diff --git a/.editorconfig b/.editorconfig
index 2d877d20b825..6972df7013d6 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -89,6 +89,10 @@ trim_trailing_whitespace = unset
 end_of_line = unset
 insert_final_newline = unset
 
+# see https://manual.jule.dev/project/code-style.html#indentions
+[*.jule]
+indent_style = tab
+
 # Keep this hint at the bottom:
 # Please don't add entries for subfolders here.
 # Create <subfolder>/.editorconfig instead.
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 9f4a2ba4d0b4..d443d68cdad9 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -40,6 +40,7 @@ jobs:
       - id: prepare
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
+          retries: 3
           script: |
             require('./ci/github-script/prepare.js')({
               github,
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0d5f20e3b57b..4431e89954f3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -27,6 +27,7 @@ jobs:
       - id: prepare
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
+          retries: 3
           script: |
             require('./ci/github-script/prepare.js')({
               github,
diff --git a/ci/README.md b/ci/README.md
index 797f231aea62..389ef59f57b9 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -10,6 +10,14 @@ In order to ensure that the needed packages are generally available without buil
 
 Run [`update-pinned.sh`](./update-pinned.sh) to update it.
 
+## GitHub specific code
+
+Some of the code is specific to GitHub.
+This code is currently spread out over multiple places and written in both Bash and JavaScript.
+The goal is to eventually have all GitHub specific code in `ci/github-script` and written in JavaScript via `actions/github-script`.
+A lot of code has already been migrated, but some Bash code still remains.
+New CI features need to be introduced in JavaScript, not Bash.
+
 ## `ci/nixpkgs-vet.sh BASE_BRANCH [REPOSITORY]`
 
 Runs the [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) on the HEAD commit, closely matching what CI does.
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index fef5ecb8d9b9..b3ebf6aee569 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -7,7 +7,13 @@
   removedattrs,
 }:
 let
-  pkgs = import ../../.. { system = "x86_64-linux"; };
+  pkgs = import ../../.. {
+    system = "x86_64-linux";
+    # We should never try to ping maintainers through package aliases, this can only lead to errors.
+    # One example case is, where an attribute is a throw alias, but then re-introduced in a PR.
+    # This would trigger the throw. By disabling aliases, we can fallback gracefully below.
+    config.allowAliases = false;
+  };
 
   changedpaths = lib.importJSON changedpathsjson;
 
diff --git a/doc/hooks/index.md b/doc/hooks/index.md
index cd04fd84495a..cd769cec0373 100644
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@@ -20,6 +20,7 @@ ghc.section.md
 gnome.section.md
 haredo.section.md
 installShellFiles.section.md
+julec.section.md
 just.section.md
 libiconv.section.md
 libxml2.section.md
diff --git a/doc/hooks/julec.section.md b/doc/hooks/julec.section.md
new file mode 100644
index 000000000000..f85619ac39e7
--- /dev/null
+++ b/doc/hooks/julec.section.md
@@ -0,0 +1,77 @@
+# julec.hook {#julec-hook}
+
+[Jule](https://jule.dev) is an effective programming language designed to build efficient, fast, reliable and safe software while maintaining simplicity.
+
+In Nixpkgs, `jule.hook` overrides the default build, check and install phases.
+
+## Example code snippet {#julec-hook-example-code-snippet}
+
+```nix
+{
+  julec,
+  clangStdenv,
+}:
+
+clangStdenv.mkDerivation (finalAttrs: {
+  # ...
+
+  nativeBuildInputs = [ julec.hook ];
+
+  # Customize filenames if needed
+  JULE_SRC_DIR = "./src";
+  JULE_OUT_DIR = "./bin";
+  JULE_OUT_NAME = "hello-jule";
+  JULE_TEST_DIR = "./tests";
+  JULE_TEST_OUT_DIR = "./test-bin";
+  JULE_TEST_OUT_NAME = "hello-jule-test";
+
+  # ...
+})
+```
+
+## Variables controlling julec.hook {#julec-hook-variables}
+
+### `JULE_SRC_DIR` {#julec-hook-variable-jule-src-dir}
+
+Specifies the source directory containing `main.jule`.
+Default is `./src`.
+
+### `JULE_OUT_DIR` {#julec-hook-variable-jule-out-dir}
+
+Specifies the output directory for the compiled binary.
+Default is `./bin`.
+
+### `JULE_OUT_NAME` {#julec-hook-variable-jule-out-name}
+
+Specifies the name of the compiled binary.
+Default is `output`.
+
+### `JULE_TEST_DIR` {#julec-hook-variable-jule-test-dir}
+
+Specifies the directory containing test files.
+Default is the value of [`JULE_SRC_DIR`](#julec-hook-variable-jule-src-dir).
+
+### `JULE_TEST_OUT_DIR` {#julec-hook-variable-jule-test-out-dir}
+
+Specifies the output directory for compiled test binaries.
+Default is the value of [`JULE_OUT_DIR`](#julec-hook-variable-jule-out-dir).
+
+### `JULE_TEST_OUT_NAME` {#julec-hook-variable-jule-test-out-name}
+
+Specifies the name of the compiled test binary.
+Default is the value of [`JULE_OUT_NAME`](#julec-hook-variable-jule-out-name) with `-test` suffix.
+
+### `dontUseJulecBuild` {#julec-hook-variable-dontusejulecbuild}
+
+When set to true, doesn't use the predefined `julecBuildHook`.
+Default is false.
+
+### `dontUseJulecCheck` {#julec-hook-variable-dontusejuleccheck}
+
+When set to true, doesn't use the predefined `julecCheckHook`.
+Default is false.
+
+### `dontUseJulecInstall` {#julec-hook-variable-dontusejulecinstall}
+
+When set to true, doesn't use the predefined `julecInstallHook`.
+Default is false.
diff --git a/doc/redirects.json b/doc/redirects.json
index eda7f3dd6c36..86054dbf920c 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -130,6 +130,42 @@
   "libcxxhardeningfast": [
     "index.html#libcxxhardeningfast"
   ],
+  "julec-hook": [
+    "index.html#julec-hook"
+  ],
+  "julec-hook-example-code-snippet": [
+    "index.html#julec-hook-example-code-snippet"
+  ],
+  "julec-hook-variable-dontusejulecbuild": [
+    "index.html#julec-hook-variable-dontusejulecbuild"
+  ],
+  "julec-hook-variable-dontusejuleccheck": [
+    "index.html#julec-hook-variable-dontusejuleccheck"
+  ],
+  "julec-hook-variable-dontusejulecinstall": [
+    "index.html#julec-hook-variable-dontusejulecinstall"
+  ],
+  "julec-hook-variable-jule-out-dir": [
+    "index.html#julec-hook-variable-jule-out-dir"
+  ],
+  "julec-hook-variable-jule-out-name": [
+    "index.html#julec-hook-variable-jule-out-name"
+  ],
+  "julec-hook-variable-jule-src-dir": [
+    "index.html#julec-hook-variable-jule-src-dir"
+  ],
+  "julec-hook-variable-jule-test-dir": [
+    "index.html#julec-hook-variable-jule-test-dir"
+  ],
+  "julec-hook-variable-jule-test-out-dir": [
+    "index.html#julec-hook-variable-jule-test-out-dir"
+  ],
+  "julec-hook-variable-jule-test-out-name": [
+    "index.html#julec-hook-variable-jule-test-out-name"
+  ],
+  "julec-hook-variables": [
+    "index.html#julec-hook-variables"
+  ],
   "major-ghc-deprecation": [
     "index.html#major-ghc-deprecation"
   ],
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index e85eb0d1bab9..2ac2776827ca 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -378,6 +378,8 @@
   - `number`
   - `numbers.*`
 
+- `lib.cli.toGNUCommandLine` and `lib.cli.toGNUCommandLineShell` have been deprecated in favor of `lib.cli.toCommandLine`, `lib.cli.toCommandLineShell`, `lib.cli.toCommandLineGNU` and `lib.cli.toCommandLineShellGNU`.
+
 ### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
 
 - `neovim`: Added support for the `vim.o.exrc` option, the `VIMINIT` environment variable, and sourcing of `sysinit.vim`.
@@ -385,3 +387,5 @@
   See the neovim help page [`:help startup`](https://neovim.io/doc/user/starting.html#startup) for more information, as well as [the nixpkgs neovim wrapper documentation](#neovim-custom-configuration).
 
 - `cloudflare-ddns`: Added package cloudflare-ddns.
+
+- `lib.cli.toCommandLine`, `lib.cli.toCommandLineShell`, `lib.cli.toCommandLineGNU` and `lib.cli.toCommandLineShellGNU` have been added to address multiple issues in `lib.cli.toGNUCommandLine` and `lib.cli.toGNUCommandLineShell`.
diff --git a/lib/cli.nix b/lib/cli.nix
index 590ba691d386..f0ebeb76c4c2 100644
--- a/lib/cli.nix
+++ b/lib/cli.nix
@@ -1,6 +1,6 @@
 { lib }:
 
-rec {
+{
   /**
     Automatically convert an attribute set to command-line options.
 
@@ -20,6 +20,7 @@ rec {
     : The attributes to transform into arguments.
 
     # Examples
+
     :::{.example}
     ## `lib.cli.toGNUCommandLineShell` usage example
 
@@ -38,7 +39,10 @@ rec {
 
     :::
   */
-  toGNUCommandLineShell = options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+  toGNUCommandLineShell =
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
+      "lib.cli.toGNUCommandLineShell is deprecated, please use lib.cli.toCommandLineShell or lib.cli.toCommandLineShellGNU instead."
+      (options: attrs: lib.escapeShellArgs (lib.cli.toGNUCommandLine options attrs));
 
   /**
     Automatically convert an attribute set to a list of command-line options.
@@ -55,7 +59,7 @@ rec {
 
     : The attributes to transform into arguments.
 
-    # Options
+    ## Options
 
     `mkOptionName`
 
@@ -85,6 +89,7 @@ rec {
     This is useful if the command requires equals, for example, `-c=5`.
 
     # Examples
+
     :::{.example}
     ## `lib.cli.toGNUCommandLine` usage example
 
@@ -111,38 +116,224 @@ rec {
     :::
   */
   toGNUCommandLine =
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
+      "lib.cli.toGNUCommandLine is deprecated, please use lib.cli.toCommandLine or lib.cli.toCommandLineShellGNU instead."
+      (
+        {
+          mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
+
+          mkBool ? k: v: lib.optional v (mkOptionName k),
+
+          mkList ? k: v: lib.concatMap (mkOption k) v,
+
+          mkOption ?
+            k: v:
+            if v == null then
+              [ ]
+            else if optionValueSeparator == null then
+              [
+                (mkOptionName k)
+                (lib.generators.mkValueStringDefault { } v)
+              ]
+            else
+              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault { } v}" ],
+
+          optionValueSeparator ? null,
+        }:
+        options:
+        let
+          render =
+            k: v:
+            if builtins.isBool v then
+              mkBool k v
+            else if builtins.isList v then
+              mkList k v
+            else
+              mkOption k v;
+
+        in
+        builtins.concatLists (lib.mapAttrsToList render options)
+      );
+
+  /**
+    Converts the given attributes into a single shell-escaped command-line string.
+    Similar to `toCommandLineGNU`, but returns a single escaped string instead of an array of arguments.
+    For further reference see: [`lib.cli.toCommandLineGNU`](#function-library-lib.cli.toCommandLineGNU)
+  */
+  toCommandLineShellGNU =
+    options: attrs: lib.escapeShellArgs (lib.cli.toCommandLineGNU options attrs);
+
+  /**
+    Converts an attribute set into a list of GNU-style command line options.
+
+    `toCommandLineGNU` returns a list of string arguments.
+
+    # Inputs
+
+    `options`
+
+    : Options, see below.
+
+    `attrs`
+
+    : The attributes to transform into arguments.
+
+    ## Options
+
+    `isLong`
+
+    : A function that determines whether an option is long or short.
+
+    `explicitBool`
+
+    : Whether or not boolean option arguments should be formatted explicitly.
+
+    `formatArg`
+
+    : A function that turns the option argument into a string.
+
+    # Examples
+
+    :::{.example}
+    ## `lib.cli.toCommandLineGNU` usage example
+
+    ```nix
+    lib.cli.toCommandLineGNU {} {
+      v = true;
+      verbose = [true true false null];
+      i = ".bak";
+      testsuite = ["unit" "integration"];
+      e = ["s/a/b/" "s/b/c/"];
+      n = false;
+      data = builtins.toJSON {id = 0;};
+    }
+    => [
+      "--data={\"id\":0}"
+      "-es/a/b/"
+      "-es/b/c/"
+      "-i.bak"
+      "--testsuite=unit"
+      "--testsuite=integration"
+      "-v"
+      "--verbose"
+      "--verbose"
+    ]
+    ```
+
+    :::
+  */
+  toCommandLineGNU =
     {
-      mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
-
-      mkBool ? k: v: lib.optional v (mkOptionName k),
-
-      mkList ? k: v: lib.concatMap (mkOption k) v,
-
-      mkOption ?
-        k: v:
-        if v == null then
-          [ ]
-        else if optionValueSeparator == null then
-          [
-            (mkOptionName k)
-            (lib.generators.mkValueStringDefault { } v)
-          ]
-        else
-          [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault { } v}" ],
-
-      optionValueSeparator ? null,
+      isLong ? optionName: builtins.stringLength optionName > 1,
+      explicitBool ? false,
+      formatArg ? lib.generators.mkValueStringDefault { },
     }:
-    options:
     let
-      render =
-        k: v:
-        if builtins.isBool v then
-          mkBool k v
-        else if builtins.isList v then
-          mkList k v
-        else
-          mkOption k v;
-
+      optionFormat = optionName: {
+        option = if isLong optionName then "--${optionName}" else "-${optionName}";
+        sep = if isLong optionName then "=" else "";
+        inherit explicitBool formatArg;
+      };
     in
-    builtins.concatLists (lib.mapAttrsToList render options);
+    lib.cli.toCommandLine optionFormat;
+
+  /**
+    Converts the given attributes into a single shell-escaped command-line string.
+    Similar to `toCommandLine`, but returns a single escaped string instead of an array of arguments.
+    For further reference see: [`lib.cli.toCommandLine`](#function-library-lib.cli.toCommandLine)
+  */
+  toCommandLineShell =
+    optionFormat: attrs: lib.escapeShellArgs (lib.cli.toCommandLine optionFormat attrs);
+
+  /**
+    Converts an attribute set into a list of command line options.
+
+    `toCommandLine` returns a list of string arguments.
+
+    # Inputs
+
+    `optionFormat`
+
+    : The option format that describes how options and their arguments should be formatted.
+
+    `attrs`
+
+    : The attributes to transform into arguments.
+
+    # Examples
+    :::{.example}
+    ## `lib.cli.toCommandLine` usage example
+
+    ```nix
+    let
+      optionFormat = optionName: {
+        option = "-${optionName}";
+        sep = "=";
+        explicitBool = true;
+      };
+    in lib.cli.toCommandLine optionFormat {
+      v = true;
+      verbose = [true true false null];
+      i = ".bak";
+      testsuite = ["unit" "integration"];
+      e = ["s/a/b/" "s/b/c/"];
+      n = false;
+      data = builtins.toJSON {id = 0;};
+    }
+    => [
+      "-data={\"id\":0}"
+      "-e=s/a/b/"
+      "-e=s/b/c/"
+      "-i=.bak"
+      "-n=false"
+      "-testsuite=unit"
+      "-testsuite=integration"
+      "-v=true"
+      "-verbose=true"
+      "-verbose=true"
+      "-verbose=false"
+    ]
+    ```
+
+    :::
+  */
+  toCommandLine =
+    optionFormat: attrs:
+    let
+      handlePair =
+        k: v:
+        if k == "" then
+          lib.throw "lib.cli.toCommandLine only accepts non-empty option names."
+        else if builtins.isList v then
+          builtins.concatMap (handleOption k) v
+        else
+          handleOption k v;
+
+      handleOption = k: renderOption (optionFormat k) k;
+
+      renderOption =
+        {
+          option,
+          sep,
+          explicitBool,
+          formatArg ? lib.generators.mkValueStringDefault { },
+        }:
+        k: v:
+        if v == null || (!explicitBool && v == false) then
+          [ ]
+        else if !explicitBool && v == true then
+          [ option ]
+        else
+          let
+            arg = formatArg v;
+          in
+          if sep != null then
+            [ "${option}${sep}${arg}" ]
+          else
+            [
+              option
+              arg
+            ];
+    in
+    builtins.concatLists (lib.mapAttrsToList handlePair attrs);
 }
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 59fbb1ccd63b..d12c27c34bbc 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -3106,6 +3106,86 @@ runTests {
     expected = "-X PUT --data '{\"id\":0}' --retry 3 --url https://example.com/foo --url https://example.com/bar --verbose";
   };
 
+  testToCommandLine = {
+    expr =
+      let
+        optionFormat = optionName: {
+          option = "-${optionName}";
+          sep = "=";
+          explicitBool = true;
+        };
+      in
+      cli.toCommandLine optionFormat {
+        v = true;
+        verbose = [
+          true
+          true
+          false
+          null
+        ];
+        i = ".bak";
+        testsuite = [
+          "unit"
+          "integration"
+        ];
+        e = [
+          "s/a/b/"
+          "s/b/c/"
+        ];
+        n = false;
+        data = builtins.toJSON { id = 0; };
+      };
+
+    expected = [
+      "-data={\"id\":0}"
+      "-e=s/a/b/"
+      "-e=s/b/c/"
+      "-i=.bak"
+      "-n=false"
+      "-testsuite=unit"
+      "-testsuite=integration"
+      "-v=true"
+      "-verbose=true"
+      "-verbose=true"
+      "-verbose=false"
+    ];
+  };
+
+  testToCommandLineGNU = {
+    expr = cli.toCommandLineGNU { } {
+      v = true;
+      verbose = [
+        true
+        true
+        false
+        null
+      ];
+      i = ".bak";
+      testsuite = [
+        "unit"
+        "integration"
+      ];
+      e = [
+        "s/a/b/"
+        "s/b/c/"
+      ];
+      n = false;
+      data = builtins.toJSON { id = 0; };
+    };
+
+    expected = [
+      "--data={\"id\":0}"
+      "-es/a/b/"
+      "-es/b/c/"
+      "-i.bak"
+      "--testsuite=unit"
+      "--testsuite=integration"
+      "-v"
+      "--verbose"
+      "--verbose"
+    ];
+  };
+
   testSanitizeDerivationNameLeadingDots = testSanitizeDerivationName {
     name = "..foo";
     expected = "foo";
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 52b6e7231b96..dd06cef1f75a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21236,6 +21236,12 @@
     githubId = 39039420;
     name = "Quinn Dougherty";
   };
+  quinneden = {
+    email = "quinn@qeden.dev";
+    github = "quinneden";
+    githubId = 125415641;
+    name = "Quinn Edenfield";
+  };
   QuiNzX = {
     name = "QuiNz-";
     github = "QuiNzX";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index ea2ed1e64ea9..f23ccf22f840 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -37,7 +37,6 @@ with lib.maintainers;
       aanderse
       arianvp
       emily
-      flokli
       m1cr0man
     ];
     scope = "Maintain ACME-related packages and modules.";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index d1285109a0ce..8b3a14483687 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -256,6 +256,10 @@
 
 - `services.gateone` has been removed as the package was removed such that it does not work.
 
+- `teleport` has been upgraded from major version 17 to major version 18.
+Refer to [upstream upgrade instructions](https://goteleport.com/docs/upgrading/overview/)
+and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
+
 - `services.dwm-status.extraConfig` was replaced by [RFC0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant [](#opt-services.dwm-status.settings), which is used to generate the config file. `services.dwm-status.order` is now moved to [](#opt-services.dwm-status.settings.order), as it's a part of the config file.
 
 - `gitversion` was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run.
diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
index 8dbfea78a516..23f656579fe6 100644
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -10,7 +10,7 @@ let
   ensurePrinter =
     p:
     let
-      args = lib.cli.toGNUCommandLineShell { } (
+      args = lib.cli.toCommandLineShellGNU { } (
         {
           p = p.name;
           v = p.deviceUri;
diff --git a/nixos/modules/services/finance/libeufin/common.nix b/nixos/modules/services/finance/libeufin/common.nix
index 71133248d607..461a96940123 100644
--- a/nixos/modules/services/finance/libeufin/common.nix
+++ b/nixos/modules/services/finance/libeufin/common.nix
@@ -48,7 +48,7 @@ libeufinComponent:
             DynamicUser = true;
             ExecStart =
               let
-                args = lib.cli.toGNUCommandLineShell { } {
+                args = lib.cli.toCommandLineShellGNU { } {
                   c = configFile;
                   L = if cfg.debug then "debug" else null;
                 };
@@ -80,7 +80,7 @@ libeufinComponent:
             initialAccountRegistration = lib.concatMapStringsSep "\n" (
               account:
               let
-                args = lib.cli.toGNUCommandLineShell { } {
+                args = lib.cli.toCommandLineShellGNU { } {
                   c = configFile;
                   inherit (account) username password name;
                   payto_uri = "payto://x-taler-bank/${bankHost}/${account.username}?receiver-name=${account.name}";
@@ -90,7 +90,7 @@ libeufinComponent:
               "${lib.getExe' cfg.package "libeufin-bank"} create-account ${args}"
             ) cfg.initialAccounts;
 
-            args = lib.cli.toGNUCommandLineShell { } {
+            args = lib.cli.toCommandLineShellGNU { } {
               c = configFile;
               L = if cfg.debug then "debug" else null;
             };
diff --git a/nixos/modules/services/hardware/undervolt.nix b/nixos/modules/services/hardware/undervolt.nix
index 5a8ad9806ef1..dd020181a6fe 100644
--- a/nixos/modules/services/hardware/undervolt.nix
+++ b/nixos/modules/services/hardware/undervolt.nix
@@ -16,7 +16,7 @@ let
         limit != null && window != null
       ) "Both power limit and window must be set";
       "${toString limit} ${toString window}";
-  cliArgs = lib.cli.toGNUCommandLine { } {
+  cliArgs = lib.cli.toCommandLineGNU { } {
     inherit (cfg)
       verbose
       temp
diff --git a/nixos/modules/services/home-automation/ebusd.nix b/nixos/modules/services/home-automation/ebusd.nix
index 3b98408ec9cc..7ee7d0751303 100644
--- a/nixos/modules/services/home-automation/ebusd.nix
+++ b/nixos/modules/services/home-automation/ebusd.nix
@@ -170,7 +170,7 @@ in
         serviceConfig = {
           ExecStart =
             let
-              args = lib.cli.toGNUCommandLineShell { optionValueSeparator = "="; } (
+              args = lib.cli.toCommandLineShellGNU { } (
                 lib.foldr (a: b: a // b) { } [
                   {
                     inherit (cfg)
diff --git a/nixos/modules/services/mail/mailpit.nix b/nixos/modules/services/mail/mailpit.nix
index 6bc368e91f5f..c3b888f15c9b 100644
--- a/nixos/modules/services/mail/mailpit.nix
+++ b/nixos/modules/services/mail/mailpit.nix
@@ -22,7 +22,7 @@ let
 
   isNonNull = v: v != null;
   genCliFlags =
-    settings: concatStringsSep " " (cli.toGNUCommandLine { } (filterAttrs (const isNonNull) settings));
+    settings: concatStringsSep " " (cli.toCommandLineGNU { } (filterAttrs (const isNonNull) settings));
 in
 {
   options.services.mailpit.instances = mkOption {
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 8ab3372c75d7..14bb792790a7 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -686,7 +686,7 @@ in
           path = [ manage ];
           script = ''
             paperless-manage document_exporter ${cfg.exporter.directory} ${
-              lib.cli.toGNUCommandLineShell { } cfg.exporter.settings
+              lib.cli.toCommandLineShellGNU { } cfg.exporter.settings
             }
           '';
         };
diff --git a/nixos/modules/services/networking/gns3-server.nix b/nixos/modules/services/networking/gns3-server.nix
index 21679a3d8364..6d69090744be 100644
--- a/nixos/modules/services/networking/gns3-server.nix
+++ b/nixos/modules/services/networking/gns3-server.nix
@@ -187,7 +187,7 @@ in
 
       systemd.services.gns3-server =
         let
-          commandArgs = lib.cli.toGNUCommandLineShell { } {
+          commandArgs = lib.cli.toCommandLineShellGNU { } {
             config = "/etc/gns3/gns3_server.conf";
             pid = "/run/gns3/server.pid";
             log = cfg.log.file;
diff --git a/nixos/modules/services/networking/hylafax/systemd.nix b/nixos/modules/services/networking/hylafax/systemd.nix
index d0cc0f230278..d08c08e6ec42 100644
--- a/nixos/modules/services/networking/hylafax/systemd.nix
+++ b/nixos/modules/services/networking/hylafax/systemd.nix
@@ -14,7 +14,13 @@ let
     mkMerge
     optional
     ;
-  inherit (lib.cli) toGNUCommandLine;
+  inherit (lib.cli) toCommandLine;
+
+  optionFormat = optionName: {
+    option = "-${optionName}";
+    sep = null;
+    explicitBool = false;
+  };
 
   cfg = config.services.hylafax;
   mapModems = lib.forEach (lib.attrValues cfg.modems);
@@ -23,9 +29,7 @@ let
     prefix: program: posArg: options:
     let
       start = "${prefix}${cfg.package}/spool/bin/${program}";
-      optionsList = toGNUCommandLine { mkOptionName = k: "-${k}"; } (
-        { q = cfg.spoolAreaPath; } // options
-      );
+      optionsList = toCommandLine optionFormat ({ q = cfg.spoolAreaPath; } // options);
       posArgList = optional (posArg != null) posArg;
     in
     "${start} ${escapeShellArgs (optionsList ++ posArgList)}";
diff --git a/nixos/modules/services/networking/newt.nix b/nixos/modules/services/networking/newt.nix
index bc2d1cc001a9..9caa45351958 100644
--- a/nixos/modules/services/networking/newt.nix
+++ b/nixos/modules/services/networking/newt.nix
@@ -83,7 +83,7 @@ in
       };
       # the flag values will all be overwritten if also defined in the env file
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
+        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toCommandLineShellGNU { } cfg.settings}";
         DynamicUser = true;
         StateDirectory = "newt";
         StateDirectoryMode = "0700";
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 645852b646d3..f1fcaf855e96 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -947,7 +947,7 @@ in
           ExecStart =
             let
               args = lib.escapeShellArgs (
-                (lib.cli.toGNUCommandLine { } {
+                (lib.cli.toCommandLineGNU { } {
                   "no-browser" = true;
                   "gui-address" = (if isUnixGui then "unix://" else "") + cfg.guiAddress;
                   "config" = cfg.configDir;
diff --git a/nixos/modules/services/networking/wstunnel.nix b/nixos/modules/services/networking/wstunnel.nix
index ce6195ec1011..8d20b37eeea8 100644
--- a/nixos/modules/services/networking/wstunnel.nix
+++ b/nixos/modules/services/networking/wstunnel.nix
@@ -26,7 +26,7 @@ let
         str
         (listOf str)
       ]);
-    generate = lib.cli.toGNUCommandLineShell { };
+    generate = lib.cli.toCommandLineShellGNU { };
   };
 
   hostPortToString = { host, port, ... }: "${host}:${toString port}";
diff --git a/nixos/modules/services/security/tsidp.nix b/nixos/modules/services/security/tsidp.nix
index 4b854cf183ca..5d1a32522875 100644
--- a/nixos/modules/services/security/tsidp.nix
+++ b/nixos/modules/services/security/tsidp.nix
@@ -164,7 +164,7 @@ in
           Type = "simple";
           ExecStart =
             let
-              args = lib.cli.toGNUCommandLineShell { mkOptionName = k: "-${k}"; } {
+              args = lib.cli.toCommandLineShellGNU { } {
                 dir = stateDir;
                 hostname = cfg.settings.hostName;
                 port = cfg.settings.port;
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index 674e075b9ad4..f52c4b4fb4e2 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -179,7 +179,7 @@ in
       serviceConfig.EnvironmentFile = "";
 
       environment.EARLYOOM_ARGS =
-        lib.cli.toGNUCommandLineShell { } {
+        lib.cli.toCommandLineShellGNU { } {
           m =
             "${toString cfg.freeMemThreshold}"
             + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}";
diff --git a/nixos/modules/services/system/self-deploy.nix b/nixos/modules/services/system/self-deploy.nix
index 4f11e8df18ad..bde3ac811569 100644
--- a/nixos/modules/services/system/self-deploy.nix
+++ b/nixos/modules/services/system/self-deploy.nix
@@ -179,7 +179,7 @@ in
         ${gitWithRepo} checkout FETCH_HEAD
 
         nix-build${renderNixArgs cfg.nixArgs} ${
-          lib.cli.toGNUCommandLineShell { } {
+          lib.cli.toCommandLineShellGNU { } {
             attr = cfg.nixAttribute;
             out-link = outPath;
           }
diff --git a/nixos/modules/services/web-apps/c2fmzq-server.nix b/nixos/modules/services/web-apps/c2fmzq-server.nix
index f1935e05407f..a7622d384cf3 100644
--- a/nixos/modules/services/web-apps/c2fmzq-server.nix
+++ b/nixos/modules/services/web-apps/c2fmzq-server.nix
@@ -25,10 +25,8 @@ let
           str
         ])
       );
-    generate = lib.cli.toGNUCommandLineShell {
-      mkBool = k: v: [
-        "--${k}=${if v then "true" else "false"}"
-      ];
+    generate = lib.cli.toCommandLineShellGNU {
+      explicitBool = true;
     };
   };
 in
diff --git a/nixos/modules/services/web-apps/libretranslate.nix b/nixos/modules/services/web-apps/libretranslate.nix
index 1664b9ef4581..5ac68ad3c919 100644
--- a/nixos/modules/services/web-apps/libretranslate.nix
+++ b/nixos/modules/services/web-apps/libretranslate.nix
@@ -146,7 +146,7 @@ in
           Type = "simple";
           ExecStart = ''
             ${cfg.package}/bin/libretranslate ${
-              lib.cli.toGNUCommandLineShell { } (
+              lib.cli.toCommandLineShellGNU { } (
                 cfg.extraArgs
                 // {
                   inherit (cfg) host port threads;
diff --git a/nixos/modules/services/web-apps/zitadel.nix b/nixos/modules/services/web-apps/zitadel.nix
index c097d36d9039..6cfd1bbd4680 100644
--- a/nixos/modules/services/web-apps/zitadel.nix
+++ b/nixos/modules/services/web-apps/zitadel.nix
@@ -207,7 +207,7 @@ in
         configFile = settingsFormat.generate "config.yaml" cfg.settings;
         stepsFile = settingsFormat.generate "steps.yaml" cfg.steps;
 
-        args = lib.cli.toGNUCommandLineShell { } {
+        args = lib.cli.toCommandLineShellGNU { } {
           config = cfg.extraSettingsPaths ++ [ configFile ];
           steps = cfg.extraStepsPaths ++ [ stepsFile ];
           masterkeyFile = cfg.masterKeyFile;
diff --git a/nixos/modules/services/web-servers/fcgiwrap.nix b/nixos/modules/services/web-servers/fcgiwrap.nix
index 992f4a46ff4b..493cd710c1bb 100644
--- a/nixos/modules/services/web-servers/fcgiwrap.nix
+++ b/nixos/modules/services/web-servers/fcgiwrap.nix
@@ -151,7 +151,7 @@ in
       serviceConfig = {
         ExecStart = ''
           ${pkgs.fcgiwrap}/sbin/fcgiwrap ${
-            cli.toGNUCommandLineShell { } (
+            cli.toCommandLineShellGNU { } (
               {
                 c = cfg.process.prefork;
               }
diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index f4a4245f141c..a64f34eaefc3 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -51,6 +51,11 @@ def config(*path: str) -> Optional[Any]:
         result = result[component]
     return result
 
+
+def bool_to_yes_no(value: bool) -> str:
+    return 'yes' if value else 'no'
+
+
 def get_system_path(profile: str = 'system', gen: Optional[str] = None, spec: Optional[str] = None) -> str:
     basename = f'{profile}-{gen}-link' if gen is not None else profile
     profiles_dir = '/nix/var/nix/profiles'
@@ -377,10 +382,14 @@ def copy_file(from_path: str, to_path: str):
 
     paths[to_path] = True
 
-def option_from_config(name: str, config_path: List[str], conversion: Callable[[str], str] | None = None) -> str:
-    if config(*config_path):
-        return f'{name}: {conversion(config(*config_path)) if conversion else config(*config_path)}\n'
-    return ''
+
+def option_from_config(name: str, config_path: List[str]) -> str:
+    value = config(*config_path)
+    if value is None:
+        return ""
+    if isinstance(value, bool):
+        value = bool_to_yes_no(value)
+    return f"{name}: {config(*config_path)}\n"
 
 
 def install_bootloader() -> None:
@@ -439,8 +448,8 @@ def install_bootloader() -> None:
         profiles += [(profile, get_gens(profile))]
 
     timeout = config('timeout')
-    editor_enabled = 'yes' if config('enableEditor') else 'no'
-    hash_mismatch_panic = 'yes' if config('panicOnChecksumMismatch') else 'no'
+    editor_enabled = bool_to_yes_no(config('enableEditor'))
+    hash_mismatch_panic = bool_to_yes_no(config('panicOnChecksumMismatch'))
 
     last_gen = get_gens()[-1]
     last_gen_json = json.load(open(os.path.join(get_system_path('system', last_gen), 'boot.json'), 'r'))
diff --git a/nixos/modules/system/boot/systemd/journald-gateway.nix b/nixos/modules/system/boot/systemd/journald-gateway.nix
index b6cf300d3bfb..f0d80077e6d6 100644
--- a/nixos/modules/system/boot/systemd/journald-gateway.nix
+++ b/nixos/modules/system/boot/systemd/journald-gateway.nix
@@ -8,7 +8,7 @@
 let
   cfg = config.services.journald.gateway;
 
-  cliArgs = lib.cli.toGNUCommandLineShell { } {
+  cliArgs = lib.cli.toCommandLineShellGNU { } {
     # If either of these are null / false, they are not passed in the command-line
     inherit (cfg)
       cert
diff --git a/nixos/modules/system/boot/systemd/journald-remote.nix b/nixos/modules/system/boot/systemd/journald-remote.nix
index 89baf421f591..7216c179b3a0 100644
--- a/nixos/modules/system/boot/systemd/journald-remote.nix
+++ b/nixos/modules/system/boot/systemd/journald-remote.nix
@@ -9,7 +9,7 @@ let
   cfg = config.services.journald.remote;
   format = pkgs.formats.systemd { };
 
-  cliArgs = lib.cli.toGNUCommandLineShell { } {
+  cliArgs = lib.cli.toCommandLineShellGNU { } {
     inherit (cfg) output;
     # "-3" specifies the file descriptor from the .socket unit.
     "listen-${cfg.listen}" = "-3";
diff --git a/nixos/modules/virtualisation/containerd.nix b/nixos/modules/virtualisation/containerd.nix
index 9e061f851126..c43db34dbf99 100644
--- a/nixos/modules/virtualisation/containerd.nix
+++ b/nixos/modules/virtualisation/containerd.nix
@@ -90,7 +90,7 @@ in
         ++ lib.optional config.boot.zfs.enabled config.boot.zfs.package;
       serviceConfig = {
         ExecStart = ''${pkgs.containerd}/bin/containerd ${
-          lib.concatStringsSep " " (lib.cli.toGNUCommandLine { } cfg.args)
+          lib.concatStringsSep " " (lib.cli.toCommandLineGNU { } cfg.args)
         }'';
         Delegate = "yes";
         KillMode = "process";
diff --git a/nixos/modules/virtualisation/virtualbox-image.nix b/nixos/modules/virtualisation/virtualbox-image.nix
index 04d36c9ce82f..25de9ac0ce86 100644
--- a/nixos/modules/virtualisation/virtualbox-image.nix
+++ b/nixos/modules/virtualisation/virtualbox-image.nix
@@ -252,8 +252,8 @@ in
           --ostype ${if pkgs.stdenv.hostPlatform.system == "x86_64-linux" then "Linux26_64" else "Linux26"}
         VBoxManage modifyvm "$vmName" \
           --memory ${toString cfg.memorySize} \
-          ${lib.cli.toGNUCommandLineShell { } cfg.params}
-        VBoxManage storagectl "$vmName" ${lib.cli.toGNUCommandLineShell { } cfg.storageController}
+          ${lib.cli.toCommandLineShellGNU { } cfg.params}
+        VBoxManage storagectl "$vmName" ${lib.cli.toCommandLineShellGNU { } cfg.storageController}
         VBoxManage storageattach "$vmName" --storagectl ${cfg.storageController.name} --port 0 --device 0 --type hdd \
           --medium disk.vdi
         ${lib.optionalString (cfg.extraDisk != null) ''
diff --git a/nixos/tests/limine/secure-boot.nix b/nixos/tests/limine/secure-boot.nix
index 52508f7eb385..9811734db5cb 100644
--- a/nixos/tests/limine/secure-boot.nix
+++ b/nixos/tests/limine/secure-boot.nix
@@ -26,10 +26,12 @@
       boot.loader.limine.secureBoot.enable = true;
       boot.loader.limine.secureBoot.createAndEnrollKeys = true;
       boot.loader.timeout = 0;
+
+      environment.systemPackages = [ pkgs.mokutil ];
     };
 
   testScript = ''
     machine.start()
-    assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status")
+    assert "SecureBoot enabled" in machine.succeed("mokutil --sb-state")
   '';
 }
diff --git a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
index 93e87a47131c..b080f2fa1ad2 100644
--- a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
@@ -13,7 +13,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "harper";
     publisher = "elijah-potter";
     version = harper.version;
-    hash = "sha256-m9PN1BZf6rLrNnX8meX2TjGx8zGLl0GgnHEgQirh9Oc=";
+    hash = "sha256-kWO3Gd2g5IsMCg+rvlQ3LpU/g5hUrpCsg3+vmOO0mnA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 60470a5e6638..3ce8d2d65f6e 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -808,7 +808,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "141.0.7390.107",
+    "version": "141.0.7390.122",
     "deps": {
       "depot_tools": {
         "rev": "3f41e54ae17d53d4a39feecad64c3d3e6871b219",
@@ -820,16 +820,16 @@
         "hash": "sha256-WERLGrReUATmn3RhxtmyZcJBxdIY/WZqBDranCLDYEg="
       },
       "ungoogled-patches": {
-        "rev": "141.0.7390.107-1",
-        "hash": "sha256-IQoIcOlFhbSBpmZ6bpoX43XMPrKWRVExETjBBT4TCs0="
+        "rev": "141.0.7390.122-1",
+        "hash": "sha256-xFJdvGHLMXNcotHTamh9Q4M2/ctoJ3b5ORHBWtZOY90="
       },
       "npmHash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "1c008349f76ff3a317bf28316fc5008c0120deb4",
-        "hash": "sha256-NRqWOkGrg/Y4wZi4WQDJ6CvsDpeseVgTc/iAnuPRy/U=",
+        "rev": "b477534e7e10d193e916cd4e2967c589383625b2",
+        "hash": "sha256-3sVHRzERwlLzXl2qSn2Lil4U4d6N63MUOomSUrjy2YY=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index bd4e9209ce67..8f2110bdfa58 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -812,7 +812,13 @@ rec {
       strip ? true,
     }:
     let
-      nimCompileCmdArgs = lib.cli.toGNUCommandLineShell { optionValueSeparator = ":"; } (
+      optionFormat = optionName: {
+        option = "--${optionName}";
+        sep = ":";
+        explicitBool = false;
+      };
+
+      nimCompileCmdArgs = lib.cli.toCommandLineShell optionFormat (
         {
           d = "release";
           nimcache = ".";
diff --git a/pkgs/games/anki/bin.nix b/pkgs/by-name/an/anki-bin/package.nix
similarity index 100%
rename from pkgs/games/anki/bin.nix
rename to pkgs/by-name/an/anki-bin/package.nix
diff --git a/pkgs/games/anki/sync-server.nix b/pkgs/by-name/an/anki-sync-server/package.nix
similarity index 100%
rename from pkgs/games/anki/sync-server.nix
rename to pkgs/by-name/an/anki-sync-server/package.nix
diff --git a/pkgs/games/anki/addons/adjust-sound-volume/default.nix b/pkgs/by-name/an/anki/addons/adjust-sound-volume/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/adjust-sound-volume/default.nix
rename to pkgs/by-name/an/anki/addons/adjust-sound-volume/default.nix
diff --git a/pkgs/games/anki/addons/anki-connect/default.nix b/pkgs/by-name/an/anki/addons/anki-connect/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/anki-connect/default.nix
rename to pkgs/by-name/an/anki/addons/anki-connect/default.nix
diff --git a/pkgs/games/anki/addons/anki-quizlet-importer-extended/default.nix b/pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/anki-quizlet-importer-extended/default.nix
rename to pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
diff --git a/pkgs/games/anki/addons/anki-utils.nix b/pkgs/by-name/an/anki/addons/anki-utils.nix
similarity index 100%
rename from pkgs/games/anki/addons/anki-utils.nix
rename to pkgs/by-name/an/anki/addons/anki-utils.nix
diff --git a/pkgs/games/anki/addons/default.nix b/pkgs/by-name/an/anki/addons/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/default.nix
rename to pkgs/by-name/an/anki/addons/default.nix
diff --git a/pkgs/games/anki/addons/local-audio-yomichan/default.nix b/pkgs/by-name/an/anki/addons/local-audio-yomichan/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/local-audio-yomichan/default.nix
rename to pkgs/by-name/an/anki/addons/local-audio-yomichan/default.nix
diff --git a/pkgs/games/anki/addons/passfail2/default.nix b/pkgs/by-name/an/anki/addons/passfail2/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/passfail2/default.nix
rename to pkgs/by-name/an/anki/addons/passfail2/default.nix
diff --git a/pkgs/games/anki/addons/puppy-reinforcement/default.nix b/pkgs/by-name/an/anki/addons/puppy-reinforcement/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/puppy-reinforcement/default.nix
rename to pkgs/by-name/an/anki/addons/puppy-reinforcement/default.nix
diff --git a/pkgs/games/anki/addons/recolor/default.nix b/pkgs/by-name/an/anki/addons/recolor/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/recolor/default.nix
rename to pkgs/by-name/an/anki/addons/recolor/default.nix
diff --git a/pkgs/games/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch b/pkgs/by-name/an/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch
similarity index 100%
rename from pkgs/games/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch
rename to pkgs/by-name/an/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch
diff --git a/pkgs/games/anki/addons/review-heatmap/default.nix b/pkgs/by-name/an/anki/addons/review-heatmap/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/review-heatmap/default.nix
rename to pkgs/by-name/an/anki/addons/review-heatmap/default.nix
diff --git a/pkgs/games/anki/addons/reviewer-refocus-card/default.nix b/pkgs/by-name/an/anki/addons/reviewer-refocus-card/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/reviewer-refocus-card/default.nix
rename to pkgs/by-name/an/anki/addons/reviewer-refocus-card/default.nix
diff --git a/pkgs/games/anki/addons/yomichan-forvo-server/default.nix b/pkgs/by-name/an/anki/addons/yomichan-forvo-server/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/yomichan-forvo-server/default.nix
rename to pkgs/by-name/an/anki/addons/yomichan-forvo-server/default.nix
diff --git a/pkgs/games/anki/missing-hashes.json b/pkgs/by-name/an/anki/missing-hashes.json
similarity index 100%
rename from pkgs/games/anki/missing-hashes.json
rename to pkgs/by-name/an/anki/missing-hashes.json
diff --git a/pkgs/games/anki/default.nix b/pkgs/by-name/an/anki/package.nix
similarity index 99%
rename from pkgs/games/anki/default.nix
rename to pkgs/by-name/an/anki/package.nix
index 57d68b125fbc..ec4f2405a974 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/by-name/an/anki/package.nix
@@ -14,7 +14,7 @@
   nixosTests,
   nodejs,
   jq,
-  protobuf,
+  protobuf_31,
   python3,
   python3Packages,
   qt6,
@@ -176,7 +176,7 @@ python3Packages.buildPythonApplication rec {
     # https://github.com/ankitects/anki/blob/24.11/docs/linux.md#packaging-considerations
     OFFLINE_BUILD = "1";
     NODE_BINARY = lib.getExe nodejs;
-    PROTOC_BINARY = lib.getExe protobuf;
+    PROTOC_BINARY = lib.getExe protobuf_31;
     PYTHON_BINARY = lib.getExe python3;
     UV_BINARY = lib.getExe uv;
     UV_NO_MANAGED_PYTHON = "1";
diff --git a/pkgs/games/anki/patches/allow-setting-addons-folder.patch b/pkgs/by-name/an/anki/patches/allow-setting-addons-folder.patch
similarity index 100%
rename from pkgs/games/anki/patches/allow-setting-addons-folder.patch
rename to pkgs/by-name/an/anki/patches/allow-setting-addons-folder.patch
diff --git a/pkgs/games/anki/patches/disable-auto-update.patch b/pkgs/by-name/an/anki/patches/disable-auto-update.patch
similarity index 100%
rename from pkgs/games/anki/patches/disable-auto-update.patch
rename to pkgs/by-name/an/anki/patches/disable-auto-update.patch
diff --git a/pkgs/games/anki/patches/remove-the-gl-library-workaround.patch b/pkgs/by-name/an/anki/patches/remove-the-gl-library-workaround.patch
similarity index 100%
rename from pkgs/games/anki/patches/remove-the-gl-library-workaround.patch
rename to pkgs/by-name/an/anki/patches/remove-the-gl-library-workaround.patch
diff --git a/pkgs/games/anki/patches/skip-formatting-python-code.patch b/pkgs/by-name/an/anki/patches/skip-formatting-python-code.patch
similarity index 100%
rename from pkgs/games/anki/patches/skip-formatting-python-code.patch
rename to pkgs/by-name/an/anki/patches/skip-formatting-python-code.patch
diff --git a/pkgs/games/anki/update.sh b/pkgs/by-name/an/anki/update.sh
similarity index 100%
rename from pkgs/games/anki/update.sh
rename to pkgs/by-name/an/anki/update.sh
diff --git a/pkgs/games/anki/uv-deps.json b/pkgs/by-name/an/anki/uv-deps.json
similarity index 100%
rename from pkgs/games/anki/uv-deps.json
rename to pkgs/by-name/an/anki/uv-deps.json
diff --git a/pkgs/games/anki/with-addons.nix b/pkgs/by-name/an/anki/with-addons.nix
similarity index 100%
rename from pkgs/games/anki/with-addons.nix
rename to pkgs/by-name/an/anki/with-addons.nix
diff --git a/pkgs/by-name/an/antora/test/default.nix b/pkgs/by-name/an/antora/test/default.nix
index ce5e0d5f50bb..b473a87b1434 100644
--- a/pkgs/by-name/an/antora/test/default.nix
+++ b/pkgs/by-name/an/antora/test/default.nix
@@ -43,7 +43,7 @@ stdenvNoCC.mkDerivation {
       # The --to-dir and --ui-bundle-url options are not included in the
       # playbook due to Antora and Nix limitations.
       antora ${
-        lib.cli.toGNUCommandLineShell { } {
+        lib.cli.toCommandLineShellGNU { } {
           cache-dir = "$(mktemp --directory)";
           extension = if antora-lunr-extension-test then antora-lunr-extension else false;
           to-dir = placeholder "out";
diff --git a/pkgs/by-name/co/containerlab/package.nix b/pkgs/by-name/co/containerlab/package.nix
index f0f2b220ecab..29a2eadcdbc0 100644
--- a/pkgs/by-name/co/containerlab/package.nix
+++ b/pkgs/by-name/co/containerlab/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "containerlab";
-  version = "0.70.2";
+  version = "0.71.0";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QBv0SZ7XxVc0yWbOxPKdfzk9AKYlMJyeZwpAx1jbamk=";
+    hash = "sha256-wfkkRQ0F8G57pEuyLP1qjoZGkDNW/Ix4Nh3ZKoWK+w8=";
   };
 
-  vendorHash = "sha256-XttJ/GXhNKVHLR33A/o3N3OYHsyKWHBhD5QOz0AlfFk=";
+  vendorHash = "sha256-s5WBCYOdNooygEL0AbhIqZLeWd4gnpAvWjJu38QTKYU=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -37,9 +37,10 @@ buildGoModule (finalAttrs: {
     export USER="runner"
   '';
 
-  # TestVerifyLinks wants to use docker.sock which is not available in the Nix build env
-  # KernelModulesLoaded wants to use /proc/modules which is not available in Nix build env
   checkFlags = [
+    # Not available in sandbox:
+    # - docker.sock needed for TestVerifyLinks
+    # - /proc/modules needed for KernelModulesLoaded
     "-skip=^TestVerifyLinks$|^TestIsKernelModuleLoaded$"
   ];
 
@@ -60,7 +61,7 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/srl-labs/containerlab/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ _0x4A6F ];
     mainProgram = "containerlab";
   };
 })
diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix
index 9e4f43601691..e2fe18a1e96f 100644
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@@ -12,20 +12,20 @@
 }:
 let
   pname = "dependabot-cli";
-  version = "1.76.0";
+  version = "1.76.1";
 
   # `tag` is what `dependabot` uses to find the relevant docker images.
   tag = "nixpkgs-dependabot-cli-${version}";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag}
-  updateJobProxy.imageDigest = "sha256:42b2a171891f4667d9a443cbfdc5f10a58e5b5d7f1b9eae6c12ec9815bec72fd";
-  updateJobProxy.hash = "sha256-+GcGyip8cgVBZeji6Zn3oN8Mc3xZvASohbPVNUbHOgA=";
+  updateJobProxy.imageDigest = "sha256:d40c689e947e78ecdaccb3da1d070a458b7f1d1cfb3052cf5751e43583d89560";
+  updateJobProxy.hash = "sha256-6VhY+7pg6+LXQ1F58ghKdabqpgPcbxWI91KNz6FntJA=";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag}
-  updaterGitHubActions.imageDigest = "sha256:d26d4ce071684b63d935c550552ae0d129f845254cb1e2f8635f15c62f43319e";
-  updaterGitHubActions.hash = "sha256-21E8q1+cwYlD8FL5njGhpsGRd/YkGQNS/y0howQFp6g=";
+  updaterGitHubActions.imageDigest = "sha256:e2cfbdde4014cd17cd85b9b411cb87a41d985bc27569e5fe1457ec68d16400b1";
+  updaterGitHubActions.hash = "sha256-VC+F0139+7n6rBLAw6MCgMf6yHCci7blaeLkHJ22fVc=";
 in
 buildGoModule {
   inherit pname version;
@@ -34,10 +34,10 @@ buildGoModule {
     owner = "dependabot";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-fSb2zzddwGJ1r9NhPEhE1WCndyoBK4VLOP3CmQUcjy0=";
+    hash = "sha256-i/Kr+69ws3HDWS+cQSn3cZzvW6GzKT+Avd3fZfvSA/c=";
   };
 
-  vendorHash = "sha256-xdouoPEPPhHcXNWxMdcdxVQsgRlFXBXjyZQ7CcROA4U=";
+  vendorHash = "sha256-dD48OKpuGAJAro7qV4tqpf/uENV2X1VQ2kUvAuJLXc0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ff/fflogs/package.nix b/pkgs/by-name/ff/fflogs/package.nix
index 85e0168b4713..0bd801ac94b0 100644
--- a/pkgs/by-name/ff/fflogs/package.nix
+++ b/pkgs/by-name/ff/fflogs/package.nix
@@ -6,10 +6,10 @@
 
 let
   pname = "fflogs";
-  version = "8.17.71";
+  version = "8.17.83";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-ey2hfndsLxViy7dYtIwfUgsk9kQycgBpsHGoBwO9LUs=";
+    hash = "sha256-orVUCf7+OzJQ561maIYEBKgSgLuKfuSXFGMLZV/HMjM=";
   };
   extracted = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/fl/flare-signal/package.nix b/pkgs/by-name/fl/flare-signal/package.nix
index a36029891702..92932650eb27 100644
--- a/pkgs/by-name/fl/flare-signal/package.nix
+++ b/pkgs/by-name/fl/flare-signal/package.nix
@@ -28,29 +28,29 @@ let
     owner = "whisperfish";
     repo = "presage";
     # match with commit from Cargo.toml
-    rev = "31a418d0a35ad746590165520b652d6adb7a0384";
-    hash = "sha256-Mf8RvwfrVpbsUj+mA9L7IjnbMKoZDjZKYor2iqFWSx4=";
+    rev = "ed011688fc8d9c0ee07c3d44743c138c1fa4dfda";
+    hash = "sha256-NTSxSOAmA9HOH52GPwl6pL0MQly+NTfJDk7k7TUP9II=";
   };
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flare";
   # NOTE: also update presage commit
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "schmiddi-on-mobile";
     repo = "flare";
     tag = finalAttrs.version;
-    hash = "sha256-3SYsVF3aUJYSr3pM/BGXYExQwbwckExYwEcF3cZ/94g=";
+    hash = "sha256-Nezg+fNC29blGhyetJqs9l6/IL08b7tHn+D3pzKj26I=";
   };
 
   cargoDeps =
     let
       cargoDeps = rustPlatform.fetchCargoVendor {
         inherit (finalAttrs) pname version src;
-        hash = "sha256-cxhnfdYcsyXxvTpGGXm2rK3cKVsNk66FYif7/c16NhU=";
+        hash = "sha256-Y6jY588axEcqv0WN6Fcm8Kd5yd2JXvKwMd8h1L6J9TE=";
       };
     in
     # Replace with simpler solution:
diff --git a/pkgs/by-name/fr/fritz-exporter/package.nix b/pkgs/by-name/fr/fritz-exporter/package.nix
index 7c18ee1f1932..f45cf5b6e39a 100644
--- a/pkgs/by-name/fr/fritz-exporter/package.nix
+++ b/pkgs/by-name/fr/fritz-exporter/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fritz-exporter";
-  version = "2.5.2";
+  version = "2.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdreker";
     repo = "fritz_exporter";
     tag = "fritzexporter-v${version}";
-    hash = "sha256-xQLTI6b8X22aU6dj7Tmkzxn7vE4y8r/djUetG3Qg9Qw=";
+    hash = "sha256-m2jDQN6c3S4xDIrmRFdD+stwutBxcespLKZvxp1VC0I=";
   };
 
   postPatch = ''
@@ -43,6 +43,9 @@ python3.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  # Required for tests
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     changelog = "https://github.com/pdreker/fritz_exporter/blob/${src.tag}/CHANGELOG.md";
     description = "Prometheus exporter for Fritz!Box home routers";
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index c17b59e72158..f4860607a84e 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.5.0";
+  version = "18.5.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-kVFO8brtXWWGU2nWTtHR1q5RrTIXy2ssra9YjtWsglU=";
+      hash = "sha256-719FC9+OBX9Li9gkIpusFoZrpMyeDwCsoWxt9pfhI1A=";
     };
 
     vendorHash = "sha256-I2YMn84wEAY+Z02bmkyP/b0eix7FW3hP/noyEKYsEaQ=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index e9ebdcf15885..9f57f4318c51 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.5.0";
+  version = "18.5.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-7jMiKN2L4rF4YyqoJW8pzj5rP5g6ScwZ3qkY+OCZOZ8=";
+    hash = "sha256-UrVH5Ky5aiqquQ2o6bSkqLD4ULl9/vUViOoACantT1Q=";
   };
 
   vendorHash = "sha256-VWD/AXqEVWo7G9p1q1BM2LUNwAFmkPm+Gm2s9EPu6nM=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index 59c57336b8f2..a9150fdb3e22 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,16 +1,16 @@
 {
-  "version": "18.5.0",
-  "repo_hash": "0r1q6byqv3zziwsw63z7km5jjap7q6222j91lnr048w6cf425n1w",
+  "version": "18.5.1",
+  "repo_hash": "0h80pzsfn6lb8mz8igbpkmazzj3kkdwhrqxazjq6g9zrsqsvydx5",
   "yarn_hash": "16f7r4v4mjjdsfbzy5vy1g18p0l3gnjvfvzrl2xrxdibx7a3b4xs",
   "frontend_islands_yarn_hash": "0kks9hzm5fq3fss9ys8zxls3d3860l1fvsfcrbhf9rccmwvmjn3l",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.5.0-ee",
+  "rev": "v18.5.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.5.0",
-    "GITLAB_PAGES_VERSION": "18.5.0",
+    "GITALY_SERVER_VERSION": "18.5.1",
+    "GITLAB_PAGES_VERSION": "18.5.1",
     "GITLAB_SHELL_VERSION": "14.45.3",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.9.4",
-    "GITLAB_WORKHORSE_VERSION": "18.5.0"
+    "GITLAB_WORKHORSE_VERSION": "18.5.1"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 1e3add758495..a91f24c0e36c 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.5.0";
+  version = "18.5.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index 49c314934630..868611f74092 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -331,7 +331,8 @@ gem 'js_regex', '~> 3.8', feature_category: :shared
 gem 'device_detector', feature_category: :shared
 
 # Redis
-gem 'redis', '~> 5.4.0', feature_category: :redis
+# Do NOT upgrade until Rails is upgraded with a version that contains https://github.com/rails/rails/pull/55359.
+gem 'redis', '= 5.4.0', feature_category: :redis
 gem 'redis-client', '~> 0.25', feature_category: :redis
 gem 'redis-cluster-client', '~> 0.13', feature_category: :redis
 gem 'redis-clustering', '~> 5.4.0', feature_category: :redis
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index cf4481484644..5bbab0aec3a3 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -1624,7 +1624,7 @@ GEM
       json
     recursive-open-struct (1.1.3)
     redcarpet (3.6.0)
-    redis (5.4.1)
+    redis (5.4.0)
       redis-client (>= 0.22.0)
     redis-actionpack (5.5.0)
       actionpack (>= 5)
@@ -1634,8 +1634,8 @@ GEM
       connection_pool
     redis-cluster-client (0.13.5)
       redis-client (~> 0.24)
-    redis-clustering (5.4.1)
-      redis (= 5.4.1)
+    redis-clustering (5.4.0)
+      redis (= 5.4.0)
       redis-cluster-client (>= 0.10.0)
     redis-namespace (1.11.0)
       redis (>= 4)
@@ -2364,7 +2364,7 @@ DEPENDENCIES
   rbtrace (~> 0.4)
   re2 (~> 2.15)
   recaptcha (~> 5.12)
-  redis (~> 5.4.0)
+  redis (= 5.4.0)
   redis-actionpack (~> 5.5.0)
   redis-client (~> 0.25)
   redis-cluster-client (~> 0.13)
@@ -2452,4 +2452,4 @@ DEPENDENCIES
   yard (~> 0.9)
 
 BUNDLED WITH
-   2.7.1
+   2.7.2
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 1f5b15a95a5a..a109fcdc6d3f 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -7528,10 +7528,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bpsh5dbvybsa8qnv4dg11a6f2zn4sndarf7pk4iaayjgaspbrmm";
+      sha256 = "0syhyw1bp9nbb0fvcmm58y1c6iav6xw6b4bzjz1rz2j1d7c012br";
       type = "gem";
     };
-    version = "5.4.1";
+    version = "5.4.0";
   };
   redis-actionpack = {
     dependencies = [
@@ -7579,10 +7579,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sj4b3j7i3rb5a276g7yyd95kji4j9sl6wmqfgpz39gx06qlni47";
+      sha256 = "0fsnfi15xiy8sal6av11fqfjmdmjpy93amf790i0zwqcf1iq1qbw";
       type = "gem";
     };
-    version = "5.4.1";
+    version = "5.4.0";
   };
   redis-namespace = {
     dependencies = [ "redis" ];
diff --git a/pkgs/by-name/go/goreleaser/package.nix b/pkgs/by-name/go/goreleaser/package.nix
index d30a09c70ea8..2b67e9bfff7e 100644
--- a/pkgs/by-name/go/goreleaser/package.nix
+++ b/pkgs/by-name/go/goreleaser/package.nix
@@ -10,16 +10,16 @@
 }:
 buildGo125Module rec {
   pname = "goreleaser";
-  version = "2.12.5";
+  version = "2.12.6";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = "goreleaser";
     rev = "v${version}";
-    hash = "sha256-EHJ1ARzk6BD5D121u+1UTe90oLOovKKD+LQWLIj81Jk=";
+    hash = "sha256-ZYlT/CkYMPZgVNR0uaDPbLT7WH5EDcUeTwUPFM6fZOg=";
   };
 
-  vendorHash = "sha256-J/OwvPxC8wz/91sWWUBNkW5E71m8EPjTq3h/MOxT/3k=";
+  vendorHash = "sha256-Zv13xWe/wwmq+2lqvsX6oWIyEYlCojgIgH/cvr5rSOI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix
index a78cddb2f7fe..2b31edcb2836 100644
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gpauth";
-  version = "2.4.1";
+  version = "2.4.6";
 
   src = fetchFromGitHub {
     owner = "yuezk";
     repo = "GlobalProtect-openconnect";
     rev = "v${version}";
-    hash = "sha256-MY4JvftrC6sR8M0dFvnGZOkvHIhPRcyct9AG/8527gw=";
+    hash = "sha256-AxerhMQBgEgeecKAhedokMdpra1C9iqhutPrdAQng6Q=";
   };
 
   buildAndTestSubdir = "apps/gpauth";
 
-  cargoHash = "sha256-8LSGuRnWRWeaY6t25GdZ2y4hGIJ+mP3UBXRjcvPuD6U=";
+  cargoHash = "sha256-oPnBpwE8bdYgve1Dh64WNjWXClSRoHL5PVwrB1ovU6Y=";
 
   nativeBuildInputs = [
     perl
diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index 78e6c0a975bf..0412494e614b 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -8,6 +8,11 @@
   perl,
   pkg-config,
   vpnc-scripts,
+  glib,
+  pango,
+  cairo,
+  atk,
+  gtk3,
 }:
 
 rustPlatform.buildRustPackage {
@@ -32,6 +37,11 @@ rustPlatform.buildRustPackage {
     openconnect
     openssl
     glib-networking
+    glib
+    pango
+    cairo
+    atk
+    gtk3
   ];
 
   preConfigure = ''
diff --git a/pkgs/by-name/gr/grav/package.nix b/pkgs/by-name/gr/grav/package.nix
index 0f2fa5f4c49b..89ea0e66bcca 100644
--- a/pkgs/by-name/gr/grav/package.nix
+++ b/pkgs/by-name/gr/grav/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.7.49.5";
+  version = "1.7.50.2";
 in
 stdenvNoCC.mkDerivation {
   pname = "grav";
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/getgrav/grav/releases/download/${version}/grav-admin-v${version}.zip";
-    hash = "sha256-zhjsYWma0qze8zdzX01EauzMONeEC6TRkhdQJUoJEUQ=";
+    hash = "sha256-UaaROMdUNFX6gcbJnfRn9CopZ3nuIMD91CkHnujtnE4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index fea0e094595c..4fd9bff2db9a 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.65.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-y2oYEJTZWZ7Rc7ZLjYUh3Cy9dtznGLhIXzJ6D0JUIGw=";
+    hash = "sha256-NYbTz/+APVGU8P0edXz84YBbBWBc8k7rhDXpRxH7Pjc=";
   };
 
   buildAndTestSubdir = "harper-ls";
 
-  cargoHash = "sha256-o6RFBCvPn3AH3mMI3guHziqOcYN99o8yk5b6VXWoepI=";
+  cargoHash = "sha256-3Vk8nQPUxD1D6AG6PjJwju5xolvfVucfYL9i6l9atOk=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ju/julec/hook.nix b/pkgs/by-name/ju/julec/hook.nix
new file mode 100644
index 000000000000..d6cccb165979
--- /dev/null
+++ b/pkgs/by-name/ju/julec/hook.nix
@@ -0,0 +1,15 @@
+{
+  julec,
+  clang,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "julec-hook";
+
+  propagatedBuildInputs = [ julec ];
+
+  meta = {
+    inherit (julec.meta) maintainers;
+  };
+} ./hook.sh
diff --git a/pkgs/by-name/ju/julec/hook.sh b/pkgs/by-name/ju/julec/hook.sh
new file mode 100644
index 000000000000..112dc48d0c81
--- /dev/null
+++ b/pkgs/by-name/ju/julec/hook.sh
@@ -0,0 +1,80 @@
+# shellcheck shell=bash disable=SC2154,SC2034
+
+julecSetEnv() {
+  if [ -z "$JULE_SRC_DIR" ]; then
+    export JULE_SRC_DIR='./src'
+  fi
+  if [ -z "$JULE_OUT_DIR" ]; then
+    export JULE_OUT_DIR='./bin'
+  fi
+  if [ -z "$JULE_OUT_NAME" ]; then
+    export JULE_OUT_NAME='output'
+  fi
+  if [ -z "$JULE_TEST_DIR" ]; then
+    export JULE_TEST_DIR="$JULE_SRC_DIR"
+  fi
+  if [ -z "$JULE_TEST_OUT_DIR" ]; then
+    export JULE_TEST_OUT_DIR="$JULE_OUT_DIR"
+  fi
+  if [ -z "$JULE_TEST_OUT_NAME" ]; then
+    export JULE_TEST_OUT_NAME="$JULE_OUT_NAME-test"
+  fi
+}
+
+julecBuildHook() {
+  echo "Executing julecBuildHook"
+
+  runHook preBuild
+
+  julecSetEnv
+  mkdir -p "$JULE_OUT_DIR"
+  julec --opt L2 -p -o "$JULE_OUT_DIR/$JULE_OUT_NAME" "$JULE_SRC_DIR"
+
+  runHook postBuild
+
+  echo "Finished julecBuildHook"
+}
+
+julecCheckHook() {
+  echo "Executing julecCheckHook"
+
+  runHook preCheck
+
+  echo "Building tests..."
+
+  julecSetEnv
+  mkdir -p "$JULE_TEST_OUT_DIR"
+  julec test -o "$JULE_TEST_OUT_DIR/$JULE_TEST_OUT_NAME" "$JULE_TEST_DIR"
+
+  echo "Running tests..."
+
+  "$JULE_TEST_OUT_DIR/$JULE_TEST_OUT_NAME"
+
+  runHook postCheck
+
+  echo "Finished julecCheckHook"
+}
+
+julecInstallHook() {
+  echo "Executing julecInstallHook"
+
+  runHook preInstall
+
+  julecSetEnv
+  mkdir -p "$out/bin"
+  cp -r "$JULE_OUT_DIR/$JULE_OUT_NAME" "$out/bin/"
+
+  runHook postInstall
+
+  echo "Finished julecInstallHook"
+}
+
+if [ -z "${dontUseJulecBuild-}" ] && [ -z "${buildPhase-}" ]; then
+  buildPhase=julecBuildHook
+fi
+if [ -z "${dontUseJulecCheck-}" ] && [ -z "${checkPhase-}" ]; then
+  checkPhase=julecCheckHook
+fi
+if [ -z "${dontUseJulecInstall-}" ] && [ -z "${installPhase-}" ]; then
+  installPhase=julecInstallHook
+fi
diff --git a/pkgs/by-name/ju/julec/package.nix b/pkgs/by-name/ju/julec/package.nix
index 27a007a791ee..e22298483855 100644
--- a/pkgs/by-name/ju/julec/package.nix
+++ b/pkgs/by-name/ju/julec/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   clangStdenv,
+  callPackage,
   fetchFromGitHub,
 }:
 
@@ -93,6 +94,12 @@ clangStdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    # see doc/hooks/julec.section.md
+    hook = callPackage ./hook.nix { julec = finalAttrs.finalPackage; };
+    tests.hello-jule = callPackage ./test { julec = finalAttrs.finalPackage; };
+  };
+
   meta = {
     description = "Jule Programming Language Compiler";
     longDescription = ''
diff --git a/pkgs/by-name/ju/julec/test/default.nix b/pkgs/by-name/ju/julec/test/default.nix
new file mode 100644
index 000000000000..6717600389c9
--- /dev/null
+++ b/pkgs/by-name/ju/julec/test/default.nix
@@ -0,0 +1,19 @@
+{
+  julec,
+  clangStdenv,
+}:
+
+clangStdenv.mkDerivation (finalAttrs: {
+  pname = "hello-jule";
+  inherit (julec) version;
+
+  src = ./hello-jule;
+
+  nativeBuildInputs = [ julec.hook ];
+
+  doCheck = true;
+
+  meta = {
+    inherit (julec.meta) platforms;
+  };
+})
diff --git a/pkgs/by-name/ju/julec/test/hello-jule/jule.mod b/pkgs/by-name/ju/julec/test/hello-jule/jule.mod
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/pkgs/by-name/ju/julec/test/hello-jule/src/_test.jule b/pkgs/by-name/ju/julec/test/hello-jule/src/_test.jule
new file mode 100644
index 000000000000..53b23c3cf884
--- /dev/null
+++ b/pkgs/by-name/ju/julec/test/hello-jule/src/_test.jule
@@ -0,0 +1,8 @@
+use "std/testing"
+
+#test
+fn testPi(t: &testing::T) {
+		if getPi() != 3.14 {
+				t.Errorf("PI not precise enough")
+		}
+}
diff --git a/pkgs/by-name/ju/julec/test/hello-jule/src/main.jule b/pkgs/by-name/ju/julec/test/hello-jule/src/main.jule
new file mode 100644
index 000000000000..322bd3111649
--- /dev/null
+++ b/pkgs/by-name/ju/julec/test/hello-jule/src/main.jule
@@ -0,0 +1,7 @@
+fn main() {
+		println("Hello, Jule!");
+}
+
+fn getPi(): f64 {
+		ret 3.14;
+}
diff --git a/pkgs/by-name/kr/krunkit/package.nix b/pkgs/by-name/kr/krunkit/package.nix
new file mode 100644
index 000000000000..230317284893
--- /dev/null
+++ b/pkgs/by-name/kr/krunkit/package.nix
@@ -0,0 +1,58 @@
+{
+  cargo,
+  darwin,
+  pkg-config,
+  rustc,
+  stdenv,
+  fetchFromGitHub,
+  libepoxy,
+  libkrun-efi,
+  rustPlatform,
+  lib,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "krunkit";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "krunkit";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dsEZZiLgHyd6xeXZCdDd4zsxzwQeIhAK+lewY2ZfvpY=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-i0cC3aOEqcvOcwTPbM6AazMzd8Q+QLwuhnvPGv3ntsc=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    darwin.sigtool
+    pkg-config
+    rustc
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    libepoxy
+    libkrun-efi
+  ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  # This is necessary in order for the binary to keep its entitlements
+  dontStrip = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Launch configurable virtual machines with libkrun";
+    homepage = "https://github.com/containers/krunkit";
+    license = lib.licenses.asl20;
+    platforms = [ "aarch64-darwin" ];
+    maintainers = with lib.maintainers; [ quinneden ];
+  };
+})
diff --git a/pkgs/by-name/la/laravel/composer.lock b/pkgs/by-name/la/laravel/composer.lock
index 8989fcdb1e51..d9fae099ba7a 100644
--- a/pkgs/by-name/la/laravel/composer.lock
+++ b/pkgs/by-name/la/laravel/composer.lock
@@ -167,7 +167,7 @@
         },
         {
             "name": "illuminate/collections",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/collections.git",
@@ -226,7 +226,7 @@
         },
         {
             "name": "illuminate/conditionable",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/conditionable.git",
@@ -272,7 +272,7 @@
         },
         {
             "name": "illuminate/contracts",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/contracts.git",
@@ -320,7 +320,7 @@
         },
         {
             "name": "illuminate/filesystem",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/filesystem.git",
@@ -387,7 +387,7 @@
         },
         {
             "name": "illuminate/macroable",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/macroable.git",
@@ -433,16 +433,16 @@
         },
         {
             "name": "illuminate/support",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/support.git",
-                "reference": "89291f59ef6c170c00f10a41c566c49ee32ca09a"
+                "reference": "eefcefcf6edff2c986f746f10fad3da3e79a1223"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/support/zipball/89291f59ef6c170c00f10a41c566c49ee32ca09a",
-                "reference": "89291f59ef6c170c00f10a41c566c49ee32ca09a",
+                "url": "https://api.github.com/repos/illuminate/support/zipball/eefcefcf6edff2c986f746f10fad3da3e79a1223",
+                "reference": "eefcefcf6edff2c986f746f10fad3da3e79a1223",
                 "shasum": ""
             },
             "require": {
@@ -508,7 +508,7 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2025-10-13T21:11:33+00:00"
+            "time": "2025-10-18T13:23:12+00:00"
         },
         {
             "name": "laravel/prompts",
@@ -2262,16 +2262,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v5.6.1",
+            "version": "v5.6.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2"
+                "reference": "3a454ca033b9e06b63282ce19562e892747449bb"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2",
-                "reference": "f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/3a454ca033b9e06b63282ce19562e892747449bb",
+                "reference": "3a454ca033b9e06b63282ce19562e892747449bb",
                 "shasum": ""
             },
             "require": {
@@ -2314,9 +2314,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v5.6.1"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.6.2"
             },
-            "time": "2025-08-13T20:13:15+00:00"
+            "time": "2025-10-21T19:32:17+00:00"
         },
         {
             "name": "phar-io/manifest",
diff --git a/pkgs/by-name/la/laravel/package.nix b/pkgs/by-name/la/laravel/package.nix
index 8ed1ade24a71..c7c3626719ec 100644
--- a/pkgs/by-name/la/laravel/package.nix
+++ b/pkgs/by-name/la/laravel/package.nix
@@ -7,19 +7,19 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "laravel";
-  version = "5.21.0";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "laravel";
     repo = "installer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2UfLzB3m/WjzJC7h/wYX9MHCUQFCVWRlXWVUpmDtUoE=";
+    hash = "sha256-kC6RD+rtjHXrOGhF/E9l8/eArTnDrXIw3D6lnDpsl7I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-My17A7xl2HacrVP5SMzYpSar6cJ0MONznkJIPLFTII8=";
+  vendorHash = "sha256-s+wBvGnDyKbzniZoKJ4wUcv0FCo7XnrD6KYvYhllBFM=";
 
   # Adding npm (nodejs) and php composer to path
   postInstall = ''
diff --git a/pkgs/by-name/li/libkrun-efi/package.nix b/pkgs/by-name/li/libkrun-efi/package.nix
new file mode 100644
index 000000000000..e140e811a2ee
--- /dev/null
+++ b/pkgs/by-name/li/libkrun-efi/package.nix
@@ -0,0 +1,117 @@
+{
+  cargo,
+  fetchFromGitHub,
+  fetchurl,
+  fixDarwinDylibNames,
+  lib,
+  libepoxy,
+  libkrun-efi,
+  moltenvk,
+  pkg-config,
+  rustc,
+  rustPlatform,
+  rutabaga_gfx,
+  nix-update-script,
+  stdenv,
+  buildPackages,
+  meson,
+  ninja,
+  vulkan-headers,
+  withGpu ? true,
+}:
+let
+  virglrenderer = stdenv.mkDerivation (finalAttrs: {
+    pname = "virglrenderer";
+    version = "0.10.4d-krunkit";
+
+    src = fetchurl {
+      url = "https://gitlab.freedesktop.org/slp/virglrenderer/-/archive/${finalAttrs.version}/virglrenderer-${finalAttrs.version}.tar.bz2";
+      hash = "sha256-M/buj97QUeY6CYeW0VICD5F6FBPi9ATPGHpNA48xL3o=";
+    };
+
+    separateDebugInfo = true;
+
+    buildInputs = [
+      libepoxy
+      moltenvk
+      vulkan-headers
+    ];
+
+    nativeBuildInputs = [
+      meson
+      ninja
+      pkg-config
+      (buildPackages.python3.withPackages (ps: [ ps.pyyaml ]))
+    ];
+
+    mesonFlags = [
+      (lib.mesonBool "render-server" false)
+      (lib.mesonBool "venus" true)
+      (lib.mesonEnable "drm" false)
+    ];
+
+    meta = {
+      description = "Virtual 3D GPU library that allows a qemu guest to use the host GPU for accelerated 3D rendering";
+      mainProgram = "virgl_test_server";
+      homepage = "https://gitlab.freedesktop.org/slp/virglrenderer";
+      license = lib.licenses.mit;
+      platforms = lib.platforms.unix;
+      maintainers = [ lib.maintainers.quinneden ];
+    };
+  });
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libkrun-efi";
+  version = "1.15.1";
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "libkrun";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VhlFyYJ/TH12I3dUq0JTus60rQEJq5H4Pm1puCnJV5A=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-dK3V7HCCvTqmQhB5Op2zmBPa9FO3h9gednU9tpQk+1U=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    fixDarwinDylibNames
+    pkg-config
+    rustc
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    libepoxy
+    rutabaga_gfx
+    virglrenderer
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "EFI=1"
+  ]
+  ++ lib.optional withGpu "GPU=1";
+
+  passthru = {
+    tests.withoutGpu = libkrun-efi.override { withGpu = false; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities";
+    homepage = "https://github.com/containers/libkrun";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ quinneden ];
+    platforms = [ "aarch64-darwin" ];
+  };
+})
diff --git a/pkgs/by-name/li/libnl-tiny/package.nix b/pkgs/by-name/li/libnl-tiny/package.nix
index f0fefcc64767..d814fbab6ce7 100644
--- a/pkgs/by-name/li/libnl-tiny/package.nix
+++ b/pkgs/by-name/li/libnl-tiny/package.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation {
   pname = "libnl-tiny";
-  version = "0-unstable-2025-03-19";
+  version = "0-unstable-2025-10-20";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libnl-tiny.git";
-    rev = "c0df580adbd4d555ecc1962dbe88e91d75b67a4e";
-    hash = "sha256-j5oIEbWqVWd7rNpCMm9+WZwud43uTGeHG81lmzQOoeY=";
+    rev = "c69fb5ef80b9780fe9add345052aef9ccb5d51f4";
+    hash = "sha256-QH4w++kekejvvgTye6djs0jYzcNsxfrE3XCBed+Oizo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/lightway/package.nix b/pkgs/by-name/li/lightway/package.nix
index 0bf4c6a92840..82c22ee4df25 100644
--- a/pkgs/by-name/li/lightway/package.nix
+++ b/pkgs/by-name/li/lightway/package.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
 
   cargoHash = "sha256-RFlac10XFJXT3Giayy31kZ3Nn1Q+YsPt/zCdkSV0Atk=";
 
-  cargoBuildFlags = lib.cli.toGNUCommandLine { } {
+  cargoBuildFlags = lib.cli.toCommandLineGNU { } {
     package = [
       "lightway-client"
       "lightway-server"
diff --git a/pkgs/by-name/mb/mbusd/package.nix b/pkgs/by-name/mb/mbusd/package.nix
index baba9df86a83..a80cf02fd297 100644
--- a/pkgs/by-name/mb/mbusd/package.nix
+++ b/pkgs/by-name/mb/mbusd/package.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.2)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = {
     description = "Modbus TCP to Modbus RTU (RS-232/485) gateway";
     homepage = "https://github.com/3cky/mbusd";
diff --git a/pkgs/by-name/ne/necesse-server/package.nix b/pkgs/by-name/ne/necesse-server/package.nix
index 684d4c5d9b1e..c1e39ebe2d40 100644
--- a/pkgs/by-name/ne/necesse-server/package.nix
+++ b/pkgs/by-name/ne/necesse-server/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.0.1-20456269";
+  version = "1.0.1-20495154";
   urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
 in
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://necessegame.com/content/server/${urlVersion}/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-1Du0r/R7wLqnWRkihW3Kwzo58HEmUt8NgNYWSyJwwdc=";
+    hash = "sha256-1k+4ywYjVddAb4yyGx1Fi/RXMyJzPIiQIyUzA0VhpAI=";
   };
 
   # removing packaged jre since we use our own
diff --git a/pkgs/by-name/ne/nemu/package.nix b/pkgs/by-name/ne/nemu/package.nix
index 0ec873b2faac..329754fe2c1b 100644
--- a/pkgs/by-name/ne/nemu/package.nix
+++ b/pkgs/by-name/ne/nemu/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nemu";
-  version = "3.3.1";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "nemuTUI";
     repo = "nemu";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6WzqBkspKKs1e8kg1i71ntZHa78s5pJ1u02mXvzpiEc=";
+    hash = "sha256-QvyCBHZmahZPIghPX53HcL5HsOVvhsVwdMZosVQ9A5U=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ne/nexusmods-app/deps.json b/pkgs/by-name/ne/nexusmods-app/deps.json
index 8a7000283848..07856e2cbb8f 100644
--- a/pkgs/by-name/ne/nexusmods-app/deps.json
+++ b/pkgs/by-name/ne/nexusmods-app/deps.json
@@ -1926,23 +1926,23 @@
   },
   {
     "pname": "NexusMods.HyperDuck",
-    "version": "0.28.0",
-    "hash": "sha256-vJW/9DbnSIzxH6CR1CzMru0w/BA7HwxuJ0TiKt6NgcQ="
+    "version": "0.28.2",
+    "hash": "sha256-VErxX62rvY5MA9LGyBcKi1BCgtgzOo4rgWTRczFNrVY="
   },
   {
     "pname": "NexusMods.MnemonicDB",
-    "version": "0.28.0",
-    "hash": "sha256-AzSzn2mdp4sx1ntOfm03kWlfo/mxxURcEMmChxSyEAI="
+    "version": "0.28.2",
+    "hash": "sha256-l6b1r0swnRfqAIk7WvdQv0VaekFRXENhZqEL9ut4AT0="
   },
   {
     "pname": "NexusMods.MnemonicDB.Abstractions",
-    "version": "0.28.0",
-    "hash": "sha256-c6hEojlKk8B//lpEyxrYBy/QlpixzDE4LJq+sk4XZDY="
+    "version": "0.28.2",
+    "hash": "sha256-HJsnz1nQeUG4iln+WDkR3SMEalYM47Z8vdYZf8V+RIU="
   },
   {
     "pname": "NexusMods.MnemonicDB.SourceGenerator",
-    "version": "0.28.0",
-    "hash": "sha256-o888EyOAzDypNzhZTtW8BZp0Ew/fOUsho6IeBbGlmNM="
+    "version": "0.28.2",
+    "hash": "sha256-vmOO/qImh5RrWC3U11D5A4Gd2SvOJvuoDID+b5fI+cA="
   },
   {
     "pname": "NexusMods.Paths",
@@ -1969,51 +1969,6 @@
     "version": "0.20.0",
     "hash": "sha256-k+1dgCZEuEO8xVfdwGKec+FgE//FX1xqIyiyPGYypF0="
   },
-  {
-    "pname": "Nito.AsyncEx",
-    "version": "5.1.2",
-    "hash": "sha256-9o4YLWAHSeApF4E/qNFyaZPh/V9N5JSeF32uquukb5I="
-  },
-  {
-    "pname": "Nito.AsyncEx.Context",
-    "version": "5.1.2",
-    "hash": "sha256-7BCVYJgZyU2/Z4r8CKajorlzajr6GBUBAbY3AcswPC0="
-  },
-  {
-    "pname": "Nito.AsyncEx.Coordination",
-    "version": "5.1.2",
-    "hash": "sha256-NHMnIBkGzzuoZL0qHKAwFC35doB08IDvmCQptC2uu2s="
-  },
-  {
-    "pname": "Nito.AsyncEx.Interop.WaitHandles",
-    "version": "5.1.2",
-    "hash": "sha256-1DgBWnkYggWQk0w2g7Y24Ogl7TJ7bQkc/0NIUFJzN00="
-  },
-  {
-    "pname": "Nito.AsyncEx.Oop",
-    "version": "5.1.2",
-    "hash": "sha256-1hnCagbt6SLbn+RpasWdBH3pLvqm8kC2Ut2iG75OUMM="
-  },
-  {
-    "pname": "Nito.AsyncEx.Tasks",
-    "version": "5.1.2",
-    "hash": "sha256-W5jxZZ0pbPHte6TkWTq4FDtHOejvlrdyb1Inw+Yhl4c="
-  },
-  {
-    "pname": "Nito.Cancellation",
-    "version": "1.1.2",
-    "hash": "sha256-oZKZUymYJiM2AfMpX4pX0FIlut0lEWdy250iVX0w+is="
-  },
-  {
-    "pname": "Nito.Collections.Deque",
-    "version": "1.1.1",
-    "hash": "sha256-6Pmz6XQ+rY32O21Z3cUDVQsLH+i53LId18UCPTAxRZQ="
-  },
-  {
-    "pname": "Nito.Disposables",
-    "version": "2.2.1",
-    "hash": "sha256-FKDLUWysqroSHLU2kLjK1m0g417AAPh6n2TIkwiapcM="
-  },
   {
     "pname": "NLog",
     "version": "6.0.3",
@@ -2689,11 +2644,6 @@
     "version": "4.3.0",
     "hash": "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="
   },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "1.7.1",
-    "hash": "sha256-WMMAUqoxT3J1gW9DI8v31VAuhwqTc4Posose5jq1BNo="
-  },
   {
     "pname": "System.Collections.Immutable",
     "version": "5.0.0",
@@ -3069,6 +3019,11 @@
     "version": "5.0.0",
     "hash": "sha256-M5Z8pw8rVb8ilbnTdaOptzk5VFd5DlKa7zzCpuytTtE="
   },
+  {
+    "pname": "System.Reactive",
+    "version": "6.0.0",
+    "hash": "sha256-hXB18OsiUHSCmRF3unAfdUEcbXVbG6/nZxcyz13oe9Y="
+  },
   {
     "pname": "System.Reactive",
     "version": "6.0.1",
@@ -3194,11 +3149,6 @@
     "version": "4.3.0",
     "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
   },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "4.4.0",
-    "hash": "sha256-SeTI4+yVRO2SmAKgOrMni4070OD+Oo8L1YiEVeKDyig="
-  },
   {
     "pname": "System.Runtime.CompilerServices.Unsafe",
     "version": "4.5.3",
@@ -3564,6 +3514,11 @@
     "version": "2.5.0",
     "hash": "sha256-i9TpQJ2+JhSQ7RXkdmC6pkND32V4cLyEaPLGrD/EpYk="
   },
+  {
+    "pname": "Verify.TUnit",
+    "version": "30.11.0",
+    "hash": "sha256-xuP2oetSNIBhCzt7go3S2Icy8wy3pBseq4XcEMMrDV8="
+  },
   {
     "pname": "Verify.Xunit",
     "version": "30.11.0",
diff --git a/pkgs/by-name/ne/nexusmods-app/package.nix b/pkgs/by-name/ne/nexusmods-app/package.nix
index 5bcea550ddf8..5b993929fc93 100644
--- a/pkgs/by-name/ne/nexusmods-app/package.nix
+++ b/pkgs/by-name/ne/nexusmods-app/package.nix
@@ -5,6 +5,7 @@
   desktop-file-utils,
   dotnetCorePackages,
   fetchFromGitHub,
+  fetchpatch2,
   imagemagick,
   lib,
   xdg-utils,
@@ -22,13 +23,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
   inherit pname;
-  version = "0.18.2";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "Nexus-Mods";
     repo = "NexusMods.App";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+ayYRNclxbBedH6gIWTh5wI/AIvMzSq4x5fQXzxOT5c=";
+    hash = "sha256-WKfv5y6UmO3dmzkXrqZ+VtIbXf0FszRdsa5Rmp95rYg=";
     fetchSubmodules = true;
   };
 
@@ -56,10 +57,15 @@ buildDotnetModule (finalAttrs: {
   dotnet-sdk = dotnetCorePackages.sdk_9_0;
   dotnet-runtime = dotnetCorePackages.runtime_9_0;
 
-  postPatch = ''
-    # for some reason these tests fail (intermittently?) with a zero timestamp
-    touch tests/NexusMods.UI.Tests/WorkspaceSystem/*.verified.png
+  patches = [
+    (fetchpatch2 {
+      name = "Fix-SMAPI-installation.patch";
+      url = "https://github.com/Nexus-Mods/NexusMods.App/pull/4026.patch?full_index=1";
+      hash = "sha256-1LgFTi63fVhGUZXZtS6iD2yqd0RxhdpiXKtWMFNEoD4=";
+    })
+  ];
 
+  postPatch = ''
     # Specify a fixed date to improve build reproducibility
     echo "1970-01-01T00:00:00Z" >buildDate.txt
     substituteInPlace src/NexusMods.Sdk/NexusMods.Sdk.csproj \
@@ -72,6 +78,16 @@ buildDotnetModule (finalAttrs: {
     # Use a vendored version of the nexus API's games.json data
     substituteInPlace src/NexusMods.Networking.NexusWebApi/NexusMods.Networking.NexusWebApi.csproj \
       --replace-fail '$(BaseIntermediateOutputPath)games.json' ${./vendored/games.json}
+
+    ${lib.optionalString finalAttrs.doCheck ''
+      # For some reason these tests fail (intermittently?) with a zero timestamp
+      touch tests/NexusMods.UI.Tests/WorkspaceSystem/*.verified.png
+
+      # Fix expected version number in text fixture
+      # https://github.com/Nexus-Mods/NexusMods.App/issues/4030
+      substituteInPlace tests/NexusMods.Backend.Tests/EventTrackerTests.Test_PrepareRequest.verified.txt \
+        --replace-fail 0.0.1 ${finalAttrs.version}
+    ''}
   '';
 
   makeWrapperArgs = [
diff --git a/pkgs/by-name/ne/nexusmods-app/vendored/games.json b/pkgs/by-name/ne/nexusmods-app/vendored/games.json
index 1ee7cae625b9..478145604579 100644
--- a/pkgs/by-name/ne/nexusmods-app/vendored/games.json
+++ b/pkgs/by-name/ne/nexusmods-app/vendored/games.json
@@ -6,12 +6,12 @@
     "forum_url": "https://forums.nexusmods.com/games/19-stardew-valley/",
     "nexusmods_url": "https://www.nexusmods.com/stardewvalley",
     "genre": "Simulation",
-    "file_count": 141993,
-    "downloads": 619854329,
+    "file_count": 143212,
+    "downloads": 627187655,
     "domain_name": "stardewvalley",
     "approved_date": 1457432329,
-    "mods": 25658,
-    "collections": 2049
+    "mods": 25945,
+    "collections": 2020
   },
   {
     "id": 1704,
@@ -20,12 +20,12 @@
     "forum_url": "https://forums.nexusmods.com/games/6-skyrim/",
     "nexusmods_url": "https://www.nexusmods.com/skyrimspecialedition",
     "genre": "RPG",
-    "file_count": 656636,
-    "downloads": 9072303822,
+    "file_count": 661698,
+    "downloads": 9193533035,
     "domain_name": "skyrimspecialedition",
     "approved_date": 1477480498,
-    "mods": 117768,
-    "collections": 4872
+    "mods": 118807,
+    "collections": 4852
   },
   {
     "id": 3174,
@@ -34,11 +34,11 @@
     "forum_url": "https://forums.nexusmods.com/games/9-mount-blade-ii-bannerlord/",
     "nexusmods_url": "https://www.nexusmods.com/mountandblade2bannerlord",
     "genre": "Strategy",
-    "file_count": 50300,
-    "downloads": 115343239,
+    "file_count": 50603,
+    "downloads": 116400189,
     "domain_name": "mountandblade2bannerlord",
     "approved_date": 1582898627,
-    "mods": 6294,
+    "mods": 6341,
     "collections": 293
   },
   {
@@ -48,12 +48,12 @@
     "forum_url": "https://forums.nexusmods.com/games/1-cyberpunk-2077/",
     "nexusmods_url": "https://www.nexusmods.com/cyberpunk2077",
     "genre": "Action",
-    "file_count": 123906,
-    "downloads": 908587568,
+    "file_count": 125224,
+    "downloads": 930909718,
     "domain_name": "cyberpunk2077",
     "approved_date": 1607433331,
-    "mods": 17809,
-    "collections": 1602
+    "mods": 18032,
+    "collections": 1588
   },
   {
     "id": 3474,
@@ -62,11 +62,11 @@
     "forum_url": "https://forums.nexusmods.com/games/2-baldurs-gate-3/",
     "nexusmods_url": "https://www.nexusmods.com/baldursgate3",
     "genre": "RPG",
-    "file_count": 104549,
-    "downloads": 345662936,
+    "file_count": 105632,
+    "downloads": 351591575,
     "domain_name": "baldursgate3",
     "approved_date": 1602863114,
-    "mods": 14843,
-    "collections": 1805
+    "mods": 15020,
+    "collections": 1752
   }
 ]
diff --git a/pkgs/by-name/op/opentabletdriver/package.nix b/pkgs/by-name/op/opentabletdriver/package.nix
index 2e5a79bdb483..04a3730acb58 100644
--- a/pkgs/by-name/op/opentabletdriver/package.nix
+++ b/pkgs/by-name/op/opentabletdriver/package.nix
@@ -23,13 +23,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "OpenTabletDriver";
-  version = "0.6.6.1";
+  version = "0.6.6.2";
 
   src = fetchFromGitHub {
     owner = "OpenTabletDriver";
     repo = "OpenTabletDriver";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ixckDFE/LCSncNGjXqPT5GurPhm5aSVALOw4ZrBa5Ww=";
+    hash = "sha256-OeioFdevYPiLl9w7FXVmpbcp1cIMoMYnSLgoBisOOOU=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 0fad77fe6a12..a518dc7625f9 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -28,13 +28,13 @@
   xorg,
 }:
 let
-  version = "2.18.4";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-sQ5laFO6DSg+4tF9jk2yuV0q2Vp7VC/+hu2XrVj8/bY=";
+    hash = "sha256-t2T42K+F3PaMfNDFa3NF/rAcG6izKTXMIzgD68WdVFE=";
   };
 
   python = python3.override {
@@ -80,7 +80,7 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
       fetcherVersion = 2;
-      hash = "sha256-fs9a2uI/TnWalQ/qRb6m4d1CsU7O6VYCJMz2xWLdC0I=";
+      hash = "sha256-AJp796oO8qOltPKndOXlLx1luCOfzsRSFscCUCe6MZo=";
     };
 
     nativeBuildInputs = [
@@ -168,10 +168,9 @@ python.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "django-allauth"
-    "django-guardian"
+    "django-cors-headers"
+    "drf-spectacular-sidecar"
     "filelock"
-    "ocrmypdf"
-    "rapidfuzz"
     "redis"
   ];
 
@@ -207,6 +206,7 @@ python.pkgs.buildPythonApplication rec {
       django-guardian
       django-multiselectfield
       django-soft-delete
+      django-treenode
       djangorestframework
       djangorestframework-guardian
       drf-spectacular
diff --git a/pkgs/by-name/pe/peergos/package.nix b/pkgs/by-name/pe/peergos/package.nix
index c0ac21fe07ac..49bbfd223761 100644
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@@ -41,12 +41,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "peergos";
-  version = "1.12.0";
+  version = "1.13.0";
   src = fetchFromGitHub {
     owner = "Peergos";
     repo = "web-ui";
     rev = "v${version}";
-    hash = "sha256-PwjSMW5d/M/IShclyFqAZJ75+dq0xSCnZmYsdKN5/O0=";
+    hash = "sha256-gyhNb68W3UF9t0AvQULQp3aEIjRUzss9XgQbHrrrsk8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pi/pixi-pack/package.nix b/pkgs/by-name/pi/pixi-pack/package.nix
index 18090d797625..591fafd8ba92 100644
--- a/pkgs/by-name/pi/pixi-pack/package.nix
+++ b/pkgs/by-name/pi/pixi-pack/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi-pack";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "Quantco";
     repo = "pixi-pack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IYY5moAxZ+pDF6G6KxfuB6DI+Y5V8AseFUyWGs77+bQ=";
+    hash = "sha256-R+JydhsYha4bQu7KBMEyV5IijnPtJZphbSib9JpchrI=";
   };
 
-  cargoHash = "sha256-EM1xCQGIXI2Q5OkfXcReGvPSLiVq98sleo0+rYa0bkw=";
+  cargoHash = "sha256-U2Ty8ZzNkhDc2O3I3ceFcZRk3fu0aSzwsdIuo6Edcx0=";
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/by-name/pl/plakar/package.nix b/pkgs/by-name/pl/plakar/package.nix
index 336064592473..dab7c6e06394 100644
--- a/pkgs/by-name/pl/plakar/package.nix
+++ b/pkgs/by-name/pl/plakar/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "plakar";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "PlakarKorp";
     repo = "plakar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gClQiXZEPui7g3Ps6yhB2tN36PnkqADo9iD4Gm6DpD4=";
+    hash = "sha256-cuPz0xg/cGKczHLpFqSBfFD7KlygCX6fnfrigv0K2Zs=";
   };
 
-  vendorHash = "sha256-JVk8wiuuicwWgEbqIjp7ryC4k3uc4DiXnJ5FxYbXV5M=";
+  vendorHash = "sha256-ySzDtj8EdGcWl6H1q44+QR5ebSC76leVygl+c8fa7sk=";
 
   buildInputs = [
     fuse
diff --git a/pkgs/by-name/po/postfix-tlspol/package.nix b/pkgs/by-name/po/postfix-tlspol/package.nix
index 700e77578310..627a0309d56f 100644
--- a/pkgs/by-name/po/postfix-tlspol/package.nix
+++ b/pkgs/by-name/po/postfix-tlspol/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "postfix-tlspol";
-  version = "1.8.19";
+  version = "1.8.20";
 
   src = fetchFromGitHub {
     owner = "Zuplu";
     repo = "postfix-tlspol";
     tag = "v${version}";
-    hash = "sha256-DSkWE76GSQKkrXAlnMvjTPAa4I4J07mZL9eea06Dzb8=";
+    hash = "sha256-/+FWTrb39PB1L6UDXAr3w0c0bMrpptX23g8WHI794GA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ro/rotonda/package.nix b/pkgs/by-name/ro/rotonda/package.nix
index 6d18cef194b9..12f5ee3ba95e 100644
--- a/pkgs/by-name/ro/rotonda/package.nix
+++ b/pkgs/by-name/ro/rotonda/package.nix
@@ -10,18 +10,23 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rotonda";
-  version = "0.4.2";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "rotonda";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B2sdQr9PctWZBpDuatJkUApW5T98BQa4HiqL8+HHevY=";
+    hash = "sha256-7SVhxUpQq1CCDYNc0xza/2ixjKF8kHBSobt4S+azLQU=";
   };
 
-  cargoHash = "sha256-XbBlA7QYUtD4uBz4t5ZR70o9bMgVLeSzq6Lexe0jzME=";
+  cargoHash = "sha256-4wldyvg0VOFTlM0FN/BSsyDNp5HbRumw4Lv4VEJlPfI=";
 
-  checkFlags =
+  checkFlags = [
+    # Broken in sandbox:
+    "--skip=http_api_responses_multiple_gets"
+    "--skip=representation::genoutput_json"
+  ]
+  ++
     lib.optionals
       (stdenv.hostPlatform.system == "aarch64-darwin" || stdenv.hostPlatform.system == "x86_64-darwin")
       [
@@ -36,10 +41,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru = {
     updateScript = nix-update-script { };
     tests.version = testers.testVersion {
-      package = rotonda;
-      command = "rotonda --version";
-      # tag/release with this version string, please revert to `inherit (finalAttrs) version;` on next release
-      version = "0.4.3-dev";
+      package = finalAttrs.finalPackage;
     };
   };
 
diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix
index 285cadf26edb..b7db2b8d0f35 100644
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.12.9";
+  version = "1.12.10";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1sN1VE+3CMI/rDiADpPJFv9NsxOvulLjGTE38CQOJzo=";
+    hash = "sha256-ZnpvE/x2+kKlKYuez1VaVx7qkybYhRTqfg7yorZpxfc=";
   };
 
-  vendorHash = "sha256-Cx9SD5FTiyISRpWxlUsxeGP1M39YJQrWpRPaK1o6H08=";
+  vendorHash = "sha256-D4nfi5PzcL9CcgLvm09DmF2Ws1o4wIH0zjgv1qDP7Nw=";
 
   tags = [
     "with_quic"
diff --git a/pkgs/by-name/sl/slade-unstable/package.nix b/pkgs/by-name/sl/slade-unstable/package.nix
index 3b40757dbddd..3d4027fd860b 100644
--- a/pkgs/by-name/sl/slade-unstable/package.nix
+++ b/pkgs/by-name/sl/slade-unstable/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation {
   pname = "slade";
-  version = "3.2.7-unstable-2025-09-30";
+  version = "3.2.8-unstable-2025-10-21";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = "8ad6609784de6fef6b35f1508b6d5d8a3084aa17";
-    hash = "sha256-XYg0k5ZOZ/M/4X0+6pjJEMK0sIVqu/1LtmJaeq6iOvM=";
+    rev = "fb7cc161a6886c12c5120e30190a7813c6c16b62";
+    hash = "sha256-skJpcxLSInAzBHGtxdTWAqocXQKKQY7vJfUx8ZAlMqc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sw/switchfin/package.nix b/pkgs/by-name/sw/switchfin/package.nix
index 5331a060a489..c3e64cfe49e8 100644
--- a/pkgs/by-name/sw/switchfin/package.nix
+++ b/pkgs/by-name/sw/switchfin/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchfin";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "dragonflylee";
     repo = "switchfin";
     rev = version;
-    hash = "sha256-vmf7urq3lnfvmdZUJ+G5zn4ZpNA2N4jlLo8D5ZG3tUQ=";
+    hash = "sha256-WEqscGd7K5tTQcK8XXc02EQU2yCbTIdrzw40eXw8lYY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/te/teleport/package.nix b/pkgs/by-name/te/teleport/package.nix
index 93697b54bc97..64af74563365 100644
--- a/pkgs/by-name/te/teleport/package.nix
+++ b/pkgs/by-name/te/teleport/package.nix
@@ -1,5 +1,5 @@
 {
-  teleport_17,
+  teleport_18,
 }:
 
-teleport_17
+teleport_18
diff --git a/pkgs/by-name/we/wesnoth/package.nix b/pkgs/by-name/we/wesnoth/package.nix
index 0c03fa0d7b7f..be34a6058bc8 100644
--- a/pkgs/by-name/we/wesnoth/package.nix
+++ b/pkgs/by-name/we/wesnoth/package.nix
@@ -39,7 +39,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wesnoth${suffix}";
-  version = if enableDevel then "1.19.16.1" else "1.18.5";
+  version = if enableDevel then "1.19.17" else "1.18.5";
 
   src = fetchFromGitHub {
     owner = "wesnoth";
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     tag = finalAttrs.version;
     hash =
       if enableDevel then
-        "sha256-ekpyQnP5r3jl98qyNkO6SwUGc9qvz2OTidUu0k3m28c="
+        "sha256-8JFJR4ghL2uSI5zG63MPX5NwlvIc3/xR0SQ2FjG5JCw="
       else
         "sha256-0VZJAmaCg12x4S07H1kl5s2NGMEo/NSVnzMniREmPJk=";
   };
diff --git a/pkgs/development/interpreters/dhall/build-dhall-package.nix b/pkgs/development/interpreters/dhall/build-dhall-package.nix
index 214fe7f92d28..3ce1c8fceb75 100644
--- a/pkgs/development/interpreters/dhall/build-dhall-package.nix
+++ b/pkgs/development/interpreters/dhall/build-dhall-package.nix
@@ -101,7 +101,7 @@ runCommand name { inherit dependencies; } ''
     mkdir -p $out/${dataDhall}
 
     XDG_DATA_HOME=$out/${data} ${dhall-docs}/bin/dhall-docs --output-link $out/docs ${
-      lib.cli.toGNUCommandLineShell { } {
+      lib.cli.toCommandLineShellGNU { } {
         base-import-url = baseImportUrl;
 
         input = documentationRoot;
diff --git a/pkgs/development/ocaml-modules/graphql_ppx/default.nix b/pkgs/development/ocaml-modules/graphql_ppx/default.nix
index 08ae3343d062..5623248589fa 100644
--- a/pkgs/development/ocaml-modules/graphql_ppx/default.nix
+++ b/pkgs/development/ocaml-modules/graphql_ppx/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  ocaml,
   buildDunePackage,
   fetchFromGitHub,
   alcotest,
@@ -9,19 +10,15 @@
   yojson,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "graphql_ppx";
-  version = "1.2.2";
-
-  duneVersion = "3";
-
-  minimalOCamlVersion = "4.08";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "reasonml-community";
     repo = "graphql-ppx";
-    rev = "v${version}";
-    sha256 = "sha256-+WJhA2ixZHiSZBoX14dnQKk7JfVAIME4JooNSnhRp44=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-u49JHC8K5iMCOQRPYaMl00npJsIE6ePaeJ2jP/vnuvw=";
   };
 
   nativeBuildInputs = [ reason ];
@@ -42,6 +39,7 @@ buildDunePackage rec {
   doCheck = true;
 
   meta = {
+    broken = lib.versionAtLeast ocaml.version "5.4";
     homepage = "https://github.com/reasonml-community/graphql_ppx";
     description = "GraphQL PPX rewriter for Bucklescript/ReasonML";
     license = lib.licenses.mit;
@@ -50,4 +48,4 @@ buildDunePackage rec {
       jtcoolen
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/copier/default.nix b/pkgs/development/python-modules/copier/default.nix
index af924d10e4ca..ccfd20310fb3 100644
--- a/pkgs/development/python-modules/copier/default.nix
+++ b/pkgs/development/python-modules/copier/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "copier";
-  version = "9.10.2";
+  version = "9.10.3";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm $out/tests/demo/doc/ma*ana.txt
     '';
-    hash = "sha256-vO807Jzl04DkiHPBhu3cGK0bhn2Cd2dT1nKznQKP/p0=";
+    hash = "sha256-ZBRJ4FrdhtKr273D2amwA3dJhISZAORqFqoh//963Fg=";
   };
 
   POETRY_DYNAMIC_VERSIONING_BYPASS = version;
diff --git a/pkgs/development/python-modules/cyclopts/default.nix b/pkgs/development/python-modules/cyclopts/default.nix
index f01ac6e888cc..d2b79bff7003 100644
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -4,12 +4,11 @@
   buildPythonPackage,
   docstring-parser,
   fetchFromGitHub,
-  poetry-core,
-  poetry-dynamic-versioning,
+  hatchling,
+  hatch-vcs,
   pydantic,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   pyyaml,
   rich-rst,
   rich,
@@ -18,21 +17,19 @@
 
 buildPythonPackage rec {
   pname = "cyclopts";
-  version = "3.24.0";
+  version = "4.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.12";
-
   src = fetchFromGitHub {
     owner = "BrianPugh";
     repo = "cyclopts";
     tag = "v${version}";
-    hash = "sha256-gJflZBH3xCGKffKGt7y1xGXQR8C1wK19LnbunZ0kbAc=";
+    hash = "sha256-efc3P5xOy6YTWoCNOjatjELOEUh6Obfkf8U94GO4+40=";
   };
 
   build-system = [
-    poetry-core
-    poetry-dynamic-versioning
+    hatchling
+    hatch-vcs
   ];
 
   dependencies = [
@@ -51,15 +48,19 @@ buildPythonPackage rec {
     pydantic
     pytest-mock
     pytestCheckHook
-    pyyaml
   ]
   ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "cyclopts" ];
 
   disabledTests = [
-    # Assertion error
-    "test_pydantic_error_msg"
+    # Test requires bash
+    "test_positional_not_treated_as_command"
+  ];
+
+  disabledTestPaths = [
+    # Tests requires sphinx
+    "tests/test_sphinx_ext.py"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/django-treenode/default.nix b/pkgs/development/python-modules/django-treenode/default.nix
new file mode 100644
index 000000000000..a445a478121d
--- /dev/null
+++ b/pkgs/development/python-modules/django-treenode/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-treenode";
+  version = "0.23.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fabiocaccamo";
+    repo = "django-treenode";
+    tag = version;
+    hash = "sha256-9AG8ntuXHB3jUHRKFDh7OOT5c0Nt8uAZnf5dR7xC/Bc=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    django
+  ];
+
+  pythonImportsCheck = [
+    "treenode"
+  ];
+
+  meta = {
+    description = "Deciduous_tree: probably the best abstract model/admin for your tree based stuff";
+    homepage = "https://github.com/fabiocaccamo/django-treenode";
+    changelog = "https://github.com/fabiocaccamo/django-treenode/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ leona ];
+  };
+}
diff --git a/pkgs/development/python-modules/gotenberg-client/default.nix b/pkgs/development/python-modules/gotenberg-client/default.nix
index 3f2cb9c04844..85a752ea301d 100644
--- a/pkgs/development/python-modules/gotenberg-client/default.nix
+++ b/pkgs/development/python-modules/gotenberg-client/default.nix
@@ -9,14 +9,14 @@
 }:
 buildPythonPackage rec {
   pname = "gotenberg-client";
-  version = "0.11.0";
+  version = "0.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stumpylog";
     repo = "gotenberg-client";
     tag = version;
-    hash = "sha256-a/GXVhZtxGgmx5mb8hozbXAI9ecrl0c6BIz3BNekA8Q=";
+    hash = "sha256-+beO1Pp+ikfk4gqpfvIEHCOPZGLanGX6Kw4mqJglJTI=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index 449ec4e2d1c7..237660e41a60 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "8.6.0";
+  version = "8.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-parser";
     tag = version;
-    hash = "sha256-OHyOlqZpevWEhFAa12VDimMT261A9DK+Cx67TDjh7rg=";
+    hash = "sha256-lKHtKrR5bjBuqBvfsMAIR3K+ERhITBXzrxAvvYopDiM=";
   };
 
   pythonRelaxDeps = [ "regex" ];
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
index ee8f8106657a..aaae68d75956 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -2,8 +2,7 @@
 let
   version = "3.11.0";
   srcHash = "sha256-mLyEHNMePVZI6MOSyeD9NMp9QXRXQ7h3LFSxHxpf878=";
-  # The tarball contains vendored dependencies
-  vendorHash = null;
+  vendorHash = null; # The tarball contains vendored dependencies
 in
 {
   inherit version vendorHash;
@@ -38,11 +37,11 @@ in
     "-X go.woodpecker-ci.org/woodpecker/v3/version.Version=${version}"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://woodpecker-ci.org/";
     changelog = "https://github.com/woodpecker-ci/woodpecker/blob/v${version}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       ambroisie
       marcusramberg
       techknowlogick
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/update.sh b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
index 98c2888c27de..10b16d9f5062 100755
--- a/pkgs/development/tools/continuous-integration/woodpecker/update.sh
+++ b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
@@ -28,5 +28,5 @@ sed -i -E -e "s#version = \".*\"#version = \"$version\"#" common.nix
 
 # Woodpecker repository
 src_hash=$(nix-prefetch-url --type sha256 --unpack "https://github.com/woodpecker-ci/woodpecker/releases/download/v$version/woodpecker-src.tar.gz")
-src_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$src_hash")
+src_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$src_hash")
 sed -i -E -e "s#srcHash = \".*\"#srcHash = \"$src_hash\"#" common.nix
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 559da3d2c48d..15977020a903 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -395,6 +395,17 @@ in
     ];
   };
 
+  ubootNanoPiR5S = buildUBoot {
+    defconfig = "nanopi-r5s-rk3568_defconfig";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    BL31 = rkbin.BL31_RK3568;
+    ROCKCHIP_TPL = rkbin.TPL_RK3568;
+    filesToInstall = [
+      "idbloader.img"
+      "u-boot.itb"
+    ];
+  };
+
   ubootNovena = buildUBoot {
     defconfig = "novena_defconfig";
     extraMeta.platforms = [ "armv7l-linux" ];
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 1cf9b2ead31d..6b27f1331d29 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.12.53";
-      hash = "sha256-BhaWUdfCgIvD0LA69I1NVIW0rv6JWQs+7HNLxOkrmGc=";
+      version = "6.12.54";
+      hash = "sha256-8ZeVHP8voR4GJfBB1iM8ZDx4QgCd83tJ7IkpJNW63ME=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.17.3";
-      hash = "sha256-VL1SCMB89P0UcCbtPdkjxcCZqQZpnSTlzzf9e8uzkyA=";
+      version = "6.17.4";
+      hash = "sha256-UHfZwK0qIVhiKw8OpE8i+V2BRav6Fsju8E5rO5WRwVA=";
     };
   };
 
diff --git a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
index fa58af91cb6c..1d9bd45d3680 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_ivm";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchFromGitHub {
     owner = "sraoss";
     repo = "pg_ivm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UeRcxoUkpPw4EcQXKUxHamjczOaE59d00kSrYsijnH8=";
+    hash = "sha256-DKU5jwnRo/kMycnq4nAdQTiZwv/wXybyjXLtz4xdaBo=";
   };
 
   meta = {
diff --git a/pkgs/tools/misc/qt6gtk2/default.nix b/pkgs/tools/misc/qt6gtk2/default.nix
index b2ffaac64abe..0bcd31da1850 100644
--- a/pkgs/tools/misc/qt6gtk2/default.nix
+++ b/pkgs/tools/misc/qt6gtk2/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qt6gtk2";
-  version = "0.5";
+  version = "0.6";
 
   src = fetchFromGitLab {
     domain = "opencode.net";
     owner = "trialuser";
     repo = "qt6gtk2";
     tag = finalAttrs.version;
-    hash = "sha256-G2TQ4LU8Cmvd+u6/s1ugbUkZcRXHTBm3+ISY0g/5/60=";
+    hash = "sha256-RJybIm0HllnYaPfsnci+9ZCGvvL9F2MC7dDbiK+L7bU=";
   };
 
   buildInputs = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "GTK+2.0 integration plugins for Qt6";
     license = lib.licenses.gpl2Plus;
-    homepage = "https://github.com/trialuser02/qt6gtk2";
+    homepage = "https://www.opencode.net/trialuser/qt6gtk2";
     maintainers = [ lib.maintainers.misterio77 ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7ef7b7efec0c..47c402f8de00 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10350,6 +10350,7 @@ with pkgs;
     ubootLibreTechCC
     ubootNanoPCT4
     ubootNanoPCT6
+    ubootNanoPiR5S
     ubootNovena
     ubootOdroidC2
     ubootOdroidXU3
@@ -13126,13 +13127,8 @@ with pkgs;
 
   qgo = libsForQt5.callPackage ../games/qgo { };
 
-  anki = callPackage ../games/anki {
-    protobuf = protobuf_31;
-  };
-  anki-utils = callPackage ../games/anki/addons/anki-utils.nix { };
-  ankiAddons = recurseIntoAttrs (callPackage ../games/anki/addons { });
-  anki-bin = callPackage ../games/anki/bin.nix { };
-  anki-sync-server = callPackage ../games/anki/sync-server.nix { };
+  anki-utils = callPackage ../by-name/an/anki/addons/anki-utils.nix { };
+  ankiAddons = recurseIntoAttrs (callPackage ../by-name/an/anki/addons { });
 
   art = callPackage ../by-name/ar/art/package.nix {
     fftw = fftwSinglePrec;
diff --git a/pkgs/top-level/by-name-overlay.nix b/pkgs/top-level/by-name-overlay.nix
index 9a011439596a..e6fe5b721556 100644
--- a/pkgs/top-level/by-name-overlay.nix
+++ b/pkgs/top-level/by-name-overlay.nix
@@ -41,10 +41,6 @@ let
   # if the overlay has to be applied multiple times
   packageFiles = mergeAttrsList (mapAttrsToList namesForShard (readDir baseDirectory));
 in
-# TODO: Consider optimising this using `builtins.deepSeq packageFiles`,
-# which could free up the above thunks and reduce GC times.
-# Currently this would be hard to measure until we have more packages
-# and ideally https://github.com/NixOS/nix/pull/8895
 self: super:
 {
   # This attribute is necessary to allow CI to ensure that all packages defined in `pkgs/by-name`
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b7f902a851f2..b7a729d6c385 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4164,6 +4164,8 @@ self: super: with self; {
 
   django-treebeard = callPackage ../development/python-modules/django-treebeard { };
 
+  django-treenode = callPackage ../development/python-modules/django-treenode { };
+
   django-two-factor-auth = callPackage ../development/python-modules/django-two-factor-auth { };
 
   django-types = callPackage ../development/python-modules/django-types { };