diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9b0b3417b9d6..04a1e3c0b6d3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5471,12 +5471,6 @@
     name = "Dima";
     keys = [ { fingerprint = "1C4E F4FE 7F8E D8B7 1E88 CCDF BAB1 D15F B7B4 D4CE"; } ];
   };
-  d-xo = {
-    email = "hi@d-xo.org";
-    github = "d-xo";
-    githubId = 6689924;
-    name = "David Terry";
-  };
   d3vil0p3r = {
     name = "Antonio Voza";
     email = "vozaanthony@gmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 4b0a2c4395d1..683724e11fc7 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -120,6 +120,10 @@
 
 - `services.ntpd-rs` now performs configuration validation.
 
+- `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
+
+- `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.pfix-srsd.configurePostfix](#opt-services.pfix-srsd.configurePostfix) option.
+
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
 
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
diff --git a/nixos/modules/services/mail/pfix-srsd.nix b/nixos/modules/services/mail/pfix-srsd.nix
index fb6a395e3ab8..035f331dcf6d 100644
--- a/nixos/modules/services/mail/pfix-srsd.nix
+++ b/nixos/modules/services/mail/pfix-srsd.nix
@@ -4,6 +4,10 @@
   pkgs,
   ...
 }:
+
+let
+  cfg = config.services.pfix-srsd;
+in
 {
 
   ###### interface
@@ -32,27 +36,46 @@
         type = lib.types.path;
         default = "/var/lib/pfix-srsd/secrets";
       };
+
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to configure the required settings to use pfix-srsd in the local Postfix instance.
+        '';
+      };
     };
   };
 
   ###### implementation
 
-  config = lib.mkIf config.services.pfix-srsd.enable {
-    environment = {
-      systemPackages = [ pkgs.pfixtools ];
-    };
-
-    systemd.services.pfix-srsd = {
-      description = "Postfix sender rewriting scheme daemon";
-      before = [ "postfix.service" ];
-      #note that we use requires rather than wants because postfix
-      #is unable to process (almost) all mail without srsd
-      requiredBy = [ "postfix.service" ];
-      serviceConfig = {
-        Type = "forking";
-        PIDFile = "/run/pfix-srsd.pid";
-        ExecStart = "${pkgs.pfixtools}/bin/pfix-srsd -p /run/pfix-srsd.pid -I ${config.services.pfix-srsd.domain} ${config.services.pfix-srsd.secretsFile}";
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
+      services.postfix.config = {
+        sender_canonical_maps = [ "tcp:127.0.0.1:10001" ];
+        sender_canonical_classes = [ "envelope_sender" ];
+        recipient_canonical_maps = [ "tcp:127.0.0.1:10002" ];
+        recipient_canonical_classes = [ "envelope_recipient" ];
       };
-    };
-  };
+    })
+
+    (lib.mkIf cfg.enable {
+      environment = {
+        systemPackages = [ pkgs.pfixtools ];
+      };
+
+      systemd.services.pfix-srsd = {
+        description = "Postfix sender rewriting scheme daemon";
+        before = [ "postfix.service" ];
+        #note that we use requires rather than wants because postfix
+        #is unable to process (almost) all mail without srsd
+        requiredBy = [ "postfix.service" ];
+        serviceConfig = {
+          Type = "forking";
+          PIDFile = "/run/pfix-srsd.pid";
+          ExecStart = "${pkgs.pfixtools}/bin/pfix-srsd -p /run/pfix-srsd.pid -I ${config.services.pfix-srsd.domain} ${config.services.pfix-srsd.secretsFile}";
+        };
+      };
+    })
+  ];
 }
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 7b2d62e1fc97..710f2d381e6a 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -785,12 +785,6 @@ in
         description = "Maps to be compiled and placed into /var/lib/postfix/conf.";
       };
 
-      useSrs = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to enable sender rewriting scheme";
-      };
-
     };
 
   };
@@ -808,8 +802,6 @@ in
           systemPackages = [ pkgs.postfix ];
         };
 
-        services.pfix-srsd.enable = config.services.postfix.useSrs;
-
         services.mail.sendmailSetuidWrapper = lib.mkIf config.services.postfix.setSendmail {
           program = "sendmail";
           source = "${pkgs.postfix}/bin/sendmail";
@@ -1002,12 +994,6 @@ in
             ] ++ lib.optional haveAliases "$alias_maps";
           }
           // lib.optionalAttrs (cfg.dnsBlacklists != [ ]) { smtpd_client_restrictions = clientRestrictions; }
-          // lib.optionalAttrs cfg.useSrs {
-            sender_canonical_maps = [ "tcp:127.0.0.1:10001" ];
-            sender_canonical_classes = [ "envelope_sender" ];
-            recipient_canonical_maps = [ "tcp:127.0.0.1:10002" ];
-            recipient_canonical_classes = [ "envelope_recipient" ];
-          }
           // lib.optionalAttrs cfg.enableHeaderChecks {
             header_checks = [ "regexp:/etc/postfix/header_checks" ];
           }
@@ -1190,5 +1176,6 @@ in
       [ "services" "postfix" "config" "smtp_tls_security_level" ]
       (config: lib.mkIf config.services.postfix.useDane "dane")
     )
+    (lib.mkRenamedOptionModule [ "services" "postfix" "useSrs" ] [ "services" "pfix-srsd" "enable" ])
   ];
 }
diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix
index bc91edbbe000..b264d17a1911 100644
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@@ -2,37 +2,67 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 let
 
   cfg = config.services.postsrsd;
-  runtimeDirectoryName = "postsrsd";
-  runtimeDirectory = "/run/${runtimeDirectoryName}";
-  # TODO: follow RFC 42, but we need a libconfuse format first:
-  #       https://github.com/NixOS/nixpkgs/issues/401565
-  # Arrays in `libconfuse` look like this: {"Life", "Universe", "Everything"}
-  # See https://www.nongnu.org/confuse/tutorial-html/ar01s03.html.
-  #
-  # Note: We're using `builtins.toJSON` to escape strings, but JSON strings
-  # don't have exactly the same semantics as libconfuse strings. For example,
-  # "${F}" gets treated as an env var reference, see above issue for details.
-  libconfuseDomains = "{ " + lib.concatMapStringsSep ", " builtins.toJSON cfg.domains + " }";
-  configFile = pkgs.writeText "postsrsd.conf" ''
-    secrets-file = "''${CREDENTIALS_DIRECTORY}/secrets-file"
-    domains = ${libconfuseDomains}
-    separator = "${cfg.separator}"
-    socketmap = "unix:${cfg.socketPath}"
 
-    # Disable postsrsd's jailing in favor of confinement with systemd.
-    unprivileged-user = ""
-    chroot-dir = ""
-  '';
+  inherit (lib)
+    concatMapStringsSep
+    concatMapAttrsStringSep
+    isBool
+    isFloat
+    isInt
+    isPath
+    isString
+    isList
+    mkEnableOption
+    mkPackageOption
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    ;
 
+  # This is a implementation of a simple libconfuse config renderer sufficient
+  # for the postsrsd configuration file complexity.
+  # TODO: Replace with pkgs.formats.libconfuse, once implemented (https://github.com/NixOS/nixpkgs/issues/401565)
+  renderValue =
+    value:
+    if isBool value then
+      if value then "true" else "false"
+    else if isString value || isPath value then
+      builtins.toJSON value # for escaping
+    else if isInt value || isFloat value then
+      toString value
+    else if isList value then
+      "{${concatMapStringsSep "," renderValue value}}"
+    else
+      throw "postsrsd: unsupported value type in settings option";
+
+  renderAttr =
+    attrs: concatMapAttrsStringSep "\n" (name: value: "${name} = ${renderValue value}") attrs;
+
+  configFile = pkgs.writeText "postsrsd.conf" (
+    renderAttr (lib.filterAttrsRecursive (_: v: v != null) cfg.settings)
+  );
 in
 {
   imports =
-    map
+    [
+      (mkRemovedOptionModule [ "services" "postsrsd" "socketPath" ] ''
+        Configure/reference `services.postsrsd.settings.socketmap` instead. Note that its now required to start with the `inet:` or `unix:` prefix.
+      '')
+      (mkRenamedOptionModule
+        [ "services" "postsrsd" "domains" ]
+        [ "services" "postsrsd" "settings" "domains" ]
+      )
+      (mkRenamedOptionModule
+        [ "services" "postsrsd" "separator" ]
+        [ "services" "postsrsd" "settings" "separator" ]
+      )
+    ]
+    ++ map
       (
         name:
         lib.mkRemovedOptionModule [ "services" "postsrsd" name ] ''
@@ -53,33 +83,140 @@ in
 
   options = {
     services.postsrsd = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to enable the postsrsd SRS server for Postfix.";
-      };
+      enable = mkEnableOption "the postsrsd SRS server for Postfix.";
+
+      package = mkPackageOption pkgs "postsrsd" { };
 
       secretsFile = lib.mkOption {
         type = lib.types.path;
         default = "/var/lib/postsrsd/postsrsd.secret";
-        description = "Secret keys used for signing and verification";
+        description = ''
+          Secret keys used for signing and verification.
+
+          ::: {.note}
+          The secret will be generated, if it does not exist at the given path.
+          :::
+        '';
       };
 
-      domains = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        description = "Domain names for rewrite";
-        default = [ config.networking.hostName ];
-        defaultText = lib.literalExpression "[ config.networking.hostName ]";
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType =
+            with lib.types;
+            attrsOf (oneOf [
+              bool
+              float
+              int
+              path
+              str
+              (listOf str)
+            ]);
+
+          options = {
+            domains = lib.mkOption {
+              type = with lib.types; listOf str;
+              default = [ ];
+              example = [ "example.com" ];
+              description = ''
+                List of local domains, that do not require rewriting.
+              '';
+            };
+
+            secrets-file = lib.mkOption {
+              type = lib.types.str;
+              default = "\${CREDENTIALS_DIRECTORY}/secrets-file";
+              readOnly = true;
+              description = ''
+                Path to the file containing the secret keys.
+
+                ::: {.note}
+                Secrets are passed using `LoadCredential=` on the systemd unit,
+                so this options is read-only.
+
+                Configure {option}`services.postsrsd.secretsFile` instead.
+              '';
+            };
+
+            separator = lib.mkOption {
+              type = lib.types.enum [
+                "-"
+                "="
+                "+"
+              ];
+              default = "=";
+              description = ''
+                SRS tag separator used in generated sender addresses.
+
+                Unless you have a very good reason, you should leave this
+                setting at its default.
+              '';
+            };
+
+            srs-domain = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              example = "srs.example.com";
+              description = ''
+                Dedicated mail domain used for ephemeral SRS envelope addresses.
+
+                Recommended to configure, when hosting multiple unrelated mail
+                domains (e.g. for different customers), to prevent privacy
+                issues.
+
+                Set to `null` to not configure any `srs-domain`.
+              '';
+            };
+
+            socketmap = lib.mkOption {
+              type = lib.types.strMatching "^(unix|inet):.+";
+              default = "unix:/run/postsrsd/socket";
+              example = "inet:localhost:10003";
+              description = ''
+                Listener configuration in socket map format native to Postfix configuration.
+              '';
+            };
+
+            chroot-dir = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              readOnly = true;
+              description = ''
+                Path to chroot into at runtime as an additional layer of protection.
+
+                ::: {.note}
+                We confine the runtime environment through systemd hardening instead, so this option is read-only.
+                :::
+              '';
+            };
+
+            unprivileged-user = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              readOnly = true;
+              description = ''
+                Unprivileged user to drop privileges to.
+
+                ::: {.note}
+                Our systemd unit never runs postsrsd as a privileged process, so this option is read-only.
+                :::
+              '';
+            };
+          };
+        };
+        default = { };
+        description = ''
+          Configuration options for the postsrsd.conf file.
+
+          See the [example configuration](https://github.com/roehling/postsrsd/blob/${cfg.package.version}/doc/postsrsd.conf) for possible values.
+        '';
       };
 
-      separator = lib.mkOption {
-        type = lib.types.enum [
-          "-"
-          "="
-          "+"
-        ];
-        default = "=";
-        description = "First separator character in generated addresses";
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to configure the required settings to use postsrsd in the local Postfix instance.
+        '';
       };
 
       user = lib.mkOption {
@@ -93,66 +230,120 @@ in
         default = "postsrsd";
         description = "Group for the daemon";
       };
-
-      socketPath = lib.mkOption {
-        type = lib.types.path;
-        default = "${runtimeDirectory}/socket";
-        readOnly = true;
-        description = ''
-          Path to the Unix socket for connecting to postsrsd.
-          Read-only, intended for usage when integrating postsrsd into other NixOS config.'';
-      };
     };
   };
 
-  config = lib.mkIf cfg.enable {
-    users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
-      postsrsd = {
-        group = cfg.group;
-        uid = config.ids.uids.postsrsd;
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
+      services.postfix.config = {
+        # https://github.com/roehling/postsrsd#configuration
+        sender_canonical_maps = "socketmap:${cfg.settings.socketmap}:forward";
+        sender_canonical_classes = "envelope_sender";
+        recipient_canonical_maps = "socketmap:${cfg.settings.socketmap}:reverse";
+        recipient_canonical_classes = [
+          "envelope_recipient"
+          "header_recipient"
+        ];
       };
-    };
 
-    users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
-      postsrsd.gid = config.ids.gids.postsrsd;
-    };
+      users.users.postfix.extraGroups = [ cfg.group ];
+    })
 
-    systemd.services.postsrsd-generate-secrets = {
-      path = [ pkgs.coreutils ];
-      script = ''
-        if [ -e "${cfg.secretsFile}" ]; then
-          echo "Secrets file exists. Nothing to do!"
-        else
-          echo "WARNING: secrets file not found, autogenerating!"
-          DIR="$(dirname "${cfg.secretsFile}")"
-          install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
-          install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
-        fi
-      '';
-      serviceConfig = {
-        Type = "oneshot";
+    (lib.mkIf cfg.enable {
+      users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
+        postsrsd = {
+          group = cfg.group;
+          uid = config.ids.uids.postsrsd;
+        };
       };
-    };
 
-    systemd.services.postsrsd = {
-      description = "PostSRSd SRS rewriting server";
-      after = [
-        "network.target"
-        "postsrsd-generate-secrets.service"
-      ];
-      before = [ "postfix.service" ];
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postsrsd-generate-secrets.service" ];
-      confinement.enable = true;
-
-      serviceConfig = {
-        ExecStart = "${lib.getExe pkgs.postsrsd} -C ${configFile}";
-        User = cfg.user;
-        Group = cfg.group;
-        PermissionsStartOnly = true;
-        RuntimeDirectory = runtimeDirectoryName;
-        LoadCredential = "secrets-file:${cfg.secretsFile}";
+      users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
+        postsrsd.gid = config.ids.gids.postsrsd;
       };
-    };
-  };
+
+      systemd.services.postsrsd-generate-secrets = {
+        path = [ pkgs.coreutils ];
+        script = ''
+          if [ -e "${cfg.secretsFile}" ]; then
+            echo "Secrets file exists. Nothing to do!"
+          else
+            echo "WARNING: secrets file not found, autogenerating!"
+            DIR="$(dirname "${cfg.secretsFile}")"
+            install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
+            install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
+          fi
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+        };
+      };
+
+      environment.etc."postsrsd.conf".source = configFile;
+
+      systemd.services.postsrsd = {
+        description = "PostSRSd SRS rewriting server";
+        after = [
+          "network.target"
+          "postsrsd-generate-secrets.service"
+        ];
+        before = [ "postfix.service" ];
+        wantedBy = [ "multi-user.target" ];
+        requires = [ "postsrsd-generate-secrets.service" ];
+        restartTriggers = [ configFile ];
+
+        serviceConfig = {
+          ExecStart = utils.escapeSystemdExecArgs [
+            (lib.getExe cfg.package)
+            "-C"
+            "/etc/postsrsd.conf"
+          ];
+          User = cfg.user;
+          Group = cfg.group;
+          RuntimeDirectory = "postsrsd";
+          RuntimeDirectoryMode = "0750";
+          LoadCredential = "secrets-file:${cfg.secretsFile}";
+
+          CapabilityBoundingSet = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateNetwork = lib.hasPrefix "unix:" cfg.settings.socketmap;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          RemoveIPC = true;
+          RestrictAddressFamilies =
+            if lib.hasPrefix "unix:" cfg.settings.socketmap then
+              [ "AF_UNIX" ]
+            else
+              [
+                "AF_INET"
+                "AF_INET6"
+              ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged @resources"
+          ];
+          UMask = "0027";
+        };
+      };
+    })
+  ];
+
+  # package version referenced in option documentation
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 3eaed22f3d35..6eeca99434e1 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -171,14 +171,6 @@ let
           quic_bpf on;
         ''}
 
-        ${optionalString cfg.experimentalZstdSettings ''
-          zstd on;
-          zstd_comp_level 9;
-          zstd_min_length 256;
-          zstd_static on;
-          zstd_types ${lib.concatStringsSep " " compressMimeTypes};
-        ''}
-
         ${cfg.config}
 
         ${optionalString (cfg.eventsConfig != "" || cfg.config == "") ''
@@ -250,7 +242,7 @@ let
               ''
             }
 
-            ${optionalString cfg.recommendedZstdSettings ''
+            ${optionalString cfg.experimentalZstdSettings ''
               zstd on;
               zstd_comp_level 9;
               zstd_min_length 256;
diff --git a/nixos/tests/bazarr.nix b/nixos/tests/bazarr.nix
index 48206ce6e2f4..0487a0d31514 100644
--- a/nixos/tests/bazarr.nix
+++ b/nixos/tests/bazarr.nix
@@ -5,7 +5,6 @@ let
 in
 {
   name = "bazarr";
-  meta.maintainers = with lib.maintainers; [ d-xo ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/nixos/tests/wireguard/wg-quick.nix b/nixos/tests/wireguard/wg-quick.nix
index 981e741d32d2..be258e1e7ed1 100644
--- a/nixos/tests/wireguard/wg-quick.nix
+++ b/nixos/tests/wireguard/wg-quick.nix
@@ -18,9 +18,6 @@ import ../make-test-python.nix (
   in
   {
     name = "wg-quick";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ d-xo ];
-    };
 
     nodes = {
       peer0 = peer {
diff --git a/pkgs/applications/graphics/gimp/2.0/default.nix b/pkgs/applications/graphics/gimp/2.0/default.nix
index d91dd67a1913..e28e084ccb60 100644
--- a/pkgs/applications/graphics/gimp/2.0/default.nix
+++ b/pkgs/applications/graphics/gimp/2.0/default.nix
@@ -89,6 +89,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./force-enable-libheif.patch
   ];
 
+  # error: possibly undefined macro: AM_NLS
+  preAutoreconf = ''
+    cp ${gettext}/share/gettext/m4/nls.m4 m4macros
+  '';
+
   nativeBuildInputs =
     [
       autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
diff --git a/pkgs/by-name/ai/airwindows/package.nix b/pkgs/by-name/ai/airwindows/package.nix
index 076461496102..6aceb886d9c1 100644
--- a/pkgs/by-name/ai/airwindows/package.nix
+++ b/pkgs/by-name/ai/airwindows/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2025-06-28";
+  version = "0-unstable-2025-07-06";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "8aedc304ed6fd44dd170cbfc6a43a3f138835af9";
-    hash = "sha256-pQOuhXypo55GqsoCmhpjQkSIsEOVL7y6xqmMqP8yzqI=";
+    rev = "4a19d80d3d2a64a8773ca319a5002ac5eefbf69c";
+    hash = "sha256-aMPe1D1/hIVY4DGKzmX/HUO04pZVBtivhVzoeG02emY=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables
diff --git a/pkgs/by-name/ba/bazarr/package.nix b/pkgs/by-name/ba/bazarr/package.nix
index 847a73607540..2be266020229 100644
--- a/pkgs/by-name/ba/bazarr/package.nix
+++ b/pkgs/by-name/ba/bazarr/package.nix
@@ -66,7 +66,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.bazarr.media/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ d-xo ];
     mainProgram = "bazarr";
     platforms = platforms.all;
   };
diff --git a/pkgs/by-name/bt/btc-rpc-explorer/package.nix b/pkgs/by-name/bt/btc-rpc-explorer/package.nix
index 912c34f69ed8..26745f66b7af 100644
--- a/pkgs/by-name/bt/btc-rpc-explorer/package.nix
+++ b/pkgs/by-name/bt/btc-rpc-explorer/package.nix
@@ -43,7 +43,6 @@ buildNpmPackage rec {
     homepage = "https://github.com/janoside/btc-rpc-explorer";
     license = lib.licenses.mit;
     mainProgram = "btc-rpc-explorer";
-    maintainers = with lib.maintainers; [ d-xo ];
     broken = true;
     # At 2024-06-29
     # https://hydra.nixos.org/build/264232177/nixlog/1
diff --git a/pkgs/by-name/ca/cargo-llvm-lines/package.nix b/pkgs/by-name/ca/cargo-llvm-lines/package.nix
index 027ff4b7c512..eddc054a4ef3 100644
--- a/pkgs/by-name/ca/cargo-llvm-lines/package.nix
+++ b/pkgs/by-name/ca/cargo-llvm-lines/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-lines";
-  version = "0.4.42";
+  version = "0.4.43";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-llvm-lines";
     rev = version;
-    hash = "sha256-qKdxnISussiyp1ylahS7qOdMfOGwJnlbWrgEHf/L2y0=";
+    hash = "sha256-fYoVPm3RxR1LZ8wJQpXQG3g69Fh7LLFwXZXmj+kr8zc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Ppuc6Dx3Y4JJ8doEJPCbwnD1+dQSLRuPdWfab+3q2Ug=";
+  cargoHash = "sha256-yhZ2MKswFvzkMamI9np7CRsQO4D/sldumaLPzSNsHgA=";
 
   meta = with lib; {
     description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
diff --git a/pkgs/by-name/ca/cargo-nextest/package.nix b/pkgs/by-name/ca/cargo-nextest/package.nix
index 8fa6cf57bca1..b51e26c09c96 100644
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.99";
+  version = "0.9.100";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-I1m4dURisTa4qwUilb8s8bvTsfMSodbZQxRlNDViFeM=";
+    hash = "sha256-MbgX/n6TC5hz66gvRAc7A0xFWbF2Ec68gMxCgPFpeoQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-f75yHVvxC+QhNmn1PUafviONLjrXhcNmMitFU06yAaQ=";
+  cargoHash = "sha256-jRBFjJB38JI9whFpImYlMx0znQj1+cdeu4Nc+nYc7OI=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ca/cargo-tally/package.nix b/pkgs/by-name/ca/cargo-tally/package.nix
index 129dd87cf991..0cb8651fc053 100644
--- a/pkgs/by-name/ca/cargo-tally/package.nix
+++ b/pkgs/by-name/ca/cargo-tally/package.nix
@@ -6,15 +6,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.65";
+  version = "1.0.66";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-cvMB/hMq0LCfuXHX1Gg0c3i69T1uQWKIddUru5dcg7g=";
+    hash = "sha256-PC/gscMO7oYcsd/cVcP5WZYweWRsh23Z7Do/qeGjAOc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ReVLeyQY08i1sH6IujeLK8y1+PfPm8BoYInzbTHHnlw=";
+  cargoHash = "sha256-00J8ip2fr/nphY0OXVOLKv7gaHitMziwsdJ4YBaYxog=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";
diff --git a/pkgs/by-name/di/difftastic/package.nix b/pkgs/by-name/di/difftastic/package.nix
index 5f51ce0129d0..fc0d2406a5a1 100644
--- a/pkgs/by-name/di/difftastic/package.nix
+++ b/pkgs/by-name/di/difftastic/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  stdenv,
   versionCheckHook,
   nix-update-script,
 }:
@@ -20,6 +21,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   useFetchCargoVendor = true;
   cargoHash = "sha256-1u3oUbqhwHXD90ld70pjK2XPJe5hpUbJtU78QpIjAE8=";
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isStatic { RUSTFLAGS = "-C relocation-model=static"; };
+
   # skip flaky tests
   checkFlags = [ "--skip=options::tests::test_detect_display_width" ];
 
diff --git a/pkgs/by-name/er/erigon/package.nix b/pkgs/by-name/er/erigon/package.nix
index af42b9c3e670..89c6479b35ca 100644
--- a/pkgs/by-name/er/erigon/package.nix
+++ b/pkgs/by-name/er/erigon/package.nix
@@ -67,7 +67,6 @@ buildGoModule {
       gpl3Plus
     ];
     maintainers = with maintainers; [
-      d-xo
       happysalada
     ];
   };
diff --git a/pkgs/by-name/es/esp-generate/package.nix b/pkgs/by-name/es/esp-generate/package.nix
index b0cc10b7d621..54005d424256 100644
--- a/pkgs/by-name/es/esp-generate/package.nix
+++ b/pkgs/by-name/es/esp-generate/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "esp-generate";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "esp-rs";
     repo = "esp-generate";
     rev = "v${version}";
-    hash = "sha256-4RF0XcDpUcMQ0u2FTRBnZdQDM7DlaI7pl5HukMbbbBE=";
+    hash = "sha256-rvgmmG0LhRb+eRdqmlCf514lzV0QGWPaJ8pnlTnxfvo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-c/BYf6SXOdI/K4t3fT4ycuILkIYCiSbHafLprSMvK8E=";
+  cargoHash = "sha256-ai8FUKHK/iHeUEgklZEDAMKoorXVDxGSZVrB7LahVV8=";
 
   meta = {
     description = "Template generation tool to create no_std applications targeting Espressif's chips";
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 28a769b5bff1..018a519aa37c 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -34,14 +34,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.6.3";
+  version = "2025.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-3Xcxn12QKQg0jxdOPP7y01YaikvxmPPX9JL2JBvdsUM=";
+    hash = "sha256-EUnptlO9Ya6GWLP7FU3gWOAs2O5xzrHhyHr8LpomapY=";
   };
 
   build-system = with python.pkgs; [
@@ -82,6 +82,7 @@ python.pkgs.buildPythonApplication rec {
     esphome-glyphsets
     freetype-py
     icmplib
+    jinja2
     kconfiglib
     packaging
     paho-mqtt
@@ -135,25 +136,9 @@ python.pkgs.buildPythonApplication rec {
     ]
     ++ [ versionCheckHook ];
 
-  disabledTests = [
-    # race condition, also visible in upstream tests
-    # tests/dashboard/test_web_server.py:78: IndexError
-    "test_devices_page"
-
+  disabledTestPaths = [
     # platformio builds; requires networking for dependency resolution
-    "test_api_message_size_batching"
-    "test_host_mode_basic"
-    "test_host_mode_batch_delay"
-    "test_host_mode_empty_string_options"
-    "test_host_mode_entity_fields"
-    "test_host_mode_fan_preset"
-    "test_host_mode_many_entities"
-    "test_host_mode_many_entities_multiple_connections"
-    "test_host_mode_noise_encryption"
-    "test_host_mode_noise_encryption_wrong_key"
-    "test_host_mode_reconnect"
-    "test_host_mode_with_sensor"
-    "test_large_message_batching"
+    "tests/integration"
   ];
 
   preCheck = ''
diff --git a/pkgs/by-name/ga/gatekeeper/package.nix b/pkgs/by-name/ga/gatekeeper/package.nix
index ccf0a13a6832..7621c2984653 100644
--- a/pkgs/by-name/ga/gatekeeper/package.nix
+++ b/pkgs/by-name/ga/gatekeeper/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gatekeeper";
-  version = "3.19.2";
+  version = "3.19.3";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "gatekeeper";
     tag = "v${version}";
-    hash = "sha256-ksspmNq42Wn/4Uzi8omvzCCprP+ELHVGBImgi8GrMSk=";
+    hash = "sha256-FQ5Q9S/YvJQaa2mUWXv8huTK89SZ31UaFbBCEduGsyg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/hs/hsd/package.nix b/pkgs/by-name/hs/hsd/package.nix
index d259a7bf851d..278f9b6254e9 100644
--- a/pkgs/by-name/hs/hsd/package.nix
+++ b/pkgs/by-name/hs/hsd/package.nix
@@ -40,6 +40,5 @@ buildNpmPackage rec {
     description = "Implementation of the Handshake protocol";
     homepage = "https://github.com/handshake-org/hsd";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ d-xo ];
   };
 }
diff --git a/pkgs/by-name/la/lasuite-meet-frontend/package.nix b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
index 62735ff11cee..f939cd296278 100644
--- a/pkgs/by-name/la/lasuite-meet-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "lasuite-meet-frontend";
-  version = "0.1.27";
+  version = "0.1.28";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
+    hash = "sha256-zB27doGkWch3e1Lc0Q3TurQeplV7vOdzJ+G+MFZI3Og=";
   };
 
   sourceRoot = "source/src/frontend";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   npmDeps = fetchNpmDeps {
     inherit version src;
     sourceRoot = "source/src/frontend";
-    hash = "sha256-7wXzcn6aGAkRUOCI6MU0AlPGngBWJtdbAfnZZDaMWec=";
+    hash = "sha256-ajN3mDIUn8uX+xc3zZmzsFWY8Y5ss9gVeV0s5kJV3fs=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index a7cdc837ed96..6df4b9622dbd 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "0.1.27";
+  version = "0.1.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
+    hash = "sha256-zB27doGkWch3e1Lc0Q3TurQeplV7vOdzJ+G+MFZI3Og=";
   };
 
   sourceRoot = "source/src/backend";
@@ -28,6 +28,8 @@ python.pkgs.buildPythonApplication rec {
   patches = [
     # Support configuration throught environment variables for SECURE_*
     ./secure_settings.patch
+    # Add PKCE option
+    ./pkce.patch
   ];
 
   build-system = with python.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/la/lasuite-meet/pkce.patch b/pkgs/by-name/la/lasuite-meet/pkce.patch
new file mode 100644
index 000000000000..968a38eb3d7b
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-meet/pkce.patch
@@ -0,0 +1,20 @@
+--- a/meet/settings.py
++++ b/meet/settings.py
+@@ -430,6 +430,17 @@ class Base(Configuration):
+     OIDC_RP_SCOPES = values.Value(
+         "openid email", environ_name="OIDC_RP_SCOPES", environ_prefix=None
+     )
++    OIDC_USE_PKCE = values.BooleanValue(
++        default=False, environ_name="OIDC_USE_PKCE", environ_prefix=None
++    )
++    OIDC_PKCE_CODE_CHALLENGE_METHOD = values.Value(
++        default="S256",
++        environ_name="OIDC_PKCE_CODE_CHALLENGE_METHOD",
++        environ_prefix=None,
++    )
++    OIDC_PKCE_CODE_VERIFIER_SIZE = values.IntegerValue(
++        default=64, environ_name="OIDC_PKCE_CODE_VERIFIER_SIZE", environ_prefix=None
++    )
+     LOGIN_REDIRECT_URL = values.Value(
+         None, environ_name="LOGIN_REDIRECT_URL", environ_prefix=None
+     )
diff --git a/pkgs/by-name/li/libeufin/deps.json b/pkgs/by-name/li/libeufin/deps.json
index 1019bab940f7..d4055e8af5a9 100644
--- a/pkgs/by-name/li/libeufin/deps.json
+++ b/pkgs/by-name/li/libeufin/deps.json
@@ -813,8 +813,8 @@
   "org/bouncycastle/bcutil-jdk18on/maven-metadata": {
    "xml": {
     "groupId": "org.bouncycastle",
-    "lastUpdated": "20250114201150",
-    "release": "1.80"
+    "lastUpdated": "20250604080934",
+    "release": "1.81"
    }
   },
   "org/checkerframework#checker-qual/3.48.3": {
@@ -1076,6 +1076,10 @@
   "org/jetbrains/kotlin#kotlin-stdlib-common/1.8.20": {
    "pom": "sha256-YFWRuJs3ISfmspxpMl+i9qjEb0aMRdCUEOeOtZ/IChc="
   },
+  "org/jetbrains/kotlin#kotlin-stdlib-common/1.9.0": {
+   "jar": "sha256-KDJ0IEvXwCB4nsRvj45yr0JE1/VQszkqV+XKAGrXqiw=",
+   "pom": "sha256-NmDTanD+s6vknxG5BjPkHTYnNXbwcbDhCdqbOg3wgqU="
+  },
   "org/jetbrains/kotlin#kotlin-stdlib-common/2.0.20": {
    "module": "sha256-tZe3Be/U4tgnFCCQw2BUJlVI7VG09SN38r+JxFlNU28=",
    "pom": "sha256-o11/wINw+TE6S5U7zu7d2F4OHnLTEGLTe/jHeBs/b18="
@@ -1092,6 +1096,10 @@
    "jar": "sha256-45i2eXdiJxi/GP+ZtznH2doGDzP7RYouJSAyIcFq8BA=",
    "pom": "sha256-OkYiFKM26ZVod2lTGx43sMgdjhDJlJzV6nrh14A6AjI="
   },
+  "org/jetbrains/kotlin#kotlin-stdlib/1.9.0": {
+   "jar": "sha256-Na7/vi21qkRgcs7lD87ki3+p4vxRyjfAzH19C8OdlS4=",
+   "pom": "sha256-N3UiY/Ysw+MlCFbiiO5Kc9QQLXJqd2JwNPlIBsjBCso="
+  },
   "org/jetbrains/kotlin#kotlin-stdlib/2.0.20": {
    "jar": "sha256-+xaVlmWaUYNXxLLBb0PcdascSYBWXtS0oxegUOXjkAY=",
    "module": "sha256-3AUdwExqGW8tBtDTya8zufErybT+E5rhKQFAUII2tns=",
diff --git a/pkgs/by-name/ln/lndconnect/package.nix b/pkgs/by-name/ln/lndconnect/package.nix
index 1de170f5e8db..55db70b56405 100644
--- a/pkgs/by-name/ln/lndconnect/package.nix
+++ b/pkgs/by-name/ln/lndconnect/package.nix
@@ -25,7 +25,6 @@ buildGoModule rec {
     description = "Generate QRCode to connect apps to lnd Resources";
     license = licenses.mit;
     homepage = "https://github.com/LN-Zap/lndconnect";
-    maintainers = [ maintainers.d-xo ];
     platforms = platforms.linux;
     mainProgram = "lndconnect";
   };
diff --git a/pkgs/by-name/md/mdbook/package.nix b/pkgs/by-name/md/mdbook/package.nix
index ded486367aec..c8ad396b347b 100644
--- a/pkgs/by-name/md/mdbook/package.nix
+++ b/pkgs/by-name/md/mdbook/package.nix
@@ -7,7 +7,7 @@
   installShellFiles,
 }:
 let
-  version = "0.4.51";
+  version = "0.4.52";
 in
 rustPlatform.buildRustPackage rec {
   inherit version;
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "mdBook";
     tag = "v${version}";
-    hash = "sha256-d211IEXtHiRhD+rXGUaDAbcDwKJZqr0fmkxTgN4RkC0=";
+    hash = "sha256-a3GSMz1+8Ve5cp4x1NjBlsCU/wMC4Jl3/H9qx7+1XlI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3VI9WZiFiyfQRQk7gZBLXA/RRfCuEBze/MWI7OUGBmc=";
+  cargoHash = "sha256-wvTixSVHXglJM+nBMulZNZKF8pZfNd2G8Z+1PlAWmpk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/md/mdp/package.nix b/pkgs/by-name/md/mdp/package.nix
index d2b979d83f4f..cc36c93783de 100644
--- a/pkgs/by-name/md/mdp/package.nix
+++ b/pkgs/by-name/md/mdp/package.nix
@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.15";
+  version = "1.0.17";
   pname = "mdp";
 
   src = fetchFromGitHub {
     owner = "visit1985";
     repo = "mdp";
     rev = version;
-    sha256 = "1m9a0vvyw2m55cn7zcq011vrjkiaj5a3g5g6f2dpq953gyi7gff9";
+    sha256 = "sha256-g9+bqMoUpcRL1pcNqaeMR3l5uHuiEpDZj/6YmyOSn7k=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/by-name/me/meli/package.nix b/pkgs/by-name/me/meli/package.nix
index d713ff827a6e..9866542ac963 100644
--- a/pkgs/by-name/me/meli/package.nix
+++ b/pkgs/by-name/me/meli/package.nix
@@ -21,6 +21,9 @@
   # runtime deps
   gpgme,
   gnum4,
+
+  withNotmuch ? true,
+  notmuch,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -66,7 +69,9 @@ rustPlatform.buildRustPackage rec {
     installManPage meli/docs/*.{1,5,7}
 
     wrapProgram $out/bin/meli \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gpgme ]} \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath ([ gpgme ] ++ lib.optional withNotmuch notmuch)
+      } \
       --prefix PATH : ${lib.makeBinPath [ gnum4 ]}
   '';
 
diff --git a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
index f89270b5432a..949160710bda 100644
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@@ -10,15 +10,15 @@
 
 buildGoModule rec {
   pname = "mongodb-atlas-cli";
-  version = "1.45.1";
+  version = "1.46.2";
 
-  vendorHash = "sha256-4qkB2PdMiMtyxdHodwR+w9Lbt1JaT1/wUS+h23ajDD4=";
+  vendorHash = "sha256-z42tJJD/iK9GDnYxdeMYogaMviGABizxX9fdWL8vVik=";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     rev = "refs/tags/atlascli/v${version}";
-    sha256 = "sha256-Pk7C8CzhRB1XRkqHPECIeaFSwWEWZqJ4sTONTEiqZvg=";
+    sha256 = "sha256-yg6GSG4TXPj4n8s4TK/i7NveJXMAQczONSrLn39PKVI=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index ea7d0ad147f9..27bfe293adcf 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "1.3.22";
+  version = "1.3.23";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mn6f4ci5C2jkyxgmBHQ4dI9V0/20DlyS6EbQz4w7znc=";
+    hash = "sha256-LVXO+V182R2KmNfTJjpYx/yYk97+Kvzul7gzSM72JJM=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildInputs = [ nodejs_22 ];
 
     fetcherVersion = 1;
-    hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
+    hash = "sha256-gmv0W4PluHoiZRSAJuBTDo3CjmJOM1ZHFbxrt7CsJaE=";
   };
 
   env = {
diff --git a/pkgs/by-name/ni/nix-ld/package.nix b/pkgs/by-name/ni/nix-ld/package.nix
index dd659a0aeebc..c82819d3554e 100644
--- a/pkgs/by-name/ni/nix-ld/package.nix
+++ b/pkgs/by-name/ni/nix-ld/package.nix
@@ -8,20 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-ld";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-ld";
     rev = version;
-    hash = "sha256-ULoitJD5bMu0pFvh35cY5EEYywxj4e2fYOpqZwKB1lk=";
+    hash = "sha256-7ev9V128h7ZWi9JsFje6X1OzE5maJfmBMkxohxQysOA=";
   };
 
-  # Submitted upstream: https://github.com/nix-community/nix-ld/pull/169
-  patches = [ ./rust-1.88.patch ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cDbszVjZcomag0HZvXM+17SjDiGS07iPj78zgsXstHc=";
+  cargoHash = "sha256-YR7j2dvZHMBUe0lW7GYFxJV11ZM+gX13NHj2uf3UEbQ=";
 
   hardeningDisable = [ "stackprotector" ];
 
diff --git a/pkgs/by-name/ni/nix-ld/rust-1.88.patch b/pkgs/by-name/ni/nix-ld/rust-1.88.patch
deleted file mode 100644
index dac1fcfa1c8b..000000000000
--- a/pkgs/by-name/ni/nix-ld/rust-1.88.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-diff --git a/src/arch.rs b/src/arch.rs
-index a998697..45ec2cb 100644
---- a/src/arch.rs
-+++ b/src/arch.rs
-@@ -140,7 +140,7 @@ cfg_match! {
-     target_arch = "x86_64" => {
-         pub const ENTRY_TRAMPOLINE: Option<unsafe extern "C" fn() -> !> = Some(entry_trampoline);
- 
--        #[naked]
-+        #[unsafe(naked)]
-         unsafe extern "C" fn entry_trampoline() -> ! {
-             core::arch::naked_asm!(
-                 "lea r10, [rip + {context}]",
-@@ -159,7 +159,7 @@ cfg_match! {
-     target_arch = "aarch64" => {
-         pub const ENTRY_TRAMPOLINE: Option<unsafe extern "C" fn() -> !> = Some(entry_trampoline);
- 
--        #[naked]
-+        #[unsafe(naked)]
-         unsafe extern "C" fn entry_trampoline() -> ! {
-             core::arch::naked_asm!(
-                 "adrp x8, {context}",
-diff --git a/src/sys.rs b/src/sys.rs
-index 109d809..bf085d9 100644
---- a/src/sys.rs
-+++ b/src/sys.rs
-@@ -181,6 +181,5 @@ pub fn new_slice_leak(size: usize) -> Option<&'static mut [u8]> {
- 
- #[cfg(not(test))]
- #[lang = "eh_personality"]
--#[no_mangle]
- pub extern fn rust_eh_personality() {
- }
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 3bf6887a388d..ddc0f4b1ddfa 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -2,26 +2,34 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.10.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     tag = "v${version}";
-    hash = "sha256-F1lKBfDufotQjVNJ1yMosRl1UlGMBlYCTHXdCzeVflg=";
+    hash = "sha256-dGQDxjvB5OX4ot22zt2zFu3T3h/clSRlfxhCpkPRePU=";
   };
 
   vendorHash = "sha256-d5KTDZKfuzv84oMgmsjJoXGO5XYLVKxOB5XehqgRvYw=";
 
-  meta = with lib; {
+  ldflags = [
+    "-X 'main.version=${version}'"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     homepage = "https://github.com/guyfedwards/nom";
+    changelog = "https://github.com/guyfedwards/nom/releases/tag/v${version}";
     description = "RSS reader for the terminal";
-    platforms = platforms.linux ++ platforms.darwin;
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
       nadir-ishiguro
       matthiasbeyer
     ];
diff --git a/pkgs/by-name/pl/pluto/package.nix b/pkgs/by-name/pl/pluto/package.nix
index 7867e3af7a6b..ce3398e80c31 100644
--- a/pkgs/by-name/pl/pluto/package.nix
+++ b/pkgs/by-name/pl/pluto/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.21.8";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    hash = "sha256-41ud7SRaivhmtBY6ekKIpRijTuLqJ/tLi0dTHDsGAps=";
+    hash = "sha256-fqN6uj/YL/sch16mmB/smJtbzCFlUa9yvCLa8sXJ/u4=";
   };
 
-  vendorHash = "sha256-4kiLgwr8wr/L4anxgZVAE6IFdbBvTgcUlf5KIcT+lRk=";
+  vendorHash = "sha256-59mRVfQ2rduTvIJE1l/j3K+PY3OEMfNpjjYg3hqNUhs=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index 006c0f204029..7c78a5bee9fd 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -1,5 +1,8 @@
 {
   lib,
+  callPackage,
+  coreutils,
+  gnugrep,
   stdenv,
   fetchurl,
   pkg-config,
@@ -16,17 +19,6 @@
   nixosTests,
   writeShellScript,
   versionCheckHook,
-
-  # for update.nix
-  writeScript,
-  common-updater-scripts,
-  bash,
-  coreutils,
-  curl,
-  gnugrep,
-  gnupg,
-  gnused,
-  nix,
 }:
 
 let
@@ -90,13 +82,8 @@ stdenv.mkDerivation (finalAttrs: {
     # https://gitlab.torproject.org/tpo/onion-services/onion-support/-/wikis/Documentation/PoW-FAQ#compiling-c-tor-with-the-pow-defense
     [ "--enable-gpl" ]
     ++
-      # cross compiles correctly but needs the following
-      lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--disable-tool-name-check" ]
-    ++
-      # sandbox is broken on aarch64-linux https://gitlab.torproject.org/tpo/core/tor/-/issues/40599
-      lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
-        "--disable-seccomp"
-      ];
+    # cross compiles correctly but needs the following
+    lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--disable-tool-name-check" ];
 
   NIX_CFLAGS_LINK = lib.optionalString stdenv.cc.isGNU "-lgcc_s";
 
@@ -126,20 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     tests.tor = nixosTests.tor;
-    updateScript = import ./update.nix {
-      inherit lib;
-      inherit
-        writeScript
-        common-updater-scripts
-        bash
-        coreutils
-        curl
-        gnupg
-        gnugrep
-        gnused
-        nix
-        ;
-    };
+    updateScript = callPackage ./update.nix { };
   };
 
   meta = {
diff --git a/pkgs/by-name/wi/wireguard-tools/package.nix b/pkgs/by-name/wi/wireguard-tools/package.nix
index 19e3585bca1d..4d47b0efd43f 100644
--- a/pkgs/by-name/wi/wireguard-tools/package.nix
+++ b/pkgs/by-name/wi/wireguard-tools/package.nix
@@ -92,7 +92,6 @@ stdenv.mkDerivation rec {
       zx2c4
       globin
       ma27
-      d-xo
     ];
     mainProgram = "wg";
     platforms = platforms.unix;
diff --git a/pkgs/development/python-modules/django-pydantic-field/default.nix b/pkgs/development/python-modules/django-pydantic-field/default.nix
new file mode 100644
index 000000000000..267988b86056
--- /dev/null
+++ b/pkgs/development/python-modules/django-pydantic-field/default.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  django,
+  dj-database-url,
+  inflection,
+  pydantic,
+  pytestCheckHook,
+  pytest-django,
+  djangorestframework,
+  pyyaml,
+  setuptools,
+  syrupy,
+  uritemplate,
+}:
+
+buildPythonPackage rec {
+  pname = "django-pydantic-field";
+  version = "0.3.13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "surenkov";
+    repo = "django-pydantic-field";
+    tag = "v${version}";
+    hash = "sha256-RxZxDQZdFiT67YcAQtf4t42XU3XfzT3KS7ZCyfHZUOs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    pydantic
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+    djangorestframework
+    dj-database-url
+    inflection
+    pyyaml
+    syrupy
+    uritemplate
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=tests.settings.django_test_settings
+  '';
+
+  meta = with lib; {
+    changelog = "https://github.com/surenkov/django-pydantic-field/releases/tag/${src.tag}";
+    description = "Django JSONField with Pydantic models as a Schema";
+    homepage = "https://github.com/surenkov/django-pydantic-field";
+    maintainers = with lib.maintainers; [ kiara ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/docling-core/default.nix b/pkgs/development/python-modules/docling-core/default.nix
index f667e2ac0aa4..8690c2289623 100644
--- a/pkgs/development/python-modules/docling-core/default.nix
+++ b/pkgs/development/python-modules/docling-core/default.nix
@@ -5,6 +5,7 @@
 
   # build-system
   poetry-core,
+  setuptools,
 
   # dependencies
   jsonref,
@@ -28,18 +29,19 @@
 
 buildPythonPackage rec {
   pname = "docling-core";
-  version = "2.31.2";
+  version = "2.43.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-core";
     tag = "v${version}";
-    hash = "sha256-O0GfEoWImDjehCPb8erBdY2gYalj2im8rxdJKEsbUs4=";
+    hash = "sha256-c9TaX4INfTfR3ZpmXbOteHr2R2jAbVzvMk8tO1XV4Nc=";
   };
 
   build-system = [
     poetry-core
+    setuptools
   ];
 
   dependencies = [
@@ -59,7 +61,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "pillow"
-    "typer"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/docling-ibm-models/default.nix b/pkgs/development/python-modules/docling-ibm-models/default.nix
index 16b6122db933..166ae7e7c5bc 100644
--- a/pkgs/development/python-modules/docling-ibm-models/default.nix
+++ b/pkgs/development/python-modules/docling-ibm-models/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -15,6 +14,7 @@
   opencv-python-headless,
   pillow,
   pydantic,
+  rtree,
   safetensors,
   torch,
   torchvision,
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "docling-ibm-models";
-  version = "3.4.4";
+  version = "3.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-ibm-models";
     tag = "v${version}";
-    hash = "sha256-a2y4vXgALPRtLhdH0Tqqht1gpdcfa1Gv4puthKDMk7U=";
+    hash = "sha256-Yogg71CXQTdF5OUbdbma1rQxtLudTLjyOIFe2LS9CpI=";
   };
 
   build-system = [
@@ -51,6 +51,7 @@ buildPythonPackage rec {
     opencv-python-headless
     pillow
     pydantic
+    rtree
     safetensors
     torch
     torchvision
diff --git a/pkgs/development/python-modules/docling-serve/default.nix b/pkgs/development/python-modules/docling-serve/default.nix
index d0c27dd14a5a..07c5e977dcf3 100644
--- a/pkgs/development/python-modules/docling-serve/default.nix
+++ b/pkgs/development/python-modules/docling-serve/default.nix
@@ -13,6 +13,7 @@
   uvicorn,
   websockets,
   tesserocr,
+  typer,
   rapidocr-onnxruntime,
   onnxruntime,
   torch,
@@ -28,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "docling-serve";
-  version = "0.11.0";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-serve";
     tag = "v${version}";
-    hash = "sha256-dPCD7Ovc6Xiga+gYOwg0mJIIhHywVOyxKIAFF5XUsYw=";
+    hash = "sha256-R8W/FXKj2wLJOcjwIsna/2wFOLGM80Qr3WlYPJTTSNU=";
   };
 
   postPatch = ''
@@ -53,7 +54,7 @@ buildPythonPackage rec {
   ];
 
   pythonRemoveDeps = [
-    "mlx-vlm" # not yet avainable on nixpkgs
+    "mlx-vlm" # not yet available on nixpkgs
   ];
 
   dependencies =
@@ -63,6 +64,7 @@ buildPythonPackage rec {
       httpx
       pydantic-settings
       python-multipart
+      typer
       uvicorn
       websockets
     ]
diff --git a/pkgs/development/python-modules/docling/default.nix b/pkgs/development/python-modules/docling/default.nix
index e8d7bd7654bf..42e4900744da 100644
--- a/pkgs/development/python-modules/docling/default.nix
+++ b/pkgs/development/python-modules/docling/default.nix
@@ -52,14 +52,14 @@
 
 buildPythonPackage rec {
   pname = "docling";
-  version = "2.31.2";
+  version = "2.41.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling";
     tag = "v${version}";
-    hash = "sha256-a2PZORT4Umf6AI3yEDDcUD0tm22Ahzm7Dwij/5ZUjNs=";
+    hash = "sha256-GD052HCqBLs+KUkOUOVdlXxS6+PD2pthGtz+zdQ6QnM=";
   };
 
   build-system = [
@@ -102,7 +102,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "pillow"
-    "typer"
   ];
 
   optional-dependencies = {
@@ -160,10 +159,14 @@ buildPythonPackage rec {
     "test_convert_stream"
     "test_compare_legacy_output"
     "test_ocr_coverage_threshold"
+    "test_formula_conversion_with_page_range"
 
     # requires network access
     "test_page_range"
     "test_parser_backends"
+    "test_confidence"
+    "test_e2e_webp_conversions"
+    "test_asr_pipeline_conversion"
 
     # AssertionError: pred_itxt==true_itxt
     "test_e2e_valid_csv_conversions"
diff --git a/pkgs/development/python-modules/fabric/default.nix b/pkgs/development/python-modules/fabric/default.nix
index fbf4528d5d39..cc77add86616 100644
--- a/pkgs/development/python-modules/fabric/default.nix
+++ b/pkgs/development/python-modules/fabric/default.nix
@@ -3,14 +3,13 @@
   buildPythonPackage,
   decorator,
   deprecated,
-  fetchPypi,
+  fetchFromGitHub,
   icecream,
   invoke,
   mock,
   paramiko,
   pytest-relaxed,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
@@ -19,11 +18,11 @@ buildPythonPackage rec {
   version = "3.2.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-h4PKQuOwB28IsmkBqsa52bHxnEEAdOesz6uQLBhP9KM=";
+  src = fetchFromGitHub {
+    owner = "fabric";
+    repo = "fabric";
+    tag = version;
+    hash = "sha256-7qC2UuI0RP5xlKIYSz1sLyK/nQYegXOou1mlJYFk7M0=";
   };
 
   build-system = [ setuptools ];
@@ -58,6 +57,10 @@ buildPythonPackage rec {
     "preserves_remote_mode_by_default"
     "proxy_jump"
     "raises_TypeError_for_disallowed_kwargs"
+    # Assertion failures on mocks
+    # https://github.com/fabric/fabric/issues/2341
+    "client_defaults_to_a_new_SSHClient"
+    "defaults_to_auto_add"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/ledgerwallet/default.nix b/pkgs/development/python-modules/ledgerwallet/default.nix
index a6e87f00f8c7..912c762edf48 100644
--- a/pkgs/development/python-modules/ledgerwallet/default.nix
+++ b/pkgs/development/python-modules/ledgerwallet/default.nix
@@ -66,7 +66,6 @@ buildPythonPackage rec {
     mainProgram = "ledgerctl";
     license = licenses.mit;
     maintainers = with maintainers; [
-      d-xo
       erdnaxe
     ];
   };
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 99103bf5404e..c7513cadeaf2 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "posthog";
-  version = "6.0.2";
+  version = "6.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${version}";
-    hash = "sha256-6ZSQFcwuHDgCv301D/7/3QjF9+ZaxXPItvoA+6x0O4U=";
+    hash = "sha256-u4qCQYCpMfM/JCyyKOfTTN7vwh3EvlGnxuslUy/d9Bs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/x3dh/default.nix b/pkgs/development/python-modules/x3dh/default.nix
index 7dccc3edf2bb..1c2e2d6e1c16 100644
--- a/pkgs/development/python-modules/x3dh/default.nix
+++ b/pkgs/development/python-modules/x3dh/default.nix
@@ -9,17 +9,18 @@
   typing-extensions,
   pytestCheckHook,
   pytest-asyncio,
+  pytest-cov-stub,
 }:
 buildPythonPackage rec {
   pname = "x3dh";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-x3dh";
     tag = "v${version}";
-    hash = "sha256-/hC1Kze4yBOlgbWJcGddcYty9fqwZ08Lyi0IiqSDibI=";
+    hash = "sha256-NLuFfkutFtNrpBcLA/83QArCDrlrT+i85s2d6FHtuT0=";
   };
 
   strictDeps = true;
@@ -38,6 +39,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio
+    pytest-cov-stub
   ];
 
   pythonImportsCheck = [ "x3dh" ];
diff --git a/pkgs/development/python-modules/xeddsa/default.nix b/pkgs/development/python-modules/xeddsa/default.nix
index fba8c0793e66..ea6e648f3b94 100644
--- a/pkgs/development/python-modules/xeddsa/default.nix
+++ b/pkgs/development/python-modules/xeddsa/default.nix
@@ -7,26 +7,22 @@
   libsodium,
   libxeddsa,
   pytestCheckHook,
+  pytest-cov-stub,
   nix-update-script,
 }:
 
 buildPythonPackage rec {
   pname = "xeddsa";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-xeddsa";
     tag = "v${version}";
-    hash = "sha256-636zsJXD8EtLDXMIkJTON0g3sg0EPrMzcfR7SUrURac=";
+    hash = "sha256-5s6ERazWnwYEc0d5e+eSdvOCTklBQVrjzvlNifC2zKU=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools<74" "setuptools"
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   build-system = [ setuptools ];
@@ -40,6 +36,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-cov-stub
   ];
 
   pythonImportsCheck = [ "xeddsa" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 863764b87add..051406104167 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12402,7 +12402,6 @@ with pkgs;
   );
 
   gimp = callPackage ../applications/graphics/gimp/2.0 {
-    autoreconfHook = buildPackages.autoreconfHook269;
     lcms = lcms2;
   };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3abd303abe7d..70be9bcde846 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3971,6 +3971,8 @@ self: super: with self; {
 
   django-pwa = callPackage ../development/python-modules/django-pwa { };
 
+  django-pydantic-field = callPackage ../development/python-modules/django-pydantic-field { };
+
   django-q2 = callPackage ../development/python-modules/django-q2 { };
 
   django-ranged-response = callPackage ../development/python-modules/django-ranged-response { };