission of the socket file (3-digit octal value).";
+        default = null;
+        type = with types; nullOr str;
+      };
+    };
+  };
+  checkedAddressModule = types.addCheck addressSubmodule (
+    m:
+    (
+      if ((hasPrefix "@" m.address) || (hasPrefix "/" m.address)) then
+        # this is a unix socket
+        (m.port != null)
+      else
+      # this is not a path-based unix socket
+      if !(hasPrefix "/" m.address) && (m.group != null) || (m.user != null) || (m.mode != null) then
+        false
+      else
+        true
+    )
+  );
   commandLine =
     "-f ${pkgs.writeText "default.vcl" cfg.config}"
     +
@@ -54,13 +149,23 @@ in
       package = lib.mkPackageOption pkgs "varnish" { };
 
       http_address = lib.mkOption {
-        type = lib.types.str;
-        default = "*:6081";
+        type = with lib.types; nullOr str;
+        default = null;
         description = ''
           HTTP listen address and port.
         '';
       };
 
+      listen = lib.mkOption {
+        description = "Accept for client requests on the specified listen addresses.";
+        type = lib.types.listOf checkedAddressModule;
+        defaultText = lib.literalExpression ''[ { address="*"; port=6081; } ]'';
+        default = lib.optional (isNull cfg.http_address) {
+          address = "*";
+          port = 6081;
+        };
+      };
+
       config = lib.mkOption {
         type = lib.types.lines;
         description = ''
@@ -97,7 +202,7 @@ in
       serviceConfig = {
         Type = "simple";
         PermissionsStartOnly = true;
-        ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+        ExecStart = "${cfg.package}/sbin/varnishd ${commandLineAddresses} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
         Restart = "always";
         RestartSec = "5s";
         User = "varnish";
@@ -118,6 +223,21 @@ in
       '')
     ];
 
+    assertions = concatMap (m: [
+      {
+        assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+        message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+      }
+      {
+        assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+        message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+      }
+    ]) cfg.listen;
+
+    warnings =
+      lib.optional (!isNull cfg.http_address)
+        "The option `services.varnish.http_address` is deprecated. Use `services.varnish.listen` instead.";
+
     users.users.varnish = {
       group = "varnish";
       uid = config.ids.uids.varnish;
diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index 1992be83d73a..746cb693409c 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -274,7 +274,7 @@ def install_bootloader() -> None:
     profiles = [('system', get_gens())]
 
     for profile in get_profiles():
-        profiles += (profile, get_gens(profile))
+        profiles += [(profile, get_gens(profile))]
 
     timeout = config('timeout')
     editor_enabled = 'yes' if config('enableEditor') else 'no'
diff --git a/nixos/tests/firefly-iii-data-importer.nix b/nixos/tests/firefly-iii-data-importer.nix
index d43a30650bc2..a068ff2d025e 100644
--- a/nixos/tests/firefly-iii-data-importer.nix
+++ b/nixos/tests/firefly-iii-data-importer.nix
@@ -1,7 +1,10 @@
 { lib, ... }:
 {
   name = "firefly-iii-data-importer";
-  meta.maintainers = [ lib.maintainers.savyajha ];
+  meta = {
+    maintainers = [ lib.maintainers.savyajha ];
+    platforms = lib.platforms.linux;
+  };
 
   nodes.dataImporter =
     { ... }:
diff --git a/nixos/tests/sing-box.nix b/nixos/tests/sing-box.nix
index 6d105253f29c..8e48031d1224 100644
--- a/nixos/tests/sing-box.nix
+++ b/nixos/tests/sing-box.nix
@@ -57,8 +57,6 @@ let
       "${hosts."${server_host}"}/32"
     ];
     strict_route = false;
-    sniff = true;
-    sniff_override_destination = false;
   };
 
   tproxyPort = 1081;
@@ -219,6 +217,9 @@ in
                 tag = "outbound:direct";
               }
             ];
+            route = {
+              default_interface = "eth1";
+            };
           };
         };
       };
@@ -267,6 +268,7 @@ in
               vmessOutbound
             ];
             route = {
+              default_interface = "eth1";
               final = "outbound:block";
               rules = [
                 {
@@ -315,25 +317,28 @@ in
                 type = "block";
                 tag = "outbound:block";
               }
+            ];
+            endpoints = [
               {
-                type = "direct";
-                tag = "outbound:direct";
-              }
-              {
-                detour = "outbound:direct";
                 type = "wireguard";
                 tag = "outbound:wireguard";
-                interface_name = "wg0";
-                local_address = [ "10.23.42.2/32" ];
+                name = "wg0";
+                address = [ "10.23.42.2/32" ];
                 mtu = 1280;
                 private_key = wg-keys.peer1.privateKey;
-                peer_public_key = wg-keys.peer0.publicKey;
-                server = server_host;
-                server_port = 2408;
-                system_interface = true;
+                peers = [
+                  {
+                    address = server_host;
+                    port = 2408;
+                    public_key = wg-keys.peer0.publicKey;
+                    allowed_ips = [ "0.0.0.0/0" ];
+                  }
+                ];
+                system = true;
               }
             ];
             route = {
+              default_interface = "eth1";
               final = "outbound:block";
             };
           };
@@ -377,8 +382,6 @@ in
                 listen = "0.0.0.0";
                 listen_port = tproxyPort;
                 udp_fragment = true;
-                sniff = true;
-                sniff_override_destination = false;
               }
             ];
             outbounds = [
@@ -393,6 +396,7 @@ in
               vmessOutbound
             ];
             route = {
+              default_interface = "eth1";
               final = "outbound:block";
               rules = [
                 {
@@ -434,7 +438,7 @@ in
               independent_cache = true;
               fakeip = {
                 enabled = true;
-                "inet4_range" = "198.18.0.0/16";
+                inet4_range = "198.18.0.0/16";
               };
               servers = [
                 {
@@ -458,7 +462,6 @@ in
                     "AAAA"
                   ];
                   server = "dns:fakeip";
-
                 }
               ];
             };
@@ -474,17 +477,17 @@ in
                 type = "direct";
                 tag = "outbound:direct";
               }
-              {
-                type = "dns";
-                tag = "outbound:dns";
-              }
             ];
             route = {
+              default_interface = "eth1";
               final = "outbound:direct";
               rules = [
+                {
+                  action = "sniff";
+                }
                 {
                   protocol = "dns";
-                  outbound = "outbound:dns";
+                  action = "hijack-dns";
                 }
               ];
             };
diff --git a/nixos/tests/varnish.nix b/nixos/tests/varnish.nix
index 8fa18da31236..10946fcdff65 100644
--- a/nixos/tests/varnish.nix
+++ b/nixos/tests/varnish.nix
@@ -10,7 +10,12 @@ in
 
   nodes = {
     varnish =
-      { config, pkgs, ... }:
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
       {
         services.nix-serve = {
           enable = true;
@@ -19,9 +24,29 @@ in
         services.varnish = {
           inherit package;
           enable = true;
-          http_address = "0.0.0.0:80";
+          http_address = "0.0.0.0:81";
+          listen = [
+            {
+              address = "0.0.0.0";
+              port = 80;
+              proto = "HTTP";
+            }
+            {
+              name = "proxyport";
+              address = "0.0.0.0";
+              port = 8080;
+              proto = "PROXY";
+            }
+            { address = "@asdf"; }
+            {
+              address = "/run/varnishd/client.http.sock";
+              user = "varnish";
+              group = "varnish";
+              mode = "660";
+            }
+          ];
           config = ''
-            vcl 4.0;
+            vcl 4.1;
 
             backend nix-serve {
               .host = "127.0.0.1";
@@ -32,6 +57,26 @@ in
 
         networking.firewall.allowedTCPPorts = [ 80 ];
         system.extraDependencies = [ testPath ];
+
+        assertions =
+          map
+            (
+              pattern:
+              let
+                cmdline = config.systemd.services.varnish.serviceConfig.ExecStart;
+              in
+              {
+                assertion = lib.hasInfix pattern cmdline;
+                message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
+              }
+            )
+            [
+              " -a 0.0.0.0:80,HTTP "
+              " -a proxyport=0.0.0.0:8080,PROXY "
+              " -a @asdf,HTTP "
+              " -a /run/varnishd/client.http.sock,HTTP,user=varnish,group=varnish,mode=660 "
+              " -a 0.0.0.0:81 "
+            ];
       };
 
     client =
@@ -48,6 +93,7 @@ in
     start_all()
     varnish.wait_for_open_port(80)
 
+
     client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");
 
     client.wait_until_succeeds("nix-store -r ${testPath}")
diff --git a/nixos/tests/xfce.nix b/nixos/tests/xfce.nix
index 03921491c7b6..0b88fb18870f 100644
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@@ -19,6 +19,8 @@
 
       services.xserver.desktopManager.xfce.enable = true;
       environment.systemPackages = [ pkgs.xfce.xfce4-whiskermenu-plugin ];
+
+      programs.thunar.plugins = [ pkgs.xfce.thunar-archive-plugin ];
     };
 
   enableOCR = true;
diff --git a/pkgs/applications/audio/youtube-music/default.nix b/pkgs/applications/audio/youtube-music/default.nix
index c89793a26ee0..05834c063e22 100644
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
     fetcherVersion = 1;
+    hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
index 422c7758d0cd..ccae9ed6c393 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
@@ -32,13 +32,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "0-unstable-2025-02-10";
+  version = "0-unstable-2025-06-28";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
-    rev = "4401d1396dce89d1fc5dc5414565818dd1c30ae0";
-    hash = "sha256-lWbFbYwJoy4UAezKUK7rnjQlDcnszHQwK5I7fuHfE8Y=";
+    rev = "3b37a04bd1b6bbcdc2b0ad7a5c388ad027eb7a25";
+    hash = "sha256-0pjRihJapljd/9nR7G+FC+gCqD82YGITPK2mcJcI7ZI=";
   };
 
   patches = [
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/hardcode-dependencies.patch b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/hardcode-dependencies.patch
index 2fa57207ec38..7cb545851f42 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/hardcode-dependencies.patch
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/hardcode-dependencies.patch
@@ -1,8 +1,8 @@
 diff --git a/lsp-bridge.el b/lsp-bridge.el
-index 278c27e..f0c67c2 100644
+index d3e2ff7..1b1d745 100644
 --- a/lsp-bridge.el
 +++ b/lsp-bridge.el
-@@ -340,19 +340,7 @@ Setting this to nil or 0 will turn off the indicator."
+@@ -417,21 +417,7 @@ LSP-Bridge will enable completion inside string literals."
    "Name of LSP-Bridge buffer."
    :type 'string)
  
@@ -13,7 +13,9 @@ index 278c27e..f0c67c2 100644
 -                                                   "python3.exe")
 -                                                  ((executable-find "python.exe")
 -                                                   "python.exe")))
--                                           (t (cond ((executable-find "pypy3")
+-                                           (t (cond ((executable-find "python-lsp-bridge")
+-                                                     "python-lsp-bridge")
+-                                                    ((executable-find "pypy3")
 -                                                     "pypy3")
 -                                                    ((executable-find "python3")
 -                                                     "python3")
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
index db0048e558a3..c03f4209dfed 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
@@ -8,19 +8,19 @@
   gitMinimal,
 }:
 let
-  version = "1.4.1";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.cmp";
     tag = "v${version}";
-    hash = "sha256-0RmX/uANgU/di3Iu0V6Oe3jZj4ikzeegW/XQUZhPgRc=";
+    hash = "sha256-R95i3dDVBfH0oxTdK0F0ami0SAk0VVONXIlX6ZF0kmk=";
   };
   blink-fuzzy-lib = rustPlatform.buildRustPackage {
     inherit version src;
     pname = "blink-fuzzy-lib";
 
     useFetchCargoVendor = true;
-    cargoHash = "sha256-/8eiZyJEwPXAviwVMFTr+NKSwMwxdraKtrlXNU0cBM4=";
+    cargoHash = "sha256-pWBOPMUy/gXeujaowlp2I6kqD+Q95h+f9mXl231DN88=";
 
     nativeBuildInputs = [ gitMinimal ];
 
diff --git a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
index 29f8d2dc6d65..c7eddaf465cb 100644
--- a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "RooVeterinaryInc";
     name = "roo-cline";
-    version = "3.22.6";
-    hash = "sha256-Gu1QcGLJVSiFCO7C6q1fVbi5MOztdKyFFyEhxxCpfUE=";
+    version = "3.23.8";
+    hash = "sha256-2k9a27sbKYcrKVFRSdneUAV/bN0Y2Q5a7vorFRmgQPo=";
   };
 
   passthru.updateScript = vscode-extension-update-script { };
diff --git a/pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix
index a8b86799c554..9d06557b795a 100644
--- a/pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix
@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "cwtools-vscode";
     publisher = "tboby";
-    version = "0.10.25";
-    hash = "sha256-TcnS4Cwn+V9hwScpLgUK5u8Jfm89EBv+koUOi1bB0DM=";
+    version = "0.10.26";
+    hash = "sha256-1ZfmcF87LyRxCbQvVX21m1yFu+7QeDCofKXEHj5W8DA=";
   };
   meta = {
     description = "Paradox Language Features for Visual Studio Code";
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 8940d99462e4..8c434e2d68c7 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -36,22 +36,22 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-72KrCDUBe+xJjnSY/nnrNH92EP4tp71x1fadh0Pe0DM=";
-      x86_64-darwin = "sha256-Ua3oh0Hv0oiW15u3Rb0pSYu+JD8m1oYMAm5pEzXD6Rw=";
-      aarch64-linux = "sha256-5L0ZArj+7M5dhZDGzYj6NaxYYZEb8q89Vhngvjuw7wQ=";
-      aarch64-darwin = "sha256-uWOF/QGgXocKZAkFMN4Kh7HjiQTSIi+PVPy3V90wrAA=";
-      armv7l-linux = "sha256-FyGPvQeVz8yLhLjFGtCXPTVPvCB0/EX6pRe5RCAmXTU=";
+      x86_64-linux = "sha256-zgrNohvsmhcRQmkX7Io2/U3qbVWdcqwT7VK7Y3ENb9g=";
+      x86_64-darwin = "sha256-depSpPZm6bMQv9yvLUJ6yacCwTDtcpoFu15b67oiFJY=";
+      aarch64-linux = "sha256-Fo2X4VAWcyySQ+CE/bt+lJneLoEKVl6tLwPSW5LwvFY=";
+      aarch64-darwin = "sha256-WdYmlopeVsFCndnTALKiQgx2O4zzkDtotR/qj7A56bY=";
+      armv7l-linux = "sha256-OF4qjhgQiagpQP8p9gV63I/B8s/CSl8KlA+FoNhl3/c=";
     }
     .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.101.2";
+  version = "1.102.0";
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
   # This is used for VS Code - Remote SSH test
-  rev = "2901c5ac6db8a986a5666c3af51ff804d05af0d4";
+  rev = "cb0c47c0cfaad0757385834bd89d410c78a856c0";
 
   executableName = "code" + lib.optionalString isInsiders "-insiders";
   longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-Bocoiz8pxQNAZxmWdOgh+y44QTnqvDjcqFCodny7VoY=";
+      hash = "sha256-Hf/pukcQf7PaHORItWO74gC54TWto+nHiKaCHzD0TmI=";
     };
     stdenv = stdenvNoCC;
   };
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 1e6f6195c234..aed3d2193ff5 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-47";
+  version = "7.1.2-0";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-lRPGVGv86vH7Q1cLoLp8mOAkxcHTHgUrx0mmKgl1oEc=";
+    hash = "sha256-4x0+yELmXstv9hPuwzMGcKiTa1rZtURZgwSSVIhzAkE=";
   };
 
   outputs = [
diff --git a/pkgs/applications/graphics/krita/default.nix b/pkgs/applications/graphics/krita/default.nix
index beb7a046b7bd..acb72088f0da 100644
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@@ -1,7 +1,7 @@
 { callPackage, ... }:
 
 callPackage ./generic.nix {
-  version = "5.2.9";
+  version = "5.2.10";
   kde-channel = "stable";
-  hash = "sha256-CMmvVW3r8mkxvWUGeS45G0t6MzSlog9RazJJBDNKy6Y=";
+  hash = "sha256-pJrJcrO7lkU0h3XPFpOADL9zXINcqfn1Thep4fMHctU=";
 }
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index 148b8dcb777e..362d23e8ed1f 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -12,13 +12,13 @@
 buildDotnetModule rec {
   pname = "ArchiSteamFarm";
   # nixpkgs-update: no auto update
-  version = "6.1.6.7";
+  version = "6.1.7.8";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ArchiSteamFarm";
     rev = version;
-    hash = "sha256-XdnKcWzw/d7yLG2efgw/gQ8UkPjExigffbomTD3YUgE=";
+    hash = "sha256-bdjkYrfaC/5rKqRmKr+NVmCMU871WJFNRdh92i8GJF8=";
   };
 
   dotnet-runtime = dotnetCorePackages.aspnetcore_9_0;
diff --git a/pkgs/applications/misc/ArchiSteamFarm/deps.json b/pkgs/applications/misc/ArchiSteamFarm/deps.json
index e7af742d589f..e52b3cc22260 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/deps.json
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps.json
@@ -276,8 +276,8 @@
   },
   {
     "pname": "Markdig.Signed",
-    "version": "0.41.1",
-    "hash": "sha256-A8dOAwZ9hMVPk8xZBaJOo0gu5Z01JQZiz0uZbIZA2eU="
+    "version": "0.41.3",
+    "hash": "sha256-r4DrP47vgky0+AbNBFso7AwwzAHgrioK2B08UIxEaNI="
   },
   {
     "pname": "Microsoft.ApplicationInsights",
@@ -286,13 +286,8 @@
   },
   {
     "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "9.0.5",
-    "hash": "sha256-v2T37X1dm/NG0ZJWk6cXB9lf8tOc6JI4uxFPqmV7ne0="
-  },
-  {
-    "pname": "Microsoft.Bcl.AsyncInterfaces",
-    "version": "6.0.0",
-    "hash": "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="
+    "version": "9.0.6",
+    "hash": "sha256-Kk1WNf1BS+9LjjXjBrYb1YCr+23W9PJ+B9Kv2OBv2Oc="
   },
   {
     "pname": "Microsoft.CodeAnalysis.ResxSourceGenerator",
@@ -431,23 +426,23 @@
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.11.0",
-    "hash": "sha256-qTBsPDE2FD/JA/n7P9g5FQPu7whUyX1X2HS62StxfLM="
+    "version": "8.12.1",
+    "hash": "sha256-gG2S/1+fPV74J9EE3oI3FKG/bRX/F7ujRvGTgxZ4r1A="
   },
   {
     "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.11.0",
-    "hash": "sha256-JayQNiEiMsvpoAM993VNfJOyAYkatRoFBuLO+ZBzBGo="
+    "version": "8.12.1",
+    "hash": "sha256-NF1kPBAfiNEIsiyNSUSPwPJMEvdk6IMC+95PdqearuM="
   },
   {
     "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.11.0",
-    "hash": "sha256-aBJSBytPxw+t68O94B8Sj+PjtBi9c2Csy5x7xyVV4m8="
+    "version": "8.12.1",
+    "hash": "sha256-zliqyeeJ9hvPUxm+rWCHGAH+aR+OeIxNhcKxM6G5AEc="
   },
   {
     "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.11.0",
-    "hash": "sha256-9sg63wXOJa2HrQBsC3w0vXsWww7FvCnjrtoaf7OsyuA="
+    "version": "8.12.1",
+    "hash": "sha256-brSDa39ISF1+N8u/b/x27IN3wiu+sTll2nMf+IqWPS0="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
@@ -471,23 +466,23 @@
   },
   {
     "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "1.7.1",
-    "hash": "sha256-HpIgMY0LRyeeipkW+rjhsqZnso3bWUTP5GZ4EJfkR0w="
+    "version": "1.7.3",
+    "hash": "sha256-Z6WsY2FCUbNnT5HJd7IOrfOvqknVXp6PWzTVeb0idVg="
   },
   {
     "pname": "Microsoft.Testing.Extensions.TrxReport",
-    "version": "1.7.1",
-    "hash": "sha256-LrNo9GKe7cFL7JXKU4h1jpiGxp5465MRJFWhErfOYOs="
+    "version": "1.7.3",
+    "hash": "sha256-QX6Oo6uI9XWRbgrjdHxzROIhTHm12ai6wIDtDuqDJwA="
   },
   {
     "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "1.7.1",
-    "hash": "sha256-zaDOAoEA4CF6/7rXLBO5f5d8PpcqB7hKlwdEWzaFsNk="
+    "version": "1.7.3",
+    "hash": "sha256-PTee04FHyTHx/gF5NLckXuVje807G51MzkPrZ1gkgCw="
   },
   {
     "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "1.7.1",
-    "hash": "sha256-6o3qqXK6dxybHybl2k/aY2flxPc2z/1VQMWQPm2Ns0g="
+    "version": "1.7.3",
+    "hash": "sha256-8d+wZmucfSO7PsviHjVxYB4q6NcjgxvnCUpLePq35sM="
   },
   {
     "pname": "Microsoft.Testing.Platform",
@@ -496,13 +491,13 @@
   },
   {
     "pname": "Microsoft.Testing.Platform",
-    "version": "1.7.1",
-    "hash": "sha256-YJ41q1VXvFZh/TWo3tutGQnhNCrxv/QbDLTxCS4b/w4="
+    "version": "1.7.3",
+    "hash": "sha256-cavX11P5o9rooqC3ZHw5h002OKRg2ZNR/VaRwpNTQYA="
   },
   {
     "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "1.7.1",
-    "hash": "sha256-j/JO5dVIHWTbUO12ZZJdQ5CB2TcBqGfZTcmVFuT3nyA="
+    "version": "1.7.3",
+    "hash": "sha256-cREl529UQ/c5atT8KimMgrgNdy6MrAd0sBGT8sXRRPM="
   },
   {
     "pname": "Microsoft.TestPlatform.AdapterUtilities",
@@ -526,23 +521,23 @@
   },
   {
     "pname": "MSTest",
-    "version": "3.9.1",
-    "hash": "sha256-7gpZKkbGRA4kjUMHrE5pgM3jQhzYQxO3RB5OfDz0Ed4="
+    "version": "3.9.3",
+    "hash": "sha256-sfvkUW4AZEmFduiSZYh3ZuXgE8/boC7gYMMleP4nkUA="
   },
   {
     "pname": "MSTest.Analyzers",
-    "version": "3.9.1",
-    "hash": "sha256-jr5UOnoX2mHFjMgo/e//4Fi736mkaYj6ChFuwP8jC2w="
+    "version": "3.9.3",
+    "hash": "sha256-uD74gJNVNSQNsxyzf/5kxCBFbgIY7pYdUrKZihAyLi4="
   },
   {
     "pname": "MSTest.TestAdapter",
-    "version": "3.9.1",
-    "hash": "sha256-nlX47U5Yxds0BXJtwWtMPY+HbEFO8TRr7yC+GS1laxU="
+    "version": "3.9.3",
+    "hash": "sha256-0krWgHpALFJMX707/SMN7b5ryEgm7taCoxtC4WBaglM="
   },
   {
     "pname": "MSTest.TestFramework",
-    "version": "3.9.1",
-    "hash": "sha256-ORwTveV9nPnx4s9av8EFt8MQ4G0pF9M8Ped/ibZXvG4="
+    "version": "3.9.3",
+    "hash": "sha256-kkW155gzuv0xjiucutNs4RjF9g2NEIZ39+nruRun4As="
   },
   {
     "pname": "Newtonsoft.Json",
@@ -646,13 +641,13 @@
   },
   {
     "pname": "Scalar.AspNetCore",
-    "version": "2.4.4",
-    "hash": "sha256-MyNRQMFXIRf6znM3SL3P+Z8jO+3Q5i23TDQuG+ZUcTY="
+    "version": "2.5.3",
+    "hash": "sha256-5rMpkchzxeO3/694RvaVzuQS9Xqd7YGDbBzqCkNyhFs="
   },
   {
     "pname": "SteamKit2",
-    "version": "3.2.0",
-    "hash": "sha256-hB/36fP9kf+1mIx+hTELUMHe8ZkmSKxOK41ZzOaBa3E="
+    "version": "3.3.0",
+    "hash": "sha256-/NxnVDatdrqIXCjs0P4gRjHq42r/K+wOv3JO5yiAIjU="
   },
   {
     "pname": "System.Buffers",
@@ -671,33 +666,33 @@
   },
   {
     "pname": "System.Composition",
-    "version": "9.0.5",
-    "hash": "sha256-Y8MPR8xot93lo4jAgVJ101M+JN973CpvOlCSYUK7wxc="
+    "version": "9.0.6",
+    "hash": "sha256-p8Oa6kjNnwzUPiotQZaLKNd5HWyaLAUrXDEb9+qGe4c="
   },
   {
     "pname": "System.Composition.AttributedModel",
-    "version": "9.0.5",
-    "hash": "sha256-CkqRwQGCRteSmN+nRF0rm8wGf2QA7gfqsVF8lBTg9EE="
+    "version": "9.0.6",
+    "hash": "sha256-39rilNPGuizRbLS9uJf8xKUsJwP6OrwlIrC0b2n2ujI="
   },
   {
     "pname": "System.Composition.Convention",
-    "version": "9.0.5",
-    "hash": "sha256-iaSaDpiep+8dthACDpgN0GJ5jRqLVzCVEKNOHUuy3/0="
+    "version": "9.0.6",
+    "hash": "sha256-/+Os5orfTZ45G+SSccBV21OGlbmqI71wZDTCbzvI3DI="
   },
   {
     "pname": "System.Composition.Hosting",
-    "version": "9.0.5",
-    "hash": "sha256-P98I/5Vs08bDObpicSzHXigXiadJA5uIKqd78WABU40="
+    "version": "9.0.6",
+    "hash": "sha256-krp3xyEOHtF/TRu7GPKaNXe+uKhDRhlNBWAD+eAfyYg="
   },
   {
     "pname": "System.Composition.Runtime",
-    "version": "9.0.5",
-    "hash": "sha256-o4yiU61i6X2Tn20pUrf/psESngE/nGHTlJSe4S7qIQ0="
+    "version": "9.0.6",
+    "hash": "sha256-ou4oVkNKVFcHgBsiKxmBfwLCDRberIlwD1uvR2XfMT8="
   },
   {
     "pname": "System.Composition.TypedParts",
-    "version": "9.0.5",
-    "hash": "sha256-+09hA4PfsR9BLHkV1aadh8Jx10AwcFrG+49U0vMATPU="
+    "version": "9.0.6",
+    "hash": "sha256-2z3Pi2vu6Acyn988JeM2B5jKYxCg8LqV8p+4Z4e094g="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
@@ -711,13 +706,13 @@
   },
   {
     "pname": "System.IO.Hashing",
-    "version": "9.0.4",
-    "hash": "sha256-rbcQzEncB3VuUZIcsE1tq30suf5rvRE4HkE+0lR/skU="
+    "version": "9.0.5",
+    "hash": "sha256-hMAhIhYl1QhtD21kSitvSnsNd9KgSydIRvjwZ/1iFes="
   },
   {
     "pname": "System.Linq.Async",
-    "version": "6.0.1",
-    "hash": "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI="
+    "version": "6.0.3",
+    "hash": "sha256-i+2XnsOJnD7R/vCFtadp+lwrkDNAscANes2Ur0MSTl8="
   },
   {
     "pname": "System.Memory",
@@ -746,8 +741,8 @@
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.5",
-    "hash": "sha256-Ed2Ea4ssYYHBBeFs0Vva+G8lEF5VFcm+DWJl/xi7arY="
+    "version": "9.0.6",
+    "hash": "sha256-WMa3KDeFuOLyIZduYd+9PCyx7usJMRu/q2x3eOw9MAQ="
   },
   {
     "pname": "System.Security.Principal.Windows",
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
index 059051c06594..c2485455d1a3 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@@ -7,7 +7,7 @@
 
 buildNpmPackage rec {
   pname = "asf-ui";
-  version = "9920764dafb0a7a87c355d9c87aff285e41494be";
+  version = "b984a9de784afb9d11364b3541961888cab8e025";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
@@ -15,10 +15,10 @@ buildNpmPackage rec {
     # updated by the update script
     # this is always the commit that should be used with asf-ui from the latest asf version
     rev = version;
-    hash = "sha256-w4pYFCdJiHocy41az4/tjWdBwAdI68RV/N8I0Onsofg=";
+    hash = "sha256-qipcDwn6Jte8MRUIgmYSuMzs4sewItlzFIeupYKkg+A=";
   };
 
-  npmDepsHash = "sha256-V9u+n4CTB+BU0zeiB8vLpFkI2VJGArU6WL+PFfi624M=";
+  npmDepsHash = "sha256-UhakvqDoWxt/nudEqUZcp8Bk0sIdYSXCYHv8YbsrWDU=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 41e0be5b3cc3..c07051ce3f4e 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "138.0.7204.100",
+    "version": "138.0.7204.157",
     "chromedriver": {
-      "version": "138.0.7204.101",
-      "hash_darwin": "sha256-ow+R2jcfm5tryB6UfnUNklVfLGc2Tzj2W6Nul6pRglI=",
-      "hash_darwin_aarch64": "sha256-GGcDoSkH8Z4N8yOL77nNMtz3BY4lNwlD10SPhEBRpJI="
+      "version": "138.0.7204.158",
+      "hash_darwin": "sha256-rNd7glDAVNkd4CNn4k3rdpb//yD/ccpebnGhDv1EGb8=",
+      "hash_darwin_aarch64": "sha256-oUMFW09mp2aUgplboMHaKvTVbKtqAy5C0KsA7DXbElc="
     },
     "deps": {
       "depot_tools": {
@@ -20,8 +20,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5f45b4744e3d5ba82c2ca6d942f1e7a516110752",
-        "hash": "sha256-bI75IXPl6YeauK2oTnUURh1ch1H7KKw/QzKYZ/q6htI=",
+        "rev": "e533e98b1267baa1f1c46d666b120e64e5146aa9",
+        "hash": "sha256-LbZ8/6Lvz1p3ydRL4fXtd7RL426PU3jU01Hx+DP5QYQ=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -96,8 +96,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "df15136b959fc60c230265f75ee7fc75c96e8250",
-        "hash": "sha256-b4bGxhtrsfmVdJo/5QT4/mtQ6hqxmfpmcrieqaT9/ls="
+        "rev": "e1dc0a7ab5d1f1f2edaa7e41447d873895e083bf",
+        "hash": "sha256-tkHvTkqbm4JtWnh41iu0aJ9Jo34hYc7aOKuuMQmST4c="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -131,8 +131,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "86772f20cca54b46f62b65ece1ef61224aef09db",
-        "hash": "sha256-N9DVbQE56WWBmJ/PJlYhU+pr8I+PFf/7FzMLCNqx3hg="
+        "rev": "1fde167ae683982d77b9ca7e1308bf9f498291e8",
+        "hash": "sha256-PbDTKSU19jn2hLDoazceYB/Rd6/qu6npPSrjOdeXFuU="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -246,8 +246,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "a6dbe06dafbad00ef4b0ea139ece1a94a5e2e6d8",
-        "hash": "sha256-XkyJFRxo3ZTBGfKdTwSIo14SLNPQAKQvY4lEX03j6LM="
+        "rev": "4cca0aa00c4915947f1081014d5cfa2e83d357fa",
+        "hash": "sha256-pVNr8NB5U/Uf688oOvPLpu81isCn/WmjJky01A000a4="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -796,8 +796,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e5b4c78b54e8b033b2701db3df0bf67d3030e4c1",
-        "hash": "sha256-5y/yNZopnwtDrG+BBU6fMEi0yJJoYvsygQR+fl6vS/Y="
+        "rev": "de9d0f8b56ae61896e4d2ac577fc589efb14f87d",
+        "hash": "sha256-/T5fisjmN80bs3PtQrCRfH3Bo9dRSd3f+xpPLDh1RTY="
       }
     }
   },
diff --git a/pkgs/applications/networking/cluster/nomad/default.nix b/pkgs/applications/networking/cluster/nomad/default.nix
index b86cbb7d8bdf..9f34af0fa64c 100644
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -91,9 +91,9 @@ rec {
 
   nomad_1_10 = generic {
     buildGoModule = buildGo124Module;
-    version = "1.10.2";
-    hash = "sha256-7i/tMQwaEmLGXNarrdPzmorv+SHrxCzeaF3BI9Jjhwg=";
-    vendorHash = "sha256-yq8xQ9wThPK/X9/lEHD8FCXq1Mrz0lO6UvrP2ipXMnw=";
+    version = "1.10.3";
+    hash = "sha256-sDOo7b32H/d5OJ6CRyga1rZZk55bFTi4ynHL/aIH87w=";
+    vendorHash = "sha256-bpCnpeRk329vUd9e6x7iCh+1ouSGd4o4Hq79K0qchJ8=";
     license = lib.licenses.bsl11;
     passthru.tests.nomad = nixosTests.nomad;
     preCheck = ''
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 9a6810e2c8c0..a7569fabb1b5 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -171,22 +171,22 @@
     "vendorHash": null
   },
   "bigip": {
-    "hash": "sha256-JGsleJiOo2wnIObvbQpvpmfc/CUaznVDIiNFX+eetW8=",
+    "hash": "sha256-lhN9YPufx6JITEhwLfqUMudXKTJqFdRCPkS+lTZpmH8=",
     "homepage": "https://registry.terraform.io/providers/F5Networks/bigip",
     "owner": "F5Networks",
     "repo": "terraform-provider-bigip",
-    "rev": "v1.23.0",
+    "rev": "v1.23.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-ZFHe91xPeKTdLRnOyFECjg1/7G2RPGpXSgaZOFrnDpY=",
+    "hash": "sha256-McRv7POFoxkehhDQWIzMY96e/Uv+lc5L0bKVlzITBZA=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.47.0",
+    "rev": "v2.48.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-AcHndbTWMMsE7CSnLtUdnfyIfkKVfmOobNOhvtrTh4I="
+    "vendorHash": "sha256-ok73U0WWFGXp5TJ7sp7U9umq7DlChCw7fSyFmbifwKE="
   },
   "bitwarden": {
     "hash": "sha256-eqWyKPzSINSZcO8Ho0WHTeVDOxbUynOzupXu6vzTtuU=",
@@ -326,13 +326,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-FYgjffK21Z/a7wpke5/Um0f8NiDfs7Xf4l7/f3i41+g=",
+    "hash": "sha256-u+iiWStjO2OFMkQp8Skynb4seTK61ETSKrEP+6o16LA=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.66.0",
+    "rev": "v3.67.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9YkSNGNcdMBLJZSlMTGoDrLZFTeGSTfhX1H8ub77Ebk="
+    "vendorHash": "sha256-fLdJxYuN4p0ZwXUXcN6BtATcwVg9asgdjHg9nOPcxK4="
   },
   "deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -552,11 +552,11 @@
     "vendorHash": "sha256-QTcWJlwE6s4nEPSg6svzIhsJo9p9rk1gQiSr4qSTfns="
   },
   "gridscale": {
-    "hash": "sha256-GHKGlqAFWVPmD7NRFcm651XBVzTtNy8mb/sKtjULkB4=",
+    "hash": "sha256-zD3KiTLKALVOvFOewWyrd65p0XmLOi/bSIP27dXwveU=",
     "homepage": "https://registry.terraform.io/providers/gridscale/gridscale",
     "owner": "gridscale",
     "repo": "terraform-provider-gridscale",
-    "rev": "v2.1.2",
+    "rev": "v2.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -624,11 +624,11 @@
     "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
   },
   "huaweicloud": {
-    "hash": "sha256-v0UqXIK4SPGouETUWSQI1K1hpsPMyUuEpLQ++Gs4+yk=",
+    "hash": "sha256-jXppJtVMPpipXbEhgenVtFP5YxwlQzekquRoZmgoP0Q=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.76.1",
+    "rev": "v1.76.4",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1147,13 +1147,13 @@
     "vendorHash": null
   },
   "sakuracloud": {
-    "hash": "sha256-vIP7hlPvx7o8/uXpg6TOEeoDL9FGaTBdXzziOyLrdGY=",
+    "hash": "sha256-IbR3m0s5LCC9tIOC67yn2yI6lssnIlc/pB6XIf0UOuk=",
     "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
     "owner": "sacloud",
     "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.28.0",
+    "rev": "v2.28.1",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-hJmMNxlhyzcnguLFJih/K1CSZHIOspTgCJ8nyVjT7mg="
+    "vendorHash": "sha256-HKmIl/GjGJZmhWLrK3lMjYo1F5nmo+U9ZpvBo5hDH/0="
   },
   "scaleway": {
     "hash": "sha256-3MLtSOcMCIl3pFJH/xKK/fPQcRrW2Nx4b2jCZiUE2aw=",
diff --git a/pkgs/applications/networking/protonvpn-gui/default.nix b/pkgs/applications/networking/protonvpn-gui/default.nix
index eb4d15dc1986..af16cdc05a44 100644
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonApplication rec {
   pname = "protonvpn-gui";
-  version = "4.9.6";
+  version = "4.9.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
-    tag = "${version}";
-    hash = "sha256-Undf3qSClcRa1e9f6B/1hLPIjc2KPG745AXxYHQA0nE=";
+    tag = "v${version}";
+    hash = "sha256-xpMXpYLLui+1bjK72VPhUT6T/sYpoqN2Jz6sczKJO5U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/scribus/default.nix b/pkgs/applications/office/scribus/default.nix
index d5fc795c3645..6e5fbf8b34ad 100644
--- a/pkgs/applications/office/scribus/default.nix
+++ b/pkgs/applications/office/scribus/default.nix
@@ -4,14 +4,27 @@
   cmake,
   cups,
   fetchurl,
+  fetchpatch,
   fontconfig,
   freetype,
+  graphicsmagick,
   harfbuzzFull,
   hunspell,
   lcms2,
+  libcdr,
+  libfreehand,
   libjpeg,
+  libjxl,
+  libmspub,
+  libpagemaker,
+  libqxp,
+  librevenge,
+  libsysprof-capture,
   libtiff,
+  libvisio,
+  libwpg,
   libxml2,
+  libzmf,
   pixman,
   pkg-config,
   podofo_0_10,
@@ -20,7 +33,7 @@
   python3,
   lib,
   stdenv,
-  qt5,
+  qt6,
 }:
 
 let
@@ -32,17 +45,17 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = "scribus";
 
-  version = "1.6.4";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UzvnrwOs+qc27F96P8JWKr0gD+9coqfN7gK19E1hgp4=";
+    hash = "sha256-+lnWIh/3z/qTcjV5l+hlcBYuHhiRNza3F2/RD0jCQ/Y=";
   };
 
   nativeBuildInputs = [
     cmake
     pkg-config
-    qt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -51,37 +64,63 @@ stdenv.mkDerivation (finalAttrs: {
     cups
     fontconfig
     freetype
+    graphicsmagick
     harfbuzzFull
     hunspell
     lcms2
+    libcdr
+    libfreehand
     libjpeg
+    libjxl
+    libpagemaker
+    libqxp
+    librevenge
+    libsysprof-capture
     libtiff
+    libvisio
+    libwpg
     libxml2
+    libzmf
     pixman
     podofo_0_10
     poppler
     poppler_data
     pythonEnv
-    qt5.qtbase
-    qt5.qtimageformats
-    qt5.qttools
+    qt6.qt5compat
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtimageformats
+    qt6.qtsvg
+    qt6.qttools
+  ] ++ lib.optionals libmspub.meta.available [ libmspub ];
+
+  cmakeFlags = [ (lib.cmakeBool "WANT_GRAPHICSMAGICK" true) ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_qt_6.9.0.patch?h=scribus-unstable";
+      hash = "sha256-hzd9XpoVVqbwvZ40QPGBqqWkIFXug/tSojf/Ikc4nn4=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_poppler_25.02.0.patch?h=scribus-unstable";
+      hash = "sha256-t9xJA6KGMGAdUFyjI8OlTNilewyMr1FFM7vjHOM15Xg=";
+    })
   ];
 
-  meta = with lib; {
-    maintainers = with maintainers; [
-      arthsmn
-    ];
+  meta = {
+    maintainers = with lib.maintainers; [ arthsmn ];
     description = "Desktop Publishing (DTP) and Layout program";
     mainProgram = "scribus";
     homepage = "https://www.scribus.net";
     # There are a lot of licenses...
     # https://github.com/scribusproject/scribus/blob/20508d69ca4fc7030477db8dee79fd1e012b52d2/COPYING#L15-L19
-    license = with licenses; [
+    license = with lib.licenses; [
       bsd3
       gpl2Plus
       mit
       publicDomain
     ];
+    platforms = lib.platforms.all;
     broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
index ee3b038e7970..e732da52817c 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@@ -113,6 +113,12 @@ stdenv.mkDerivation {
     )
     ++ [
       ./patches/256-color-resources.patch
+      (fetchPatchFromAUR {
+        name = "7-bit-queries.patch";
+        package = "rxvt-unicode-truecolor-wide-glyphs";
+        rev = "61ed186890a2bf37585e4704a095be61e6504ac6";
+        sha256 = "1xpv6g3bhxq5gp40k3rp8yjp4xrw7dr2g9sfkdmj0gi3rr0myx46";
+      })
     ]
     ++ lib.optional (perlSupport && lib.versionAtLeast perl.version "5.38") (fetchpatch {
       name = "perl538-locale-c.patch";
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix b/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
index 744ba03ca442..ae4a77d246c8 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-shaderfilter";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-shaderfilter";
     rev = version;
-    sha256 = "sha256-HJFgGicOtEZMMJyAkwgHCvWPoj00C6YGU9NwagD4Fpw=";
+    sha256 = "sha256-1RRGXAzP7BIwJJMmXSknPDtHxXZex9SqDDVbWOE43Yk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 8449e7a75a64..9d8e38a8b28f 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -367,13 +367,13 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_25 = callPackage dockerGen rec {
-    version = "25.0.10";
+    version = "25.0.11";
     # Upstream forgot to tag release
     # https://github.com/docker/cli/issues/5789
     cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
     cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
     mobyRev = "v${version}";
-    mobyHash = "sha256-57iXL+QYtbEz099yOTR4k/2Z7CT08OAkQ3kVJSmsa/U=";
+    mobyHash = "sha256-vHHi0/sX9fm83gyUjDpRYTGV9h18IVia1oSmj4n31nc=";
     runcRev = "v1.2.5";
     runcHash = "sha256-J/QmOZxYnMPpzm87HhPTkYdt+fN+yeSUu2sv6aUeTY4=";
     containerdRev = "v1.7.27";
@@ -383,11 +383,11 @@ rec {
   };
 
   docker_28 = callPackage dockerGen rec {
-    version = "28.2.2";
+    version = "28.3.2";
     cliRev = "v${version}";
-    cliHash = "sha256-ZaKG4H8BqIzgs9OFktH9bjHSf9exAlh5kPCGP021BWI=";
+    cliHash = "sha256-LsV9roOPw0LccvBUeF3bY014OwG6QpnVsLf+dqKyvsg=";
     mobyRev = "v${version}";
-    mobyHash = "sha256-Y2yP2NBJLrI83iHe2EoA7/cXiQifrCkUKlwJhINKBXE=";
+    mobyHash = "sha256-YfdnCAc9NgLTuvxLHGhTPdWqXz9VSVsQsfzLD3YER3g=";
     runcRev = "v1.2.6";
     runcHash = "sha256-XMN+YKdQOQeOLLwvdrC6Si2iAIyyHD5RgZbrOHrQE/g=";
     containerdRev = "v1.7.27";
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 731ad0104206..7e51efed66ac 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -69,12 +69,6 @@
   gnome = [
     # This one redirects to some mirror closeby, so it should be all you need
     "https://download.gnome.org/"
-
-    "https://fr2.rpmfind.net/linux/gnome.org/"
-    "https://ftp.acc.umu.se/pub/GNOME/"
-    "https://ftp.belnet.be/mirror/ftp.gnome.org/"
-    "ftp://ftp.cse.buffalo.edu/pub/Gnome/"
-    "ftp://ftp.nara.wide.ad.jp/pub/X11/GNOME/"
   ];
 
   # GNU (https://www.gnu.org/prep/ftp.html)
diff --git a/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules.js b/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules.js
index 79e247eb4acb..b045e4e0918c 100644
--- a/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules.js
+++ b/pkgs/build-support/node/import-npm-lock/hooks/link-node-modules.js
@@ -69,19 +69,17 @@ async function main() {
       // Don't unlink this file, we just wrote it.
       managed.delete(file);
 
-      // Link to a temporary dummy path and rename.
-      // This is to get some degree of atomicity.
+      // Link file
       try {
-        await fs.promises.symlink(sourcePath, targetPath + "-nix-hook-temp");
+        await fs.promises.symlink(sourcePath, targetPath);
       } catch (err) {
+        // If the target file already exists remove it and try again
         if (err.code !== "EEXIST") {
           throw err;
         }
-
-        await fs.promises.unlink(targetPath + "-nix-hook-temp");
-        await fs.promises.symlink(sourcePath, targetPath + "-nix-hook-temp");
+        await fs.promises.unlink(targetPath);
+        await fs.promises.symlink(sourcePath, targetPath);
       }
-      await fs.promises.rename(targetPath + "-nix-hook-temp", targetPath);
     })
   );
 
diff --git a/pkgs/build-support/src-only/tests.nix b/pkgs/build-support/src-only/tests.nix
index 7ea7c23621be..f739715e717d 100644
--- a/pkgs/build-support/src-only/tests.nix
+++ b/pkgs/build-support/src-only/tests.nix
@@ -1,28 +1,89 @@
 {
+  lib,
   runCommand,
   srcOnly,
+  hello,
   emptyDirectory,
-  glibc,
+  zlib,
+  stdenv,
+  testers,
 }:
 
 let
   emptySrc = srcOnly emptyDirectory;
-  glibcSrc = srcOnly glibc;
+  zlibSrc = srcOnly zlib;
+
+  # It can be invoked in a number of ways. Let's make sure they're equivalent.
+  zlibSrcDrvAttrs = srcOnly zlib.drvAttrs;
+  # zlibSrcFreeform = # ???;
+  helloSrc = srcOnly hello;
+  helloSrcDrvAttrs = srcOnly hello.drvAttrs;
+
+  # The srcOnly <drv> invocation leaks a lot of attrs into the srcOnly derivation,
+  # so for comparing with the freeform invocation, we need to make a selection.
+  # Otherwise, we'll be comparing against whatever attribute the fancy hello drv
+  # has.
+  helloDrvSimple = stdenv.mkDerivation {
+    inherit (hello)
+      name
+      pname
+      version
+      src
+      patches
+      ;
+  };
+  helloDrvSimpleSrc = srcOnly helloDrvSimple;
+  helloDrvSimpleSrcFreeform = srcOnly (
+    {
+      inherit (helloDrvSimple)
+        name
+        pname
+        version
+        src
+        patches
+        stdenv
+        ;
+    }
+    # __impureHostDeps get duplicated in helloDrvSimpleSrc (on darwin)
+    # This is harmless, but fails the test for what is arguably an
+    # unrelated non-problem, so we just work around it here.
+    # The inclusion of __impureHostDeps really shouldn't be required,
+    # and should be removed from this test.
+    // lib.optionalAttrs (helloDrvSimple ? __impureHostDeps) {
+      inherit (helloDrvSimple) __impureHostDeps;
+    }
+  );
+
 in
 
-runCommand "srcOnly-tests" { } ''
-  # Test that emptySrc is empty
-  if [ -n "$(ls -A ${emptySrc})" ]; then
-    echo "emptySrc is not empty"
-    exit 1
-  fi
+runCommand "srcOnly-tests"
+  {
+    moreTests = [
+      (testers.testEqualDerivation "zlibSrcDrvAttrs == zlibSrc" zlibSrcDrvAttrs zlibSrc)
+      # (testers.testEqualDerivation
+      #   "zlibSrcFreeform == zlibSrc"
+      #   zlibSrcFreeform
+      #   zlibSrc)
+      (testers.testEqualDerivation "helloSrcDrvAttrs == helloSrc" helloSrcDrvAttrs helloSrc)
+      (testers.testEqualDerivation "helloDrvSimpleSrcFreeform == helloDrvSimpleSrc"
+        helloDrvSimpleSrcFreeform
+        helloDrvSimpleSrc
+      )
+    ];
+  }
+  ''
+    # Test that emptySrc is empty
+    if [ -n "$(ls -A ${emptySrc})" ]; then
+      echo "emptySrc is not empty"
+      exit 1
+    fi
 
-  # Test that glibcSrc is not empty
-  if [ -z "$(ls -A ${glibcSrc})" ]; then
-    echo "glibcSrc is empty"
-    exit 1
-  fi
+    # Test that zlibSrc is not empty
+    if [ -z "$(ls -A ${zlibSrc})" ]; then
+      echo "zlibSrc is empty"
+      exit 1
+    fi
 
-  # Make $out exist to avoid build failure
-  mkdir -p $out
-''
+    # Make $out exist to avoid build failure
+    mkdir -p $out
+  ''
diff --git a/pkgs/by-name/ad/ada/package.nix b/pkgs/by-name/ad/ada/package.nix
index 9bee2fc45d33..f8fc46ad7551 100644
--- a/pkgs/by-name/ad/ada/package.nix
+++ b/pkgs/by-name/ad/ada/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ada";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "ada-url";
     repo = "ada";
     tag = "v${version}";
-    hash = "sha256-tC7Hpf9xCysraTtVC+mYE/DVNrG02lwLAlDiTeaWpY4=";
+    hash = "sha256-gXeQYNuhrlCEvvDQtQ07+nE/9gGzzEYPnEKMxWryLRI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/am/amazon-q-cli/package.nix b/pkgs/by-name/am/amazon-q-cli/package.nix
index bf68e93100d0..e793ec319dbb 100644
--- a/pkgs/by-name/am/amazon-q-cli/package.nix
+++ b/pkgs/by-name/am/amazon-q-cli/package.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "amazon-q-cli";
-  version = "1.12.2";
+  version = "1.12.4";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-q-developer-cli-autocomplete";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TIKG1nzpmjiHE+EjTJR+/GklQNJQeUzmDXaPEiRT80Y=";
+    hash = "sha256-juZuqZkBsIHhLOCZk+QpTaO1BsHj2RZyCvkvc0G5KbU=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-lJbHPqQ3eybo03oZY2VyKlsxcTdbdrc8q8AjV+IahEY=";
+  cargoHash = "sha256-BT3LNOkRf4gfBy5SwuAnMoJVF9PmwiLsS5phdtEgIrs=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 318253459ac7..3ff760bffdf0 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -16,6 +16,7 @@
   wireguard-tools,
   libssh,
   zlib,
+  openssl,
   tun2socks,
   xray,
   nix-update-script,
@@ -41,16 +42,16 @@ let
   amnezia-xray = xray.overrideAttrs (
     finalAttrs: prevAttrs: {
       pname = "amnezia-xray";
-      version = "1.8.13";
+      version = "1.8.15";
 
       src = fetchFromGitHub {
         owner = "amnezia-vpn";
         repo = "amnezia-xray-core";
         tag = "v${finalAttrs.version}";
-        hash = "sha256-7XYdogoUEv3kTPTOQwRCohsPtfSDf+aRdI28IkTjvPk=";
+        hash = "sha256-3ZGkfGxYl9/yE7Q2CsJkFJ6xSGybBdq3DztQ0f4VsnY=";
       };
 
-      vendorHash = "sha256-zArdGj5yeRxU0X4jNgT5YBI9SJUyrANDaqNPAPH3d5M=";
+      vendorHash = "sha256-AimQsuBRhgpTY5rW8WRejCkx4s9Q9n+OuTf4XCrgpnE=";
     }
   );
 
@@ -64,56 +65,50 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.6.0";
+  version = "4.8.8.3";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-WQbay3dtGNPPpcK1O7bfs/HKO4ytfmQo60firU/9o28=";
+    hash = "sha256-hDbrp6eT+avFepJL55Vl2alOD+IMnyy8MPXZQTEmLJo=";
     fetchSubmodules = true;
   };
 
-  # Temporary patch header file to fix build with QT 6.9
-  patches = [
-    (fetchpatch {
-      name = "add-missing-include.patch";
-      url = "https://github.com/amnezia-vpn/amnezia-client/commit/c44ce0d77cc3acdf1de48a12459a1a821d404a1c.patch";
-      hash = "sha256-Q6UMD8PlKAcI6zNolT5+cULECnxNrYrD7cifvNg1ZrY=";
-    })
-  ];
-
-  postPatch =
-    ''
-      substituteInPlace client/platforms/linux/daemon/wireguardutilslinux.cpp \
-        --replace-fail 'm_tunnel.start(appPath.filePath("../../client/bin/wireguard-go"), wgArgs);' 'm_tunnel.start("${amneziawg-go}/bin/amneziawg-go", wgArgs);'
-      substituteInPlace client/utilities.cpp \
-        --replace-fail 'return Utils::executable("../../client/bin/openvpn", true);' 'return Utils::executable("${openvpn}/bin/openvpn", false);' \
-        --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${amnezia-tun2socks}/bin/amnezia-tun2socks", false);' \
-        --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);'
-      substituteInPlace client/protocols/xrayprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("xray"), true);' 'return Utils::executable(QString("${amnezia-xray}/bin/xray"), false);'
-      substituteInPlace client/protocols/openvpnovercloakprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("/ck-client"), true);' 'return Utils::executable(QString("${cloak-pt}/bin/ck-client"), false);'
-      substituteInPlace client/protocols/shadowsocksvpnprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("/ss-local"), true);' 'return Utils::executable(QString("${shadowsocks-rust}/bin/sslocal"), false);'
-      substituteInPlace client/configurators/openvpn_configurator.cpp \
-        --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");"
-      substituteInPlace client/ui/qautostart.cpp \
-        --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "AmneziaVPN"
-      substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \
-        --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
-      substituteInPlace deploy/data/linux/AmneziaVPN.service \
-        --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "ExecStart=$out/bin/AmneziaVPN-service" \
-        --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" ""
-    ''
-    + (lib.optionalString (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) ''
-      substituteInPlace client/cmake/3rdparty.cmake \
-        --replace-fail 'set(LIBSSH_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libssh.a")' 'set(LIBSSH_LIB_PATH "${libssh}/lib/libssh.so")' \
-        --replace-fail 'set(ZLIB_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libz.a")' 'set(ZLIB_LIB_PATH "${zlib}/lib/libz.so")' \
-        --replace-fail 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")' 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/arm64/libssl.a")' \
-        --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/arm64/libcrypto.a")'
-    '');
+  postPatch = ''
+    substituteInPlace client/platforms/linux/daemon/wireguardutilslinux.cpp \
+      --replace-fail 'm_tunnel.start(appPath.filePath("../../client/bin/wireguard-go"), wgArgs);' 'm_tunnel.start("${amneziawg-go}/bin/amneziawg-go", wgArgs);'
+    substituteInPlace client/utilities.cpp \
+      --replace-fail 'return Utils::executable("../../client/bin/openvpn", true);' 'return Utils::executable("${openvpn}/bin/openvpn", false);' \
+      --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${amnezia-tun2socks}/bin/amnezia-tun2socks", false);' \
+      --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);'
+    substituteInPlace client/protocols/xrayprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("xray"), true);' 'return Utils::executable(QString("${amnezia-xray}/bin/xray"), false);'
+    substituteInPlace client/protocols/openvpnovercloakprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("/ck-client"), true);' 'return Utils::executable(QString("${cloak-pt}/bin/ck-client"), false);'
+    substituteInPlace client/protocols/shadowsocksvpnprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("/ss-local"), true);' 'return Utils::executable(QString("${shadowsocks-rust}/bin/sslocal"), false);'
+    substituteInPlace client/configurators/openvpn_configurator.cpp \
+      --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");"
+    substituteInPlace client/ui/qautostart.cpp \
+      --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "AmneziaVPN"
+    substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \
+      --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
+    substituteInPlace deploy/data/linux/AmneziaVPN.service \
+      --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "ExecStart=$out/bin/AmneziaVPN-service" \
+      --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" ""
+    substituteInPlace client/cmake/3rdparty.cmake \
+      --replace-fail 'set(LIBSSH_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libssh.a")' 'set(LIBSSH_LIB_PATH "${libssh}/lib/libssh.so")' \
+      --replace-fail 'set(ZLIB_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libz.a")' 'set(ZLIB_LIB_PATH "${zlib}/lib/libz.so")' \
+      --replace-fail 'set(OPENSSL_INCLUDE_DIR "''${OPENSSL_ROOT_DIR}/linux/include")' 'set(OPENSSL_INCLUDE_DIR "${openssl.dev}/include")' \
+      --replace-fail 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")' 'set(OPENSSL_LIB_SSL_PATH "${openssl.out}/lib/libssl.so")' \
+      --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "${openssl.out}/lib/libcrypto.so")' \
+      --replace-fail 'set(OPENSSL_USE_STATIC_LIBS TRUE)' 'set(OPENSSL_USE_STATIC_LIBS FALSE)'
+    substituteInPlace service/server/CMakeLists.txt \
+      --replace-fail 'set(OPENSSL_INCLUDE_DIR "''${OPENSSL_ROOT_DIR}/linux/include")' 'set(OPENSSL_INCLUDE_DIR "${openssl.dev}/include")' \
+      --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "${openssl.out}/lib/libcrypto.so")' \
+      --replace-fail 'set(OPENSSL_USE_STATIC_LIBS TRUE)' 'set(OPENSSL_USE_STATIC_LIBS FALSE)'
+  '';
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/an/andcli/package.nix b/pkgs/by-name/an/andcli/package.nix
index c1c1a1e49b69..66b91e63f9f5 100644
--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "andcli";
-  version = "2.2.0";
+  version = "2.3.0";
 
   subPackages = [ "cmd/andcli" ];
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "tjblackheart";
     repo = "andcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wAatlCckSpa/BE4UVR/L6SkVmNyW2/cl//JOy62EaLc=";
+    hash = "sha256-umV0oJ4sySnZzrIpRuTP/fT8a9nhkC1shVEfVVRpEyI=";
   };
 
-  vendorHash = "sha256-/rmx9g7OfsZXr3zb1UfR1qLxdV2/ELzc/wXn0fJRzbE=";
+  vendorHash = "sha256-lzmkNxQUqktnl2Rpjgoa2yvAuGiMtVGNhiuF40how4o=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ao/aonsoku/package.nix b/pkgs/by-name/ao/aonsoku/package.nix
index b58573ad4aee..38bdf6850e86 100644
--- a/pkgs/by-name/ao/aonsoku/package.nix
+++ b/pkgs/by-name/ao/aonsoku/package.nix
@@ -27,8 +27,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # lockfileVersion: '6.0' need old pnpm
   pnpmDeps = pnpm_8.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
     fetcherVersion = 1;
+    hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/ap/apache-answer/package.nix b/pkgs/by-name/ap/apache-answer/package.nix
index 5e657cf8f680..a3d0fa6fc285 100644
--- a/pkgs/by-name/ap/apache-answer/package.nix
+++ b/pkgs/by-name/ap/apache-answer/package.nix
@@ -28,8 +28,8 @@ buildGoModule rec {
     pnpmDeps = pnpm_9.fetchDeps {
       inherit src version pname;
       sourceRoot = "${src.name}/ui";
-      hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
       fetcherVersion = 1;
+      hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index ada9a015e6c2..1ed8cfd79d64 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "0.29.2";
+  version = "0.29.3";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-szUOl5nKrra7Vvyfcd60/Oy/QFiXZpGJR2gtw3lriKE=";
+    hash = "sha256-3BmWxHhpdkJ7Zyd+K+YS/u4cIiwPsNGaYNvb6ZrIaeQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -79,7 +79,7 @@ buildGoModule (finalAttrs: {
         --zsh <(${apko}/bin/apko completion zsh)
     '';
 
-  nativeCheckInstallInputs = [ versionCheckHook ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
   versionCheckProgramArg = "version";
 
diff --git a/pkgs/by-name/aq/aquamarine/package.nix b/pkgs/by-name/aq/aquamarine/package.nix
index 015e4066e22d..f39c3b8176e7 100644
--- a/pkgs/by-name/aq/aquamarine/package.nix
+++ b/pkgs/by-name/aq/aquamarine/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
-  version = "0.8.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "aquamarine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ybpV2+yNExdHnMhhhmtxqgBCgI+nRr8gi/D+VVb9lQY=";
+    hash = "sha256-1bxH4zW/mnEh7ySsByZBRpANUG/Ym8kgorawYI70z7A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/archipelago/package.nix b/pkgs/by-name/ar/archipelago/package.nix
index 4140936fc5e7..e0cd0fcaac95 100644
--- a/pkgs/by-name/ar/archipelago/package.nix
+++ b/pkgs/by-name/ar/archipelago/package.nix
@@ -7,10 +7,10 @@
 }:
 let
   pname = "archipelago";
-  version = "0.6.1";
+  version = "0.6.2";
   src = fetchurl {
     url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${version}/Archipelago_${version}_linux-x86_64.AppImage";
-    hash = "sha256-8mPlR5xVnHL9I0rV4bMFaffSJv7dMlCcPHrLkM/pyVU=";
+    hash = "sha256-DdlfHb8iTCfTGGBUYQeELYh2NF/2GcamtuJzeYb2A5M=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -40,7 +40,10 @@ appimageTools.wrapType2 {
     changelog = "https://github.com/ArchipelagoMW/Archipelago/releases/tag/${version}";
     license = lib.licenses.mit;
     mainProgram = "archipelago";
-    maintainers = with lib.maintainers; [ pyrox0 ];
+    maintainers = with lib.maintainers; [
+      pyrox0
+      iqubic
+    ];
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/ar/ares/package.nix b/pkgs/by-name/ar/ares/package.nix
index 84eaaf6f3d49..48a80bbf01b1 100644
--- a/pkgs/by-name/ar/ares/package.nix
+++ b/pkgs/by-name/ar/ares/package.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ares";
-  version = "144";
+  version = "145";
 
   src = fetchFromGitHub {
     owner = "ares-emulator";
     repo = "ares";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BpVyPdtsIUstLVf/HGO6vcAlLgJP5SgJbZtqEV/uJ2g=";
+    hash = "sha256-es+K5+qlK7FcJCFEIMcOsXCZSnoXEEmtS0yhpCvaILM";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ar/artalk/package.nix b/pkgs/by-name/ar/artalk/package.nix
index d0d94f2afa1c..407c76243483 100644
--- a/pkgs/by-name/ar/artalk/package.nix
+++ b/pkgs/by-name/ar/artalk/package.nix
@@ -33,8 +33,8 @@ let
 
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
-      hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
       fetcherVersion = 1;
+      hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/as/astro-language-server/package.nix b/pkgs/by-name/as/astro-language-server/package.nix
index c1d467284a0e..5ee70c8e2206 100644
--- a/pkgs/by-name/as/astro-language-server/package.nix
+++ b/pkgs/by-name/as/astro-language-server/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       prePnpmInstall
       ;
-    hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
     fetcherVersion = 1;
+    hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/at/atmos/package.nix b/pkgs/by-name/at/atmos/package.nix
index 1b029ce7ae8f..0e1aaa50fe6d 100644
--- a/pkgs/by-name/at/atmos/package.nix
+++ b/pkgs/by-name/at/atmos/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.180.0";
+  version = "1.182.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/yCgC73J4PVTqmJBW0eLCMVWtsyMGLeF0Rmvx+N/oP8=";
+    hash = "sha256-xGNexXxeX6ZKG4eWCoj0laHHXegnNqSfRPEkIWcieNQ=";
   };
 
-  vendorHash = "sha256-k1zC3tUF2uDAo86J6dZmYOGZcYFBNdSH15cyX2tiZEg=";
+  vendorHash = "sha256-P+Fsc6z3kTG8iq29KEp7DUV4zeT7Kee384TMosTDKGU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/at/attic-client/package.nix b/pkgs/by-name/at/attic-client/package.nix
index 261e63193d29..b9f1d8300afd 100644
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@@ -21,13 +21,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "attic";
-  version = "0-unstable-2025-07-08";
+  version = "0-unstable-2025-07-11";
 
   src = fetchFromGitHub {
     owner = "zhaofengli";
     repo = "attic";
-    rev = "07147da79388468ff85c2a650500d11ca0edd12e";
-    hash = "sha256-pHsHcWQWGyzDh48YHnSw9YVKEnQ95QWnmHNFtvo7iu0=";
+    rev = "24fad0622fc9404c69e83bab7738359c5be4988e";
+    hash = "sha256-5TomR72rn4q+5poQcN6EnanxeXKqJSqWVAoDAFN0lUc=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage {
   buildInputs = lib.optional needNixInclude nix ++ [ boost ];
 
   cargoBuildFlags = lib.concatMapStrings (c: "-p ${c} ") crates;
-  cargoHash = "sha256-I5GS32dOCECYKSNMi2Xs2rBRxPLcvLEWHlIIWP/bMBU=";
+  cargoHash = "sha256-NdzwYnD0yMEI2RZwwXl/evYx9zdBVMOUee+V7uq1cf0=";
   useFetchCargoVendor = true;
 
   env = {
diff --git a/pkgs/by-name/au/audiobookshelf/source.json b/pkgs/by-name/au/audiobookshelf/source.json
index 4af825176f8c..0b924019b56b 100644
--- a/pkgs/by-name/au/audiobookshelf/source.json
+++ b/pkgs/by-name/au/audiobookshelf/source.json
@@ -1,9 +1,9 @@
 {
   "owner": "advplyr",
   "repo": "audiobookshelf",
-  "rev": "f3f5f3b9bd540d311a6ab0a99b9317a5142755ea",
-  "hash": "sha256-tymJLs0gucJX0n0helxAkCrifG4uWcxaEBpgK7uVG2c=",
-  "version": "2.25.1",
-  "depsHash": "sha256-JFoE4jNyIfdk/uhhbdP3flcNRus8FvwRNrs+hf4YJ5E=",
-  "clientDepsHash": "sha256-s8fybUu3hJozX57RfsxBSy09QjOiVGO4vg7woOEqMi4="
+  "rev": "264ae928a9c1af620487488110eec816b14e23ec",
+  "hash": "sha256-QNzQY5+tHzMopvJJw3ihb+x203wNnvIRbyyFNESN0Bk=",
+  "version": "2.26.0",
+  "depsHash": "sha256-rbe0EAGK2t3KkTaNie9psiFcA4EVooPDQzQclgW9R6k=",
+  "clientDepsHash": "sha256-yrTkVDFsf8o3QVtRAiy6rS3UZO2vxvBIoh2RsAmVp18="
 }
diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index b545937a1ddc..9f49e3e6f408 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -40,8 +40,8 @@ let
         src
         sourceRoot
         ;
-      hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
       fetcherVersion = 1;
+      hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
     };
 
     postBuild = ''
diff --git a/pkgs/by-name/au/automatic-timezoned/package.nix b/pkgs/by-name/au/automatic-timezoned/package.nix
index 352d04af20c2..df2e3d35f524 100644
--- a/pkgs/by-name/au/automatic-timezoned/package.nix
+++ b/pkgs/by-name/au/automatic-timezoned/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "2.0.80";
+  version = "2.0.82";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = "automatic-timezoned";
     rev = "v${version}";
-    sha256 = "sha256-5JrIcdNgi68g+5zF0y4YeNboFl6SS9QvZEsmcMh35gE=";
+    sha256 = "sha256-qUpPeuFfdj0rIygSo9C7LGdFi7l1erfz4XYTuxLgL7M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-IX3lSupcKn1ET4Q7tLpUBhQ+wfmfUyM/onlTwW7wloU=";
+  cargoHash = "sha256-7QkrKeF1WY1ewe4GsdpZ/Na7hd9AGq+ixepeB473bDQ=";
 
   meta = {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/by-name/au/autoprefixer/package.nix b/pkgs/by-name/au/autoprefixer/package.nix
index 31662f322b7e..7d98e6bf4b19 100644
--- a/pkgs/by-name/au/autoprefixer/package.nix
+++ b/pkgs/by-name/au/autoprefixer/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
     fetcherVersion = 1;
+    hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/au/autotiling-rs/package.nix b/pkgs/by-name/au/autotiling-rs/package.nix
index b095f7d06174..f4e979b04bd5 100644
--- a/pkgs/by-name/au/autotiling-rs/package.nix
+++ b/pkgs/by-name/au/autotiling-rs/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "autotiling-rs";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "ammgws";
     repo = "autotiling-rs";
     rev = "v${version}";
-    sha256 = "sha256-rihNlKaESxIEQ61FP6PzIg82yuwQ/R4GX5BA0Ss+I5w=";
+    sha256 = "sha256-S/6LRQTHdPGZkmbTAb0ufNoXE1nD+rIQ2ASJ8jjFS3E=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-mXuI+kA8J2Bhli6HiX9h72i61cRbByKJQtUHHjCUza8=";
+  cargoHash = "sha256-riQ1nOs4fBj9y/jK0nS7Y85vMejLrKrEJzNnsQKkoeg=";
 
   meta = with lib; {
     description = "Autotiling for sway (and possibly i3)";
diff --git a/pkgs/by-name/aw/aws-c-common/package.nix b/pkgs/by-name/aw/aws-c-common/package.nix
index 2c33c7f38b49..10f0884243b6 100644
--- a/pkgs/by-name/aw/aws-c-common/package.nix
+++ b/pkgs/by-name/aw/aws-c-common/package.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/awslabs/aws-c-common";
     license = licenses.asl20;
     platforms = platforms.unix;
+    # https://github.com/awslabs/aws-c-common/issues/1175
+    badPlatforms = platforms.bigEndian;
     maintainers = with maintainers; [
       orivej
       r-burns
diff --git a/pkgs/by-name/ba/backrest/package.nix b/pkgs/by-name/ba/backrest/package.nix
index 55f1a97532d8..66c51c3bdf91 100644
--- a/pkgs/by-name/ba/backrest/package.nix
+++ b/pkgs/by-name/ba/backrest/package.nix
@@ -33,8 +33,8 @@ let
 
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
-      hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
       fetcherVersion = 1;
+      hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 7257b7a1f881..2cd18243b106 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -16,13 +16,13 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.29.5";
+  version = "1.30.1";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-fD7A37G1kr7sWfwI8GXOm1cOlpnTSE9tN/WzotM8BeQ=";
+    hash = "sha256-YPjeiRg7vIpb9k32og6byWMk+EfhDS9MwfJveAndbQQ=";
   };
 
   npmDepsHash = "sha256-aJte4ApeXJQ9EYn87Uo+Xx7s+wi80I1JsZHeqklHGs4=";
diff --git a/pkgs/by-name/ba/bash-language-server/package.nix b/pkgs/by-name/ba/bash-language-server/package.nix
index f03d0195e32c..ab6279ea88ba 100644
--- a/pkgs/by-name/ba/bash-language-server/package.nix
+++ b/pkgs/by-name/ba/bash-language-server/package.nix
@@ -28,8 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src
       pnpmWorkspaces
       ;
-    hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
     fetcherVersion = 1;
+    hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bo/bootc/package.nix b/pkgs/by-name/bo/bootc/package.nix
index a2a7fa796bf3..e0f4f3a0473c 100644
--- a/pkgs/by-name/bo/bootc/package.nix
+++ b/pkgs/by-name/bo/bootc/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bootc";
-  version = "1.1.2";
+  version = "1.4.0";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-/Sb2XtVguj5zpj/OTl90xFHFSaBeLgb8xIlNm4UrnRI=";
+  cargoHash = "sha256-7Fn68bcm8ZyR5eALCMIdcXcZ595EnWFHKdnqI5vMso4=";
   doInstallCheck = true;
 
   src = fetchFromGitHub {
-    owner = "containers";
+    owner = "bootc-dev";
     repo = "bootc";
     rev = "v${version}";
-    hash = "sha256-p1+j62MllmPcvWnijieSZmlgwYy76X17fv12Haetz78=";
+    hash = "sha256-FuU3rQtKpK+ScQ10GivisSJseY2GOFJ/y2HRKIiU0G8=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -35,13 +35,26 @@ rustPlatform.buildRustPackage rec {
     ostree-full
   ];
 
+  checkFlags = [
+    # These all require a writable /var/tmp
+    "--skip=test_cli_fns"
+    "--skip=test_diff"
+    "--skip=test_tar_export_reproducible"
+    "--skip=test_tar_export_structure"
+    "--skip=test_tar_import_empty"
+    "--skip=test_tar_import_export"
+    "--skip=test_tar_import_signed"
+    "--skip=test_tar_write"
+    "--skip=test_tar_write_tar_layer"
+  ];
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
 
   meta = {
     description = "Boot and upgrade via container images";
-    homepage = "https://containers.github.io/bootc";
+    homepage = "https://bootc-dev.github.io/bootc";
     license = lib.licenses.mit;
     mainProgram = "bootc";
     maintainers = with lib.maintainers; [ thesola10 ];
diff --git a/pkgs/by-name/bu/bumpp/package.nix b/pkgs/by-name/bu/bumpp/package.nix
index 3b05d5a65df2..4eda9b885e5d 100644
--- a/pkgs/by-name/bu/bumpp/package.nix
+++ b/pkgs/by-name/bu/bumpp/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
     fetcherVersion = 1;
+    hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/by/byedpi/package.nix b/pkgs/by-name/by/byedpi/package.nix
index 5358b379ef88..c3ed44f2a0e0 100644
--- a/pkgs/by-name/by/byedpi/package.nix
+++ b/pkgs/by-name/by/byedpi/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "byedpi";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "hufrea";
     repo = "byedpi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-an0UmsAZw5DJMuM4WpAWBVVN0ZVBpXhn0cbZ0ZbfBjo=";
+    hash = "sha256-XeUcf8w6b0vZQwttopRnmg5320oF/Z+gHWcWMQ6kAkc=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ca/candy-icons/package.nix b/pkgs/by-name/ca/candy-icons/package.nix
index 2dcfe0af6b93..82ecfad4ef58 100644
--- a/pkgs/by-name/ca/candy-icons/package.nix
+++ b/pkgs/by-name/ca/candy-icons/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "candy-icons";
-  version = "0-unstable-2025-06-23";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "EliverLara";
     repo = "candy-icons";
-    rev = "29976b2036490599753766f869f83e9346d8cf8e";
-    hash = "sha256-UxuW9cRGmKS2t8ik2tMAQHU0Xj+W5WhWuBxnLkkPnoE=";
+    rev = "475c5b27d34e6bde3ed11e985a727bd7ec9f155a";
+    hash = "sha256-XU10gw0WYWnzyzbzJlg2oNCksLY/Tt1CJGo0Nu4FLnM=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/by-name/ca/cargo-deb/package.nix b/pkgs/by-name/ca/cargo-deb/package.nix
index 5db84ae41b5e..e23b255a9921 100644
--- a/pkgs/by-name/ca/cargo-deb/package.nix
+++ b/pkgs/by-name/ca/cargo-deb/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "kornelski";
     repo = "cargo-deb";
     rev = "v${version}";
-    hash = "sha256-2HHxGpp/N8QDytOsiWh8nkYNbWhThjisjnyI3B8+XYo=";
+    hash = "sha256-MvuwvJUPI+UBw9oEVYtjWjPCHUEBJE3L5+EEwBROwQ8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hHZt4mRLpeXj1XWJ6v0pBDO0NpFDn0BT2oLgT2yZlm0=";
+  cargoHash = "sha256-k6mghoRWaKfHzT8YM2ZylJSLDIf005gRL64qqGwo2qw=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/ca/cargo-tauri/test-app.nix b/pkgs/by-name/ca/cargo-tauri/test-app.nix
index af0c230af635..67d17cece65c 100644
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       ;
 
-    hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
     fetcherVersion = 1;
+    hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cd/cdxgen/package.nix b/pkgs/by-name/cd/cdxgen/package.nix
index 3fa6ec4c0a45..7baf4185d643 100644
--- a/pkgs/by-name/cd/cdxgen/package.nix
+++ b/pkgs/by-name/cd/cdxgen/package.nix
@@ -37,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
     fetcherVersion = 1;
+    hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/ci/circt/package.nix b/pkgs/by-name/ci/circt/package.nix
index ea2ca8e1cb4f..282079be6889 100644
--- a/pkgs/by-name/ci/circt/package.nix
+++ b/pkgs/by-name/ci/circt/package.nix
@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.124.0";
+  version = "1.125.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-IoS7mhQLiaVlqyosqOOaoGKBkS5WuQHRJK9v+FonCxc=";
+    hash = "sha256-bpQvBUSYpmv6bmgXSCz9pfGgFxlGVFFDfaSkvk7481E=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
index 42c311251c50..e434d832d736 100644
--- a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
@@ -37,8 +37,8 @@ rustPlatform.buildRustPackage {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = pnpm-hash;
     fetcherVersion = 1;
+    hash = pnpm-hash;
   };
 
   env = {
diff --git a/pkgs/by-name/cl/clickhouse-backup/package.nix b/pkgs/by-name/cl/clickhouse-backup/package.nix
index 296576174eae..c390fd8ac046 100644
--- a/pkgs/by-name/cl/clickhouse-backup/package.nix
+++ b/pkgs/by-name/cl/clickhouse-backup/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.6.24";
+  version = "2.6.26";
 
   src = fetchFromGitHub {
     owner = "Altinity";
     repo = "clickhouse-backup";
     rev = "v${version}";
-    hash = "sha256-KpCucAG2t2+HyDLCkc838k07QqWTC57Oolp9CAxTQiY=";
+    hash = "sha256-CdDzIKCtOE8Q7I6YhMIi4oyjo5rnYrySvzbpcdgQH6s=";
   };
 
-  vendorHash = "sha256-ynXS0owzBBIPzSma/nhY/cX/gSL6nQ+/KmMYY16NloU=";
+  vendorHash = "sha256-Vqudi7sl9VTWo4g+74qh9sMUOGd9OpNDlzimEPm/EtU=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/by-name/cm/cmctl/package.nix b/pkgs/by-name/cm/cmctl/package.nix
index a443b7df1faf..e0c1b044eac8 100644
--- a/pkgs/by-name/cm/cmctl/package.nix
+++ b/pkgs/by-name/cm/cmctl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cmctl";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cmctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kr7vwVW6v08QRbJDs2u0vK241ljNfhLVYIQCBl31QSs=";
+    hash = "sha256-yX3A63MU1PaFQmAemp62F5sHlgWpkInhbIIZx7HfdEc=";
   };
 
-  vendorHash = "sha256-SYCWvt2K3MEow4cDKxLSK+Bp0hZG9rNI9PoXdPcPESg=";
+  vendorHash = "sha256-LDmhlSWa6/Z4KyXnF9OFVkgTksV7TL+m1os0NW89ZpY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/co/comma/package.nix b/pkgs/by-name/co/comma/package.nix
index 7e79b6eb89be..8111f49b7816 100644
--- a/pkgs/by-name/co/comma/package.nix
+++ b/pkgs/by-name/co/comma/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comma";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "comma";
     rev = "v${version}";
-    hash = "sha256-EP1UGmoPXeyJY1mk3c4DNF6/HkjqlwKf5ZLhjNa1WMo=";
+    hash = "sha256-Q9s3z/FqkEqCQyvYhH07qlITGGlA8quZcYsK3lO8M8g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-GEHvS4hDBKqSquRmGZ9LMIFsX8MGqOqPZVf0aAzMmmI=";
+  cargoHash = "sha256-yNx0Sc2JnEfndBBPxaeNMWsdWpB9fAUqXUPVNR+NOrM=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/by-name/co/concurrently/package.nix b/pkgs/by-name/co/concurrently/package.nix
index b89146d333c9..cdf9061c726b 100644
--- a/pkgs/by-name/co/concurrently/package.nix
+++ b/pkgs/by-name/co/concurrently/package.nix
@@ -29,8 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
     fetcherVersion = 1;
+    hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/co/copybara/package.nix b/pkgs/by-name/co/copybara/package.nix
index f6bbfd31edd5..7e3ff087f355 100644
--- a/pkgs/by-name/co/copybara/package.nix
+++ b/pkgs/by-name/co/copybara/package.nix
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20250630";
+  version = "20250714";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-eXvFPzlQT3sVcXi+b6ze/3Llnv9T0S2cELdDbyHJ6Yg=";
+    hash = "sha256-pvJnBMuTJb4juJBJObpA9hP2Fw42IssdAARUGUuEgJo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 109b6ac2ec76..9ec093cf4084 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -6,21 +6,21 @@
   installShellFiles,
   nixosTests,
   externalPlugins ? [ ],
-  vendorHash ? "sha256-mp+0/DQTNsgAZTnLqcQq1HVLAfKr5vUGYSZlIvM7KpE=",
+  vendorHash ? "sha256-Es3xy8NVDo7Xgu32jJa4lhYWGa5hJnRyDKFYQqB3aBY=",
 }:
 
 let
   attrsToSources = attrs: builtins.map ({ repo, version, ... }: "${repo}@${version}") attrs;
 in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "coredns";
-  version = "1.11.3";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
-    rev = "v${version}";
-    sha256 = "sha256-8LZMS1rAqEZ8k1IWSRkQ2O650oqHLP0P31T8oUeE4fw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-P4GhWrEACR1ZhNhGAoXWvNXYlpwnm2dz6Ggqv72zYog=";
   };
 
   inherit vendorHash;
@@ -95,16 +95,17 @@ buildGoModule rec {
   postPatch =
     ''
       substituteInPlace test/file_cname_proxy_test.go \
-        --replace "TestZoneExternalCNAMELookupWithProxy" \
-                  "SkipZoneExternalCNAMELookupWithProxy"
+        --replace-fail \
+          "TestZoneExternalCNAMELookupWithProxy" \
+          "SkipZoneExternalCNAMELookupWithProxy"
 
       substituteInPlace test/readme_test.go \
-        --replace "TestReadme" "SkipReadme"
+        --replace-fail "TestReadme" "SkipReadme"
 
       # this test fails if any external plugins were imported.
       # it's a lint rather than a test of functionality, so it's safe to disable.
       substituteInPlace test/presubmit_test.go \
-        --replace "TestImportOrdering" "SkipImportOrdering"
+        --replace-fail "TestImportOrdering" "SkipImportOrdering"
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       # loopback interface is lo0 on macos
@@ -112,9 +113,11 @@ buildGoModule rec {
 
       # test is apparently outdated but only exhibits this on darwin
       substituteInPlace test/corefile_test.go \
-        --replace "TestCorefile1" "SkipCorefile1"
+        --replace-fail "TestCorefile1" "SkipCorefile1"
     '';
 
+  __darwinAllowLocalNetworking = true;
+
   postInstall = ''
     installManPage man/*
   '';
@@ -124,15 +127,16 @@ buildGoModule rec {
     kubernetes-multi-node = nixosTests.kubernetes.dns-multi-node;
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://coredns.io";
     description = "DNS server that runs middleware";
     mainProgram = "coredns";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
-      rushmorem
-      rtreffer
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       deltaevo
+      djds
+      rtreffer
+      rushmorem
     ];
   };
-}
+})
diff --git a/pkgs/by-name/co/cowsql/37.patch b/pkgs/by-name/co/cowsql/37.patch
deleted file mode 100644
index 9f7eb84afc35..000000000000
--- a/pkgs/by-name/co/cowsql/37.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From c0d7c99632ea2ee01066988708cbb41f335cbdc3 Mon Sep 17 00:00:00 2001
-From: Brahmajit Das <listout@listout.xyz>
-Date: Sat, 14 Jun 2025 00:18:38 +0530
-Subject: [PATCH] src/lib/serialize.h: don't define double as float_t
-
-libuv with commit 85b526f makes uv.h include math.h for the definitions
-of NAN/INFINITY. That header also defines the ISO C standard float_t
-type. Now that that definition is in scope, the cowsql definition in
-src/lib/serialize.h conflicts with it.
-
-Fixes: 451cff63b29366237a9502823299b05bbff8662b
-Closes: https://github.com/cowsql/cowsql/issues/35
-Signed-off-by: Brahmajit Das <listout@listout.xyz>
----
- src/lib/serialize.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/lib/serialize.h b/src/lib/serialize.h
-index 9fbd49c..a7f9147 100644
---- a/src/lib/serialize.h
-+++ b/src/lib/serialize.h
-@@ -37,7 +37,7 @@ static_assert(sizeof(double) == sizeof(uint64_t),
-  * Basic type aliases to used by macro-based processing.
-  */
- typedef const char *text_t;
--typedef double float_t;
-+typedef double cowsql_float;
- typedef uv_buf_t blob_t;
- 
- /**
-@@ -143,7 +143,7 @@ COWSQL_INLINE size_t int64__sizeof(const int64_t *value)
- 	return sizeof(int64_t);
- }
- 
--COWSQL_INLINE size_t float__sizeof(const float_t *value)
-+COWSQL_INLINE size_t float__sizeof(const cowsql_float *value)
- {
- 	(void)value;
- 	return sizeof(double);
-@@ -190,7 +190,7 @@ COWSQL_INLINE void int64__encode(const int64_t *value, void **cursor)
- 	*cursor += sizeof(int64_t);
- }
- 
--COWSQL_INLINE void float__encode(const float_t *value, void **cursor)
-+COWSQL_INLINE void float__encode(const cowsql_float *value, void **cursor)
- {
- 	*(uint64_t *)(*cursor) = ByteFlipLe64(*(uint64_t *)value);
- 	*cursor += sizeof(uint64_t);
-@@ -273,7 +273,7 @@ COWSQL_INLINE int int64__decode(struct cursor *cursor, int64_t *value)
- 	return 0;
- }
- 
--COWSQL_INLINE int float__decode(struct cursor *cursor, float_t *value)
-+COWSQL_INLINE int float__decode(struct cursor *cursor, cowsql_float *value)
- {
- 	size_t n = sizeof(double);
- 	if (n > cursor->cap) {
diff --git a/pkgs/by-name/co/cowsql/package.nix b/pkgs/by-name/co/cowsql/package.nix
index f7e19e77757e..538a46889ce1 100644
--- a/pkgs/by-name/co/cowsql/package.nix
+++ b/pkgs/by-name/co/cowsql/package.nix
@@ -13,21 +13,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cowsql";
-  version = "1.15.8";
+  version = "1.15.9";
 
   src = fetchFromGitHub {
     owner = "cowsql";
     repo = "cowsql";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rwTa9owtnkyI9OpUKLk6V7WbAkqlYucpGzPnHHvKW/A=";
+    hash = "sha256-7djVcozWklI/0KhDC20df+H3YQbodUZaXBnQT4Ug8oI=";
   };
 
-  patches = [
-    # fix libuv changes. review removal in > 1.15.8
-    # https://github.com/cowsql/cowsql/pull/37
-    ./37.patch
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index 53e5b50e475a..4ea3c37c46db 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -21,12 +21,12 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-06-26";
+  version = "0-unstable-2025-07-02";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "4c8cd6ddfd940a1f61178bb469a2bb7274bc07b1";
-    hash = "sha256-6Io0Vj5QG6BwAlcgB0KyQlsRU3Z/elvd1oXt2w+hgBM=";
+    rev = "0435ecd305e4a4f9f4110cfe7d94a6ff906d2f5d";
+    hash = "sha256-NZezC/XZwWivJsmVUkcncVonJM5jRZottRGO+I0KhIY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/cu/cubeb/package.nix b/pkgs/by-name/cu/cubeb/package.nix
index aa63c0393cc5..8086302d1e23 100644
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cubeb";
-  version = "0-unstable-2025-06-16";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cubeb";
-    rev = "566c73da47668ca85817108b749a13ac9c3f5a9d";
-    hash = "sha256-qYDsRhVBHLOVpWwtRNUtnZRZZq9Rot1pOn+4let6v6I=";
+    rev = "fa021607121360af7c171d881dc5bc8af7bb56eb";
+    hash = "sha256-6PUHUPybe3g5nexunAHsHLThFdvpnv+avks+C0oYih0=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/da/daed/package.nix b/pkgs/by-name/da/daed/package.nix
index 618a7d85a16f..a6ebfd9ee257 100644
--- a/pkgs/by-name/da/daed/package.nix
+++ b/pkgs/by-name/da/daed/package.nix
@@ -27,8 +27,8 @@ let
 
     pnpmDeps = pnpm_9.fetchDeps {
       inherit pname version src;
-      hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
       fetcherVersion = 1;
+      hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index 9790889f4512..e676f0e74c2e 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "0.258.0";
+  version = "0.259.0";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8JVU0tn0KINBdEE0nS2VQ8v9TUn9h2euPGZELSCbcLA=";
+    hash = "sha256-UzfLtGwiyEnHRn54qAwcqMXag8k8GjpB5BGMYh/93O8=";
   };
 
   # Otherwise these tests fail asserting that the version is 0.0.0-dev
diff --git a/pkgs/by-name/db/dbtpl/package.nix b/pkgs/by-name/db/dbtpl/package.nix
new file mode 100644
index 000000000000..d4fa2c6a61b7
--- /dev/null
+++ b/pkgs/by-name/db/dbtpl/package.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  buildPackages,
+  versionCheckHook,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "dbtpl";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "xo";
+    repo = "dbtpl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-r0QIgfDSt7HWnIDnJWGbwkqkXWYWGXoF5H/+zS6gEtE=";
+  };
+
+  vendorHash = "sha256-scJRJaaccQovxhzC+/OHuPR4NRaE8+u57S1JY40bif8=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  modPostBuild = ''
+    substituteInPlace vendor/github.com/xo/ox/ox.go \
+        --replace-warn "ver := \"(devel)\"" "ver := \"${finalAttrs.version}\""
+  '';
+
+  postInstall =
+    let
+      exe =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$out/bin/dbtpl"
+        else
+          lib.getExe buildPackages.dbtpl;
+    in
+    ''
+      installShellCompletion --cmd dbtpl \
+        --bash <(${exe} completion bash) \
+        --fish <(${exe} completion fish) \
+        --zsh <(${exe} completion zsh)
+    '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command line tool to generate idiomatic Go code for SQL databases supporting PostgreSQL, MySQL, SQLite, Oracle, and Microsoft SQL Server";
+    homepage = "https://github.com/xo/dbtpl";
+    changelog = "https://github.com/xo/dbtpl/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      xiaoxiangmoe
+      shellhazard
+    ];
+    mainProgram = "dbtpl";
+  };
+})
diff --git a/pkgs/by-name/dd/ddns-go/package.nix b/pkgs/by-name/dd/ddns-go/package.nix
index 099b1074859b..6599cf0a62f3 100644
--- a/pkgs/by-name/dd/ddns-go/package.nix
+++ b/pkgs/by-name/dd/ddns-go/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.11.2";
+  version = "6.11.3";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = "ddns-go";
     rev = "v${version}";
-    hash = "sha256-dzHNv7zfn1jU3F7nyQP/mP3icGCoeR3C7rerE3oYoTw=";
+    hash = "sha256-65j1hZqnpSRpDmkzjb8ciJoVGHbV2xuOwBLcsW65eOE=";
   };
 
   vendorHash = "sha256-oHiREhvqu14z5StjzD4PgtFasYQ0X435eMCRMiWUzg0=";
diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index 0f5992cd0bcb..ee3c55ae5a74 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
     fetcherVersion = 1;
+    hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/dh/dhcpcd/package.nix b/pkgs/by-name/dh/dhcpcd/package.nix
index 27a290c8284f..d78024d5cdb3 100644
--- a/pkgs/by-name/dh/dhcpcd/package.nix
+++ b/pkgs/by-name/dh/dhcpcd/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dhcpcd";
-  version = "10.1.0";
+  version = "10.2.4";
 
   src = fetchFromGitHub {
     owner = "NetworkConfiguration";
     repo = "dhcpcd";
     rev = "v${version}";
-    sha256 = "sha256-Qtg9jOFMR/9oWJDmoNNcEAMxG6G1F187HF4MMBJIoTw=";
+    sha256 = "sha256-ysaKgF4Cu/S6yhSn/4glA0+Ey54KNp3/1Oh82yE0/PY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/di/diesel-cli/package.nix b/pkgs/by-name/di/diesel-cli/package.nix
index 4c72fc27f2d8..0205540f90df 100644
--- a/pkgs/by-name/di/diesel-cli/package.nix
+++ b/pkgs/by-name/di/diesel-cli/package.nix
@@ -27,16 +27,16 @@ assert lib.assertMsg (lib.elem true [
 
 rustPlatform.buildRustPackage rec {
   pname = "diesel-cli";
-  version = "2.2.11";
+  version = "2.2.12";
 
   src = fetchCrate {
     inherit version;
     crateName = "diesel_cli";
-    hash = "sha256-utiIuifPxHjvC0TkY2XLeOlqReaal/4T4hrJ7tmQ27k=";
+    hash = "sha256-cBufd4HwNffkK2VDPMMUT1qZfgKNa6XKpxT5QlQesyc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-QHcH0jgBAYtyYJoaBJW92HR5ZBgdMLupe5+l22Wpfjg=";
+  cargoHash = "sha256-CmzUe/R9iFU//u0/FxMonYWyx0EJnI/blUktYN/eNe8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index 98f70f8ef84e..d06de6f83032 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -106,12 +106,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "300";
+  version = "301";
   format = "setuptools";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-ByfAS1ygWex8FLGeaV1HouSb6ElDZjAhXV5xjpsltFE=";
+    hash = "sha256-piTdP812LgcxvvgvUOKUrkxVXCbclyQW8dp84beT7H4=";
   };
 
   outputs = [
diff --git a/pkgs/development/tools/djhtml/default.nix b/pkgs/by-name/dj/djhtml/package.nix
similarity index 70%
rename from pkgs/development/tools/djhtml/default.nix
rename to pkgs/by-name/dj/djhtml/package.nix
index dc94350fdb2b..2f4f4be65d3d 100644
--- a/pkgs/development/tools/djhtml/default.nix
+++ b/pkgs/by-name/dj/djhtml/package.nix
@@ -1,10 +1,9 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  setuptools,
 }:
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "djhtml";
   version = "3.0.8";
   pyproject = true;
@@ -16,16 +15,16 @@ buildPythonApplication rec {
     hash = "sha256-1bopV6mjwjXdoIN9i3An4NvSpeGcVlQ24nLLjP/UfQU=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ python3Packages.setuptools ];
 
   pythonImportsCheck = [ "djhtml" ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/rtts/djhtml";
     description = "Django/Jinja template indenter";
     changelog = "https://github.com/rtts/djhtml/releases/tag/${src.tag}";
-    license = licenses.gpl3Plus;
-    maintainers = [ ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "djhtml";
   };
 }
diff --git a/pkgs/by-name/dn/dns-collector/package.nix b/pkgs/by-name/dn/dns-collector/package.nix
index f9a9aa9c6297..636c31493891 100644
--- a/pkgs/by-name/dn/dns-collector/package.nix
+++ b/pkgs/by-name/dn/dns-collector/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "dns-collector";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "dns-collector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q12hMnSqA/KCkmiqsmBpvDmyHtuEWhMBTKwOOyw3Wfs=";
+    hash = "sha256-ebl/edMN45oLV1pN6mCaOSgxSSyAugsBP2sQWbIiPTI=";
   };
   subPackages = [ "." ];
 
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-TtlOwmNyO2/eQCajPBu6Pgdbuk4gacpgtcnr1vZgZdg=";
+  vendorHash = "sha256-Y0LOtyRJWOFAQwfg8roisSer0oCxPiaYICE1FY/SEF8=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index c1066373414b..895763c82698 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.132.0";
+  version = "1.133.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${version}";
-    hash = "sha256-A4CtJpqHkC88kH6CsEt2Pc+SgHeznjnzRYwclvm7De0=";
+    hash = "sha256-U3n407HnivvogybgTuB/Rb932bt0WTbk6M1Wf7jRoTo=";
   };
 
   meta = {
diff --git a/pkgs/by-name/do/dorion/package.nix b/pkgs/by-name/do/dorion/package.nix
index f8e3dba5d29b..99bc6259bfe8 100644
--- a/pkgs/by-name/do/dorion/package.nix
+++ b/pkgs/by-name/do/dorion/package.nix
@@ -59,8 +59,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xBonUzA4+1zbViEsKap6CaG6ZRldW1LjNYIB+FmVRFs=";
     fetcherVersion = 1;
+    hash = "sha256-xBonUzA4+1zbViEsKap6CaG6ZRldW1LjNYIB+FmVRFs=";
   };
 
   # CMake (webkit extension)
diff --git a/pkgs/by-name/dr/drawterm/package.nix b/pkgs/by-name/dr/drawterm/package.nix
index 835dfea8faac..9501e867b5b0 100644
--- a/pkgs/by-name/dr/drawterm/package.nix
+++ b/pkgs/by-name/dr/drawterm/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "drawterm";
-  version = "0-unstable-2025-06-13";
+  version = "0-unstable-2025-06-29";
 
   src = fetchFrom9Front {
     owner = "plan9front";
     repo = "drawterm";
-    rev = "4e32a9fa6e58c1474f747a99083303c4a2f14ea7";
-    hash = "sha256-j0s6xB8c8vQoOzL34Gu84elec0ig4z75NzlUx6PsW4E=";
+    rev = "903bcd8dba9cb9dfc70707a28089c469e5302539";
+    hash = "sha256-gZAPNRzAuvpIAV7ArPGsqVv6SYBJkqA+Okf6FmStvsU=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/dv/dvdauthor/gettext-0.25.patch b/pkgs/by-name/dv/dvdauthor/gettext-0.25.patch
new file mode 100644
index 000000000000..9503b6157f96
--- /dev/null
+++ b/pkgs/by-name/dv/dvdauthor/gettext-0.25.patch
@@ -0,0 +1,14 @@
+diff --git a/configure.ac b/configure.ac
+index f4b270f..17e102f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1,5 +1,9 @@
+ AC_INIT(DVDAuthor,0.7.2,dvdauthor-users@lists.sourceforge.net)
+ 
++AC_CONFIG_MACRO_DIRS([m4])
++AM_GNU_GETTEXT_VERSION([0.25])
++AM_GNU_GETTEXT([external])
++
+ AC_CONFIG_HEADERS(src/config.h)
+ AC_CONFIG_AUX_DIR(autotools)
+ 
diff --git a/pkgs/by-name/dv/dvdauthor/package.nix b/pkgs/by-name/dv/dvdauthor/package.nix
index fd46701f54f0..099670aa2eec 100644
--- a/pkgs/by-name/dv/dvdauthor/package.nix
+++ b/pkgs/by-name/dv/dvdauthor/package.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
       url = "https://github.com/ldo/dvdauthor/commit/45705ece5ec5d7d6b9ab3e7a68194796a398e855.patch?full_index=1";
       hash = "sha256-tykCr2Axc1qhUvjlGyXQ6X+HwzuFTm5Va2gjGlOlSH0=";
     })
+    ./gettext-0.25.patch
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/ea/easyeffects/package.nix b/pkgs/by-name/ea/easyeffects/package.nix
index 9cc27b35d31a..49db81c475b9 100644
--- a/pkgs/by-name/ea/easyeffects/package.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@@ -48,13 +48,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "easyeffects";
-  version = "7.2.3";
+  version = "7.2.4";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     tag = "v${version}";
-    hash = "sha256-bTyPStOQusIho8x6RI+2Z+4wHSG9ERjo4NuvLUILIm8=";
+    hash = "sha256-C+zorQ7AFx72eOHUtjCHB2/1i1gnAoSMfEB+dWJIXHM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ej/ejsonkms/package.nix b/pkgs/by-name/ej/ejsonkms/package.nix
index 5ad750655827..13a7281cee88 100644
--- a/pkgs/by-name/ej/ejsonkms/package.nix
+++ b/pkgs/by-name/ej/ejsonkms/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "ejsonkms";
-  version = "0.2.5";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "envato";
     repo = "ejsonkms";
     rev = "v${version}";
-    hash = "sha256-EcNvzkZmSASe+0UMixBe8qwZq1JN3zFvppdWu1LM46A=";
+    hash = "sha256-G2rUcAjFSXnkRaQiu3WK5WRwNeQ0vyxj1Ql+vaRUUeM=";
   };
 
-  vendorHash = "sha256-LS+iCTpE7+vXa25CTudNHLPRYSod4ozuErnoYWB9LNU=";
+  vendorHash = "sha256-ulocGcRnkWBLnkoimkxrppO2i9lowFChlMYl0+kVXCo=";
 
   ldflags = [
     "-X main.version=v${version}"
diff --git a/pkgs/by-name/em/emmet-language-server/package.nix b/pkgs/by-name/em/emmet-language-server/package.nix
index dc2a8a8cff46..0a1c7bd9d69e 100644
--- a/pkgs/by-name/em/emmet-language-server/package.nix
+++ b/pkgs/by-name/em/emmet-language-server/package.nix
@@ -20,8 +20,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-hh5PEtmSHPs6QBgwWHS0laGU21e82JckIP3mB/P9/vE=";
     fetcherVersion = 1;
+    hash = "sha256-hh5PEtmSHPs6QBgwWHS0laGU21e82JckIP3mB/P9/vE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/en/en-croissant/package.nix b/pkgs/by-name/en/en-croissant/package.nix
index 86d89a85933e..a35536ad30f1 100644
--- a/pkgs/by-name/en/en-croissant/package.nix
+++ b/pkgs/by-name/en/en-croissant/package.nix
@@ -30,8 +30,8 @@ rustPlatform.buildRustPackage rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-hvWXSegUWJvwCU5NLb2vqnl+FIWpCLxw96s9NUIgJTI=";
     fetcherVersion = 1;
+    hash = "sha256-hvWXSegUWJvwCU5NLb2vqnl+FIWpCLxw96s9NUIgJTI=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/en/ente-web/package.nix b/pkgs/by-name/en/ente-web/package.nix
index 7ca8ac8b1adf..1e717dae7ab1 100644
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-web";
-  version = "1.1.53";
+  version = "1.1.57";
 
   src = fetchFromGitHub {
     owner = "ente-io";
@@ -20,13 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
     sparseCheckout = [ "web" ];
     tag = "photos-v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-LYFkqB44pS7WLa4HEnYrnRanh04P82ydsqiZYHNAshc=";
+    hash = "sha256-SCkxGm/w0kES7wDuLBsUTgwrFYNLvLD51NyioAVTLrg=";
   };
   sourceRoot = "${finalAttrs.src.name}/web";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-8uqKlqBnYTft3P7r1rQaEqn7ixj55yWnSLKTNi/0MZA=";
+    hash = "sha256-FnLMXOpIVNOhaM7VjNEDlwpew9T/5Ch5eFed9tLpDsI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/en/envoy-bin/package.nix b/pkgs/by-name/en/envoy-bin/package.nix
index d5d687e1fc73..f59a402b19ad 100644
--- a/pkgs/by-name/en/envoy-bin/package.nix
+++ b/pkgs/by-name/en/envoy-bin/package.nix
@@ -8,7 +8,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.34.1";
+  version = "1.34.2";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -21,8 +21,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-7v9KwHdQIF4dElsvTPxsJNnpxfLJk3TQ4tCgzwqsebs=";
-      x86_64-linux = "sha256-iCZNZRh2qa0oqn4Jjj34Q1cEBM9gts6WjESWykorbp0=";
+      aarch64-linux = "sha256-82jzPZ08FCuM2eABcqU/QTdxEipnnvNjb350ZSiUS0o=";
+      x86_64-linux = "sha256-B1tnshv5fIjIKjeSADSjBotakhUak3rM0NWt4kWoWhk=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/eq/equibop/package.nix b/pkgs/by-name/eq/equibop/package.nix
index 4da34c82565b..b52c61d53b76 100644
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -39,8 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-laTyxRh54x3iopGVgoFtcgaV7R6IKux1O/+tzGEy0Fg=";
     fetcherVersion = 1;
+    hash = "sha256-laTyxRh54x3iopGVgoFtcgaV7R6IKux1O/+tzGEy0Fg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/eq/equicord/package.nix b/pkgs/by-name/eq/equicord/package.nix
index e0c5734b2ad5..11bf8e6e4226 100644
--- a/pkgs/by-name/eq/equicord/package.nix
+++ b/pkgs/by-name/eq/equicord/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-fjfzBy1Z7AUKA53yjjCQ6yasHc5QMaOBtXtXA5fNK5s=";
     fetcherVersion = 1;
+    hash = "sha256-fjfzBy1Z7AUKA53yjjCQ6yasHc5QMaOBtXtXA5fNK5s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/er/erofs-utils/package.nix b/pkgs/by-name/er/erofs-utils/package.nix
index c89e8071a707..8b3d5c2a3a8c 100644
--- a/pkgs/by-name/er/erofs-utils/package.nix
+++ b/pkgs/by-name/er/erofs-utils/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "erofs-utils";
-  version = "1.8.9";
+  version = "1.8.10";
   outputs = [
     "out"
     "man"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${finalAttrs.version}.tar.gz";
-    hash = "sha256-FFpvf+SUGBTTAJnDVoRI03yBnM0DD8W/vKqyETTmF24=";
+    hash = "sha256-BetO3r4R3szm7LNOmNL4DIzSg8Lyln2Lp+/VhBhXBRQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/et/etherpad-lite/package.nix b/pkgs/by-name/et/etherpad-lite/package.nix
index cfccafa873c6..0d6e7dbb3e7e 100644
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -31,8 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-n7LolizpKng7zzccytYoCwJ7uGQbMagsgYPDuq0mdxU=";
     fetcherVersion = 1;
+    hash = "sha256-n7LolizpKng7zzccytYoCwJ7uGQbMagsgYPDuq0mdxU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 3b648c3d1614..b9e4c5d58803 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.204.5";
+  version = "0.205.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-kGn7O2OCvStez2eaT+h7EDBi96Q7dshK8X7DUD2SBOo=";
+    hash = "sha256-T97f5K4TDaAdqm2zU8+cEyq1YIzwy35tX8mb3pPkhIo=";
   };
 
-  vendorHash = "sha256-n67OSKpMhvgqftoVAqtABfcNgdRSbWjmJv7HSmv3Ev8=";
+  vendorHash = "sha256-gbTh9/Ny4JVCbpzz+opN92m6LQhPEBj/XuLLZ4M6tIc=";
 
   commonMeta = with lib; {
     license = licenses.mit;
@@ -52,7 +52,7 @@ buildGo124Module rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-HDokBgvRxmKkuQyGIqkX0Hy4Up+K25yYSRYAstE8mBY=";
+    hash = "sha256-OmiINzMCXbvceCDZ9zYTQKfWQ3iUgovMznmVoQkQ5DE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fa/fable/package.nix b/pkgs/by-name/fa/fable/package.nix
index 3cf318c5350e..e7765a80563a 100644
--- a/pkgs/by-name/fa/fable/package.nix
+++ b/pkgs/by-name/fa/fable/package.nix
@@ -6,9 +6,9 @@
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "fable";
-  version = "4.25.0";
+  version = "4.26.0";
 
-  nugetHash = "sha256-1T6cJKODI5Rm6Ze0f7X/Ecdrrn1NulKSnO3lMW73W0M=";
+  nugetHash = "sha256-nhIGVwu6kHTW+t0hiD1Pha3+ErE5xACBrVDgFP6qMnc=";
 
   passthru.tests = testers.testVersion {
     package = finalAttrs.finalPackage;
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index f1f48a86384f..764d08a7433d 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.231";
+  version = "1.4.247";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-V/ryS0EB8izLsU0ggmAkdq3oFnR2h16ZF1JTJT/GMwY=";
+    hash = "sha256-s1FlQIbHSCWUR9f3qWfYHOLYmG8GwJb3SAu6d9DAH1Q=";
   };
 
-  vendorHash = "sha256-g2nMyrmDkb14siqiAMcis1bRijTsJ2KDtaK3FHCofx0=";
+  vendorHash = "sha256-/3+4oeKl+GQPmYt3yBt77ATm55pALa+62mC6lktSTiw=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;
diff --git a/pkgs/by-name/fe/fedistar/package.nix b/pkgs/by-name/fe/fedistar/package.nix
index ad1b4f3cce96..ba8866e2da0a 100644
--- a/pkgs/by-name/fe/fedistar/package.nix
+++ b/pkgs/by-name/fe/fedistar/package.nix
@@ -38,8 +38,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
     fetcherVersion = 1;
+    hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index e84c9dcd3c8b..5e4eaa2bfdab 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -37,8 +37,8 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${src.name}/frontend";
-      hash = "sha256-vLOtVeGFeHXgQglvKsih4lj1uIs6wipwfo374viIq4I=";
       fetcherVersion = 1;
+      hash = "sha256-vLOtVeGFeHXgQglvKsih4lj1uIs6wipwfo374viIq4I=";
     };
 
     installPhase = ''
diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index 381408cd8e5d..3be092be7ca3 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "1.7.3";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CUotqHmVXKKkbAS4a7YWoVjs1GRhxrA5Y5rXtMx/mCo=";
+    hash = "sha256-2QjflXnusdqg63S1RgSbDsYHk9U4Xjf59wkvvo9n+Zo=";
   };
 
   buildInputs = [ php84 ];
@@ -38,12 +38,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-JN9HaX056+AhYkMyZ7KO7c6z43ynbRyORAOvW+6eVO8=";
+  vendorHash = "sha256-j0KjjmaDyFBFWnz6e4Bkrb3gkitfSKsj9UB2j/G19do=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-0vMxwm6NOdhCQcVeO93QNGB1BlqVckXzHkpCVvDB9ms=";
+    hash = "sha256-4bDSEGg5vGoam1PLRfaxJK0aQ+MLBTF+GP0AZQjHvVw=";
   };
 
   composerRepository = php84.mkComposerRepository {
diff --git a/pkgs/by-name/fi/firewalld/gettext-0.25.patch b/pkgs/by-name/fi/firewalld/gettext-0.25.patch
new file mode 100644
index 000000000000..0205e1914d52
--- /dev/null
+++ b/pkgs/by-name/fi/firewalld/gettext-0.25.patch
@@ -0,0 +1,14 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -152,8 +152,10 @@
+ AC_SUBST([GETTEXT_PACKAGE], '[PKG_NAME]')
+ AC_DEFINE_UNQUOTED([GETTEXT_PACKAGE], ["$GETTEXT_PACKAGE"],)
+ 
++AM_GNU_GETTEXT_VERSION([0.22.5])
++AM_GNU_GETTEXT([external])
++
+ IT_PROG_INTLTOOL([0.35.0], [no-xml])
+-AM_PO_SUBDIRS
+ 
+ AC_CONFIG_COMMANDS([xsl-cleanup],,[rm -f doc/xml/transform-*.xsl])
+ 
diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 51ee769c84ac..630b85bf35bf 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -57,6 +57,8 @@ stdenv.mkDerivation rec {
     ./add-config-path-env-var.patch
     ./respect-xml-catalog-files-var.patch
     ./specify-localedir.patch
+
+    ./gettext-0.25.patch
   ];
 
   postPatch =
diff --git a/pkgs/by-name/fi/firezone-gui-client/package.nix b/pkgs/by-name/fi/firezone-gui-client/package.nix
index d586e1f9cfc4..9a95968f46dc 100644
--- a/pkgs/by-name/fi/firezone-gui-client/package.nix
+++ b/pkgs/by-name/fi/firezone-gui-client/package.nix
@@ -40,8 +40,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit pname version;
       src = "${src}/rust/gui-client";
-      hash = "sha256-ttbTYBuUv0vyiYzrFATF4x/zngsRXjuLPfL3qW2HEe4=";
       fetcherVersion = 1;
+      hash = "sha256-ttbTYBuUv0vyiYzrFATF4x/zngsRXjuLPfL3qW2HEe4=";
     };
     pnpmRoot = "rust/gui-client";
 
diff --git a/pkgs/by-name/fi/firezone-server/package.nix b/pkgs/by-name/fi/firezone-server/package.nix
index 549c272590b8..d1f835531a88 100644
--- a/pkgs/by-name/fi/firezone-server/package.nix
+++ b/pkgs/by-name/fi/firezone-server/package.nix
@@ -34,8 +34,8 @@ beamPackages.mixRelease rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version;
     src = "${src}/apps/web/assets";
-    hash = "sha256-ejyBppFtKeyVhAWmssglbpLleOnbw9d4B+iM5Vtx47A=";
     fetcherVersion = 1;
+    hash = "sha256-ejyBppFtKeyVhAWmssglbpLleOnbw9d4B+iM5Vtx47A=";
   };
   pnpmRoot = "apps/web/assets";
 
diff --git a/pkgs/by-name/fl/flexget/package.nix b/pkgs/by-name/fl/flexget/package.nix
index eb7b0600efe2..c7c11a2396cb 100644
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.16.12";
+  version = "3.16.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${version}";
-    hash = "sha256-0JXJrW/3RKisrasxI1ina43GYwHcpqjbhb/OpaoIVyg=";
+    hash = "sha256-RtDb/irvZe/v4aXcn0Vfo3pa7alvLWtP3x3vwR4og5s=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/fl/flood/package.nix b/pkgs/by-name/fl/flood/package.nix
index 8d561a278e23..263a20088c4b 100644
--- a/pkgs/by-name/fl/flood/package.nix
+++ b/pkgs/by-name/fl/flood/package.nix
@@ -22,8 +22,8 @@ buildNpmPackage rec {
   npmDeps = pnpmDeps;
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-E2VxRcOMLvvCQb9gCAGcBTsly571zh/HWM6Q1Zd2eVw=";
     fetcherVersion = 1;
+    hash = "sha256-E2VxRcOMLvvCQb9gCAGcBTsly571zh/HWM6Q1Zd2eVw=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix b/pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix
index b734f677aa80..5106012acd4d 100644
--- a/pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix
+++ b/pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix
@@ -7,18 +7,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "flutter_rust_bridge_codegen";
-  version = "2.11.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "fzyzcjy";
     repo = "flutter_rust_bridge";
     rev = "v${version}";
-    hash = "sha256-vtdIbrVm9r8PiTYvhz4Ikj4e22jxqgEraH+YHlRS4O4=";
+    hash = "sha256-Us+LwT6tjBcTl2xclVsiLauSlIO8w+PiokpiDB+h1fI=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TwnibHjMDZ3aj1EDNHd/AO7nNtSnY335P3vU4iyp4SY=";
+  cargoHash = "sha256-pxEwcLiRB95UBfXb+JgS8duEXiZUApH/C8Exus5TkfU=";
   cargoBuildFlags = "--package flutter_rust_bridge_codegen";
   cargoTestFlags = "--package flutter_rust_bridge_codegen";
 
diff --git a/pkgs/by-name/fo/follow/package.nix b/pkgs/by-name/fo/follow/package.nix
index 2cbb1401ccb0..4d8459936084 100644
--- a/pkgs/by-name/fo/follow/package.nix
+++ b/pkgs/by-name/fo/follow/package.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-xNGLYzEz1G5sZSqmji+ItJ9D1vvZcwkkygnDeuypcIM=";
     fetcherVersion = 1;
+    hash = "sha256-xNGLYzEz1G5sZSqmji+ItJ9D1vvZcwkkygnDeuypcIM=";
   };
 
   env = {
diff --git a/pkgs/by-name/fr/freedv/no-framework.patch b/pkgs/by-name/fr/freedv/no-framework.patch
new file mode 100644
index 000000000000..01bb31e00bf5
--- /dev/null
+++ b/pkgs/by-name/fr/freedv/no-framework.patch
@@ -0,0 +1,28 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 38b3b262..3be9bfee 100644
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -146,21 +146,16 @@ if(APPLE)
+         TARGET FreeDV
+         POST_BUILD
+         COMMAND rm -rf dist_tmp FreeDV.dmg || true
+-        COMMAND DYLD_LIBRARY_PATH=${CODEC2_BUILD_DIR}/src:${portaudio_BINARY_DIR}:${samplerate_BINARY_DIR}/src:${Python3_ROOT_DIR}:${DYLD_LIBRARY_PATH} ${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler ARGS -od -b -x FreeDV.app/Contents/MacOS/FreeDV -d FreeDV.app/Contents/libs -p @loader_path/../libs/ -i /usr/lib -s ${CODEC2_BUILD_DIR}/src -s ${CMAKE_BINARY_DIR}/codec2_build/src ${PORTAUDIO_BUNDLE_ARG} -s ${samplerate_BINARY_DIR}/src -s ${rade_BINARY_DIR}/src -s ${Python3_ROOT_DIR}
++        COMMAND DYLD_LIBRARY_PATH=${CODEC2_BUILD_DIR}/src:${portaudio_BINARY_DIR}:${samplerate_BINARY_DIR}/src:${DYLD_LIBRARY_PATH} ${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler ARGS -od -b -x FreeDV.app/Contents/MacOS/FreeDV -d FreeDV.app/Contents/libs -p @loader_path/../libs/ -i /usr/lib -s ${CODEC2_BUILD_DIR}/src -s ${CMAKE_BINARY_DIR}/codec2_build/src ${PORTAUDIO_BUNDLE_ARG} -s ${samplerate_BINARY_DIR}/src -s ${rade_BINARY_DIR}/src
+         COMMAND cp ARGS ${CMAKE_CURRENT_SOURCE_DIR}/freedv.icns FreeDV.app/Contents/Resources
+         COMMAND rm ARGS -rf FreeDV.app/Contents/Frameworks
+         COMMAND mkdir ARGS FreeDV.app/Contents/Frameworks
+-        COMMAND cp ARGS -a ${Python3_ROOT_DIR}/../../../Python.framework FreeDV.app/Contents/Frameworks
+-        COMMAND install_name_tool ARGS -add_rpath @loader_path/../Frameworks/Python.framework FreeDV.app/Contents/libs/librade*.dylib
+         COMMAND cp ARGS ../rade_src/radae_*e.py FreeDV.app/Contents/Resources
+         COMMAND cp ARGS -a ../rade_src/radae FreeDV.app/Contents/Resources
+         COMMAND cp ARGS -a ../rade_src/model19_check3 FreeDV.app/Contents/Resources
+         
+-        # Precompile Python code to improve startup time
+-        COMMAND cd FreeDV.app/Contents/Resources && ../Frameworks/Python.framework/Versions/Current/bin/python3 -c "import radae_txe\; import radae_rxe\;" && cd ../../..
+-        
+         # Codesign binary so that it can execute
+-        COMMAND codesign --force --options runtime --timestamp --entitlements ${CMAKE_CURRENT_SOURCE_DIR}/entitlements.plist --sign ${MACOS_CODESIGN_IDENTITY} ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app `find ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app -name '*.so' -o -name '*.dylib'` `find ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/Frameworks/Python.framework/Versions/3.12/bin -name 'Python' -o -name 'python3.12*'` `find ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/Frameworks/Python.framework/ -name 'Python'` ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/MacOS/FreeDV ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/torch/bin/* ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app/Contents/Frameworks/Python.framework/Versions/3.12/Python
++        COMMAND codesign --force --options runtime --timestamp --entitlements ${CMAKE_CURRENT_SOURCE_DIR}/entitlements.plist --sign ${MACOS_CODESIGN_IDENTITY} ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app `find ${CMAKE_CURRENT_BINARY_DIR}/FreeDV.app -name '*.so' -o -name '*.dylib'`
+     )
+ 
+     if (MACOS_CODESIGN_KEYCHAIN_PROFILE)
diff --git a/pkgs/by-name/fr/freedv/package.nix b/pkgs/by-name/fr/freedv/package.nix
index ff04378f9f7e..bdff43aaef2f 100644
--- a/pkgs/by-name/fr/freedv/package.nix
+++ b/pkgs/by-name/fr/freedv/package.nix
@@ -1,9 +1,11 @@
 {
-  config,
   lib,
   stdenv,
   fetchFromGitHub,
   cmake,
+  pkg-config,
+  python3,
+  libopus,
   macdylibbundler,
   makeWrapper,
   darwin,
@@ -17,64 +19,115 @@
   hamlib_4,
   wxGTK32,
   sioclient,
-  pulseSupport ? config.pulseaudio or stdenv.hostPlatform.isLinux,
+  dbus,
+  apple-sdk_15,
   nix-update-script,
 }:
 
+let
+  radaeSrc = fetchFromGitHub {
+    owner = "drowe67";
+    repo = "radae";
+    rev = "2354cd2a4b3af60c7feb1c0d6b3d6dd7417c2ac9";
+    hash = "sha256-yEr/OCXV83qXi89QHXMrUtQ2UwNOsijQMN35Or2JP+Y=";
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freedv";
-  version = "1.9.9.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oFuAH81mduiSQGIDgDDy1IPskqqCBmfWbpqQstUIw9g=";
+    hash = "sha256-3vwFB+3LloumEAGlSJZc2+/I8uI6KLP/KuDGeDOj87k=";
   };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "-Wl,-ld_classic" ""
-    substituteInPlace src/CMakeLists.txt \
-      --replace-fail "\''${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler" "dylibbundler"
-    sed -i "/codesign/d;/hdiutil/d" src/CMakeLists.txt
-  '';
+  patches = [
+    ./no-framework.patch
+  ];
+
+  postPatch =
+    ''
+      cp -R ${radaeSrc} radae
+      chmod -R u+w radae
+      substituteInPlace radae/cmake/BuildOpus.cmake \
+        --replace-fail "https://gitlab.xiph.org/xiph/opus/-/archive/main/opus-main.tar.gz" "${libopus.src}" \
+        --replace-fail "./autogen.sh && " ""
+      substituteInPlace cmake/BuildRADE.cmake \
+        --replace-fail "GIT_REPOSITORY https://github.com/drowe67/radae.git" "URL $(realpath radae)" \
+        --replace-fail "GIT_TAG main" ""
+      patchShebangs test/test_*.sh
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail "-Wl,-ld_classic" ""
+      substituteInPlace src/CMakeLists.txt \
+        --replace-fail "\''${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler" "dylibbundler"
+      sed -i "/codesign/d;/hdiutil/d" src/CMakeLists.txt
+    '';
 
   nativeBuildInputs =
     [
       cmake
+      pkg-config
+      python3
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       macdylibbundler
       makeWrapper
       darwin.autoSignDarwinBinariesHook
+      darwin.sigtool
     ];
 
-  buildInputs = [
-    codec2
-    libsamplerate
-    libsndfile
-    lpcnet
-    speexdsp
-    hamlib_4
-    wxGTK32
-    sioclient
-  ] ++ (if pulseSupport then [ libpulseaudio ] else [ portaudio ]);
+  buildInputs =
+    [
+      codec2
+      libsamplerate
+      libsndfile
+      lpcnet
+      speexdsp
+      hamlib_4
+      wxGTK32
+      sioclient
+      python3.pkgs.numpy
+    ]
+    ++ (
+      if stdenv.hostPlatform.isLinux then
+        [
+          libpulseaudio
+          dbus
+        ]
+      else if stdenv.hostPlatform.isDarwin then
+        [
+          apple-sdk_15
+        ]
+      else
+        [
+          portaudio
+        ]
+    );
 
   cmakeFlags = [
     (lib.cmakeBool "USE_INTERNAL_CODEC2" false)
     (lib.cmakeBool "USE_STATIC_DEPS" false)
     (lib.cmakeBool "UNITTEST" true)
-    (lib.cmakeBool "USE_PULSEAUDIO" pulseSupport)
+    (lib.cmakeBool "USE_NATIVE_AUDIO" (with stdenv.hostPlatform; isLinux || isDarwin))
   ];
 
-  doCheck = true;
+  env.NIX_CFLAGS_COMPILE = "-I${codec2.src}/src";
 
-  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/Applications
-    mv $out/bin/FreeDV.app $out/Applications
-    makeWrapper $out/Applications/FreeDV.app/Contents/MacOS/FreeDV $out/bin/freedv
-  '';
+  doCheck = false;
+
+  postInstall =
+    ''
+      install -Dm755 rade_build/src/librade.* -t $out/lib
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/Applications
+      mv $out/bin/FreeDV.app $out/Applications
+      makeWrapper $out/Applications/FreeDV.app/Contents/MacOS/FreeDV $out/bin/freedv
+    '';
 
   passthru.updateScript = nix-update-script {
     extraArgs = [
diff --git a/pkgs/by-name/fr/freetds/gettext-0.25.patch b/pkgs/by-name/fr/freetds/gettext-0.25.patch
new file mode 100644
index 000000000000..d584ad9aefb6
--- /dev/null
+++ b/pkgs/by-name/fr/freetds/gettext-0.25.patch
@@ -0,0 +1,13 @@
+diff --git i/configure.ac w/configure.ac
+index bb07bba1..c4e15d53 100644
+--- i/configure.ac
++++ w/configure.ac
+@@ -20,6 +20,8 @@ AM_INIT_AUTOMAKE([dist-bzip2 parallel-tests subdir-objects foreign])
+ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES(yes)])
+ AC_CONFIG_HEADERS(include/config.h)
+ AC_CONFIG_MACRO_DIR([m4])
++AM_GNU_GETTEXT_VERSION([0.25])
++AM_GNU_GETTEXT([external])
+ 
+ dnl configuration directory will be /usr/local/etc
+ AC_PREFIX_DEFAULT(/usr/local)
diff --git a/pkgs/by-name/fr/freetds/package.nix b/pkgs/by-name/fr/freetds/package.nix
index 5c0e0e7d11fe..9a01adc25221 100644
--- a/pkgs/by-name/fr/freetds/package.nix
+++ b/pkgs/by-name/fr/freetds/package.nix
@@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-XLZsRqYKg7iihV5GYUi2+ieWLH/R3LP25dCrF+xf9t0=";
   };
 
+  patches = [
+    ./gettext-0.25.patch
+  ];
+
   buildInputs = [
     openssl
   ] ++ lib.optional odbcSupport unixODBC;
diff --git a/pkgs/by-name/fr/frida-tools/package.nix b/pkgs/by-name/fr/frida-tools/package.nix
index c55458108dd0..4f56d016ce93 100644
--- a/pkgs/by-name/fr/frida-tools/package.nix
+++ b/pkgs/by-name/fr/frida-tools/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "frida-tools";
-  version = "14.4.0";
+  version = "14.4.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ACiznCkOZvnPUSB+Xcs4IZfbPGyknr193gLok0FrzqA=";
+    hash = "sha256-Zb6Pk6c7QbJLsb4twhdVgaUWtxCy/Vff5PKIno9B/b4=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/fr/frigate/package.nix b/pkgs/by-name/fr/frigate/package.nix
index 8e7178f285b0..5b8024232b6c 100644
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -12,14 +12,14 @@
 }:
 
 let
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     name = "frigate-${version}-source";
     owner = "blakeblackshear";
     repo = "frigate";
     tag = "v${version}";
-    hash = "sha256-rnsc2VXaypIPVtYQHTGe9lg7PuAyjfjz4aeATmFzp5s=";
+    hash = "sha256-YJFtMVCTtp8h9a9RmkcoZSQ+nIKb5o/4JVynVslkx78=";
   };
 
   frigate-web = callPackage ./web.nix {
diff --git a/pkgs/by-name/fr/froide/package.nix b/pkgs/by-name/fr/froide/package.nix
index b602b385a771..0219d4da8462 100644
--- a/pkgs/by-name/fr/froide/package.nix
+++ b/pkgs/by-name/fr/froide/package.nix
@@ -118,8 +118,8 @@ python.pkgs.buildPythonApplication rec {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-g7YX2fVXGmb3Qq9NNCb294bk4/0khcIZVSskYbE8Mdw=";
     fetcherVersion = 1;
+    hash = "sha256-g7YX2fVXGmb3Qq9NNCb294bk4/0khcIZVSskYbE8Mdw=";
   };
 
   postBuild = ''
diff --git a/pkgs/by-name/fs/fsautocomplete/deps.json b/pkgs/by-name/fs/fsautocomplete/deps.json
index bc3a9e23a5c2..104e36eb51c2 100644
--- a/pkgs/by-name/fs/fsautocomplete/deps.json
+++ b/pkgs/by-name/fs/fsautocomplete/deps.json
@@ -76,8 +76,8 @@
   },
   {
     "pname": "fsharp-analyzers",
-    "version": "0.31.0",
-    "hash": "sha256-PoAvaXbXsmvVw870UsnqdD20HoBHO7u4bzoaz5DXfzM="
+    "version": "0.32.0",
+    "hash": "sha256-MnhsK5tOeexL6uQhsV4nTRz8CGbz2o8VyHwAK8x91pE="
   },
   {
     "pname": "FSharp.Analyzers.Build",
@@ -86,8 +86,8 @@
   },
   {
     "pname": "FSharp.Analyzers.SDK",
-    "version": "0.31.0",
-    "hash": "sha256-ws2nu1EyEESFqui/3l4+ucATy0Ag/XjjPvLZprcbC5c="
+    "version": "0.32.0",
+    "hash": "sha256-0mdnqvE4ltEfehzS+ylah5MSy+sXbYrKRHrNDlWvIjg="
   },
   {
     "pname": "FSharp.Compiler.Service",
@@ -206,8 +206,8 @@
   },
   {
     "pname": "Ionide.Analyzers",
-    "version": "0.14.5",
-    "hash": "sha256-0bJGA3+8+FC3C6e1l4j0mrRO2uujQOf2C3Qa+JxkH3o="
+    "version": "0.14.6",
+    "hash": "sha256-56FJUeWvxE2xbaX/qhfCN6ksiNWz7aGQySEskOnzFB0="
   },
   {
     "pname": "Ionide.KeepAChangelog.Tasks",
diff --git a/pkgs/by-name/fs/fsautocomplete/package.nix b/pkgs/by-name/fs/fsautocomplete/package.nix
index 1729a1388f1c..ae6a2172f084 100644
--- a/pkgs/by-name/fs/fsautocomplete/package.nix
+++ b/pkgs/by-name/fs/fsautocomplete/package.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "fsautocomplete";
-  version = "0.78.3";
+  version = "0.78.4";
 
   src = fetchFromGitHub {
     owner = "fsharp";
     repo = "FsAutoComplete";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZY0sRRGTazaesHyqUe5C/l8xmo+teTS34KVXd0DnO84=";
+    hash = "sha256-SBNtVtPVQ+l0U+jsvSiJVdS6TR4+wZ8rScFrRKWJSX8=";
   };
 
   nugetDeps = ./deps.json;
diff --git a/pkgs/by-name/g-/g-ls/package.nix b/pkgs/by-name/g-/g-ls/package.nix
index bea5ed3e1b43..77a3664dd896 100644
--- a/pkgs/by-name/g-/g-ls/package.nix
+++ b/pkgs/by-name/g-/g-ls/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "g-ls";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "Equationzhao";
     repo = "g";
     tag = "v${version}";
-    hash = "sha256-OaYWorybwUxG452b0vEKwryxmRaNTQ5xDWe9GmEWuGE=";
+    hash = "sha256-cHB9oW4vF00hvhZ7KNY5TUjIjLjEoiJb/psMSq+kSHU=";
   };
 
-  vendorHash = "sha256-E/4iB1apLCOEtijCZymObz0Zjlf0+dQC37ALSbl1tr0=";
+  vendorHash = "sha256-5ksa0AJ7JbQPzBypDDMUvnXtIeXNEm9zKL5JetHWnrs=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gh/gh-f/package.nix b/pkgs/by-name/gh/gh-f/package.nix
index c479a1f875d5..d90ede5caa7e 100644
--- a/pkgs/by-name/gh/gh-f/package.nix
+++ b/pkgs/by-name/gh/gh-f/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "gh-f";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "gennaro-tedesco";
     repo = "gh-f";
     rev = "v${version}";
-    hash = "sha256-62FVFW2KLdH0uonIf3OVBFMGLcCteMjydaLAjWtxwUo=";
+    hash = "sha256-CW6iAI5IomJoMuPBFq/3owhZJbcruKtOqoxzsh+FNVw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gifski/package.nix b/pkgs/by-name/gi/gifski/package.nix
index eb0ee73c73a9..ca5991392321 100644
--- a/pkgs/by-name/gi/gifski/package.nix
+++ b/pkgs/by-name/gi/gifski/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gifski";
-  version = "1.33.0";
+  version = "1.34.0";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = "gifski";
     rev = version;
-    hash = "sha256-IjQ2PqjXhNvXknVxfphSSwQEWBuTkSxMFrbwd2trlVI=";
+    hash = "sha256-8EAC8YH3AIbvYdTL7HtqTL7WqztzCwvDwIVkhiqvtrQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-2A7SDu9f7Tf74SAD72gCQ00Ccp3r2MaPo0qjVe3nR5s=";
+  cargoHash = "sha256-ZppSO3TyZBbNhG+YW71+C9kMu7ok2+kbnnCRbAKsbfs=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/gi/git-team/package.nix b/pkgs/by-name/gi/git-team/package.nix
index 081c8dc5e71d..6fb27115e1a4 100644
--- a/pkgs/by-name/gi/git-team/package.nix
+++ b/pkgs/by-name/gi/git-team/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  go-mockery,
+  go-mockery_2,
   installShellFiles,
 }:
 
@@ -20,7 +20,7 @@ buildGoModule rec {
   vendorHash = "sha256-NTOUL1oE2IhgLyYYHwRCMW5yCxIRxUwqkfuhSSBXf6A=";
 
   nativeBuildInputs = [
-    go-mockery
+    go-mockery_2
     installShellFiles
   ];
 
diff --git a/pkgs/by-name/gi/gitbutler/package.nix b/pkgs/by-name/gi/gitbutler/package.nix
index b6741c04df1e..ba50b5ef3b25 100644
--- a/pkgs/by-name/gi/gitbutler/package.nix
+++ b/pkgs/by-name/gi/gitbutler/package.nix
@@ -64,8 +64,8 @@ rustPlatform.buildRustPackage rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-5NtfstUuIYyntt09Mu9GAFAOImfO6VMmJ7g15kvGaLE=";
     fetcherVersion = 1;
+    hash = "sha256-5NtfstUuIYyntt09Mu9GAFAOImfO6VMmJ7g15kvGaLE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gitea-actions-runner/package.nix b/pkgs/by-name/gi/gitea-actions-runner/package.nix
index 6b2300e74186..08338d917e2d 100644
--- a/pkgs/by-name/gi/gitea-actions-runner/package.nix
+++ b/pkgs/by-name/gi/gitea-actions-runner/package.nix
@@ -1,42 +1,42 @@
 {
   lib,
   fetchFromGitea,
-  buildGo123Module,
+  buildGoModule,
   testers,
   gitea-actions-runner,
 }:
 
-buildGo123Module rec {
+buildGoModule (finalAttrs: {
   pname = "gitea-actions-runner";
-  version = "0.2.11";
+  version = "0.2.12";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "act_runner";
-    rev = "v${version}";
-    hash = "sha256-PmDa8XIe1uZ4SSrs9zh5HBmFaOuj+uuLm7jJ4O5V1dI=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-z/wEs110Y2IZ2Jm6bayxlD2sjyl2V/v+gP6l9pwGi5o=";
   };
 
-  vendorHash = "sha256-lYJFySGqkhT89vHDp1FcTiiC7DG4ziQ1DaBHLh/kXQc=";
+  vendorHash = "sha256-HuiL6OLShSeGtHb4dOeOFOpOgl55s3x18uYgM4X8G7M=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=v${version}"
+    "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=v${finalAttrs.version}"
   ];
 
   passthru.tests.version = testers.testVersion {
     package = gitea-actions-runner;
-    version = "v${version}";
+    version = "v${finalAttrs.version}";
   };
 
   meta = {
     mainProgram = "act_runner";
     maintainers = with lib.maintainers; [ techknowlogick ];
     license = lib.licenses.mit;
-    changelog = "https://gitea.com/gitea/act_runner/releases/tag/v${version}";
+    changelog = "https://gitea.com/gitea/act_runner/releases/tag/v${finalAttrs.version}";
     homepage = "https://gitea.com/gitea/act_runner";
     description = "Runner for Gitea based on act";
   };
-}
+})
diff --git a/pkgs/by-name/gi/gitify/package.nix b/pkgs/by-name/gi/gitify/package.nix
index 48333f8312e1..6347600790f3 100644
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -33,8 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-eIvqZ9a+foYH+jXuqGz1m/4C+0Xq8mTvm7ZajKeOw58=";
     fetcherVersion = 1;
+    hash = "sha256-eIvqZ9a+foYH+jXuqGz1m/4C+0Xq8mTvm7ZajKeOw58=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
diff --git a/pkgs/by-name/gi/gitkraken/package.nix b/pkgs/by-name/gi/gitkraken/package.nix
index 6465e144acf9..48688fa884e5 100644
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,24 +56,24 @@
 
 let
   pname = "gitkraken";
-  version = "11.2.0";
+  version = "11.2.1";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-yCAxNYwjnmK0lSkH9x8Q4KoQgAWwWmCS8O81tcsqWhs=";
+      hash = "sha256-nxYWcw8A/lIVyjiUJOmcjmTblbxiLSxMUjo7KnlAMzs=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-q3sy2VxgccA/9UaX08NcNusibXYNPFzZcaNlVi2eN9E=";
+      hash = "sha256-7I3yAEarGGhFs/PvcqvoDx8MbJ/zEuNN/s0o357M1vc=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-6SxuOgfWMpaYYES+9QBwYJ4t+Go43Af0cwzs/tPVOts=";
+      hash = "sha256-pDPdi+cRMqhxu/84u6ojxteIi1VHfN3qy/NTruHVt8U=";
     };
   };
 
diff --git a/pkgs/by-name/go/go-dnscollector/package.nix b/pkgs/by-name/go/go-dnscollector/package.nix
index cc428c1fdae0..08622db92926 100644
--- a/pkgs/by-name/go/go-dnscollector/package.nix
+++ b/pkgs/by-name/go/go-dnscollector/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-dnscollector";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "go-dnscollector";
     rev = "v${version}";
-    sha256 = "sha256-q12hMnSqA/KCkmiqsmBpvDmyHtuEWhMBTKwOOyw3Wfs=";
+    sha256 = "sha256-ebl/edMN45oLV1pN6mCaOSgxSSyAugsBP2sQWbIiPTI=";
   };
 
-  vendorHash = "sha256-TtlOwmNyO2/eQCajPBu6Pgdbuk4gacpgtcnr1vZgZdg=";
+  vendorHash = "sha256-Y0LOtyRJWOFAQwfg8roisSer0oCxPiaYICE1FY/SEF8=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/go/go-mockery/package.nix b/pkgs/by-name/go/go-mockery/package.nix
index 99cd99afeaaa..ecc0dddaf54e 100644
--- a/pkgs/by-name/go/go-mockery/package.nix
+++ b/pkgs/by-name/go/go-mockery/package.nix
@@ -1,80 +1,72 @@
 {
   lib,
-  buildGoModule, # sync with go below, update to latest release
+  stdenv,
+  buildGoModule,
   fetchFromGitHub,
-
-  # passthru test
-  go-mockery,
-  runCommand,
-  go,
+  versionCheckHook,
+  go-task,
+  gotestsum,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "go-mockery";
-  version = "2.53.3";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
-    rev = "v${version}";
-    sha256 = "sha256-X0cHpv4o6pzgjg7+ULCuFkspeff95WFtJbVHqy4LxAg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qcK0FXtAL7kJ+dotthmnMcGa9wu97UsDKBoKy5lD2W4=";
   };
 
+  proxyVendor = true;
+  vendorHash = "sha256-Xy2w61ATNDOZKtdekeA9NSdyJq2/eiEZ9iJ3PDSUm9Q=";
+
   ldflags = [
     "-s"
     "-w"
-    "-X"
-    "github.com/vektra/mockery/v${lib.versions.major version}/pkg/logging.SemVer=v${version}"
+    "-X github.com/vektra/mockery/v${lib.versions.major finalAttrs.version}/internal/logging.SemVer=v${finalAttrs.version}"
   ];
 
   env.CGO_ENABLED = false;
 
-  proxyVendor = true;
-  vendorHash = "sha256-AQY4x2bLqMwHIjoKHzEm1hebR29gRs3LJN8i00Uup5o=";
-
   subPackages = [ "." ];
 
-  preCheck = ''
-    # check all paths
-    unset subPackages
+  nativeCheckInputs = [
+    versionCheckHook
+    go-task
+    gotestsum
+  ];
 
-    substituteInPlace ./pkg/generator_test.go --replace-fail 0.0.0-dev ${version}
-    substituteInPlace ./pkg/logging/logging_test.go --replace-fail v0.0 v${lib.versions.majorMinor version}
+  prePatch = ''
+    # remove test.ci's dependency on lint since we don't need it and
+    # it tries to use remote golangci-lint
+    substituteInPlace Taskfile.yml \
+      --replace-fail "deps: [lint]" "" \
+      --replace-fail "go run gotest.tools/gotestsum" "gotestsum"
+
+    # patch scripts used in e2e testing
+    patchShebangs e2e
   '';
 
-  passthru.tests = {
-    generateMock =
-      runCommand "${pname}-test"
-        {
-          nativeBuildInputs = [ go-mockery ];
-          buildInputs = [ go ];
-        }
-        ''
-          if [[ $(${meta.mainProgram} --version) != *"${version}"* ]]; then
-            echo "Error: program version does not match package version"
-            exit 1
-          fi
+  checkPhase = ''
+    runHook preCheck
 
-          export HOME=$TMPDIR
+    ${
+      # TestRemoteTemplates/schema_validation_OK fails only on x86_64-darwin
+      (lib.optionalString (
+        stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86
+      ) "rm -rf e2e/test_remote_templates/")
+    }
+    # run unit tests and e2e tests plus pre-gen necessary mocks
+    task test.ci
 
-          cat <<EOF > foo.go
-          package main
+    runHook postCheck
+  '';
 
-          type Foo interface {
-            Bark() string
-          }
-          EOF
-
-          ${meta.mainProgram} --name Foo --dir .
-
-          if [[ ! -f "mocks/Foo.go" ]]; then
-            echo "Error: mocks/Foo.go was not generated by ${pname}"
-            exit 1
-          fi
-
-          touch $out
-        '';
-  };
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/mockery";
+  versionCheckProgramArg = "version";
 
   meta = {
     homepage = "https://github.com/vektra/mockery";
@@ -86,4 +78,4 @@ buildGoModule rec {
     mainProgram = "mockery";
     license = lib.licenses.bsd3;
   };
-}
+})
diff --git a/pkgs/by-name/go/go-mockery_2/package.nix b/pkgs/by-name/go/go-mockery_2/package.nix
new file mode 100644
index 000000000000..09243bb05618
--- /dev/null
+++ b/pkgs/by-name/go/go-mockery_2/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  go-task,
+  gotestsum,
+  getent,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "go-mockery_2";
+  # supported upstream until 2029-12-31
+  # https://vektra.github.io/mockery/latest/v3/#v2-support-lifecycle
+  version = "2.53.3";
+
+  src = fetchFromGitHub {
+    owner = "vektra";
+    repo = "mockery";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-X0cHpv4o6pzgjg7+ULCuFkspeff95WFtJbVHqy4LxAg=";
+  };
+
+  proxyVendor = true;
+  vendorHash = "sha256-AQY4x2bLqMwHIjoKHzEm1hebR29gRs3LJN8i00Uup5o=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/vektra/mockery/v${lib.versions.major finalAttrs.version}/pkg/logging.SemVer=v${finalAttrs.version}"
+  ];
+
+  env.CGO_ENABLED = false;
+
+  subPackages = [ "." ];
+
+  nativeCheckInputs = [
+    versionCheckHook
+  ];
+
+  meta = {
+    homepage = "https://github.com/vektra/mockery";
+    description = "Mock code autogenerator for Golang - v2";
+    maintainers = with lib.maintainers; [
+      fbrs
+      jk
+    ];
+    mainProgram = "mockery";
+    license = lib.licenses.bsd3;
+  };
+})
diff --git a/pkgs/by-name/go/goctl/package.nix b/pkgs/by-name/go/goctl/package.nix
index 2b3ad122f511..7eb8e461ef5a 100644
--- a/pkgs/by-name/go/goctl/package.nix
+++ b/pkgs/by-name/go/goctl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "goctl";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "zeromicro";
     repo = "go-zero";
     tag = "v${version}";
-    hash = "sha256-N0U/8YbqhyD5kb14lq8JKWwfYHUZ57Z/KZyIf6kKl0U=";
+    hash = "sha256-12nlrwzzM5wPyiC3vJfs7sJ7kPiRy1H0gTeWB+9bqKI=";
   };
 
-  vendorHash = "sha256-D56zTwn4y03eaP2yP8Q2F6ixGMaQJwKEqonHNJGp2Ec=";
+  vendorHash = "sha256-ReLXN4SUNQ7X0yHy8FFwD8lRRm05q2FdEdohXpfuZIY=";
 
   modRoot = "tools/goctl";
   subPackages = [ "." ];
diff --git a/pkgs/by-name/go/gollama/package.nix b/pkgs/by-name/go/gollama/package.nix
index ab08580ed1bc..5ebd9917b0b0 100644
--- a/pkgs/by-name/go/gollama/package.nix
+++ b/pkgs/by-name/go/gollama/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gollama";
-  version = "v1.34.0";
+  version = "v1.34.1";
 
   src = fetchFromGitHub {
     owner = "sammcj";
     repo = "gollama";
     tag = "v${version}";
-    hash = "sha256-gWEm5aUVq2yfxuZ6GxITiAAsn5gj1HR9I7seyRX8DoA=";
+    hash = "sha256-Zysy8UTpUzIb4ekg9tAg5Wj7LRIIw8axENYqK8z2TdY=";
   };
 
   vendorHash = "sha256-7e1wM2FDaQGAIhb0gERy/RgJupra1B52SgTV0EHD570=";
diff --git a/pkgs/by-name/go/goofcord/package.nix b/pkgs/by-name/go/goofcord/package.nix
index 168a77c346a7..7e238de22f17 100644
--- a/pkgs/by-name/go/goofcord/package.nix
+++ b/pkgs/by-name/go/goofcord/package.nix
@@ -42,8 +42,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm'.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-8dSyU9arSvISc2kDWbg/CP6L4sZjZi/Zv7TZN4ONOjQ=";
     fetcherVersion = 1;
+    hash = "sha256-8dSyU9arSvISc2kDWbg/CP6L4sZjZi/Zv7TZN4ONOjQ=";
   };
 
   env = {
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 6b997ece78f5..27dd1eab9d8c 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -171,11 +171,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "138.0.7204.92";
+    version = "138.0.7204.100";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-9HaUIvJEw6PqinEnpam/Dh5+6XPJ2ou+j8Jfhc7nd/E=";
+      hash = "sha256-H22aDTMvbUsbBWasGjCP1dUKmYzD9/6TIzfBpahAnA8=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -276,11 +276,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "138.0.7204.93";
+    version = "138.0.7204.101";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/k3cs4pgesvh4zq3jml7x52esia_138.0.7204.93/GoogleChrome-138.0.7204.93.dmg";
-      hash = "sha256-IEcwjrtNMMSjwNCrINjXRbnSI0Uf2JKtA+KwvQc5Fhc=";
+      url = "http://dl.google.com/release2/chrome/h7v73czgelyzwk2xfcs2gkpkwm_138.0.7204.101/GoogleChrome-138.0.7204.101.dmg";
+      hash = "sha256-gG20H5QsVmnfRi+Zo+OiLTLlPP2cLp6W+JaJoRE0QtI=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/go/goperf/package.nix b/pkgs/by-name/go/goperf/package.nix
index 0e45df953fb5..a4de4af4c403 100644
--- a/pkgs/by-name/go/goperf/package.nix
+++ b/pkgs/by-name/go/goperf/package.nix
@@ -9,15 +9,15 @@
 
 buildGoModule rec {
   pname = "goperf";
-  version = "0-unstable-2025-06-05";
+  version = "0-unstable-2025-07-10";
 
   src = fetchgit {
     url = "https://go.googlesource.com/perf";
-    rev = "b481878a17bef398145703a878ff39e5bedae345";
-    hash = "sha256-jaMJhBf6uE7pKhGYU5RiHl2DpOBhZLqmZvIYZuYFGP4=";
+    rev = "7b7c2de18447122afb45241f2ca525b4dd19df7b";
+    hash = "sha256-WUoInX/Wuq5TnDcCJWnPQtdX+2dIAFKTQdBDZyw8Z9Q=";
   };
 
-  vendorHash = "sha256-r0GYVYgBoTE5Dpma5xqp7llBF9+QDgD/PfL+P01LImA=";
+  vendorHash = "sha256-wAHri6Tj+vDJ0vCvRngK+mdXG5tU5WVeni54gA26nDQ=";
 
   passthru.updateScript = writeShellScript "update-goperf" ''
     export UPDATE_NIX_ATTR_PATH=goperf
diff --git a/pkgs/by-name/gr/greaseweazle/package.nix b/pkgs/by-name/gr/greaseweazle/package.nix
new file mode 100644
index 000000000000..915d5910de06
--- /dev/null
+++ b/pkgs/by-name/gr/greaseweazle/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "greaseweazle";
+  version = "1.22";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "keirf";
+    repo = "greaseweazle";
+    rev = "v${version}";
+    hash = "sha256-Ki4OvtcFn5DH87OCWY7xN9fRhGxlzS9QIuQCJxPWJco=";
+  };
+
+  build-system = with python3.pkgs; [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = with python3.pkgs; [
+    crcmod
+    bitarray
+    pyserial
+    requests
+  ];
+
+  pythonImportsCheck = [
+    "greaseweazle"
+  ];
+
+  meta = {
+    description = "Tools for accessing a floppy drive at the raw flux level";
+    homepage = "https://github.com/keirf/greaseweazle";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "greaseweazle";
+  };
+}
diff --git a/pkgs/by-name/gr/grml-zsh-config/package.nix b/pkgs/by-name/gr/grml-zsh-config/package.nix
index 4d39810fd783..0553e99b92e9 100644
--- a/pkgs/by-name/gr/grml-zsh-config/package.nix
+++ b/pkgs/by-name/gr/grml-zsh-config/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "grml-zsh-config";
-  version = "0.19.21";
+  version = "0.19.23";
 
   src = fetchFromGitHub {
     owner = "grml";
     repo = "grml-etc-core";
     rev = "v${version}";
-    sha256 = "sha256-OazsDuIMFnyJrmd4Idt6ciV0huC9QmtcqBxEVD4nf6g=";
+    sha256 = "sha256-kaVDX+f2WeRjrpyW5pKkamNIKemdUq+1AU+8W+0vAx8=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/gu/gui-for-clash/package.nix b/pkgs/by-name/gu/gui-for-clash/package.nix
index 0831f4c4d86f..a62b2a436281 100644
--- a/pkgs/by-name/gu/gui-for-clash/package.nix
+++ b/pkgs/by-name/gu/gui-for-clash/package.nix
@@ -43,8 +43,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
-      hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
       fetcherVersion = 1;
+      hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
diff --git a/pkgs/by-name/gu/gui-for-singbox/package.nix b/pkgs/by-name/gu/gui-for-singbox/package.nix
index fae5157c6005..9dcde1a8f007 100644
--- a/pkgs/by-name/gu/gui-for-singbox/package.nix
+++ b/pkgs/by-name/gu/gui-for-singbox/package.nix
@@ -45,8 +45,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
-      hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
       fetcherVersion = 1;
+      hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index d2a694d0285c..ef8fabdf6e59 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.21.2";
+  version = "2.21.3";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-XYzk989eaOXU81EWUbwhLl6Fy30dbLhn4/x2wJ4I4ac=";
+    hash = "sha256-l5tD9QIQfuRXG6hxP2ensb3SeX/A7F/xx694rQKUUrI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/he/helix/package.nix b/pkgs/by-name/he/helix/package.nix
index f5f9cc80a68a..09f89cd3a8f0 100644
--- a/pkgs/by-name/he/helix/package.nix
+++ b/pkgs/by-name/he/helix/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "helix";
-  version = "25.01.1";
+  version = "25.07";
 
   # This release tarball includes source code for the tree-sitter grammars,
   # which is not ordinarily part of the repository.
   src = fetchzip {
     url = "https://github.com/helix-editor/helix/releases/download/${version}/helix-${version}-source.tar.xz";
-    hash = "sha256-rN2eK+AoyDH+tL3yxTRQQQYHf0PoYK84FgrRwm/Wfjk=";
+    hash = "sha256-UbvIbrDNUmcAvqVM98CPlBhjAc5BAyIUpp9+BXGmdfA=";
     stripRoot = false;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-JZwURUMUnwc3tzAsN7NJCE8106c/4VgZtHHA3e/BsXs=";
+  cargoHash = "sha256-++zslB4s5/TOjxqeOFZAsYUu7acPxQw/xMnlYgTf5GU=";
 
   nativeBuildInputs = [
     git
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index d5dca60dbe20..466de55844c3 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -33,8 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-9WCIdQ91IU8pfq6kpbmmn6APBTNwpCi9ovgRuWYUad8=";
     fetcherVersion = 1;
+    hash = "sha256-9WCIdQ91IU8pfq6kpbmmn6APBTNwpCi9ovgRuWYUad8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index cb9fb8de7f4b..e810da871057 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.6.13";
+  version = "3.6.14";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/release-${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-rqfesqt3yYDU6koDLFbE9FJpA6iNzDTNG6lWGA2bBYo=";
+    hash = "sha256-8AviAYAMm74uJeMvgESPNHbT5b91mDTxDgLYh+8VHb8=";
   };
 
   icon = fetchurl {
diff --git a/pkgs/by-name/ho/holo-daemon/package.nix b/pkgs/by-name/ho/holo-daemon/package.nix
index c704a02c5e59..c71f737c54f8 100644
--- a/pkgs/by-name/ho/holo-daemon/package.nix
+++ b/pkgs/by-name/ho/holo-daemon/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "holo-daemon";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "holo-routing";
     repo = "holo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wASY+binAflxaXjKdSfUXS8jgdEHjdIF3AOzjN/a1Fo=";
+    hash = "sha256-8cScq/6e9u3rDilnjT6mAbEudXybNj3YUicYiEgoCyE=";
   };
 
   passthru.updateScript = nix-update-script { };
 
-  cargoHash = "sha256-5X6a86V3Y9+KK0kGbS/ovelqXyLv15gQRFI7GhiYBjY=";
+  cargoHash = "sha256-YZ2c6W6CCqgyN+6i7Vh5fWLKw8L4pUqvq/tDO/Q/kf0=";
 
   # Use rust nightly features
   RUSTC_BOOTSTRAP = 1;
@@ -36,19 +36,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pcre2
   ];
 
-  # Might not be needed if latest nightly compiler version is used
-  preConfigure = ''
-    # Find all lib.rs and main.rs files and add required unstable features
-    # Add the feature flag at the top of the file if not present`
-    find . -name "lib.rs" -o -name "main.rs" | while read -r file; do
-      for feature in extract_if let_chains hash_extract_if; do
-        if ! grep -q "feature.*$feature" "$file"; then
-          sed -i "1i #![feature($feature)]" "$file"
-        fi
-      done
-    done
-  '';
-
   meta = {
     description = "`holo` daemon that provides the routing protocols, tools and policies";
     homepage = "https://github.com/holo-routing/holo";
diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index a0de686dfb10..039d6c1489d6 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-07-02";
+  version = "0-unstable-2025-07-11";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "89af52d9a893af013f5f4c1d2d56912106827153";
-    hash = "sha256-ENTd/sd4Vz/VJYn14SVqW1OH2m7WIAvsm9A9SrmDZRY=";
+    rev = "392ddb642abec771d63688c49fa7bcbb9d2a5717";
+    hash = "sha256-A4nftqiNz2bNihz0bKY94Hq/6ydR6UQOcGioeL7iymY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/homebox/package.nix b/pkgs/by-name/ho/homebox/package.nix
index d2e40a060116..d3f0be14dfa1 100644
--- a/pkgs/by-name/ho/homebox/package.nix
+++ b/pkgs/by-name/ho/homebox/package.nix
@@ -38,8 +38,8 @@ buildGo123Module {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version;
     src = "${src}/frontend";
-    hash = "sha256-6Q+tIY5dl5jCQyv1F8btLdJg0oEUGs0Wyu/joVdVhf8=";
     fetcherVersion = 1;
+    hash = "sha256-6Q+tIY5dl5jCQyv1F8btLdJg0oEUGs0Wyu/joVdVhf8=";
   };
   pnpmRoot = "../frontend";
 
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index 95e0091061b4..e3dd75595a7b 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -50,8 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-aPkXHKG3vDsfYqYx9q9+2wZhuFqmPcXdoBqOfAvW9oA=";
     fetcherVersion = 1;
+    hash = "sha256-aPkXHKG3vDsfYqYx9q9+2wZhuFqmPcXdoBqOfAvW9oA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/homer/package.nix b/pkgs/by-name/ho/homer/package.nix
index 0eb47d64454f..e00c2327054e 100644
--- a/pkgs/by-name/ho/homer/package.nix
+++ b/pkgs/by-name/ho/homer/package.nix
@@ -25,8 +25,8 @@ stdenvNoCC.mkDerivation rec {
       src
       patches
       ;
-    hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
     fetcherVersion = 1;
+    hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
   };
 
   # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
diff --git a/pkgs/by-name/hy/hyperswarm/package.nix b/pkgs/by-name/hy/hyperswarm/package.nix
index 5c0072f448e5..a805c136fb86 100644
--- a/pkgs/by-name/hy/hyperswarm/package.nix
+++ b/pkgs/by-name/hy/hyperswarm/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "hyperswarm";
-  version = "4.11.7";
+  version = "4.12.1";
 
   src = fetchFromGitHub {
     owner = "holepunchto";
     repo = "hyperswarm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z/FNBDJbiyR5AY40RDtiuQmjNUZ+BSGv8aewBnhSNZw=";
+    hash = "sha256-BQ1/kNJAFoxPJ2I3dyV7EHafKfbbDqCQw039VT4YLT8=";
   };
 
   npmDepsHash = "sha256-4ysUYFIFlzr57J7MdZit1yX3Dgpb2eY0rdYnwyppwK0=";
diff --git a/pkgs/by-name/hy/hyprpanel/package.nix b/pkgs/by-name/hy/hyprpanel/package.nix
index bc6ef56220e1..f6953012d783 100644
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -37,7 +37,7 @@
 }:
 ags.bundle {
   pname = "hyprpanel";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-12";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,8 +45,8 @@ ags.bundle {
   src = fetchFromGitHub {
     owner = "Jas-SinghFSU";
     repo = "HyprPanel";
-    rev = "343c9857bd7f1d302d591e8d5f3f9952dc84775b";
-    hash = "sha256-MGJmxnjlERXJLDywrSHYSgpt7fhh3/HOHQboRrxDW64=";
+    rev = "59b57fca0634c98f23227ea948f87df7814e72f6";
+    hash = "sha256-cl1NEWTUsNxBmLjyvz+GDP4Hy7riaOszSGpfplHA7Y4=";
   };
 
   # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
diff --git a/pkgs/by-name/im/immich-public-proxy/package.nix b/pkgs/by-name/im/immich-public-proxy/package.nix
index 42126fa6023b..516547bc9c0b 100644
--- a/pkgs/by-name/im/immich-public-proxy/package.nix
+++ b/pkgs/by-name/im/immich-public-proxy/package.nix
@@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
   pname = "immich-public-proxy";
-  version = "1.11.3";
+  version = "1.11.5";
   src = fetchFromGitHub {
     owner = "alangrainger";
     repo = "immich-public-proxy";
     tag = "v${version}";
-    hash = "sha256-rroccsVgPsBOTQ/2Mb+BoqOm59LdjqSqKsL40n7NXss=";
+    hash = "sha256-jSAQbACWEt/gyZbr4sOM17t3KZoxPOM0RZFbsLZfcRM=";
   };
 
   sourceRoot = "${src.name}/app";
 
-  npmDepsHash = "sha256-9zuw24lPFsDWHrplShsCQDrUpBa6U+NeRVJNSI4OJHA=";
+  npmDepsHash = "sha256-av+XKzrTl+8xizYFZwCTmaLNsbBnusf03I1Uvkp0sF8=";
 
   # patch in absolute nix store paths so the process doesn't need to cwd in $out
   postPatch = ''
diff --git a/pkgs/by-name/in/infrastructure-agent/package.nix b/pkgs/by-name/in/infrastructure-agent/package.nix
index f727f2b2aeda..f3f4a9d390b5 100644
--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "infrastructure-agent";
-  version = "1.65.1";
+  version = "1.65.3";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = version;
-    hash = "sha256-OHL0H2OCPd5+HenF63/ndWYkdlufrG31Xlb9Sv9EP6g=";
+    hash = "sha256-T87ET+rKGqEEmVujJMkHlgA29cYK+yQ7K+JTICwT57s=";
   };
 
   vendorHash = "sha256-eZtO+RFw+yUjIQ03y0NOiHIFLcwEwWu5A+7wsaraCCQ=";
diff --git a/pkgs/by-name/in/iniparser/package.nix b/pkgs/by-name/in/iniparser/package.nix
index fb8d7e48ea60..d467ca283448 100644
--- a/pkgs/by-name/in/iniparser/package.nix
+++ b/pkgs/by-name/in/iniparser/package.nix
@@ -10,6 +10,8 @@
   ruby,
   validatePkgConfig,
   testers,
+  unity-test,
+  ctestCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -19,56 +21,57 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitLab {
     owner = "iniparser";
     repo = "iniparser";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-z10S9ODLprd7CbL5Ecgh7H4eOwTetYwFXiWBUm6fIr4=";
   };
 
-  patches = lib.optionals finalAttrs.finalPackage.doCheck [
-    (replaceVars ./remove-fetchcontent-usage.patch {
-      # Do not let cmake's fetchContent download unity
-      unitySrc = symlinkJoin {
-        paths = [
-          (fetchFromGitHub {
-            owner = "throwtheswitch";
-            repo = "unity";
-            rev = "v2.6.0";
-            hash = "sha256-SCcUGNN/UJlu3ALJiZ9bQKxYRZey3cm9QG+NOehp6Ow=";
-          })
-        ];
-        postBuild = ''
-          ln -s ${finalAttrs.src}/test/unity_config.h $out/src/unity_config.h
-        '';
-      };
-    })
-  ];
+  patches = lib.optional finalAttrs.doCheck (
+    # 1. Do not fetch the Unity GitHub repository
+    # 2. Lookup the Unity pkgconfig file
+    # 3. Get the generate_test_runner.rb file from the Unity share directory
+    replaceVars ./remove-fetchcontent-usage.patch {
+      # Get the test generator
+      UNITY-GENERATE-TEST-RUNNER = "${unity-test}/share/generate_test_runner.rb";
+    }
+  );
 
   nativeBuildInputs = [
     cmake
     doxygen
     validatePkgConfig
-  ] ++ lib.optionals finalAttrs.finalPackage.doCheck [ ruby ];
+  ];
 
-  cmakeFlags = [ "-DBUILD_TESTING=${if finalAttrs.finalPackage.doCheck then "ON" else "OFF"}" ];
-
-  doCheck = false;
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
+  ];
+  doCheck = true;
+  nativeCheckInputs = [
+    ruby
+    ctestCheckHook
+  ];
+  checkInputs = [
+    (
+      (unity-test.override {
+        supportDouble = true;
+      }).overrideAttrs
+      {
+        doCheck = false;
+      }
+    )
+  ];
 
   postFixup = ''
     ln -sv $out/include/iniparser/*.h $out/include/
   '';
 
-  passthru.tests = {
-    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-    iniparser-with-tests = finalAttrs.overrideAttrs (_: {
-      doCheck = true;
-    });
-  };
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://gitlab.com/iniparser/iniparser";
     description = "Free standalone ini file parsing library";
     changelog = "https://gitlab.com/iniparser/iniparser/-/releases/v${finalAttrs.version}";
-    license = licenses.mit;
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
     pkgConfigModules = [ "iniparser" ];
     maintainers = [ ];
   };
diff --git a/pkgs/by-name/in/iniparser/remove-fetchcontent-usage.patch b/pkgs/by-name/in/iniparser/remove-fetchcontent-usage.patch
index db96c37e6b2c..16c24385cd48 100644
--- a/pkgs/by-name/in/iniparser/remove-fetchcontent-usage.patch
+++ b/pkgs/by-name/in/iniparser/remove-fetchcontent-usage.patch
@@ -1,17 +1,52 @@
 diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index b28d151..33a6bcf 100644
+index 0735d27..32c5cdb 100644
 --- a/test/CMakeLists.txt
 +++ b/test/CMakeLists.txt
-@@ -28,10 +28,8 @@ set(FETCHCONTENT_QUIET OFF)
+@@ -26,16 +26,8 @@ endif()
  
- FetchContent_Declare(
-   unity
+ set(FETCHCONTENT_QUIET OFF)
+ 
+-FetchContent_Declare(
+-  unity
 -  GIT_REPOSITORY "https://github.com/throwtheswitch/unity.git"
 -  GIT_PROGRESS TRUE
 -  PATCH_COMMAND ${CMAKE_COMMAND} -E copy
 -                ${CMAKE_CURRENT_LIST_DIR}/unity_config.h ./src/)
-+  SOURCE_DIR @unitySrc@
-+)
+-
+-FetchContent_MakeAvailable(unity)
+-target_compile_definitions(unity PUBLIC UNITY_INCLUDE_CONFIG_H
+-                                        UNITY_USE_COMMAND_LINE_ARGS)
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(UNITY REQUIRED unity)
+ 
+ function(create_test_runner)
+   set(options)
+@@ -52,7 +44,7 @@ function(create_test_runner)
+   add_custom_command(
+     OUTPUT test_${TEST_RUNNER_NAME}_runner.c
+     COMMAND
+-      ${RUBY_EXECUTABLE} ${unity_SOURCE_DIR}/auto/generate_test_runner.rb
++      @UNITY-GENERATE-TEST-RUNNER@
+       ${CMAKE_CURRENT_SOURCE_DIR}/test_${TEST_RUNNER_NAME}.c
+       test_${TEST_RUNNER_NAME}_runner.c ${CMAKE_CURRENT_LIST_DIR}/unity-config.yml
+     DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/test_${TEST_RUNNER_NAME}.c
+@@ -62,10 +54,18 @@ function(create_test_runner)
+                                           test_${TEST_RUNNER_NAME}_runner.c)
+   foreach(TARGET_TYPE ${TARGET_TYPES})
+     # if BUILD_STATIC_LIBS=ON shared takes precedence
++    target_include_directories(
++      test_${TEST_RUNNER_NAME}
++      PUBLIC
++      ${UNITY_INCLUDE_DIRS})
++    target_compile_options(
++      test_${TEST_RUNNER_NAME}
++      PUBLIC
++      ${UNITY_CFLAGS_OTHER})
+     target_link_libraries(
+       test_${TEST_RUNNER_NAME}
+       ${PROJECT_NAME}-${TARGET_TYPE}
+-      unity)
++      ${UNITY_LIBRARIES})
+   endforeach()
+ endfunction()
  
- FetchContent_MakeAvailable(unity)
- target_compile_definitions(unity PUBLIC UNITY_INCLUDE_CONFIG_H)
diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index 2555fe1c6b7e..5c10d9519ed7 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inputplumber";
-  version = "0.59.2";
+  version = "0.60.2";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${version}";
-    hash = "sha256-IAopZnGU0NOfpViLLetAm5BycTXyYL1fJ5WJW8qVnwA=";
+    hash = "sha256-zcy9scs7oRRLKm/FL6BfO64IstWY4HmTRxG/jJG0jLw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-m/U9fYio39hkjcVDO3VlK5yJF9nWL9Y5B8D0FgD7LKk=";
+  cargoHash = "sha256-fw7pM6HSy/8fNTYu7MqKiTl/2jdyDOLDBNhd0rpzb6M=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ip/ipget/package.nix b/pkgs/by-name/ip/ipget/package.nix
index 1439acbd300b..1a91414abf21 100644
--- a/pkgs/by-name/ip/ipget/package.nix
+++ b/pkgs/by-name/ip/ipget/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "ipget";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "ipget";
     rev = "v${version}";
-    hash = "sha256-5nddlFaQCGJzzH39DqqBNtdc8IFNSLfDv7yKgA4dR6Y=";
+    hash = "sha256-Q9rgbfPAdAulNuDQ1bXM08aK0IEerbsKqjK8aMnBwcM=";
   };
 
-  vendorHash = "sha256-miwOJcaSfa4eUIwAt+ewMELzS3Ib023pzFunVSoyBkM=";
+  vendorHash = "sha256-2boqKf/7y/71ThNodUuZXaRHZadx+TU0d6swHHN1VyM=";
 
   postPatch = ''
     # main module (github.com/ipfs/ipget) does not contain package github.com/ipfs/ipget/sharness/dependencies
diff --git a/pkgs/by-name/it/it-tools/package.nix b/pkgs/by-name/it/it-tools/package.nix
index 7c8bb989875a..de26c725090e 100644
--- a/pkgs/by-name/it/it-tools/package.nix
+++ b/pkgs/by-name/it/it-tools/package.nix
@@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
 
   pnpmDeps = pnpm_8.fetchDeps {
     inherit pname version src;
-    hash = "sha256-m1eXBE5rakcq8NGnPC9clAAvNJQrN5RuSQ94zfgGZxw=";
     fetcherVersion = 1;
+    hash = "sha256-m1eXBE5rakcq8NGnPC9clAAvNJQrN5RuSQ94zfgGZxw=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/je/jellyseerr/package.nix b/pkgs/by-name/je/jellyseerr/package.nix
index 25804ba2c1ce..7351676250ce 100644
--- a/pkgs/by-name/je/jellyseerr/package.nix
+++ b/pkgs/by-name/je/jellyseerr/package.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
     fetcherVersion = 1;
+    hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
   };
 
   buildInputs = [ sqlite ];
diff --git a/pkgs/by-name/k9/k9s/package.nix b/pkgs/by-name/k9/k9s/package.nix
index 951a33687595..f25b2d4eb652 100644
--- a/pkgs/by-name/k9/k9s/package.nix
+++ b/pkgs/by-name/k9/k9s/package.nix
@@ -10,22 +10,21 @@
   writableTmpDirAsHomeHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "k9s";
   version = "0.50.7";
 
   src = fetchFromGitHub {
     owner = "derailed";
     repo = "k9s";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-K0JETHs2vOOfDUPw22x+2O5WN0rtkXsRxMnUHrCpkDg=";
   };
 
   ldflags = [
     "-s"
-    "-w"
-    "-X github.com/derailed/k9s/cmd.version=${version}"
-    "-X github.com/derailed/k9s/cmd.commit=${src.rev}"
+    "-X github.com/derailed/k9s/cmd.version=${finalAttrs.version}"
+    "-X github.com/derailed/k9s/cmd.commit=${finalAttrs.src.rev}"
     "-X github.com/derailed/k9s/cmd.date=1970-01-01T00:00:00Z"
   ];
 
@@ -44,7 +43,7 @@ buildGoModule rec {
     tests.version = testers.testVersion {
       package = k9s;
       command = "HOME=$(mktemp -d) k9s version -s";
-      inherit version;
+      inherit (finalAttrs) version;
     };
     updateScript = nix-update-script { };
   };
@@ -60,6 +59,9 @@ buildGoModule rec {
       --bash <($out/bin/k9s completion bash) \
       --fish <($out/bin/k9s completion fish) \
       --zsh <($out/bin/k9s completion zsh)
+
+    mkdir -p $out/share/k9s/skins
+    cp -r $src/skins/* $out/share/k9s/skins/
   '';
 
   nativeCheckInputs = [ writableTmpDirAsHomeHook ];
@@ -67,7 +69,7 @@ buildGoModule rec {
   meta = {
     description = "Kubernetes CLI To Manage Your Clusters In Style";
     homepage = "https://github.com/derailed/k9s";
-    changelog = "https://github.com/derailed/k9s/releases/tag/v${version}";
+    changelog = "https://github.com/derailed/k9s/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     mainProgram = "k9s";
     maintainers = with lib.maintainers; [
@@ -79,4 +81,4 @@ buildGoModule rec {
       ryan4yin
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ka/kaidan/package.nix b/pkgs/by-name/ka/kaidan/package.nix
index 396212ad3de8..95beeba72cf8 100644
--- a/pkgs/by-name/ka/kaidan/package.nix
+++ b/pkgs/by-name/ka/kaidan/package.nix
@@ -6,6 +6,7 @@
   extra-cmake-modules,
   pkg-config,
   kdePackages,
+  kdsingleapplication,
   zxing-cpp,
   qxmpp,
   gst_all_1,
@@ -14,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kaidan";
-  version = "0.11.0";
+  version = "0.12.2";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "kaidan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8pC4vINeKSYY+LlVgCXUtBq9UjraPdTikBOwLBLeQ3Y=";
+    hash = "sha256-+9L1NuyHnyX7yThC3LGqKJd9XU8Mo7NAdnGoJSdq4TM=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     kdePackages.qtlocation
     kdePackages.qqc2-desktop-style
     kdePackages.sonnet
+    kdsingleapplication
     zxing-cpp
     qxmpp
     gst_all_1.gstreamer
diff --git a/pkgs/by-name/ka/karakeep/package.nix b/pkgs/by-name/ka/karakeep/package.nix
index 1d63fdab3e5b..d901f1ad09e2 100644
--- a/pkgs/by-name/ka/karakeep/package.nix
+++ b/pkgs/by-name/ka/karakeep/package.nix
@@ -53,8 +53,8 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     };
 
-    hash = "sha256-yf8A0oZ0Y4A5k7gfinIU02Lbqp/ygyvIBlldS0pv5+0=";
     fetcherVersion = 1;
+    hash = "sha256-yf8A0oZ0Y4A5k7gfinIU02Lbqp/ygyvIBlldS0pv5+0=";
   };
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/ka/kargo/package.nix b/pkgs/by-name/ka/kargo/package.nix
index b50072c4024e..42fef092db88 100644
--- a/pkgs/by-name/ka/kargo/package.nix
+++ b/pkgs/by-name/ka/kargo/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "kargo";
-  version = "1.5.3";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "akuity";
     repo = "kargo";
     tag = "v${version}";
-    hash = "sha256-JjDlH3KqB0NEPFvOhKzUR24WvV/6lx7yXTwM10cIA2k=";
+    hash = "sha256-I1mOEI9F8qQU9g4iKZC6iE0Or2UA25qM4z+H1z2juRY=";
   };
 
-  vendorHash = "sha256-iZEAUDRqOHmG5u1FEtb14hSHp4p30FGzLEsCYJQCd8U=";
+  vendorHash = "sha256-K7/18Qk1sEmBW+Nt5VpO/eMKijDuXXx1+fIlXB1lUUM=";
 
   subPackages = [ "cmd/cli" ];
 
diff --git a/pkgs/by-name/kr/kryoflux/package.nix b/pkgs/by-name/kr/kryoflux/package.nix
new file mode 100644
index 000000000000..3a6e415feac8
--- /dev/null
+++ b/pkgs/by-name/kr/kryoflux/package.nix
@@ -0,0 +1,54 @@
+{
+  stdenv,
+  lib,
+  autoPatchelfHook,
+  fetchurl,
+  makeWrapper,
+  jre,
+  fmt_9,
+  libusb1,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  name = "kryoflux";
+  version = "3.50";
+  src = fetchurl {
+    url = "https://www.kryoflux.com/download/kryoflux_${finalAttrs.version}_linux_r2.tar.gz";
+    hash = "sha256-qGFXu0FkmCB7cffOqNiOluDUww19MA/UuEVElgmSd3o=";
+  };
+  nativeBuildInputs = [
+    makeWrapper
+    autoPatchelfHook
+  ];
+  buildInputs = [
+    fmt_9
+    libusb1
+  ];
+  dontBuild = true;
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mkdir -p $out/share/java
+    cp -r {docs,testimages,schematics} $out/share
+    cp dtc/kryoflux-ui.jar $out/share/java
+    makeWrapper ${jre}/bin/java $out/bin/kryoflux-ui \
+      --add-flags "-jar $out/share/java/kryoflux-ui.jar" \
+      --set PATH "$out/bin"
+    tar -C $out -xf dtc/${stdenv.hostPlatform.linuxArch}/kryoflux-dtc*.tar.gz \
+      --strip-components=1 \
+      --wildcards '*/bin/*' '*/lib/*' '*/share/*'
+
+    mkdir -p $out/etc/udev/rules.d
+    echo 'ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="03eb", ATTR{idProduct}=="6124", GROUP="floppy", MODE="0660"' > 80-kryoflux.rules
+
+    runHook postInstall
+  '';
+  meta = {
+    description = "Software UI to accompany KryoFlux, the renowned forensic floppy controller";
+    homepage = "https://kryoflux.com";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "kryoflux-ui";
+    platforms = with lib.platforms; lib.intersectLists linux (x86_64 ++ aarch64);
+  };
+})
diff --git a/pkgs/by-name/ku/kube-linter/package.nix b/pkgs/by-name/ku/kube-linter/package.nix
index ceff52574dc9..716282cfd080 100644
--- a/pkgs/by-name/ku/kube-linter/package.nix
+++ b/pkgs/by-name/ku/kube-linter/package.nix
@@ -9,16 +9,18 @@
 
 buildGoModule rec {
   pname = "kube-linter";
-  version = "0.6.8";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "kube-linter";
     rev = "v${version}";
-    sha256 = "sha256-abfNzf+84BWHpvLQZKyzl7WBt7UHj2zqzKq3VCqAwwY=";
+    sha256 = "sha256-19roNwTRyP28YTIwkDDXlvsg7yY4vRLHUnBRREOe7iQ=";
   };
 
-  vendorHash = "sha256-FUkGiJ/6G9vSYtAj0v9GT4OINbO3d/OKlJ0YwhONftY=";
+  vendorHash = "sha256-wCYEgQ+mm50ESQOs7IivTUhjTDiaGETogLOHcJtNfaM=";
+
+  excludedPackages = [ "tool-imports" ];
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ku/kubo/package.nix b/pkgs/by-name/ku/kubo/package.nix
index 78b542d6d841..72e95894d686 100644
--- a/pkgs/by-name/ku/kubo/package.nix
+++ b/pkgs/by-name/ku/kubo/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "kubo";
-  version = "0.35.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.36.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "16"; # Also update kubo-migrator when changing the repo version
@@ -16,7 +16,7 @@ buildGoModule rec {
   # Kubo makes changes to its source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-OubXaa2JWbEaakDV6pExm5PkiZ5XPd9uG+S4KwWb0xQ=";
+    hash = "sha256-KrNP3JMkyTo6hghLLGWerH1Oz3HsnTI5jCfqRbp6AR8=";
   };
 
   # tarball contains multiple files/directories
diff --git a/pkgs/by-name/la/labwc/package.nix b/pkgs/by-name/la/labwc/package.nix
index 596e8245b179..3d1cbea4f1c2 100644
--- a/pkgs/by-name/la/labwc/package.nix
+++ b/pkgs/by-name/la/labwc/package.nix
@@ -22,20 +22,20 @@
   wayland,
   wayland-protocols,
   wayland-scanner,
-  wlroots_0_18,
+  wlroots_0_19,
   xcbutilwm,
   xwayland,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc";
-  version = "0.8.4";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc";
     tag = finalAttrs.version;
-    hash = "sha256-JeEw1xKwgsTMllZXvNaXXdgmZnmIFUyG/cJ14QFQf/E=";
+    hash = "sha256-7PgRbOSxU7v49dcTuke7V/Xa42baw79iMvfnCOYx4qU=";
   };
 
   outputs = [
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     pango
     wayland
     wayland-protocols
-    wlroots_0_18
+    wlroots_0_19
     xcbutilwm
     xwayland
   ];
diff --git a/pkgs/by-name/le/leetgo/package.nix b/pkgs/by-name/le/leetgo/package.nix
index 12cb24a61efb..079444b6398c 100644
--- a/pkgs/by-name/le/leetgo/package.nix
+++ b/pkgs/by-name/le/leetgo/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "leetgo";
-  version = "1.4.14";
+  version = "1.4.15";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "leetgo";
     rev = "v${version}";
-    hash = "sha256-RRKQlCGVE8/RS1jPZBmzDXrv0dTW1zKR5mugByfIzsU=";
+    hash = "sha256-9GM4V7NOYMsvWwBgJSnGl4/S+UexdlVL/NyIiMRnL8A=";
   };
 
-  vendorHash = "sha256-VNJe+F/lbW+9fX6Fie91LLSs5H4Rn+kmHhsMd5mbYtA=";
+  vendorHash = "sha256-I3H2uVIvOGM6aQelM/69LpwJvg3TBZwq3i4R913etH4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/le/legcord/package.nix b/pkgs/by-name/le/legcord/package.nix
index e6568dc948c5..8ad3d679fd84 100644
--- a/pkgs/by-name/le/legcord/package.nix
+++ b/pkgs/by-name/le/legcord/package.nix
@@ -44,8 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-nobOORfhwlGEvNt+MfDKd3rXor6tJHDulz5oD1BGY4I=";
     fetcherVersion = 1;
+    hash = "sha256-nobOORfhwlGEvNt+MfDKd3rXor6tJHDulz5oD1BGY4I=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index 9eff15d6faa4..912712cb42f3 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.160.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${version}";
-    hash = "sha256-F88mDic6cnSa8mHhr+uX2WORFgJOu9LChLIS6DqWc40=";
+    hash = "sha256-Evk2g2fqEmo/cd6+Sd76U0Byj6OEm99OZuUkoxTELbM=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "deltachat-core-rust";
     inherit version src;
-    hash = "sha256-pZwCcAOYLKR6wfncIyuisYccNSGK+lqUg6lkyfKPgFk=";
+    hash = "sha256-vnnROLmsAh6mSPuQzTSbYSgxGfrKaanuLcADFE+kQeM=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/li/libdwarf/package.nix b/pkgs/by-name/li/libdwarf/package.nix
index 9c61445ee549..6c68ef9c26dc 100644
--- a/pkgs/by-name/li/libdwarf/package.nix
+++ b/pkgs/by-name/li/libdwarf/package.nix
@@ -6,6 +6,7 @@
   ninja,
   zlib,
   zstd,
+  pkg-config,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,6 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     meson
     ninja
+    pkg-config
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/li/libfreehand/package.nix b/pkgs/by-name/li/libfreehand/package.nix
new file mode 100644
index 000000000000..3a7ae6f8565e
--- /dev/null
+++ b/pkgs/by-name/li/libfreehand/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchpatch,
+  perl,
+  pkg-config,
+  boost,
+  cppunit,
+  doxygen,
+  gperf,
+  icu,
+  lcms2,
+  librevenge,
+  zlib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libfreehand";
+  version = "0.1.2";
+
+  src = fetchzip {
+    url = "https://dev-www.libreoffice.org/src/libfreehand/libfreehand-${finalAttrs.version}.tar.xz";
+    hash = "sha256-0icEGnTtYveP24FbYjRB7tFW/TquSOszbqZspHAhQ7I=";
+  };
+
+  nativeBuildInputs = [
+    perl
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    cppunit
+    doxygen
+    gperf
+    icu
+    lcms2
+    librevenge
+    zlib
+  ];
+
+  configureFlags = [ "--disable-werror" ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libfreehand/-/raw/main/libfreehand-0.1.2-icu-fix.patch?ref_type=heads";
+      hash = "sha256-SRkcF+FRkFdueLSTOMYWo6+CCl05f0OBP6G5VrXRyCw=";
+    })
+  ];
+
+  meta = {
+    description = "Adobe Freehand import library";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libfreehand";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/li/libmspub/package.nix b/pkgs/by-name/li/libmspub/package.nix
new file mode 100644
index 000000000000..803be7ab7e32
--- /dev/null
+++ b/pkgs/by-name/li/libmspub/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchpatch,
+  pkg-config,
+  boost,
+  doxygen,
+  icu,
+  librevenge,
+  zlib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libmspub";
+  version = "0.1.4";
+
+  src = fetchzip {
+    url = "https://dev-www.libreoffice.org/src/libmspub/libmspub-${finalAttrs.version}.tar.xz";
+    hash = "sha256-/6e9IGcTIZTlnsakOaSjTn3DsO9ZNQigdCCbMbrBTQE=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    boost
+    doxygen
+    icu
+    librevenge
+    zlib
+  ];
+
+  configureFlags = [ "--with-docs" ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libmspub/-/raw/main/buildfix.diff?ref_type=heads";
+      hash = "sha256-evxEoQ0a6YHoymR+SEJwqfr7rkWp3JnsWOD1tfYfZOw=";
+    })
+  ];
+
+  meta = {
+    description = "Microsoft Publisher import library";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libmspub";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    platforms = lib.platforms.all;
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+  };
+})
diff --git a/pkgs/by-name/li/libpagemaker/package.nix b/pkgs/by-name/li/libpagemaker/package.nix
new file mode 100644
index 000000000000..4edb59e9d992
--- /dev/null
+++ b/pkgs/by-name/li/libpagemaker/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchpatch,
+  pkg-config,
+  boost,
+  doxygen,
+  librevenge,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libpagemaker";
+  version = "0.0.4";
+
+  src = fetchzip {
+    url = "https://dev-www.libreoffice.org/src/libpagemaker/libpagemaker-${finalAttrs.version}.tar.xz";
+    hash = "sha256-fAtCNbP0fI2LxTOPPh5zbdF50wWhsrfSoNFPVU9tBas=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    boost
+    doxygen
+    librevenge
+  ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libpagemaker/-/raw/main/libpagemaker-0.0.4-const-ref-exception.patch?ref_type=heads";
+      hash = "sha256-yZbiLAZHgzygGetiuoKiQS010pRfZTi2CbAAxQdCZbs=";
+    })
+  ];
+
+  meta = {
+    description = "Adobe PageMaker import library";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libpagemaker";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/li/libqxp/package.nix b/pkgs/by-name/li/libqxp/package.nix
new file mode 100644
index 000000000000..46a70cf55007
--- /dev/null
+++ b/pkgs/by-name/li/libqxp/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  pkg-config,
+  boost,
+  cppunit,
+  doxygen,
+  icu,
+  librevenge,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libqxp";
+  version = "0.0.2";
+
+  src = fetchzip {
+    url = "https://dev-www.libreoffice.org/src/libqxp/libqxp-${finalAttrs.version}.tar.xz";
+    hash = "sha256-5AcZDdmowFbsl9xJ/CPXAUL5zSNu90HgX3V0V8Pt/Rw=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    boost
+    cppunit
+    doxygen
+    icu
+    librevenge
+  ];
+
+  meta = {
+    description = "QuarkXPress import library";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libqxp";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/li/librecad/package.nix b/pkgs/by-name/li/librecad/package.nix
index 63b730c4a4ea..9a175061c3eb 100644
--- a/pkgs/by-name/li/librecad/package.nix
+++ b/pkgs/by-name/li/librecad/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librecad";
-  version = "2.2.1.1";
+  version = "2.2.1.2";
 
   src = fetchFromGitHub {
     owner = "LibreCAD";
     repo = "LibreCAD";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0RhdX8wUjZ2JQazhFjkfdnxvh5VhXfVMspvhBF03VNk=";
+    hash = "sha256-a/0prti7aFIzoHXyd6NsiKx4ugW/vRXURAHBrAqyp84=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index 004488565f04..93b159a5b162 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "5c2c28f79716968381f71b3470ee0064762d7c6f";
-    hash = "sha256-L+jTTZA2qg/PlZtI0G0rzLk5is6cUFiTfy2RTcry5vA=";
+    rev = "82d91f7daf81a41ece49644d2a26b2a40228be61";
+    hash = "sha256-zRtn+Fc1sw3Uja5vJ5/1IRPr/xG5O0wIKflHr96tu3I=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/li/librime-lua/package.nix b/pkgs/by-name/li/librime-lua/package.nix
index b503fecfb138..0c988e2b8b62 100644
--- a/pkgs/by-name/li/librime-lua/package.nix
+++ b/pkgs/by-name/li/librime-lua/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "librime-lua";
-  version = "0-unstable-2024-12-21";
+  version = "0-unstable-2025-07-07";
 
   src = fetchFromGitHub {
     owner = "hchunhui";
     repo = "librime-lua";
-    rev = "e3912a4b3ac2c202d89face3fef3d41eb1d7fcd6";
-    hash = "sha256-zx0F41szn5qlc2MNjt1vizLIsIFQ67fp5cb8U8UUgtY=";
+    rev = "68f9c364a2d25a04c7d4794981d7c796b05ab627";
+    hash = "sha256-m7/qXdIlMMHscDDcFmusNuOR0cuzPpDQdprqRci8qZw=";
   };
 
   propagatedBuildInputs = [ lua ];
diff --git a/pkgs/by-name/li/libtins/0001-force-cpp-14.patch b/pkgs/by-name/li/libtins/0001-force-cpp-17.patch
similarity index 87%
rename from pkgs/by-name/li/libtins/0001-force-cpp-14.patch
rename to pkgs/by-name/li/libtins/0001-force-cpp-17.patch
index 3426713a07e3..0c80cafa201c 100644
--- a/pkgs/by-name/li/libtins/0001-force-cpp-14.patch
+++ b/pkgs/by-name/li/libtins/0001-force-cpp-17.patch
@@ -1,4 +1,4 @@
-This change bypasses all the code that attempts to see which C++11 features are enabled in your specific C++11 compiler.  C++14 is required for gtest 1.13+.
+This change bypasses all the code that attempts to see which C++11 features are enabled in your specific C++11 compiler.  C++17 is required for gtest 1.17+.
 diff --git a/CMakeLists.txt b/CMakeLists.txt
 index 902233e676ee..49ac8a1010a4 100644
 --- a/CMakeLists.txt
@@ -20,7 +20,7 @@ index 902233e676ee..49ac8a1010a4 100644
 -    ENDIF()
 +    SET(TINS_HAVE_CXX11 ON)
 +    MESSAGE(STATUS "Using C++11 features")
-+    SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++14")
++    SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17")
  ELSE(LIBTINS_ENABLE_CXX11)
      MESSAGE(
          WARNING
diff --git a/pkgs/by-name/li/libtins/package.nix b/pkgs/by-name/li/libtins/package.nix
index 00c7a33339f3..3653b7671d78 100644
--- a/pkgs/by-name/li/libtins/package.nix
+++ b/pkgs/by-name/li/libtins/package.nix
@@ -21,9 +21,11 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Required for gtest 1.13+, see also upstream report at:
-    # https://github.com/mfontanini/libtins/issues/529
-    ./0001-force-cpp-14.patch
+    # Required for gtest 1.17+:
+    # https://github.com/NixOS/nixpkgs/issues/425358
+    # See also an upstream report for gtest 1.13+ and C++14:
+    # https://github.com/mfontanini/libtins/issues/
+    ./0001-force-cpp-17.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index b93ccaebffc7..25d8afd115be 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "9.4.0";
+  version = "9.5.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ddQB0wKMhKSnPrJflgsDfyWCzOiFehf/2CijPiVk65U=";
+    hash = "sha256-SWJ5e6/q92UyC0ea8yJAYcFNr5LreJ2qFY7hcunovEM=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/lo/lock/package.nix b/pkgs/by-name/lo/lock/package.nix
index 3e7a33fea314..7a127bed79a2 100644
--- a/pkgs/by-name/lo/lock/package.nix
+++ b/pkgs/by-name/lo/lock/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lock";
-  version = "1.6.2";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "konstantintutsch";
     repo = "Lock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ct5INzqSNbGVSlpQsAuAXFlcZHmN/L4eLCZ4/Di5apQ=";
+    hash = "sha256-SomQYgc3F7w5DB0+j4peYTLSdHsrg9fw3h15gU3DTKU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/lx/lxgw-neoxihei/package.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
index 102698250980..022eb700ecb5 100644
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.218";
+  version = "1.218.1";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-TGl4J4r7ueAahrTgsJH0DlucuT2OrW3NzR1jQGwQA7E=";
+    hash = "sha256-ZWotvGj2LpQbi3t6mVBL8kE19JC4X6VqkIXSQSuyjR0=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ma/markdown-oxide/package.nix b/pkgs/by-name/ma/markdown-oxide/package.nix
index 981d271bf3f7..18e81ddf599d 100644
--- a/pkgs/by-name/ma/markdown-oxide/package.nix
+++ b/pkgs/by-name/ma/markdown-oxide/package.nix
@@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "markdown-oxide";
-  version = "0.25.3";
+  version = "0.25.4";
 
   src = fetchFromGitHub {
     owner = "Feel-ix-343";
     repo = "markdown-oxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LBY7hLen6jhOBsOIl9f5rFVH66FbLbuYgLl1xtzTRQg=";
+    hash = "sha256-wS75Etj6NAMt/wlWB1yLGetM+OsgyeCo0dqHkrjUsQI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-VEYwLTWnFMO6qH9qsO4/oiNeIHgoEZAF+YjeVgFOESQ=";
+  cargoHash = "sha256-W+4WmWfqNuh3kmqE9X6CQ5/kTqMoUqyuIFCRiZa6Kc4=";
 
   meta = {
     description = "Markdown LSP server inspired by Obsidian";
diff --git a/pkgs/by-name/ma/master_me/package.nix b/pkgs/by-name/ma/master_me/package.nix
index a12562ff8cab..38836aa35544 100644
--- a/pkgs/by-name/ma/master_me/package.nix
+++ b/pkgs/by-name/ma/master_me/package.nix
@@ -11,14 +11,14 @@
 }:
 stdenv.mkDerivation rec {
   pname = "master_me";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "trummerschlunk";
     repo = "master_me";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-PEa1EHgr3dcM2Kh0AHvy1knKkRo89D6J4h6qGFy1vVY=";
+    hash = "sha256-eesMXxRcCgzhSQ+WUqM00EuKYhFxysjH+RWKHKGYzUM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/me/melange/package.nix b/pkgs/by-name/me/melange/package.nix
index 2ddf086f8b9d..74e135d7f36f 100644
--- a/pkgs/by-name/me/melange/package.nix
+++ b/pkgs/by-name/me/melange/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "melange";
-  version = "0.29.0";
+  version = "0.29.1";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "melange";
     rev = "v${version}";
-    hash = "sha256-nyrR9RxoZzQQ4OqV4FtW9534PQAyGnBCEqCJReMkCIQ=";
+    hash = "sha256-GQvsq9PJA4dbi69ZAMcyPwbsSSbsNm4ZyBj+W6c0VV4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/me/memos/package.nix b/pkgs/by-name/me/memos/package.nix
index 97e48f88b0d9..517824d22319 100644
--- a/pkgs/by-name/me/memos/package.nix
+++ b/pkgs/by-name/me/memos/package.nix
@@ -61,8 +61,8 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/web";
-      hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
       fetcherVersion = 1;
+      hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
     };
     pnpmRoot = "web";
     nativeBuildInputs = [
diff --git a/pkgs/by-name/me/metacubexd/package.nix b/pkgs/by-name/me/metacubexd/package.nix
index 9ebf3530a5e9..00c766368b23 100644
--- a/pkgs/by-name/me/metacubexd/package.nix
+++ b/pkgs/by-name/me/metacubexd/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Ct/YLnpZb0YBXVaghd5W1bmDcjVRladwQNRoLagHgJo=";
     fetcherVersion = 1;
+    hash = "sha256-Ct/YLnpZb0YBXVaghd5W1bmDcjVRladwQNRoLagHgJo=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index de3ebc0f46f5..74c8548b6a20 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -179,11 +179,11 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "138.0.3351.77";
+  version = "138.0.3351.83";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-8D0aYlzkp5ol7s6m1342BJONiiQgyZeClREFw0mZqHY=";
+    hash = "sha256-NcDw2483l+VmBgr4Ue2vZmFFs3ZdWJvsfsub7stMEOE=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/mi/minio-certgen/package.nix b/pkgs/by-name/mi/minio-certgen/package.nix
index 3ab53dbac9ad..05e0c8b784c3 100644
--- a/pkgs/by-name/mi/minio-certgen/package.nix
+++ b/pkgs/by-name/mi/minio-certgen/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "minio-certgen";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "certgen";
     rev = "v${version}";
-    sha256 = "sha256-bYZfQeqPqroMkqJOqHri3l7xscEK9ml/oNLVPBVSDKk=";
+    sha256 = "sha256-Fuuq48+/ry6h9iA4WBXnahJp6EP640St84Tu6B86weI=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/mi/miniserve/package.nix b/pkgs/by-name/mi/miniserve/package.nix
index 34f88c26958e..b9558bade88c 100644
--- a/pkgs/by-name/mi/miniserve/package.nix
+++ b/pkgs/by-name/mi/miniserve/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "miniserve";
-  version = "0.29.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = "miniserve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HHTNBqMYf7WrqJl5adPmH87xfrzV4TKJckpwTPiiw7w=";
+    hash = "sha256-sSCS5jHhu0PBF/R3YqbR9krZghNNa2cPkLkK8kvWWd4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Rjql9cyw7RS66HE50iUrjNvS5JRhR1HBaalOY9eDGH4=";
+  cargoHash = "sha256-Gb1k4sd2/OV1GskFZBn7EapZTlhb9LK19lJHVP7uCK0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index 5c3838396187..7bb5af68c058 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.148.0",
+  "version": "3.149.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.148.0/mirrord_linux_x86_64",
-      "hash": "sha256-nQtpilOmYqji0hswq5KfG4mP5Jvtll+WTr5vcd/x1m8="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.149.0/mirrord_linux_x86_64",
+      "hash": "sha256-sRg0p9A8azjSSQLTltgfi62GaA0VI2bLKuL2P2hB2E8="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.148.0/mirrord_linux_aarch64",
-      "hash": "sha256-HOdX97d29VAiUy2W2bpnpvity+Kc3MD/+JwFgPCZfXI="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.149.0/mirrord_linux_aarch64",
+      "hash": "sha256-gbDNJh1rycJ/WzBA/wy6eLscjNQ7ktCV+CrlorCF95A="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.148.0/mirrord_mac_universal",
-      "hash": "sha256-fMlsuoqKv+9URHAfmhaCznHedknz9bFX4SCg3qU19JY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.149.0/mirrord_mac_universal",
+      "hash": "sha256-vUPuTc69yn71tLzSH6DdzWKc/yoHergglF7iL+R7PLE="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.148.0/mirrord_mac_universal",
-      "hash": "sha256-fMlsuoqKv+9URHAfmhaCznHedknz9bFX4SCg3qU19JY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.149.0/mirrord_mac_universal",
+      "hash": "sha256-vUPuTc69yn71tLzSH6DdzWKc/yoHergglF7iL+R7PLE="
     }
   }
 }
diff --git a/pkgs/by-name/mi/misconfig-mapper/package.nix b/pkgs/by-name/mi/misconfig-mapper/package.nix
index 9ff75fefa6a9..515893a91bd3 100644
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "misconfig-mapper";
-  version = "1.14.4";
+  version = "1.14.5";
 
   src = fetchFromGitHub {
     owner = "intigriti";
     repo = "misconfig-mapper";
     tag = "v${version}";
-    hash = "sha256-HLGBQugGg66wH3NFPDvFRRGdDscd+Vz6LHG8CYHqgYw=";
+    hash = "sha256-faIjS3B019eYefOIklJMuUVcCzkM3bHu/HJ1kaERtUA=";
   };
 
-  vendorHash = "sha256-GY3eRMj7YtuP/Bibf2e4fAOwGNe9TTadmOBpOxK4S6c=";
+  vendorHash = "sha256-mh66gH4ln/D2OWaD+VISTysszjpPGg2dHF29BD1i6z8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 09154c9cf804..d0199b2955ab 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -21,17 +21,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.7.0";
+  version = "2025.7.4";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-PIUw84xwR9m06fPkO7MYf95Q21YvYnBMi+MY+OOz+2k=";
+    hash = "sha256-l1Bce0CFhR5cyBnlNGy4KM8aqVntGkzRsi+Qh6KODQk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-5876Lc4rRNwTH8u5bMyV52Eps9QOcBHhE3v+33hzeBA=";
+  cargoHash = "sha256-ujZ6iPwsIlAFCfkZbGLqgLjvJMZE+ehKRw10NnwS7jE=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix
index 24eedc13aa62..e840b4491f51 100644
--- a/pkgs/by-name/mi/misskey/package.nix
+++ b/pkgs/by-name/mi/misskey/package.nix
@@ -37,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
   # https://nixos.org/manual/nixpkgs/unstable/#javascript-pnpm
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4=";
     fetcherVersion = 1;
+    hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/mo/moar/package.nix b/pkgs/by-name/mo/moar/package.nix
index 0f0ec6a9b724..8e0fbb53e35c 100644
--- a/pkgs/by-name/mo/moar/package.nix
+++ b/pkgs/by-name/mo/moar/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "moar";
-  version = "1.32.2";
+  version = "1.32.3";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moar";
     rev = "v${version}";
-    hash = "sha256-iv5rvIf/4bRgaFUNnXvANEynNUVQv4twK21ZJhpxLXU=";
+    hash = "sha256-gN5fP+eG3pDyQxOjqFcB9RuTjO+uDMsYLKdtwBVIQdI=";
   };
 
   vendorHash = "sha256-eKL6R2Xmj6JOwXGuJJdSGwobEzDzZ0FUD8deO2d1unc=";
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 747b703ae64c..5f7a5f0cb9c9 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -36,8 +36,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Q6e942R+3+511qFe4oehxdquw1TgaWMyOGOmP3me54o=";
     fetcherVersion = 1;
+    hash = "sha256-Q6e942R+3+511qFe4oehxdquw1TgaWMyOGOmP3me54o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/moonfire-nvr/package.nix b/pkgs/by-name/mo/moonfire-nvr/package.nix
index f28324dac034..b661f9a1f07e 100644
--- a/pkgs/by-name/mo/moonfire-nvr/package.nix
+++ b/pkgs/by-name/mo/moonfire-nvr/package.nix
@@ -32,8 +32,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/ui";
-      hash = "sha256-7fMhUFlV5lz+A9VG8IdWoc49C2CTdLYQlEgBSBqJvtw=";
       fetcherVersion = 1;
+      hash = "sha256-7fMhUFlV5lz+A9VG8IdWoc49C2CTdLYQlEgBSBqJvtw=";
     };
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index 12e4a6d63dab..ea7d0ad147f9 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     buildInputs = [ nodejs_22 ];
 
-    hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
     fetcherVersion = 1;
+    hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
   };
 
   env = {
diff --git a/pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch b/pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch
new file mode 100644
index 000000000000..f9b52f605dec
--- /dev/null
+++ b/pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch
@@ -0,0 +1,14 @@
+diff --git i/configure.ac w/configure.ac
+index dcc3c3d..888dc12 100644
+--- i/configure.ac
++++ w/configure.ac
+@@ -4,6 +4,9 @@ AC_INIT([mpDris2],
+ 	[mpdris2],
+ 	[https://github.com/eonpatapon/mpDris2])
+ AC_CONFIG_AUX_DIR([build-aux])
++AC_CONFIG_MACRO_DIRS([m4])
++AM_GNU_GETTEXT_VERSION([0.21])
++AM_GNU_GETTEXT([external])
+ AM_INIT_AUTOMAKE([1.11 tar-ustar foreign])
+ 
+ m4_ifdef([AM_SILENT_RULES],[AM_SILENT_RULES([yes])])
diff --git a/pkgs/by-name/mp/mpdris2/package.nix b/pkgs/by-name/mp/mpdris2/package.nix
index 77629454a09e..05935093bfb1 100644
--- a/pkgs/by-name/mp/mpdris2/package.nix
+++ b/pkgs/by-name/mp/mpdris2/package.nix
@@ -2,6 +2,7 @@
   lib,
   autoreconfHook,
   fetchFromGitHub,
+  gettext,
   glib,
   gobject-introspection,
   intltool,
@@ -28,6 +29,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     autoreconfHook
+    gettext
     gobject-introspection
     intltool
     wrapGAppsHook3
@@ -45,6 +47,8 @@ python3.pkgs.buildPythonApplication rec {
     pygobject3
   ];
 
+  patches = [ ./fix-gettext-0.25.patch ];
+
   meta = with lib; {
     description = "MPRIS 2 support for mpd";
     homepage = "https://github.com/eonpatapon/mpDris2/";
diff --git a/pkgs/applications/networking/msmtp/msmtpq-remove-binary-check.patch b/pkgs/by-name/ms/msmtp/msmtpq-remove-binary-check.patch
similarity index 100%
rename from pkgs/applications/networking/msmtp/msmtpq-remove-binary-check.patch
rename to pkgs/by-name/ms/msmtp/msmtpq-remove-binary-check.patch
diff --git a/pkgs/applications/networking/msmtp/msmtpq-systemd-logging.patch b/pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch
similarity index 70%
rename from pkgs/applications/networking/msmtp/msmtpq-systemd-logging.patch
rename to pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch
index a9db3e645808..55f386bb3190 100644
--- a/pkgs/applications/networking/msmtp/msmtpq-systemd-logging.patch
+++ b/pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch
@@ -1,17 +1,17 @@
 diff --git a/scripts/msmtpq/msmtpq b/scripts/msmtpq/msmtpq
-index bcb384e..dbaf1b5 100755
+index 28d0754..3eaac58 100755
 --- a/scripts/msmtpq/msmtpq
 +++ b/scripts/msmtpq/msmtpq
-@@ -92,6 +92,8 @@ if [ ! -v MSMTPQ_LOG ] ; then
-   fi
+@@ -182,6 +182,8 @@ if [ -n "$MSMTPQ_LOG" ] ; then
+   unset msmptq_log_dir
  fi
- [ -d "$(dirname "$MSMTPQ_LOG")" ] || mkdir -p "$(dirname "$MSMTPQ_LOG")"
-+
-+JOURNAL=@journal@
- ## ======================================================================================
  
- ## msmtpq can use the following environment variables :
-@@ -144,6 +146,7 @@ on_exit() {                          # unlock the queue on exit if the lock was
++JOURNAL=@journal@
++
+ umask 077                            # set secure permissions on created directories and files
+ 
+ declare -i CNT                       # a count of mail(s) currently in the queue
+@@ -214,6 +216,7 @@ on_exit() {                          # unlock the queue on exit if the lock was
  ## display msg to user, as well
  ##
  log() {
@@ -19,7 +19,7 @@ index bcb384e..dbaf1b5 100755
    local ARG RC PFX
    PFX="$('date' +'%Y %d %b %H:%M:%S')"
                                       # time stamp prefix - "2008 13 Mar 03:59:45 "
-@@ -161,10 +164,19 @@ log() {
+@@ -233,10 +236,19 @@ log() {
      done
    fi
  
diff --git a/pkgs/applications/networking/msmtp/default.nix b/pkgs/by-name/ms/msmtp/package.nix
similarity index 84%
rename from pkgs/applications/networking/msmtp/default.nix
rename to pkgs/by-name/ms/msmtp/package.nix
index 60946106d0dd..c801fa83ee9b 100644
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/by-name/ms/msmtp/package.nix
@@ -9,6 +9,7 @@
   bash,
   coreutils,
   gnugrep,
+  gnused,
   gnutls,
   gsasl,
   libidn2,
@@ -20,6 +21,8 @@
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
   systemd,
   withScripts ? true,
+  withLibnotify ? true,
+  libnotify,
   gitUpdater,
   binlore,
   msmtp,
@@ -28,13 +31,13 @@
 let
   inherit (lib) getBin getExe optionals;
 
-  version = "1.8.26";
+  version = "1.8.30";
 
   src = fetchFromGitHub {
     owner = "marlam";
     repo = "msmtp";
     rev = "msmtp-${version}";
-    hash = "sha256-MV3fzjjyr7qZw/BbKgsSObX+cxDDivI+0ZlulrPFiWM=";
+    hash = "sha256-aM2qId08zvT9LbncCQYHsklbvHVtcZJgr91JTjwpQ/0=";
   };
 
   meta = with lib; {
@@ -112,13 +115,17 @@ let
       msmtpq = {
         scripts = [ "bin/msmtpq" ];
         interpreter = getExe bash;
-        inputs = [
-          binaries
-          coreutils
-          gnugrep
-          netcat-gnu
-          which
-        ] ++ optionals withSystemd [ systemd ];
+        inputs =
+          [
+            binaries
+            coreutils
+            gnugrep
+            gnused
+            netcat-gnu
+            which
+          ]
+          ++ optionals withSystemd [ systemd ]
+          ++ optionals withLibnotify [ libnotify ];
         execer =
           [
             "cannot:${getBin binaries}/bin/msmtp"
@@ -126,9 +133,15 @@ let
           ]
           ++ optionals withSystemd [
             "cannot:${getBin systemd}/bin/systemd-cat"
+          ]
+          ++ optionals withLibnotify [
+            "cannot:${getBin libnotify}/bin/notify-send"
           ];
         fix."$MSMTP" = [ "msmtp" ];
-        fake.external = [ "ping" ] ++ optionals (!withSystemd) [ "systemd-cat" ];
+        fake.external =
+          [ "ping" ]
+          ++ optionals (!withSystemd) [ "systemd-cat" ]
+          ++ optionals (!withLibnotify) [ "notify-send" ];
         keep.source = [ "~/.msmtpqrc" ];
       };
 
diff --git a/pkgs/by-name/mt/mtail/package.nix b/pkgs/by-name/mt/mtail/package.nix
index c47c61f2055f..2ae645bc2eb2 100644
--- a/pkgs/by-name/mt/mtail/package.nix
+++ b/pkgs/by-name/mt/mtail/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "mtail";
-  version = "3.2.5";
+  version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${version}";
-    hash = "sha256-T81eLshaHqbLj4X0feWJE+VEWItmOxcVCQX04zl3jeA=";
+    hash = "sha256-rQ4Psm3sdKIIvmulPjE2DvRtf/HlriacWT6xEvm504U=";
   };
 
-  vendorHash = "sha256-Q3Fj73sQAmZQ9OF5hI0t1iPkY8u189PZ4LlzW34NQx0=";
+  vendorHash = "sha256-KZOcmZGv1kI9eDhQdtQeQ3ITyEw9vEDPz4RAz30pP9s=";
 
   nativeBuildInputs = [
     gotools # goyacc
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index 4939b5d66195..0be17c7a2aff 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -9,14 +9,14 @@
 
 buildGoModule rec {
   pname = "museum";
-  version = "1.1.53";
+  version = "1.1.57";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     rev = "photos-v${version}";
-    hash = "sha256-lgxgtxRV4jRnOwlgX1jY6CrgVF0pSvoW5fVEU3L0jMY=";
+    hash = "sha256-801wTTxruhZc18+TAPSYrBRtCPNZXwSKs2Hkvc/6BjM=";
   };
 
   vendorHash = "sha256-px4pMqeH73Fe06va4+n6hklIUDMbPmAQNKKRIhwv6ec=";
diff --git a/pkgs/by-name/my/mydumper/package.nix b/pkgs/by-name/my/mydumper/package.nix
index 6298d806aefe..a282673f5243 100644
--- a/pkgs/by-name/my/mydumper/package.nix
+++ b/pkgs/by-name/my/mydumper/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mydumper";
-  version = "0.19.3-2";
+  version = "0.19.3-3";
 
   src = fetchFromGitHub {
     owner = "mydumper";
     repo = "mydumper";
     tag = "v${version}";
-    hash = "sha256-Vm2WOx35QmiGBHnOckNw0mMS95aHrcNO4c1ptCYF7c4=";
+    hash = "sha256-CrjI6jwktBxKn7hgL8+pCikbtCFUK6z90Do9fWmLZlQ=";
     # as of mydumper v0.16.5-1, mydumper extracted its docs into a submodule
     fetchSubmodules = true;
   };
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 591307ed01be..046afbd33c40 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
     fetcherVersion = 1;
+    hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/na/naabu/package.nix b/pkgs/by-name/na/naabu/package.nix
index 1255a198b1d3..a74a2ad81fe0 100644
--- a/pkgs/by-name/na/naabu/package.nix
+++ b/pkgs/by-name/na/naabu/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "naabu";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "naabu";
     tag = "v${version}";
-    hash = "sha256-Xri3kdpK1oPb2doL/x7PkZQBtFugesbNX3GGc/w3GY8=";
+    hash = "sha256-UHjWO/uCfUF6xylfYLbwiMwpNwZvlNoVRzRhRFxfqck=";
   };
 
-  vendorHash = "sha256-HpkFUHD3B09nxGK75zELTsjr4wXivY2o/DCjYSDepRI=";
+  vendorHash = "sha256-wl0BqZXd7NRNBY3SCLOwfwa3e91ar5JX6lxtkQChXHM=";
 
   buildInputs = [ libpcap ];
 
diff --git a/pkgs/by-name/na/naev/package.nix b/pkgs/by-name/na/naev/package.nix
index 970af62c4330..a988a316c909 100644
--- a/pkgs/by-name/na/naev/package.nix
+++ b/pkgs/by-name/na/naev/package.nix
@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "naev";
-  version = "0.12.5";
+  version = "0.12.6";
 
   src = fetchFromGitHub {
     owner = "naev";
     repo = "naev";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-I+OU3sr+C8HPnJTQ+Cc/EvshzawqikoMg3cp9uQ5dSQ=";
+    hash = "sha256-Phes5d7q1PgviwKFcvDvm9xregcbj2NTTPdmbaXJ19Y=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/nc/ncspot/package.nix b/pkgs/by-name/nc/ncspot/package.nix
index 84ddcf446fa3..78e6958f4acf 100644
--- a/pkgs/by-name/nc/ncspot/package.nix
+++ b/pkgs/by-name/nc/ncspot/package.nix
@@ -33,16 +33,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ncspot";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4zeBTi1WBy9tXowsehUo4qou6bhznWPeCXFg+R3akho=";
+    hash = "sha256-FSMQv2443oPQjMSv68ppfI2ZTUG79b+GcXmHNAmjPZk=";
   };
 
-  cargoHash = "sha256-c16qw2khbMXTA8IbYQnMKqivO63DwyAWKfV2P1aD7dU=";
+  cargoHash = "sha256-Qjsn3U9KZr5qZliJ/vbudfkH1uOng1N5c8dAyH+Y5vQ=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withClipboard python3;
 
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index 2c22d7a2a4de..39aa18c513bf 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation (
   in
   {
     pname = "neovim-unwrapped";
-    version = "0.11.2";
+    version = "0.11.3";
 
     __structuredAttrs = true;
 
@@ -103,7 +103,7 @@ stdenv.mkDerivation (
       owner = "neovim";
       repo = "neovim";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-sNunEdIFrSMqYaNg0hbrSXALRQXxFkdDOl/hhX1L1WA=";
+      hash = "sha256-B/An+SiRWC3Ea0T/sEk8aNBS1Ab9OENx/l4Z3nn8xE4=";
     };
 
     patches = [
diff --git a/pkgs/by-name/ni/ni/package.nix b/pkgs/by-name/ni/ni/package.nix
index c943ebba7215..7f2bf48eaa9f 100644
--- a/pkgs/by-name/ni/ni/package.nix
+++ b/pkgs/by-name/ni/ni/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-gDBjAwut217mdbWyk/dSU4JOkoRbOk4Czlb/lXhWqRU=";
     fetcherVersion = 1;
+    hash = "sha256-gDBjAwut217mdbWyk/dSU4JOkoRbOk4Czlb/lXhWqRU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ni/nimble/package.nix b/pkgs/by-name/ni/nimble/package.nix
index 42c0ccf50833..1f1c2ff6fd68 100644
--- a/pkgs/by-name/ni/nimble/package.nix
+++ b/pkgs/by-name/ni/nimble/package.nix
@@ -12,13 +12,13 @@
 buildNimPackage (
   final: prev: {
     pname = "nimble";
-    version = "0.18.2";
+    version = "0.20.0";
 
     src = fetchFromGitHub {
       owner = "nim-lang";
       repo = "nimble";
       rev = "v${final.version}";
-      hash = "sha256-wgzFhModFkwB8st8F5vSkua7dITGGC2cjoDvgkRVZMs=";
+      hash = "sha256-XcXdhEtwnsHZGBTt1xU7HaJK2qyJ0s2xxk2O3XkbTXQ=";
       fetchSubmodules = true;
     };
 
diff --git a/pkgs/by-name/ni/nix-fast-build/package.nix b/pkgs/by-name/ni/nix-fast-build/package.nix
index 0996d4a98b41..90ea52a3f504 100644
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -6,6 +6,7 @@
   nix-eval-jobs,
   nix-output-monitor,
   nix-update-script,
+  bashInteractive,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -28,6 +29,7 @@ python3Packages.buildPythonApplication rec {
         [
           nix-eval-jobs
           nix-eval-jobs.nix
+          bashInteractive
         ]
         ++ lib.optional (lib.meta.availableOn stdenv.buildPlatform nix-output-monitor.compiler) nix-output-monitor
       )
diff --git a/pkgs/by-name/ni/nixos-facter/package.nix b/pkgs/by-name/ni/nixos-facter/package.nix
index f762d2f78a22..8c519a65256f 100644
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@@ -23,13 +23,13 @@ let
 in
 buildGoModule rec {
   pname = "nixos-facter";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nixos-facter";
-    rev = "v${version}";
-    hash = "sha256-SuD6FTyCGT+H5uEPkPmBSI00R87weAoO5xZHPJElSu8=";
+    tag = "v${version}";
+    hash = "sha256-4kER7CyFvMKVpKxCYHuf9fkkYVzVK9AWpF55cBNzPc0=";
   };
 
   vendorHash = "sha256-A7ZuY8Gc/a0Y8O6UG2WHWxptHstJOxi4n9F8TY6zqiw=";
diff --git a/pkgs/by-name/nw/nwg-clipman/package.nix b/pkgs/by-name/nw/nwg-clipman/package.nix
index 03d3b5bcab7b..30e97da20f82 100644
--- a/pkgs/by-name/nw/nwg-clipman/package.nix
+++ b/pkgs/by-name/nw/nwg-clipman/package.nix
@@ -13,14 +13,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "nwg-clipman";
-  version = "0.2.6";
+  version = "0.2.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-clipman";
     tag = "v${version}";
-    hash = "sha256-FB+NerU3CfGru7vDBQflAzgtO7gt8cjgyC9O3zCa2ss=";
+    hash = "sha256-EBxt1OSwddlMIwEqc89rzak3jhPwOhZ61Rz5l2LU2kY=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/nw/nwg-drawer/package.nix b/pkgs/by-name/nw/nwg-drawer/package.nix
index e31155c69989..6014dd10e6ee 100644
--- a/pkgs/by-name/nw/nwg-drawer/package.nix
+++ b/pkgs/by-name/nw/nwg-drawer/package.nix
@@ -13,13 +13,13 @@
 
 let
   pname = "nwg-drawer";
-  version = "0.7.1";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-drawer";
     rev = "v${version}";
-    hash = "sha256-vORjD6nMy0h2Udo6Sy6aD0td+sLBUusDRiuT6jssais=";
+    hash = "sha256-5e0NQ3A8KXnXAYma42JPvS6RLocFOTe76tPSFdg97NM=";
   };
 
   vendorHash = "sha256-ftE8u0m1KGyEdLVbmpFKCeuDFnBcY3AyqmWNGPST27k=";
diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index 13f7f529a92f..ae21c462c22d 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.10.8";
+  version = "0.10.10";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${version}";
-    hash = "sha256-DU9G11lR0nENE29yAsix946mmexLFK3eoqjZcyKYOH8=";
+    hash = "sha256-fZjjfblXFyB4npcv5xKXGqnqNCAdmvJTErI+0PcuaPk=";
   };
 
   # No tests
diff --git a/pkgs/by-name/oc/ocis/package.nix b/pkgs/by-name/oc/ocis/package.nix
index a03c50f4734f..c00d6bb28f4c 100644
--- a/pkgs/by-name/oc/ocis/package.nix
+++ b/pkgs/by-name/oc/ocis/package.nix
@@ -50,8 +50,8 @@ buildGoModule rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     sourceRoot = "${src.name}/services/idp";
-    hash = "sha256-gNlN+u/bobnTsXrsOmkDcWs67D/trH3inT5AVQs3Brs=";
     fetcherVersion = 1;
+    hash = "sha256-gNlN+u/bobnTsXrsOmkDcWs67D/trH3inT5AVQs3Brs=";
   };
   pnpmRoot = "services/idp";
 
diff --git a/pkgs/by-name/oc/ocis/web.nix b/pkgs/by-name/oc/ocis/web.nix
index 14b407470371..73ae19b50409 100644
--- a/pkgs/by-name/oc/ocis/web.nix
+++ b/pkgs/by-name/oc/ocis/web.nix
@@ -36,8 +36,8 @@ stdenvNoCC.mkDerivation rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-3Erva6srdkX1YQ727trx34Ufx524nz19MUyaDQToz6M=";
     fetcherVersion = 1;
+    hash = "sha256-3Erva6srdkX1YQ727trx34Ufx524nz19MUyaDQToz6M=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix
index 21eb3657b331..775586a951ff 100644
--- a/pkgs/by-name/ol/olivetin/package.nix
+++ b/pkgs/by-name/ol/olivetin/package.nix
@@ -81,18 +81,18 @@ buildGoModule (
 
   {
     pname = "olivetin";
-    version = "2025.6.22";
+    version = "2025.7.13";
 
     src = fetchFromGitHub {
       owner = "OliveTin";
       repo = "OliveTin";
       tag = finalAttrs.version;
-      hash = "sha256-fNE8x0d0lnKVxy4fk3h5QrcWnMKBcxhrxpDbZYTXimc=";
+      hash = "sha256-/KylnGxamyhrvLNHAIcBUcDWU+Agizg7tlMOv6qnpCI=";
     };
 
     modRoot = "service";
 
-    vendorHash = "sha256-8rPJoB75de2Y56iyIwdI9HPk7OlCgfMPy28TW1i7+sU=";
+    vendorHash = "sha256-mI17WV+U4wbcZhSymX4NnxwvHqQNehubrvH9CxXe4/o=";
 
     ldflags = [
       "-s"
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 1e5d79cdb81b..ee48d94116c3 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -117,13 +117,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QP70s6gPL1GJv5G4VhYwWpf5raRIcOVsjPq3Jdw89eU=";
+    hash = "sha256-fVbHz/Sa3aSIYBic3lNQl5iUYo+9LHIk52vO9mx6XRE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ol/olympus-unwrapped/package.nix b/pkgs/by-name/ol/olympus-unwrapped/package.nix
index 8153c5cec67b..b1125c5cbdd7 100644
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -31,9 +31,9 @@ let
 
   phome = "$out/lib/olympus";
   # The following variables are to be updated by the update script.
-  version = "25.06.28.03";
-  buildId = "4925"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "1671a4e90da4f8cd565712ed5344bd4e01cf29a1";
+  version = "25.07.12.01";
+  buildId = "4934"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "17634d29b91b737580c878ba96f73bd077fbfba0";
 in
 buildDotnetModule {
   pname = "olympus-unwrapped";
@@ -44,7 +44,7 @@ buildDotnetModule {
     owner = "EverestAPI";
     repo = "Olympus";
     fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-TgtokrUt15k7SxjPcIFIbv2QL+hgB0cIZYb3oG/l/GI=";
+    hash = "sha256-Z6OWO6WCHhmmGI8dF23yiLNBy11Mutu941jY/0pxIkQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/open-fprintd/package.nix b/pkgs/by-name/op/open-fprintd/package.nix
index b15b225060ef..740b2ce33766 100644
--- a/pkgs/by-name/op/open-fprintd/package.nix
+++ b/pkgs/by-name/op/open-fprintd/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "open-fprintd";
-  version = "0.6";
+  version = "0.7";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "uunicorn";
     repo = "open-fprintd";
     rev = version;
-    hash = "sha256-uVFuwtsmR/9epoqot3lJ/5v5OuJjuRjL7FJF7oXNDzU=";
+    hash = "sha256-4TraOKvBc7ddqcY73aCuKgfwx4fNoaPHVG8so8Dc5Bw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openasar/package.nix b/pkgs/by-name/op/openasar/package.nix
index d37f6feb246a..d17c378fabb2 100644
--- a/pkgs/by-name/op/openasar/package.nix
+++ b/pkgs/by-name/op/openasar/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openasar";
-  version = "0-unstable-2025-01-20";
+  version = "0-unstable-2025-07-14";
 
   src = fetchFromGitHub {
     owner = "GooseMod";
     repo = "OpenAsar";
-    rev = "e88eebf440866a06f3eca3b4fe2a8cc07818ee61";
-    hash = "sha256-SejlIm9AIK09grP8j5h0O8DxIv85zGssr170xskGx2I=";
+    rev = "e6991e30910b4019bff1ad6e1934534ad546831e";
+    hash = "sha256-COz3X2sYSYnd436pOjiHgpYxQbn6hRCo8AefPzv5hTs=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
index fa1c4dfeb595..bd481954f09d 100644
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -16,8 +16,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
-    hash = "sha256-yseRO1tClLTRpQj5BzMscElUlgLEzj1u8ndT1+di2+Y=";
     fetcherVersion = 1;
+    hash = "sha256-NW7HK2B9h5JprK3JcIGi/OHcyoa5VTs/P0s3BZr+4FU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 38b2c3b12e95..943bc71569ce 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule rec {
   pname = "opencloud";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${version}";
-    hash = "sha256-hWd/x+HRuU39j4F2bC0RbhFJEyjlKIknAYGArcdGEoM=";
+    hash = "sha256-QHx97pEsAIj0F46vAPv/fuSc0sfUP7BYfMVCE1mE3co=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index 38b796df4115..3b2ab9c9661d 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -9,19 +9,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1LcOvpVVhBkY2ek67ME2rHqdYo5Ud2oWQC6rjxQX3Ng=";
+    hash = "sha256-nFiYnZ+um1J0pf0Dr0P1ZBeTeZnxOQc0ILEyhFF2kQw=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-7wwviWveMf+xnYmO05MI3XuPVZ/pcSqQi4sGjrEdjGc=";
     fetcherVersion = 1;
+    hash = "sha256-vxZxwbJByTk45GDD2FNphMMdeLlF8uxyrlc9x42crNA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openimageio/package.nix b/pkgs/by-name/op/openimageio/package.nix
index 2605eb20d5fe..b7d9675c52ea 100644
--- a/pkgs/by-name/op/openimageio/package.nix
+++ b/pkgs/by-name/op/openimageio/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openimageio";
-  version = "3.0.8.0";
+  version = "3.0.8.1";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenImageIO";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-94DGol32IPAu9QKRMFjAoGLMfV7x6eXGGqpOxzYh/Ww=";
+    hash = "sha256-GbjkFij8d5a/pxNYckCs+McMAHh+NiGAaxAaZYjj7jY=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix
index 28a8aff7ea19..6f0ac2f559c4 100644
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -32,8 +32,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
     fetcherVersion = 1;
+    hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/op/openobserve/build.rs.patch b/pkgs/by-name/op/openobserve/build.rs.patch
index 1cfb91c7c12b..70e89ec2c873 100644
--- a/pkgs/by-name/op/openobserve/build.rs.patch
+++ b/pkgs/by-name/op/openobserve/build.rs.patch
@@ -1,11 +1,11 @@
 diff --git a/build.rs b/build.rs
 index 0f66ace..be74fad 100644
---- a/build.rs
-+++ b/build.rs
-@@ -99,24 +99,5 @@ fn main() -> Result<()> {
-         &["proto"],
-     )?;
- 
+--- a/src/config/build.rs
++++ b/src/config/build.rs
+@@ -20,24 +20,5 @@ use chrono::{DateTime, SecondsFormat, Utc};
+ fn main() -> Result<()> {
+     println!("cargo:rerun-if-changed=build.rs");
+
 -    // build information
 -    let output = Command::new("git")
 -        .args(["describe", "--tags", "--abbrev=0"])
diff --git a/pkgs/by-name/op/openobserve/package.nix b/pkgs/by-name/op/openobserve/package.nix
index 6684c7d4f1e9..8472b1700e23 100644
--- a/pkgs/by-name/op/openobserve/package.nix
+++ b/pkgs/by-name/op/openobserve/package.nix
@@ -15,12 +15,12 @@
 }:
 
 let
-  version = "0.14.0";
+  version = "0.14.7";
   src = fetchFromGitHub {
     owner = "openobserve";
     repo = "openobserve";
     tag = "v${version}";
-    hash = "sha256-rTp+DkADqYkJg1zJog1yURE082V5kCqgid/oUd81SN8=";
+    hash = "sha256-+YcVTn/jcEbaqTycMCYn6B0z2HsvgrCY1gHnkRajwSs=";
   };
   web = buildNpmPackage {
     inherit src version;
@@ -28,7 +28,7 @@ let
 
     sourceRoot = "${src.name}/web";
 
-    npmDepsHash = "sha256-awfQR1wZBX3ggmD0uJE9Fur4voPydeygrviRijKnBTE=";
+    npmDepsHash = "sha256-1MUmAWkeYUEL6WZGq1Jg5W2uKa2xj0oZbGlIbvZWT1E=";
 
     preBuild = ''
       # Patch vite config to not open the browser to visualize plugin composition
@@ -64,7 +64,7 @@ rustPlatform.buildRustPackage {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FWMUPghx9CxuzP7jFZYSIwZsylApWzQsfx8DuwS4GTo=";
+  cargoHash = "sha256-vfc6B+Uc8RXQD8vGC1yV9w5YAefkYJMpCH2frqjrSWk=";
 
   nativeBuildInputs = [
     pkg-config
@@ -96,6 +96,7 @@ rustPlatform.buildRustPackage {
   checkFlags = [
     "--skip=handler::http::router::tests::test_get_proxy_routes"
     "--skip=tests::e2e_test"
+    "--skip=service::organization::tests::test_organization"
   ];
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/by-name/op/openpgp-card-tools/package.nix b/pkgs/by-name/op/openpgp-card-tools/package.nix
index cb6c21ceb2f3..3cc6e76e7aea 100644
--- a/pkgs/by-name/op/openpgp-card-tools/package.nix
+++ b/pkgs/by-name/op/openpgp-card-tools/package.nix
@@ -13,18 +13,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "openpgp-card-tools";
-  version = "0.11.9";
+  version = "0.11.10";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "openpgp-card";
     repo = "openpgp-card-tools";
     rev = "v${version}";
-    hash = "sha256-kT/egkOBOomUX+fwT3OeRSZOnGeuFRLKKAXtW8nN4rw=";
+    hash = "sha256-1sm/zaKhUPMGdYg8sX/IXAI4vIRRZezSD89rljG4S/Y=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-mZZ8veY3iqsgScfFAGYo496qxTew24R5NxYf3WjnHco=";
+  cargoHash = "sha256-S+TOSUh/sr647aUBjo+aaZgVrrOubwa+XVFcwNBOxmI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/op/opentofu/package.nix b/pkgs/by-name/op/opentofu/package.nix
index 883363ebbf2a..f91885db49f4 100644
--- a/pkgs/by-name/op/opentofu/package.nix
+++ b/pkgs/by-name/op/opentofu/package.nix
@@ -15,13 +15,13 @@
 let
   package = buildGoModule rec {
     pname = "opentofu";
-    version = "1.10.2";
+    version = "1.10.3";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       tag = "v${version}";
-      hash = "sha256-kRIj6M5/HfuzYrFV9ygyZsbVrHqvmqPo40XLcsNg7fU=";
+      hash = "sha256-2Z2PM1ahkvwtrkfTkVF6wSyk/BI17Ys8CIlB1Xd+fhI=";
     };
 
     vendorHash = "sha256-npMGiUIDhp4n7nKMWeyq+TDggU1xm5RzQrGOxvzWcnI=";
diff --git a/pkgs/by-name/ov/overlayed/package.nix b/pkgs/by-name/ov/overlayed/package.nix
index 8aa00be38990..48068c6454c4 100644
--- a/pkgs/by-name/ov/overlayed/package.nix
+++ b/pkgs/by-name/ov/overlayed/package.nix
@@ -35,8 +35,8 @@ rustPlatform.buildRustPackage rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-+yyxoodcDfqJ2pkosd6sMk77/71RDsGthedo1Oigwto=";
     fetcherVersion = 1;
+    hash = "sha256-+yyxoodcDfqJ2pkosd6sMk77/71RDsGthedo1Oigwto=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ow/owi/package.nix b/pkgs/by-name/ow/owi/package.nix
index 65d1729540ef..18ce88812f6e 100644
--- a/pkgs/by-name/ow/owi/package.nix
+++ b/pkgs/by-name/ow/owi/package.nix
@@ -10,18 +10,18 @@
 }:
 
 let
-  ocamlPackages = ocaml-ng.ocamlPackages_5_1;
+  ocamlPackages = ocaml-ng.ocamlPackages_5_2;
 in
 ocamlPackages.buildDunePackage rec {
   pname = "owi";
-  version = "0.2-unstable-2025-05-05";
+  version = "0.2-unstable-2025-07-08";
 
   src = fetchFromGitHub {
     owner = "ocamlpro";
     repo = "owi";
-    rev = "e4c2e85f1364714a77a925ec29321cf9b8fe90f4";
+    rev = "bcd7d362ed165c542deb2d49da1d45296aa03277";
     fetchSubmodules = true;
-    hash = "sha256-ewaAkSyxtiiE8WcHusOyZDesqI61kCEN3pMb99R7Dkw=";
+    hash = "sha256-611k9CQx0C3QKR4NZpnr77LoBZSFBEdU0uRnZshO1cc=";
   };
 
   nativeBuildInputs = with ocamlPackages; [
@@ -32,9 +32,9 @@ ocamlPackages.buildDunePackage rec {
     llvmPackages.clang-unwrapped
     # lld + llc isn't included in unwrapped, so we pull it in here
     llvmPackages.bintools-unwrapped
+    makeWrapper
     rustc
     zig
-    makeWrapper
   ];
 
   buildInputs = with ocamlPackages; [
@@ -46,14 +46,11 @@ ocamlPackages.buildDunePackage rec {
     dune-site
     hc
     integers
-    menhir
     menhirLib
     ocaml_intrinsics
     patricia-tree
     prelude
     processor
-    pyml
-    re2
     scfg
     sedlex
     smtml
diff --git a/pkgs/by-name/ow/owncloud-client/package.nix b/pkgs/by-name/ow/owncloud-client/package.nix
index 3ee82ec6f1cc..5d380ca54a42 100644
--- a/pkgs/by-name/ow/owncloud-client/package.nix
+++ b/pkgs/by-name/ow/owncloud-client/package.nix
@@ -15,7 +15,6 @@
   kdsingleapplication,
   ## darwin only
   libinotify-kqueue,
-  sparkleshare,
 }:
 
 stdenv.mkDerivation rec {
@@ -49,7 +48,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libinotify-kqueue
-      sparkleshare
     ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index e3a29e4f5e05..dd50cf82562e 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -69,8 +69,8 @@ let
 
       pnpmDeps = pnpm.fetchDeps {
         inherit pname version src;
-        hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
         fetcherVersion = 1;
+        hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
       };
 
       nativeBuildInputs =
diff --git a/pkgs/by-name/pa/parca/package.nix b/pkgs/by-name/pa/parca/package.nix
index 7a32df1ea4f0..ef36a0be3aa5 100644
--- a/pkgs/by-name/pa/parca/package.nix
+++ b/pkgs/by-name/pa/parca/package.nix
@@ -24,8 +24,8 @@ let
 
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname src version;
-      hash = "sha256-gczEkCU9xESn9T1eVOmGAufh+24mOsYCMO6f5tcbdmQ=";
       fetcherVersion = 1;
+      hash = "sha256-gczEkCU9xESn9T1eVOmGAufh+24mOsYCMO6f5tcbdmQ=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/pc/pcsx2-bin/package.nix b/pkgs/by-name/pc/pcsx2-bin/package.nix
index b9c8c0f3880c..7310b25301d5 100644
--- a/pkgs/by-name/pc/pcsx2-bin/package.nix
+++ b/pkgs/by-name/pc/pcsx2-bin/package.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pcsx2-bin";
-  version = "2.3.180";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "https://github.com/PCSX2/pcsx2/releases/download/v${finalAttrs.version}/pcsx2-v${finalAttrs.version}-macos-Qt.tar.xz";
-    hash = "sha256-FsYVTqQ9Se6SoSbHGUw8eLd6Y9ywaedlBy9fu/FYr7g=";
+    hash = "sha256-nExKu5WwBVxUA8P3DZ7SVln5zORXcR3lM/gWjFxgAV8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/pc/pcsx2-bin/update.sh b/pkgs/by-name/pc/pcsx2-bin/update.sh
index 8748a75a3bbc..943d2693d201 100755
--- a/pkgs/by-name/pc/pcsx2-bin/update.sh
+++ b/pkgs/by-name/pc/pcsx2-bin/update.sh
@@ -6,7 +6,7 @@ set -euo pipefail
 cd "$(dirname "$0")" || exit 1
 
 # Grab latest version, ignoring "latest" and "preview" tags
-LATEST_VER="$(curl --fail -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/PCSX2/pcsx2/releases" | jq -r '.[0].tag_name' | sed 's/^v//')"
+LATEST_VER="$(curl --fail -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/PCSX2/pcsx2/releases/latest" | jq -r '.tag_name' | sed 's/^v//')"
 CURRENT_VER="$(grep -oP 'version = "\K[^"]+' package.nix)"
 
 if [[ "$LATEST_VER" == "$CURRENT_VER" ]]; then
diff --git a/pkgs/by-name/pd/pds/package.nix b/pkgs/by-name/pd/pds/package.nix
index 5fdc7aaea121..efc4fdf95d0f 100644
--- a/pkgs/by-name/pd/pds/package.nix
+++ b/pkgs/by-name/pd/pds/package.nix
@@ -50,8 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
     fetcherVersion = 1;
+    hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/pe/peergos/package.nix b/pkgs/by-name/pe/peergos/package.nix
index a6153c9ae14c..191f3e1907df 100644
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@@ -41,12 +41,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "peergos";
-  version = "1.7.1";
+  version = "1.8.0";
   src = fetchFromGitHub {
     owner = "Peergos";
     repo = "web-ui";
     rev = "v${version}";
-    hash = "sha256-gafFkHgTDBBon5fxjZwDGhEPyk6bp2XL4DxAWKtpWzo=";
+    hash = "sha256-bvuJ/Z/GVBohUX7dgpx77QdWUEW0eI8FUAGUibOmaM0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pg/pgrok/package.nix b/pkgs/by-name/pg/pgrok/package.nix
index 7dc9a44a034f..cff0a849af48 100644
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@@ -33,8 +33,8 @@ buildGoModule {
 
   env.pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-o6wxO8EGRmhcYggJnfxDkH+nbt+isc8bfHji8Hu9YKg=";
     fetcherVersion = 1;
+    hash = "sha256-o6wxO8EGRmhcYggJnfxDkH+nbt+isc8bfHji8Hu9YKg=";
   };
 
   vendorHash = "sha256-nIxsG1O5RG+PDSWBcUWpk+4aFq2cYaxpkgOoDqLjY90=";
diff --git a/pkgs/by-name/pi/piped/package.nix b/pkgs/by-name/pi/piped/package.nix
index 374063af3be6..8bb53c6754c7 100644
--- a/pkgs/by-name/pi/piped/package.nix
+++ b/pkgs/by-name/pi/piped/package.nix
@@ -28,8 +28,8 @@ buildNpmPackage rec {
   npmDeps = pnpmDeps;
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-WtZfRZFRV9I1iBlAoV69GGFjdiQhTSBG/iiEadPVcys=";
     fetcherVersion = 1;
+    hash = "sha256-WtZfRZFRV9I1iBlAoV69GGFjdiQhTSBG/iiEadPVcys=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix b/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
index cebcd29e5a77..75866f2be064 100644
--- a/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
+++ b/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plasma-plugin-blurredwallpaper";
-  version = "3.2.1";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "bouteillerAlan";
     repo = "blurredwallpaper";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P/N7g/cl2K0R4NKebfqZnr9WQkHPSvHNbKbWiOxs76k=";
+    hash = "sha256-hXuJhSS5QEgKWn60ctF3N+avfez8Ktrne3re/FY/VMU=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pl/plutovg/package.nix b/pkgs/by-name/pl/plutovg/package.nix
index 7e795b499e6e..b6bea9349aec 100644
--- a/pkgs/by-name/pl/plutovg/package.nix
+++ b/pkgs/by-name/pl/plutovg/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "plutovg";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "sammycage";
     repo = "plutovg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-989MA60nc1Tzp/4RzT0iYHz4JBJkU9zgEjEswa4vDpk=";
+    hash = "sha256-+LJhQb8uZ7iPNcdhL40LLk/6mR97VCgDtYgnj2R8vno=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 2a84d1d207e2..d201751f4847 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -60,8 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-8lNmCLfuAkXK1Du4iYYasRTozZf0HoAttf8Dfc6Jglw=";
     fetcherVersion = 1;
+    hash = "sha256-8lNmCLfuAkXK1Du4iYYasRTozZf0HoAttf8Dfc6Jglw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/po/polarity/package.nix b/pkgs/by-name/po/polarity/package.nix
index 0dc56dbf950a..22f702f68936 100644
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "polarity";
-  version = "latest-unstable-2025-07-06";
+  version = "latest-unstable-2025-07-15";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "f95159a91c712984a51103ea6b6f32ed7f59f4df";
-    hash = "sha256-iKhxvJtVeTIFQUgtlLPBH9Swvw8om61FxwahOov9xDs=";
+    rev = "83bd1bd5bc461421115333e423f45a7735782638";
+    hash = "sha256-+l3pS8IpPvebpX++ezcC05X06f+NnBZBsNVXEHTYh6A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bQVZEYQ9KRiG+DAl1XAEjhuXg+Rtt65srwL9yXBYhf0=";
+  cargoHash = "sha256-SXGuf/JaBfPZgbCAfRmC2Gd82kOn54VQrc7FdmVJRuA=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/po/pop-gtk-theme/package.nix b/pkgs/by-name/po/pop-gtk-theme/package.nix
index ffcd53531128..da11dd534d50 100644
--- a/pkgs/by-name/po/pop-gtk-theme/package.nix
+++ b/pkgs/by-name/po/pop-gtk-theme/package.nix
@@ -12,6 +12,7 @@
   gdk-pixbuf,
   librsvg,
   python3,
+  buildPackages,
 }:
 
 stdenv.mkDerivation {
@@ -50,9 +51,9 @@ stdenv.mkDerivation {
     for file in $(find -name render-\*.sh); do
       substituteInPlace "$file" \
         --replace 'INKSCAPE="/usr/bin/inkscape"' \
-                  'INKSCAPE="${inkscape}/bin/inkscape"' \
+                  'INKSCAPE="${buildPackages.inkscape}/bin/inkscape"' \
         --replace 'OPTIPNG="/usr/bin/optipng"' \
-                  'OPTIPNG="${optipng}/bin/optipng"'
+                  'OPTIPNG="${buildPackages.optipng}/bin/optipng"'
     done
   '';
 
diff --git a/pkgs/by-name/po/porn-vault/package.nix b/pkgs/by-name/po/porn-vault/package.nix
index 7dd5e251116c..fb0a58df550f 100644
--- a/pkgs/by-name/po/porn-vault/package.nix
+++ b/pkgs/by-name/po/porn-vault/package.nix
@@ -51,8 +51,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Xr9tRiP1hW+aFs9FnPvPkeJ0/LtJI57cjWY5bZQaRTQ=";
     fetcherVersion = 1;
+    hash = "sha256-Xr9tRiP1hW+aFs9FnPvPkeJ0/LtJI57cjWY5bZQaRTQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/postgres-lsp/package.nix b/pkgs/by-name/po/postgres-lsp/package.nix
index 6981031280a2..407592de904f 100644
--- a/pkgs/by-name/po/postgres-lsp/package.nix
+++ b/pkgs/by-name/po/postgres-lsp/package.nix
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "postgres-lsp";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "supabase-community";
     repo = "postgres-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-ckD2IoG4jHd+IppCpl6VJN8Z3Dj2iiR7Uv9uBTy823s=";
+    hash = "sha256-MdEI/3oqTIJ4anG6jXO4SEkb4VDulzD3Ql+TiFdCQa8=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-P5Q6VMy5DsMDA9r28lRH4MA8ZlXN0gRVe/ICeDfvBuQ=";
+  cargoHash = "sha256-vr84vwmDUpmyiX4TTTdR35Hjevi43+KgWxDhSbUKr+k=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/po/pot/package.nix b/pkgs/by-name/po/pot/package.nix
index 5a1c84fba77c..a31500b0f309 100644
--- a/pkgs/by-name/po/pot/package.nix
+++ b/pkgs/by-name/po/pot/package.nix
@@ -41,8 +41,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-iYQNGRWqXYBU+WIH/Xm8qndgOQ6RKYCtAyi93kb7xrQ=";
     fetcherVersion = 1;
+    hash = "sha256-iYQNGRWqXYBU+WIH/Xm8qndgOQ6RKYCtAyi93kb7xrQ=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/pr/prisma/package.nix b/pkgs/by-name/pr/prisma/package.nix
index 3bcae8fba8be..cecab11fc8b2 100644
--- a/pkgs/by-name/pr/prisma/package.nix
+++ b/pkgs/by-name/pr/prisma/package.nix
@@ -32,8 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-dhEpn0oaqZqeiRMfcSiaqhud/RsKd6Wm5RR5iyQp1I8=";
     fetcherVersion = 1;
+    hash = "sha256-dhEpn0oaqZqeiRMfcSiaqhud/RsKd6Wm5RR5iyQp1I8=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/pr/probe-rs-tools/package.nix b/pkgs/by-name/pr/probe-rs-tools/package.nix
index 244e14ebf756..8c2c72aaa74f 100644
--- a/pkgs/by-name/pr/probe-rs-tools/package.nix
+++ b/pkgs/by-name/pr/probe-rs-tools/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "probe-rs-tools";
-  version = "0.29.0";
+  version = "0.29.1";
 
   src = fetchFromGitHub {
     owner = "probe-rs";
     repo = "probe-rs";
     tag = "v${version}";
-    hash = "sha256-5EppB6XVUHM7TrvpdqdvojuFbjw8RTDOudpypVdLPbQ=";
+    hash = "sha256-/gP9abygktYSzg/054o1PEcQywiPFTtKNdUdI3hCYyc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-sdMRauSaDYMgpfAYhEBEqz0s9WHAZJLjijdvQqO6fMs=";
+  cargoHash = "sha256-txHl0+HDCVdmbZppGsFqPjsEbPBCJVEB3XZWZJBBoOk=";
 
   buildAndTestSubdir = pname;
 
diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index c36fa8784160..5fd7e2bf8632 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -33,7 +33,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus";
-  version = "3.4.2";
+  version = "3.5.0";
 
   outputs = [
     "out"
@@ -45,14 +45,14 @@ buildGoModule (finalAttrs: {
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/JeT8+I/jNE7O2YT9qfu7RF3xculPyR3rRrFQIG4YV4=";
+    hash = "sha256-QBmtJ+qBIwQzfJ7tx0P9/3kl6UaZou7qp8jrI+Qrcck=";
   };
 
-  vendorHash = "sha256-edR9vvSNexRR8EGEiSCIIYl3ndGckS8XuIWojPrq60U=";
+  vendorHash = "sha256-Svm+rH/cmS9mjiQHVucwKHy6ilw3mgySjRdC3ivw0YE=";
 
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-3aXP79aeA/qe99sVsJn0nNRggrzFWTmaRO3dBzOR6UU=";
+    hash = "sha256-j+wOQ8m2joXZ3/C6bO8pxroM/hntVLP/QhoWVmdLir4=";
   };
 
   excludedPackages = [
diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix
index 7233511b79b7..0ac7dfdb5b38 100644
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "proto";
-  version = "0.50.1";
+  version = "0.50.4";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "proto";
     rev = "v${version}";
-    hash = "sha256-Ol0l+9pkMDmb09a6gsDxP9KIpIIeDNHp9cGBbfWHBNA=";
+    hash = "sha256-X448S7eGx60CgpZkV81bVuxAc6HuIRNeHJgKW4min/E=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-kc/NC1WGOChdPXq1q83j5GBrcYTEpPCauIZ/q02caUU=";
+  cargoHash = "sha256-PUNBq4VWufCeFdhI7zThEyDMA4UHpL95uVdv4uouxBQ=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
diff --git a/pkgs/by-name/pr/protonplus/package.nix b/pkgs/by-name/pr/protonplus/package.nix
index fc56159e4148..c3c68cc2a845 100644
--- a/pkgs/by-name/pr/protonplus/package.nix
+++ b/pkgs/by-name/pr/protonplus/package.nix
@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "protonplus";
-  version = "0.5.8";
+  version = "0.5.9";
 
   src = fetchFromGitHub {
     owner = "Vysp3r";
     repo = "protonplus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-99RD1M6i/titM0dzyNPZGdWyNAUo7ZBj2QEw/qDl5nM=";
+    hash = "sha256-Ss+9p6mQQNYcY+5gAD1CtM+TpNRC/kVqV8fmfowydBk=";
   };
 
   nativeBuildInputs = [
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    mainProgram = "com.vysp3r.ProtonPlus";
+    mainProgram = "protonplus";
     description = "Simple Wine and Proton-based compatibility tools manager";
     homepage = "https://github.com/Vysp3r/ProtonPlus";
     changelog = "https://github.com/Vysp3r/ProtonPlus/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/ps/pscale/package.nix b/pkgs/by-name/ps/pscale/package.nix
index 16e639d15260..a3b9034d80ae 100644
--- a/pkgs/by-name/ps/pscale/package.nix
+++ b/pkgs/by-name/ps/pscale/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "pscale";
-  version = "0.246.0";
+  version = "0.247.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-w9R11v9OheK4JJnRyhYVBqGlThZ4eJtwFWH8NdrTSyI=";
+    sha256 = "sha256-/ZBGeZTrtRUCqoS1cgDHglogpVOzOLroOWgJC3j9Zxg=";
   };
 
-  vendorHash = "sha256-IekHvDhLTcRYrse81CQ+TJAi3VRUhgZRDfrSe7Wp4WM=";
+  vendorHash = "sha256-w1abfm7wSywu+KXIACfYtHZoW/uSzW/2M0vR9gXrj34=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pu/pubs/package.nix b/pkgs/by-name/pu/pubs/package.nix
index 0aa4e6b47430..baa7fceab427 100644
--- a/pkgs/by-name/pu/pubs/package.nix
+++ b/pkgs/by-name/pu/pubs/package.nix
@@ -30,11 +30,11 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
     setuptools
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     argcomplete
     beautifulsoup4
     bibtexparser
@@ -44,6 +44,7 @@ python3.pkgs.buildPythonApplication rec {
     pyyaml
     requests
     six
+    standard-pipes # https://github.com/pubs/pubs/issues/282
   ];
 
   nativeCheckInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/py/pyprland/package.nix b/pkgs/by-name/py/pyprland/package.nix
index 08ddc3341f28..730da05985ee 100644
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyprland";
-  version = "2.4.5";
+  version = "2.4.6";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.10";
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
     owner = "hyprland-community";
     repo = "pyprland";
     tag = version;
-    hash = "sha256-s93zuBS2jpGLTKKGvna1Zc+ph6A6kemgfkl8j7uSdKY=";
+    hash = "sha256-OH+BTPw574FykVYWG6TIOpSPeYB39UxyMy/gzMDw0z4=";
   };
 
   nativeBuildInputs = with python3Packages; [ poetry-core ];
diff --git a/pkgs/by-name/qu/quantframe/package.nix b/pkgs/by-name/qu/quantframe/package.nix
index 6a622cb21655..a6a70280fb89 100644
--- a/pkgs/by-name/qu/quantframe/package.nix
+++ b/pkgs/by-name/qu/quantframe/package.nix
@@ -41,8 +41,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-3IHwwbl1aH3Pzh9xq2Jfev9hj6/LXZaVaIJOPbgsquE=";
     fetcherVersion = 1;
+    hash = "sha256-3IHwwbl1aH3Pzh9xq2Jfev9hj6/LXZaVaIJOPbgsquE=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 3639341555ac..c57caf5b135d 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -39,8 +39,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-lez75n3dIM4efpP+qPuDteCfMnC6wPD+L2173iJbTZM=";
     fetcherVersion = 1;
+    hash = "sha256-lez75n3dIM4efpP+qPuDteCfMnC6wPD+L2173iJbTZM=";
   };
 
   pnpmRoot = "../..";
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 05e0671b98d4..3fbd31ab3217 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2025.06.30.00";
+  version = "2025.07.14.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${version}";
-    hash = "sha256-9TvYewY74ntI8iTo5UOTQ+OA6eJHmA/fUPRW0maZn00=";
+    hash = "sha256-gr5J2qqpn2kaFdM9Q+UvIugg435XTzyWvfRJwresQyE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yxxh/ikFioEAHpuS/AAIpQClWvQxL/5/UkiSbbKRnBA=";
+  cargoHash = "sha256-QdGqvY0uUdxkDRgowSc35Bk5P2YOM5+MmUUMEt/pmCk=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index daff959eeca6..02cce1cf0d22 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -39,8 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-XOlFJFFyzbx8Bg92HXhVFFCI51j2GUK7+LJKfqVOQyU=";
     fetcherVersion = 1;
+    hash = "sha256-XOlFJFFyzbx8Bg92HXhVFFCI51j2GUK7+LJKfqVOQyU=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;
diff --git a/pkgs/by-name/re/reth/package.nix b/pkgs/by-name/re/reth/package.nix
index 7b9498ebb3ef..f96f1237dc7d 100644
--- a/pkgs/by-name/re/reth/package.nix
+++ b/pkgs/by-name/re/reth/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reth";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "paradigmxyz";
     repo = "reth";
     rev = "v${version}";
-    hash = "sha256-bEWgXRV82FIeJSO5voDewFxjUzphRlZ1W+k/QqJCigM=";
+    hash = "sha256-R+TE9MRSAZuBHglgFECrYrTkGDbi2WceFUNYAvd1O9g=";
   };
 
-  cargoHash = "sha256-Mp5Ydf3/okos2nPK3ghc/hAS3y6b2kxgPS2+kZS/rF4=";
+  cargoHash = "sha256-/LoqFP/vGWMTiBp6wiTabTec+Uwoc35683HnPe9QUGA=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/rm/rmfakecloud/package.nix b/pkgs/by-name/rm/rmfakecloud/package.nix
index da58d05dbad6..44a994a66945 100644
--- a/pkgs/by-name/rm/rmfakecloud/package.nix
+++ b/pkgs/by-name/rm/rmfakecloud/package.nix
@@ -28,8 +28,8 @@ buildGoModule rec {
     inherit pname version src;
     sourceRoot = "${src.name}/ui";
     pnpmLock = "${src}/ui/pnpm-lock.yaml";
-    hash = "sha256-VNmCT4um2W2ii8jAm+KjQSjixYEKoZkw7CeRwErff/o=";
     fetcherVersion = 1;
+    hash = "sha256-VNmCT4um2W2ii8jAm+KjQSjixYEKoZkw7CeRwErff/o=";
   };
   preBuild = lib.optionals enableWebui ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart
diff --git a/pkgs/by-name/ro/rockcraft/package.nix b/pkgs/by-name/ro/rockcraft/package.nix
index be29de5fcc69..3e88c80b4092 100644
--- a/pkgs/by-name/ro/rockcraft/package.nix
+++ b/pkgs/by-name/ro/rockcraft/package.nix
@@ -10,13 +10,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "rockcraft";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "rockcraft";
     rev = version;
-    hash = "sha256-yv+TGDSUBKJf5X+73Do9KrAcCodeBPqpIHgpYZslR3o=";
+    hash = "sha256-pIOCgOC969Fj3lNnmsb6QTEV8z1KWxrUSsdl6Aogd4Q=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/rq/rquickshare/package.nix b/pkgs/by-name/rq/rquickshare/package.nix
index a1fcb7c53e1d..855afe4e3a81 100644
--- a/pkgs/by-name/rq/rquickshare/package.nix
+++ b/pkgs/by-name/rq/rquickshare/package.nix
@@ -64,8 +64,8 @@ rustPlatform.buildRustPackage rec {
       patches
       ;
     postPatch = "cd ${pnpmRoot}";
-    hash = app-type-either "sha256-V46V/VPwCKEe3sAp8zK0UUU5YigqgYh1GIOorqIAiNE=" "sha256-8QRigYNtxirXidFFnTzA6rP0+L64M/iakPqe2lZKegs=";
     fetcherVersion = 1;
+    hash = app-type-either "sha256-V46V/VPwCKEe3sAp8zK0UUU5YigqgYh1GIOorqIAiNE=" "sha256-8QRigYNtxirXidFFnTzA6rP0+L64M/iakPqe2lZKegs=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/applications/networking/feedreaders/rss2email/default.nix b/pkgs/by-name/rs/rss2email/package.nix
similarity index 66%
rename from pkgs/applications/networking/feedreaders/rss2email/default.nix
rename to pkgs/by-name/rs/rss2email/package.nix
index c13135dbb31b..143a3a9edc56 100644
--- a/pkgs/applications/networking/feedreaders/rss2email/default.nix
+++ b/pkgs/by-name/rs/rss2email/package.nix
@@ -1,23 +1,15 @@
 {
   lib,
-  pythonPackages,
+  python3Packages,
   fetchPypi,
   fetchpatch2,
   nixosTests,
 }:
 
-with pythonPackages;
-
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "rss2email";
   version = "3.14";
-  format = "setuptools";
-
-  propagatedBuildInputs = [
-    feedparser
-    html2text
-  ];
-  nativeCheckInputs = [ beautifulsoup4 ];
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -30,6 +22,11 @@ buildPythonApplication rec {
       url = "https://github.com/rss2email/rss2email/commit/b5c0e78006c2db6929b5ff50e8529de58a00412a.patch";
       hash = "sha256-edmsi3I0acx5iF9xoAS9deSexqW2UtWZR/L7CgeZs/M=";
     })
+    (fetchpatch2 {
+      name = "use-poetry-core.patch";
+      url = "https://github.com/rss2email/rss2email/commit/183a17aefe4eb66f898cf088519b1e845559f2bd.patch";
+      hash = "sha256-SoWahlOJ7KkaHMwOrKIBgwEz8zJQrSXVD1w2wiV1phE=";
+    })
   ];
 
   outputs = [
@@ -40,10 +37,19 @@ buildPythonApplication rec {
 
   postPatch = ''
     # sendmail executable is called from PATH instead of sbin by default
-    sed -e 's|/usr/sbin/sendmail|sendmail|' \
-        -i rss2email/config.py
+    substituteInPlace  rss2email/config.py \
+      --replace-fail '/usr/sbin/sendmail' 'sendmail'
   '';
 
+  build-system = with python3Packages; [
+    poetry-core
+  ];
+
+  dependencies = with python3Packages; [
+    feedparser
+    html2text
+  ];
+
   postInstall = ''
     install -Dm 644 r2e.1 $man/share/man/man1/r2e.1
     # an alias for better finding the manpage
@@ -54,11 +60,14 @@ buildPythonApplication rec {
     cp AUTHORS COPYING CHANGELOG README.rst $doc/share/doc/rss2email/
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    env PATH=$out/bin:$PATH python ./test/test.py
-    runHook postCheck
-  '';
+  nativeCheckInputs = [
+    python3Packages.unittestCheckHook
+  ];
+
+  unittestFlagsArray = [
+    "-s"
+    "test"
+  ];
 
   meta = with lib; {
     description = "Tool that converts RSS/Atom newsfeeds to email";
diff --git a/pkgs/by-name/rs/rsshub/package.nix b/pkgs/by-name/rs/rsshub/package.nix
index d9121ef6d829..e47927a02a74 100644
--- a/pkgs/by-name/rs/rsshub/package.nix
+++ b/pkgs/by-name/rs/rsshub/package.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-7qh6YZbIH/kHVssDZxHY7X8bytrnMcUq0MiJzWZYItc=";
     fetcherVersion = 1;
+    hash = "sha256-7qh6YZbIH/kHVssDZxHY7X8bytrnMcUq0MiJzWZYItc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rt/rtabmap/package.nix b/pkgs/by-name/rt/rtabmap/package.nix
index b30f319eeea8..a8ac06b59150 100644
--- a/pkgs/by-name/rt/rtabmap/package.nix
+++ b/pkgs/by-name/rt/rtabmap/package.nix
@@ -38,23 +38,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rtabmap";
-  version = "0.21.13";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "introlab";
     repo = "rtabmap";
-    tag = "${finalAttrs.version}-noetic";
-    hash = "sha256-W4yjHKb2BprPYkL8rLwLQcZDGgmMZ8279ntR+Eqj7R0=";
+    tag = finalAttrs.version;
+    hash = "sha256-6kDjIfUgyaqrsVAWO6k0h1qIDN/idMOJJxLpqMQ6DFY=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Fix the ctor and dtor warning
-      url = "https://github.com/introlab/rtabmap/pull/1496/commits/84c59a452b40a26edf1ba7ec8798700a2f9c3959.patch";
-      hash = "sha256-kto02qcL2dW8Frt81GA+OCldPgCF5bAs/28w9amcf0o=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     libsForQt5.wrapQtAppsHook
diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index 52d0be28d90f..fbc5a9333530 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -12,15 +12,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2025-07-07";
+  version = "2025-07-14";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-6letdN1dn5pvUkArddMFxGHsAtprpCGJ98zTr7sAdfY=";
+  cargoHash = "sha256-bYJGlePqgcZ5ixdCJleJS0gjiKtiS1d2XJymhyUknas=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    hash = "sha256-YjyurHKMrUYKjnujSqjpFtHGYFCGr2Xpo1Xc1AYT1+M=";
+    hash = "sha256-EJcdxw3aXfP8Ex1Nm3s0awyH9egQvB2Gu+QEnJn2Sfg=";
   };
 
   cargoBuildFlags = [
diff --git a/pkgs/by-name/sa/sabnzbd/package.nix b/pkgs/by-name/sa/sabnzbd/package.nix
index 16705b2a20c4..b3d9fe15a05e 100644
--- a/pkgs/by-name/sa/sabnzbd/package.nix
+++ b/pkgs/by-name/sa/sabnzbd/package.nix
@@ -72,14 +72,14 @@ let
   ];
 in
 stdenv.mkDerivation rec {
-  version = "4.5.1";
+  version = "4.5.2";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = "sabnzbd";
     repo = "sabnzbd";
     rev = version;
-    hash = "sha256-vundARltVyTX0rEdwQJnY8p1n9zBhFskJkyttWgEaZI=";
+    hash = "sha256-8Q/6H9DfiVkonsIvlv7Y4yDHrvpE9dB/5KxUff14qkA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix
index 5dcfabab65dd..1c823d7bbafe 100644
--- a/pkgs/by-name/sa/saga/package.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "saga";
-  version = "9.8.1";
+  version = "9.9.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${version}.tar.gz";
-    hash = "sha256-NCNeTxR4eWMJ3OHcBEQ2MZky9XiEExPscGhriDvXYf8=";
+    hash = "sha256-xS9h8QGm6PH8rx0qXmvolDpH9fy8ma7HlBVbQo5pX4Q=";
   };
 
   sourceRoot = "saga-${version}/saga-gis";
diff --git a/pkgs/by-name/sa/salt/package.nix b/pkgs/by-name/sa/salt/package.nix
index 8902eeca366c..1608a9078ff6 100644
--- a/pkgs/by-name/sa/salt/package.nix
+++ b/pkgs/by-name/sa/salt/package.nix
@@ -12,12 +12,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "salt";
-  version = "3007.5";
+  version = "3007.6";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f1cuA5BZ8aWXuhCpvcgdzCN1pJxJEGWBmI9QYDmz3aU=";
+    hash = "sha256-F2qLl8Q8UO2H3xInmz3SSLu2q0jNMrLekPRSNMfE0JQ=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sa/satisfactorymodmanager/package.nix b/pkgs/by-name/sa/satisfactorymodmanager/package.nix
index bdb1fa77f346..248a1b3fe428 100644
--- a/pkgs/by-name/sa/satisfactorymodmanager/package.nix
+++ b/pkgs/by-name/sa/satisfactorymodmanager/package.nix
@@ -55,8 +55,8 @@ buildGoModule rec {
     pnpmDeps = pnpm_8.fetchDeps {
       inherit pname version src;
       sourceRoot = "${src.name}/frontend";
-      hash = "sha256-OP+3zsNlvqLFwvm2cnBd2bj2Kc3EghQZE3hpotoqqrQ=";
       fetcherVersion = 1;
+      hash = "sha256-OP+3zsNlvqLFwvm2cnBd2bj2Kc3EghQZE3hpotoqqrQ=";
     };
 
     pnpmRoot = "frontend";
diff --git a/pkgs/by-name/sc/scooter/package.nix b/pkgs/by-name/sc/scooter/package.nix
index cac351608edf..59e0d7975a78 100644
--- a/pkgs/by-name/sc/scooter/package.nix
+++ b/pkgs/by-name/sc/scooter/package.nix
@@ -18,6 +18,12 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-kPweKXAitvODNoKTr2iB+qM9qMWGoKEQCxpkgrpnewY=";
 
+  # Ensure that only the `scooter` package is built (excluding `xtask`)
+  cargoBuildFlags = [
+    "--package"
+    "scooter"
+  ];
+
   # Many tests require filesystem writes which fail in Nix sandbox
   doCheck = false;
 
diff --git a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
index 28ff9cb503ce..e3df4161d946 100644
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "7979e7b29261c11ebce2deabc41ed081b6691398";
-    hash = "sha256-FSA1hsYvMQ49AxWY/sRP1Mx6XthKDVdixEW+JmNNsDU=";
+    rev = "0f63b5ea2932d1af560fcd874b9b8562b5c69403";
+    hash = "sha256-AZkLkSxdNbybf5AJTPHsBd0BQmZ+/1YWg2mSSlUlZTs=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index 035bf1c2a8ca..ea1af5f85b13 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -38,14 +38,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2025-06-28";
+    version = "0-unstable-2025-07-08";
     format = "setuptools";
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "df76647c52b56101f152c5dec7c1d08f1732ceb7";
-      hash = "sha256-8Rh42DFLyQz+4cWA8x5wpFO41DusMuTo8NAloprw5w0=";
+      rev = "bd593d0bad2189f57657bbcfa2c5e86f795c680e";
+      hash = "sha256-vNI66OKA8LPXqc2mt8lm4iKS6njRLQhjzcykCQyPJsk=";
     };
 
     postPatch = ''
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 4fe69579cd36..1e3ced96b2a8 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.92";
+  version = "3.94";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-In4LVN5Um7ettxDFuT2MFuU9kx50PXBpd5t5qp/2lzk=";
+    hash = "sha256-d8N9py3khwjg/tRyKUfImLy1CwtjoDvWzQB6F+tM5kQ=";
   };
 
-  vendorHash = "sha256-gTfoC5yHOSRSTsVXKrPx3Jxwh3IUmwjr9ynR02zYduA=";
+  vendorHash = "sha256-WURNRNjUylLsf3+AMfb48VHbqfiPIT0lPmLfNjWphSU=";
 
   subPackages = [ "weed" ];
 
diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index b33d7df53314..aaf9dfb941a5 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -65,13 +65,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "servo";
-  version = "0-unstable-2025-07-08";
+  version = "0-unstable-2025-07-13";
 
   src = fetchFromGitHub {
     owner = "servo";
     repo = "servo";
-    rev = "c3f441d7abe7243a31150bf424babf0f1679ea88";
-    hash = "sha256-rFROwsU/x8LsD8vpCcmLyQMYCl9AQwgbv/kHk7JTa4c=";
+    rev = "93e5b672a78247205c431d5741952bdf23c3fcc2";
+    hash = "sha256-0826hNZ45BXXNzdZKbyUW/CfwVRZmpYU1e6efaACh4o=";
     # Breaks reproducibility depending on whether the picked commit
     # has other ref-names or not, which may change over time, i.e. with
     # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -82,7 +82,7 @@ rustPlatform.buildRustPackage {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-2J6ByE2kmoHBGWgwYU2FWgTt47cw+s8IPcm4ElRVWMc=";
+  cargoHash = "sha256-uB5eTGiSq+DV7VwYoyLR2HH3DQpSV4xnP7C7iXZa7S0=";
 
   # set `HOME` to a temp dir for write access
   # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
diff --git a/pkgs/by-name/sh/shadcn/package.nix b/pkgs/by-name/sh/shadcn/package.nix
index 02f73aace615..bece7c8a189c 100644
--- a/pkgs/by-name/sh/shadcn/package.nix
+++ b/pkgs/by-name/sh/shadcn/package.nix
@@ -28,8 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src
       pnpmWorkspaces
       ;
-    hash = "sha256-/80LJm65ZRqyfhsNqGl83bsI2wjgVkvrA6Ij4v8rtoQ=";
     fetcherVersion = 1;
+    hash = "sha256-/80LJm65ZRqyfhsNqGl83bsI2wjgVkvrA6Ij4v8rtoQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sh/sharkey/package.nix b/pkgs/by-name/sh/sharkey/package.nix
index c3572f5e278c..babb5feb38d7 100644
--- a/pkgs/by-name/sh/sharkey/package.nix
+++ b/pkgs/by-name/sh/sharkey/package.nix
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-S8LxawbtguFOEZyYbS1FQWw/TcRm4Z6mG7dUhfXbf1c=";
     fetcherVersion = 1;
+    hash = "sha256-S8LxawbtguFOEZyYbS1FQWw/TcRm4Z6mG7dUhfXbf1c=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/sh/sheldon/package.nix b/pkgs/by-name/sh/sheldon/package.nix
index 87ecc05bbc28..1dc0e140ca84 100644
--- a/pkgs/by-name/sh/sheldon/package.nix
+++ b/pkgs/by-name/sh/sheldon/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sheldon";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "rossmacarthur";
     repo = "sheldon";
     rev = version;
-    hash = "sha256-+NtiscyNlrXNNj3njvdZQB8dHs/PBYpEo9VwodEOtDs=";
+    hash = "sha256-CkcY4YVTguULE/4QGX72X3Jdi+z1XWo1M0J6ocCavCI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-O9v77mwOeTnT4LetcrzQjdd3MDXDbpptUODMAVBwZv8=";
+  cargoHash = "sha256-H2PQyfBaQ0jD69LMEi3kkgPWk0RkOI8b7ODGzks/gj0=";
 
   buildInputs =
     [ openssl ]
diff --git a/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json b/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
index 1bffe72ed0e0..772386febedf 100644
--- a/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
+++ b/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
@@ -1,14 +1,14 @@
 {
   "name": "shopify",
-  "version": "3.82.0",
+  "version": "3.82.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "shopify",
-      "version": "3.82.0",
+      "version": "3.82.1",
       "dependencies": {
-        "@shopify/cli": "3.82.0"
+        "@shopify/cli": "3.82.1"
       },
       "bin": {
         "shopify": "node_modules/@shopify/cli/bin/run.js"
@@ -579,9 +579,9 @@
       }
     },
     "node_modules/@shopify/cli": {
-      "version": "3.82.0",
-      "resolved": "https://registry.npmjs.org/@shopify/cli/-/cli-3.82.0.tgz",
-      "integrity": "sha512-y+Sq21Zr+vJVQu7z2wNKXXI4NnkACuh/Tt/KrAX7C+NntmKLXl7CZEaVesmJ5shpksG2up1iY1MgMYsDPoNpUA==",
+      "version": "3.82.1",
+      "resolved": "https://registry.npmjs.org/@shopify/cli/-/cli-3.82.1.tgz",
+      "integrity": "sha512-iIABwasf+aMSBIjaPsKlVSaLp3vcOIPcfiitdoMUJKQhjIVbq8KdwaAa/MLUMe5B+l230zjq/xGB8U3JeJY0eg==",
       "license": "MIT",
       "os": [
         "darwin",
diff --git a/pkgs/by-name/sh/shopify-cli/manifests/package.json b/pkgs/by-name/sh/shopify-cli/manifests/package.json
index 33d2d489ab47..f8fef2a1630d 100644
--- a/pkgs/by-name/sh/shopify-cli/manifests/package.json
+++ b/pkgs/by-name/sh/shopify-cli/manifests/package.json
@@ -1,11 +1,11 @@
 {
   "name": "shopify",
-  "version": "3.82.0",
+  "version": "3.82.1",
   "private": true,
   "bin": {
     "shopify": "node_modules/@shopify/cli/bin/run.js"
   },
   "dependencies": {
-    "@shopify/cli": "3.82.0"
+    "@shopify/cli": "3.82.1"
   }
 }
diff --git a/pkgs/by-name/sh/shopify-cli/package.nix b/pkgs/by-name/sh/shopify-cli/package.nix
index 6bbd087f8a04..1b64c8313477 100644
--- a/pkgs/by-name/sh/shopify-cli/package.nix
+++ b/pkgs/by-name/sh/shopify-cli/package.nix
@@ -5,7 +5,7 @@
   shopify-cli,
 }:
 let
-  version = "3.82.0";
+  version = "3.82.1";
 in
 buildNpmPackage {
   pname = "shopify";
@@ -13,7 +13,7 @@ buildNpmPackage {
 
   src = ./manifests;
 
-  npmDepsHash = "sha256-liqEE0AXbj9L23xR6cpNK6b7CdL2pWvFFjL2S1lwKwQ=";
+  npmDepsHash = "sha256-s0wlJxA3DUXRGBlLvyesLr9H/nbDc9yHBBWBLjQd8vE=";
   dontNpmBuild = true;
 
   passthru = {
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index a0a2fcc0baeb..86ec124538fb 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -68,8 +68,8 @@ let
 
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname src version;
-      hash = "sha256-cT7Ixl/V/mesPHvJUsG63Y/wXwKjbjkjdjP3S7uEOa0=";
       fetcherVersion = 1;
+      hash = "sha256-cT7Ixl/V/mesPHvJUsG63Y/wXwKjbjkjdjP3S7uEOa0=";
     };
 
     strictDeps = true;
@@ -119,12 +119,12 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
+    fetcherVersion = 1;
     hash =
       if withAppleEmojis then
         "sha256-ry7s9fbKx4e1LR8DlI2LIJY9GQrxmU7JQt+3apJGw/M="
       else
         "sha256-AkrfugpNvk4KgesRLQbso8p5b96Dg174R9/xuP4JtJg=";
-    fetcherVersion = 1;
   };
 
   env = {
diff --git a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
index 14f9e1866e55..a71e8dffdb56 100644
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -22,8 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
     fetcherVersion = 1;
+    hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
   };
 
   cargoRoot = "deps/extension";
diff --git a/pkgs/by-name/si/sigtop/package.nix b/pkgs/by-name/si/sigtop/package.nix
index c9e41c1c6a9f..dfdc42eca1d6 100644
--- a/pkgs/by-name/si/sigtop/package.nix
+++ b/pkgs/by-name/si/sigtop/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   name = "sigtop";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "tbvdm";
     repo = "sigtop";
     rev = "v${version}";
-    sha256 = "sha256-1ZZBsKkgBnkNtYdlarbi+6DtCWBRvgcsoH0v4VNjKh0=";
+    sha256 = "sha256-xW+fwyXNM11KoU3cCfPzAjBsz6yQlTHkmDWitoq1p1k=";
   };
 
-  vendorHash = "sha256-EWppsnZ/Ch7JjltkejOYKepZUfKNZY9+F7VbzjNCYNU=";
+  vendorHash = "sha256-V47Z96ZoIgDQbGocpAJ/4oiK6uJXY8XTndsAifETbCc=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libsecret ];
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index dc85f15bd48b..bc33bcaf5758 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -96,8 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       postPatch
       ;
-    hash = "sha256-eSf4mpKBm1G4K9+V6VXEiPrIVQMyru7o9BGVIUycQaQ=";
     fetcherVersion = 1;
+    hash = "sha256-eSf4mpKBm1G4K9+V6VXEiPrIVQMyru7o9BGVIUycQaQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";
diff --git a/pkgs/by-name/sk/sketchybar-app-font/package.nix b/pkgs/by-name/sk/sketchybar-app-font/package.nix
index 481d59136084..4bf819c1cbd5 100644
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@@ -20,8 +20,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-NGAgueJ+cuK/csjdf94KNklu+Xf91BHoWKVgEctX6eA=";
     fetcherVersion = 1;
+    hash = "sha256-NGAgueJ+cuK/csjdf94KNklu+Xf91BHoWKVgEctX6eA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sl/slimevr/package.nix b/pkgs/by-name/sl/slimevr/package.nix
index 2d82414032bf..2c6daec2e1ef 100644
--- a/pkgs/by-name/sl/slimevr/package.nix
+++ b/pkgs/by-name/sl/slimevr/package.nix
@@ -39,8 +39,8 @@ rustPlatform.buildRustPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     pname = "${pname}-pnpm-deps";
     inherit version src;
-    hash = "sha256-lh5IKdBXuH9GZFUTrzaQFDWCEYj0UJhKwCdPmsiwfCs=";
     fetcherVersion = 1;
+    hash = "sha256-lh5IKdBXuH9GZFUTrzaQFDWCEYj0UJhKwCdPmsiwfCs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sl/slskd/deps.json b/pkgs/by-name/sl/slskd/deps.json
index afffb6a8d3dd..b58ab14bb3d8 100644
--- a/pkgs/by-name/sl/slskd/deps.json
+++ b/pkgs/by-name/sl/slskd/deps.json
@@ -781,8 +781,8 @@
   },
   {
     "pname": "Soulseek",
-    "version": "7.0.3",
-    "hash": "sha256-/GCUh4XJ4zs5etxQ0GjNJozkS2GZ/Qq1cot1+bRQack="
+    "version": "7.1.0",
+    "hash": "sha256-n6LUNuPmmy9QYNNALR0ObYyR9LJalf0H8P+SKnoqfFc="
   },
   {
     "pname": "SQLitePCLRaw.bundle_e_sqlite3",
diff --git a/pkgs/by-name/sl/slskd/package.nix b/pkgs/by-name/sl/slskd/package.nix
index a5bc3bedfc3c..ef94103af49a 100644
--- a/pkgs/by-name/sl/slskd/package.nix
+++ b/pkgs/by-name/sl/slskd/package.nix
@@ -19,13 +19,13 @@ let
 in
 buildDotnetModule rec {
   pname = "slskd";
-  version = "0.22.5";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "slskd";
     repo = "slskd";
     tag = version;
-    hash = "sha256-gLPWbRffoCJAdg8zP9idfnzqT1nIZrI88cYUd/DyxZA=";
+    hash = "sha256-vUqDWzWJIZbb6WvANsLhUBzyQFi59/+jizarI8Ob3uQ=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ buildDotnetModule rec {
     name = "${pname}-${version}-npm-deps";
     inherit src;
     sourceRoot = "${src.name}/${npmRoot}";
-    hash = "sha256-GACe+ufxiSlS1aD9R+I8VqbZqi2gCHUp+Dm/XMx2WZQ=";
+    hash = "sha256-AbIlpu0KNuzwSQVIsSRhLQZqE3yA68DlIL4WbZ34Hi8=";
   };
 
   projectFile = "slskd.sln";
diff --git a/pkgs/by-name/sn/snapcraft/package.nix b/pkgs/by-name/sn/snapcraft/package.nix
index 01334b07d3fc..9d11d12e7a30 100644
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@@ -14,7 +14,7 @@
 
 python312Packages.buildPythonApplication rec {
   pname = "snapcraft";
-  version = "8.10.0";
+  version = "8.10.1";
 
   pyproject = true;
 
@@ -22,7 +22,7 @@ python312Packages.buildPythonApplication rec {
     owner = "canonical";
     repo = "snapcraft";
     tag = version;
-    hash = "sha256-k48OgHg0Pm3WfjPex27UvMZBOq9708vGJy/rZvCZdbg=";
+    hash = "sha256-WGCbqtuCOF5X8yOVrgLKWyDcqjpb8sbTPRZzVesnAIY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/so/solaar/package.nix b/pkgs/by-name/so/solaar/package.nix
index 01cac2c422f3..f48f559fd9ee 100644
--- a/pkgs/by-name/so/solaar/package.nix
+++ b/pkgs/by-name/so/solaar/package.nix
@@ -95,6 +95,7 @@ python3Packages.buildPythonApplication rec {
     '';
     homepage = "https://pwr-solaar.github.io/Solaar/";
     license = licenses.gpl2Only;
+    mainProgram = "solaar";
     maintainers = with maintainers; [
       spinus
       ysndr
diff --git a/pkgs/by-name/sp/sparkleshare/package.nix b/pkgs/by-name/sp/sparkleshare/package.nix
deleted file mode 100644
index 62606d12dc97..000000000000
--- a/pkgs/by-name/sp/sparkleshare/package.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  appindicator-sharp,
-  bash,
-  coreutils,
-  fetchFromGitHub,
-  git,
-  git-lfs,
-  glib,
-  gtk-sharp-3_0,
-  lib,
-  makeWrapper,
-  meson,
-  mono,
-  ninja,
-  notify-sharp,
-  openssh,
-  openssl,
-  pkg-config,
-  stdenv,
-  symlinkJoin,
-  webkit2-sharp,
-  xdg-utils,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "sparkleshare";
-  version = "3.38";
-
-  src = fetchFromGitHub {
-    owner = "hbons";
-    repo = "SparkleShare";
-    rev = version;
-    sha256 = "1a9csflmj96iyr1l0mdm3ziv1bljfcjnzm9xb2y4qqk7ha2p6fbq";
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-    meson
-    mono
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    appindicator-sharp
-    gtk-sharp-3_0
-    notify-sharp
-    webkit2-sharp
-  ];
-
-  patchPhase = ''
-    # SparkleShare's default desktop file falls back to flatpak.
-    sed -i -e "s_^Exec=.*_Exec=$out/bin/sparkleshare_" SparkleShare/Linux/SparkleShare.Autostart.desktop
-
-    # Nix will manage the icon cache.
-    echo '#!/bin/sh' >scripts/post-install.sh
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/sparkleshare \
-        --set PATH ${
-          symlinkJoin {
-            name = "mono-path";
-            paths = [
-              bash
-              coreutils
-              git
-              git-lfs
-              glib
-              mono
-              openssh
-              openssl
-              xdg-utils
-            ];
-          }
-        }/bin \
-        --set MONO_GAC_PREFIX ${
-          lib.concatStringsSep ":" [
-            appindicator-sharp
-            gtk-sharp-3_0
-            webkit2-sharp
-          ]
-        } \
-        --set LD_LIBRARY_PATH ${
-          lib.makeLibraryPath [
-            appindicator-sharp
-            gtk-sharp-3_0.gtk3
-            webkit2-sharp
-            webkit2-sharp.webkitgtk
-          ]
-        }
-  '';
-
-  meta = {
-    description = "Share and collaborate by syncing with any Git repository instantly. Linux, macOS, and Windows";
-    homepage = "https://sparkleshare.org";
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ kevincox ];
-    mainProgram = "sparkleshare";
-  };
-}
diff --git a/pkgs/by-name/sp/splayer/package.nix b/pkgs/by-name/sp/splayer/package.nix
index 9e405aaacbc0..f7213eb5bd83 100644
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@@ -26,8 +26,8 @@ stdenv.mkDerivation (final: {
 
   pnpmDeps = final.pnpm.fetchDeps {
     inherit (final) pname version src;
-    hash = "sha256-mC1iJtkZpTd2Vte5DLI3ntZ7vSO5Gka2qOk7ihQd3Gs=";
     fetcherVersion = 1;
+    hash = "sha256-mC1iJtkZpTd2Vte5DLI3ntZ7vSO5Gka2qOk7ihQd3Gs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sq/sqlfluff/package.nix b/pkgs/by-name/sq/sqlfluff/package.nix
index b6a4852f61ed..40b6a82d5329 100644
--- a/pkgs/by-name/sq/sqlfluff/package.nix
+++ b/pkgs/by-name/sq/sqlfluff/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "3.4.1";
+  version = "3.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlfluff";
     repo = "sqlfluff";
     tag = version;
-    hash = "sha256-gtpYQvhDOxNO97YXaSHqSgUklmPJIe2ynjexTZPBUmA=";
+    hash = "sha256-Cf4nrINpe5Kr2JYwcTYx1oO+E6ydlBs0W7F4Mh7ITAs=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
@@ -71,7 +71,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = {
     description = "SQL linter and auto-formatter";
     homepage = "https://www.sqlfluff.com/";
-    changelog = "https://github.com/sqlfluff/sqlfluff/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/sqlfluff/sqlfluff/blob/${src.tag}/CHANGELOG.md";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "sqlfluff";
diff --git a/pkgs/by-name/st/step-kms-plugin/package.nix b/pkgs/by-name/st/step-kms-plugin/package.nix
index 93f455bb1a96..0a2a94498321 100644
--- a/pkgs/by-name/st/step-kms-plugin/package.nix
+++ b/pkgs/by-name/st/step-kms-plugin/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "step-kms-plugin";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = "step-kms-plugin";
     rev = "v${version}";
-    hash = "sha256-XZRNEUMko3HMlKOyHYK3TQywkqC6K5VvdvGFTSk6V68=";
+    hash = "sha256-9prrXwxCeqMTdO6+qIWhn6Vd67pslXvhkUnQa7ZfEpg=";
   };
 
-  vendorHash = "sha256-gIzllbLAshJXoTawTbQ+ERliaHwhJhQM6v1aykDKF7M=";
+  vendorHash = "sha256-hnUsYWuL+CJIL6w7EdYBevH9Cb19fLuE+VD4ZiRuBFM=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index f7aa71f359c0..0626ec7dcca2 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.15.51";
+  version = "3.15.55";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-NISp1TNEgoLn2sBglpoKfg/aiiLynNOrOWqTppkbDs0=";
+    hash = "sha256-eDKP15xvd/SHZd4i2EorRZkS7ih5d8YNvCJQsRQeMYs=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index 48c8c18b5676..d4ecb9d68689 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   pkg-config,
   autoreconfHook,
   perl,
@@ -86,6 +87,20 @@ stdenv.mkDerivation rec {
     ./ext_auth-path.patch
     ./firewall_defaults.patch
     ./updown-path.patch
+    # Fixes for gettext 0.25
+    (fetchpatch2 {
+      url = "https://github.com/strongswan/strongswan/commit/7ec0101250bf2ac3da7a576cbb4204fceb2ef10c.patch?full_index=1";
+      excludes = [ "scripts/test.sh" ];
+      hash = "sha256-ATd/oj6/1vrtZdwMs45rA2MGtH2viumyucVj0LZ8Nnc=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/strongswan/strongswan/commit/e8e5e2d4419a686c5a2c064648618ec281089b2e.patch?full_index=1";
+      hash = "sha256-p98LSX8jjsDK/GZTovj/salmQ8T+txEV3vKD+wTUvsM=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/strongswan/strongswan/commit/2b3a5172d89c513ed28d21bb406c1b4ef0ac787a.patch?full_index=1";
+      hash = "sha256-xqp2Lq4pp3Uu0nVC/fl4E5mpJqCNgyZXP2g/Y2wShhI=";
+    })
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/by-name/st/stylelint-lsp/package.nix b/pkgs/by-name/st/stylelint-lsp/package.nix
index 06fb4c4d3d24..6fc0ac292506 100644
--- a/pkgs/by-name/st/stylelint-lsp/package.nix
+++ b/pkgs/by-name/st/stylelint-lsp/package.nix
@@ -28,8 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PVA6sXbiuxqvi9u3sPoeVIJSSpSbFQHQQnTFO3w31WE=";
     fetcherVersion = 1;
+    hash = "sha256-PVA6sXbiuxqvi9u3sPoeVIJSSpSbFQHQQnTFO3w31WE=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/su/surrealdb/package.nix b/pkgs/by-name/su/surrealdb/package.nix
index 2b075e2abc4f..e95b4e5e03b5 100644
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -6,22 +6,21 @@
   openssl,
   rocksdb,
   testers,
-  surrealdb,
   protobuf,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "surrealdb";
-  version = "2.3.5";
+  version = "2.3.7";
 
   src = fetchFromGitHub {
     owner = "surrealdb";
     repo = "surrealdb";
-    tag = "v${version}";
-    hash = "sha256-7Rv57D966TQFHbZKmtnt1XWuNOwD+r175iUVJiVho/0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gZICuvgMOdwa39i+5ETUDuFfBtSiZuuFOYW5pHPkoms=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-JENp5g1as1RS9fdV5qepEAhE9/SJ8lbMiwyk3YDeu5k=";
+  cargoHash = "sha256-KndVaz7o0kMtMvQf4NK0pNMaC518keWddmGkYtemeWg=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
@@ -55,19 +54,19 @@ rustPlatform.buildRustPackage rec {
   __darwinAllowLocalNetworking = true;
 
   passthru.tests.version = testers.testVersion {
-    package = surrealdb;
+    package = finalAttrs.finalPackage;
     command = "surreal version";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Scalable, distributed, collaborative, document-graph database, for the realtime web";
     homepage = "https://surrealdb.com/";
     mainProgram = "surreal";
-    license = licenses.bsl11;
-    maintainers = with maintainers; [
+    license = lib.licenses.bsl11;
+    maintainers = with lib.maintainers; [
       sikmir
       happysalada
       siriobalmelli
     ];
   };
-}
+})
diff --git a/pkgs/by-name/su/surrealist/package.nix b/pkgs/by-name/su/surrealist/package.nix
index 87df89375c41..3ebb574901be 100644
--- a/pkgs/by-name/su/surrealist/package.nix
+++ b/pkgs/by-name/su/surrealist/package.nix
@@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-oreeV9g16/F7JGLApi0Uq+vTqNhIg7Lg1Z4k00RUOYI=";
     fetcherVersion = 1;
+    hash = "sha256-oreeV9g16/F7JGLApi0Uq+vTqNhIg7Lg1Z4k00RUOYI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sw/swaybg/package.nix b/pkgs/by-name/sw/swaybg/package.nix
index 3f24ffb75864..48af7410eb36 100644
--- a/pkgs/by-name/sw/swaybg/package.nix
+++ b/pkgs/by-name/sw/swaybg/package.nix
@@ -10,6 +10,8 @@
   wayland-protocols,
   cairo,
   gdk-pixbuf,
+  gnome,
+  webp-pixbuf-loader,
   wayland-scanner,
   wrapGAppsNoGuiHook,
   librsvg,
@@ -50,6 +52,18 @@ stdenv.mkDerivation rec {
     "-Dman-pages=enabled"
   ];
 
+  # add support for webp
+  postInstall = ''
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          librsvg
+          webp-pixbuf-loader
+        ];
+      }
+    }"
+  '';
+
   meta = with lib; {
     description = "Wallpaper tool for Wayland compositors";
     inherit (src.meta) homepage;
diff --git a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
index f9b32eb054cb..4bb6743d2470 100644
--- a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "synapse-admin-etkecc";
-  version = "0.11.1-etke44";
+  version = "0.11.1-etke45";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "synapse-admin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8IL81rMohPNss0ZTKgyxvx4FNcgFtDoJGZ6uyM/nJgg=";
+    hash = "sha256-LlwNVlgZl5O9paEGem68FbzAPOfXlLTxZ865vR7qPR8=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-6TVVYitLtpNjyMOUXaMYlhOskSZCb/eWW91S69RTeFo=";
+    hash = "sha256-7eSQQdcJkBIbG/0cj0uh02Day+4ph6LMQGIaMPqjpdk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sy/synchrony/package.nix b/pkgs/by-name/sy/synchrony/package.nix
index bae597725037..21ed6c385e09 100644
--- a/pkgs/by-name/sy/synchrony/package.nix
+++ b/pkgs/by-name/sy/synchrony/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-+hS4UK7sncCxv6o5Yl72AeY+LSGLnUTnKosAYB6QsP0=";
     fetcherVersion = 1;
+    hash = "sha256-+hS4UK7sncCxv6o5Yl72AeY+LSGLnUTnKosAYB6QsP0=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/sy/syncyomi/package.nix b/pkgs/by-name/sy/syncyomi/package.nix
index b3944784c853..21a7e6bc5211 100644
--- a/pkgs/by-name/sy/syncyomi/package.nix
+++ b/pkgs/by-name/sy/syncyomi/package.nix
@@ -33,8 +33,8 @@ buildGoModule rec {
         src
         sourceRoot
         ;
-      hash = "sha256-edcZIqshnvM3jJpZWIR/UncI0VCMLq26h/n3VvV/384=";
       fetcherVersion = 1;
+      hash = "sha256-edcZIqshnvM3jJpZWIR/UncI0VCMLq26h/n3VvV/384=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/tabby-agent/package.nix b/pkgs/by-name/ta/tabby-agent/package.nix
index 271e4dd38cab..ea316cd13f0e 100644
--- a/pkgs/by-name/ta/tabby-agent/package.nix
+++ b/pkgs/by-name/ta/tabby-agent/package.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-SiJJxRzmKQxqw3UESN7q+3qkU1nK+7z6K5RpIMRRces=";
     fetcherVersion = 1;
+    hash = "sha256-SiJJxRzmKQxqw3UESN7q+3qkU1nK+7z6K5RpIMRRces=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/ta/tailwindcss-language-server/package.nix b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
index c543ed0803c9..1d769564d0bc 100644
--- a/pkgs/by-name/ta/tailwindcss-language-server/package.nix
+++ b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       pnpmWorkspaces
       ;
-    hash = "sha256-SUEq20gZCiTDkFuNgMc5McHBPgW++8P9Q1MJb7a7pY8=";
     fetcherVersion = 1;
+    hash = "sha256-SUEq20gZCiTDkFuNgMc5McHBPgW++8P9Q1MJb7a7pY8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taler-wallet-core/package.nix b/pkgs/by-name/ta/taler-wallet-core/package.nix
index eb86a73f1a0c..313bd567b98b 100644
--- a/pkgs/by-name/ta/taler-wallet-core/package.nix
+++ b/pkgs/by-name/ta/taler-wallet-core/package.nix
@@ -56,8 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-pLe5smsXdzSBgz/OYNO5FVEI2L6y/p+jMxEkzqUaX34=";
     fetcherVersion = 1;
+    hash = "sha256-pLe5smsXdzSBgz/OYNO5FVEI2L6y/p+jMxEkzqUaX34=";
   };
 
   buildInputs = [ nodejs_20 ];
diff --git a/pkgs/by-name/ta/tauno-monitor/package.nix b/pkgs/by-name/ta/tauno-monitor/package.nix
index 0c165057e334..d604098744cd 100644
--- a/pkgs/by-name/ta/tauno-monitor/package.nix
+++ b/pkgs/by-name/ta/tauno-monitor/package.nix
@@ -13,14 +13,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "tauno-monitor";
-  version = "0.2.1";
+  version = "0.2.9";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "taunoe";
     repo = "tauno-monitor";
     tag = "v${version}";
-    hash = "sha256-WsBov5ftt0lXw3fC04EGAFj1imDaPAmKvWDC5a1y9+k=";
+    hash = "sha256-tVl6JZbzAgOlXQzvN9Wq4TTRoGfIyWw243vZFbkcyRo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taze/package.nix b/pkgs/by-name/ta/taze/package.nix
index 76c9b8b8560b..a4bd2fe26c45 100644
--- a/pkgs/by-name/ta/taze/package.nix
+++ b/pkgs/by-name/ta/taze/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-aUMV2REINp5LDcj1s8bgQAj/4508UEewu+ebD+JT0+M=";
     fetcherVersion = 1;
+    hash = "sha256-aUMV2REINp5LDcj1s8bgQAj/4508UEewu+ebD+JT0+M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index be118252e32d..e085cfb1220a 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -5,7 +5,7 @@
   fetchFromGitHub,
   alsa-utils,
   copyDesktopItems,
-  electron_35,
+  electron_37,
   makeDesktopItem,
   makeWrapper,
   nix-update-script,
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.0.18";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-44K76pNJ0SRKAF8QdHYSi5htQpbP6YNNg6vDkzaeqaI=";
+    hash = "sha256-lISDy721e3bfWMl56DlIxVKN2bW8Yonc5XSVL072OQk=";
   };
 
-  npmDepsHash = "sha256-ShEqO6nL2YK2wdHGEcKff0fJsd9N9LI0VfhFe6FQ2gw=";
+  npmDepsHash = "sha256-QcjXJcEIi/sUJLUF+wMqhXyLYPgjZKK6n4ngyvrH9NA=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -46,7 +46,7 @@ buildNpmPackage rec {
     ''
       runHook preBuild
 
-      cp -r ${electron_35.dist} electron-dist
+      cp -r ${electron_37.dist} electron-dist
       chmod -R u+w electron-dist
     ''
     # Electron builder complains about symlink in electron-dist
@@ -61,7 +61,7 @@ buildNpmPackage rec {
           -c.npmRebuild=true \
           -c.asarUnpack="**/*.node" \
           -c.electronDist=electron-dist \
-          -c.electronVersion=${electron_35.version}
+          -c.electronVersion=${electron_37.version}
 
       runHook postBuild
     '';
@@ -83,7 +83,7 @@ buildNpmPackage rec {
       popd
 
       # Linux needs 'aplay' for notification sounds
-      makeWrapper '${lib.getExe electron_35}' "$out/bin/teams-for-linux" \
+      makeWrapper '${lib.getExe electron_37}' "$out/bin/teams-for-linux" \
         --prefix PATH : ${
           lib.makeBinPath [
             alsa-utils
diff --git a/pkgs/by-name/te/tektoncd-cli/package.nix b/pkgs/by-name/te/tektoncd-cli/package.nix
index 4bfdc93f4f4a..2916735697b1 100644
--- a/pkgs/by-name/te/tektoncd-cli/package.nix
+++ b/pkgs/by-name/te/tektoncd-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.41.0";
+  version = "0.41.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-X+zFYPoHf8Q1K0bLjrsnwOZxxAeJCzgKqmr3FYK5AKA=";
+    sha256 = "sha256-AxE7Dom40xL+f2VXz9zlAZYFfW/iCbR9EdHfuCu8z7M=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix
index 48af298648ea..bc4d5f9039a1 100644
--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.35.1";
+  version = "1.35.2";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +18,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-vdn/c3EVtGnCh750IqjMjRxeW2Zimn8PazREL9KZX2Y=";
+    hash = "sha256-x1PUDe5sMtg7VjFmjZ1rtk1SjglkEtbhVOfDYL/kikA=";
   };
 
-  vendorHash = "sha256-W5Ng7IH4WKq1v1PfO1Wi3eBDonITcIuJzJTmtHPnCmg=";
+  vendorHash = "sha256-pTJqf00JdF+6ixU23zBLrNZquB02fP+BBX6JXgxthSw=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/by-name/te/teleport/package.nix b/pkgs/by-name/te/teleport/package.nix
index 4b3667ba21e3..0058ebc0b571 100644
--- a/pkgs/by-name/te/teleport/package.nix
+++ b/pkgs/by-name/te/teleport/package.nix
@@ -73,8 +73,8 @@ let
 
     pnpmDeps = pnpm_10.fetchDeps {
       inherit src pname version;
-      hash = pnpmHash;
       fetcherVersion = 1;
+      hash = pnpmHash;
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/te/termsvg/package.nix b/pkgs/by-name/te/termsvg/package.nix
index 9726eeb44474..7e984c2c5406 100644
--- a/pkgs/by-name/te/termsvg/package.nix
+++ b/pkgs/by-name/te/termsvg/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "termsvg";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "mrmarble";
     repo = "termsvg";
     rev = "v${version}";
-    hash = "sha256-q6xjsoxQTIQwPYkBTGwLfTt1VQ8GJPdsiP5dvTyEBIw=";
+    hash = "sha256-ejrg1UywPQDCeaymkGzU+xZoPXME6XEP/SBe3Yxf4YU=";
   };
 
-  vendorHash = "sha256-HhJcf+NwM1h0Hh76LU/cddaLoCaQdyuKLSvDFmiKEEg=";
+  vendorHash = "sha256-BoXRLWhQmfvMIN658MiXGCFMbnvuXfv/H/jCE6h4aWk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ti/tiny-rdm/package.nix b/pkgs/by-name/ti/tiny-rdm/package.nix
index 17b95f7dbdeb..661eb2246165 100644
--- a/pkgs/by-name/ti/tiny-rdm/package.nix
+++ b/pkgs/by-name/ti/tiny-rdm/package.nix
@@ -17,13 +17,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tiny-rdm";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "tiny-craft";
     repo = "tiny-rdm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7e+thMIEYmPHJAePJdEQo1q/Zzf+iKPhlkqrrr2O9iE=";
+    hash = "sha256-wSTC9Ne/Q9LLZL2+8ObMFCXrf4VSI0LkZhHHbAiXCYE=";
   };
 
   postPatch = ''
@@ -31,13 +31,13 @@ buildGoModule (finalAttrs: {
       --replace-fail "prefStore.autoCheckUpdate" "false"
   '';
 
-  vendorHash = "sha256-LWa0eZibFc7bXYMWgm+/awOaerd6kBrFpk/dDSGoKlE=";
+  vendorHash = "sha256-Hh/qudoCZtIHJLsI6GQ814W4nC/uRd4gQd0PobzMlnQ=";
 
   env = {
     CGO_ENABLED = 1;
     npmDeps = fetchNpmDeps {
       src = "${finalAttrs.src}/frontend";
-      hash = "sha256-/kkLabtYXcipyiBpY2UFYBbbbNYHaFqYSNgLYiwErGc=";
+      hash = "sha256-dcoTwfRocVjpBzqS9f2MkXjzcCI5sLjRZ3UC/Ml+7T0=";
     };
     npmRoot = "frontend";
   };
diff --git a/pkgs/by-name/tl/tlsx/package.nix b/pkgs/by-name/tl/tlsx/package.nix
index 94cf073b1dd3..0da6965982fd 100644
--- a/pkgs/by-name/tl/tlsx/package.nix
+++ b/pkgs/by-name/tl/tlsx/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tlsx";
-  version = "1.1.9";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "tlsx";
     tag = "v${version}";
-    hash = "sha256-u83hPmmiXH7SGCyINkHFrjNDLanwJLf0o9ZyceQeSg0=";
+    hash = "sha256-5ffJ7UzIP3qZoEAxJFGce5BaWHnkqtPnQOHpuJmQC50=";
   };
 
-  vendorHash = "sha256-NF05vVLBRlWQpmTfrNEjnvH7kZMhgY73xmSgTZ8FGmo=";
+  vendorHash = "sha256-hSCzpvciuI8zJgD2xgWTK+UiVthXgrPl6AeU/7QLg4c=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/tor/disable-monotonic-timer-tests.patch b/pkgs/by-name/to/tor/disable-monotonic-timer-tests.patch
similarity index 100%
rename from pkgs/tools/security/tor/disable-monotonic-timer-tests.patch
rename to pkgs/by-name/to/tor/disable-monotonic-timer-tests.patch
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/by-name/to/tor/package.nix
similarity index 87%
rename from pkgs/tools/security/tor/default.nix
rename to pkgs/by-name/to/tor/package.nix
index 18aabfcd33c4..006c0f204029 100644
--- a/pkgs/tools/security/tor/default.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -15,6 +15,7 @@
   scrypt,
   nixosTests,
   writeShellScript,
+  versionCheckHook,
 
   # for update.nix
   writeScript,
@@ -27,6 +28,7 @@
   gnused,
   nix,
 }:
+
 let
   tor-client-auth-gen = writeShellScript "tor-client-auth-gen" ''
     PATH="${
@@ -48,13 +50,14 @@ let
     base64 -d | tail --bytes=32 | base32 | tr -d =
   '';
 in
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "tor";
   version = "0.4.8.17";
 
   src = fetchurl {
-    url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ebRyXh1LiHueaP0JsNIkN3fVzjzUceU4WDvPb52M21Y=";
+    url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
+    hash = "sha256-ebRyXh1LiHueaP0JsNIkN3fVzjzUceU4WDvPb52M21Y=";
   };
 
   outputs = [
@@ -63,6 +66,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs =
     [
       libevent
@@ -98,8 +102,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace contrib/client-tools/torify \
-      --replace 'pathfind torsocks' true          \
-      --replace 'exec torsocks' 'exec ${torsocks}/bin/torsocks'
+      --replace-fail 'exec torsocks' 'exec ${torsocks}/bin/torsocks'
 
     patchShebangs ./scripts/maint/checkShellScripts.sh
   '';
@@ -117,6 +120,10 @@ stdenv.mkDerivation rec {
     ln -s ${tor-client-auth-gen} $out/bin/tor-client-auth-gen
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
   passthru = {
     tests.tor = nixosTests.tor;
     updateScript = import ./update.nix {
@@ -135,10 +142,9 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.torproject.org/";
     description = "Anonymizing overlay network";
-
     longDescription = ''
       Tor helps improve your privacy by bouncing your communications around a
       network of relays run by volunteers all around the world: it makes it
@@ -148,17 +154,16 @@ stdenv.mkDerivation rec {
       instant messaging clients, remote login, and other applications based on
       the TCP protocol.
     '';
-
-    license = with licenses; [
+    license = with lib.licenses; [
       bsd3
       gpl3Only
     ];
-
-    maintainers = with maintainers; [
+    mainProgram = "tor";
+    maintainers = with lib.maintainers; [
       thoughtpolice
       joachifm
       prusnak
     ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/tools/security/tor/update.nix b/pkgs/by-name/to/tor/update.nix
similarity index 100%
rename from pkgs/tools/security/tor/update.nix
rename to pkgs/by-name/to/tor/update.nix
diff --git a/pkgs/tools/security/tor/torsocks.nix b/pkgs/by-name/to/torsocks/package.nix
similarity index 57%
rename from pkgs/tools/security/tor/torsocks.nix
rename to pkgs/by-name/to/torsocks/package.nix
index 5092a1e42af9..db78e0a0dc6a 100644
--- a/pkgs/tools/security/tor/torsocks.nix
+++ b/pkgs/by-name/to/torsocks/package.nix
@@ -5,28 +5,26 @@
   fetchpatch,
   autoreconfHook,
   libcap,
+  nix-update-script,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "torsocks";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
     group = "tpo";
     owner = "core";
     repo = "torsocks";
-    rev = "v${version}";
-    sha256 = "sha256-ocJkoF9LMLC84ukFrm5pzjp/1gaXqDz8lzr9TdG+f88=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-um5D6d/fzKynfa1kA/VbdnKvAlZ7jQs+pmOgWQMpwgM=";
   };
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   patches = [
-    # fix compatibility with C99
-    # https://gitlab.torproject.org/tpo/core/torsocks/-/merge_requests/9
-    (fetchpatch {
-      url = "https://gitlab.torproject.org/tpo/core/torsocks/-/commit/1171bf2fd4e7a0cab02cf5fca59090b65af9cd29.patch";
-      hash = "sha256-qu5/0fy72+02QI0cVE/6YrR1kPuJxsZfG8XeODqVOPY=";
-    })
     # tsocks_libc_accept4 only exists on Linux, use tsocks_libc_accept on other platforms
     (fetchpatch {
       url = "https://gitlab.torproject.org/tpo/core/torsocks/uploads/eeec9833512850306a42a0890d283d77/0001-Fix-macros-for-accept4-2.patch";
@@ -36,30 +34,24 @@ stdenv.mkDerivation rec {
     ./torsocks-gethostbyaddr-darwin.patch
   ];
 
-  postPatch =
-    ''
-      # Patch torify_app()
-      sed -i \
-        -e 's,\(local app_path\)=`which $1`,\1=`type -P $1`,' \
-        src/bin/torsocks.in
-    ''
-    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      sed -i \
-        -e 's,\(local getcap\)=.*,\1=${libcap}/bin/getcap,' \
-        src/bin/torsocks.in
-    '';
-
-  nativeBuildInputs = [ autoreconfHook ];
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace src/bin/torsocks.in --replace-fail \
+    '"$(PATH="$PATH:/usr/sbin:/sbin" command -v getcap)"' '${libcap}/bin/getcap'
+  '';
 
   doInstallCheck = true;
   installCheckTarget = "check-recursive";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
+    changelog = "https://gitlab.torproject.org/tpo/core/torsocks/-/releases/v${finalAttrs.version}";
     description = "Wrapper to safely torify applications";
-    mainProgram = "torsocks";
     homepage = "https://gitlab.torproject.org/tpo/core/torsocks";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
+    mainProgram = "torsocks";
     maintainers = with lib.maintainers; [ thoughtpolice ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/tools/security/tor/torsocks-gethostbyaddr-darwin.patch b/pkgs/by-name/to/torsocks/torsocks-gethostbyaddr-darwin.patch
similarity index 100%
rename from pkgs/tools/security/tor/torsocks-gethostbyaddr-darwin.patch
rename to pkgs/by-name/to/torsocks/torsocks-gethostbyaddr-darwin.patch
diff --git a/pkgs/by-name/to/toybox/package.nix b/pkgs/by-name/to/toybox/package.nix
index e12d2f9edc98..84dde2316d7c 100644
--- a/pkgs/by-name/to/toybox/package.nix
+++ b/pkgs/by-name/to/toybox/package.nix
@@ -64,7 +64,19 @@ stdenv.mkDerivation rec {
     make oldconfig
   '';
 
-  makeFlags = [ "PREFIX=$(out)/bin" ] ++ optionals enableStatic [ "LDFLAGS=--static" ];
+  hardeningDisable = lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic) [
+    # breaks string.h header in musl
+    "fortify"
+  ];
+
+  makeFlags =
+    [
+      "PREFIX=$(out)/bin"
+      "CC=${stdenv.cc.targetPrefix}cc"
+    ]
+    ++ optionals (enableStatic && !stdenv.hostPlatform.isDarwin) [
+      "LDFLAGS=--static"
+    ];
 
   installTargets = [ "install_flat" ];
 
diff --git a/pkgs/by-name/tp/tproxy/package.nix b/pkgs/by-name/tp/tproxy/package.nix
index 451fb3d0a35f..3d864c06552c 100644
--- a/pkgs/by-name/tp/tproxy/package.nix
+++ b/pkgs/by-name/tp/tproxy/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "tproxy";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "kevwan";
     repo = "tproxy";
     tag = "v${version}";
-    hash = "sha256-LiYZ9S7Jga4dQWHmqsPvlGDAAw5reO16LAYaNJZFnhE=";
+    hash = "sha256-Ck7WtCxWiZxkKlx7D/N0EZmFEgrW7MpPj5ATvJxGXgg=";
   };
 
-  vendorHash = "sha256-YjkYb5copw0SM2lago+DyVgHIrqLDSBnO+4zLMq+YJ8=";
+  vendorHash = "sha256-xYPF3RGrOQ1e2EPHtvlM9QKSE+V4cnG8f9JTS0hkAYU=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index b767ffb6dea9..a7cb1b88a7cb 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.77.23";
+  version = "2.78.0";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PkQ9fBkkhGBlkbII/C+E5g4AQR6xckrRkAgKBwVhNuk=";
+    hash = "sha256-CJ1/Qbt6osuJZNuKiEaGEsDztVo8hTNOv6XvUQyWbFU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/tr/trickest-cli/package.nix b/pkgs/by-name/tr/trickest-cli/package.nix
index 03204b1428f2..31a077a5a99e 100644
--- a/pkgs/by-name/tr/trickest-cli/package.nix
+++ b/pkgs/by-name/tr/trickest-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "trickest-cli";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "trickest";
     repo = "trickest-cli";
     tag = "v${version}";
-    hash = "sha256-OuCiW/5g4swtSpqM2rhLyB1syiRkyTbJsghEvyosz/A=";
+    hash = "sha256-rYdv0OkABV2ih5u28AoxAg3qabbl2VQnuQ01PCXPY6M=";
   };
 
   vendorHash = "sha256-Ae0fNzYOAeCMrNFVhw4VvG/BkOMcguIMiBvLGt7wxEo=";
diff --git a/pkgs/by-name/tr/trzsz-ssh/package.nix b/pkgs/by-name/tr/trzsz-ssh/package.nix
new file mode 100644
index 000000000000..dd97c6bc76fb
--- /dev/null
+++ b/pkgs/by-name/tr/trzsz-ssh/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "trzsz-ssh";
+  version = "0.1.22";
+
+  src = fetchFromGitHub {
+    owner = "trzsz";
+    repo = "trzsz-ssh";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VvPdWRP+lrhho+Bk5rT9pktEvKe01512WoDfAu5d868=";
+  };
+
+  vendorHash = "sha256-EllXxDyWI4Dy5E6KnzYFxuYDQcdk9+01v5svpARZU44=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  nativeCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "SSH client designed as a drop-in replacement for the openssh client";
+    homepage = "https://github.com/trzsz/trzsz-ssh";
+    changelog = "https://github.com/trzsz/trzsz-ssh/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ rewine ];
+    mainProgram = "trzsz-ssh";
+  };
+})
diff --git a/pkgs/by-name/ts/tsx/package.nix b/pkgs/by-name/ts/tsx/package.nix
index 43e081b470d2..faa25ee6f5a1 100644
--- a/pkgs/by-name/ts/tsx/package.nix
+++ b/pkgs/by-name/ts/tsx/package.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-57KDZ9cHb7uqnypC0auIltmYMmIhs4PWyf0HTRWEFiU=";
     fetcherVersion = 1;
+    hash = "sha256-57KDZ9cHb7uqnypC0auIltmYMmIhs4PWyf0HTRWEFiU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ty/typespec/package.nix b/pkgs/by-name/ty/typespec/package.nix
index d78bc9ebd677..df0d3ca91eb9 100644
--- a/pkgs/by-name/ty/typespec/package.nix
+++ b/pkgs/by-name/ty/typespec/package.nix
@@ -38,8 +38,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       postPatch
       ;
-    hash = "sha256-9RQZ2ycu78W3Ie6MLpo6x7Sa/iYsUdq5bYed56mOPxs=";
     fetcherVersion = 1;
+    hash = "sha256-9RQZ2ycu78W3Ie6MLpo6x7Sa/iYsUdq5bYed56mOPxs=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/uf/uftrace/package.nix b/pkgs/by-name/uf/uftrace/package.nix
index 7224d7b5fc97..3a052d100d91 100644
--- a/pkgs/by-name/uf/uftrace/package.nix
+++ b/pkgs/by-name/uf/uftrace/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "uftrace";
-  version = "0.18";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "namhyung";
     repo = "uftrace";
     rev = "v${version}";
-    sha256 = "sha256-TgGeeZtrhGlQxQp0y6D8SMjRJ9YITzWdaWxblKfcvzU=";
+    sha256 = "sha256-9fVBV23gVN1kSkdqBlWV0oEIj6ew6yVO4edUTTHV5H0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ug/ugs/package.nix b/pkgs/by-name/ug/ugs/package.nix
index bb0c580863cd..de8cd6239ec4 100644
--- a/pkgs/by-name/ug/ugs/package.nix
+++ b/pkgs/by-name/ug/ugs/package.nix
@@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ugs";
-  version = "2.1.14";
+  version = "2.1.15";
 
   src = fetchzip {
     url = "https://github.com/winder/Universal-G-Code-Sender/releases/download/v${version}/UniversalGcodeSender.zip";
-    hash = "sha256-yPamI5Ww56J+jQ3IZW2VKtyW19SHZ1Cxhq2dOAOiUMo=";
+    hash = "sha256-IzDcMe8seISyF4Eg4CPDsCj2DDFknFgCkajhLoL3YrM=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/uh/uhk-agent/package.nix b/pkgs/by-name/uh/uhk-agent/package.nix
index 5a095b4411d8..8feaea98ae70 100644
--- a/pkgs/by-name/uh/uhk-agent/package.nix
+++ b/pkgs/by-name/uh/uhk-agent/package.nix
@@ -13,12 +13,12 @@
 
 let
   pname = "uhk-agent";
-  version = "7.0.1";
+  version = "8.0.0";
 
   src = fetchurl {
     url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-8zf6vhgZj8cY9XoI/6FZH1/xh7/I3vboVumLsTq3q8Q=";
+    sha256 = "sha256-1XgmGAjLoxJ9ZyeaDSk8UC9fVVwkY83i+DRBRIQz7/M=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/um/umu-launcher-unwrapped/package.nix b/pkgs/by-name/um/umu-launcher-unwrapped/package.nix
index 1de3507d4805..8fd010e52852 100644
--- a/pkgs/by-name/um/umu-launcher-unwrapped/package.nix
+++ b/pkgs/by-name/um/umu-launcher-unwrapped/package.nix
@@ -13,13 +13,13 @@
 }:
 python3Packages.buildPythonPackage rec {
   pname = "umu-launcher-unwrapped";
-  version = "1.2.7";
+  version = "1.2.9";
 
   src = fetchFromGitHub {
     owner = "Open-Wine-Components";
     repo = "umu-launcher";
     tag = version;
-    hash = "sha256-G8UZvQ/pidh93FSsYq1dY0FTESWbksKAd9OU5Sxvv4I=";
+    hash = "sha256-nqI2XmMS28dvYrgD9kh7Xc510CvG7ifIybj+HlrU3qI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/un/unity-test/meson.patch b/pkgs/by-name/un/unity-test/meson.patch
new file mode 100644
index 000000000000..4276fb2d1e56
--- /dev/null
+++ b/pkgs/by-name/un/unity-test/meson.patch
@@ -0,0 +1,18 @@
+diff --git a/meson.build b/meson.build
+index 6585129..9489aef 100644
+--- a/meson.build
++++ b/meson.build
+@@ -64,10 +64,10 @@ unity_dep = declare_dependency(
+ if not meson.is_subproject()
+   pkg = import('pkgconfig')
+   pkg.generate(
+-    name: meson.project_name(),
++    unity_lib,
+     version: meson.project_version(),
+-    libraries: [ unity_lib ],
+-    description: 'C Unit testing framework.'
++    subdirs: 'unity',
++    extra_cflags: unity_args,
+   )
+ endif
+ 
diff --git a/pkgs/by-name/un/unity-test/package.nix b/pkgs/by-name/un/unity-test/package.nix
index 4b0d280276c3..9adc30e47b03 100644
--- a/pkgs/by-name/un/unity-test/package.nix
+++ b/pkgs/by-name/un/unity-test/package.nix
@@ -2,9 +2,33 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  cmake,
-}:
+  fetchpatch2,
+  meson,
+  ninja,
+  ruby,
+  python3Minimal,
+  nix-update-script,
+  testers,
+  iniparser,
+  validatePkgConfig,
+  # Adds test groups and extra CLI flags.
+  buildFixture ? false,
+  # Adds the ablilty to track malloc and free calls.
+  # Note that if fixtures are enabled, this option is ignored
+  # and will always be enabled.
+  buildMemory ? buildFixture,
+  # Adds double precision floating point assertions
+  supportDouble ? false,
 
+}:
+let
+  # On newer versions of Clang, Weverything is too much of everything.
+  ignoredErrors = [
+    "-Wno-unsafe-buffer-usage"
+    "-Wno-reserved-identifier"
+    "-Wno-extra-semi-stmt"
+  ];
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "unity-test";
   version = "2.6.1";
@@ -16,13 +40,85 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-g0ubq7RxGQmL1R6vz9RIGJpVWYsgrZhsTWSrL1ySEug=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  patches = [
+    # The meson file does not have the subdir set correctly
+    (fetchpatch2 {
+      url = "https://patch-diff.githubusercontent.com/raw/ThrowTheSwitch/Unity/pull/771.patch";
+      hash = "sha256-r8ldVb7WrzVwTC2CtGul9Jk4Rzt+6ejk+paYAfFlR5M=";
+    })
+    # Fix up the shebangs in the auto directory as not all are correct
+    (fetchpatch2 {
+      url = "https://patch-diff.githubusercontent.com/raw/ThrowTheSwitch/Unity/pull/790.patch";
+      hash = "sha256-K+OxMe/ZMXPPjZXjGhgc5ULLN7plBwL0hV5gwmgA3FM=";
+    })
+  ];
+
+  postPatch = ''
+    patchShebangs --build auto
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    meson
+    ninja
+    python3Minimal
+    validatePkgConfig
+  ];
+
+  # For the helper shebangs
+  buildInputs = [
+    python3Minimal
+    ruby
+  ];
+
+  mesonFlags = [
+    (lib.mesonBool "extension_memory" buildMemory)
+    (lib.mesonBool "extension_fixture" buildFixture)
+    (lib.mesonBool "support_double" supportDouble)
+  ];
+
   doCheck = true;
 
+  checkPhase = ''
+    runHook preCheck
+
+    make -C../test -j $NIX_BUILD_CORES ${lib.optionalString stdenv.cc.isClang "CC=clang"} E="-Weverything ${lib.escapeShellArgs ignoredErrors}" test
+
+    runHook postCheck
+  '';
+
+  # Various helpers
+  postInstall = ''
+    mkdir -p "$out/share"
+    install -Dm755 ../auto/* -t "$out/share/"
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      inherit iniparser;
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+        versionCheck = true;
+      };
+    };
+  };
+
   meta = {
     description = "Unity Unit Testing Framework";
     homepage = "https://www.throwtheswitch.org/unity";
+    changelog = "https://github.com/ThrowTheSwitch/Unity/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.i01011001 ];
+    platforms = lib.platforms.all;
+    pkgConfigModules = [ "unity" ];
+    maintainers = with lib.maintainers; [
+      i01011001
+      RossSmyth
+    ];
   };
 })
diff --git a/pkgs/by-name/up/upcloud-cli/package.nix b/pkgs/by-name/up/upcloud-cli/package.nix
index ad86a7220300..8ae5be32171b 100644
--- a/pkgs/by-name/up/upcloud-cli/package.nix
+++ b/pkgs/by-name/up/upcloud-cli/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "upcloud-cli";
-  version = "3.20.1";
+  version = "3.20.2";
 
   src = fetchFromGitHub {
     owner = "UpCloudLtd";
     repo = "upcloud-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X+nv9MA20z2fJ2N+gyUkwGCHjX2hYMHSv8jfwKbegNE=";
+    hash = "sha256-M2xGrJKZRlC3YS6JBvLRahX2gm12kctM3waQ1sQ/BHQ=";
   };
 
-  vendorHash = "sha256-kyIsTNLC1hKsSbZel97eUtBLyH/3iTEvSMsV+6u347c=";
+  vendorHash = "sha256-EytU3BuAdW3p54SOvgnfohODbd11PYLk4HC5Ix393XU=";
 
   ldflags = [
     "-s -w -X github.com/UpCloudLtd/upcloud-cli/v3/internal/config.Version=${finalAttrs.version}"
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index 673958c802bc..b51a1cf70126 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.17.1";
+  version = "0.17.5";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zWnYBDNsOoyc28JB8/dbommIxKUU2XGOHHYsR2q1hj0=";
+    hash = "sha256-QBbpDV/hlzFgrmCsywH5CC43V2Rt0fwPkf6ZCgjqqUc=";
   };
 
-  vendorHash = "sha256-4cYG8ilWSI+bSoEBpohN6Fr3kmsBUNmbz0iyHmiCDgw=";
+  vendorHash = "sha256-AjmET86E/xu6DTK07kMySWp5Z8W1RE/QPSe2B/IfDl0=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/by-name/va/vals/package.nix b/pkgs/by-name/va/vals/package.nix
index af436434833b..8c785eeb46cb 100644
--- a/pkgs/by-name/va/vals/package.nix
+++ b/pkgs/by-name/va/vals/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "vals";
-  version = "0.41.2";
+  version = "0.41.3";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "helmfile";
     repo = "vals";
-    sha256 = "sha256-cwyEg+5vysVaW+pe77e+CUJpYLJ6BediJZTaz/eZRAA=";
+    sha256 = "sha256-SY3GXctZS5lRKqMDn5AbNA6mY++6d3BtqCcHog5NtH8=";
   };
 
-  vendorHash = "sha256-VOKvXovE/aagZOBFtF2o6/RhJMZhoZAHlVNqXD5Y7L4=";
+  vendorHash = "sha256-mTzKxVGirM/YClhNYVp9a2nuZMViAFYkl7Hq8D7ir/8=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 440ebab7b0c6..3bb9de8cb72f 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -14,19 +14,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.12.4";
+  version = "1.12.6";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x5tbLoNGBT3tS+QXn0piFMM8+uqoQt8gfQJap1TyLmQ=";
+    hash = "sha256-7JT8BMKUhIwYMkIwr2mD8IQLDpldcDtAKh6R1tbAKMw=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname src;
-    hash = "sha256-hO6QKRr4jTfesRDAEGcpFeJmGTGLGMw6EgIvD23DNzw=";
-    fetcherVersion = 1;
+    fetcherVersion = 2;
+    hash = "sha256-JP9HOaP3DG+2F89tC77JZFD0ls35u/MzxNmvMCbBo9Y=";
   };
 
   nativeBuildInputs = [
@@ -83,6 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       donteatoreo
       FlafyDev
+      Gliczy
       NotAShelf
       Scrumplex
     ];
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index a9a48dc3e768..ec4a84039dff 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -24,13 +24,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vesktop";
-  version = "1.5.7";
+  version = "1.5.8";
 
   src = fetchFromGitHub {
     owner = "Vencord";
     repo = "Vesktop";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2YVaDfvhmuUx2fVm9PuMPQ3Z5iu7IHJ7dgF52a1stoM=";
+    hash = "sha256-9wYIg1TGcntUMMp6SqYrgDRl3P41eeOqt76OMjSAi5M=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
@@ -40,8 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-C05rDd5bcbR18O6ACgzS0pQdWzB99ulceOBpW+4Zbqw=";
-    fetcherVersion = 1;
+    fetcherVersion = 2;
+    hash = "sha256-rJzXbIQUxCImTqeH8EsGiyGNGoHYUqoekoa+VXpob5Y=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index c703e6eca8f9..89200906e53b 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -36,8 +36,8 @@ let
         src
         sourceRoot
         ;
-      hash = "sha256-94ZlywOZYmW/NsvE0dtEA81MeBWGUrJsBXTUauuOmZM=";
       fetcherVersion = 1;
+      hash = "sha256-94ZlywOZYmW/NsvE0dtEA81MeBWGUrJsBXTUauuOmZM=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/virtnbdbackup/package.nix b/pkgs/by-name/vi/virtnbdbackup/package.nix
index ae64b13ece2c..9b69133d1102 100644
--- a/pkgs/by-name/vi/virtnbdbackup/package.nix
+++ b/pkgs/by-name/vi/virtnbdbackup/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "virtnbdbackup";
-  version = "2.29";
+  version = "2.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "virtnbdbackup";
     tag = "v${version}";
-    hash = "sha256-KIxRYD+GogYpZnUaBdhFd52sO51Two2vzY4LYRJRCto=";
+    hash = "sha256-4WnMY7eEEJD2l+GoQkKbVXSETh7+PEckrGspZhW2nMk=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/vo/voicevox-core/package.nix b/pkgs/by-name/vo/voicevox-core/package.nix
index 0ccdfa46688f..7b9cbe55c16f 100644
--- a/pkgs/by-name/vo/voicevox-core/package.nix
+++ b/pkgs/by-name/vo/voicevox-core/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "voicevox-core";
-  version = "0.15.8";
+  version = "0.15.9";
 
   src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
 
@@ -42,19 +42,19 @@ stdenv.mkDerivation (finalAttrs: {
     {
       "x86_64-linux" = fetchCoreArtifact {
         id = "linux-x64";
-        hash = "sha256-n0rYSMR5wgjAtlQ4DWRAhJW/VevGG/Mmj6lXieG1U78=";
+        hash = "sha256-dEikEQcGL6h59nTxY833XGBawUjceq8NxIUVhRdQ2I8=";
       };
       "aarch64-linux" = fetchCoreArtifact {
         id = "linux-arm64";
-        hash = "sha256-GOgBH0UinZMiNszTp2CWJKT9prTi84KH3V9fxpmweeU=";
+        hash = "sha256-92aZEb2bz7xXA4uSo3lWy/cApr88I+yNqDlAWo6nFpg=";
       };
       "x86_64-darwin" = fetchCoreArtifact {
         id = "osx-x64";
-        hash = "sha256-8TRlu1ztPciKDX9Igr0TKcyLzP8WRwTN9F11MjXNNW8=";
+        hash = "sha256-/5MghfgI8wup+o+eYMgcjI9Mjkjt1NPuN0x3JnqAlxg=";
       };
       "aarch64-darwin" = fetchCoreArtifact {
         id = "osx-arm64";
-        hash = "sha256-6Na7LBZg2bWaX1VN6r6zdyg0mszBNn0e7u+cmqKVuY0=";
+        hash = "sha256-UrgI4dy/VQCLZ/gyMX0D0YPabtw3IA76CpjLmbFLQeY=";
       };
     };
 
diff --git a/pkgs/by-name/vo/voicevox-engine/package.nix b/pkgs/by-name/vo/voicevox-engine/package.nix
index 0ca639093865..b999573501de 100644
--- a/pkgs/by-name/vo/voicevox-engine/package.nix
+++ b/pkgs/by-name/vo/voicevox-engine/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "voicevox-engine";
-  version = "0.24.0";
+  version = "0.24.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
     repo = "voicevox_engine";
     tag = version;
-    hash = "sha256-LFbKnNv+NNfA6dvgVGr8fGr+3o5/sAyZ8XFZan2EJUY=";
+    hash = "sha256-WoHTv4VjLFJPIi47WETMQM8JmgBctAWlue8yKmi1+6A=";
   };
 
   patches = [
@@ -99,7 +99,7 @@ python3Packages.buildPythonApplication rec {
       owner = "VOICEVOX";
       repo = "voicevox_resource";
       tag = version;
-      hash = "sha256-/L7gqskzg7NFBO6Jg2MEMYuQeZK58hTWrRypTE42nGg=";
+      hash = "sha256-4D9b5MjJQq+oCqSv8t7CILgFcotbNBH3m2F/up12pPE=";
     };
 
     pyopenjtalk = python3Packages.callPackage ./pyopenjtalk.nix { };
diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index 1b8b303807fb..dde014b43e85 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "voicevox";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
     repo = "voicevox";
     tag = finalAttrs.version;
-    hash = "sha256-2MXJOLt14zpoahYjd3l3q5UxT2yK/g/jksHO4Q7W6HA=";
+    hash = "sha256-ploFrzxIseyUD7LINnFmshrg3QJV8KUkdbvDoJ/VkRk=";
   };
 
   patches = [
@@ -64,8 +64,8 @@ stdenv.mkDerivation (finalAttrs: {
       moreutils
     ];
 
-    hash = "sha256-RKgqFmHQnjHS7yeUIbH9awpNozDOCCHplc/bmfxmMyg=";
     fetcherVersion = 1;
+    hash = "sha256-RKgqFmHQnjHS7yeUIbH9awpNozDOCCHplc/bmfxmMyg=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/vt/vtsls/package.nix b/pkgs/by-name/vt/vtsls/package.nix
index 4aba8fa0a226..851fdbc30491 100644
--- a/pkgs/by-name/vt/vtsls/package.nix
+++ b/pkgs/by-name/vt/vtsls/package.nix
@@ -40,8 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       version
       ;
-    hash = "sha256-SdqeTYRH60CyU522+nBo0uCDnzxDP48eWBAtGTL/pqg=";
     fetcherVersion = 1;
+    hash = "sha256-SdqeTYRH60CyU522+nBo0uCDnzxDP48eWBAtGTL/pqg=";
   };
 
   # Patches to get submodule sha from file instead of 'git submodule status'
diff --git a/pkgs/by-name/wa/wayfreeze/package.nix b/pkgs/by-name/wa/wayfreeze/package.nix
index 2f4328c6c8ae..3b7e0ec5faca 100644
--- a/pkgs/by-name/wa/wayfreeze/package.nix
+++ b/pkgs/by-name/wa/wayfreeze/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "wayfreeze";
-  version = "0-unstable-2025-06-29";
+  version = "0-unstable-2025-07-08";
 
   src = fetchFromGitHub {
     owner = "Jappie3";
     repo = "wayfreeze";
-    rev = "57877b94804b23e725257fcf26f7c296a5a38f8c";
-    hash = "sha256-dArJwfAm3jqJurNYMUOVzGMMp1ska0D+SkQ6tj0HhqQ=";
+    rev = "dc41ae1662c4c760f3deba9f826ba605e99971cc";
+    hash = "sha256-dDncKClSsRfkQ27x67U2Mpdcc+nx28bNZughJKar+RU=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
diff --git a/pkgs/by-name/wd/wdt/package.nix b/pkgs/by-name/wd/wdt/package.nix
index e2a26733c427..95e12fd6b062 100644
--- a/pkgs/by-name/wd/wdt/package.nix
+++ b/pkgs/by-name/wd/wdt/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation {
   pname = "wdt";
-  version = "1.27.1612021-unstable-2025-06-12";
+  version = "1.27.1612021-unstable-2025-07-09";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "wdt";
-    rev = "5fdb967ef2618e483341bc5021c6fa5f5506a549";
-    sha256 = "sha256-3RT7sM8KosrW0r/yrxa8fKz2dSjjf2684VL3ULqfkC4=";
+    rev = "e4d03e392e90b8ff4d2a67da31d65405afd32db5";
+    sha256 = "sha256-epjZFTczJLmI5MgKLMVXhEhv9MYJCYWYOAkZcvqeBs0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/we/wealthfolio/package.nix b/pkgs/by-name/we/wealthfolio/package.nix
index 42bfe5434ca1..31b6c06ef864 100644
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@@ -29,8 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) src pname version;
-    hash = "sha256-KupqObdNrnWbbt9C4NNmgmQCfJ2O4FjJBwGy6XQhhHg=";
     fetcherVersion = 1;
+    hash = "sha256-KupqObdNrnWbbt9C4NNmgmQCfJ2O4FjJBwGy6XQhhHg=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/wo/woomer/package.nix b/pkgs/by-name/wo/woomer/package.nix
index f3984cb551fa..cafcacacd82b 100644
--- a/pkgs/by-name/wo/woomer/package.nix
+++ b/pkgs/by-name/wo/woomer/package.nix
@@ -8,21 +8,22 @@
   pkg-config,
   rustPlatform,
   wayland,
+  libgbm,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "woomer";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "coffeeispower";
     repo = "woomer";
     tag = version;
-    hash = "sha256-puALhN54ma2KToXUF8ipaYysyayjaSp+ISZ3AgQvniw=";
+    hash = "sha256-LcL43Wq+5d7HPsm2bEK0vZsjP/dixtNhMKywXMi4ODw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-VQee/2adBvJpJDihWuo22JNyDKLkZ9PrVqWPB/gJ9Sw=";
+  cargoHash = "sha256-xll/A0synEsXy9kPThA3bR8LRuAOQH0T6CAfIEoYJ0w=";
 
   strictDeps = true;
 
@@ -35,6 +36,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     glfw3
     wayland
+    libgbm
   ];
 
   # `raylib-sys` wants to compile examples that don't exist in its crate
diff --git a/pkgs/by-name/wo/wox/package.nix b/pkgs/by-name/wo/wox/package.nix
index cb5987089024..f06e7652d6aa 100644
--- a/pkgs/by-name/wo/wox/package.nix
+++ b/pkgs/by-name/wo/wox/package.nix
@@ -74,8 +74,8 @@ let
         src
         sourceRoot
         ;
-      hash = "sha256-4Xj6doUHFoZSwel+cPnr2m3rfvlxNmQCppm5gXGIEtU=";
       fetcherVersion = 1;
+      hash = "sha256-4Xj6doUHFoZSwel+cPnr2m3rfvlxNmQCppm5gXGIEtU=";
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/wp/wpprobe/package.nix b/pkgs/by-name/wp/wpprobe/package.nix
index 866956db428b..8c5fa5cafa9b 100644
--- a/pkgs/by-name/wp/wpprobe/package.nix
+++ b/pkgs/by-name/wp/wpprobe/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wpprobe";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "Chocapikk";
     repo = "wpprobe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6aL1hK9oZYcBVQbfualIOsYrbMWTA1uV+fEKbOFaSHU=";
+    hash = "sha256-duTd+4nY8G8+RPlNBrcEZ4hBd4lf/gEyykIdbWcWPbs=";
   };
 
   vendorHash = "sha256-KV6Ss0fN3xwm5Id7MAHMUjq9TsQbaInLjd5xcLKGX6U=";
diff --git a/pkgs/by-name/wr/wrangler/package.nix b/pkgs/by-name/wr/wrangler/package.nix
index d1cf0d4f75bb..01cc0714480b 100644
--- a/pkgs/by-name/wr/wrangler/package.nix
+++ b/pkgs/by-name/wr/wrangler/package.nix
@@ -33,8 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       postPatch
       ;
-    hash = "sha256-r3QswmqP6CNufnsFM0KeKojm/HjHogrfYO/TdL3SrmA=";
     fetcherVersion = 1;
+    hash = "sha256-r3QswmqP6CNufnsFM0KeKojm/HjHogrfYO/TdL3SrmA=";
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''
diff --git a/pkgs/by-name/xl/xloadimage/package.nix b/pkgs/by-name/xl/xloadimage/package.nix
index 6a94e3ba6ae8..1f29e514dec3 100644
--- a/pkgs/by-name/xl/xloadimage/package.nix
+++ b/pkgs/by-name/xl/xloadimage/package.nix
@@ -2,9 +2,11 @@
   lib,
   stdenv,
   fetchurl,
+  fetchzip,
   libX11,
   libXt,
   autoreconfHook,
+  quilt,
 
   libjpeg ? null,
   libpng ? null,
@@ -20,23 +22,30 @@ assert withPngSupport -> libpng != null;
 assert withTiffSupport -> libtiff != null;
 
 let
+  version = "4.1";
   deb_patch = "25";
+  debian_patches = fetchzip {
+    url = "mirror://debian/pool/main/x/xloadimage/xloadimage_${version}-${deb_patch}.debian.tar.xz";
+    hash = "sha256-5FbkiYjI8ASUyi1DTFiAcJ9y2z1sEKrNNyKoqnca30I=";
+  };
 in
 stdenv.mkDerivation rec {
-  version = "4.1";
   pname = "xloadimage";
+  inherit version;
 
   src = fetchurl {
     url = "mirror://debian/pool/main/x/xloadimage/xloadimage_${version}.orig.tar.gz";
     sha256 = "1i7miyvk5ydhi6yi8593vapavhwxcwciir8wg9d2dcyg9pccf2s0";
   };
 
-  patches = fetchurl {
-    url = "mirror://debian/pool/main/x/xloadimage/xloadimage_${version}-${deb_patch}.debian.tar.xz";
-    sha256 = "17k518vrdrya5c9dqhpmm4g0h2vlkq1iy87sg2ngzygypbli1xvn";
-  };
+  postPatch = ''
+    QUILT_PATCHES=${debian_patches}/patches quilt push -a
+  '';
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    quilt
+  ];
 
   buildInputs =
     [
diff --git a/pkgs/by-name/xs/xscreensaver/package.nix b/pkgs/by-name/xs/xscreensaver/package.nix
index e02f96562936..62ec22428439 100644
--- a/pkgs/by-name/xs/xscreensaver/package.nix
+++ b/pkgs/by-name/xs/xscreensaver/package.nix
@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xscreensaver";
-  version = "6.11";
+  version = "6.12";
 
   src = fetchurl {
     url = "https://www.jwz.org/xscreensaver/xscreensaver-${finalAttrs.version}.tar.gz";
-    hash = "sha256-lIi3ouZVkSh7lEMB8x+WjXcX/5vGswmJ46vtZiyH4eg=";
+    hash = "sha256-T/Z5ghfju7w8cza+7afoPq+/AzAawpsiNtpmoPExdkM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ye/yew-fmt/package.nix b/pkgs/by-name/ye/yew-fmt/package.nix
index 52763818adc1..7dc716500b6f 100644
--- a/pkgs/by-name/ye/yew-fmt/package.nix
+++ b/pkgs/by-name/ye/yew-fmt/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yew-fmt";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "its-the-shrimp";
     repo = "yew-fmt";
     tag = "v${version}";
-    hash = "sha256-kUelvhWUj9+nEHNWolhTJa8emdBInKV9cK2dF/H7dNQ=";
+    hash = "sha256-IrfL4t92neaJS8UybnHeAg9hShER6TLK1nuFqPHYoMg=";
   };
 
-  cargoHash = "sha256-oIliRYc6HU8KFmlTTIlV+nmeRUx1gJhy93QjPnGxiK8=";
+  cargoHash = "sha256-AvtrqqsUGW9qG+ZHd/PrCLAHKk9psS3tnd1SPkdsNXw=";
   nativeCheckInputs = [ rustfmt ];
   passthru.updateScript = nix-update-script { };
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/za/zammad/package.nix b/pkgs/by-name/za/zammad/package.nix
index 16d9dd41c465..062c8842d1e1 100644
--- a/pkgs/by-name/za/zammad/package.nix
+++ b/pkgs/by-name/za/zammad/package.nix
@@ -81,8 +81,8 @@ stdenvNoCC.mkDerivation {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname src;
 
-    hash = "sha256-mfdzb/LXQYL8kaQpWi9wD3OOroOOonDlJrhy9Dwl1no";
     fetcherVersion = 1;
+    hash = "sha256-mfdzb/LXQYL8kaQpWi9wD3OOroOOonDlJrhy9Dwl1no";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix
index 99921816e3eb..3b4b13a362fb 100644
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-aiSZS6FEs7kqGXxC9Tx6Rngv3qrPMi5gOuh5Z3/oZyc=";
     fetcherVersion = 1;
+    hash = "sha256-aiSZS6FEs7kqGXxC9Tx6Rngv3qrPMi5gOuh5Z3/oZyc=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/ze/zenn-cli/package.nix b/pkgs/by-name/ze/zenn-cli/package.nix
index 9f1a07298756..092748bd6de7 100644
--- a/pkgs/by-name/ze/zenn-cli/package.nix
+++ b/pkgs/by-name/ze/zenn-cli/package.nix
@@ -56,8 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-AjdXclrNl1AHJ4LXq9I5Rk6KGyDaWXW187o2uLwRy/o=";
     fetcherVersion = 1;
+    hash = "sha256-AjdXclrNl1AHJ4LXq9I5Rk6KGyDaWXW187o2uLwRy/o=";
   };
 
   preBuild =
diff --git a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
index eb0c4c21d2b5..4320ede7126d 100644
--- a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-OPfs9WiUehKPaAqqgMOiIELoCPVBFYpNKeesfmA8Db0=";
     fetcherVersion = 1;
+    hash = "sha256-OPfs9WiUehKPaAqqgMOiIELoCPVBFYpNKeesfmA8Db0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zi/zipline/package.nix b/pkgs/by-name/zi/zipline/package.nix
index a44a9b099dc8..fb9d95826bfd 100644
--- a/pkgs/by-name/zi/zipline/package.nix
+++ b/pkgs/by-name/zi/zipline/package.nix
@@ -43,8 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-kIneqtLPZ29PzluKUGO4XbQYHbNddu0kTfoP4C22k7U=";
     fetcherVersion = 1;
+    hash = "sha256-kIneqtLPZ29PzluKUGO4XbQYHbNddu0kTfoP4C22k7U=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/zo/zola/package.nix b/pkgs/by-name/zo/zola/package.nix
index 2d59b4a35f00..894f00b55d8a 100644
--- a/pkgs/by-name/zo/zola/package.nix
+++ b/pkgs/by-name/zo/zola/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zola";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "getzola";
     repo = "zola";
     rev = "v${version}";
-    hash = "sha256-pk7xlNgYybKHm7Zn6cbO1CMUOAKVtX1uxq+6vl48FZk=";
+    hash = "sha256-+/0MhKKDSbOEa5btAZyaS3bQPeGJuski/07I4Q9v9cg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3Po9PA5XJeiwkMaq/8glfaC1E7QmSeuR81BwOyMznOM=";
+  cargoHash = "sha256-K2wdq61FVVG9wJF+UcRZyZ2YSEw3iavboAGkzCcTGkU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 3c82cb82ff13..318eae02bd6c 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -152,8 +152,9 @@ let
       license = lib.licenses.unfree;
       platforms = builtins.attrNames srcs;
       maintainers = with lib.maintainers; [
-        danbst
-        tadfisher
+        philiptaron
+        ryan4yin
+        yarny
       ];
       mainProgram = "zoom";
     };
@@ -245,10 +246,6 @@ let
     version = versions.${system} or throwSystem;
 
     targetPkgs = pkgs: (linuxGetDependencies pkgs) ++ [ unpacked ];
-    extraPreBwrapCmds = ''
-      unset QT_PLUGIN_PATH
-      unset LANG  # would break settings dialog on non-"en_XX" locales
-    '';
     extraBwrapArgs = [ "--ro-bind ${unpacked}/opt /opt" ];
     runScript = "/opt/zoom/ZoomLauncher";
 
diff --git a/pkgs/by-name/zz/zziplib/package.nix b/pkgs/by-name/zz/zziplib/package.nix
index effdb4b4bd4e..14e17d1b4b9b 100644
--- a/pkgs/by-name/zz/zziplib/package.nix
+++ b/pkgs/by-name/zz/zziplib/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zziplib";
-  version = "0.13.79";
+  version = "0.13.80";
 
   src = fetchFromGitHub {
     owner = "gdraheim";
     repo = "zziplib";
-    rev = "v${version}";
-    hash = "sha256-PUG6MAglYJXJzQMWM7KfLFbHG3bva7FyaP+HdCsRnZQ=";
+    tag = "v${version}";
+    hash = "sha256-vvPcQBRk1iIPNk5qI7N0Nv9JWndVfFH6oGxyr9ZIt0g=";
   };
 
   nativeBuildInputs = [
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
     xmlto
     zip
   ];
+
   buildInputs = [
     zlib
   ];
@@ -50,7 +51,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://github.com/gdraheim/zziplib";
-    changelog = "https://github.com/gdraheim/zziplib/blob/${version}/ChangeLog";
+    changelog = "https://github.com/gdraheim/zziplib/blob/v${version}/ChangeLog";
     description = "Library to extract data from files archived in a zip file";
     longDescription = ''
       The zziplib library is intentionally lightweight, it offers the ability to
diff --git a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
index 78690280af4f..abda11fd84cf 100644
--- a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
@@ -1,6 +1,15 @@
 {
-  mkXfceDerivation,
-  gobject-introspection,
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  docbook_xml_dtd_412,
+  docbook-xsl-ns,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook3,
+  xmlto,
   dbus-glib,
   garcon,
   glib,
@@ -17,22 +26,37 @@
   systemd,
   xfconf,
   xfdesktop,
-  lib,
+  gitUpdater,
 }:
 
 let
   # For xfce4-screensaver-configure
   pythonEnv = python3.withPackages (pp: [ pp.pygobject3 ]);
 in
-mkXfceDerivation {
-  category = "apps";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-screensaver";
-  version = "4.18.4";
+  version = "4.20.0";
 
-  sha256 = "sha256-vkxkryi7JQg1L/JdWnO9qmW6Zx6xP5Urq4kXMe7Iiyc=";
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "apps";
+    repo = "xfce4-screensaver";
+    tag = "xfce4-screensaver-${finalAttrs.version}";
+    hash = "sha256-Pt7Rl+WlR2D4KC6GTXjQhs3yirrUgUG5XkKXnyaJZbo=";
+  };
+
+  strictDeps = true;
 
   nativeBuildInputs = [
-    gobject-introspection
+    docbook_xml_dtd_412
+    docbook-xsl-ns
+    gettext
+    glib # glib-compile-resources
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook3
+    xmlto
   ];
 
   buildInputs = [
@@ -53,18 +77,20 @@ mkXfceDerivation {
     xfconf
   ];
 
-  configureFlags = [ "--without-console-kit" ];
-
-  makeFlags = [ "DBUS_SESSION_SERVICE_DIR=$(out)/etc" ];
-
   preFixup = ''
     # For default wallpaper.
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${xfdesktop}/share")
   '';
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-screensaver-"; };
+
+  meta = {
+    homepage = "https://gitlab.xfce.org/apps/xfce4-screensaver";
     description = "Screensaver for Xfce";
-    maintainers = with maintainers; [ symphorien ];
-    teams = [ teams.xfce ];
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "xfce4-screensaver";
+    maintainers = with lib.maintainers; [ symphorien ];
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index 4673cf878abe..e2889789564e 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -16,82 +16,63 @@
   pcre2,
   xfce4-panel,
   xfconf,
-  makeWrapper,
-  symlinkJoin,
-  thunarPlugins ? [ ],
   withIntrospection ? false,
-  buildPackages,
   gobject-introspection,
 }:
 
-let
-  unwrapped = mkXfceDerivation {
-    category = "xfce";
-    pname = "thunar";
-    version = "4.20.3";
+mkXfceDerivation {
+  category = "xfce";
+  pname = "thunar";
+  version = "4.20.3";
 
-    sha256 = "sha256-YOh7tuCja9F2VvzX+QqsKHJfebXWbhLqvcraq6PBOGo=";
+  sha256 = "sha256-YOh7tuCja9F2VvzX+QqsKHJfebXWbhLqvcraq6PBOGo=";
 
-    nativeBuildInputs =
-      [
-        docbook_xsl
-        libxslt
-      ]
-      ++ lib.optionals withIntrospection [
-        gobject-introspection
-      ];
-
-    buildInputs = [
-      exo
-      gdk-pixbuf
-      gtk3
-      libX11
-      libexif # image properties page
-      libgudev
-      libnotify
-      libxfce4ui
-      libxfce4util
-      pcre2 # search & replace renamer
-      xfce4-panel # trash panel applet plugin
-      xfconf
+  nativeBuildInputs =
+    [
+      docbook_xsl
+      libxslt
+    ]
+    ++ lib.optionals withIntrospection [
+      gobject-introspection
     ];
 
-    configureFlags = [ "--with-custom-thunarx-dirs-enabled" ];
+  buildInputs = [
+    exo
+    gdk-pixbuf
+    gtk3
+    libX11
+    libexif # image properties page
+    libgudev
+    libnotify
+    libxfce4ui
+    libxfce4util
+    pcre2 # search & replace renamer
+    xfce4-panel # trash panel applet plugin
+    xfconf
+  ];
 
-    # the desktop file … is in an insecure location»
-    # which pops up when invoking desktop files that are
-    # symlinks to the /nix/store
-    #
-    # this error was added by this commit:
-    # https://github.com/xfce-mirror/thunar/commit/1ec8ff89ec5a3314fcd6a57f1475654ddecc9875
-    postPatch = ''
-      sed -i -e 's|thunar_dialogs_show_insecure_program (parent, _(".*"), file, exec)|1|' thunar/thunar-file.c
-    '';
+  configureFlags = [ "--with-custom-thunarx-dirs-enabled" ];
 
-    preFixup = ''
-      gappsWrapperArgs+=(
-        # https://github.com/NixOS/nixpkgs/issues/329688
-        --prefix PATH : ${lib.makeBinPath [ exo ]}
-      )
-    '';
+  # the desktop file … is in an insecure location»
+  # which pops up when invoking desktop files that are
+  # symlinks to the /nix/store
+  #
+  # this error was added by this commit:
+  # https://github.com/xfce-mirror/thunar/commit/1ec8ff89ec5a3314fcd6a57f1475654ddecc9875
+  postPatch = ''
+    sed -i -e 's|thunar_dialogs_show_insecure_program (parent, _(".*"), file, exec)|1|' thunar/thunar-file.c
+  '';
 
-    meta = with lib; {
-      description = "Xfce file manager";
-      mainProgram = "thunar";
-      teams = [ teams.xfce ];
-    };
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # https://github.com/NixOS/nixpkgs/issues/329688
+      --prefix PATH : ${lib.makeBinPath [ exo ]}
+    )
+  '';
+
+  meta = with lib; {
+    description = "Xfce file manager";
+    mainProgram = "thunar";
+    teams = [ teams.xfce ];
   };
-
-in
-if thunarPlugins == [ ] then
-  unwrapped
-else
-  import ./wrapper.nix {
-    inherit
-      makeWrapper
-      symlinkJoin
-      thunarPlugins
-      lib
-      ;
-    thunar = unwrapped;
-  }
+}
diff --git a/pkgs/desktops/xfce/core/thunar/wrapper.nix b/pkgs/desktops/xfce/core/thunar/wrapper.nix
index e4b3cec39d84..009710ea353e 100644
--- a/pkgs/desktops/xfce/core/thunar/wrapper.nix
+++ b/pkgs/desktops/xfce/core/thunar/wrapper.nix
@@ -2,53 +2,61 @@
   lib,
   makeWrapper,
   symlinkJoin,
-  thunar,
-  thunarPlugins,
+  thunar-unwrapped,
+  thunarPlugins ? [ ],
 }:
 
-symlinkJoin {
-  name = "thunar-with-plugins-${thunar.version}";
+let
+  thunar = thunar-unwrapped;
+in
 
-  paths = [ thunar ] ++ thunarPlugins;
+if thunarPlugins == [ ] then
+  thunar
 
-  nativeBuildInputs = [ makeWrapper ];
+else
+  symlinkJoin {
+    name = "thunar-with-plugins-${thunar.version}";
 
-  postBuild = ''
-    wrapProgram "$out/bin/thunar" \
-      --set "THUNARX_DIRS" "$out/lib/thunarx-3"
+    paths = [ thunar ] ++ thunarPlugins;
 
-    wrapProgram "$out/bin/thunar-settings" \
-      --set "THUNARX_DIRS" "$out/lib/thunarx-3"
+    nativeBuildInputs = [ makeWrapper ];
 
-    # NOTE: we need to remove the folder symlink itself and create
-    # a new folder before trying to substitute any file below.
-    rm -f "$out/lib/systemd/user"
-    mkdir -p "$out/lib/systemd/user"
+    postBuild = ''
+      wrapProgram "$out/bin/thunar" \
+        --set "THUNARX_DIRS" "$out/lib/thunarx-3"
 
-    # point to wrapped binary in all service files
-    for file in "lib/systemd/user/thunar.service" \
-      "share/dbus-1/services/org.xfce.FileManager.service" \
-      "share/dbus-1/services/org.xfce.Thunar.FileManager1.service" \
-      "share/dbus-1/services/org.xfce.Thunar.service"
-    do
-      rm -f "$out/$file"
-      substitute "${thunar}/$file" "$out/$file" \
-        --replace "${thunar}" "$out"
-    done
-  '';
+      wrapProgram "$out/bin/thunar-settings" \
+        --set "THUNARX_DIRS" "$out/lib/thunarx-3"
 
-  meta = with lib; {
-    inherit (thunar.meta)
-      homepage
-      license
-      platforms
-      teams
-      ;
+      # NOTE: we need to remove the folder symlink itself and create
+      # a new folder before trying to substitute any file below.
+      rm -f "$out/lib/systemd/user"
+      mkdir -p "$out/lib/systemd/user"
 
-    description =
-      thunar.meta.description
-      +
-        optionalString (0 != length thunarPlugins)
-          " (with plugins: ${concatStringsSep ", " (map (x: x.name) thunarPlugins)})";
-  };
-}
+      # point to wrapped binary in all service files
+      for file in "lib/systemd/user/thunar.service" \
+        "share/dbus-1/services/org.xfce.FileManager.service" \
+        "share/dbus-1/services/org.xfce.Thunar.FileManager1.service" \
+        "share/dbus-1/services/org.xfce.Thunar.service"
+      do
+        rm -f "$out/$file"
+        substitute "${thunar}/$file" "$out/$file" \
+          --replace "${thunar}" "$out"
+      done
+    '';
+
+    meta = with lib; {
+      inherit (thunar.meta)
+        homepage
+        license
+        platforms
+        teams
+        ;
+
+      description =
+        thunar.meta.description
+        +
+          optionalString (0 != length thunarPlugins)
+            " (with plugins: ${concatStringsSep ", " (map (x: x.name) thunarPlugins)})";
+    };
+  }
diff --git a/pkgs/desktops/xfce/default.nix b/pkgs/desktops/xfce/default.nix
index 2a907a4ba39c..bdd3a9aadc84 100644
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@@ -33,9 +33,9 @@ makeScopeWithSplicing' {
 
       libxfce4windowing = callPackage ./core/libxfce4windowing { };
 
-      thunar = callPackage ./core/thunar {
-        thunarPlugins = [ ];
-      };
+      thunar-unwrapped = callPackage ./core/thunar { };
+
+      thunar = callPackage ./core/thunar/wrapper.nix { };
 
       thunar-volman = callPackage ./core/thunar-volman { };
 
@@ -169,7 +169,7 @@ makeScopeWithSplicing' {
 
       xinitrc = self.xfce4-session.xinitrc; # added 2019-11-04
 
-      thunar-bare = self.thunar.override { thunarPlugins = [ ]; }; # added 2019-11-04
+      thunar-bare = self.thunar-unwrapped; # added 2019-11-04
 
       xfce4-datetime-plugin = throw ''
         xfce4-datetime-plugin has been removed: this plugin has been merged into the xfce4-panel's built-in clock
diff --git a/pkgs/development/compilers/openjdk/generic.nix b/pkgs/development/compilers/openjdk/generic.nix
index a6913dc9bdc8..3daca22c905d 100644
--- a/pkgs/development/compilers/openjdk/generic.nix
+++ b/pkgs/development/compilers/openjdk/generic.nix
@@ -427,8 +427,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildFlags = if atLeast17 then [ "images" ] else [ "all" ];
 
-  separateDebugInfo = true;
-  __structuredAttrs = true;
+  separateDebugInfo = atLeast11;
+  __structuredAttrs = atLeast11;
 
   # -j flag is explicitly rejected by the build system:
   #     Error: 'make -jN' is not supported, use 'make JOBS=N'
diff --git a/pkgs/development/compilers/rust/1_88.nix b/pkgs/development/compilers/rust/1_88.nix
index 2bf2a6c2875f..fef90efe0927 100644
--- a/pkgs/development/compilers/rust/1_88.nix
+++ b/pkgs/development/compilers/rust/1_88.nix
@@ -7,7 +7,6 @@
 # 2. The LLVM version used for building should match with rust upstream.
 #    Check the version number in the src/llvm-project git submodule in:
 #    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
 
 {
   stdenv,
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 1f2bb0174a32..9cf00c318a16 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -3214,6 +3214,18 @@ with haskellLib;
   brillo-juicy = warnAfterVersion "0.2.4" (doJailbreak super.brillo-juicy);
   brillo = warnAfterVersion "1.13.3" (doJailbreak super.brillo);
 
+  # Floating point precision issues. Test suite is only checked on x86_64.
+  # https://github.com/tweag/monad-bayes/issues/368
+  monad-bayes = dontCheckIf (
+    let
+      inherit (pkgs.stdenv) hostPlatform;
+    in
+    !hostPlatform.isx86_64
+    # Presumably because we emulate x86_64-darwin via Rosetta, x86_64-darwin
+    # also fails on Hydra
+    || hostPlatform.isDarwin
+  ) super.monad-bayes;
+
   # 2025-04-13: jailbreak to allow th-abstraction >= 0.7
   crucible = warnAfterVersion "0.7.2" (
     doJailbreak (
diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index e32bbbdf24d2..601aa9db8868 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -130,10 +130,16 @@ stdenv.mkDerivation {
 
   doCheck = true;
 
-  postInstall = lib.optionalString (withModules != [ ]) (
-    ''bash ./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
-    + lib.concatMapStrings (x: " " + x) withModules
-  );
+  postInstall = lib.optionalString (withModules != [ ]) ''
+    bash ./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full \
+      ${lib.concatMapStrings (x: " " + x) withModules}
+
+    find "$out"/lib/clisp*/full -type l -name "*.o" | while read -r symlink; do
+      if [[ "$(readlink "$symlink")" =~ (.*\/builddir\/)(.*) ]]; then
+        ln -sf "../''${BASH_REMATCH[2]}" "$symlink"
+      fi
+    done
+  '';
 
   env.NIX_CFLAGS_COMPILE = "-O0 -falign-functions=${
     if stdenv.hostPlatform.is64bit then "8" else "4"
diff --git a/pkgs/development/libraries/astal/source.nix b/pkgs/development/libraries/astal/source.nix
index ec4678cb0894..be6aa94308ab 100644
--- a/pkgs/development/libraries/astal/source.nix
+++ b/pkgs/development/libraries/astal/source.nix
@@ -7,15 +7,15 @@ let
   originalDrv = fetchFromGitHub {
     owner = "Aylur";
     repo = "astal";
-    rev = "ac90f09385a2295da9fdc108aaba4a317aaeacc7";
-    hash = "sha256-AodIKw7TmI7rHVcOfEsO82stupMYIMVQeLAUQfVxnkU=";
+    rev = "81eb3770965190024803ed6dd0fe35318da64831";
+    hash = "sha256-5Nr80lTZJ8ewuxIzRHc6E8L4LW4rdGZukiZyL7nOVSE=";
   };
 in
 originalDrv.overrideAttrs (
   final: prev: {
     name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
     pname = "astal-source";
-    version = "0-unstable-2025-06-28";
+    version = "0-unstable-2025-07-11";
 
     meta = prev.meta // {
       description = "Building blocks for creating custom desktop shells (source)";
diff --git a/pkgs/development/libraries/kquickimageedit/0.3.0.nix b/pkgs/development/libraries/kquickimageedit/0.3.0.nix
new file mode 100644
index 000000000000..358105ed2c1b
--- /dev/null
+++ b/pkgs/development/libraries/kquickimageedit/0.3.0.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  extra-cmake-modules,
+  qtbase,
+  qtdeclarative,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kquickimageeditor";
+  version = "0.3.0";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "libraries";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-+BByt07HMb4u6j9bVZqkUPvyRaElKvJ2MjKlPakL87E=";
+  };
+
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [
+    qtbase
+    qtdeclarative
+  ];
+  cmakeFlags = [ "-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}" ];
+  dontWrapQtApps = true;
+
+  meta = with lib; {
+    description = "Set of QtQuick components providing basic image editing capabilities";
+    homepage = "https://invent.kde.org/libraries/kquickimageeditor";
+    license = licenses.lgpl21Plus;
+    platforms = platforms.unix;
+    badPlatforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/development/libraries/kquickimageedit/default.nix b/pkgs/development/libraries/kquickimageedit/default.nix
index 358105ed2c1b..6b7950d4fd8b 100644
--- a/pkgs/development/libraries/kquickimageedit/default.nix
+++ b/pkgs/development/libraries/kquickimageedit/default.nix
@@ -3,28 +3,29 @@
   stdenv,
   fetchFromGitLab,
   extra-cmake-modules,
+  kdePackages,
   qtbase,
   qtdeclarative,
 }:
 
 stdenv.mkDerivation rec {
   pname = "kquickimageeditor";
-  version = "0.3.0";
+  version = "0.5.1";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "libraries";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+BByt07HMb4u6j9bVZqkUPvyRaElKvJ2MjKlPakL87E=";
+    sha256 = "sha256-8TJBg42E9lNbLpihjtc5Z/drmmSGQmic8yO45yxSNQ4=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
+    kdePackages.kirigami
     qtbase
     qtdeclarative
   ];
-  cmakeFlags = [ "-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}" ];
   dontWrapQtApps = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/protobuf/24.nix b/pkgs/development/libraries/protobuf/24.nix
deleted file mode 100644
index ad808810ad63..000000000000
--- a/pkgs/development/libraries/protobuf/24.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (
-  {
-    version = "24.4";
-    hash = "sha256-I+Xtq4GOs++f/RlVff9MZuolXrMLmrZ2z6mkBayqQ2s=";
-  }
-  // args
-)
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index d41104dbf560..3f69c382ff77 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -109,6 +109,13 @@ let
       USE_OPENMP = false;
     };
 
+    powerpc64-linux = {
+      BINARY = 64;
+      TARGET = setTarget "POWER4";
+      DYNAMIC_ARCH = setDynamicArch false;
+      USE_OPENMP = !stdenv.hostPlatform.isMusl;
+    };
+
     powerpc64le-linux = {
       BINARY = 64;
       TARGET = setTarget "POWER5";
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index eeb1fd0b633d..baae48d64427 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -966,7 +966,8 @@ in
 
   rocks-dev-nvim = prev.rocks-dev-nvim.overrideAttrs (oa: {
 
-    doCheck = true;
+    # E5113: Error while calling lua chunk [...] pl.path requires LuaFileSystem
+    doCheck = luaOlder "5.2";
     nativeCheckInputs = [
       final.nlua
       final.busted
diff --git a/pkgs/development/ocaml-modules/smtml/default.nix b/pkgs/development/ocaml-modules/smtml/default.nix
index d68add0058e4..dd3999f3f960 100644
--- a/pkgs/development/ocaml-modules/smtml/default.nix
+++ b/pkgs/development/ocaml-modules/smtml/default.nix
@@ -25,13 +25,13 @@
 
 buildDunePackage rec {
   pname = "smtml";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "formalsec";
     repo = "smtml";
     tag = "v${version}";
-    hash = "sha256-QxVORnu28mcs54ZEPMxI5Bch/+/gkIfn0bTqrnSKUOw=";
+    hash = "sha256-gmYyVUkwXBqGKGhp6Pqdf2PJafUJ1hF96WxOLq1h2f8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aider-chat/default.nix b/pkgs/development/python-modules/aider-chat/default.nix
index 4bcd0efece97..11cbaaa39908 100644
--- a/pkgs/development/python-modules/aider-chat/default.nix
+++ b/pkgs/development/python-modules/aider-chat/default.nix
@@ -264,6 +264,7 @@ let
     disabledTestPaths = [
       # Tests require network access
       "tests/scrape/test_scrape.py"
+      "tests/basic/test_repomap.py"
       # Expected 'mock' to have been called once
       "tests/help/test_help.py"
     ];
@@ -273,6 +274,7 @@ let
         # Tests require network
         "test_urls"
         "test_get_commit_message_with_custom_prompt"
+        "test_cmd_tokens_output"
         # FileNotFoundError
         "test_get_commit_message"
         # Expected 'launch_gui' to have been called once
diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
index 266f9b072411..3818ad68ef14 100644
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "aiolifx";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pAuQLeqLVkVEW/iByXk9brfEm79rR4ZL+ncUA0MxOnM=";
+    hash = "sha256-h82KPrHcWUUrQFyMy3fY6BmQFA5a4DFJdhJ6zRnKMsc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ancp-bids/default.nix b/pkgs/development/python-modules/ancp-bids/default.nix
index 4711b2bf2030..10a184ca67cd 100644
--- a/pkgs/development/python-modules/ancp-bids/default.nix
+++ b/pkgs/development/python-modules/ancp-bids/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ancp-bids";
-  version = "0.2.9";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "ANCPLabOldenburg";
     repo = "ancp-bids";
     tag = version;
-    hash = "sha256-vmw8SAikvbaHnPOthBQxTbyvDwnnZwCOV97aUogIgxw=";
+    hash = "sha256-n8QfQ2PGdAO6kTfkbFpj3f2gYa3vwuYg+vPpZlGNpb0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/conda-package-streaming/default.nix b/pkgs/development/python-modules/conda-package-streaming/default.nix
index 6649fe770a07..d0fed91251b7 100644
--- a/pkgs/development/python-modules/conda-package-streaming/default.nix
+++ b/pkgs/development/python-modules/conda-package-streaming/default.nix
@@ -8,14 +8,14 @@
 }:
 buildPythonPackage rec {
   pname = "conda-package-streaming";
-  version = "0.11.0";
+  version = "0.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "conda";
     repo = "conda-package-streaming";
     tag = "v${version}";
-    hash = "sha256-Y0moewJROhybbyo263akbO20Q6As245ULKJikkWU4XE=";
+    hash = "sha256-BfvD+64c9uxBvEJnAuI4MaF0CqS9Gwnqx1Xi+l36Dwo=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/ddgs/default.nix b/pkgs/development/python-modules/ddgs/default.nix
new file mode 100644
index 000000000000..9ca4c278600e
--- /dev/null
+++ b/pkgs/development/python-modules/ddgs/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  click,
+  primp,
+  lxml,
+  versionCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "ddgs";
+  version = "9.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "deedy5";
+    repo = "ddgs";
+    tag = "v${version}";
+    hash = "sha256-c0kTZV+lM1/vkI51TK6klUmnoaAdt8KSEn/rjeqcBa8=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    primp
+    lxml
+  ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  pythonImportsCheck = [ "ddgs" ];
+
+  meta = {
+    description = "D.D.G.S. | Dux Distributed Global Search. A metasearch library that aggregates results from diverse web search services";
+    mainProgram = "ddgs";
+    homepage = "https://github.com/deedy5/ddgs";
+    changelog = "https://github.com/deedy5/ddgs/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drawbu ];
+  };
+}
diff --git a/pkgs/development/python-modules/django-filingcabinet/default.nix b/pkgs/development/python-modules/django-filingcabinet/default.nix
index 19c27bc950ec..8e9e8b46d6e0 100644
--- a/pkgs/development/python-modules/django-filingcabinet/default.nix
+++ b/pkgs/development/python-modules/django-filingcabinet/default.nix
@@ -94,8 +94,8 @@ buildPythonPackage rec {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-kvLV/pCX/wQHG0ttrjSro7/CoQ5K1T0aFChafQOwvNw=";
     fetcherVersion = 1;
+    hash = "sha256-kvLV/pCX/wQHG0ttrjSro7/CoQ5K1T0aFChafQOwvNw=";
   };
 
   postBuild = ''
diff --git a/pkgs/development/python-modules/django-types/default.nix b/pkgs/development/python-modules/django-types/default.nix
index d9f4776bf293..326a0bb2a860 100644
--- a/pkgs/development/python-modules/django-types/default.nix
+++ b/pkgs/development/python-modules/django-types/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "django-types";
-  version = "0.20.0";
+  version = "0.22.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "django_types";
     inherit version;
-    hash = "sha256-TlXSxWFV49addd756x2VqJEwPyrBn8z2/oBW2kKT+uc=";
+    hash = "sha256-TOzJ7uhG5/8qOYvsnf5lQ+du+5IqeljF1gZLyw5qPcU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/djangosaml2/default.nix b/pkgs/development/python-modules/djangosaml2/default.nix
index c3e130ba27a4..7d1c6d09e5f1 100644
--- a/pkgs/development/python-modules/djangosaml2/default.nix
+++ b/pkgs/development/python-modules/djangosaml2/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "djangosaml2";
-  version = "1.11.0";
+  version = "1.11.1-1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "IdentityPython";
     repo = "djangosaml2";
     tag = "v${version}";
-    hash = "sha256-AkyXxWcckBVWUZAhjuUru2b1/t4iwoCKxmTvvqSziV0=";
+    hash = "sha256-f7VgysfGpwt4opmXXaigRsOBS506XB/jZV1zRiYwZig=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/docling-parse/default.nix b/pkgs/development/python-modules/docling-parse/default.nix
index a6e6fba0468c..ebca992e63b0 100644
--- a/pkgs/development/python-modules/docling-parse/default.nix
+++ b/pkgs/development/python-modules/docling-parse/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "docling-parse";
-  version = "4.0.5";
+  version = "4.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-parse";
     tag = "v${version}";
-    hash = "sha256-H8/T9gwQ6MeNsNcJ5I9cVnQVFEXHfmqYCxhkxszD8/w=";
+    hash = "sha256-1vl5Ij25NXAwhoXLJ35lcr5r479jrdKd9DxWhYbCApw=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/development/python-modules/drf-extra-fields/default.nix b/pkgs/development/python-modules/drf-extra-fields/default.nix
index 431ad99e0d19..9ffeddfab9bb 100644
--- a/pkgs/development/python-modules/drf-extra-fields/default.nix
+++ b/pkgs/development/python-modules/drf-extra-fields/default.nix
@@ -48,16 +48,18 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "drf_extra_fields" ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.13") [
-    # https://github.com/Hipo/drf-extra-fields/issues/210
-    "test_read_source_with_context"
-
-    # pytz causes the following tests to fail
-    "test_create"
-    "test_create_with_base64_prefix"
-    "test_create_with_webp_image"
-    "test_remove_with_empty_string"
-  ];
+  disabledTests =
+    [
+      # pytz causes the following tests to fail
+      "test_create"
+      "test_create_with_base64_prefix"
+      "test_create_with_webp_image"
+      "test_remove_with_empty_string"
+    ]
+    ++ lib.optionals (pythonAtLeast "3.13") [
+      # https://github.com/Hipo/drf-extra-fields/issues/210
+      "test_read_source_with_context"
+    ];
 
   meta = {
     description = "Extra Fields for Django Rest Framework";
diff --git a/pkgs/development/python-modules/drf-pydantic/default.nix b/pkgs/development/python-modules/drf-pydantic/default.nix
new file mode 100644
index 000000000000..c9c9d90eb247
--- /dev/null
+++ b/pkgs/development/python-modules/drf-pydantic/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  django,
+  pydantic,
+  hatchling,
+  djangorestframework,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "drf-pydantic";
+  version = "2.7.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "georgebv";
+    repo = "drf-pydantic";
+    tag = "v${version}";
+    hash = "sha256-ABtSoxj/+HHq4hj4Yb6bEiyOl00TCO/9tvBzhv6afxM=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    django
+    pydantic
+    djangorestframework
+  ];
+
+  nativeChecksInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/georgebv/drf-pydantic/releases/tag/${src.tag}";
+    description = "Use pydantic with the Django REST framework";
+    homepage = "https://github.com/georgebv/drf-pydantic";
+    maintainers = [ maintainers.kiara ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/dvclive/default.nix b/pkgs/development/python-modules/dvclive/default.nix
index 90c541c09e8b..def78905451a 100644
--- a/pkgs/development/python-modules/dvclive/default.nix
+++ b/pkgs/development/python-modules/dvclive/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "dvclive";
-  version = "3.48.2";
+  version = "3.48.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvclive";
     tag = version;
-    hash = "sha256-KwS5426EU0vym2fDbtIH4bmlSLKWLfZRRxXE+bEmGfc=";
+    hash = "sha256-peT7L4SpCtjOVr4qaLyFtqEIiqAnEaTMfYxu02L9q2s=";
   };
 
   build-system = [ setuptools-scm ];
@@ -115,7 +115,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for logging machine learning metrics and other metadata in simple file formats";
     homepage = "https://github.com/iterative/dvclive";
-    changelog = "https://github.com/iterative/dvclive/releases/tag/${version}";
+    changelog = "https://github.com/iterative/dvclive/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/edk2-pytool-library/default.nix b/pkgs/development/python-modules/edk2-pytool-library/default.nix
index 796daf64dc20..820008e94ea7 100644
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "edk2-pytool-library";
-  version = "0.23.3";
+  version = "0.23.6";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "tianocore";
     repo = "edk2-pytool-library";
     tag = "v${version}";
-    hash = "sha256-fWt9epsc77YCQiB5BeuCHUZ2Or8ddgMDSZPHC4f3yZ8=";
+    hash = "sha256-62uWRr1n3C51OeHeCKKJrB1KLcjRGnwBCgpC0RPWum8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 42068d644a01..354bb0cd06c1 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -85,8 +85,8 @@ buildPythonPackage rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-h3ulPik0Uf8X687Se3J7h3+8jYzwXtbO6obsO27zyfA=";
     fetcherVersion = 1;
+    hash = "sha256-h3ulPik0Uf8X687Se3J7h3+8jYzwXtbO6obsO27zyfA=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/ihm/default.nix b/pkgs/development/python-modules/ihm/default.nix
index 23617b9fba5c..f6ff9245d69b 100644
--- a/pkgs/development/python-modules/ihm/default.nix
+++ b/pkgs/development/python-modules/ihm/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "ihm";
-  version = "2.6";
+  version = "2.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ihmwg";
     repo = "python-ihm";
     tag = version;
-    hash = "sha256-g8ELTPPWnSXpzH7IiPTe4MS+jIFQPXx48D/X9dL2nPk=";
+    hash = "sha256-ZMHVYuNcUjhMKJUr5bCIELO6F0CNi0ESfbsBm5vOiA4=";
   };
 
   nativeBuildInputs = [ swig ];
diff --git a/pkgs/development/python-modules/jsonnet/default.nix b/pkgs/development/python-modules/jsonnet/default.nix
new file mode 100644
index 000000000000..66ffe5975aab
--- /dev/null
+++ b/pkgs/development/python-modules/jsonnet/default.nix
@@ -0,0 +1,23 @@
+{
+  pkgs,
+  buildPythonPackage,
+  setuptools,
+}:
+
+buildPythonPackage {
+  inherit (pkgs.jsonnet) pname version src;
+  pyproject = true;
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "_jsonnet" ];
+
+  meta = {
+    inherit (pkgs.jsonnet.meta)
+      description
+      maintainers
+      license
+      homepage
+      ;
+  };
+}
diff --git a/pkgs/development/python-modules/kernels/default.nix b/pkgs/development/python-modules/kernels/default.nix
index b4fb9cf0308b..4f97afd113e0 100644
--- a/pkgs/development/python-modules/kernels/default.nix
+++ b/pkgs/development/python-modules/kernels/default.nix
@@ -7,14 +7,14 @@
 }:
 buildPythonPackage rec {
   pname = "kernels";
-  version = "0.6.2";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "kernels";
     tag = "v${version}";
-    hash = "sha256-Akd1gbWcWfxkrhdN6NQ8qRDPRFAPuqy7a3bj2Z+BxF4=";
+    hash = "sha256-IbOadtnuRgN54Sg+mFULkkqi6LVlW+ohBgtemz/Pxxc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/langchain-aws/default.nix b/pkgs/development/python-modules/langchain-aws/default.nix
index f8d019357689..5c321651d0c4 100644
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-aws";
-  version = "0.2.27";
+  version = "0.2.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-aws";
     tag = "langchain-aws==${version}";
-    hash = "sha256-FHWozXf0zEyKvFODZ+8JHMiwARJETJxmLh3z1HJSNV4=";
+    hash = "sha256-sfdijQxcw0TNK1/IOmHQTHznDIMDTvXqMWBb58cTPlI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/langchain-google-genai/default.nix b/pkgs/development/python-modules/langchain-google-genai/default.nix
new file mode 100644
index 000000000000..0bb29afa3d52
--- /dev/null
+++ b/pkgs/development/python-modules/langchain-google-genai/default.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  filetype,
+  google-api-core,
+  google-auth,
+  google-generativeai,
+  langchain-core,
+  pydantic,
+
+  # tests
+  freezegun,
+  langchain-tests,
+  numpy,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  syrupy,
+
+  # passthru
+  gitUpdater,
+}:
+
+buildPythonPackage rec {
+  pname = "langchain-google-genai";
+  version = "2.1.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "langchain-ai";
+    repo = "langchain-google";
+    tag = "libs/genai/v${version}";
+    hash = "sha256-NCy4PHUSChsMVSebshDRGsg/koY7S4+mvI+GlIqW4q4=";
+  };
+
+  sourceRoot = "${src.name}/libs/genai";
+
+  build-system = [ poetry-core ];
+
+  pythonRelaxDeps = [
+    # Each component release requests the exact latest core.
+    # That prevents us from updating individual components.
+    "langchain-core"
+  ];
+
+  dependencies = [
+    filetype
+    google-api-core
+    google-auth
+    google-generativeai
+    langchain-core
+    pydantic
+  ];
+
+  nativeCheckInputs = [
+    freezegun
+    langchain-tests
+    numpy
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+    syrupy
+  ];
+
+  pytestFlagsArray = [ "tests/unit_tests" ];
+
+  pythonImportsCheck = [ "langchain_google_genai" ];
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "libs/genai/v";
+  };
+
+  meta = {
+    changelog = "https://github.com/langchain-ai/langchain-google/releases/tag/${src.tag}";
+    description = "LangChain integrations for Google Gemini";
+    homepage = "https://github.com/langchain-ai/langchain-google/tree/main/libs/genai";
+    license = lib.licenses.mit;
+    maintainers = [
+      lib.maintainers.eu90h
+      lib.maintainers.sarahec
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/llm-grok/default.nix b/pkgs/development/python-modules/llm-grok/default.nix
index a2c5ac03adc3..1e834b795deb 100644
--- a/pkgs/development/python-modules/llm-grok/default.nix
+++ b/pkgs/development/python-modules/llm-grok/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "llm-grok";
-  version = "1.0.1";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Hiepler";
     repo = "llm-grok";
     tag = "v${version}";
-    hash = "sha256-OeeU/53XKucLCtGvnl5RWc/QqF0TprB/SO8pnnK5fdw=";
+    hash = "sha256-Zwvf33XSoULJxJMBHftysY3RzGEQ+L46UJ0V8b/+UXQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mpi-pytest/default.nix b/pkgs/development/python-modules/mpi-pytest/default.nix
index 875f0d949bcc..c436e1f0a69a 100644
--- a/pkgs/development/python-modules/mpi-pytest/default.nix
+++ b/pkgs/development/python-modules/mpi-pytest/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "mpi-pytest";
-  version = "2025.6.0";
+  version = "2025.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firedrakeproject";
     repo = "mpi-pytest";
     tag = "v${version}";
-    hash = "sha256-hZPTVqVaCd75UMoUQTZXrmnFM6cpMp9ejKqct3lN0Bo=";
+    hash = "sha256-TZj1hObMVzYfAUC0UjXMvUThbKCNdiB1FMSA0AHjZ9s=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/nitrokey/default.nix b/pkgs/development/python-modules/nitrokey/default.nix
index d21635145b01..8258a73e57bd 100644
--- a/pkgs/development/python-modules/nitrokey/default.nix
+++ b/pkgs/development/python-modules/nitrokey/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "nitrokey";
-  version = "0.3.1";
+  version = "0.3.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Lf20du+DDwMrHrC+wCXxFNG8ThBnbonx4wq7DatH4X4=";
+    hash = "sha256-JAgorA2V+WHgqtwk8fEPjdwoog7Q3xk93aKSJ0mxHkQ=";
   };
 
   disabled = pythonOlder "3.9";
diff --git a/pkgs/development/python-modules/nodriver/default.nix b/pkgs/development/python-modules/nodriver/default.nix
index 704437918246..2a408c9a2572 100644
--- a/pkgs/development/python-modules/nodriver/default.nix
+++ b/pkgs/development/python-modules/nodriver/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "nodriver";
-  version = "0.46.1";
+  version = "0.47.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zFyeSwMJJLoIrE+CJ79kJrFF4qQOWun/AFO64Je8440=";
+    hash = "sha256-X8MRgqTbcl6lb8BCJpopoT5Vorr4Pf3XMKqFHdUmlgg=";
   };
 
   disabled = pythonOlder "3.9";
diff --git a/pkgs/development/python-modules/nutils/default.nix b/pkgs/development/python-modules/nutils/default.nix
index 8c5c8a4c3076..ee7b23f027b9 100644
--- a/pkgs/development/python-modules/nutils/default.nix
+++ b/pkgs/development/python-modules/nutils/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "nutils";
-  version = "9.0";
+  version = "9.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "evalf";
     repo = "nutils";
     tag = "v${version}";
-    hash = "sha256-Ef830yTY+g6ZPZ9h0lSktkewIerHbWVfXwrdQ6rzz6I=";
+    hash = "sha256-NmWoRDYOfSweqUhw0KTdXubWgXmVr+odrs1dMLXdHEI=";
   };
 
   build-system = [ flit-core ];
@@ -68,7 +68,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Numerical Utilities for Finite Element Analysis";
-    changelog = "https://github.com/evalf/nutils/releases/tag/v${version}";
+    changelog = "https://github.com/evalf/nutils/releases/tag/${src.tag}";
     homepage = "https://www.nutils.org/";
     license = licenses.mit;
     maintainers = with maintainers; [ Scriptkiddi ];
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index e448ccbd306a..0acf6101ea62 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "8.1.1";
+  version = "8.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-parser";
     tag = version;
-    hash = "sha256-XjKtZky/i6KxS81tMbEsSe/caQ/GsEXEGO3pt6uEBq8=";
+    hash = "sha256-KrN7xJhb2EWRBxzl6GY+kW86oLVnzxdLYRSS9F9F/EY=";
   };
 
   pythonRelaxDeps = [ "regex" ];
diff --git a/pkgs/development/python-modules/openfga-sdk/default.nix b/pkgs/development/python-modules/openfga-sdk/default.nix
index 5cd8bbe94fd2..37368c4deb21 100644
--- a/pkgs/development/python-modules/openfga-sdk/default.nix
+++ b/pkgs/development/python-modules/openfga-sdk/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "openfga-sdk";
-  version = "0.9.4";
+  version = "0.9.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "python-sdk";
     tag = "v${version}";
-    hash = "sha256-ukx3XzNl2vIhPtHPJ46mUYbuxXkMKmlUNXV/3UF4DKo=";
+    hash = "sha256-e/Pgyj7A1HtcDPeRy0QK+Nok2ruWBiU9A1Yh7RZvtVI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/optype/default.nix b/pkgs/development/python-modules/optype/default.nix
index a6bc03c35523..2692774265a7 100644
--- a/pkgs/development/python-modules/optype/default.nix
+++ b/pkgs/development/python-modules/optype/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "optype";
-  version = "0.10.0";
+  version = "0.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jorenham";
     repo = "optype";
     tag = "v${version}";
-    hash = "sha256-F6nkbSSmAHIs2I/Yi1+PPtEsSSTnCO8Hsws7JyleJsM=";
+    hash = "sha256-jExwQiEkCLiVFwiFYp2dBvH5PiRlSVG20CneGnht+No=";
   };
 
   disabled = pythonOlder "3.11";
diff --git a/pkgs/development/python-modules/osmpythontools/default.nix b/pkgs/development/python-modules/osmpythontools/default.nix
index 8f8e21974597..cdf2598369e9 100644
--- a/pkgs/development/python-modules/osmpythontools/default.nix
+++ b/pkgs/development/python-modules/osmpythontools/default.nix
@@ -8,23 +8,26 @@
   matplotlib,
   numpy,
   pandas,
+  setuptools,
   ujson,
   xarray,
 }:
 
 buildPythonPackage rec {
   pname = "osmpythontools";
-  version = "0.3.5";
-  format = "setuptools";
+  version = "0.3.6";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mocnik-science";
     repo = "osm-python-tools";
-    rev = "v${version}";
-    hash = "sha256-lTDA1Rad9aYI/ymU/0xzdJHmebUGcpVJ0GW7D0Ujdko=";
+    tag = "v${version}";
+    hash = "sha256-ajZJSuMbku08vHvn4fqsLqCS/E2XR3uVqiH7R1GHH5o=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     beautifulsoup4
     geojson
     lxml
@@ -47,7 +50,7 @@ buildPythonPackage rec {
     "OSMPythonTools.overpass"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Library to access OpenStreetMap-related services";
     longDescription = ''
       The python package OSMPythonTools provides easy access to
@@ -55,9 +58,9 @@ buildPythonPackage rec {
       Nominatim, and the OpenStreetMap editing API.
     '';
     homepage = "https://github.com/mocnik-science/osm-python-tools";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
     changelog = "https://raw.githubusercontent.com/mocnik-science/osm-python-tools/v${version}/version-history.md";
-    maintainers = with maintainers; [ das-g ];
-    teams = [ teams.geospatial ];
+    maintainers = with lib.maintainers; [ das-g ];
+    teams = [ lib.teams.geospatial ];
   };
 }
diff --git a/pkgs/development/python-modules/paddlex/default.nix b/pkgs/development/python-modules/paddlex/default.nix
index ea4bb32e213c..f0e3657e3353 100644
--- a/pkgs/development/python-modules/paddlex/default.nix
+++ b/pkgs/development/python-modules/paddlex/default.nix
@@ -50,14 +50,14 @@ let
 in
 buildPythonPackage rec {
   pname = "paddlex";
-  version = "3.0.3";
+  version = "3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleX";
     tag = "v${version}";
-    hash = "sha256-uIpt2I6Lx/nJDh4sZYBI6dL8IveQf6aOxA/9vKFU2nU=";
+    hash = "sha256-vmb1A7AifQmWv31b847hP1lHeBe+ZDEGR3raIGykRoo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/plugp100/default.nix b/pkgs/development/python-modules/plugp100/default.nix
index 2164b86790bc..de9c7beb41cc 100644
--- a/pkgs/development/python-modules/plugp100/default.nix
+++ b/pkgs/development/python-modules/plugp100/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "plugp100";
-  version = "5.1.4";
+  version = "5.1.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "petretiandrea";
     repo = "plugp100";
     tag = version;
-    sha256 = "sha256-a/Rv5imVJOJNaLzPozK8+XMZZsR5HyIXbCmq2Flkd+I=";
+    sha256 = "sha256-bPjgyScHxiUke/M5S6BOw7df7wbNuSy5ouVIK5guWxw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 8cdbe2b964dc..99103bf5404e 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -15,6 +15,7 @@
   requests,
   setuptools,
   six,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
@@ -38,6 +39,7 @@ buildPythonPackage rec {
     python-dateutil
     requests
     six
+    typing-extensions
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/proton-vpn-api-core/default.nix b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
index babb3c02bcf4..b74f34be696b 100644
--- a/pkgs/development/python-modules/proton-vpn-api-core/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-api-core";
-  version = "0.42.4";
+  version = "0.42.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-api-core";
     rev = "v${version}";
-    hash = "sha256-WzyxBeIiOXDxyv0/guPWO16pN41ZVXnxd6iiiZ+bLR4=";
+    hash = "sha256-sSLBo2nTn7rvtSZqCWZLwca5DRIgqSkImRM6U6/xJ70=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
index 937c54b5c103..1d1da8138ed5 100644
--- a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-network-manager";
-  version = "0.12.13";
+  version = "0.12.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-network-manager";
     tag = "v${version}";
-    hash = "sha256-LRjC1uuAG2OG52moRBSvTR7HvqdldNmW0Tv7AZmUf60=";
+    hash = "sha256-flZeEdmGXsSFHtlm6HrBtuwOcYJFjWmkMvGgnHL4cPw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/proxmoxer/default.nix b/pkgs/development/python-modules/proxmoxer/default.nix
index 2b3abbe28352..8bd6804fd9ce 100644
--- a/pkgs/development/python-modules/proxmoxer/default.nix
+++ b/pkgs/development/python-modules/proxmoxer/default.nix
@@ -46,6 +46,9 @@ buildPythonPackage rec {
   disabledTests = [
     # Tests require openssh_wrapper which is outdated and not available
     "test_repr_openssh"
+
+    # Test fails randomly
+    "test_timeout"
   ];
 
   pythonImportsCheck = [ "proxmoxer" ];
diff --git a/pkgs/development/python-modules/py-ocsf-models/default.nix b/pkgs/development/python-modules/py-ocsf-models/default.nix
index 76f2a00cd600..326906f3ab5e 100644
--- a/pkgs/development/python-modules/py-ocsf-models/default.nix
+++ b/pkgs/development/python-modules/py-ocsf-models/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "py-ocsf-models";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "prowler-cloud";
     repo = "py-ocsf-models";
     tag = version;
-    hash = "sha256-aHde/dYgY4x5b/iwIddqvfQ3/pRhEp0zDsrK3+jMV44=";
+    hash = "sha256-9aKZtSolUARl70QdavQ6mkW7jk3OlOAIoy/8I6o1+0M=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/pyais/default.nix b/pkgs/development/python-modules/pyais/default.nix
index ce8be1fffd07..d109d1cc08c9 100644
--- a/pkgs/development/python-modules/pyais/default.nix
+++ b/pkgs/development/python-modules/pyais/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyais";
-  version = "2.11.1";
+  version = "2.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "M0r13n";
     repo = "pyais";
     tag = "v${version}";
-    hash = "sha256-/etiTXKNcf5sMHxdl2dq1gH3OwKTwrz7zyH3CXmx/vQ=";
+    hash = "sha256-83JZ8OWbk6vwcbB6JFwHNNuvbq1n/4YHi1FhG+FIts8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyatv/default.nix b/pkgs/development/python-modules/pyatv/default.nix
index 8bb069700b9a..767b8c5eb067 100644
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "pyatv";
-  version = "0.16.0";
+  version = "0.16.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "postlund";
     repo = "pyatv";
     tag = "v${version}";
-    hash = "sha256-yjPbSTmHoKnVwNArZw5mGf3Eh4Ei1+DkY9y2XRRy4YA=";
+    hash = "sha256-b5u9u5CD/1W422rCxHvoyBqT5CuBAh68/EUBzNDcXoE=";
   };
 
   postPatch = ''
@@ -109,7 +109,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client library for the Apple TV";
     homepage = "https://github.com/postlund/pyatv";
-    changelog = "https://github.com/postlund/pyatv/blob/v${version}/CHANGES.md";
+    changelog = "https://github.com/postlund/pyatv/blob/${src.tag}/CHANGES.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index d3ae6abe0189..7e9addf18e73 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -245,7 +245,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.12.23"
+version = "0.12.26"
 dependencies = [
  "pyo3",
  "serde_json",
@@ -569,9 +569,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "yrs"
-version = "0.23.5"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "197c2b4b298f35c3ba4d549884ac872a961112095b29f173ab45e3d5cf609018"
+checksum = "f904a99678a852d7cbc6958c94087f739c10cfb19642635951219c525a5fdb89"
 dependencies = [
  "arc-swap",
  "async-lock",
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index f706bd380a67..098d3bc6d5f6 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pycrdt";
-  version = "0.12.23";
+  version = "0.12.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "y-crdt";
     repo = "pycrdt";
     tag = version;
-    hash = "sha256-xMGu7L6aisTLzLx8pw/k4rXvjTiZsPANXsU1T1FOXKM=";
+    hash = "sha256-dhIMh8sRFS9LSX17vnGn/eqQF/WpGDJkzjwHYCuzbkM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index 92222c73676e..d26992820e9c 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.88";
+  version = "0.2.89";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-KHFzK9MIT3tHwFmdGx/i9OSzQTKIhGXgWEI+qtH1Dkk=";
+    hash = "sha256-DCQmJ4YNQKMIK0IJwAYwIYp+ulGcRdjwDIsNI6W6RsU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pylamarzocco/default.nix b/pkgs/development/python-modules/pylamarzocco/default.nix
index 3871ba0145ef..e895eb3180ac 100644
--- a/pkgs/development/python-modules/pylamarzocco/default.nix
+++ b/pkgs/development/python-modules/pylamarzocco/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pylamarzocco";
-  version = "2.0.10";
+  version = "2.0.11";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "zweckj";
     repo = "pylamarzocco";
     tag = "v${version}";
-    hash = "sha256-8nmbnucTJa1RAmsOsqQLusjTnnrDZtHaADycnn3NyUU=";
+    hash = "sha256-g0qhNBhcU7Dogcw9WiEk+APk2McU7woXBqgeUS9D8iQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pylitterbot/default.nix b/pkgs/development/python-modules/pylitterbot/default.nix
index 7f9d01ae3964..26f7b8934954 100644
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pylitterbot";
-  version = "2024.2.1";
+  version = "2024.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "natekspencer";
     repo = "pylitterbot";
     tag = "v${version}";
-    hash = "sha256-33LiWgI9E7/I6fyrdv+YXcw+gxUOsPZ0mYvEIF8/fOI=";
+    hash = "sha256-FKBgvP3qXT3nKHn5R9pp4nYNX+mO4vfDi5fzQ5+y1Nc=";
   };
 
   pythonRelaxDeps = [ "deepdiff" ];
diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index 5a6f3d32b490..d20b3a5a8335 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyngrok";
-  version = "7.2.11";
+  version = "7.2.12";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-n4iQOJvZWrwA7KE4Rsj0haDbZmfcBZh+uY/eNDrfslo=";
+    hash = "sha256-HM5NeFYZuAZLyn5vbIo0VNaaql/P8PNb0FqoElTOEv8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/python-arango/default.nix b/pkgs/development/python-modules/python-arango/default.nix
index 430fc37f025f..d7acf848e061 100644
--- a/pkgs/development/python-modules/python-arango/default.nix
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -33,7 +33,7 @@ in
 
 buildPythonPackage rec {
   pname = "python-arango";
-  version = "8.2.0";
+  version = "8.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "arangodb";
     repo = "python-arango";
     tag = version;
-    hash = "sha256-DPyCHa9tAnxKYeieiHe10UV7EPnF7octbDm23dSlIb0=";
+    hash = "sha256-ZLjCcH6cSG+LcoeSifBm6HGjnRFJwYNTXbcw9b/BeQY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvers/default.nix b/pkgs/development/python-modules/pyvers/default.nix
new file mode 100644
index 000000000000..972abed60503
--- /dev/null
+++ b/pkgs/development/python-modules/pyvers/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  packaging,
+
+  # tests
+  jax,
+  numpy,
+  pytest-cov-stub,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pyvers";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "vmoens";
+    repo = "pyvers";
+    tag = "v${version}";
+    hash = "sha256-BUUfb0vI1r/VV5aF9gmqnXGOIWQfBJ98MrcF/IH5CEs=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    packaging
+  ];
+
+  pythonImportsCheck = [ "pyvers" ];
+
+  nativeCheckInputs = [
+    jax
+    numpy
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Python library for dynamic dispatch based on module versions and backends";
+    homepage = "https://github.com/vmoens/pyvers";
+    changelog = "https://github.com/vmoens/pyvers/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/qpageview/default.nix b/pkgs/development/python-modules/qpageview/default.nix
index c383e89b0de0..12ab639fd775 100644
--- a/pkgs/development/python-modules/qpageview/default.nix
+++ b/pkgs/development/python-modules/qpageview/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "qpageview";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frescobaldi";
     repo = "qpageview";
     tag = "v${version}";
-    hash = "sha256-UADC+DH3eG1pqlC9BRsqGQQjJcpfwWWVq4O7aFGLxLA=";
+    hash = "sha256-5D+fumQVCfl9ZEHIQmbdXkAuAkiKy6P5+StMWSE+a0A=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/rclone-python/default.nix b/pkgs/development/python-modules/rclone-python/default.nix
index 6d0a508c3fc2..b4469d714dbc 100644
--- a/pkgs/development/python-modules/rclone-python/default.nix
+++ b/pkgs/development/python-modules/rclone-python/default.nix
@@ -2,32 +2,60 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pytestCheckHook,
+  replaceVars,
   setuptools,
   rich,
   rclone,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "rclone-python";
-  version = "0.1.21";
+  version = "0.1.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Johannes11833";
     repo = "rclone_python";
     tag = "v${version}";
-    hash = "sha256-lYrPSDBWGVQmT2/MgzbtZ6hHNZXINCmmFP+ZHFZQDw8=";
+    hash = "sha256-vvsiXS3uI0TcL+X8+75BQmycrF+EGIgQE1dmGef35rI=";
   };
 
+  patches = [
+    (replaceVars ./hardcode-rclone-path.patch {
+      rclone = lib.getExe rclone;
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
-    rclone
     rich
   ];
 
-  # tests require working internet connection
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  preCheck = ''
+    # Unlike upstream we don't actually run an S3 server for testing.
+    # See https://github.com/Johannes11833/rclone_python/blob/master/launch_test_server.sh
+    mkdir -p "$HOME/.config/rclone"
+    cat > "$HOME/.config/rclone/rclone.conf" <<EOF
+    [test_server_s3]
+    type = combine
+    upstreams = "testdir=$(mktemp -d)"
+    EOF
+  '';
+
+  disabledTestPaths = [
+    # test requires a remote that supports public links
+    "tests/test_link.py"
+    # test looks up latest version on rclone.org
+    "tests/test_version.py"
+  ];
 
   pythonImportsCheck = [ "rclone_python" ];
 
diff --git a/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch b/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch
new file mode 100644
index 000000000000..238f92c619d0
--- /dev/null
+++ b/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch
@@ -0,0 +1,129 @@
+diff --git a/rclone_python/rclone.py b/rclone_python/rclone.py
+index da399b4..e05365a 100644
+--- a/rclone_python/rclone.py
++++ b/rclone_python/rclone.py
+@@ -43,7 +43,7 @@ def is_installed() -> bool:
+     """
+     :return: True if rclone is correctly installed on the system.
+     """
+-    return which("rclone") is not None
++    return True
+ 
+ 
+ @__check_installed
+@@ -199,7 +199,7 @@ def copy(
+         in_path,
+         out_path,
+         ignore_existing=ignore_existing,
+-        command="rclone copy",
++        command="@rclone@ copy",
+         command_descr="Copying",
+         show_progress=show_progress,
+         listener=listener,
+@@ -234,7 +234,7 @@ def copyto(
+         in_path,
+         out_path,
+         ignore_existing=ignore_existing,
+-        command="rclone copyto",
++        command="@rclone@ copyto",
+         command_descr="Copying",
+         show_progress=show_progress,
+         listener=listener,
+@@ -269,7 +269,7 @@ def move(
+         in_path,
+         out_path,
+         ignore_existing=ignore_existing,
+-        command="rclone move",
++        command="@rclone@ move",
+         command_descr="Moving",
+         show_progress=show_progress,
+         listener=listener,
+@@ -304,7 +304,7 @@ def moveto(
+         in_path,
+         out_path,
+         ignore_existing=ignore_existing,
+-        command="rclone moveto",
++        command="@rclone@ moveto",
+         command_descr="Moving",
+         show_progress=show_progress,
+         listener=listener,
+@@ -336,7 +336,7 @@ def sync(
+     _rclone_transfer_operation(
+         src_path,
+         dest_path,
+-        command="rclone sync",
++        command="@rclone@ sync",
+         command_descr="Syncing",
+         show_progress=show_progress,
+         listener=listener,
+diff --git a/rclone_python/scripts/get_version.py b/rclone_python/scripts/get_version.py
+index b1d30fd..bc00cad 100644
+--- a/rclone_python/scripts/get_version.py
++++ b/rclone_python/scripts/get_version.py
+@@ -2,6 +2,6 @@ from subprocess import check_output
+ 
+ 
+ def get_version():
+-    stdout = check_output("rclone version", shell=True, encoding="utf8")
++    stdout = check_output("@rclone@ version", shell=True, encoding="utf8")
+ 
+     return stdout.split("\n")[0].replace("rclone ", "")
+diff --git a/rclone_python/scripts/update_hash_types.py b/rclone_python/scripts/update_hash_types.py
+index 92fbd0a..ef963cf 100644
+--- a/rclone_python/scripts/update_hash_types.py
++++ b/rclone_python/scripts/update_hash_types.py
+@@ -14,7 +14,7 @@ def update_hashes(output_path: str):
+     """
+ 
+     # get all supported backends
+-    rclone_output = sp.check_output("rclone hashsum", shell=True, encoding="utf8")
++    rclone_output = sp.check_output("@rclone@ hashsum", shell=True, encoding="utf8")
+     lines = rclone_output.splitlines()
+ 
+     hashes = []
+diff --git a/rclone_python/utils.py b/rclone_python/utils.py
+index d4a8413..1b29bd8 100644
+--- a/rclone_python/utils.py
++++ b/rclone_python/utils.py
+@@ -66,9 +66,9 @@ def run_rclone_cmd(
+     # otherwise the default rclone config path is used:
+     config = Config()
+     if config.config_path is not None:
+-        base_command = f"rclone --config={config.config_path}"
++        base_command = f"@rclone@ --config={config.config_path}"
+     else:
+-        base_command = "rclone"
++        base_command = "@rclone@"
+ 
+     # add optional arguments and flags to the command
+     args_str = args2string(args)
+diff --git a/tests/test_copy.py b/tests/test_copy.py
+index 4ded5fa..1cae53b 100644
+--- a/tests/test_copy.py
++++ b/tests/test_copy.py
+@@ -45,11 +45,11 @@ def create_local_file(
+ @pytest.mark.parametrize(
+     "wrapper_command,rclone_command",
+     [
+-        (rclone.copy, "rclone copy"),
+-        (rclone.copyto, "rclone copyto"),
+-        (rclone.sync, "rclone sync"),
+-        (rclone.move, "rclone move"),
+-        (rclone.moveto, "rclone moveto"),
++        (rclone.copy, "@rclone@ copy"),
++        (rclone.copyto, "@rclone@ copyto"),
++        (rclone.sync, "@rclone@ sync"),
++        (rclone.move, "@rclone@ move"),
++        (rclone.moveto, "@rclone@ moveto"),
+     ],
+ )
+ def test_rclone_command_called(wrapper_command: Callable, rclone_command: str):
+@@ -62,7 +62,7 @@ def test_rclone_command_called(wrapper_command: Callable, rclone_command: str):
+         rclone.utils.subprocess,
+         "Popen",
+         return_value=subprocess.Popen(
+-            "rclone help", stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True
++            "@rclone@ help", stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True
+         ),
+     ) as mock:
+         wrapper_command("nothing/not_a.file", "fake_remote:unicorn/folder")
diff --git a/pkgs/development/python-modules/redshift-connector/default.nix b/pkgs/development/python-modules/redshift-connector/default.nix
index 4da64f6afaeb..46aa57ca12da 100644
--- a/pkgs/development/python-modules/redshift-connector/default.nix
+++ b/pkgs/development/python-modules/redshift-connector/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "redshift-connector";
-  version = "2.1.7";
+  version = "2.1.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "amazon-redshift-python-driver";
     tag = "v${version}";
-    hash = "sha256-OMi8788F2qjMOVDLuJLVReqNv7c/DpXTy1UpqoKRmnQ=";
+    hash = "sha256-q8TQYiPmm3w9Bh4+gvVW5XAa4FZ3+/MZqZL0RCgl77E=";
   };
 
   # remove addops as they add test directory and coverage parameters to pytest
diff --git a/pkgs/development/python-modules/robotframework-databaselibrary/default.nix b/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
index 15e766dd0a83..109fc786e775 100644
--- a/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
+++ b/pkgs/development/python-modules/robotframework-databaselibrary/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "robotframework-databaselibrary";
-  version = "2.1.3";
+  version = "2.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MarketSquare";
     repo = "Robotframework-Database-Library";
     tag = "v.${version}";
-    hash = "sha256-XsRXQU31Q2iGUMJgDvIIcSsT8guALZO5tnIjwGLR8+Q=";
+    hash = "sha256-ZZOhGZTJGWYCHyvJXDYGn9BMuPioCVIu0KONGkXsRmk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rope/default.nix b/pkgs/development/python-modules/rope/default.nix
index 27ac5a2c32c2..94ba8fafe514 100644
--- a/pkgs/development/python-modules/rope/default.nix
+++ b/pkgs/development/python-modules/rope/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "rope";
-  version = "1.13.0";
+  version = "1.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "python-rope";
     repo = "rope";
     tag = version;
-    hash = "sha256-g/fta5gW/xPs3VaVuLtikfLhqCKyy1AKRnOcOXjQ8bA=";
+    hash = "sha256-LcxpJhMtyk0kT759ape9zQzdwmL1321Spdbg9zuuXtI=";
   };
 
   build-system = [ setuptools ];
@@ -51,7 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python refactoring library";
     homepage = "https://github.com/python-rope/rope";
-    changelog = "https://github.com/python-rope/rope/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/python-rope/rope/blob/${src.tag}/CHANGELOG.md";
     license = licenses.gpl3Plus;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/scipy-stubs/default.nix b/pkgs/development/python-modules/scipy-stubs/default.nix
index 3a64ae17a484..ce38381ca3ef 100644
--- a/pkgs/development/python-modules/scipy-stubs/default.nix
+++ b/pkgs/development/python-modules/scipy-stubs/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "scipy-stubs";
-  version = "1.16.0.0";
+  version = "1.16.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipy";
     repo = "scipy-stubs";
     tag = "v${version}";
-    hash = "sha256-LuBypvtbLp7Zo8Rou1JwBwJjZr0BBic25dhX5Yg1Esk=";
+    hash = "sha256-xaBii3vONwfHlrsLr+uvXvirZ2WT1OgUzlYxRIRnGdI=";
   };
 
   disabled = pythonOlder "3.11";
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 7de7eb2564f3..ba87c81b4ac6 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.9.6";
+  version = "1.9.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/uzLkxqSVKjSYmFeDMo7EzcLbxGXGHlkg0ufhPRsGpY=";
+    hash = "sha256-E2cb/hp7sg56S9By3AT3BGnqQSVlQzRV3wEW+uuJozI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index fd93658c84ca..329a2d1707f8 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1421";
+  version = "3.0.1423";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-jUFi0KMj22PuCHQlVKV/yqWFam3/WfMZxcpCr2St9N8=";
+    hash = "sha256-HITx60SRPAXKdVCl3jMq+AknGl5Su6S0whWuPOTRIMU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tensordict/default.nix b/pkgs/development/python-modules/tensordict/default.nix
index 59395912ba36..66cc02861228 100644
--- a/pkgs/development/python-modules/tensordict/default.nix
+++ b/pkgs/development/python-modules/tensordict/default.nix
@@ -19,6 +19,7 @@
   numpy,
   orjson,
   packaging,
+  pyvers,
   torch,
 
   # tests
@@ -28,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "tensordict";
-  version = "0.9.0";
+  version = "0.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "tensordict";
     tag = "v${version}";
-    hash = "sha256-actBFzWb2JBPsLhRZiD6zRpk7eyX2OHUPMU9JpJ90Wc=";
+    hash = "sha256-OdS9dw/BtSLZuY857O2njlFOMQj5IJ6v9c2aRP+H1Hc=";
   };
 
   build-system = [
@@ -56,6 +57,7 @@ buildPythonPackage rec {
     numpy
     orjson
     packaging
+    pyvers
     torch
   ];
 
diff --git a/pkgs/development/python-modules/tidalapi/default.nix b/pkgs/development/python-modules/tidalapi/default.nix
index 956846ba82f1..875a2af1cff9 100644
--- a/pkgs/development/python-modules/tidalapi/default.nix
+++ b/pkgs/development/python-modules/tidalapi/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   python-dateutil,
   poetry-core,
   requests,
@@ -12,15 +12,19 @@
 }:
 buildPythonPackage rec {
   pname = "tidalapi";
-  version = "0.8.3";
+  version = "0.8.4";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-3I5Xi9vmyAlUNKBmmTuGnetaiiVzL3sEEy31npRZlFU=";
+  src = fetchFromGitHub {
+    owner = "EbbLabs";
+    repo = "python-tidal";
+    tag = "v${version}";
+    hash = "sha256-PSM4aLjvG8b2HG86SCLgPjPo8PECVD5XrNZSbiAxcSk=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [
+    poetry-core
+  ];
 
   dependencies = [
     requests
@@ -33,13 +37,18 @@ buildPythonPackage rec {
 
   doCheck = false; # tests require internet access
 
-  pythonImportsCheck = [ "tidalapi" ];
+  pythonImportsCheck = [
+    "tidalapi"
+  ];
 
   meta = {
     changelog = "https://github.com/tamland/python-tidal/blob/v${version}/HISTORY.rst";
     description = "Unofficial Python API for TIDAL music streaming service";
     homepage = "https://github.com/tamland/python-tidal";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ drawbu ];
+    maintainers = with lib.maintainers; [
+      drawbu
+      ryand56
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/types-markdown/default.nix b/pkgs/development/python-modules/types-markdown/default.nix
index 410b83ddcef7..0a5073d4cc8a 100644
--- a/pkgs/development/python-modules/types-markdown/default.nix
+++ b/pkgs/development/python-modules/types-markdown/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "types-markdown";
-  version = "3.8.0.20250415";
+  version = "3.8.0.20250708";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_markdown";
     inherit version;
-    hash = "sha256-mKsTWH0Rd3adk+VVhtPclwR991vG43zkB0Zm9d1CEro=";
+    hash = "sha256-KGkCUf6QdX9amc1nHHlQK8LeB67y01/lQRfDsceZgEo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/urwid-satext/default.nix b/pkgs/development/python-modules/urwid-satext/default.nix
new file mode 100644
index 000000000000..5c4d35f1dda2
--- /dev/null
+++ b/pkgs/development/python-modules/urwid-satext/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchhg,
+  setuptools,
+  urwid,
+}:
+
+buildPythonPackage rec {
+  pname = "urwid-satext";
+  version = "0.8.0-unstable-2023-04-08";
+  pyproject = true;
+
+  src = fetchhg {
+    url = "https://repos.goffi.org/urwid-satext";
+    rev = "6689aa54b20cb38731c68d4d39d86d01d25c21fa";
+    hash = "sha256-llCONyYV2kVVmT4EsugnW9j5X5PIeYEnnk4i5rQnE0w=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    urwid
+  ];
+
+  pythonImportsCheck = [
+    "urwid_satext"
+  ];
+
+  # no pytest tests exist
+  doCheck = false;
+
+  meta = {
+    description = "SàT extension widgets for Urwid";
+    homepage = "https://libervia.org";
+    changelog = "https://repos.goffi.org/urwid-satext/file/${src.rev}/CHANGELOG";
+    license = lib.licenses.lgpl3Plus;
+    teams = with lib.teams; [ ngi ];
+    maintainers = [ lib.maintainers.oluchitheanalyst ];
+  };
+}
diff --git a/pkgs/development/python-modules/xformers/default.nix b/pkgs/development/python-modules/xformers/default.nix
index db01a4abeb48..46e77b3c3acd 100644
--- a/pkgs/development/python-modules/xformers/default.nix
+++ b/pkgs/development/python-modules/xformers/default.nix
@@ -26,7 +26,8 @@
   einops,
   transformers,
   timm,
-#, flash-attn
+  #, flash-attn
+  openmp,
 }:
 let
   inherit (torch) cudaCapabilities cudaPackages cudaSupport;
@@ -66,23 +67,28 @@ buildPythonPackage {
 
   stdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
 
-  buildInputs = lib.optionals cudaSupport (
-    with cudaPackages;
-    [
-      # flash-attn build
-      cuda_cudart # cuda_runtime_api.h
-      libcusparse # cusparse.h
-      cuda_cccl # nv/target
-      libcublas # cublas_v2.h
-      libcusolver # cusolverDn.h
-      libcurand # curand_kernel.h
-    ]
-  );
+  buildInputs =
+    lib.optional stdenv.hostPlatform.isDarwin openmp
+    ++ lib.optionals cudaSupport (
+      with cudaPackages;
+      [
+        # flash-attn build
+        cuda_cudart # cuda_runtime_api.h
+        libcusparse # cusparse.h
+        cuda_cccl # nv/target
+        libcublas # cublas_v2.h
+        libcusolver # cusolverDn.h
+        libcurand # curand_kernel.h
+      ]
+    );
 
-  nativeBuildInputs = [
-    ninja
-    which
-  ] ++ lib.optionals cudaSupport (with cudaPackages; [ cuda_nvcc ]);
+  nativeBuildInputs =
+    [
+      ninja
+      which
+    ]
+    ++ lib.optionals cudaSupport (with cudaPackages; [ cuda_nvcc ])
+    ++ lib.optional stdenv.hostPlatform.isDarwin openmp.dev;
 
   dependencies = [
     numpy
@@ -123,9 +129,5 @@ buildPythonPackage {
     changelog = "https://github.com/facebookresearch/xformers/blob/${version}/CHANGELOG.md";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ happysalada ];
-    badPlatforms = [
-      # fatal error: 'omp.h' file not found
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 69547ad9d803..7a256239768c 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -225,14 +225,14 @@ rec {
   # https://docs.gradle.org/current/userguide/compatibility.html
 
   gradle_8 = gen {
-    version = "8.14.2";
-    hash = "sha256-cZehL0UHlJMVMkadT/IaWeosHNWaPsP4nANcPEIKaZk=";
+    version = "8.14.3";
+    hash = "sha256-vXEQIhNJMGCVbsIp2Ua+7lcVjb2J0OYrkbyg+ixfNTE=";
     defaultJava = jdk21;
   };
 
   gradle_7 = gen {
-    version = "7.6.5";
-    hash = "sha256-uBL+wO230n4K41lViHuylUU2+j5E7a9IEVDaBY4VTZo=";
+    version = "7.6.6";
+    hash = "sha256-Zz2XdvMDvHBI/DMp0jLW6/EFGweJO9nRFhb62ahnO+A=";
     defaultJava = jdk17;
   };
 
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
index e3cba7ead56d..9494ff61a362 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 let
-  version = "3.7.0";
-  srcHash = "sha256-5EmvmfkAUMkmImS37jAPOoEADYeAzQgV6zhpRbP9FVk=";
+  version = "3.8.0";
+  srcHash = "sha256-vU8lyWnXU2KnayZ863MMTMOc1/AkQ6p+uNiJOFqDNJk=";
   # The tarball contains vendored dependencies
   vendorHash = null;
 in
diff --git a/pkgs/development/tools/misc/coreboot-toolchain/default.nix b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
index a0d9a450ff55..03da396b9950 100644
--- a/pkgs/development/tools/misc/coreboot-toolchain/default.nix
+++ b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
@@ -15,8 +15,8 @@ let
         flex,
         getopt,
         git,
-        gnat,
-        gcc,
+        gnat14,
+        gcc14,
         lib,
         perl,
         stdenvNoCC,
@@ -50,7 +50,7 @@ let
         buildInputs = [
           flex
           zlib
-          (if withAda then gnat else gcc)
+          (if withAda then gnat14 else gcc14)
         ];
 
         enableParallelBuilding = true;
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 164feec97923..399683e25850 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -139,6 +139,7 @@ in
           '';
 
           passthru = {
+            inherit fetcherVersion;
             serve = callPackage ./serve.nix {
               pnpm = args.pnpm or pnpm';
               pnpmDeps = finalAttrs.finalPackage;
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 9b44178afda9..c4bb1f022071 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -17,8 +17,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "24.3.0";
-  sha256 = "eb688ef8a63fda9ebc0b5f907609a46e26db6d9aceefc0832009a98371e992ed";
+  version = "24.4.0";
+  sha256 = "42fa8079da25a926013cd89b9d3467d09110e4fbb0c439342ebe4dd6ecc26bbb";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -51,13 +51,6 @@ buildNodejs {
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
-
-      # Fix for flaky test
-      # TODO: remove when included in a release
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/cd685fe3b6b18d2a1433f2635470513896faebe6.patch?full_index=1";
-        hash = "sha256-KA7WBFnLXCKx+QVDGxFixsbj3Y7uJkAKEUTeLShI1Xo=";
-      })
     ]
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [
       # test-icu-env is failing without the reverts
diff --git a/pkgs/games/path-of-building/default.nix b/pkgs/games/path-of-building/default.nix
index a467106884b9..7dadeb4aa380 100644
--- a/pkgs/games/path-of-building/default.nix
+++ b/pkgs/games/path-of-building/default.nix
@@ -17,13 +17,13 @@
 let
   data = stdenv.mkDerivation (finalAttrs: {
     pname = "path-of-building-data";
-    version = "2.55.3";
+    version = "2.55.4";
 
     src = fetchFromGitHub {
       owner = "PathOfBuildingCommunity";
       repo = "PathOfBuilding";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-LGn5dDH1oRD6bi3KGqyiQh7Gu/8k+RRgGRFkUaFa19E=";
+      hash = "sha256-lRzK5ykdmFH6/I0jmhOB0V7njXsszcp9yaJPx5SBStY=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/kde/generated/sources/plasma.json b/pkgs/kde/generated/sources/plasma.json
index b955a9b6aa59..8b266ee27c9b 100644
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@@ -1,347 +1,347 @@
 {
   "aurorae": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/aurorae-6.4.2.tar.xz",
-    "hash": "sha256-nYjOtnMItAk8aisnEz6Aj5dM+XMUR/rO9y7hO19CTVE="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/aurorae-6.4.3.tar.xz",
+    "hash": "sha256-pTMhyYqBgf5ek89ch76qxgkYwygN3Zg0JjBt+ucAlE8="
   },
   "bluedevil": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/bluedevil-6.4.2.tar.xz",
-    "hash": "sha256-JTvWMwWrK3Y5H+ynIfc1trrmxcE3mRZLjKoJ+/o6DgY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/bluedevil-6.4.3.tar.xz",
+    "hash": "sha256-J2DbvT7nhc5JPTn49icvR52xhAdqbjDx9GRq+9jKMx0="
   },
   "breeze": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/breeze-6.4.2.tar.xz",
-    "hash": "sha256-RgerRR0NFfDQgVJD0H/V9XCZhffrK+8b9MoWkbRwqrU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/breeze-6.4.3.tar.xz",
+    "hash": "sha256-AXotrfgDoMLRZ0ifW6TSoAEfxY/PGMXnb6b8IvSET78="
   },
   "breeze-grub": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/breeze-grub-6.4.2.tar.xz",
-    "hash": "sha256-kqyaSHIcRgVBajz+LxVvE1e47YDliZq0jTe0X17roCU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/breeze-grub-6.4.3.tar.xz",
+    "hash": "sha256-TwGrZLiijF2jmRXq8D1vt8APFTugcbt2c8HbsEFvueo="
   },
   "breeze-gtk": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/breeze-gtk-6.4.2.tar.xz",
-    "hash": "sha256-SOW1KpUXZGGlO9U7P+lRPEycJxVcrW+IMMeLzEA8to0="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/breeze-gtk-6.4.3.tar.xz",
+    "hash": "sha256-25GtKkYllrxxXTCRsJ6Gx52gBgoTxqDeGwMk7wYO6AM="
   },
   "breeze-plymouth": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/breeze-plymouth-6.4.2.tar.xz",
-    "hash": "sha256-/V6zHc9mCS2kgceXyHKGWQcAA961ldyVxP6jvf9K3T4="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/breeze-plymouth-6.4.3.tar.xz",
+    "hash": "sha256-BE6qpzIkxyY0Sz1ZksfSilgNxIHAZdogN4KiD9qV3D8="
   },
   "discover": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/discover-6.4.2.tar.xz",
-    "hash": "sha256-8d21G83ZgV3CIsAtKZQkkk2lQbOpGiy/lye9GyDb1RU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/discover-6.4.3.tar.xz",
+    "hash": "sha256-wt2COKqoyAGhLG8p1w8kRnutWSCcX8j66Xy7usRd3hA="
   },
   "drkonqi": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/drkonqi-6.4.2.tar.xz",
-    "hash": "sha256-xYlgsRuheAqPOTMgJRcmJJSkDHPQQeu/5tdsFBdAbJ0="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/drkonqi-6.4.3.tar.xz",
+    "hash": "sha256-OtmLG8xkIO1BVGQK+MsvRByndMrz2ajk2KufVTYJ+0M="
   },
   "flatpak-kcm": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/flatpak-kcm-6.4.2.tar.xz",
-    "hash": "sha256-FA48nX/qzO76aQHFXchyKBr5t81YzzZlU4kVB9RXnAQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/flatpak-kcm-6.4.3.tar.xz",
+    "hash": "sha256-K4VHWf0RJeRwYc2tOqFk4/7IvBAdS209H6LUkHdNITk="
   },
   "kactivitymanagerd": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kactivitymanagerd-6.4.2.tar.xz",
-    "hash": "sha256-GraFQCR7IHrhS+Rkd7YEqOj/A9qwB+n84WDSMP6DtsM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kactivitymanagerd-6.4.3.tar.xz",
+    "hash": "sha256-6esrBjv8Rp1GWor73w7HagQQyj9o92ZsULUBIxW2pos="
   },
   "kde-cli-tools": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kde-cli-tools-6.4.2.tar.xz",
-    "hash": "sha256-9iJhUETVIxqayTNJalCbRaZ54vT3arlUHa8ZoP7c76o="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kde-cli-tools-6.4.3.tar.xz",
+    "hash": "sha256-1UzEL4yVXvgyKXZlWh7QA8yiS0LBqPUXvBwnzhevbig="
   },
   "kde-gtk-config": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kde-gtk-config-6.4.2.tar.xz",
-    "hash": "sha256-b6XWoEX0eRaRm9wY8eJxR2PwXmIOtaJjqMqU1weVIVQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kde-gtk-config-6.4.3.tar.xz",
+    "hash": "sha256-IvciU7yAG7F1e31Wqza7J5waElXviIytyVDFslWbWRI="
   },
   "kdecoration": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kdecoration-6.4.2.tar.xz",
-    "hash": "sha256-16vnPcCTBFPxl7egIvwZPNESwlSvKccvMWq/517nXzM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kdecoration-6.4.3.tar.xz",
+    "hash": "sha256-vQ+ZvfSHqFnaixIn40QyWa0o6Q8RC9OnvOzDhv3teCQ="
   },
   "kdeplasma-addons": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kdeplasma-addons-6.4.2.tar.xz",
-    "hash": "sha256-3d+FtyjfgE6jngJFLjVc7RlrGjXrjp2dcbdH+JzBZsE="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kdeplasma-addons-6.4.3.tar.xz",
+    "hash": "sha256-fa2Rdv7pn06V9lc6qxgybu/2dCYJ6HObm1nC6fKq0Zs="
   },
   "kgamma": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kgamma-6.4.2.tar.xz",
-    "hash": "sha256-/4JZiLpURND+5uM4xkPX0x230fNb4txizmf27oAcjxs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kgamma-6.4.3.tar.xz",
+    "hash": "sha256-2F+G9v2bAXM5ViO1GKQGCVHBD3UGxWG5mYGOgZsT7A4="
   },
   "kglobalacceld": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kglobalacceld-6.4.2.tar.xz",
-    "hash": "sha256-n3yiUzquPVzROJX0euB7/bpBZa8BzKpGDWRbPE0qUeQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kglobalacceld-6.4.3.tar.xz",
+    "hash": "sha256-ppx4fhsTOtXpnz+D0aGVch8n5SAMxgzbpw2NwDrMQ3g="
   },
   "kinfocenter": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kinfocenter-6.4.2.tar.xz",
-    "hash": "sha256-HSX/7XkEvbeuTS/1bUFztIoVOEy5cKeKFFEnhm3Rmdo="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kinfocenter-6.4.3.tar.xz",
+    "hash": "sha256-TV9JlHB3KnS08in2dv63rv0S7CstNkWLhIPY3KOkink="
   },
   "kmenuedit": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kmenuedit-6.4.2.tar.xz",
-    "hash": "sha256-oA/YUDAP8IsXvZpS7Bno9pgiNE79oXc06GVaHL6qNSs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kmenuedit-6.4.3.tar.xz",
+    "hash": "sha256-lPsm7/zhhSQKiPgrv3VqaztvCi0FVlKcSien9iqnnIk="
   },
   "kpipewire": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kpipewire-6.4.2.tar.xz",
-    "hash": "sha256-1Z+L6VTSOsS58+0ovMWiLoquvq31HCg0SZt2lMqQzhw="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kpipewire-6.4.3.tar.xz",
+    "hash": "sha256-GGbZZs5hu4PtHUXcwNsai6kZcXYmgTaKM1fYZDj6lkI="
   },
   "krdp": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/krdp-6.4.2.tar.xz",
-    "hash": "sha256-7PKlFzfhYOmo57hVcqLAAKk8e1k4spyVkRiasGJKC7Y="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/krdp-6.4.3.tar.xz",
+    "hash": "sha256-sElQOTYg8Us1INxnboFjKjGI+S5Q2oTd4z8AgcWHt4c="
   },
   "kscreen": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kscreen-6.4.2.tar.xz",
-    "hash": "sha256-dxpsShfDTbdii6tY7m0Zd9WO7iik05T7nsIIz3nnaBk="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kscreen-6.4.3.tar.xz",
+    "hash": "sha256-N+9wMqITYpPP7OtB+u/1Jd6AxxGc2MhUEWuLMA76YKk="
   },
   "kscreenlocker": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kscreenlocker-6.4.2.tar.xz",
-    "hash": "sha256-7yvIwvHw33XGd3jEIIpe4CwFRjVu+DUt0f/e6GcoPMQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kscreenlocker-6.4.3.tar.xz",
+    "hash": "sha256-NEEXRCb9GFJMpZ+iJG+e6Zwx3sD9ieqnlwXmoy0dysM="
   },
   "ksshaskpass": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/ksshaskpass-6.4.2.tar.xz",
-    "hash": "sha256-bvOBEjnC7FBYWfbEg5J9bWmln72NbaQbOFqXfCMe//w="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/ksshaskpass-6.4.3.tar.xz",
+    "hash": "sha256-ll+JoBqpHAftW4rtK+NSH4jpiyLhJ3hG8SRAyXYLrxA="
   },
   "ksystemstats": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/ksystemstats-6.4.2.tar.xz",
-    "hash": "sha256-UWE07MisRse88JnVfYiJ6FbMzxo2EnWg0yxmzS9lwSQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/ksystemstats-6.4.3.tar.xz",
+    "hash": "sha256-DRvbUY/XI1VREPjcTtm1CbA7Jn5AzC1wlYevLEzo2gw="
   },
   "kwallet-pam": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwallet-pam-6.4.2.tar.xz",
-    "hash": "sha256-/FV4roYNdM52lc8LVhpyvPRzBjZpTY3r/BDIXpcpauk="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwallet-pam-6.4.3.tar.xz",
+    "hash": "sha256-CBUcoD57io52lpJ+Oq3DCVz0gIF0jJg3mNrDWrX9DN4="
   },
   "kwayland": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwayland-6.4.2.tar.xz",
-    "hash": "sha256-go3ZwewydyFYPW8EpEE/CPb/2TUMUd4WmGNZqnDICNc="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwayland-6.4.3.tar.xz",
+    "hash": "sha256-/1B9PENUB7ODHq0epj9t6mx3i6ah9bRYldX+xvXB+YI="
   },
   "kwayland-integration": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwayland-integration-6.4.2.tar.xz",
-    "hash": "sha256-P8Xp+/SqnXM0KeI+VBd6mYOj7SohH6IKGfUA1c/dJjc="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwayland-integration-6.4.3.tar.xz",
+    "hash": "sha256-m68hNOLTLp1NQXiU+mORH6lLyoYZjvjhbkYdWYm24tA="
   },
   "kwin": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwin-6.4.2.tar.xz",
-    "hash": "sha256-HLAMYDuwENRQ4IvidDlBi+ZZlA6IWpCsTi9bxhrjtxs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwin-6.4.3.tar.xz",
+    "hash": "sha256-oTVoyRjsp4A+tEo6J3i4YO3D8Ds2eXhRxPOu7tS1Aqg="
   },
   "kwin-x11": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwin-x11-6.4.2.tar.xz",
-    "hash": "sha256-bt+yBKGrmvmRvwV643bBJZUXDVkdCAFnS7pkFI1FLCM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwin-x11-6.4.3.tar.xz",
+    "hash": "sha256-TytgGTlnwkoGe53agtWfgR9WY/V4PVngNCT8AoHM0Yg="
   },
   "kwrited": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwrited-6.4.2.tar.xz",
-    "hash": "sha256-25fcbeRcNfwUY6kQe/0lYnUk3nwcAEQ0US2naWvPmWE="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwrited-6.4.3.tar.xz",
+    "hash": "sha256-/hRLXtQnDL1F9xGHuXDkxOPgA1wa/EBxmxyGK4rbCYs="
   },
   "layer-shell-qt": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/layer-shell-qt-6.4.2.tar.xz",
-    "hash": "sha256-e+rQL1BufB763GFYjMUujtL6Rnyhg0hcO3KAwIpaYxI="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/layer-shell-qt-6.4.3.tar.xz",
+    "hash": "sha256-M+ZOwM0tnpVHw8P6qcTWogBr9oH6w2FRH0QbUfnd23w="
   },
   "libkscreen": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/libkscreen-6.4.2.tar.xz",
-    "hash": "sha256-c9+69sQ3pcHQH3aLTxQAcNBH+P7DBkQqzZOrVIN+wao="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/libkscreen-6.4.3.tar.xz",
+    "hash": "sha256-ol8GBBEGUshH4ADt5v3p8nfrOIUO3qvePjpB0uuBsGs="
   },
   "libksysguard": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/libksysguard-6.4.2.tar.xz",
-    "hash": "sha256-5XHYTNsLpcPePCabNKJ2aylMUjNwuiy3jW9OUqO7R9k="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/libksysguard-6.4.3.tar.xz",
+    "hash": "sha256-V6NTMV/SCw5GbuOZ2Oxq+ee1dDKDEfqHF3MSZ763MuI="
   },
   "libplasma": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/libplasma-6.4.2.tar.xz",
-    "hash": "sha256-qbtVMubvswgzx2teLg+xzhquVAvraBO2kWPSC5bVYKw="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/libplasma-6.4.3.tar.xz",
+    "hash": "sha256-9QjOztMqEURi5eMRlWAO5EChohuOt3uiADPPuJK7DMg="
   },
   "milou": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/milou-6.4.2.tar.xz",
-    "hash": "sha256-smV6I1WaG/+FqzC2svXS4anBSZ7Qrwla2oOthby1paY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/milou-6.4.3.tar.xz",
+    "hash": "sha256-1nnJW2KuuBSb02ivHYMf7nnrqqw+5HnaZ8RQ6A/TX/E="
   },
   "ocean-sound-theme": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/ocean-sound-theme-6.4.2.tar.xz",
-    "hash": "sha256-0bRaGlY/iK6lHMH2PjpREghMvNHwOEOU64qNkcXIpGY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/ocean-sound-theme-6.4.3.tar.xz",
+    "hash": "sha256-s/ggACbvS+YCN5XbPZr/Lk+GrHXVH8AjPqJpumVChDI="
   },
   "oxygen": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/oxygen-6.4.2.tar.xz",
-    "hash": "sha256-i70B4P5cAKMcyT+3u588rfgOn+iwzkQtupJOEQL2f/o="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/oxygen-6.4.3.tar.xz",
+    "hash": "sha256-f+VdNdt+GsAZushbVdUCbc+ZwfS78Y5a7zinW8Adz2g="
   },
   "oxygen-sounds": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/oxygen-sounds-6.4.2.tar.xz",
-    "hash": "sha256-EFCF+0JnJxQoDq9gzLL5/eVOj+81aGdKvnCwiXKPT30="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/oxygen-sounds-6.4.3.tar.xz",
+    "hash": "sha256-RAVm+ahMnOkOBLVhq5eQmDi1Gcg/fe61dNBckzuvLis="
   },
   "plasma-activities": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-activities-6.4.2.tar.xz",
-    "hash": "sha256-u8oDrGpqcZWLRCbVdexoI5klzT7Ry6W9Fxt+e4YFqNs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-activities-6.4.3.tar.xz",
+    "hash": "sha256-HI3KdGYC3vrNSVua5jfBcA075+fjzF1Jml/WaaC5jvA="
   },
   "plasma-activities-stats": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-activities-stats-6.4.2.tar.xz",
-    "hash": "sha256-xon1HSnwtlqRPm10ZIQ0fVFt+aFy8sUee8hcrecqjno="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-activities-stats-6.4.3.tar.xz",
+    "hash": "sha256-mRAC49qbWWm5WDzRaQUKI6rL4C8tfUqxoZ9b18crO2s="
   },
   "plasma-browser-integration": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-browser-integration-6.4.2.tar.xz",
-    "hash": "sha256-y4W5WagRCb8qqC91gpsOGDPJtMBriBnDBPfKXjIPFUs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-browser-integration-6.4.3.tar.xz",
+    "hash": "sha256-WMznF6tOw66UGL4F6GfCyD0jKG0dxo8mUM6hizF5q8s="
   },
   "plasma-desktop": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-desktop-6.4.2.tar.xz",
-    "hash": "sha256-MpaRuS82jCIRRgRlDjnbkcY4cMgMDAjoU8agQNvTCoQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-desktop-6.4.3.tar.xz",
+    "hash": "sha256-GQo/VY9rP6khZMPyaecP/R6YHjUt1xikOkywByRapSU="
   },
   "plasma-dialer": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-dialer-6.4.2.tar.xz",
-    "hash": "sha256-l9UkW9yylvJCXNJ3NK/EYWpi6VYKwqEnv+WVxbfFJXs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-dialer-6.4.3.tar.xz",
+    "hash": "sha256-p960P1UuPAecHl3RT+xfbrcuVQJPI6Kbe8LQE9PCM+o="
   },
   "plasma-disks": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-disks-6.4.2.tar.xz",
-    "hash": "sha256-cZvMFQpGJSsO8WT5CVELOMYusNsRrxYVbB0CbzNGWtk="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-disks-6.4.3.tar.xz",
+    "hash": "sha256-vW5jR1ZCr+ciKGLXLUVM2cpsfzkfSBwrFFwqt5NGwhM="
   },
   "plasma-firewall": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-firewall-6.4.2.tar.xz",
-    "hash": "sha256-cRXcGHF16e2KIvbbh2ZiE9jlyV2mbErjdxorvxy4VJs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-firewall-6.4.3.tar.xz",
+    "hash": "sha256-vHgAR7ZWarEjgnWwLBIOKnRUIiy0XEf8spYAMIaDxow="
   },
   "plasma-integration": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-integration-6.4.2.tar.xz",
-    "hash": "sha256-8LVs4ErhEXzA8ipypgAWT9IUiiW3553AxMUH+ImQpcw="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-integration-6.4.3.tar.xz",
+    "hash": "sha256-cfPmQ9e38z/C5HOFBCTc+wDDJY1/4uJxoDJiEzMoi9c="
   },
   "plasma-mobile": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-mobile-6.4.2.tar.xz",
-    "hash": "sha256-p5O7SWV+40IhLQuCCOz+6uyArVzZZA2fBBQi6fkcn2A="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-mobile-6.4.3.tar.xz",
+    "hash": "sha256-4089dZ3kh+QOWQAQ69Fsx0CBHNFd4AEfp3xBcq+WHfM="
   },
   "plasma-nano": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-nano-6.4.2.tar.xz",
-    "hash": "sha256-HqL2PEcuL+2bwgun0Om7MIDBToMCn/htFwaIopjwqCM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-nano-6.4.3.tar.xz",
+    "hash": "sha256-CnxbV63/Wu93yJHoiDqwLFQ6/IYKueK1745VBnZTilY="
   },
   "plasma-nm": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-nm-6.4.2.tar.xz",
-    "hash": "sha256-eG+s60HArZEuBcVHgO2TMcQBlwf7EdzZBPGBOi/Wh2k="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-nm-6.4.3.tar.xz",
+    "hash": "sha256-Z8OOPApU6QrhI3mRFCuSBkY9Q8Lq2O313Vu3oWpGoT4="
   },
   "plasma-pa": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-pa-6.4.2.tar.xz",
-    "hash": "sha256-V9cdQErXnobcEB4o5+g7j0xtvYJb4dsi8pr4Gi2izUU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-pa-6.4.3.tar.xz",
+    "hash": "sha256-aw49OrRpz4b8GNIR/L9BJRqjOjAUoyt37EGQX9L6TiE="
   },
   "plasma-sdk": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-sdk-6.4.2.tar.xz",
-    "hash": "sha256-5/DiYmnWxPI5LYWhtoWY7dH9TAcRZbeiWklv2+WgOeE="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-sdk-6.4.3.tar.xz",
+    "hash": "sha256-m3zjZFmz8s2Ru+CUGto+uzjv8BSZOcWdqy0LDTkowGQ="
   },
   "plasma-systemmonitor": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-systemmonitor-6.4.2.tar.xz",
-    "hash": "sha256-pIZhYNvcVvp7hfSOYyZDuC1tNmdMdU+Zafzq3W8+pTg="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-systemmonitor-6.4.3.tar.xz",
+    "hash": "sha256-aFbjmSZVJjMu6TifvPgZ09B6DqLtRWfVRa4IjkiV0jA="
   },
   "plasma-thunderbolt": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-thunderbolt-6.4.2.tar.xz",
-    "hash": "sha256-cNjE7N+ibccva7ZEctbcVRPKlPCCPYJpT/7sntWrOhY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-thunderbolt-6.4.3.tar.xz",
+    "hash": "sha256-aYn51hqotPoh2iPeALIxZO0VN1mG0nFgGRqQtawTP1I="
   },
   "plasma-vault": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-vault-6.4.2.tar.xz",
-    "hash": "sha256-vSk0YVkv57EkPPpFyH9bGRlrMN1/ADvlTzi2pIG/UZY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-vault-6.4.3.tar.xz",
+    "hash": "sha256-uXkOHGYGUFBDzQxfWJYP5d4dGgT1OazjuYbZbUcDTsc="
   },
   "plasma-welcome": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-welcome-6.4.2.tar.xz",
-    "hash": "sha256-bVfIrkRYph+2BXSwF1sup2bQ8oIhQiGU7xA8D7fsfIQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-welcome-6.4.3.tar.xz",
+    "hash": "sha256-1xzWOZ91n6T8+jD1CKRgqzfSq0+9zd+aLn8rWrhwtGM="
   },
   "plasma-workspace": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-workspace-6.4.2.tar.xz",
-    "hash": "sha256-7WV7457JvB1OW6TF5xe0q2g90nvs7Prvbn4gn3cbSFA="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-workspace-6.4.3.tar.xz",
+    "hash": "sha256-clTyhakeyAKwYSp62yQtmDYqzN/4ZvwShbtluASN7bg="
   },
   "plasma-workspace-wallpapers": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-workspace-wallpapers-6.4.2.tar.xz",
-    "hash": "sha256-06iVlvN2HWJ2wMvCaPerjrcjhhgvjTVovpvDy3bBm38="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-workspace-wallpapers-6.4.3.tar.xz",
+    "hash": "sha256-9dIdq7VO20SDtXihp+foLw5x/K2XS+8kQSE01NQ6ycQ="
   },
   "plasma5support": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma5support-6.4.2.tar.xz",
-    "hash": "sha256-JKB87/CDpqei2bQVKBJUkFBiPENO9zGRCZYwhaEUrvI="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma5support-6.4.3.tar.xz",
+    "hash": "sha256-Homok10Y2YqPy+Av80d0iThbtCqATlQ7uyTwQ/XNjPY="
   },
   "plymouth-kcm": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plymouth-kcm-6.4.2.tar.xz",
-    "hash": "sha256-3GQyiAKa9btFixXYPW0M/VwAzqajRUj+g6UsM9wrOpI="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plymouth-kcm-6.4.3.tar.xz",
+    "hash": "sha256-ONxaWan+fXX6gAr6V604RF89n608obsGbm5GSDj6fg8="
   },
   "polkit-kde-agent-1": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/polkit-kde-agent-1-6.4.2.tar.xz",
-    "hash": "sha256-Kq+ua00EgBjDmPSaFf+YchmDGu4i/sVNCPIHhjQXD5o="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/polkit-kde-agent-1-6.4.3.tar.xz",
+    "hash": "sha256-InMbD6Aun9y9WSajxThhAPIKzXoCY5ZyFlebCERWguc="
   },
   "powerdevil": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/powerdevil-6.4.2.tar.xz",
-    "hash": "sha256-y/ifJe/Iy4fEfFLrV1eBsjajU3lvcxcqQ7iNRBZixsU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/powerdevil-6.4.3.tar.xz",
+    "hash": "sha256-wkfQxBSQXeCfHAEzAoSB+w8ez6JtiTcqzvr/qxUFK9Y="
   },
   "print-manager": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/print-manager-6.4.2.tar.xz",
-    "hash": "sha256-brk+AAZa3hcTf/a0ruxIhltRSbz8Jff5xZPfTRoWaL0="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/print-manager-6.4.3.tar.xz",
+    "hash": "sha256-/f1/42htk351wopMuQG5P0+iiWd+8uypSlDYNVOjLTQ="
   },
   "qqc2-breeze-style": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/qqc2-breeze-style-6.4.2.tar.xz",
-    "hash": "sha256-NuBbGyJ7W2WbiwuIbcNN/sIbCZJb707D5x7ygyXG7Ik="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/qqc2-breeze-style-6.4.3.tar.xz",
+    "hash": "sha256-PGytdAsDEzpwheQ30MsWrOq94oDFXAIrAnLvRNPTI6A="
   },
   "sddm-kcm": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/sddm-kcm-6.4.2.tar.xz",
-    "hash": "sha256-988F3cfix2M72eKaX92vpuCGB9ayA0dpqPSXTIuoR88="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/sddm-kcm-6.4.3.tar.xz",
+    "hash": "sha256-UxQSOsVTiPcBViFjm42DZ8yCns7yU1aIkpjWvlSPjPY="
   },
   "spacebar": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/spacebar-6.4.2.tar.xz",
-    "hash": "sha256-l9lAg3wc5aPXRM/q2jOTXblqjHrP+ALt0y+7r9Eei2E="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/spacebar-6.4.3.tar.xz",
+    "hash": "sha256-9Rwm4KtPadbXJ2iPVh2AdeAOLSlYGosKnDoED/4JynE="
   },
   "spectacle": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/spectacle-6.4.2.tar.xz",
-    "hash": "sha256-GLHQt+JmgGZuuGorCQjDbZ4XpJizUpRNibkBGDkg4Ms="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/spectacle-6.4.3.tar.xz",
+    "hash": "sha256-mYb8CR+ROj8OFSC9izoz6cF04D9ItLKvMZK9ijG7Kdg="
   },
   "systemsettings": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/systemsettings-6.4.2.tar.xz",
-    "hash": "sha256-vFZoCu1tpn3qAmoLxgV0w/Olz6s5kxMZI7aY0oEC1gs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/systemsettings-6.4.3.tar.xz",
+    "hash": "sha256-zBzc1xDz9f0kJIbtypTXGT1F20F4A+1imsdifrIwVVY="
   },
   "wacomtablet": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/wacomtablet-6.4.2.tar.xz",
-    "hash": "sha256-R+aPq/fLHjyXAqxhsaYJvPn4PEgJxD0Et23ln2ih9Nc="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/wacomtablet-6.4.3.tar.xz",
+    "hash": "sha256-NT1D9an3qwRcHwGKvVSt3GOPsJTuxTdfH/YxaRkDM5g="
   },
   "xdg-desktop-portal-kde": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/xdg-desktop-portal-kde-6.4.2.tar.xz",
-    "hash": "sha256-K2dIB9KnhJN6C87wJxOVrYWjVHUlO6nxirotdtgzClM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/xdg-desktop-portal-kde-6.4.3.tar.xz",
+    "hash": "sha256-P+xx4AWr6Ds9WTp0vDMEwXjWBYg/47d/kVxkz0XB/Cc="
   }
 }
\ No newline at end of file
diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
index 1fee859946b2..b2ca5dca7cf9 100644
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -3,12 +3,15 @@
   stdenv,
   fetchurl,
   fetchFromGitHub,
-  fetchpatch2,
   kernel,
 }:
 
 let
   version = "6.30.223.271";
+  # Patchset release number from rpmfusion, to more easily differentiate
+  # versions and updates. See `wl-kmod.spec` file:
+  # https://github.com/rpmfusion/wl-kmod/blob/master/wl-kmod.spec#L19
+  release = "57";
   hashes = {
     i686-linux = "sha256-T4twspOsjMXHDlca1dGHjQ8p0TOkb+eGmGjZwZtQWM0=";
     x86_64-linux = "sha256-X3l3TVvuyPdja1nA+wegMQju8eP9MkVjiyCFjHFBRL4=";
@@ -21,8 +24,8 @@ let
   rpmFusionPatches = fetchFromGitHub {
     owner = "rpmfusion";
     repo = "wl-kmod";
-    rev = "9a5a0d7195e0f6b05ff97e948b97fb0b7427cbf2";
-    hash = "sha256-pOOkkOjc77KGqc9fWuRyRsymd90OpLEnbOvxBbeIdKQ=";
+    rev = "b0d19578ebd0daae9c5b7f9e9511a6d73ac4d957";
+    hash = "sha256-v7mZ2S/eVfGTEXrxpdiemHhrC+P3/sPOZqTBhRtins4=";
   };
   patchset = [
     "wl-kmod-001_wext_workaround.patch"
@@ -55,10 +58,14 @@ let
     "wl-kmod-028_kernel_6.12_adaptation.patch"
     "wl-kmod-029_kernel_6.13_adaptation.patch"
     "wl-kmod-030_kernel_6.14_adaptation.patch"
+    "wl-kmod-031_replace_EXTRA_CFLAGS_EXTRA_LDFLAGS_with_ccflags-y_ldflags-y.patch"
+    "wl-kmod-032_add_MODULE_DESCRIPTION_macro.patch"
+    "wl-kmod-033_disable_objtool_add_warning_unmaintained.patch"
+    "wl-kmod-034_kernel_6.15_adaptation_replace_del_timer_with_timer_delete.patch"
   ];
 in
 stdenv.mkDerivation {
-  name = "broadcom-sta-${version}-${kernel.version}";
+  name = "broadcom-sta-${version}-${release}-${kernel.version}";
 
   src = fetchurl {
     url = "https://docs.broadcom.com/docs-and-downloads/docs/linux_sta/${tarball}";
@@ -94,9 +101,25 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Kernel module driver for some Broadcom's wireless cards";
-    homepage = "http://www.broadcom.com/support/802.11/linux_sta.php";
+    homepage = "https://www.broadcom.com/support/download-search?pg=Legacy%20Products&pf=Legacy%20Wireless&pn&pa&po&dk&pl";
     license = lib.licenses.unfreeRedistributable;
-    maintainers = [ lib.maintainers.j0hax ];
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      j0hax
+      nullcube
+    ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
+    knownVulnerabilities = [
+      "CVE-2019-9501: heap buffer overflow, potentially allowing remote code execution by sending specially-crafted WiFi packets"
+      "CVE-2019-9502: heap buffer overflow, potentially allowing remote code execution by sending specially-crafted WiFi packets"
+      (
+        "The Broadcom STA wireless driver is not maintained "
+        + "and is incompatible with Linux kernel security mitigations. "
+        + "It is heavily recommended to replace the hardware and remove the driver. "
+        + "Proceed at your own risk!"
+      )
+    ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index fb6a33b29ad4..24fa44148956 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,15 +1,15 @@
 {
     "testing": {
-        "version": "6.16-rc5",
-        "hash": "sha256:0will8rmmdlcxyrflr778264h9pfv67cpqqnas112r248vicnkny"
+        "version": "6.16-rc6",
+        "hash": "sha256:03sz5gbnz1s763nlq2sbqk3bmjca24hq2n9wrpqhy6gyrd11s22f"
     },
     "6.1": {
-        "version": "6.1.144",
-        "hash": "sha256:1kvskw600nm6ybd5yr940cx3fz0l9myyqzsk7l30cxdx5yjbsj8g"
+        "version": "6.1.145",
+        "hash": "sha256:0qrkcrqb0migsrq6xl1idyz8n6vjbdk74z4sc9na97b6n5vp0r9i"
     },
     "5.15": {
-        "version": "5.15.187",
-        "hash": "sha256:057zmzq364483gc5n9aab8mi0bxbk3nyc2nnziwq4hc197l6wy11"
+        "version": "5.15.188",
+        "hash": "sha256:1nfcrdwa2mgih57ch9kh8gc6jl950a7vpqgr56xk1b02303km5f4"
     },
     "5.10": {
         "version": "5.10.239",
@@ -20,12 +20,12 @@
         "hash": "sha256:1adn0pbk8y1zp1yrz83ch6h4wypm2qvbnx4xig3sls2nfgvmi0f4"
     },
     "6.6": {
-        "version": "6.6.97",
-        "hash": "sha256:0fzfp46czdk3v8mnphiv9n68xf434igjkhx9nxbdlhl1cdqc2rrv"
+        "version": "6.6.98",
+        "hash": "sha256:1raxyhvv0yay3k1izwcqdbq9322nflflfzcn9d1jrhmb032k8si9"
     },
     "6.12": {
-        "version": "6.12.37",
-        "hash": "sha256:15gzcbkjkycvghjvpx3qshnc4416fw3ln2afip1hlpjv839dyvwk"
+        "version": "6.12.38",
+        "hash": "sha256:1k0gcwavn5iws3z1as39227i2hnc62qnfddjfqy7k7ymhf6zldgh"
     },
     "6.15": {
         "version": "6.15.6",
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 8e04958ba462..49522576d3d3 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.15.4"; # zen
-      suffix = "zen2"; # zen
-      sha256 = "0mf83mwpsa2zm1crc3gqbgmsrpsdxi52r1yvrknrcvi003m1y55y"; # zen
+      version = "6.15.6"; # zen
+      suffix = "zen1"; # zen
+      sha256 = "11nfmnyyqph9d0hihss9dg96z7dgiqk3p16c2i2li6q52walbj6g"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index a888c5b9a5da..9374f9585f92 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -101,13 +101,13 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "570.123.18";
-    persistencedVersion = "550.142";
-    settingsVersion = "550.142";
-    sha256_64bit = "sha256-GoBNatVpits13a3xsJSUr9BFG+5xrUDROfHmvss2cSY=";
-    openSha256 = "sha256-AYl8En0ZAZXWlJ8J8LKbPvAEKX+y65L1aq4Hm+dJScs=";
-    settingsSha256 = "sha256-Wk6IlVvs23cB4s0aMeZzSvbOQqB1RnxGMv3HkKBoIgY=";
-    persistencedSha256 = "sha256-yQFrVk4i2dwReN0XoplkJ++iA1WFhnIkP7ns4ORmkFA=";
+    version = "570.123.19";
+    persistencedVersion = "570.169";
+    settingsVersion = "570.169";
+    sha256_64bit = "sha256-K1ElpoTBjlLUG7slBrAhKqnEjUFwupiF7TS/8ogCf7c=";
+    openSha256 = "sha256-uGH2lnnADf5AGl5ShcbCOULsCIWtJlbxgHiz7I2efVE=";
+    settingsSha256 = "sha256-0E3UnpMukGMWcX8td6dqmpakaVbj4OhhKXgmqz77XZc=";
+    persistencedSha256 = "sha256-dttFu+TmbFI+mt1MbbmJcUnc1KIJ20eHZDR7YzfWmgE=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
 
     broken = kernel.kernelAtLeast "6.15";
diff --git a/pkgs/os-specific/linux/rtw88/default.nix b/pkgs/os-specific/linux/rtw88/default.nix
index 5c2bf316081c..0f2e47595e9a 100644
--- a/pkgs/os-specific/linux/rtw88/default.nix
+++ b/pkgs/os-specific/linux/rtw88/default.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "rtw88";
-  version = "0-unstable-2025-06-26";
+  version = "0-unstable-2025-07-13";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtw88";
-    rev = "b89af8cd40d9528b0cdb9a6251efe49d8a69bfc6";
-    hash = "sha256-gzWVfb8nAN0mmOpiats+VDG/6iwdrxcQHEsDgC7eFZU=";
+    rev = "fa96fd4c014fa528d1fa50318e97aa71bf4f473c";
+    hash = "sha256-KFozxbpw6HJhbL5QLnGkKEBAbeEiHrhSJUMAcbM+lX4=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/servers/authelia/web.nix b/pkgs/servers/authelia/web.nix
index 3c4e0ae2ca72..fcad0e1de466 100644
--- a/pkgs/servers/authelia/web.nix
+++ b/pkgs/servers/authelia/web.nix
@@ -31,8 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = pnpmDepsHash;
     fetcherVersion = 1;
+    hash = pnpmDepsHash;
   };
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
index 5e7304ea9f13..118b04924f90 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
@@ -19,8 +19,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-ZWh2R6wr7FH2RfoFAE81Kl+wHnUeNjUbFG3KIk8ZN3g=";
     fetcherVersion = 1;
+    hash = "sha256-ZWh2R6wr7FH2RfoFAE81Kl+wHnUeNjUbFG3KIk8ZN3g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/mobilizon/common.nix b/pkgs/servers/mobilizon/common.nix
index 813dcb1da927..15dd8337a01c 100644
--- a/pkgs/servers/mobilizon/common.nix
+++ b/pkgs/servers/mobilizon/common.nix
@@ -2,13 +2,13 @@
 rec {
 
   pname = "mobilizon";
-  version = "5.1.4";
+  version = "5.1.5";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "kaihuri";
     repo = pname;
     tag = version;
-    sha256 = "sha256-rtYb9wptP1wAaQrK60apjjSCqtfolXag6QgRYf6pwzQ=";
+    hash = "sha256-nwEmW43GO0Ta7O7mUSJaEtm4hBfXInPqatBRdaWrhBU=";
   };
 }
diff --git a/pkgs/servers/mobilizon/default.nix b/pkgs/servers/mobilizon/default.nix
index 61dd5c7f8dfa..0d88715bb0f2 100644
--- a/pkgs/servers/mobilizon/default.nix
+++ b/pkgs/servers/mobilizon/default.nix
@@ -46,7 +46,7 @@ mixRelease rec {
             owner = "elixir-cldr";
             repo = "cldr";
             rev = "v${old.version}";
-            sha256 =
+            hash =
               assert old.version == "2.37.5";
               "sha256-T5Qvuo+xPwpgBsqHNZYnTCA4loToeBn1LKTMsDcCdYs=";
           };
@@ -67,7 +67,7 @@ mixRelease rec {
             owner = "danhper";
             repo = "elixir-web-push-encryption";
             rev = "6e143dcde0a2854c4f0d72816b7ecab696432779";
-            sha256 = "sha256-Da+/28SPZuUQBi8fQj31zmMvhMrYUaQIW4U4E+mRtMg=";
+            hash = "sha256-Da+/28SPZuUQBi8fQj31zmMvhMrYUaQIW4U4E+mRtMg=";
           };
           beamDeps = with final; [
             httpoison
@@ -81,7 +81,7 @@ mixRelease rec {
             owner = "tcitworld";
             repo = name;
             rev = "1033d922c82a7223db0ec138e2316557b70ff49f";
-            sha256 = "sha256-N3bJZznNazLewHS4c2B7LP1lgxd1wev+EWVlQ7rOwfU=";
+            hash = "sha256-N3bJZznNazLewHS4c2B7LP1lgxd1wev+EWVlQ7rOwfU=";
           };
           beamDeps = with final; [
             mix_test_watch
@@ -96,7 +96,7 @@ mixRelease rec {
             owner = "tcitworld";
             repo = name;
             rev = "0c036448e261e8be6a512581c592fadf48982d84";
-            sha256 = "sha256-4pfply1vTAIT2Xvm3kONmrCK05xKfXFvcb8EKoSCXBE=";
+            hash = "sha256-4pfply1vTAIT2Xvm3kONmrCK05xKfXFvcb8EKoSCXBE=";
           };
           beamDeps = with final; [
             ex_doc
@@ -114,7 +114,7 @@ mixRelease rec {
             owner = "tcitworld";
             repo = name;
             rev = "8b5485fde00fafbde20f315bec387a77f7358334";
-            sha256 = "sha256-ttgCWoBKU7VTjZJBhZNtqVF4kN7psBr/qOeR65MbTqw=";
+            hash = "sha256-ttgCWoBKU7VTjZJBhZNtqVF4kN7psBr/qOeR65MbTqw=";
           };
           beamDeps = with final; [
             httpoison
diff --git a/pkgs/servers/mobilizon/frontend.nix b/pkgs/servers/mobilizon/frontend.nix
index 23b83bc16d7f..8a5ca34f9a1f 100644
--- a/pkgs/servers/mobilizon/frontend.nix
+++ b/pkgs/servers/mobilizon/frontend.nix
@@ -11,7 +11,7 @@ in
 buildNpmPackage {
   inherit (common) pname version src;
 
-  npmDepsHash = "sha256-vf8qEXMZ+TGqKjDN7LjUyOm98EQqweW6NKdJuNoMuVc=";
+  npmDepsHash = "sha256-5ilhuFaIvksXsJmNu20m8MV3hYtyPUz4zp8NIvhR5Nw=";
 
   nativeBuildInputs = [ imagemagick ];
 
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
new file mode 100644
index 000000000000..3e57035a9946
--- /dev/null
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
@@ -0,0 +1,13 @@
+{ grafanaPlugin, lib }:
+
+grafanaPlugin {
+  pname = "grafana-exploretraces-app";
+  version = "1.1.1";
+  zipHash = "sha256-vzLZvBxFF9TQBWvuAUrfWROIerOqPPjs/OKUyX1dBac=";
+  meta = with lib; {
+    description = "Opinionated traces app.";
+    license = licenses.agpl3Only;
+    teams = [ lib.teams.fslabs ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
index f4b4f50b874c..2e1416a89369 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-lokiexplore-app";
-  version = "1.0.13";
-  zipHash = "sha256-oTiwvkKiKpeI7MUxyaRuxXot4UhMeSvuJh0N1VIfA5Q=";
+  version = "1.0.22";
+  zipHash = "sha256-y1WJ1RxUbJSsiSApz3xvrARefNnXdZxDVfzeGfDZbFo=";
   meta = with lib; {
     description = "The Grafana Logs Drilldown app offers a queryless experience for browsing Loki logs without the need for writing complex queries.";
     license = licenses.agpl3Only;
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix
index 5cad9c5e9519..1e90b2574278 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-oncall-app";
-  version = "1.15.6";
-  zipHash = "sha256-2BlR8dKcfevkajT571f2vSn+YOzfrjUaY+dmN0SSZHE=";
+  version = "1.16.4";
+  zipHash = "sha256-sz8jdUBEUpvfvYo0dZU1KVW/65MI5rcheTCia2m4cjU=";
   meta = with lib; {
     description = "Developer-friendly incident response for Grafana";
     license = licenses.agpl3Only;
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
new file mode 100644
index 000000000000..d7d915552a45
--- /dev/null
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
@@ -0,0 +1,13 @@
+{ grafanaPlugin, lib }:
+
+grafanaPlugin {
+  pname = "grafana-pyroscope-app";
+  version = "1.5.0";
+  zipHash = "sha256-C3TbXJa17ciEmvnKgw/5i6bq/5bzDe2iJebNaFFMxXQ=";
+  meta = with lib; {
+    description = "Profiles Drilldown is a native Grafana application designed to integrate seamlessly with Pyroscope, the open-source continuous profiling platform, providing a smooth, query-less experience for browsing and analyzing profiling data.";
+    license = licenses.agpl3Only;
+    teams = [ lib.teams.fslabs ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/servers/monitoring/grafana/plugins/marcusolsson-calendar-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/marcusolsson-calendar-panel/default.nix
index 9b7e9c602316..ea6774622e98 100644
--- a/pkgs/servers/monitoring/grafana/plugins/marcusolsson-calendar-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/marcusolsson-calendar-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "marcusolsson-calendar-panel";
-  version = "3.9.1";
-  zipHash = "sha256-52MhkjsTke256cId6BtgjdRiU4w9cA6MTWA79/UfHQw=";
+  version = "4.0.1";
+  zipHash = "sha256-xyqu9e6PImQmwN/p05TrSYx5uOmghbTVfoy4JT7hyqA=";
   meta = with lib; {
     description = "Calendar Panel is a Grafana plugin that displays events from various data sources.";
     license = licenses.asl20;
diff --git a/pkgs/servers/monitoring/grafana/plugins/plugins.nix b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
index 3b20f29f2be9..bc22c3443e98 100644
--- a/pkgs/servers/monitoring/grafana/plugins/plugins.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
@@ -12,6 +12,7 @@
   grafana-clickhouse-datasource = callPackage ./grafana-clickhouse-datasource { };
   grafana-clock-panel = callPackage ./grafana-clock-panel { };
   grafana-discourse-datasource = callPackage ./grafana-discourse-datasource { };
+  grafana-exploretraces-app = callPackage ./grafana-exploretraces-app { };
   grafana-github-datasource = callPackage ./grafana-github-datasource { };
   grafana-googlesheets-datasource = callPackage ./grafana-googlesheets-datasource { };
   grafana-lokiexplore-app = callPackage ./grafana-lokiexplore-app { };
@@ -21,6 +22,7 @@
   grafana-opensearch-datasource = callPackage ./grafana-opensearch-datasource { };
   grafana-piechart-panel = callPackage ./grafana-piechart-panel { };
   grafana-polystat-panel = callPackage ./grafana-polystat-panel { };
+  grafana-pyroscope-app = callPackage ./grafana-pyroscope-app { };
   grafana-worldmap-panel = callPackage ./grafana-worldmap-panel { };
   marcusolsson-calendar-panel = callPackage ./marcusolsson-calendar-panel { };
   marcusolsson-csv-datasource = callPackage ./marcusolsson-csv-datasource { };
diff --git a/pkgs/servers/monitoring/grafana/plugins/ventura-psychrometric-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/ventura-psychrometric-panel/default.nix
index 4e75c01cfe1b..c4031ee69b81 100644
--- a/pkgs/servers/monitoring/grafana/plugins/ventura-psychrometric-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/ventura-psychrometric-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "ventura-psychrometric-panel";
-  version = "5.0.0";
-  zipHash = "sha256-g14Xosk48dslNROidRDRJGzrDSkeB3cr1PxNrsLMEAA=";
+  version = "5.0.1";
+  zipHash = "sha256-WcMgjgDobexUrfZOBmXRWv0FD3us3GgglxRdpo9BecA=";
   meta = with lib; {
     description = "Grafana plugin to display air conditions on a psychrometric chart.";
     license = licenses.bsd3Lbnl;
diff --git a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-logs-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-logs-datasource/default.nix
index bdc9b95b583f..d18f6a0686ce 100644
--- a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-logs-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-logs-datasource/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "victoriametrics-logs-datasource";
-  version = "0.16.3";
-  zipHash = "sha256-C7xYnhRd6KC+prZwL0vINriMb1mvFxMattLp8N8A8tE=";
+  version = "0.18.1";
+  zipHash = "sha256-iX9CbkXPP8/SCDbdbik2gr0DIZmGFUi2M3Iw3Z7pyNM=";
   meta = {
     description = "Grafana datasource for VictoriaLogs";
     license = lib.licenses.asl20;
diff --git a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
index 37ce8cd0df44..5be2cbae1b35 100644
--- a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "victoriametrics-metrics-datasource";
-  version = "0.16.0";
-  zipHash = "sha256-Oy++CDFAdG2wlAkxzDKWUX6PVX+t47tZBImUEw+XUho=";
+  version = "0.17.0";
+  zipHash = "sha256-/DOv90kl1TSJ1NJ9g2LVu8qzudBDO3UfyVox1S73JFg=";
   meta = {
     description = "VictoriaMetrics metrics datasource for Grafana";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/monitoring/grafana/plugins/volkovlabs-variable-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/volkovlabs-variable-panel/default.nix
index 893c3ed635b0..98b4dd69e7c5 100644
--- a/pkgs/servers/monitoring/grafana/plugins/volkovlabs-variable-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/volkovlabs-variable-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "volkovlabs-variable-panel";
-  version = "3.9.0";
-  zipHash = "sha256-M9upfNMK45dPnouSO6Do3Li833q9NI0H2gc6DaLEsbA=";
+  version = "4.0.0";
+  zipHash = "sha256-fHOo/Au8yPQXIkG/BupNcMpFNgDLRrqpwRpmbq6xYhM=";
   meta = with lib; {
     description = "The Variable panel allows you to have dashboard filters in a separate panel which you can place anywhere on the dashboard.";
     license = licenses.asl20;
diff --git a/pkgs/servers/sql/postgresql/ext/pg_net.nix b/pkgs/servers/sql/postgresql/ext/pg_net.nix
index c754b7104f43..d0c55edced2e 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_net.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_net.nix
@@ -8,21 +8,17 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_net";
-  version = "0.18.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "pg_net";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MXZewz6vb1ZEGMzbk/x0VtBDH2GxnwYWsy3EjJnas2U=";
+    hash = "sha256-Sy2PG1zCB6tNbcMNMWvl/Fe2Zu1stvEIqGrLsRF09GY=";
   };
 
   buildInputs = [ curl ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optional (lib.versionAtLeast postgresql.version "18") "-Wno-error=missing-variable-declarations"
-  );
-
   meta = {
     description = "Async networking for Postgres";
     homepage = "https://github.com/supabase/pg_net";
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 20ed0a5ef44f..a5d3d0489359 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -233,8 +233,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       pname = "discourse-assets";
       inherit version src;
-      hash = "sha256-WyRBnuKCl5NJLtqy3HK/sJcrpMkh0PjbasGPNDV6+7Y=";
       fetcherVersion = 1;
+      hash = "sha256-WyRBnuKCl5NJLtqy3HK/sJcrpMkh0PjbasGPNDV6+7Y=";
     };
 
     nativeBuildInputs = runtimeDeps ++ [
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index eecf875e3728..85ce59d44ab6 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -42,8 +42,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   extraBuildInputs = [ libsass ];
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = pinData.uiPNPMDepsHash;
     fetcherVersion = 1;
+    hash = pinData.uiPNPMDepsHash;
   };
 
   buildPhase = ''
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 56d9bd10dc2c..5bcfd73888f9 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -6575,46 +6575,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videoxgi = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libdrm,
-      libpciaccess,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-xgi";
-      version = "1.6.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-xgi-1.6.1.tar.bz2";
-        sha256 = "10xd2vah0pnpw5spn40n4p95mpmgvdkly4i1cz51imnlfsw7g8si";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libdrm
-        libpciaccess
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xfd = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index e324f91246d2..49f4838a058b 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -1307,27 +1307,6 @@ self: super:
     ];
   });
 
-  xf86videoxgi = super.xf86videoxgi.overrideAttrs (attrs: {
-    patches = [
-      # fixes invalid open mode
-      # https://cgit.freedesktop.org/xorg/driver/xf86-video-xgi/commit/?id=bd94c475035739b42294477cff108e0c5f15ef67
-      (fetchpatch {
-        url = "https://cgit.freedesktop.org/xorg/driver/xf86-video-xgi/patch/?id=bd94c475035739b42294477cff108e0c5f15ef67";
-        sha256 = "0myfry07655adhrpypa9rqigd6rfx57pqagcwibxw7ab3wjay9f6";
-      })
-      (fetchpatch {
-        url = "https://cgit.freedesktop.org/xorg/driver/xf86-video-xgi/patch/?id=78d1138dd6e214a200ca66fa9e439ee3c9270ec8";
-        sha256 = "0z3643afgrync280zrp531ija0hqxc5mrwjif9nh9lcnzgnz2d6d";
-      })
-      # Pull upstream fix for -fno-common toolchains.
-      (fetchpatch {
-        name = "fno-common.patch";
-        url = "https://github.com/freedesktop/xorg-xf86-video-xgi/commit/3143bdee580c4d397e21adb0fa35502d4dc8e888.patch";
-        sha256 = "0by6k26rj1xmljnbfd08v90s1f9bkmnf17aclhv50081m83lmm07";
-      })
-    ];
-  });
-
   xfd = addMainProgram super.xfd { };
   xfontsel = addMainProgram super.xfontsel { };
   xfs = addMainProgram super.xfs { };
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index f40de6f38675..af52d9252054 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -119,7 +119,6 @@ mirror://xorg/individual/driver/xf86-video-vesa-2.6.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
 mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
-mirror://xorg/individual/driver/xf86-video-xgi-1.6.1.tar.bz2
 mirror://xorg/individual/font/encodings-1.1.0.tar.xz
 mirror://xorg/individual/font/font-adobe-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-adobe-100dpi-1.0.4.tar.xz
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 0a0a40121f39..5c359014ba26 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -295,6 +295,7 @@ rec {
         dontStrip = true;
         env = (args.env or { }) // {
           NIX_CFLAGS_COMPILE = toString (args.env.NIX_CFLAGS_COMPILE or "") + " -ggdb -Og";
+          NIX_RUSTFLAGS = toString (args.env.NIX_RUSTFLAGS or "") + " -g -C opt-level=0 -C strip=none";
         };
       });
     });
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index 3056f7eb9dd1..51b7a04a9fa7 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -25,13 +25,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.27.67";
+  version = "2.27.68";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-DIezuI8pexIzqiGWFrgQQER1wx0jCwTZgcluFCBvpCw=";
+    hash = "sha256-jDBm6fo/dwE41aNH8CmpqJo8ZyPblMd4DQqxo5C0J8w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 2feabeefa54a..a32da370bef2 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -60,11 +60,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "networkmanager";
-  version = "1.52.0";
+  version = "1.52.1";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NW8hoV2lHkIY/U0P14zqYeBnsRFqJc3e5K+d8FBi6S0=";
+    hash = "sha256-ixIsc0k6cvK65SfBJc69h3EWcbkDUtvisXiKupV1rG8=";
   };
 
   outputs = [
diff --git a/pkgs/tools/package-management/nix/common-autoconf.nix b/pkgs/tools/package-management/nix/common-autoconf.nix
index 4ad05d61d01b..a6e758467596 100644
--- a/pkgs/tools/package-management/nix/common-autoconf.nix
+++ b/pkgs/tools/package-management/nix/common-autoconf.nix
@@ -72,7 +72,11 @@ in
   xz,
   enableDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   enableStatic ? stdenv.hostPlatform.isStatic,
-  withAWS ? !enableStatic && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  withAWS ?
+    lib.meta.availableOn stdenv.hostPlatform aws-c-common
+    && !enableStatic
+    && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  aws-c-common,
   aws-sdk-cpp,
   withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
   libseccomp,
diff --git a/pkgs/tools/package-management/nix/common-meson.nix b/pkgs/tools/package-management/nix/common-meson.nix
index 1e2bb73aef41..50e5c9fd060d 100644
--- a/pkgs/tools/package-management/nix/common-meson.nix
+++ b/pkgs/tools/package-management/nix/common-meson.nix
@@ -63,7 +63,11 @@ assert (hash == null) -> (src != null);
   xz,
   enableDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   enableStatic ? stdenv.hostPlatform.isStatic,
-  withAWS ? !enableStatic && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  withAWS ?
+    lib.meta.availableOn stdenv.hostPlatform aws-c-common
+    && !enableStatic
+    && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  aws-c-common,
   aws-sdk-cpp,
   withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
   libseccomp,
diff --git a/pkgs/tools/security/firefox_decrypt/default.nix b/pkgs/tools/security/firefox_decrypt/default.nix
index 5bc8dbe86aa0..8b4a1464b743 100644
--- a/pkgs/tools/security/firefox_decrypt/default.nix
+++ b/pkgs/tools/security/firefox_decrypt/default.nix
@@ -18,8 +18,8 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "unode";
     repo = pname;
-    rev = "0931c0484d7429f7d4de3a2f5b62b01b7924b49f";
-    hash = "sha256-9HbH8DvHzmlem0XnDbcrIsMQRBuf82cHObqpLzQxNZM=";
+    tag = "${version}";
+    hash = "sha256-HPjOUWusPXoSwwDvW32Uad4gFERvn79ee/WxeX6h3jY=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +42,9 @@ buildPythonApplication rec {
     description = "Tool to extract passwords from profiles of Mozilla Firefox and derivates";
     mainProgram = "firefox_decrypt";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ schnusch ];
+    maintainers = with maintainers; [
+      schnusch
+      unode
+    ];
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9789bd3c3de6..67263043db84 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1653,6 +1653,7 @@ mapAliases {
   prometheus-minio-exporter = throw "'prometheus-minio-exporter' has been removed from nixpkgs, use Minio's built-in Prometheus integration instead"; # Added 2024-06-10
   prometheus-tor-exporter = throw "'prometheus-tor-exporter' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-10-30
   protobuf_23 = throw "'protobuf_23' has been removed from nixpkgs. Consider using a more recent version of the protobuf library"; # Added 2025-04-20
+  protobuf_24 = throw "'protobuf_24' has been removed from nixpkgs. Consider using a more recent version of the protobuf library"; # Added 2025-07-14
   protobuf_26 = throw "'protobuf_26' has been removed from nixpkgs. Consider using a more recent version of the protobuf library"; # Added 2025-06-29
   protobuf_28 = throw "'protobuf_28' has been removed from nixpkgs. Consider using a more recent version of the protobuf library"; # Added 2025-06-14
   protobuf3_24 = protobuf_24;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index abd8886dbf42..b9b1e511533c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -395,8 +395,6 @@ with pkgs;
     }
   );
 
-  djhtml = python3Packages.callPackage ../development/tools/djhtml { };
-
   dnf-plugins-core = with python3Packages; toPythonApplication dnf-plugins-core;
 
   dnf4 = python3Packages.callPackage ../development/python-modules/dnf4/wrapper.nix { };
@@ -4289,10 +4287,6 @@ with pkgs;
 
   rsibreak = libsForQt5.callPackage ../applications/misc/rsibreak { };
 
-  rss2email = callPackage ../applications/networking/feedreaders/rss2email {
-    pythonPackages = python3Packages;
-  };
-
   rucio = callPackage ../by-name/ru/rucio/package.nix {
     # Pinned to python 3.12 while python313Packages.future does not evaluate and
     # until https://github.com/CZ-NIC/pyoidc/issues/649 is resolved
@@ -4489,10 +4483,6 @@ with pkgs;
     }
   );
 
-  tor = callPackage ../tools/security/tor { };
-
-  torsocks = callPackage ../tools/security/tor/torsocks.nix { };
-
   trackma-curses = trackma.override { withCurses = true; };
 
   trackma-gtk = trackma.override { withGTK = true; };
@@ -9249,7 +9239,6 @@ with pkgs;
       };
       protobuf_27 = callPackage ../development/libraries/protobuf/27.nix { };
       protobuf_25 = callPackage ../development/libraries/protobuf/25.nix { };
-      protobuf_24 = callPackage ../development/libraries/protobuf/24.nix { };
       protobuf_21 = callPackage ../development/libraries/protobuf/21.nix {
         abseil-cpp = abseil-cpp_202103;
       };
@@ -9259,7 +9248,6 @@ with pkgs;
     protobuf_29
     protobuf_27
     protobuf_25
-    protobuf_24
     protobuf_21
     ;
 
@@ -10242,7 +10230,7 @@ with pkgs;
   freshrss-extensions = recurseIntoAttrs (callPackage ../servers/web-apps/freshrss/extensions { });
 
   grafana = callPackage ../servers/monitoring/grafana { };
-  grafanaPlugins = callPackages ../servers/monitoring/grafana/plugins { };
+  grafanaPlugins = recurseIntoAttrs (callPackages ../servers/monitoring/grafana/plugins { });
 
   hasura-cli = callPackage ../servers/hasura/cli.nix { };
 
@@ -12181,7 +12169,7 @@ with pkgs;
 
   gnuradio = callPackage ../applications/radio/gnuradio/wrapper.nix {
     unwrapped = callPackage ../applications/radio/gnuradio {
-      python = python311;
+      python = python3;
     };
   };
   gnuradioPackages = lib.recurseIntoAttrs gnuradio.pkgs;
@@ -13312,10 +13300,6 @@ with pkgs;
 
   taxi-cli = with python3Packages; toPythonApplication taxi;
 
-  msmtp = callPackage ../applications/networking/msmtp {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
-
   imapfilter = callPackage ../applications/networking/mailreaders/imapfilter.nix {
     lua = lua5;
   };
@@ -13720,8 +13704,7 @@ with pkgs;
 
   scantailor-universal = callPackage ../applications/graphics/scantailor/universal.nix { };
 
-  scribus_1_5 = libsForQt5.callPackage ../applications/office/scribus/default.nix { };
-  scribus = scribus_1_5;
+  scribus = callPackage ../applications/office/scribus/default.nix { };
 
   seafile-client = libsForQt5.callPackage ../applications/networking/seafile-client { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1f90a3258ce3..3abd303abe7d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3409,6 +3409,8 @@ self: super: with self; {
 
   dctorch = callPackage ../development/python-modules/dctorch { };
 
+  ddgs = callPackage ../development/python-modules/ddgs { };
+
   ddt = callPackage ../development/python-modules/ddt { };
 
   deal = callPackage ../development/python-modules/deal { };
@@ -4308,6 +4310,8 @@ self: super: with self; {
 
   drf-orjson-renderer = callPackage ../development/python-modules/drf-orjson-renderer { };
 
+  drf-pydantic = callPackage ../development/python-modules/drf-pydantic { };
+
   drf-spectacular = callPackage ../development/python-modules/drf-spectacular { };
 
   drf-spectacular-sidecar = callPackage ../development/python-modules/drf-spectacular-sidecar { };
@@ -7396,10 +7400,7 @@ self: super: with self; {
 
   jsonmerge = callPackage ../development/python-modules/jsonmerge { };
 
-  jsonnet = buildPythonPackage {
-    inherit (pkgs.jsonnet) name src;
-    format = "setuptools";
-  };
+  jsonnet = callPackage ../development/python-modules/jsonnet { };
 
   jsonpatch = callPackage ../development/python-modules/jsonpatch { };
 
@@ -7806,6 +7807,8 @@ self: super: with self; {
 
   langchain-fireworks = callPackage ../development/python-modules/langchain-fireworks { };
 
+  langchain-google-genai = callPackage ../development/python-modules/langchain-google-genai { };
+
   langchain-groq = callPackage ../development/python-modules/langchain-groq { };
 
   langchain-huggingface = callPackage ../development/python-modules/langchain-huggingface { };
@@ -14948,6 +14951,8 @@ self: super: with self; {
 
   pyverilog = callPackage ../development/python-modules/pyverilog { };
 
+  pyvers = callPackage ../development/python-modules/pyvers { };
+
   pyversasense = callPackage ../development/python-modules/pyversasense { };
 
   pyvesync = callPackage ../development/python-modules/pyvesync { };
@@ -19066,6 +19071,8 @@ self: super: with self; {
 
   urwid-readline = callPackage ../development/python-modules/urwid-readline { };
 
+  urwid-satext = callPackage ../development/python-modules/urwid-satext { };
+
   urwidgets = callPackage ../development/python-modules/urwidgets { };
 
   urwidtrees = callPackage ../development/python-modules/urwidtrees { };
@@ -19687,7 +19694,9 @@ self: super: with self; {
 
   xen = toPythonModule (pkgs.xen.override { python3Packages = self; });
 
-  xformers = callPackage ../development/python-modules/xformers { };
+  xformers = callPackage ../development/python-modules/xformers {
+    inherit (pkgs.llvmPackages) openmp;
+  };
 
   xgboost = callPackage ../development/python-modules/xgboost { inherit (pkgs) xgboost; };
 
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index 0e635efa2316..e4d3d4582ab0 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -174,7 +174,7 @@ makeScopeWithSplicing' {
 
         kreport = callPackage ../development/libraries/kreport { };
 
-        kquickimageedit = callPackage ../development/libraries/kquickimageedit { };
+        kquickimageedit = callPackage ../development/libraries/kquickimageedit/0.3.0.nix { };
 
         kuserfeedback = callPackage ../development/libraries/kuserfeedback { };
 
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 5efa85cfec65..8a64dc00c9f9 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -117,6 +117,8 @@ makeScopeWithSplicing' {
         wlroots = pkgs.wlroots_0_18;
       };
 
+      qwt = callPackage ../development/libraries/qwt/default.nix { };
+
       qxlsx = callPackage ../development/libraries/qxlsx { };
 
       qzxing = callPackage ../development/libraries/qzxing { };