diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ae324fbeec5e..083bdc4280bc 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6905,12 +6905,6 @@
     githubId = 187309685;
     name = "Drew Council";
   };
-  drewrisinger = {
-    email = "drisinger+nixpkgs@gmail.com";
-    github = "drewrisinger";
-    githubId = 10198051;
-    name = "Drew Risinger";
-  };
   dritter = {
     email = "dritter03@googlemail.com";
     github = "dritter";
@@ -11080,6 +11074,13 @@
     githubId = 54999;
     name = "Ariel Nunez";
   };
+  insipx = {
+    email = "github@andrewplaza.dev";
+    github = "insipx";
+    githubId = 6452260;
+    name = "Andrew Plaza";
+    keys = [ { fingerprint = "843D 72A9 EB79 A869 2C58  5B3A E773 8A7A 0F5C DB89"; } ];
+  };
   Intuinewin = {
     email = "antoinelabarussias@gmail.com";
     github = "Intuinewin";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index e21b526517d8..feed83cfc142 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -76,6 +76,8 @@
 
 - [yubikey-manager](https://github.com/Yubico/yubikey-manager), a tool for configuring YubiKey devices. Available as [programs.yubikey-manager](#opt-programs.yubikey-manager.enable).
 
+- [Linkwarden](https://linkwarden.app/) a self-hosted collaborative bookmark manager to collect, read, annotate, and fully preserve what matters, all in one place. Available as [services.linkwarden](#opt-services.linkwarden.enable).
+
 - [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
 
 - [Pangolin](https://github.com/fosrl/pangolin), a tunneled reverse proxy server with access control. Available as [services.pangolin](#opt-services.pangolin.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d17ae2acafe2..5b285ee24580 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1628,6 +1628,7 @@
   ./services/web-apps/lemmy.nix
   ./services/web-apps/libretranslate.nix
   ./services/web-apps/limesurvey.nix
+  ./services/web-apps/linkwarden.nix
   ./services/web-apps/mainsail.nix
   ./services/web-apps/mastodon.nix
   ./services/web-apps/matomo.nix
diff --git a/nixos/modules/services/web-apps/linkwarden.nix b/nixos/modules/services/web-apps/linkwarden.nix
new file mode 100644
index 000000000000..a7aa3cb1ee0b
--- /dev/null
+++ b/nixos/modules/services/web-apps/linkwarden.nix
@@ -0,0 +1,293 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.linkwarden;
+  isPostgresUnixSocket = lib.hasPrefix "/" cfg.database.host;
+
+  inherit (lib)
+    types
+    mkIf
+    mkOption
+    mkEnableOption
+    ;
+
+  commonServiceConfig = {
+    Type = "simple";
+    Restart = "on-failure";
+    RestartSec = 3;
+
+    EnvironmentFile = cfg.environmentFile;
+    StateDirectory = "linkwarden";
+    CacheDirectory = "linkwarden";
+    User = cfg.user;
+    Group = cfg.group;
+
+    # Hardening
+    CapabilityBoundingSet = "";
+    NoNewPrivileges = true;
+    PrivateUsers = true;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+  };
+
+  secret = types.nullOr (
+    types.str
+    // {
+      # We don't want users to be able to pass a path literal here but
+      # it should look like a path.
+      check = it: lib.isString it && lib.types.path.check it;
+    }
+  );
+
+  startupScript =
+    arg:
+    if cfg.secretFiles == { } then
+      "${lib.getExe cfg.package}" + arg
+    else
+      pkgs.writeShellScript "linkwarden-env" ''
+        ${lib.strings.concatStringsSep "\n" (
+          lib.attrsets.mapAttrsToList (key: path: "export ${key}=$(< \"${path}\")") cfg.secretFiles
+        )}
+        ${lib.getExe cfg.package}${arg}
+      '';
+in
+{
+  options.services.linkwarden = {
+    enable = mkEnableOption "Linkwarden";
+    package = lib.mkPackageOption pkgs "linkwarden" { };
+
+    storageLocation = mkOption {
+      type = types.path;
+      default = "/var/lib/linkwarden";
+      description = "Directory used to store media files. If it is not the default, the directory has to be created manually such that the linkwarden user is able to read and write to it.";
+    };
+    cacheLocation = mkOption {
+      type = types.path;
+      default = "/var/cache/linkwarden";
+      description = "Directory used as cache. If it is not the default, the directory has to be created manually such that the linkwarden user is able to read and write to it.";
+    };
+
+    enableRegistration = mkEnableOption "registration for new users";
+
+    environment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = {
+        PAGINATION_TAKE_COUNT = "50";
+      };
+      description = ''
+        Extra configuration environment variables. Refer to the [documentation](https://docs.linkwarden.app/self-hosting/environment-variables) for options.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = secret;
+      example = "/run/secrets/linkwarden";
+      default = null;
+      description = ''
+        Path of a file with extra environment variables to be loaded from disk.
+        This file is not added to the nix store, so it can be used to pass secrets to linkwarden.
+        Refer to the [documentation](https://docs.linkwarden.app/self-hosting/environment-variables) for options.
+
+        Linkwarden needs at least a nextauth secret. To set a database password use POSTGRES_PASSWORD:
+        ```
+        NEXTAUTH_SECRET=<secret>
+        POSTGRES_PASSWORD=<pass>
+        ```
+      '';
+    };
+
+    secretFiles = mkOption {
+      type = types.attrsOf secret;
+      example = {
+        POSTGRES_PASSWORD = "/run/secrets/linkwarden_postgres_passwd";
+        NEXTAUTH_SECRET = "/run/secrets/linkwarden_secret";
+      };
+      default = { };
+      description = ''
+        Attribute set containing paths to files to add to the environment of linkwarden.
+        The files are not added to the nix store, so they can be used to pass secrets to linkwarden.
+        Refer to the [documentation](https://docs.linkwarden.app/self-hosting/environment-variables) for options.
+
+        Linkwarden needs at least a nextauth secret. To set a database password use POSTGRES_PASSWORD:
+        ```
+        NEXTAUTH_SECRET=<secret>
+        POSTGRES_PASSWORD=<pass>
+        ```
+      '';
+    };
+
+    host = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = "The host that Linkwarden will listen on.";
+    };
+    port = mkOption {
+      type = types.port;
+      default = 3000;
+      description = "The port that Linkwarden will listen on.";
+    };
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to open the Linkwarden port in the firewall";
+    };
+    user = mkOption {
+      type = types.str;
+      default = "linkwarden";
+      description = "The user Linkwarden should run as.";
+    };
+    group = mkOption {
+      type = types.str;
+      default = "linkwarden";
+      description = "The group Linkwarden should run as.";
+    };
+
+    database = {
+      createLocally = mkEnableOption "the automatic creation of the database for Linkwarden." // {
+        default = true;
+      };
+      name = mkOption {
+        type = types.str;
+        default = "linkwarden";
+        description = "The name of the Linkwarden database.";
+      };
+      host = mkOption {
+        type = types.str;
+        default = "/run/postgresql";
+        example = "localhost";
+        description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 5432;
+        description = "Port of the postgresql server.";
+      };
+      user = mkOption {
+        type = types.str;
+        default = "linkwarden";
+        description = "The database user for Linkwarden.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.database.createLocally -> cfg.database.name == cfg.database.user;
+        message = "The postgres module requires the database name and the database user name to be the same.";
+      }
+      {
+        assertion = cfg.environmentFile == null -> cfg.secretFiles ? "NEXTAUTH_SECRET";
+        message = ''
+          Linkwarden needs at least a nextauth secret to run.
+          Use either the environmentFile or secretFiles.NEXTAUTH_SECRET to provide one.
+        '';
+      }
+    ];
+
+    services.postgresql = mkIf cfg.database.createLocally {
+      enable = true;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [
+        {
+          name = cfg.database.user;
+          ensureDBOwnership = true;
+          ensureClauses.login = true;
+        }
+      ];
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
+    services.linkwarden.environment = {
+      LINKWARDEN_HOST = cfg.host;
+      LINKWARDEN_PORT = toString cfg.port;
+      LINKWARDEN_CACHE_DIR = cfg.cacheLocation;
+      STORAGE_FOLDER = cfg.storageLocation;
+      NEXT_PUBLIC_DISABLE_REGISTRATION = mkIf (!cfg.enableRegistration) "true";
+      NEXT_TELEMETRY_DISABLED = "1";
+      DATABASE_URL = mkIf isPostgresUnixSocket "postgresql://${lib.strings.escapeURL cfg.database.user}@localhost/${lib.strings.escapeURL cfg.database.name}?host=${cfg.database.host}";
+      DATABASE_PORT = toString cfg.database.port;
+      DATABASE_HOST = mkIf (!isPostgresUnixSocket) cfg.database.host;
+      DATABASE_NAME = cfg.database.name;
+      DATABASE_USER = cfg.database.user;
+    };
+
+    systemd.services.linkwarden = {
+      description = "Linkwarden (Self-hosted collaborative bookmark manager to collect, organize, and preserve webpages, articles, and more...)";
+      requires = [
+        "network-online.target"
+      ]
+      ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      after = [
+        "network-online.target"
+      ]
+      ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.environment // {
+        # Required, otherwise chrome dumps core
+        CHROME_CONFIG_HOME = cfg.cacheLocation;
+      };
+
+      serviceConfig = commonServiceConfig // {
+        ExecStart = startupScript "";
+      };
+    };
+
+    systemd.services.linkwarden-worker = {
+      description = "Linkwarden (worker process)";
+      requires = [
+        "network-online.target"
+        "linkwarden.service"
+      ]
+      ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      after = [
+        "network-online.target"
+        "linkwarden.service"
+      ]
+      ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.environment // {
+        # Required, otherwise chrome dumps core
+        CHROME_CONFIG_HOME = cfg.cacheLocation;
+      };
+
+      serviceConfig = commonServiceConfig // {
+        ExecStart = startupScript " worker";
+      };
+    };
+
+    users.users = mkIf (cfg.user == "linkwarden") {
+      linkwarden = {
+        name = "linkwarden";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+    users.groups = mkIf (cfg.group == "linkwarden") { linkwarden = { }; };
+
+    meta.maintainers = with lib.maintainers; [ jvanbruegge ];
+  };
+}
diff --git a/nixos/modules/virtualisation/virtualbox-host.nix b/nixos/modules/virtualisation/virtualbox-host.nix
index d5b2949b762f..56ba741dc2e4 100644
--- a/nixos/modules/virtualisation/virtualbox-host.nix
+++ b/nixos/modules/virtualisation/virtualbox-host.nix
@@ -164,6 +164,16 @@ in
           "vboxnetflt"
         ];
         boot.extraModulePackages = [ kernelModules ];
+        # See https://github.com/VirtualBox/virtualbox/issues/188
+        boot.kernelParams =
+          lib.mkIf
+            (
+              lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.12"
+              && lib.versionOlder config.boot.kernelPackages.kernel.version "6.16"
+            )
+            [
+              "kvm.enable_virt_at_load=0"
+            ];
 
         services.udev.extraRules = ''
           KERNEL=="vboxdrv",    OWNER="root", GROUP="vboxusers", MODE="0660", TAG+="systemd"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a6c3ff57d737..e471baaf7849 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -831,6 +831,7 @@ in
   lighttpd = runTest ./lighttpd.nix;
   limesurvey = runTest ./limesurvey.nix;
   limine = import ./limine { inherit runTest; };
+  linkwarden = runTest ./web-apps/linkwarden.nix;
   listmonk = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./listmonk.nix { };
   litellm = runTest ./litellm.nix;
   litestream = runTest ./litestream.nix;
diff --git a/nixos/tests/web-apps/linkwarden.nix b/nixos/tests/web-apps/linkwarden.nix
new file mode 100644
index 000000000000..153c7e437599
--- /dev/null
+++ b/nixos/tests/web-apps/linkwarden.nix
@@ -0,0 +1,60 @@
+{ ... }:
+{
+  name = "linkwarden-nixos";
+
+  nodes.machine =
+    { pkgs, ... }:
+    let
+      secretsFile = pkgs.writeText "linkwarden-secret-env" ''
+        VERY_SENSITIVE_SECRET
+      '';
+      webroot = pkgs.runCommand "webroot" { } ''
+        mkdir $out
+        cd $out
+        echo '<!DOCTYPE html><html><body><h1>HELLO LINKWARDEN</h1></body></html>' > index.html
+      '';
+    in
+    {
+      services.linkwarden = {
+        enable = true;
+        enableRegistration = true;
+        secretFiles = {
+          NEXTAUTH_SECRET = toString secretsFile;
+        };
+        environment = {
+          NEXTAUTH_URL = "http://localhost:3000/api/v1/auth";
+        };
+      };
+
+      services.nginx = {
+        enable = true;
+        virtualHosts.localhost.root = webroot;
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("linkwarden.service")
+    machine.wait_for_unit("linkwarden-worker.service")
+
+    machine.wait_for_open_port(3000)
+    machine.succeed("curl --fail -s http://localhost:3000/")
+
+    machine.succeed("curl -L --fail -s --data '{\"name\":\"Admin\",\"username\":\"admin\",\"password\":\"adminadmin\"}' -H 'Content-Type: application/json' -X POST http://localhost:3000/api/v1/users")
+
+    response = machine.succeed("curl -L --fail -s -c next_cookies.txt -H 'Content-Type: application/json' -X GET http://localhost:3000/api/v1/auth/csrf")
+    csrfToken = json.loads(response)['csrfToken']
+
+    machine.succeed("curl -L --fail -s -b next_cookies.txt -c next_cookies.txt -H 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'username=admin' --data-urlencode 'password=adminadmin' --data-urlencode 'csrfToken=%s' http://localhost:3000/api/v1/auth/callback/credentials" % csrfToken)
+
+    curlCmd = "curl -L --fail -s -b next_cookies.txt -H 'Content-Type: application/json' "
+
+    machine.succeed(curlCmd + "--data '{\"url\":\"http://localhost/\"}' -X POST http://localhost:3000/api/v1/links")
+
+    machine.succeed(curlCmd + "-X GET http://localhost:3000/api/v1/links")
+
+    machine.wait_for_file("/var/lib/linkwarden/archives/1/1.html")
+    machine.succeed("grep -q '<h1>HELLO LINKWARDEN</h1>' </var/lib/linkwarden/archives/1/1.html")
+  '';
+}
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 944250b8b15e..8a4ed7645b1c 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -74,7 +74,8 @@
   withCairo ? withX,
   withCsrc ? true,
   withDbus ? stdenv.hostPlatform.isLinux,
-  withGcMarkTrace ? false, # increase gc performance for reduced debugability
+  # https://github.com/emacs-mirror/emacs/blob/emacs-30.2/etc/NEWS#L52-L56
+  withGcMarkTrace ? false,
   withGTK3 ? withPgtk && !noGui,
   withGlibNetworking ? withPgtk || withGTK3 || (withX && withXwidgets),
   withGpm ? stdenv.hostPlatform.isLinux,
diff --git a/pkgs/applications/editors/jetbrains/source/build.nix b/pkgs/applications/editors/jetbrains/source/build.nix
index 90f412953372..2052025ba3a9 100644
--- a/pkgs/applications/editors/jetbrains/source/build.nix
+++ b/pkgs/applications/editors/jetbrains/source/build.nix
@@ -102,7 +102,12 @@ let
     inherit src;
     sourceRoot = "${src.name}/native/LinuxGlobalMenu";
     patches = [ ../patches/libdbm-headers.patch ];
-    postPatch = "cp ${libdbusmenu-jb}/lib/libdbusmenu-glib.a libdbusmenu-glib.a";
+    postPatch = ''
+      # Fix the build with CMake 4.
+      substituteInPlace CMakeLists.txt \
+        --replace-fail 'cmake_minimum_required(VERSION 2.6.0)' 'cmake_minimum_required(VERSION 3.10)'
+      cp ${libdbusmenu-jb}/lib/libdbusmenu-glib.a libdbusmenu-glib.a
+    '';
     passthru.patched-libdbusmenu = libdbusmenu-jb;
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index a8141c84cc82..0c8304d836ba 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1324,8 +1324,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.27.2";
-          hash = "sha256-NkOYn0ZNRqgi8HHowZSYmRKeOfqcxXfKIXUQNsJ0BtM=";
+          version = "2.27.9";
+          hash = "sha256-6+sAbjpwWTLGZ7uH6rl7LZcNmOnAftiYGithbBlvIak=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
diff --git a/pkgs/build-support/wasm-bindgen-cli/default.nix b/pkgs/build-support/wasm-bindgen-cli/default.nix
index 112e999323ed..c4688dfec76e 100644
--- a/pkgs/build-support/wasm-bindgen-cli/default.nix
+++ b/pkgs/build-support/wasm-bindgen-cli/default.nix
@@ -38,13 +38,16 @@ rustPlatform.buildRustPackage {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "https://rustwasm.github.io/docs/wasm-bindgen/";
+    homepage = "https://wasm-bindgen.github.io/wasm-bindgen/";
     license = with lib.licenses; [
       asl20 # or
       mit
     ];
     description = "Facilitating high-level interactions between wasm modules and JavaScript";
-    maintainers = with lib.maintainers; [ rizary ];
+    maintainers = with lib.maintainers; [
+      rizary
+      insipx
+    ];
     mainProgram = "wasm-bindgen";
   };
 }
diff --git a/pkgs/by-name/bi/biboumi/package.nix b/pkgs/by-name/bi/biboumi/package.nix
index ea9b4688c9fa..ebc9dfa625e3 100644
--- a/pkgs/by-name/bi/biboumi/package.nix
+++ b/pkgs/by-name/bi/biboumi/package.nix
@@ -79,6 +79,12 @@ stdenv.mkDerivation {
     "man"
   ];
 
+  cmakeFlags = [
+    # Fix breakage with CMake 4
+    "-DCMAKE_SKIP_RPATH=ON"
+    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
+  ];
+
   preConfigure = ''
     substituteInPlace CMakeLists.txt --replace /etc/biboumi $out/etc/biboumi
     cp ${catch}/single_include/catch.hpp tests/
diff --git a/pkgs/by-name/ca/catppuccin/package.nix b/pkgs/by-name/ca/catppuccin/package.nix
index 9435bd31dfc6..d6ae9a5e091a 100644
--- a/pkgs/by-name/ca/catppuccin/package.nix
+++ b/pkgs/by-name/ca/catppuccin/package.nix
@@ -68,16 +68,16 @@ let
       name = "bat";
       owner = "catppuccin";
       repo = "bat";
-      rev = "699f60fc8ec434574ca7451b444b880430319941";
-      hash = "sha256-6fWoCH90IGumAMc4buLRWL0N61op+AuMNN9CAR9/OdI=";
+      rev = "6810349b28055dce54076712fc05fc68da4b8ec0";
+      hash = "sha256-lJapSgRVENTrbmpVyn+UQabC9fpV1G1e+CdlJ090uvg=";
     };
 
     bottom = fetchFromGitHub {
       name = "bottom";
       owner = "catppuccin";
       repo = "bottom";
-      rev = "ed09bd5a5dd78d83acdc8ff5fdec40a6340ed1c2";
-      hash = "sha256-Vi438I+YVvoD2xzq2t9hJ9R3a+2TlDdbakjFYFtjtXQ=";
+      rev = "eadd75acd0ecad4a58ade9a1d6daa3b97ccec07c";
+      hash = "sha256-dfukdk70ug1lRGADKBnvMhkl+3tsY7F+UAwTS2Qyapk=";
     };
 
     btop = fetchFromGitHub {
@@ -100,8 +100,8 @@ let
       name = "grub";
       owner = "catppuccin";
       repo = "grub";
-      rev = "2a5c8be8185dae49dd22030df45860df8c796312";
-      hash = "sha256-20D1EcV8SWOd5BLdAc6FaQu3onha0+aS5yA/GK8Ra0g=";
+      rev = "0a37ab19f654e77129b409fed371891c01ffd0b9";
+      hash = "sha256-jgM22pvCQvb0bjQQXoiqGMgScR9AgCK3OfDF5Ud+/mk=";
     };
 
     hyprland = fetchFromGitHub {
@@ -124,16 +124,16 @@ let
       name = "kvantum";
       owner = "catppuccin";
       repo = "Kvantum";
-      rev = "a87694e0a3c97644dbb34f8835112d17b54ace68";
-      hash = "sha256-eQmEeKC+L408ajlNg3oKMnDK6Syy2GV6FrR2TN5ZBCg=";
+      rev = "c7cb144b041395e83e4f510a62526b7adfb79911";
+      hash = "sha256-YNUkri+no+rNLTJHf6cPdy4AmQLzPiRK1Jbp2o8e1LE=";
     };
 
     lazygit = fetchFromGitHub {
       name = "lazygit";
       owner = "catppuccin";
       repo = "lazygit";
-      rev = "d3c95a67ea3f778f7705d8ef814f87ac5213436d";
-      hash = "sha256-b2SoIeXT1BaoxvEeQ0VaPmnBND+7qUe342kOIkyOcAc=";
+      rev = "c24895902ec2a3cb62b4557f6ecd8e0afeed95d5";
+      hash = "sha256-4eJEOEfwLBc4EoQ32TpuhXS3QDvQ8FtT7EgpotEKV7o=";
     };
 
     lxqt = fetchFromGitHub {
@@ -156,32 +156,32 @@ let
       name = "qt5ct";
       owner = "catppuccin";
       repo = "qt5ct";
-      rev = "0442cc931390c226d143e3a6d6e77f819c68502a";
-      hash = "sha256-hXyPuI225WdMuVSeX1AwrylUzNt0VA33h8C7MoSJ+8A=";
+      rev = "cb585307edebccf74b8ae8f66ea14f21e6666535";
+      hash = "sha256-wDj6kQ2LQyMuEvTQP6NifYFdsDLT+fMCe3Fxr8S783w=";
     };
 
     refind = fetchFromGitHub {
       name = "refind";
       owner = "catppuccin";
       repo = "refind";
-      rev = "ff0b593c19bb9b469ee0ee36068b8d373f0fadc5";
-      hash = "sha256-itUMo0lA23bJzH0Ndq7L2IaEYoVdNPYxbB/VWkRfRso=";
+      rev = "e92ad6f4673e30fbc79e69c9cbe3780fb9a3f05f";
+      hash = "sha256-34+MkvWEp3xq6Di1uWKR4ieaG4t2rufnRRN1/V0WRfw=";
     };
 
     rofi = fetchFromGitHub {
       name = "rofi";
       owner = "catppuccin";
       repo = "rofi";
-      rev = "c24a212a6b07c2d45f32d01d7f10b4d88ddc9f45";
-      hash = "sha256-WGYEA4Q7UvSaRDjP/DiEtfXjvmWbewtdyJWRpjhbZgg=";
+      rev = "71fb15577ccb091df2f4fc1f65710edbc61b5a53";
+      hash = "sha256-81eeFjwM/haPjIEWkZPp1JSDwhWbWDAuKtWiCg7P9Q0=";
     };
 
     starship = fetchFromGitHub {
       name = "starship";
       owner = "catppuccin";
       repo = "starship";
-      rev = "e99ba6b210c0739af2a18094024ca0bdf4bb3225";
-      hash = "sha256-1w0TJdQP5lb9jCrCmhPlSexf0PkAlcz8GBDEsRjPRns=";
+      rev = "5906cc369dd8207e063c0e6e2d27bd0c0b567cb8";
+      hash = "sha256-FLHjbClpTqaK4n2qmepCPkb8rocaAo3qeV4Zp1hia0g=";
     };
 
     thunderbird = fetchFromGitHub {
@@ -196,8 +196,8 @@ let
       name = "waybar";
       owner = "catppuccin";
       repo = "waybar";
-      rev = "v1.1";
-      hash = "sha256-9lY+v1CTbpw2lREG/h65mLLw5KuT8OJdEPOb+NNC6Fo=";
+      rev = "ee8ed32b4f63e9c417249c109818dcc05a2e25da";
+      hash = "sha256-za0y6hcN2rvN6Xjf31xLRe4PP0YyHu2i454ZPjr+lWA=";
     };
   };
 in
@@ -213,7 +213,7 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "unstable-2025-02-21";
+    version = "unstable-2025-10-07";
 
     srcs = selectedSources;
 
@@ -331,9 +331,12 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
 
     meta = {
       description = "Soothing pastel themes";
-      homepage = "https://github.com/catppuccin/catppuccin";
+      homepage = "https://catppuccin.com";
       license = lib.licenses.mit;
       platforms = lib.platforms.all;
-      maintainers = [ lib.maintainers.khaneliman ];
+      maintainers = with lib.maintainers; [
+        khaneliman
+        SchweGELBin
+      ];
     };
   }
diff --git a/pkgs/by-name/cl/clblast/package.nix b/pkgs/by-name/cl/clblast/package.nix
index 8f93b2d236a5..c1f9cd6e7336 100644
--- a/pkgs/by-name/cl/clblast/package.nix
+++ b/pkgs/by-name/cl/clblast/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   fetchFromGitHub,
   cmake,
   ninja,
@@ -19,6 +20,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-fzenYFCAQ0B2NQgh5OaErv/yNEzjznB6ogRapqfL6P4=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "clblast-fix-cmake4.patch";
+      url = "https://github.com/CNugteren/CLBlast/commit/dd714f1b72aa8c341e5a27aa9e968b4ecdaf1abb.patch";
+      includes = [ "CMakeLists.txt" ];
+      hash = "sha256-AVFzEdj1CaVSJxOcn5PoqFb+b8k5YgSMD3VhvHeBd7o=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 7019fc6ab242..abf64cc9f4da 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -14,18 +14,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.44.0";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-i7UhSQ16HqcX/QUb6JQgF6WOTAEDZZNkL/MSqefcwBI=";
+    hash = "sha256-HRVfUK+ZH/Q2xEQ16wboA56q9Ia3Xx5LpdqKSpjr5hI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-sR7Y1SfP0akLRRvP/6tu3gZRNvQbG/a+4bOSEbbrV30=";
+  cargoHash = "sha256-7uO7I84kthMh4UQUioW7gf1E0IB+9ov/tDvXdiCdK2s=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/do/docopt_cpp/package.nix b/pkgs/by-name/do/docopt_cpp/package.nix
index 37c50283f698..a46d051f6750 100644
--- a/pkgs/by-name/do/docopt_cpp/package.nix
+++ b/pkgs/by-name/do/docopt_cpp/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
+  fetchpatch2,
   cmake,
   python3,
 }:
@@ -19,10 +19,15 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (fetchpatch {
+    (fetchpatch2 {
       name = "python3-for-tests";
-      url = "https://github.com/docopt/docopt.cpp/commit/b3d909dc952ab102a4ad5a1541a41736f35b92ba.patch";
-      hash = "sha256-JJR09pbn3QhYaZAIAjs+pe28+g1VfgHUKspWorHzr8o=";
+      url = "https://github.com/docopt/docopt.cpp/commit/b3d909dc952ab102a4ad5a1541a41736f35b92ba.patch?full_index=1";
+      hash = "sha256-LXnN36/JuHsCeLnjuPFa42dT52iOcnJd4NGYx96Z5c0=";
+    })
+    (fetchpatch2 {
+      name = "Increase-cmake_minimum_required-to-3.5";
+      url = "https://github.com/docopt/docopt.cpp/commit/05d507da0d153faff381f44968833ebffdc03447.patch?full_index=1";
+      hash = "sha256-bwKkhU3+GZFIUH0Ig0l9zcTtox9som3DY+ZApWrWl80=";
     })
   ];
 
diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index 8558132a7f25..9a980e79477b 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.201";
+  version = "0.0.203";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-TUGWQImDtXOOkEt20719OheKlPgWjEVdqTh/ET/c1cs=";
+    hash = "sha256-PfV50pGDGWx4Ih8x8V0ib+Oti71oH90ODepiDN+q4tU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/fl/flare/engine.nix b/pkgs/by-name/fl/flare/engine.nix
index d466f032dd8c..bfa24d0e9469 100644
--- a/pkgs/by-name/fl/flare/engine.nix
+++ b/pkgs/by-name/fl/flare/engine.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   SDL2,
   SDL2_image,
@@ -20,7 +21,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-DIzfTqwZJ8NAPB/TWzvPjepHb7hIbIr+Kk+doXJmpLc=";
   };
 
-  patches = [ ./desktop.patch ];
+  patches = [
+    ./desktop.patch
+
+    # cmake-4 compatibility patch
+    (fetchpatch {
+      name = "cmake-4.patch";
+      url = "https://github.com/flareteam/flare-engine/commit/9500379f886484382bba2f893faf49865de9f2c0.patch";
+      hash = "sha256-nUn54ZBEvvFkIhzE/UBbsvF0rFC9JAeQACTAPtsc1VI=";
+    })
+  ];
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
diff --git a/pkgs/by-name/fl/flare/game.nix b/pkgs/by-name/fl/flare/game.nix
index e726d3a290e0..59bd9a52d19d 100644
--- a/pkgs/by-name/fl/flare/game.nix
+++ b/pkgs/by-name/fl/flare/game.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
@@ -16,6 +17,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-tINIwxyQn8eeJCHwRmAMo2TYRgrgJlGaUrnrgbmM3Jo=";
   };
 
+  patches = [
+    # cmake-4 compatibility patch
+    (fetchpatch {
+      name = "cmake-4.patch";
+      url = "https://github.com/flareteam/flare-game/commit/5b61dfd69f4ecbaca6439caa9ae41b3168e4d21a.patch";
+      hash = "sha256-5Um6LWAWQyialzO3KSebmLju0VOuz1S5dzavO9EWlLE=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   meta = {
diff --git a/pkgs/by-name/fl/fly/package.nix b/pkgs/by-name/fl/fly/package.nix
index 087f3bc7e927..af9f062beec0 100644
--- a/pkgs/by-name/fl/fly/package.nix
+++ b/pkgs/by-name/fl/fly/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "fly";
-  version = "7.14.1";
+  version = "7.14.2";
 
   src = fetchFromGitHub {
     owner = "concourse";
     repo = "concourse";
     rev = "v${version}";
-    hash = "sha256-Q+j41QhhibyE+a7iOgMKm2SeXhNV8ek97P014Wje9NQ=";
+    hash = "sha256-lm4l+9hYOFKt12KaOs/5R4zymya82Tb4q1k3leyG2UA=";
   };
 
   vendorHash = "sha256-2busKAFaQYE82XKCAx8BGOMjjs8WzqIxdpz+J45maoc=";
diff --git a/pkgs/by-name/fw/fw-ectool/package.nix b/pkgs/by-name/fw/fw-ectool/package.nix
index bd1bc0bfea98..fd5bc5e87814 100644
--- a/pkgs/by-name/fw/fw-ectool/package.nix
+++ b/pkgs/by-name/fw/fw-ectool/package.nix
@@ -20,6 +20,12 @@ stdenv.mkDerivation {
     hash = "sha256-j0Z2Uo1LBXlHZVHPm4Xjx3LZaI6Qq0nSdViyC/CjWC8=";
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION 3.1)' \
+      'cmake_minimum_required(VERSION 4.0)'
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/by-name/go/go-judge/package.nix b/pkgs/by-name/go/go-judge/package.nix
index 64592b1b6d20..24877f211833 100644
--- a/pkgs/by-name/go/go-judge/package.nix
+++ b/pkgs/by-name/go/go-judge/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-judge";
-  version = "1.9.6";
+  version = "1.9.8";
 
   src = fetchFromGitHub {
     owner = "criyle";
     repo = "go-judge";
     rev = "v${version}";
-    hash = "sha256-hD33oD2JHabeVF5sHhud5czFQUC9gZEb1gri/JUFYK8=";
+    hash = "sha256-hBOH5FDqzUGiCXucbTPBPXdEnHPq7fL0SYlY5b3OMHY=";
   };
 
-  vendorHash = "sha256-JmRAFNmmEADVsV0zpctIVRlXc4DYyXX3RrBQW0MP8ow=";
+  vendorHash = "sha256-dUJpNGJvvmIJuA6GSWhL4weQEwn5iM9k+y8clHdxhvY=";
 
   tags = [
     "nomsgpack"
diff --git a/pkgs/by-name/gr/graphite-cli/package-lock.json b/pkgs/by-name/gr/graphite-cli/package-lock.json
index aaf0d83d72e5..c846f44400a1 100644
--- a/pkgs/by-name/gr/graphite-cli/package-lock.json
+++ b/pkgs/by-name/gr/graphite-cli/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.6.8",
+  "version": "1.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.6.8",
+      "version": "1.7.0",
       "hasInstallScript": true,
       "license": "None",
       "dependencies": {
diff --git a/pkgs/by-name/gr/graphite-cli/package.nix b/pkgs/by-name/gr/graphite-cli/package.nix
index 5100d7d69180..0eb51e8db8d4 100644
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@@ -9,14 +9,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.6.8";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-HkxhPx38FjwrwPGhXSWw21mizjuWblcPxWFLYUU7Oys=";
+    hash = "sha256-RoFzv4edmX4j6vl5K70fK38uZiXwqcbIvCdNcvumnRE=";
   };
 
-  npmDepsHash = "sha256-28jOlUaVo8HN5HF1EvcPAu9qYJOsby5gt9rCGbIOMRU=";
+  npmDepsHash = "sha256-OpX0FpOGtsVgIsIsEPSTkNQ6z2basOf0OTboSBcrdOI=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/ha/halibut/package.nix b/pkgs/by-name/ha/halibut/package.nix
index 730fc63aa748..564348024143 100644
--- a/pkgs/by-name/ha/halibut/package.nix
+++ b/pkgs/by-name/ha/halibut/package.nix
@@ -4,6 +4,7 @@
   fetchurl,
   cmake,
   perl,
+  fetchpatch2,
 }:
 
 stdenv.mkDerivation rec {
@@ -15,6 +16,14 @@ stdenv.mkDerivation rec {
     sha256 = "0ciikn878vivs4ayvwvr63nnhpcg12m8023xv514zxqpdxlzg85a";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "fix-charset-cmakelists.patch";
+      url = "https://git.tartarus.org/?p=simon/halibut.git;a=blobdiff_plain;f=charset/CMakeLists.txt;h=4613cb4d02959db051dd82b25d6bfd82a50455d7;hp=06eae7703d3e52aa50d5309624ec93a7684f73d8;hb=570407a40bdde2a9bb50c16aa47711202ade8923;hpb=ce14e373b7e6532c0dfa1908fe6030c5667cf79a";
+      hash = "sha256-YdLxbXc3C2UxWp0CUzvmJ8mgzqaWJ5Br4VfRU7YjBYE=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     perl
diff --git a/pkgs/by-name/hc/hcloud/package.nix b/pkgs/by-name/hc/hcloud/package.nix
index 3ccfe9d337b5..9cd1c77baebf 100644
--- a/pkgs/by-name/hc/hcloud/package.nix
+++ b/pkgs/by-name/hc/hcloud/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "hcloud";
-  version = "1.53.0";
+  version = "1.54.0";
 
   src = fetchFromGitHub {
     owner = "hetznercloud";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-jeiiBnid+s4y6h9Q9NdsbqYQpSrEzHysDq0wcNX50XY=";
+    hash = "sha256-PpCEdhEjfd7d8DdU2ABAjL8O98cLR20xWwhcESJK4uI=";
   };
 
-  vendorHash = "sha256-sqqzFFgLdVsQMOaJEwX2ixLVFj3YpuJSG5r7xc+NgvI=";
+  vendorHash = "sha256-tJwd/qLs0QvnjKi0B2NBTosGt7qCzJCHxZ5LYJB4vjA=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch b/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
deleted file mode 100644
index 19e2ee66e681..000000000000
--- a/pkgs/by-name/ho/homer/0001-build-enable-specifying-custom-sass-compiler-path-by.patch
+++ /dev/null
@@ -1,147 +0,0 @@
-From 0f77537ce2ba5c1a23d5c2a154bdc77450d1e0e5 Mon Sep 17 00:00:00 2001
-From: Christoph Heiss <christoph@c8h4.io>
-Date: Tue, 26 Aug 2025 10:23:14 +0200
-Subject: [PATCH] build: enable specifying custom sass compiler path by env-var
-
-Signed-off-by: Christoph Heiss <christoph@c8h4.io>
----
- package.json                |  5 ++++-
- patches/sass-embedded.patch | 15 +++++++++++++++
- pnpm-lock.yaml              | 27 ++++++++++++++++-----------
- 3 files changed, 35 insertions(+), 12 deletions(-)
- create mode 100644 patches/sass-embedded.patch
-
-diff --git a/package.json b/package.json
-index a67d2c6..17f17b1 100644
---- a/package.json
-+++ b/package.json
-@@ -32,6 +32,9 @@
-   "license": "Apache-2.0",
-   "packageManager": "pnpm@10.14.0+sha512.ad27a79641b49c3e481a16a805baa71817a04bbe06a38d17e60e2eaee83f6a146c6a688125f5792e48dd5ba30e7da52a5cda4c3992b9ccf333f9ce223af84748",
-   "pnpm": {
--    "neverBuiltDependencies": []
-+    "neverBuiltDependencies": [],
-+    "patchedDependencies": {
-+      "sass-embedded": "patches/sass-embedded.patch"
-+    }
-   }
- }
-diff --git a/patches/sass-embedded.patch b/patches/sass-embedded.patch
-new file mode 100644
-index 0000000..5e02bed
---- /dev/null
-+++ b/patches/sass-embedded.patch
-@@ -0,0 +1,15 @@
-+diff --git a/dist/lib/src/compiler-path.js b/dist/lib/src/compiler-path.js
-+index ae33aa3028e1a120d9e84b043bb19a71f1083b96..7a49d16a54982312ad638632d6750d7bec670f02 100644
-+--- a/dist/lib/src/compiler-path.js
-++++ b/dist/lib/src/compiler-path.js
-+@@ -8,6 +8,10 @@ const p = require("path");
-+ const compiler_module_1 = require("./compiler-module");
-+ /** The full command for the embedded compiler executable. */
-+ exports.compilerCommand = (() => {
-++    const binPath = process.env.SASS_EMBEDDED_BIN_PATH;
-++    if (binPath) {
-++        return [binPath];
-++    }
-+     try {
-+         return [
-+             require.resolve(`${compiler_module_1.compilerModule}/dart-sass/src/dart` +
-diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index 8f98554..44d1691 100644
---- a/pnpm-lock.yaml
-+++ b/pnpm-lock.yaml
-@@ -4,6 +4,11 @@ settings:
-   autoInstallPeers: true
-   excludeLinksFromLockfile: false
- 
-+patchedDependencies:
-+  sass-embedded:
-+    hash: 24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20
-+    path: patches/sass-embedded.patch
-+
- importers:
- 
-   .:
-@@ -29,7 +34,7 @@ importers:
-         version: 9.32.0
-       '@vitejs/plugin-vue':
-         specifier: ^6.0.1
--        version: 6.0.1(vite@7.0.6(sass-embedded@1.90.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))(vue@3.5.18)
-+        version: 6.0.1(vite@7.0.6(sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20))(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))(vue@3.5.18)
-       '@vue/eslint-config-prettier':
-         specifier: ^10.2.0
-         version: 10.2.0(eslint@9.32.0)(prettier@3.6.2)
-@@ -50,13 +55,13 @@ importers:
-         version: 3.6.2
-       sass-embedded:
-         specifier: ^1.90.0
--        version: 1.90.0
-+        version: 1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20)
-       vite:
-         specifier: ^7.0.6
--        version: 7.0.6(sass-embedded@1.90.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1)
-+        version: 7.0.6(sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20))(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1)
-       vite-plugin-pwa:
-         specifier: ^1.0.2
--        version: 1.0.2(vite@7.0.6(sass-embedded@1.90.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))(workbox-build@7.3.0)(workbox-window@7.3.0)
-+        version: 1.0.2(vite@7.0.6(sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20))(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))(workbox-build@7.3.0)(workbox-window@7.3.0)
- 
- packages:
- 
-@@ -3634,10 +3639,10 @@ snapshots:
- 
-   '@types/trusted-types@2.0.7': {}
- 
--  '@vitejs/plugin-vue@6.0.1(vite@7.0.6(sass-embedded@1.90.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))(vue@3.5.18)':
-+  '@vitejs/plugin-vue@6.0.1(vite@7.0.6(sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20))(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))(vue@3.5.18)':
-     dependencies:
-       '@rolldown/pluginutils': 1.0.0-beta.29
--      vite: 7.0.6(sass-embedded@1.90.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1)
-+      vite: 7.0.6(sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20))(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1)
-       vue: 3.5.18
- 
-   '@vue/compiler-core@3.5.18':
-@@ -4869,7 +4874,7 @@ snapshots:
-   sass-embedded-win32-x64@1.90.0:
-     optional: true
- 
--  sass-embedded@1.90.0:
-+  sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20):
-     dependencies:
-       '@bufbuild/protobuf': 2.6.3
-       buffer-builder: 0.2.0
-@@ -5184,18 +5189,18 @@ snapshots:
- 
-   varint@6.0.0: {}
- 
--  vite-plugin-pwa@1.0.2(vite@7.0.6(sass-embedded@1.90.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))(workbox-build@7.3.0)(workbox-window@7.3.0):
-+  vite-plugin-pwa@1.0.2(vite@7.0.6(sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20))(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1))(workbox-build@7.3.0)(workbox-window@7.3.0):
-     dependencies:
-       debug: 4.4.1
-       pretty-bytes: 6.1.1
-       tinyglobby: 0.2.14
--      vite: 7.0.6(sass-embedded@1.90.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1)
-+      vite: 7.0.6(sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20))(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1)
-       workbox-build: 7.3.0
-       workbox-window: 7.3.0
-     transitivePeerDependencies:
-       - supports-color
- 
--  vite@7.0.6(sass-embedded@1.90.0)(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1):
-+  vite@7.0.6(sass-embedded@1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20))(sass@1.90.0)(terser@5.43.1)(yaml@2.8.1):
-     dependencies:
-       esbuild: 0.25.8
-       fdir: 6.4.6(picomatch@4.0.3)
-@@ -5206,7 +5211,7 @@ snapshots:
-     optionalDependencies:
-       fsevents: 2.3.3
-       sass: 1.90.0
--      sass-embedded: 1.90.0
-+      sass-embedded: 1.90.0(patch_hash=24d35db63138795a11bb26b230cf743c82f571c7e2ee061db58263799d659e20)
-       terser: 5.43.1
-       yaml: 2.8.1
- 
--- 
-2.50.1
-
diff --git a/pkgs/by-name/ho/homer/package.nix b/pkgs/by-name/ho/homer/package.nix
index 79c4cffde305..b1c8f9999a7b 100644
--- a/pkgs/by-name/ho/homer/package.nix
+++ b/pkgs/by-name/ho/homer/package.nix
@@ -11,12 +11,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "homer";
-  version = "25.08.1";
+  version = "25.09.1";
   src = fetchFromGitHub {
     owner = "bastienwirtz";
     repo = "homer";
     rev = "v${version}";
-    hash = "sha256-DA2gdh6o67QDC4y+N5DVG0ktjt/ORNbycU/y2cUjUE0=";
+    hash = "sha256-MwDDnfp21MoQ9hh0+cjUo+sc+u69rx1K9ATbBB6RX78=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
@@ -24,15 +24,12 @@ stdenvNoCC.mkDerivation rec {
       pname
       version
       src
-      patches
+
       ;
     fetcherVersion = 2;
-    hash = "sha256-y/4f/39NOVV46Eg3h7fw8K43/kUIBqtiokTRRlX7398=";
+    hash = "sha256-2cozIe70PGo1WRUeWrY8W1B6U2QYLbWYcwN5WllRwkg=";
   };
 
-  # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
-  patches = [ ./0001-build-enable-specifying-custom-sass-compiler-path-by.patch ];
-
   nativeBuildInputs = [
     nodejs
     dart-sass
@@ -42,7 +39,9 @@ stdenvNoCC.mkDerivation rec {
   buildPhase = ''
     runHook preBuild
 
-    export SASS_EMBEDDED_BIN_PATH="${dart-sass}/bin/sass"
+    # force the sass npm dependency to use our own sass binary instead of the bundled one
+    substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
+      --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'
     pnpm build
 
     runHook postBuild
@@ -54,6 +53,10 @@ stdenvNoCC.mkDerivation rec {
     mkdir -p $out
     cp -R dist/* $out/
 
+    # Remove sample/demo files from output
+    rm -f $out/assets/*.yml.dist
+    rm -f $out/assets/*.css.sample
+
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/in/innoextract/package.nix b/pkgs/by-name/in/innoextract/package.nix
index 644c57812260..158571b48e6f 100644
--- a/pkgs/by-name/in/innoextract/package.nix
+++ b/pkgs/by-name/in/innoextract/package.nix
@@ -1,8 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitHub,
   cmake,
   makeWrapper,
   boost,
@@ -10,27 +9,20 @@
   libiconv,
   withGog ? false,
   unar ? null,
+  unstableGitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "innoextract";
-  version = "1.9";
+  version = "1.9-unstable-2025-02-06";
 
-  src = fetchurl {
-    url = "https://constexpr.org/innoextract/files/innoextract-${version}.tar.gz";
-    sha256 = "09l1z1nbl6ijqqwszdwch9mqr54qb7df0wp2sd77v17dq6gsci33";
+  src = fetchFromGitHub {
+    owner = "dscharrer";
+    repo = "innoextract";
+    rev = "6e9e34ed0876014fdb46e684103ef8c3605e382e";
+    hash = "sha256-bgACPDo1phjIiwi336JEB1UAJKyL2NmCVOhyZxBFLJo=";
   };
 
-  patches = [
-    # Fix boost-1.86 build:
-    #   https://github.com/dscharrer/innoextract/pull/169
-    (fetchpatch {
-      name = "boost-1.86.patch";
-      url = "https://github.com/dscharrer/innoextract/commit/264c2fe6b84f90f6290c670e5f676660ec7b2387.patch";
-      hash = "sha256-QYwrqLXC7FE4oYi6G1erpX/RUUtS5zNBv7/fO7AdZQg=";
-    })
-  ];
-
   buildInputs = [
     xz
     boost
@@ -53,6 +45,9 @@ stdenv.mkDerivation rec {
       --prefix PATH : ${lib.makeBinPath [ unar ]}
   '';
 
+  # use unstable as latest release does not yet support cmake-4
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with lib; {
     description = "Tool to unpack installers created by Inno Setup";
     homepage = "https://constexpr.org/innoextract/";
diff --git a/pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch b/pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch
new file mode 100644
index 000000000000..518accce964e
--- /dev/null
+++ b/pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch
@@ -0,0 +1,77 @@
+From bc76a7087e4621269bdf9080581088a6c8f6b3a6 Mon Sep 17 00:00:00 2001
+From: Chris Mayo <aklhfex@gmail.com>
+Date: Tue, 20 May 2025 19:27:57 +0100
+Subject: [PATCH] Raise minimum CMake version to 3.5
+
+For compatibility with CMake 4.0, which also removes CMP0043 OLD - there
+are no uses of COMPILE_DEFINITIONS_<CONFIG>.
+
+Signed-off-by: Chris Mayo <aklhfex@gmail.com>
+---
+ IGC/MDAutogen/CMakeLists.txt                    | 2 +-
+ external/SPIRV-Tools/CMakeLists.txt             | 2 +-
+ visa/CMakeLists.txt                             | 7 +------
+ visa/iga/GEDLibrary/GED_external/CMakeLists.txt | 6 +-----
+ 4 files changed, 4 insertions(+), 13 deletions(-)
+
+diff --git a/IGC/MDAutogen/CMakeLists.txt b/IGC/MDAutogen/CMakeLists.txt
+index c9522feea29d..0a79b3c8e32b 100644
+--- a/igc/IGC/MDAutogen/CMakeLists.txt
++++ b/igc/IGC/MDAutogen/CMakeLists.txt
+@@ -6,7 +6,7 @@
+ #
+ #============================ end_copyright_notice =============================
+ 
+-cmake_minimum_required(VERSION 2.8.12)
++cmake_minimum_required(VERSION 3.5)
+ 
+ set(_autogenScript "${IGC_SOURCE_DIR}/common/autogen.py")
+ set(_autogenSource "${IGC_SOURCE_DIR}/common/MDFrameWork.h")
+diff --git a/external/SPIRV-Tools/CMakeLists.txt b/external/SPIRV-Tools/CMakeLists.txt
+index d2e3f63fb0d3..75f013409990 100644
+--- a/igc/external/SPIRV-Tools/CMakeLists.txt
++++ b/igc/external/SPIRV-Tools/CMakeLists.txt
+@@ -6,7 +6,7 @@
+ #
+ #============================ end_copyright_notice =============================
+ 
+-cmake_minimum_required(VERSION 2.8.12)
++cmake_minimum_required(VERSION 3.5)
+ 
+ message(STATUS "============================ SPIRV-Tools project ============================")
+ 
+diff --git a/visa/CMakeLists.txt b/visa/CMakeLists.txt
+index a96924e907c5..1e4b57516ce8 100644
+--- a/igc/visa/CMakeLists.txt
++++ b/igc/visa/CMakeLists.txt
+@@ -74,12 +74,7 @@ if (WIN32 OR UNIX)
+   add_subdirectory(iga/IGAExe)
+ endif (WIN32 OR UNIX)
+ 
+-if(WIN32)
+-  cmake_minimum_required(VERSION 3.1)
+-  cmake_policy(SET CMP0043 OLD)
+-else()
+-  cmake_minimum_required(VERSION 2.8.12)
+-endif(WIN32)
++cmake_minimum_required(VERSION 3.5)
+ 
+ # In the case where this is the IGC build we need to add a dummy custom target check_headers
+ add_custom_target(check_headers)
+diff --git a/visa/iga/GEDLibrary/GED_external/CMakeLists.txt b/visa/iga/GEDLibrary/GED_external/CMakeLists.txt
+index e40313fc1944..275fff1114a6 100644
+--- a/igc/visa/iga/GEDLibrary/GED_external/CMakeLists.txt
++++ b/igc/visa/iga/GEDLibrary/GED_external/CMakeLists.txt
+@@ -7,11 +7,7 @@
+ #============================ end_copyright_notice =============================
+ 
+ # GEDLibrary/GED
+-if(WIN32)
+-    cmake_minimum_required(VERSION 3.1)
+-else()
+-    cmake_minimum_required(VERSION 2.8.12)
+-endif(WIN32)
++cmake_minimum_required(VERSION 3.5)
+ 
+ project(GEDLibrary)
+ 
diff --git a/pkgs/by-name/in/intel-graphics-compiler/package.nix b/pkgs/by-name/in/intel-graphics-compiler/package.nix
index d30b7b783e7b..2c3e65dcf9fe 100644
--- a/pkgs/by-name/in/intel-graphics-compiler/package.nix
+++ b/pkgs/by-name/in/intel-graphics-compiler/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   ninja,
   git,
@@ -58,6 +59,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  patches = [
+    # Raise minimum CMake version to 3.5
+    # https://github.com/intel/intel-graphics-compiler/commit/4f0123a7d67fb716b647f0ba5c1ab550abf2f97d
+    # https://github.com/intel/intel-graphics-compiler/pull/364
+    ./bump-cmake.patch
+  ];
+
   sourceRoot = ".";
 
   cmakeDir = "../igc";
diff --git a/pkgs/by-name/li/libcint/package.nix b/pkgs/by-name/li/libcint/package.nix
index 0e6fa2408c0a..a85880b587a5 100644
--- a/pkgs/by-name/li/libcint/package.nix
+++ b/pkgs/by-name/li/libcint/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     downloadPage = "https://github.com/sunqm/libcint";
     changelog = "https://github.com/sunqm/libcint/blob/master/ChangeLog";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/by-name/li/libdaq/package.nix b/pkgs/by-name/li/libdaq/package.nix
index 4f01a909114f..a7b2ca1748b7 100644
--- a/pkgs/by-name/li/libdaq/package.nix
+++ b/pkgs/by-name/li/libdaq/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdaq";
-  version = "3.0.19";
+  version = "3.0.21";
 
   src = fetchFromGitHub {
     owner = "snort3";
     repo = "libdaq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ma+M/rIbChqL0pjhE0a1UfJLm/r7I7IvIuSwcnQWvAQ=";
+    hash = "sha256-ifG7Ccuwus+ftTzjTrvgkGDAxEhYT9pJVrILn7K17P8=";
   };
 
   nativeBuildInputs = [
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
       aycanirican
       brianmcgillion
     ];
-    changelog = "https://github.com/snort3/libdaq/releases/tag/v${finalAttrs.version}/changelog.md";
+    changelog = "https://github.com/snort3/libdaq/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl2;
     outputsToInstall = [
       "lib"
diff --git a/pkgs/by-name/li/libunarr/package.nix b/pkgs/by-name/li/libunarr/package.nix
index 2ea5d3025a24..bb5d2e88092f 100644
--- a/pkgs/by-name/li/libunarr/package.nix
+++ b/pkgs/by-name/li/libunarr/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   cmake,
 }:
 
@@ -14,6 +15,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-Mo76BOqZbdOJFrEkeozxdqwpuFyvkhdONNMZmN5BdNI=";
   };
 
+  patches = [
+    # cmake-4 compatibility:
+    #   https://github.com/selmf/unarr/pull/30
+    (fetchpatch {
+      name = "cmake-4.patch";
+      url = "https://github.com/selmf/unarr/commit/1df8ab3d281409e9fe6bed8bf485976bb47f5bef.patch";
+      hash = "sha256-u3shRgtRcHYxvXAHmYyQH1HLYV1PgWaJBY7BZCOYiL4=";
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace CMakeLists.txt \
       --replace "-flto" "" \
diff --git a/pkgs/by-name/li/lightningcss/package.nix b/pkgs/by-name/li/lightningcss/package.nix
index 21b67ff7e9da..0aa89973b4f1 100644
--- a/pkgs/by-name/li/lightningcss/package.nix
+++ b/pkgs/by-name/li/lightningcss/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lightningcss";
-  version = "1.30.1";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "parcel-bundler";
     repo = "lightningcss";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-imLbsQ2F5CQiepwWSMcXj0Fgyv4liCMmCwA/0SE07Mo=";
+    hash = "sha256-AuMboSZ7fX6UhnPeXjpnBEDGkQdK1EMKSUpw3TPZxRk=";
   };
 
-  cargoHash = "sha256-aNho9NavEgY4dwGcNXsLDnlVCB2rODIPae3LnfOwJIA=";
+  cargoHash = "sha256-7oyDnT81G47SaceJ5st+1P3a2fb9Dj5Eu2c0glw8YW4=";
 
   patches = [
     # Backport fix for build error for lightningcss-napi
diff --git a/pkgs/by-name/li/linkwarden/01-localfont.patch b/pkgs/by-name/li/linkwarden/01-localfont.patch
new file mode 100644
index 000000000000..459ccc39a8f5
--- /dev/null
+++ b/pkgs/by-name/li/linkwarden/01-localfont.patch
@@ -0,0 +1,42 @@
+diff --git i/apps/web/components/Preservation/ReadableView.tsx w/apps/web/components/Preservation/ReadableView.tsx
+index 64f14186..daff3636 100644
+--- i/apps/web/components/Preservation/ReadableView.tsx
++++ w/apps/web/components/Preservation/ReadableView.tsx
+@@ -20,13 +20,13 @@ import {
+ } from "@linkwarden/router/highlights";
+ import { Highlight } from "@linkwarden/prisma/client";
+ import { useUser } from "@linkwarden/router/user";
+-import { Caveat } from "next/font/google";
+-import { Bentham } from "next/font/google";
++import localFont from "next/font/local";
+ import { Separator } from "../ui/separator";
+ import { Button } from "../ui/button";
+ 
+-const caveat = Caveat({ subsets: ["latin"] });
+-const bentham = Bentham({ subsets: ["latin"], weight: "400" });
++
++const caveat = localFont({ src: "../../public/caveat.ttf" });
++const bentham = localFont({ src: "../../public/bentham.ttf" });
+ 
+ type Props = {
+   link: LinkIncludingShortenedCollectionAndTags;
+diff --git i/apps/web/components/TextStyleDropdown.tsx w/apps/web/components/TextStyleDropdown.tsx
+index a84587d9..59a291e4 100644
+--- i/apps/web/components/TextStyleDropdown.tsx
++++ w/apps/web/components/TextStyleDropdown.tsx
+@@ -13,12 +13,11 @@ import {
+ import { Button } from "@/components/ui/button";
+ import { FitWidth, FormatLineSpacing, FormatSize } from "@/components/ui/icons";
+ import { useUpdateUserPreference, useUser } from "@linkwarden/router/user";
+-import { Caveat } from "next/font/google";
+-import { Bentham } from "next/font/google";
++import localFont from "next/font/local";
+ import { useTranslation } from "next-i18next";
+ 
+-const caveat = Caveat({ subsets: ["latin"] });
+-const bentham = Bentham({ subsets: ["latin"], weight: "400" });
++const caveat = localFont({ src: "../public/caveat.ttf" });
++const bentham = localFont({ src: "../public/bentham.ttf" });
+ 
+ const fontSizes = [
+   "12px",
diff --git a/pkgs/by-name/li/linkwarden/package.nix b/pkgs/by-name/li/linkwarden/package.nix
new file mode 100644
index 000000000000..626427b4e66b
--- /dev/null
+++ b/pkgs/by-name/li/linkwarden/package.nix
@@ -0,0 +1,205 @@
+{
+  lib,
+  stdenvNoCC,
+  buildNpmPackage,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  makeBinaryWrapper,
+  nixosTests,
+  yarnConfigHook,
+  fetchpatch,
+  # dependencies
+  bash,
+  monolith,
+  nodejs,
+  openssl,
+  google-fonts,
+  playwright-driver,
+  prisma,
+  prisma-engines,
+}:
+
+let
+  # The bcrypt package requires a gyp build and its dev dependencies.
+  # Linkwarden uses yarn for dependencies, bycrypt npm. Mixing the two causes issues.
+  bcrypt = buildNpmPackage rec {
+    pname = "bcrypt";
+    version = "5.1.1";
+
+    src = fetchFromGitHub {
+      owner = "kelektiv";
+      repo = "node.bcrypt.js";
+      tag = "v${version}";
+      hash = "sha256-mgfYEgvgC5JwgUhU8Kn/f1D7n9ljnIODkKotEcxQnDQ=";
+    };
+
+    npmDepsHash = "sha256-CPXZ/yLEjTBIyTPVrgCvb+UGZJ6yRZUJOvBSZpLSABY=";
+
+    npmBuildScript = "install";
+
+    postInstall = ''
+      cp -r lib $out/lib/node_modules/bcrypt/
+    '';
+  };
+
+  google-fonts' = google-fonts.override {
+    fonts = [
+      "Caveat"
+      "Bentham"
+    ];
+  };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "linkwarden";
+  version = "2.13.0";
+
+  src = fetchFromGitHub {
+    owner = "linkwarden";
+    repo = "linkwarden";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zoJ5y2J+lkmfAFdI/7FvFAC6D308IPxaLzpGtj42IrU=";
+  };
+
+  patches = [
+    /*
+      Prevents NextJS from attempting to download fonts during build. The fonts
+      directory will be created in the derivation script.
+
+      See similar patches:
+       pkgs/by-name/cr/crabfit-frontend/01-localfont.patch
+       pkgs/by-name/al/alcom/use-local-fonts.patch
+       pkgs/by-name/ne/nextjs-ollama-llm-ui/0002-use-local-google-fonts.patch
+    */
+    ./01-localfont.patch
+
+    /*
+      https://github.com/linkwarden/linkwarden/pull/1290
+
+      Fixes an issue where linkwarden cannot save a plain HTTP (no TLS) website.
+    */
+    (fetchpatch {
+      url = "https://github.com/linkwarden/linkwarden/commit/327826d760e5b1870c58a25f85501a7c9a468818.patch";
+      hash = "sha256-kq1GIEW0chnPmzvg4eDSS/5WtRyWlrHlk41h4pSCMzg=";
+    })
+  ];
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-Z1EwecQGWHr6RZCDHAy7BA6BEoixj1dbKH3XE8sfeKQ=";
+  };
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    nodejs
+    prisma
+    yarnConfigHook
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  env.NODE_ENV = "production";
+
+  postPatch = ''
+    for f in packages/filesystem/*Folder.ts packages/filesystem/*File.ts; do
+      substituteInPlace $f \
+        --replace-fail 'process.cwd(),' "" \
+        --replace-fail '"../..",' ""
+    done
+  '';
+
+  preBuild = ''
+    export PRISMA_CLIENT_ENGINE_TYPE='binary'
+    export PRISMA_QUERY_ENGINE_LIBRARY="${prisma-engines}/lib/libquery_engine.node"
+    export PRISMA_QUERY_ENGINE_BINARY="${prisma-engines}/bin/query-engine"
+    export PRISMA_SCHEMA_ENGINE_BINARY="${prisma-engines}/bin/schema-engine"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    cp ${google-fonts'}/share/fonts/truetype/Bentham-* ./apps/web/public/bentham.ttf
+    cp ${google-fonts'}/share/fonts/truetype/Caveat* ./apps/web/public/caveat.ttf
+
+    yarn prisma:generate
+    yarn web:build
+
+    runHook postBuild
+  '';
+
+  postBuild = ''
+    substituteInPlace node_modules/next/dist/server/image-optimizer.js \
+      --replace-fail 'this.cacheDir = (0, _path.join)(distDir, "cache", "images");' 'this.cacheDir = (0, _path.join)(process.env.LINKWARDEN_CACHE_DIR, "cache", "images");'
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Shrink closure a bit
+    shopt -s extglob
+    rm -rf node_modules/bcrypt node_modules/@next/swc-* node_modules/lightningcss* node_modules/react-native* node_modules/@react-native* \
+      node_modules/expo* node_modules/@expo node_modules/.bin node_modules/zeego/node_modules/.bin node_modules/@react-navigation/native* \
+      node_modules/@react-navigation/*/node_modules/.bin node_modules/@native-html node_modules/jest-expo node_modules/@jsamr/react-native-li \
+      node_modules/lucide-react-native node_modules/@esbuild/!(linux-x64)
+    shopt -u extglob
+
+    ln -s ${bcrypt}/lib/node_modules/bcrypt node_modules/
+    mkdir -p $out/share/linkwarden/apps/web/.next $out/bin
+    cp -r apps/web/.next apps/web/* $out/share/linkwarden/apps/web
+    cp -r apps/worker $out/share/linkwarden/apps/worker
+    cp -r packages $out/share/linkwarden/
+    cp -r node_modules $out/share/linkwarden/
+    rm -r $out/share/linkwarden/node_modules/@linkwarden/{mobile,react-native-render-html}
+
+    echo "#!${lib.getExe bash} -e
+    export DATABASE_URL=\''${DATABASE_URL-"postgresql://\$DATABASE_USER:\$POSTGRES_PASSWORD@\$DATABASE_HOST:\$DATABASE_PORT/\$DATABASE_NAME"}
+    export npm_config_cache="\$LINKWARDEN_CACHE_DIR/npm"
+
+    if [ \"\$1\" == \"worker\" ]; then
+      echo "Starting worker"
+      ${lib.getExe' nodejs "npm"} start --prefix $out/share/linkwarden/apps/worker
+    else
+      echo "Starting server"
+      ${lib.getExe prisma} migrate deploy --schema $out/share/linkwarden/packages/prisma/schema.prisma \
+        && ${lib.getExe' nodejs "npm"} start --prefix $out/share/linkwarden/apps/web -- -H \$LINKWARDEN_HOST -p \$LINKWARDEN_PORT
+    fi
+    " > $out/bin/start.sh
+    chmod +x $out/bin/start.sh
+
+    makeWrapper $out/bin/start.sh $out/bin/linkwarden \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          bash
+          monolith
+          openssl
+        ]
+      }" \
+      --set-default PRISMA_CLIENT_ENGINE_TYPE 'binary' \
+      --set-default PRISMA_QUERY_ENGINE_LIBRARY "${prisma-engines}/lib/libquery_engine.node" \
+      --set-default PRISMA_QUERY_ENGINE_BINARY "${prisma-engines}/bin/query-engine" \
+      --set-default PRISMA_SCHEMA_ENGINE_BINARY "${prisma-engines}/bin/schema-engine" \
+      --set-default PLAYWRIGHT_LAUNCH_OPTIONS_EXECUTABLE_PATH ${playwright-driver.browsers-chromium}/chromium-*/chrome-linux/chrome \
+      --set-default LINKWARDEN_CACHE_DIR /var/cache/linkwarden \
+      --set-default LINKWARDEN_HOST localhost \
+      --set-default LINKWARDEN_PORT 3000 \
+      --set-default STORAGE_FOLDER /var/lib/linkwarden \
+      --set-default NEXT_TELEMETRY_DISABLED 1
+
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) linkwarden;
+  };
+
+  meta = {
+    description = "Self-hosted collaborative bookmark manager to collect, organize, and preserve webpages, articles, and more...";
+    homepage = "https://linkwarden.app/";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ jvanbruegge ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "linkwarden";
+  };
+
+})
diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix
index cc12dd32e0b3..d0e091b644b7 100644
--- a/pkgs/by-name/lo/lockbook-desktop/package.nix
+++ b/pkgs/by-name/lo/lockbook-desktop/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "lockbook-desktop";
-  version = "25.9.17";
+  version = "25.10.7";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-S2FApDKP2P4c9z6szM4irmu/ThmGnfgzzqJjI9qRc6w=";
+    hash = "sha256-EzVMTJaxPeIOJUdwmaShMLEe1XQcJx+0i1Rl0ILi5+c=";
   };
 
-  cargoHash = "sha256-94YNSY7s5mS3j/HhPx5HAMqiKXBXWbToysREmTHKgCk=";
+  cargoHash = "sha256-ze82Iu2lH0n3ucKibLu3/VWMaaDWhs0oFFe/na2GbmY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/lo/lockbook/package.nix b/pkgs/by-name/lo/lockbook/package.nix
index 12edcbc57a75..aa0bf6970c25 100644
--- a/pkgs/by-name/lo/lockbook/package.nix
+++ b/pkgs/by-name/lo/lockbook/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lockbook";
-  version = "25.9.17";
+  version = "25.10.7";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-S2FApDKP2P4c9z6szM4irmu/ThmGnfgzzqJjI9qRc6w=";
+    hash = "sha256-EzVMTJaxPeIOJUdwmaShMLEe1XQcJx+0i1Rl0ILi5+c=";
   };
 
-  cargoHash = "sha256-94YNSY7s5mS3j/HhPx5HAMqiKXBXWbToysREmTHKgCk=";
+  cargoHash = "sha256-ze82Iu2lH0n3ucKibLu3/VWMaaDWhs0oFFe/na2GbmY=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [
diff --git a/pkgs/by-name/lu/lune/package.nix b/pkgs/by-name/lu/lune/package.nix
index 7f0ec9b1faea..df7bf3ce6753 100644
--- a/pkgs/by-name/lu/lune/package.nix
+++ b/pkgs/by-name/lu/lune/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lune";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "filiptibell";
     repo = "lune";
     tag = "v${version}";
-    hash = "sha256-td+rzfM4MtvuwnxDZbJOJAFMPzc/KzTWsHSiqJg2+a4=";
+    hash = "sha256-pWOGaVugfnwaA4alFP85ha+/iaN8x6KOVnx38vfFk78=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-vgnt76GyKYJhrnMqJNKj5YMXubDzSgsab07nd5Y8+qY=";
+  cargoHash = "sha256-cq7Sgq9f2XpVTgEOMfR/G7sTqcWLwuJBgG9U+h4IMWQ=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
diff --git a/pkgs/by-name/ma/maim/package.nix b/pkgs/by-name/ma/maim/package.nix
index eca2e188eba1..e2719e11d978 100644
--- a/pkgs/by-name/ma/maim/package.nix
+++ b/pkgs/by-name/ma/maim/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   pkg-config,
   zlib,
@@ -23,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "maim";
-  version = "5.8.0";
+  version = "5.8.1";
 
   src = fetchFromGitHub {
     owner = "naelstrof";
     repo = "maim";
     rev = "v${version}";
-    sha256 = "sha256-/tZqSJnKe8GiffSz9VIFKuxMktRld+hA4ZWP4TZQrlg=";
+    hash = "sha256-bbjV3+41cxAlKCEd1/nvnZ19GhctWOr5Lu4X+Vg3EAk=";
   };
 
   nativeBuildInputs = [
@@ -53,15 +52,6 @@ stdenv.mkDerivation rec {
     icu
   ];
 
-  patches = [
-    # Use C++17 as required by icu
-    (fetchpatch {
-      name = "maim-c++-17.patch";
-      url = "https://github.com/naelstrof/maim/commit/e7fe09b6734baeb59081b8805be542c92178cf0f.patch";
-      sha256 = "0z9zvrr8msfli88jmhxm5knysi385s48j2w7zpacc7qhf4c5zh8c";
-    })
-  ];
-
   doCheck = false;
 
   meta = {
diff --git a/pkgs/by-name/mo/moxnotify/package.nix b/pkgs/by-name/mo/moxnotify/package.nix
new file mode 100644
index 000000000000..01456d62d31e
--- /dev/null
+++ b/pkgs/by-name/mo/moxnotify/package.nix
@@ -0,0 +1,104 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  clang,
+  libclang,
+  makeWrapper,
+  lua5_4,
+  dbus,
+  wayland,
+  wayland-protocols,
+  pipewire,
+  vulkan-loader,
+  libxkbcommon,
+  libGL,
+  sqlite,
+  fontconfig,
+  freetype,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "moxnotify";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "mox-desktop";
+    repo = "moxnotify";
+    rev = "6726af08621072e0c95a147cf4ae63ea66c7e857";
+    hash = "sha256-tTgY/813WaW3K8QKbj6qwCVKOAA8zMqy97Q7Z5qA0JM=";
+  };
+
+  cargoHash = "sha256-o2YyPa7bX9585lsicJjhj1xJ1jMdU5mlxbEn/6zSy8U=";
+
+  nativeBuildInputs = [
+    pkg-config
+    clang
+    makeWrapper
+  ];
+
+  buildInputs = [
+    lua5_4
+    dbus
+    wayland
+    wayland-protocols
+    pipewire
+    vulkan-loader
+    libxkbcommon
+    libGL
+    sqlite
+    fontconfig
+    freetype
+    libclang.lib
+  ];
+
+  # Set LIBCLANG_PATH for bindgen
+  env.LIBCLANG_PATH = "${libclang.lib}/lib";
+
+  # Workspace members - build both daemon and ctl
+  cargoBuildFlags = [ "--workspace" ];
+  cargoTestFlags = [ "--workspace" ];
+
+  # Skip tests for now as they may require display/audio systems
+  doCheck = false;
+
+  # Install both binaries with proper names
+  postInstall = ''
+    # Rename binaries to have more descriptive names
+    mv $out/bin/daemon $out/bin/moxnotify
+    mv $out/bin/ctl $out/bin/moxctl
+
+    # Install D-Bus service file
+    mkdir -p $out/share/dbus-1/services
+    substitute ${src}/pl.mox.notify.service.in $out/share/dbus-1/services/pl.mox.notify.service \
+      --replace-fail "@bindir@" "$out/bin"
+  '';
+
+  # Wrap binaries with runtime dependencies for graphics libraries
+  postFixup = ''
+    wrapProgram $out/bin/moxnotify \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [
+          vulkan-loader
+          libGL
+        ]
+      }
+    wrapProgram $out/bin/moxctl \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [
+          vulkan-loader
+          libGL
+        ]
+      }
+  '';
+
+  meta = {
+    description = "Feature-rich hardware-accelerated keyboard driven Wayland notification daemon";
+    homepage = "https://github.com/mox-desktop/moxnotify";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ logger ];
+    platforms = lib.platforms.linux; # Wayland-specific, Linux only
+    mainProgram = "moxnotify";
+  };
+}
diff --git a/pkgs/by-name/mu/muparserx/package.nix b/pkgs/by-name/mu/muparserx/package.nix
index 4c1071eb2c68..d30fac0d67f6 100644
--- a/pkgs/by-name/mu/muparserx/package.nix
+++ b/pkgs/by-name/mu/muparserx/package.nix
@@ -35,6 +35,6 @@ stdenv.mkDerivation rec {
     description = "C++ Library for Parsing Expressions with Strings, Complex Numbers, Vectors, Matrices and more";
     homepage = "https://beltoforion.de/en/muparserx/";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/ne/nezha/package.nix b/pkgs/by-name/ne/nezha/package.nix
index 8094d74c5856..6d328b2213ce 100644
--- a/pkgs/by-name/ne/nezha/package.nix
+++ b/pkgs/by-name/ne/nezha/package.nix
@@ -14,7 +14,7 @@
 
 let
   pname = "nezha";
-  version = "1.13.2";
+  version = "1.14.3";
 
   frontendName = lib.removePrefix "nezha-theme-";
 
@@ -58,7 +58,7 @@ buildGo124Module {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${version}";
-    hash = "sha256-IkB2V4KKSUfX+E9bMEGzCc3urAjgpXYhpO0Lfi4LYdY=";
+    hash = "sha256-ORPu7mCNqHfuXq/nB3TuNoevbw5ZMvZFetR6NPX/b3U=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/ni/nixfmt/generated-package.nix b/pkgs/by-name/ni/nixfmt/generated-package.nix
index df4a00eb9cf1..fc2566739ac9 100644
--- a/pkgs/by-name/ni/nixfmt/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt/generated-package.nix
@@ -23,10 +23,10 @@
 }:
 mkDerivation {
   pname = "nixfmt";
-  version = "1.0.1";
+  version = "1.1.0";
   src = fetchzip {
-    url = "https://github.com/nixos/nixfmt/archive/v1.0.1.tar.gz";
-    sha256 = "00ra92pq3926vr96wjzn9109zljbv1qy64nv9p2vgabnwwhx5nll";
+    url = "https://github.com/nixos/nixfmt/archive/v1.1.0.tar.gz";
+    sha256 = "19sydkdw1579qmvzx0zq06s23bm6m6l9wp1kvsfhxawk8pkz2pc2";
   };
   isLibrary = true;
   isExecutable = true;
diff --git a/pkgs/by-name/on/onionbalance/package.nix b/pkgs/by-name/on/onionbalance/package.nix
new file mode 100644
index 000000000000..c05141976dd0
--- /dev/null
+++ b/pkgs/by-name/on/onionbalance/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitLab,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "onionbalance";
+  version = "0.2.4";
+
+  pyproject = true;
+  src = fetchFromGitLab {
+    domain = "gitlab.torproject.org";
+    owner = "tpo";
+    repo = "onion-services/onionbalance";
+    tag = version;
+    hash = "sha256-amwKP9LJ7aHPECNUNTluFpgIFSRLxR7eHQxBxW5574I=";
+  };
+  dependencies = with python3Packages; [
+    cryptography
+    pycryptodomex
+    pyyaml
+    setproctitle
+    stem
+  ];
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  meta = {
+    description = "Tool for loadbalancing onion services";
+    homepage = "https://github.com/torproject/onionbalance";
+    changelog = "https://github.com/torproject/onionbalance/blob/${version}/docs/changelog.md";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.ForgottenBeast ];
+    mainProgram = "onionbalance";
+  };
+}
diff --git a/pkgs/by-name/op/openvino/package.nix b/pkgs/by-name/op/openvino/package.nix
index 81eb194a5fb9..81c9db239ab9 100644
--- a/pkgs/by-name/op/openvino/package.nix
+++ b/pkgs/by-name/op/openvino/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   fetchurl,
   cudaSupport ? opencv.cudaSupport or false,
 
@@ -71,6 +72,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-EtXHMOIk4hGcLiaoC0ZWYF6XZCD2qNtt1HeJoJIuuTA=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "cmake4-compat.patch";
+      url = "https://github.com/openvinotoolkit/openvino/commit/677716c2471cadf1bf1268eca6343498a886a229.patch?full_index=1";
+      hash = "sha256-iaifJBdl7+tQZq1d8SiczUaXz+AdfMrLtwzfTmSG+XA=";
+    })
+  ];
+
   outputs = [
     "out"
     "python"
diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 895959038d04..b4099c6c1285 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-52NTG+cZLOxCJZvDSZ9vqsyH+J8U38aGlQdWQ2dFOWE=";
+    hash = "sha256-XvNvVWEmJpsY2AxTYLT0/4IiJ2QTI4mWwDleMmZ2LgA=";
   };
 
-  cargoHash = "sha256-SYJ+ABvIoOW0O+28ofM8YXJwIlFkR84yDZaaehhx0Ks=";
+  cargoHash = "sha256-PDYCO1ggKwtMR9tnokY7JqVM03FWsO4c2L4GV+7TKu4=";
 
   preBuild = ''
     version312_str=$(${python312}/bin/python -c 'import sys; print(sys.version_info[:3])')
diff --git a/pkgs/by-name/pr/prisma/package.nix b/pkgs/by-name/pr/prisma/package.nix
index cecab11fc8b2..abdf921664eb 100644
--- a/pkgs/by-name/pr/prisma/package.nix
+++ b/pkgs/by-name/pr/prisma/package.nix
@@ -101,6 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.prisma.io/";
     license = licenses.asl20;
     maintainers = with maintainers; [ aqrln ];
+    mainProgram = "prisma";
     platforms = platforms.unix;
   };
 })
diff --git a/pkgs/by-name/re/redland-wayland/package.nix b/pkgs/by-name/re/redland-wayland/package.nix
new file mode 100644
index 000000000000..d2ee300f496d
--- /dev/null
+++ b/pkgs/by-name/re/redland-wayland/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  wayland,
+}:
+
+let
+  version = "0.1.0";
+in
+rustPlatform.buildRustPackage {
+  pname = "redland-wayland";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "domenkozar";
+    repo = "redland";
+    tag = "v${version}";
+    hash = "sha256-iZtRpxloZzneAQ6+5cW0x1E7Qbx/8i9PqkpOHbCZ4Qk=";
+  };
+
+  cargoHash = "sha256-eE+0wvh2g7t3VhqLxQiQ4tu8oSv8w4HIIzRFAf2kxlc=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    wayland
+  ];
+
+  meta = {
+    description = "Wayland screen color temperature adjuster with automatic day/night cycle support";
+    homepage = "https://github.com/domenkozar/redland";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ domenkozar ];
+    mainProgram = "redland";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
index 54909cfbfd48..2b7708c07d4a 100644
--- a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
+++ b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2025-09-27";
+  version = "0-unstable-2025-10-05";
 
   src = fetchFromGitHub {
     owner = "roddhjav";
     repo = "apparmor.d";
-    rev = "0ef6041dc38ccfd1c87699170518a56f03e1d9e6";
-    hash = "sha256-iVf8mGN+q/a3ftuWqXp24MQ7Dr+V0JplA77IsfKFUGw=";
+    rev = "cdc782ce0836f3d5566fafb93cb43cbae21b3f58";
+    hash = "sha256-uXa78bFhCYkMCOTdNnQJLu7Yz3do+hZBUG3TIZWv544=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/sn/snort/package.nix b/pkgs/by-name/sn/snort/package.nix
index cf46356b6a79..2a58e87a1bb4 100644
--- a/pkgs/by-name/sn/snort/package.nix
+++ b/pkgs/by-name/sn/snort/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snort";
-  version = "3.9.2.0";
+  version = "3.9.6.0";
 
   src = fetchFromGitHub {
     owner = "snort3";
     repo = "snort3";
     tag = finalAttrs.version;
-    hash = "sha256-LVAsCps5XLsj4acYWI42qdbvX6h9JTJJfM33FvVfWK0=";
+    hash = "sha256-YZCS2w4T9XskydnC4C2EMies9cUklvL56Umdw9EogLo=";
   };
 
   nativeBuildInputs = [
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
       aycanirican
       brianmcgillion
     ];
-    changelog = "https://github.com/snort3/snort3/releases/tag/${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/snort3/snort3/blob/${finalAttrs.src.rev}/ChangeLog.md";
     license = lib.licenses.gpl2;
     platforms = with lib.platforms; linux;
   };
diff --git a/pkgs/by-name/sp/spicedb/package.nix b/pkgs/by-name/sp/spicedb/package.nix
index 9db7a3e2e5df..ca09384217c3 100644
--- a/pkgs/by-name/sp/spicedb/package.nix
+++ b/pkgs/by-name/sp/spicedb/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.45.4";
+  version = "1.46.0";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     tag = "v${version}";
-    hash = "sha256-q5szY9eJcmlxoA5FcBgOb81l5p8b9+SUSQffXV3KMgk=";
+    hash = "sha256-laLUhJkD4XbwKo4wjngBN1PkDpt2fHgMmVv2JTzZl6Q=";
   };
 
   vendorHash = "sha256-XqXbQYUAQiOZ0MjWwFSRe0suaQzXb6KQb+KoGAvvceM=";
diff --git a/pkgs/by-name/sy/syshud/package.nix b/pkgs/by-name/sy/syshud/package.nix
index 6393c7eab0f0..3fe9f6367f87 100644
--- a/pkgs/by-name/sy/syshud/package.nix
+++ b/pkgs/by-name/sy/syshud/package.nix
@@ -14,18 +14,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "syshud";
-  version = "0-unstable-2025-08-18";
+  version = "0-unstable-2025-10-06";
 
   src = fetchFromGitHub {
     owner = "System64fumo";
     repo = "syshud";
-    rev = "6dbf17bb953342c844517d1b4eb672cbae7a1566";
-    hash = "sha256-T9tWmgDIcmmRXAeWR7Pfjalkl6xogtuz1qfsSAuQmkg=";
+    rev = "60d3e362cf6983e7d7ebea7584a8bd84eb815f4c";
+    hash = "sha256-GxJWGRm7N/TgvAtuWXjusyUT7Pnuw0uIySp6i6Kn7Gs=";
   };
 
   postPatch = ''
-    substituteInPlace Makefile \
-      --replace-fail pkg-config ''${PKG_CONFIG}
     substituteInPlace src/main.cpp \
       --replace-fail /usr/share/sys64/hud/config.conf $out/share/sys64/hud/config.conf
     substituteInPlace src/window.cpp \
@@ -65,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
     wrapProgram $out/bin/syshud --prefix LD_LIBRARY_PATH : $out/lib
   '';
 
+  strictDeps = true;
+
   passthru.updateScript = nix-update-script {
     extraArgs = [
       "--version"
diff --git a/pkgs/by-name/te/tex-fmt/package.nix b/pkgs/by-name/te/tex-fmt/package.nix
index c7309af24410..c10424acba80 100644
--- a/pkgs/by-name/te/tex-fmt/package.nix
+++ b/pkgs/by-name/te/tex-fmt/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tex-fmt";
-  version = "0.5.5";
+  version = "0.5.6";
 
   src = fetchFromGitHub {
     owner = "WGUNDERWOOD";
     repo = "tex-fmt";
     tag = "v${version}";
-    hash = "sha256-zF7Bbt4DrGb/PkKrHtynb6yskP+ZdIZY7BgLygZyvro=";
+    hash = "sha256-xVB4y80BFa9MRBsMYMSQmaRSNJVoeCiYW2UTJ+UpBYQ=";
   };
 
-  cargoHash = "sha256-Msvp1gEwVoUb7DhBdPtjT/d+/I+G8pv+sBWxqqqdyEQ=";
+  cargoHash = "sha256-glaD8/CoHrtqRnZh0iMR55EQF9xbBbv+x+xt/xa1xTM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ut/ut1999/package.nix b/pkgs/by-name/ut/ut1999/package.nix
index dc2ae509e546..ae7147fac2e3 100644
--- a/pkgs/by-name/ut/ut1999/package.nix
+++ b/pkgs/by-name/ut/ut1999/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  requireFile,
   autoPatchelfHook,
   undmg,
   fetchurl,
@@ -18,6 +17,8 @@
   openal,
   libmpg123,
   libxmp,
+  libiconv,
+  darwin,
 }:
 
 let
@@ -84,6 +85,9 @@ stdenv.mkDerivation (finalAttrs: {
     libmpg123
     libxmp
     stdenv.cc.cc
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    libiconv
   ];
 
   nativeBuildInputs =
@@ -94,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       makeWrapper
       undmg
+      darwin.autoSignDarwinBinariesHook
     ];
 
   installPhase =
@@ -116,6 +121,15 @@ stdenv.mkDerivation (finalAttrs: {
       cp -r "UnrealTournament.app" $out/Applications/
       makeWrapper $out/Applications/UnrealTournament.app/Contents/MacOS/UnrealTournament \
         $out/bin/${finalAttrs.meta.mainProgram}
+      # If the darwin build sandbox is enabled, system libiconv is not available
+      # https://github.com/OldUnreal/UnrealTournamentPatches/issues/1902
+      # Even though ut1999 is able to unpack the map files at runtime, upstream advised to still do it at install time
+      # which is why the UCC binary is fixed to access a copy of iconv from the nix store
+      install_name_tool -change /usr/lib/libiconv.2.dylib \
+        ${libiconv}/lib/libiconv.2.dylib \
+        $out/Applications/UnrealTournament.app/Contents/MacOS/UCC
+      # Needs manual re-signing, as UCC is used during the build, and the auto signer is part of the fixup phase
+      signDarwinBinariesInAllOutputs
     ''
     + ''
       chmod -R 755 $out
diff --git a/pkgs/by-name/wa/wasm-bindgen-cli_0_2_104/package.nix b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_104/package.nix
new file mode 100644
index 000000000000..6cf00848f144
--- /dev/null
+++ b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_104/package.nix
@@ -0,0 +1,19 @@
+{
+  buildWasmBindgenCli,
+  fetchCrate,
+  rustPlatform,
+}:
+
+buildWasmBindgenCli rec {
+  src = fetchCrate {
+    pname = "wasm-bindgen-cli";
+    version = "0.2.104";
+    hash = "sha256-9kW+a7IreBcZ3dlUdsXjTKnclVW1C1TocYfY8gUgewE=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    inherit (src) pname version;
+    hash = "sha256-V0AV5jkve37a5B/UvJ9B3kwOW72vWblST8Zxs8oDctE=";
+  };
+}
diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index 642159e10f6f..5ff193745fc7 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -13,20 +13,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "36.0.2";
+  version = "37.0.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tcG78WubEm1zZXfNsDCwtw4QF5ip3ZjkxaLu8D4qBc4=";
+    hash = "sha256-IVnKZJyNyKd/+x/VhlRo9zaPppFuEXo7jUKC5+Cg8+g=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-iCYZLKjO1kD753S1CiwTHa9qVxg9Y2ZMCKg0wod7GbQ=";
+  cargoHash = "sha256-4Kxt1QauD6P5yJj+R/jPUR6itXvYubCukGMk7iij75w=";
   cargoBuildFlags = [
     "--package"
     "wasmtime-cli"
diff --git a/pkgs/by-name/xc/xcalib/package.nix b/pkgs/by-name/xc/xcalib/package.nix
index 515fb2b9cc8a..0ad51f9ee12f 100644
--- a/pkgs/by-name/xc/xcalib/package.nix
+++ b/pkgs/by-name/xc/xcalib/package.nix
@@ -8,6 +8,7 @@
   libXxf86vm,
   libXrandr,
   samurai,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,6 +23,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-o0pizV4Qrb9wfVKVNH2Ifb9tr7N7iveVHQB39WVCl8w=";
   };
 
+  patches = [
+    # bump min cmake to v3.5
+    (fetchpatch {
+      url = "https://codeberg.org/OpenICC/xcalib/commit/e8566ead8c043b5f0003c3613b91deab6430eac8.patch";
+      hash = "sha256-gZc4itfsP5T68ZucdYJWJ4sL11xFaw5ePABsmEYHxrU=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/by-name/xu/xunlei-uos/sources.nix b/pkgs/by-name/xu/xunlei-uos/sources.nix
index eb08be168268..10722a2f10ca 100644
--- a/pkgs/by-name/xu/xunlei-uos/sources.nix
+++ b/pkgs/by-name/xu/xunlei-uos/sources.nix
@@ -1,11 +1,11 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-03-19
+# Last updated: 2025-09-24
 {
   version = "1.0.0.5";
-  amd64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_1.0.0.5_amd64.deb";
-  arm64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_1.0.0.5_arm64.deb";
-  loongarch64_url = "https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_1.0.0.5_loongarch64.deb";
-  amd64_hash = "sha256-K+eHPmG2tT5Z+RWxigg03itw6Rcnk5MZlODqS/JtAnk=";
-  arm64_hash = "sha256-iA9mbp0wSe66qC5lphMTFPzmOJjzHfWKubGRPiKcVdg=";
-  loongarch64_hash = "sha256-44QPnB/1uWHaQkd3DBMDvYXfXwch9HywZUvg71z8fts=";
+  amd64_url = "https://archive2.kylinos.cn/DEB/KYLIN_DEB/pool/all/com.xunlei.download_1.0.0.5_amd64.deb";
+  arm64_url = "https://archive2.kylinos.cn/DEB/KYLIN_DEB/pool/all/com.xunlei.download_1.0.0.5_arm64.deb";
+  loongarch64_url = "https://archive2.kylinos.cn/DEB/KYLIN_DEB/pool/all/com.xunlei.download_1.0.0.5_loongarch64.deb";
+  amd64_hash = "sha256-7558/p0iyXHdelOvNQvbFqA5kBprv8oJJv178ysoeXg=";
+  arm64_hash = "sha256-CciKobahdbub+dGFYy/EY3DSSP6Ge5/bZi/LDuY2MOw=";
+  loongarch64_hash = "sha256-X5NIwWaLbajcTJrDUbCwoFICU3gk1kHX3gGvJ/MDYhE=";
 }
diff --git a/pkgs/by-name/xu/xunlei-uos/update.sh b/pkgs/by-name/xu/xunlei-uos/update.sh
old mode 100644
new mode 100755
index 78b1769b3504..b0aa254c0c0c
--- a/pkgs/by-name/xu/xunlei-uos/update.sh
+++ b/pkgs/by-name/xu/xunlei-uos/update.sh
@@ -1,5 +1,9 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash --pure --keep GITHUB_TOKEN -p nix git curl cacert nix-prefetch-git gzip
+#! nix-shell -i bash --pure -p nix curl cacert gzip
+
+set -euo pipefail
+
+cd "$(dirname "$(readlink -f "$0")")"
 
 base_url_suffix="https://pro-store-packages.uniontech.com/appstore/dists/eagle/appstore/binary-"
 base_url_appendix="/Packages.gz"
@@ -39,8 +43,8 @@ do
         }
     }
     ')
-    url+=("https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_"$version"_"$i".deb")
-    hash+=("$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $sha256sum)")
+    url+=("https://archive2.kylinos.cn/DEB/KYLIN_DEB/pool/all/com.xunlei.download_"$version"_"$i".deb")
+    hash+=("$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url "${url[-1]}")")")
 done
 
 cat >sources.nix <<EOF
diff --git a/pkgs/by-name/ya/yaookctl/package.nix b/pkgs/by-name/ya/yaookctl/package.nix
new file mode 100644
index 000000000000..5b888664d7b0
--- /dev/null
+++ b/pkgs/by-name/ya/yaookctl/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  fetchFromGitLab,
+  python3,
+  nix-update-script,
+}:
+python3.pkgs.buildPythonApplication {
+  pname = "yaookctl";
+  version = "0-unstable-2025-08-25";
+
+  src = fetchFromGitLab {
+    owner = "yaook";
+    repo = "yaookctl";
+    rev = "205fab35f6680d15d86ef3596fe8a12590e3916c";
+    hash = "sha256-V30581TeBtk/IvqBebsyT2lJ8bp8UkCH4AIy+mnnzCc=";
+  };
+
+  pyproject = true;
+  build-system = [ python3.pkgs.setuptools ];
+
+  dontCheckRuntimeDeps = true;
+
+  dependencies = with python3.pkgs; [
+    babel
+    click
+    click-option-group
+    kubernetes-asyncio
+    prettytable
+    typing-extensions
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    homepage = "https://gitlab.com/yaook/yaookctl";
+    description = "Toolbox for interacting with Yaook clusters";
+    license = lib.licenses.mit;
+    mainProgram = "yaookctl";
+    maintainers = with lib.maintainers; [ lykos153 ];
+  };
+}
diff --git a/pkgs/development/libraries/libcec/platform.nix b/pkgs/development/libraries/libcec/platform.nix
index 11139df5e027..52f61d413544 100644
--- a/pkgs/development/libraries/libcec/platform.nix
+++ b/pkgs/development/libraries/libcec/platform.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
@@ -13,11 +14,28 @@ stdenv.mkDerivation rec {
     owner = "Pulse-Eight";
     repo = "platform";
     rev = "p8-platform-${version}";
-    sha256 = "sha256-zAI/AOLJAunv+cCQ6bOXrgkW+wl5frj3ktzx2cDeCCk=";
+    hash = "sha256-zAI/AOLJAunv+cCQ6bOXrgkW+wl5frj3ktzx2cDeCCk=";
   };
 
   nativeBuildInputs = [ cmake ];
 
+  patches = [
+    # required for cmake 4 support
+    (fetchpatch {
+      name = "libcec-platform-fix-cmake4-1.patch";
+      url = "https://github.com/Pulse-Eight/platform/commit/7350df98980b4e7036812b15812e3cb3c9353816.patch";
+      includes = [ "CMakeLists.txt" ];
+      hash = "sha256-YbxQxmXF2Iv67SjX/kMD9Df2nggBFX0fBFMyNdXXZtI=";
+    })
+    # required for cmake 4 support
+    (fetchpatch {
+      name = "libcec-platform-fix-cmake4-5.patch";
+      url = "https://github.com/Pulse-Eight/platform/commit/d7faed1c696b1a6a67f114a63a0f4c085f0f9195.patch";
+      includes = [ "CMakeLists.txt" ];
+      hash = "sha256-T+quL5wxc1w+KyNGxW443Ud+r6FVPej6jN6oXQ5pkRs=";
+    })
+  ];
+
   cmakeFlags = lib.optional stdenv.hostPlatform.isDarwin "-DCMAKE_CXX_FLAGS='-std=c++11'";
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index 016a03a52724..df052a2d4773 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -32,11 +32,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation rec {
   pname = "mpich";
-  version = "4.3.1";
+  version = "4.3.2";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    hash = "sha256-rMEcsr3Glnjci7p0fCSigjPFhZb4HwN4W/K3u3oO99w=";
+    hash = "sha256-R9d0WHpxVqU3UiGMgRyFLnCsRNucUC3D85m0y4F+OBg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/cirq-core/default.nix b/pkgs/development/python-modules/cirq-core/default.nix
index 571550ba24f2..f14dc0b8c569 100644
--- a/pkgs/development/python-modules/cirq-core/default.nix
+++ b/pkgs/development/python-modules/cirq-core/default.nix
@@ -108,7 +108,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/quantumlib/Cirq/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
-      drewrisinger
       fab
     ];
   };
diff --git a/pkgs/development/python-modules/cvxpy/default.nix b/pkgs/development/python-modules/cvxpy/default.nix
index 1234264f35d7..6c1083f5a2ee 100644
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@@ -94,6 +94,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/cvxpy/cvxpy//releases";
     changelog = "https://github.com/cvxpy/cvxpy/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/dlx/default.nix b/pkgs/development/python-modules/dlx/default.nix
index 6951f64315dd..588f47b127c5 100644
--- a/pkgs/development/python-modules/dlx/default.nix
+++ b/pkgs/development/python-modules/dlx/default.nix
@@ -30,6 +30,6 @@ buildPythonPackage {
     description = "Implementation of Donald Knuth's Dancing Links algorithm";
     homepage = "https://github.com/sraaphorst/dlx_python";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/dnf-plugins-core/default.nix b/pkgs/development/python-modules/dnf-plugins-core/default.nix
index bc213157ed00..2b5432e7c6a1 100644
--- a/pkgs/development/python-modules/dnf-plugins-core/default.nix
+++ b/pkgs/development/python-modules/dnf-plugins-core/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # dependencies
   cmake,
@@ -38,6 +39,14 @@ buildPythonPackage rec {
     hash = "sha256-nZyM61bQ9L4t3/fa9cP+xo9ke00e6w2Obt80OpqOG8A=";
   };
 
+  patches = [
+    # Fix building with CMake 4
+    (fetchpatch {
+      url = "https://github.com/rpm-software-management/dnf-plugins-core/commit/1f5d725d857b61760174dd09165e885dd63762c5.patch?full_index=1";
+      hash = "sha256-dI6tVokgenb4aaLH5YuG3EZ1Ehgf/NwwPprcDWcHt2Q=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail "SYSCONFDIR /etc" "SYSCONFDIR $out/etc" \
diff --git a/pkgs/development/python-modules/docloud/default.nix b/pkgs/development/python-modules/docloud/default.nix
index 5c7c57811543..cf7e5d333f0d 100644
--- a/pkgs/development/python-modules/docloud/default.nix
+++ b/pkgs/development/python-modules/docloud/default.nix
@@ -29,6 +29,6 @@ buildPythonPackage rec {
     description = "IBM Decision Optimization on Cloud Python client";
     homepage = "https://onboarding-oaas.docloud.ibmcloud.com/software/analytics/docloud/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/docplex/default.nix b/pkgs/development/python-modules/docplex/default.nix
index f28c1e99cd68..5c0cd075f546 100644
--- a/pkgs/development/python-modules/docplex/default.nix
+++ b/pkgs/development/python-modules/docplex/default.nix
@@ -38,6 +38,6 @@ buildPythonPackage rec {
     description = "IBM Decision Optimization CPLEX Modeling for Python";
     homepage = "https://onboarding-oaas.docloud.ibmcloud.com/software/analytics/docloud/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/duet/default.nix b/pkgs/development/python-modules/duet/default.nix
index 739f84709af1..3101d0da03b5 100644
--- a/pkgs/development/python-modules/duet/default.nix
+++ b/pkgs/development/python-modules/duet/default.nix
@@ -35,9 +35,9 @@ buildPythonPackage rec {
     "test_repeated_sleep"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Simple future-based async library for python";
     homepage = "https://github.com/google/duet";
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/ecos/default.nix b/pkgs/development/python-modules/ecos/default.nix
index 521dee031479..748e88cd25f0 100644
--- a/pkgs/development/python-modules/ecos/default.nix
+++ b/pkgs/development/python-modules/ecos/default.nix
@@ -45,6 +45,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/embotech/ecos-python";
     changelog = "https://github.com/embotech/ecos-python/releases/tag/v${version}";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/fastdtw/default.nix b/pkgs/development/python-modules/fastdtw/default.nix
index 2164f63c51a1..5fa542831a3d 100644
--- a/pkgs/development/python-modules/fastdtw/default.nix
+++ b/pkgs/development/python-modules/fastdtw/default.nix
@@ -56,6 +56,6 @@ buildPythonPackage rec {
     '';
     homepage = "https://github.com/slaypni/fastdtw";
     license = licenses.mit;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/fastjsonschema/default.nix b/pkgs/development/python-modules/fastjsonschema/default.nix
index ae2d51d9e9f4..db73ff4710d6 100644
--- a/pkgs/development/python-modules/fastjsonschema/default.nix
+++ b/pkgs/development/python-modules/fastjsonschema/default.nix
@@ -49,6 +49,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/horejsek/python-fastjsonschema";
     homepage = "https://horejsek.github.io/python-fastjsonschema/";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/ipyvue/default.nix b/pkgs/development/python-modules/ipyvue/default.nix
index 8a7991648d02..6fc90d99fd77 100644
--- a/pkgs/development/python-modules/ipyvue/default.nix
+++ b/pkgs/development/python-modules/ipyvue/default.nix
@@ -28,6 +28,6 @@ buildPythonPackage rec {
     description = "Jupyter widgets base for Vue libraries";
     homepage = "https://github.com/mariobuikhuizen/ipyvue";
     license = licenses.mit;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/ipyvuetify/default.nix b/pkgs/development/python-modules/ipyvuetify/default.nix
index 718a390a6a02..4f37bd1b055d 100644
--- a/pkgs/development/python-modules/ipyvuetify/default.nix
+++ b/pkgs/development/python-modules/ipyvuetify/default.nix
@@ -36,6 +36,6 @@ buildPythonPackage rec {
     description = "Jupyter widgets based on Vuetify UI Components";
     homepage = "https://github.com/mariobuikhuizen/ipyvuetify";
     license = licenses.mit;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/lark/default.nix b/pkgs/development/python-modules/lark/default.nix
index d6baab279b19..5c7f2ff3e549 100644
--- a/pkgs/development/python-modules/lark/default.nix
+++ b/pkgs/development/python-modules/lark/default.nix
@@ -38,6 +38,6 @@ buildPythonPackage rec {
     homepage = "https://lark-parser.readthedocs.io/";
     changelog = "https://github.com/lark-parser/lark/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/marshmallow-polyfield/default.nix b/pkgs/development/python-modules/marshmallow-polyfield/default.nix
index c4e5ad21e819..5230a614c6b1 100644
--- a/pkgs/development/python-modules/marshmallow-polyfield/default.nix
+++ b/pkgs/development/python-modules/marshmallow-polyfield/default.nix
@@ -38,6 +38,6 @@ buildPythonPackage rec {
     description = "Extension to Marshmallow to allow for polymorphic fields";
     homepage = "https://github.com/Bachmann1234/marshmallow-polyfield";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/minimock/default.nix b/pkgs/development/python-modules/minimock/default.nix
index a10fa1f89a7f..543c32987f85 100644
--- a/pkgs/development/python-modules/minimock/default.nix
+++ b/pkgs/development/python-modules/minimock/default.nix
@@ -31,6 +31,6 @@ buildPythonPackage rec {
     description = "Minimalistic mocking library";
     homepage = "https://pypi.python.org/pypi/MiniMock";
     license = licenses.mit;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/multitasking/default.nix b/pkgs/development/python-modules/multitasking/default.nix
index edfbece090b1..f41f27e14693 100644
--- a/pkgs/development/python-modules/multitasking/default.nix
+++ b/pkgs/development/python-modules/multitasking/default.nix
@@ -22,6 +22,6 @@ buildPythonPackage rec {
     description = "Non-blocking Python methods using decorators";
     homepage = "https://github.com/ranaroussi/multitasking";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/osqp/default.nix b/pkgs/development/python-modules/osqp/default.nix
index e2bcaa300c67..d7ea2d74430c 100644
--- a/pkgs/development/python-modules/osqp/default.nix
+++ b/pkgs/development/python-modules/osqp/default.nix
@@ -108,6 +108,6 @@ buildPythonPackage rec {
     homepage = "https://osqp.org/";
     downloadPage = "https://github.com/oxfordcontrol/osqp-python/releases";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pproxy/default.nix b/pkgs/development/python-modules/pproxy/default.nix
index c08d2de25aa8..8d355218a0cc 100644
--- a/pkgs/development/python-modules/pproxy/default.nix
+++ b/pkgs/development/python-modules/pproxy/default.nix
@@ -51,6 +51,6 @@ buildPythonPackage rec {
     mainProgram = "pproxy";
     homepage = "https://github.com/qwj/python-proxy";
     license = licenses.mit;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pygmt/default.nix b/pkgs/development/python-modules/pygmt/default.nix
index 3a4d278a0f01..053e8ca2df90 100644
--- a/pkgs/development/python-modules/pygmt/default.nix
+++ b/pkgs/development/python-modules/pygmt/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pygmt";
-  version = "0.16.0";
+  version = "0.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "GenericMappingTools";
     repo = "pygmt";
     tag = "v${version}";
-    hash = "sha256-VzsSBdKQDSXCFC61eCD6e45GLpVcKjRo3rx+cT/A7Jc=";
+    hash = "sha256-YW111pgaW13TrD6mu+WgeLNljgmXWT/r1mZDbl9uROw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pylatexenc/default.nix b/pkgs/development/python-modules/pylatexenc/default.nix
index d48fe47bf447..61dded2a3b6e 100644
--- a/pkgs/development/python-modules/pylatexenc/default.nix
+++ b/pkgs/development/python-modules/pylatexenc/default.nix
@@ -26,6 +26,6 @@ buildPythonPackage rec {
     downloadPage = "https://www.github.com/phfaist/pylatexenc/releases";
     changelog = "https://pylatexenc.readthedocs.io/en/latest/changes/";
     license = licenses.mit;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyring-buffer/default.nix b/pkgs/development/python-modules/pyring-buffer/default.nix
index c2200b9f1c1d..5b8b178b03ba 100644
--- a/pkgs/development/python-modules/pyring-buffer/default.nix
+++ b/pkgs/development/python-modules/pyring-buffer/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyring-buffer";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rhasspy";
     repo = "pyring-buffer";
     tag = "v${version}";
-    hash = "sha256-s0iIcY2cwTbOMrpw14uAYfeAl/MOJTLfZbJr+tmTM6U=";
+    hash = "sha256-YBkBuptoOc3d746WkqoCHOr0LuG+QlORt/z1oqSf+AA=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-constraint/default.nix b/pkgs/development/python-modules/python-constraint/default.nix
index 1c402663a675..24bbd022c2a5 100644
--- a/pkgs/development/python-modules/python-constraint/default.nix
+++ b/pkgs/development/python-modules/python-constraint/default.nix
@@ -46,6 +46,6 @@ buildPythonPackage rec {
     homepage = "https://labix.org/doc/constraint/";
     downloadPage = "https://github.com/python-constraint/python-constraint/releases";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qdldl/default.nix b/pkgs/development/python-modules/qdldl/default.nix
index 49e97e832b5c..9b53768ecf76 100644
--- a/pkgs/development/python-modules/qdldl/default.nix
+++ b/pkgs/development/python-modules/qdldl/default.nix
@@ -57,6 +57,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/osqp/qdldl-python";
     changelog = "https://github.com/osqp/qdldl-python/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-aer/default.nix b/pkgs/development/python-modules/qiskit-aer/default.nix
index 6e208ebb8069..4a61d4ae3c82 100644
--- a/pkgs/development/python-modules/qiskit-aer/default.nix
+++ b/pkgs/development/python-modules/qiskit-aer/default.nix
@@ -151,6 +151,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/QISKit/qiskit-aer/releases";
     changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-finance/default.nix b/pkgs/development/python-modules/qiskit-finance/default.nix
index 56551914b2e4..d01ebc3e7593 100644
--- a/pkgs/development/python-modules/qiskit-finance/default.nix
+++ b/pkgs/development/python-modules/qiskit-finance/default.nix
@@ -83,6 +83,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/QISKit/qiskit-optimization/releases";
     changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix b/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
index 089fdde389ce..6f2d5881f5ed 100644
--- a/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
+++ b/pkgs/development/python-modules/qiskit-ibmq-provider/default.nix
@@ -104,6 +104,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/Qiskit/qiskit-ibmq-provider";
     changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-ignis/default.nix b/pkgs/development/python-modules/qiskit-ignis/default.nix
index 02b6b29de9c7..9fb6826634aa 100644
--- a/pkgs/development/python-modules/qiskit-ignis/default.nix
+++ b/pkgs/development/python-modules/qiskit-ignis/default.nix
@@ -71,6 +71,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/QISKit/qiskit-ignis/releases";
     changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-machine-learning/default.nix b/pkgs/development/python-modules/qiskit-machine-learning/default.nix
index 559d858e0fbb..d9c751d8b95e 100644
--- a/pkgs/development/python-modules/qiskit-machine-learning/default.nix
+++ b/pkgs/development/python-modules/qiskit-machine-learning/default.nix
@@ -89,6 +89,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/QISKit/qiskit-optimization/releases";
     changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-nature/default.nix b/pkgs/development/python-modules/qiskit-nature/default.nix
index f8419b9810d4..306cacfc9265 100644
--- a/pkgs/development/python-modules/qiskit-nature/default.nix
+++ b/pkgs/development/python-modules/qiskit-nature/default.nix
@@ -76,6 +76,6 @@ buildPythonPackage rec {
       binaryNativeCode # drivers/gaussiand/gauopen/*.so
     ];
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-optimization/default.nix b/pkgs/development/python-modules/qiskit-optimization/default.nix
index c2408686d6ff..b063e8d3786b 100644
--- a/pkgs/development/python-modules/qiskit-optimization/default.nix
+++ b/pkgs/development/python-modules/qiskit-optimization/default.nix
@@ -66,6 +66,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/QISKit/qiskit-optimization/releases";
     changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit-terra/default.nix b/pkgs/development/python-modules/qiskit-terra/default.nix
index 232cae299dd4..b333497ed5db 100644
--- a/pkgs/development/python-modules/qiskit-terra/default.nix
+++ b/pkgs/development/python-modules/qiskit-terra/default.nix
@@ -220,6 +220,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/QISKit/qiskit-terra/releases";
     changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/qiskit/default.nix b/pkgs/development/python-modules/qiskit/default.nix
index 38bd460cff8a..7a54eb295059 100644
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@@ -72,7 +72,6 @@ buildPythonPackage rec {
     changelog = "https://qiskit.org/documentation/release_notes.html";
     license = licenses.asl20;
     maintainers = with maintainers; [
-      drewrisinger
       pandaman
     ];
   };
diff --git a/pkgs/development/python-modules/qstylizer/default.nix b/pkgs/development/python-modules/qstylizer/default.nix
index 5396e38834df..9201bc677bdd 100644
--- a/pkgs/development/python-modules/qstylizer/default.nix
+++ b/pkgs/development/python-modules/qstylizer/default.nix
@@ -54,6 +54,6 @@ buildPythonPackage rec {
     description = "Qt stylesheet generation utility for PyQt/PySide";
     homepage = "https://github.com/blambright/qstylizer";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/scs/default.nix b/pkgs/development/python-modules/scs/default.nix
index 70292a711206..e6fe0b20db9f 100644
--- a/pkgs/development/python-modules/scs/default.nix
+++ b/pkgs/development/python-modules/scs/default.nix
@@ -68,6 +68,6 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/bodono/scs-python";
     changelog = "https://github.com/bodono/scs-python/releases/tag/${src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/tables/default.nix b/pkgs/development/python-modules/tables/default.nix
index bab23c58c0d9..0357ae53d639 100644
--- a/pkgs/development/python-modules/tables/default.nix
+++ b/pkgs/development/python-modules/tables/default.nix
@@ -102,6 +102,6 @@ buildPythonPackage rec {
     homepage = "https://www.pytables.org/";
     changelog = "https://github.com/PyTables/PyTables/releases/tag/v${version}";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/torch/source/default.nix b/pkgs/development/python-modules/torch/source/default.nix
index d9b25ed09bb9..61caaf420b57 100644
--- a/pkgs/development/python-modules/torch/source/default.nix
+++ b/pkgs/development/python-modules/torch/source/default.nix
@@ -28,6 +28,7 @@
   MPISupport ? false,
   mpi,
   buildDocs ? false,
+  targetPackages,
 
   # tests.cudaAvailable:
   callPackage,
@@ -368,6 +369,12 @@ buildPythonPackage rec {
     substituteInPlace torch/csrc/profiler/unwind/unwind.cpp \
       --replace-fail 'addr2line_binary_ = "addr2line"' 'addr2line_binary_ = "${lib.getExe' binutils "addr2line"}"'
   ''
+  # Ensures torch compile can find and use compilers from nix.
+  + ''
+    substituteInPlace torch/_inductor/config.py \
+      --replace-fail '"clang++" if sys.platform == "darwin" else "g++"' \
+      '"${lib.getExe' targetPackages.stdenv.cc "${targetPackages.stdenv.cc.targetPrefix}c++"}"'
+  ''
   + lib.optionalString rocmSupport ''
     # https://github.com/facebookincubator/gloo/pull/297
     substituteInPlace third_party/gloo/cmake/Hipify.cmake \
diff --git a/pkgs/development/python-modules/tweedledum/default.nix b/pkgs/development/python-modules/tweedledum/default.nix
index 2cc2de443b30..365531bb7633 100644
--- a/pkgs/development/python-modules/tweedledum/default.nix
+++ b/pkgs/development/python-modules/tweedledum/default.nix
@@ -42,6 +42,6 @@ buildPythonPackage rec {
     description = "Library for synthesizing and manipulating quantum circuits";
     homepage = "https://github.com/boschmitt/tweedledum";
     license = licenses.mit;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 4e0e58410621..a65300932ef4 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -200,16 +200,19 @@ let
         "8.9"
         "9.0"
         "9.0a"
-        "10.0"
-        "10.0a"
-        "10.1"
-        "10.1a"
-        "10.3"
-        "10.3a"
-        "12.0"
-        "12.0a"
-        "12.1"
-        "12.1a"
+        # Blackwell (SM100+) capabilities temporarily disabled due to CUTLASS API incompatibility
+        # FlashMLA kernels require CUTLASS v4.2.1+ APIs not available in bundled v4.0.0
+        # TODO: Re-enable when vLLM upgrades CUTLASS (see https://github.com/vllm-project/vllm/pull/24673)
+        # "10.0"
+        # "10.0a"
+        # "10.1"
+        # "10.1a"
+        # "10.3"
+        # "10.3a"
+        # "12.0"
+        # "12.0a"
+        # "12.1"
+        # "12.1a"
       ];
       ptx = lists.map (x: "${x}+PTX") real;
     in
diff --git a/pkgs/development/python-modules/yfinance/default.nix b/pkgs/development/python-modules/yfinance/default.nix
index c8efa3b2f66c..14cedb9370b8 100644
--- a/pkgs/development/python-modules/yfinance/default.nix
+++ b/pkgs/development/python-modules/yfinance/default.nix
@@ -75,6 +75,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/ranaroussi/yfinance";
     changelog = "https://github.com/ranaroussi/yfinance/blob/${src.tag}/CHANGELOG.rst";
     license = licenses.asl20;
-    maintainers = with maintainers; [ drewrisinger ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 0f071ff58330..6ccf978c9517 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.12.50";
-      hash = "sha256-I3D862tWW+MYDTd5C6iGB8ZLH8nDOsXzlrOYch55K2g=";
+      version = "6.12.51";
+      hash = "sha256-7fIOQ7VctDhueoOnZA8/7Dc7gxAl+vKgO/X5Oa4Z8kE=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.16.10";
-      hash = "sha256-TCMx1Sx/9o8oGOLVfsIvYZoe+FHs5zL+n/tGYevObI0=";
+      version = "6.16.11";
+      hash = "sha256-EZjH22q8JvlbFpab4rdrA24kf+r9heneiwy5YM4WfYk=";
     };
   };
 
diff --git a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
index 6d2e071a3f3a..eb47147bbcb2 100644
--- a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "wills106";
   domain = "solax_modbus";
-  version = "2025.09.9";
+  version = "2025.10.1";
 
   src = fetchFromGitHub {
     owner = "wills106";
     repo = "homeassistant-solax-modbus";
     tag = version;
-    hash = "sha256-OqLkXvAX1yGjSjHpeLQECeVyX3RxQSPRpvdVuzLa+kI=";
+    hash = "sha256-cmSaVg/v/rledIY980BJyGaLN3CQtCGMextN2WzOmXk=";
   };
 
   dependencies = [ pymodbus ];
diff --git a/pkgs/servers/sql/postgresql/ext/pg_graphql.nix b/pkgs/servers/sql/postgresql/ext/pg_graphql.nix
new file mode 100644
index 000000000000..36c6e5f4587e
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/pg_graphql.nix
@@ -0,0 +1,50 @@
+{
+  buildPgrxExtension,
+  cargo-pgrx_0_16_0,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  postgresql,
+}:
+buildPgrxExtension (finalAttrs: {
+  inherit postgresql;
+  cargo-pgrx = cargo-pgrx_0_16_0;
+
+  pname = "pg_graphql";
+  version = "1.5.12-unstable-2025-09-01";
+
+  src = fetchFromGitHub {
+    owner = "supabase";
+    repo = "pg_graphql";
+    # ToDo: 1.5.12 has not been tagged in Git yet, hence `rev` is used instead for now
+    #tag = "v${finalAttrs.version}";
+    rev = "bae1cb506d48d14ccf2b05f6a42331f3c9c71a76";
+    hash = "sha256-aJPstwzizWzVIo1N/4CHKgJBJ7DJpRkrwYrzNL+z7zQ=";
+  };
+
+  cargoHash = "sha256-Gfvu6YY+pRGrcAXAgEIa1iZKLJlbkvMv0F3pg3X/CXQ=";
+
+  # pgrx tests try to install the extension into postgresql nix store
+  doCheck = false;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "GraphQL support for PostgreSQL";
+    homepage = "https://supabase.github.io/pg_graphql";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ julm ];
+    broken =
+      lib.versionOlder postgresql.version "14"
+      || (
+        # ToDo: check after next package update.
+        lib.versionAtLeast postgresql.version "18"
+        && (
+          finalAttrs.version == "1.5.12-unstable-2025-09-01"
+          || lib.warn "Is postgresql18Packages.pg_graphql still broken?" false
+        )
+      );
+  };
+})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4076bacec858..b68aeeb3cf5f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2723,7 +2723,7 @@ mapAliases {
   wal_e = throw "wal_e was removed as it is unmaintained upstream and depends on the removed boto package; upstream recommends using wal-g or pgbackrest"; # Added 2024-09-22
   wapp = tclPackages.wapp; # Added 2024-10-02
   wavebox = throw "'wavebox' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-06-24
-  wasm-bindgen-cli = wasm-bindgen-cli_0_2_100;
+  wasm-bindgen-cli = wasm-bindgen-cli_0_2_104;
   watershot = throw "'watershot' has been removed as it is unmaintained upstream and no longer works"; # Added 2025-06-01
   wayfireApplications-unwrapped = throw ''
     'wayfireApplications-unwrapped.wayfire' has been renamed to/replaced by 'wayfire'