diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 79237c844589..3e520139bc28 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -39,6 +39,10 @@ jobs:
   update:
     runs-on: ubuntu-24.04-arm
     if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
+    env:
+      # TODO: Remove after 2026-03-04, when Node 24 becomes the default.
+      # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
diff --git a/ci/github-script/labels.js b/ci/github-script/labels.js
index 801380aad54f..faf7693c0f04 100644
--- a/ci/github-script/labels.js
+++ b/ci/github-script/labels.js
@@ -72,20 +72,7 @@ module.exports = async ({ github, context, core, dry }) => {
           exclude_pull_requests: true,
           head_sha: pull_request.head.sha,
         })
-      ).data.workflow_runs[0] ??
-      // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
-      (
-        await github.rest.actions.listWorkflowRuns({
-          ...context.repo,
-          // In older PRs, we need eval.yml instead of pr.yml.
-          workflow_id: 'eval.yml',
-          event: 'pull_request_target',
-          status: 'success',
-          exclude_pull_requests: true,
-          head_sha: pull_request.head.sha,
-        })
-      ).data.workflow_runs[0] ??
-      {}
+      ).data.workflow_runs[0] ?? {}
 
     // Newer PRs might not have run Eval to completion, yet.
     // Older PRs might not have an eval.yml workflow, yet.
@@ -159,20 +146,10 @@ module.exports = async ({ github, context, core, dry }) => {
         await readFile(`${pull_number}/changed-paths.json`, 'utf-8'),
       ).labels
 
-      Object.assign(
-        prLabels,
-        // Ignore `evalLabels` if it's an array.
-        // This can happen for older eval runs, before we switched to objects.
-        // The old eval labels would have been set by the eval run,
-        // so now they'll be present in `before`.
-        // TODO: Simplify once old eval results have expired (~2025-10)
-        Array.isArray(evalLabels) ? undefined : evalLabels,
-        {
-          '12.approved-by: package-maintainer': Array.from(maintainers).some(
-            (m) => approvals.has(m),
-          ),
-        },
-      )
+      Object.assign(prLabels, evalLabels, {
+        '12.approved-by: package-maintainer':
+          maintainers.intersection(approvals).size > 0,
+      })
     }
 
     return prLabels
@@ -372,7 +349,7 @@ module.exports = async ({ github, context, core, dry }) => {
             `updated:>=${cutoff.toISOString()}`,
           ].join(' AND '),
           per_page: 100,
-          // TODO: Remove in 2025-10, when it becomes the default.
+          // TODO: Remove after 2025-11-04, when it becomes the default.
           advanced_search: true,
         },
       )
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fa21e0a5e200..6a45628adc62 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7370,12 +7370,6 @@
     github = "eigengrau";
     githubId = 4939947;
   };
-  eihqnh = {
-    email = "eihqnh@outlook.com";
-    github = "eihqnh";
-    githubId = 40905037;
-    name = "eihqnh";
-  };
   eikek = {
     email = "eike.kettner@posteo.de";
     github = "eikek";
@@ -15845,7 +15839,7 @@
     githubId = 13599169;
   };
   marius851000 = {
-    email = "mariusdavid@laposte.net";
+    email = "nix@mariusdavid.fr";
     name = "Marius David";
     github = "marius851000";
     githubId = 22586596;
@@ -23217,6 +23211,12 @@
     githubId = 11320;
     name = "Sergiu Ivanov";
   };
+  scottstephens = {
+    email = "stephens.js@gmail.com";
+    github = "scottstephens";
+    githubId = 526260;
+    name = "Scott Stephens";
+  };
   scraptux = {
     email = "git@thomasjasny.de";
     github = "scraptux";
@@ -26206,6 +26206,12 @@
     githubId = 48209000;
     name = "Anna Gillert";
   };
+  tlvince = {
+    email = "nixos@tlvince.com";
+    github = "tlvince";
+    githubId = 323761;
+    name = "Tom Vincent";
+  };
   tm-drtina = {
     email = "tm.drtina@gmail.com";
     github = "tm-drtina";
diff --git a/nixos/modules/security/tpm2.nix b/nixos/modules/security/tpm2.nix
index a8e6efdc780f..29eece1ef794 100644
--- a/nixos/modules/security/tpm2.nix
+++ b/nixos/modules/security/tpm2.nix
@@ -388,5 +388,8 @@ in
   );
 
   meta.doc = ./tpm2.md;
-  meta.maintainers = with lib.maintainers; [ lschuermann ];
+  meta.maintainers = with lib.maintainers; [
+    lschuermann
+    scottstephens
+  ];
 }
diff --git a/nixos/modules/services/misc/klipper.nix b/nixos/modules/services/misc/klipper.nix
index 9322ad5a74cc..223bc8125915 100644
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -16,6 +16,68 @@ let
         lib.concatMapStrings (s: "\n  ${lib.generators.mkValueStringDefault { } s}") l;
     mkKeyValue = lib.generators.mkKeyValueDefault { } ":";
   };
+  firmwareSubmodule = lib.types.submodule (
+    { name, ... }@local:
+    let
+      mcu = local.name;
+      subcfg = local.config;
+    in
+    {
+      options = {
+        enable = lib.mkEnableOption ''
+          building of firmware for manual flashing
+        '';
+        enableKlipperFlash = lib.mkEnableOption ''
+          flashings scripts for firmware. This will add `klipper-flash-$mcu` scripts to your environment which can be called to flash the firmware.
+          Please check the configs at [klipper](https://github.com/Klipper3d/klipper/tree/master/config) whether your board supports flashing via `make flash`
+        '';
+        serial = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          description = "Path to serial port this printer is connected to. Derived from `service.klipper.settings` by default.";
+          defaultText = lib.literalExpression "config.services.klipper.settings.<name>.serial";
+          default =
+            if lib.hasAttrByPath [ "${mcu}" "serial" ] cfg.settings then cfg.settings."${mcu}".serial else null;
+        };
+        configFile = lib.mkOption {
+          type = lib.types.path;
+          description = "Path to firmware config which is generated using `klipper-genconf`";
+        };
+        package = lib.mkOption {
+          type = lib.types.nullOr lib.types.package;
+          readOnly = true;
+          description = "Path to the built firmware package.";
+        };
+        klipperFlashPackage = lib.mkOption {
+          type = lib.types.nullOr lib.types.package;
+          readOnly = true;
+          description = "Path to the built klipper-flash package.";
+        };
+      };
+      config = {
+        package =
+          if subcfg.enable then
+            pkgs.klipper-firmware.override {
+              klipper = cfg.package;
+              mcu = lib.strings.sanitizeDerivationName mcu;
+              firmwareConfig = subcfg.configFile;
+            }
+          else
+            null;
+
+        klipperFlashPackage =
+          if subcfg.enable && subcfg.enableKlipperFlash then
+            pkgs.klipper-flash.override {
+              klipper = cfg.package;
+              klipper-firmware = subcfg.package;
+              mcu = lib.strings.sanitizeDerivationName mcu;
+              flashDevice = subcfg.serial;
+              firmwareConfig = subcfg.configFile;
+            }
+          else
+            null;
+      };
+    }
+  );
 in
 {
   imports = [
@@ -119,30 +181,17 @@ in
       };
 
       firmwares = lib.mkOption {
-        description = "Firmwares klipper should manage";
+        description = "Firmwares Klipper should manage";
         default = { };
-        type =
-          with lib.types;
-          attrsOf (submodule {
-            options = {
-              enable = lib.mkEnableOption ''
-                building of firmware for manual flashing
-              '';
-              enableKlipperFlash = lib.mkEnableOption ''
-                flashings scripts for firmware. This will add `klipper-flash-$mcu` scripts to your environment which can be called to flash the firmware.
-                Please check the configs at [klipper](https://github.com/Klipper3d/klipper/tree/master/config) whether your board supports flashing via `make flash`
-              '';
-              serial = lib.mkOption {
-                type = lib.types.nullOr path;
-                default = null;
-                description = "Path to serial port this printer is connected to. Leave `null` to derive it from `service.klipper.settings`.";
-              };
-              configFile = lib.mkOption {
-                type = path;
-                description = "Path to firmware config which is generated using `klipper-genconf`";
-              };
-            };
-          });
+        type = lib.types.attrsOf firmwareSubmodule;
+        example = {
+          mcu = {
+            enable = true;
+            enableKlipperFlash = true;
+            serial = "/dev/serial/by-id/usb-Klipper_123ABCDEF";
+            configFile = lib.literalExpression "./klipper-firmware.cfg";
+          };
+        };
       };
     };
   };
@@ -158,16 +207,6 @@ in
         assertion = cfg.user != null -> cfg.group != null;
         message = "Option services.klipper.group is not set when services.klipper.user is specified.";
       }
-      {
-        assertion =
-          cfg.settings != null
-          -> lib.foldl (a: b: a && b) true (
-            lib.mapAttrsToList (
-              mcu: _: mcu != null -> (lib.hasAttrByPath [ "${mcu}" "serial" ] cfg.settings)
-            ) cfg.firmwares
-          );
-        message = "Option services.klipper.settings.$mcu.serial must be set when settings.klipper.firmware.$mcu is specified";
-      }
       {
         assertion = (cfg.configFile != null) != (cfg.settings != null);
         message = "You need to either specify services.klipper.settings or services.klipper.configFile.";
@@ -176,7 +215,16 @@ in
         assertion = (cfg.configFile != null) -> (cfg.extraSettings == "");
         message = "You can't use services.klipper.extraSettings with services.klipper.configFile.";
       }
-    ];
+    ]
+    ++ lib.mapAttrsToList (mcu: firmware: {
+      assertion = firmware.enable -> firmware.serial != null;
+      message = ''
+        Unable to determine the serial connection for services.klipper.firmwares."${mcu}". Please set one of the following:
+
+          - services.klipper.firmwares."${mcu}".serial
+          - services.klipper.settings."${mcu}".serial
+      '';
+    }) cfg.firmwares;
 
     services.klipper = lib.mkIf cfg.octoprintIntegration {
       user = config.services.octoprint.user;
@@ -257,37 +305,14 @@ in
         genconf = pkgs.klipper-genconf.override {
           klipper = cfg.package;
         };
-        firmwares = lib.filterAttrs (n: v: v != null) (
-          lib.mapAttrs (
-            mcu:
-            {
-              enable,
-              enableKlipperFlash,
-              configFile,
-              serial,
-            }:
-            if enable then
-              pkgs.klipper-firmware.override {
-                klipper = cfg.package;
-                mcu = lib.strings.sanitizeDerivationName mcu;
-                firmwareConfig = configFile;
-              }
-            else
-              null
-          ) cfg.firmwares
+        firmwares = lib.filter (v: v != null) (
+          lib.mapAttrsToList (mcu: firmware: firmware.package) cfg.firmwares
+        );
+        firmwareFlashers = lib.filter (v: v != null) (
+          lib.mapAttrsToList (mcu: firmware: firmware.klipperFlashPackage) cfg.firmwares
         );
-        firmwareFlasher = lib.mapAttrsToList (
-          mcu: firmware:
-          pkgs.klipper-flash.override {
-            klipper = cfg.package;
-            klipper-firmware = firmware;
-            mcu = lib.strings.sanitizeDerivationName mcu;
-            flashDevice = default cfg.firmwares."${mcu}".serial cfg.settings."${mcu}".serial;
-            firmwareConfig = cfg.firmwares."${mcu}".configFile;
-          }
-        ) (lib.filterAttrs (mcu: firmware: cfg.firmwares."${mcu}".enableKlipperFlash) firmwares);
       in
-      [ genconf ] ++ firmwareFlasher ++ lib.attrValues firmwares;
+      [ genconf ] ++ firmwares ++ firmwareFlashers;
   };
   meta.maintainers = [
     lib.maintainers.cab404
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index abba24d1e430..c61f217b4b68 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -109,18 +109,11 @@ in
     package = lib.mkOption {
       type = lib.types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "25.11" then
-          pkgs.netbox_4_3
-        else if lib.versionAtLeast config.system.stateVersion "25.05" then
-          pkgs.netbox_4_2
-        else
-          pkgs.netbox_4_1;
+        if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_3 else pkgs.netbox_4_2;
       defaultText = lib.literalExpression ''
         if lib.versionAtLeast config.system.stateVersion "25.11"
         then pkgs.netbox_4_3
-        else if lib.versionAtLeast config.system.stateVersion "25.05"
-        then pkgs.netbox_4_2
-        else pkgs.netbox_4_1;
+        else pkgs.netbox_4_2;
       '';
       description = ''
         NetBox package to use.
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e8427a17974e..86662c1e528d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -992,7 +992,6 @@ in
   neo4j = runTest ./neo4j.nix;
   netbird = runTest ./netbird.nix;
   netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
-  netbox_4_1 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_1; };
   netbox_4_2 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_2; };
   netbox_4_3 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_3; };
   netdata = runTest ./netdata.nix;
diff --git a/nixos/tests/web-apps/immich.nix b/nixos/tests/web-apps/immich.nix
index e9b3c38961fd..fddc681620f1 100644
--- a/nixos/tests/web-apps/immich.nix
+++ b/nixos/tests/web-apps/immich.nix
@@ -27,6 +27,12 @@
           notifications.smtp.transport.password = "/etc/shadow";
         };
       };
+
+      # licensed under  CC0 1.0: https://github.com/NixOS/nixpkgs/issues/450972#issuecomment-3393545531
+      environment.etc.photos.source = pkgs.fetchzip {
+        url = "https://github.com/user-attachments/files/22865871/IMGP5923.zip";
+        hash = "sha256-ux0IG1qCB1s8GKsZp9R0rvwEZxeXm5FnuS9kYstKVmo=";
+      };
     };
 
   testScript = ''
@@ -57,6 +63,13 @@
     res = machine.succeed("immich server-info")
     print(res)
 
+    with subtest("Test thumbnail generation from PEF format"):
+      res = machine.succeed("immich upload --json-output /etc/photos/IMGP5923.PEF | tail -n +4")
+      asset_id = json.loads(res)["newAssets"][0]["id"]
+      machine.wait_until_succeeds(f"""
+        curl -fI -X GET -H 'Cookie: immich_access_token={token}' http://localhost:2283/api/assets/{asset_id}/thumbnail
+      """)
+
     machine.succeed("""
       curl -f -X PUT -H 'Cookie: immich_access_token=%s' --json '{ "command": "start" }' http://localhost:2283/api/jobs/backupDatabase
     """ % token)
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index 6ce69fa2e889..3d57250f978d 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -36,13 +36,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "musescore";
-  version = "4.6.1";
+  version = "4.6.2";
 
   src = fetchFromGitHub {
     owner = "musescore";
     repo = "MuseScore";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-vpX96M1Adu3HsGoFExinr5dfZEe7RO4fLkqAALQIsSY=";
+    sha256 = "sha256-3VpptHR9dt8lJeFhFygnPiP0XRf4R29SASC8AicLU5E=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 50026a681614..411006cb6e32 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-5";
+  version = "7.1.2-6";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-THStvhNWu4OYotzxksGJ6l6VeTVRNoJeKoRG1LaJhNI=";
+    hash = "sha256-eJCUryZhGn3LPkmP9JG1iVqZiy8RXARLYDZR++SeYgM=";
   };
 
   outputs = [
diff --git a/pkgs/applications/graphics/scantailor/universal.nix b/pkgs/applications/graphics/scantailor/universal.nix
index 4bc05941e166..954a50661f9a 100644
--- a/pkgs/applications/graphics/scantailor/universal.nix
+++ b/pkgs/applications/graphics/scantailor/universal.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   libsForQt5,
   zlib,
@@ -25,6 +26,20 @@ stdenv.mkDerivation rec {
     hash = "sha256-n8NbokK+U0FAuYXtjRJcxlI1XAmI4hk5zV3sF86hB/s=";
   };
 
+  patches = [
+    # Bump CMAKE_MINIMUM_REQUIRED
+    (fetchpatch {
+      url = "https://github.com/trufanov-nok/scantailor-universal/commit/f90b1c6bb2954ca5c4d0c5b310f359c522fe538c.patch?full_index=1";
+      hash = "sha256-c/mynpM4XNbQ6TcxzZvwwujnfwwA1TPogNU9393gcY4=";
+    })
+    # Remove outdated CMP0043 policy
+    (fetchpatch {
+      url = "https://github.com/trufanov-nok/scantailor-universal/commit/248fdf0fc2dc014d76d4ec9e27a7ad340ff7aaf5.patch?full_index=1";
+      hash = "sha256-xK0hNr6YHgMK4fghc07CTRwcsizTsnGSdDwqcUf9wsY=";
+    })
+
+  ];
+
   buildInputs = [
     libsForQt5.qtbase
     zlib
diff --git a/pkgs/applications/misc/cubocore-packages/libcprime/default.nix b/pkgs/applications/misc/cubocore-packages/libcprime/default.nix
index 28f426b274b1..7bfde551bb3d 100644
--- a/pkgs/applications/misc/cubocore-packages/libcprime/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/libcprime/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
   libnotify,
   cmake,
   ninja,
@@ -21,6 +22,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./0001-fix-application-dirs.patch
+
+    # cmake-4 support
+    (fetchpatch {
+      name = "cmake-4.patch";
+      url = "https://gitlab.com/cubocore/libcprime/-/commit/505931e9634d1b55ea97bdaa0f68dcd51faaea39.patch";
+      hash = "sha256-toWG78tW6qOETTMb63/WtSyIiGkJ00RlPyGTqrWPnLY=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/mailnag/default.nix b/pkgs/applications/networking/mailreaders/mailnag/default.nix
deleted file mode 100644
index ca78b5510d27..000000000000
--- a/pkgs/applications/networking/mailreaders/mailnag/default.nix
+++ /dev/null
@@ -1,111 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  gettext,
-  xorg, # for lndir
-  gtk3,
-  python3Packages,
-  gdk-pixbuf,
-  libnotify,
-  gst_all_1,
-  libsecret,
-  wrapGAppsHook3,
-  gsettings-desktop-schemas,
-  glib,
-  gobject-introspection,
-  # Available plugins (can be overridden)
-  availablePlugins,
-  # Used in the withPlugins interface at passthru, can be overrided directly, or
-  # preferably via e.g: `mailnag.withPlugins([mailnag.availablePlugins.goa])`
-  mailnag,
-  userPlugins ? [ ],
-  pluginsDeps ? [ ],
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "mailnag";
-  version = "2.2.0";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "pulb";
-    repo = "mailnag";
-    rev = "v${version}";
-    sha256 = "0m1cyzwzm7z4p2v31dx098a1iar7dbilwyjcxiqnjx05nlmiqvgf";
-  };
-
-  buildInputs = [
-    gtk3
-    gdk-pixbuf
-    glib
-    libnotify
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad
-    libsecret
-  ]
-  ++ pluginsDeps;
-
-  nativeBuildInputs = [
-    gettext
-    wrapGAppsHook3
-    gobject-introspection
-    # To later add plugins to
-    xorg.lndir
-  ];
-
-  propagatedBuildInputs = with python3Packages; [
-    gsettings-desktop-schemas
-    pygobject3
-    dbus-python
-    pyxdg
-  ];
-
-  passthru = {
-    inherit availablePlugins;
-    withPlugins =
-      plugs:
-      let
-        # goa plugin requires gio's gnome-online-accounts which requires making sure
-        # mailnag runs with GI_TYPELIB_PATH containing the path to Goa-1.0.typelib.
-        # This is handled best by adding the plugins' deps to buildInputs and let
-        # wrapGAppsHook3 handle that.
-        pluginsDeps = lib.flatten (lib.catAttrs "buildInputs" plugs);
-        self = mailnag;
-      in
-      self.override {
-        userPlugins = plugs;
-        inherit pluginsDeps;
-      };
-  };
-
-  # See https://nixos.org/nixpkgs/manual/#ssec-gnome-common-issues-double-wrapped
-  dontWrapGApps = true;
-
-  preFixup = ''
-    substituteInPlace $out/${python3Packages.python.sitePackages}/Mailnag/common/dist_cfg.py \
-      --replace "/usr/" $out/
-    for desktop_file in $out/share/applications/*.desktop; do
-      substituteInPlace "$desktop_file" \
-      --replace "/usr/bin" $out/bin
-    done
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
-  # Actually install plugins
-  postInstall = ''
-    for plug in ${toString userPlugins}; do
-      lndir $plug/${python3Packages.python.sitePackages} $out/${python3Packages.python.sitePackages}
-    done
-  '';
-
-  meta = with lib; {
-    description = "Extensible mail notification daemon";
-    homepage = "https://github.com/pulb/mailnag";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ doronbehar ];
-    broken = true; # at 2022-09-23
-  };
-}
diff --git a/pkgs/applications/networking/mailreaders/mailnag/goa-plugin.nix b/pkgs/applications/networking/mailreaders/mailnag/goa-plugin.nix
deleted file mode 100644
index a163a56e5315..000000000000
--- a/pkgs/applications/networking/mailreaders/mailnag/goa-plugin.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  python3Packages,
-  gobject-introspection,
-  gnome-online-accounts,
-}:
-
-python3Packages.buildPythonPackage rec {
-  pname = "mailnag-goa-plugin";
-  version = "2.0.0";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "pulb";
-    repo = "mailnag-goa-plugin";
-    rev = "v${version}";
-    sha256 = "0bij6cy96nhq7xzslx0fnhmiac629h0x4wgy67k4i4npwqw10680";
-  };
-
-  nativeBuildInputs = [
-    gobject-introspection
-  ];
-
-  buildInputs = [
-    gnome-online-accounts
-  ];
-
-  meta = with lib; {
-    description = "Mailnag GNOME Online Accounts plugin";
-    homepage = "https://github.com/pulb/mailnag-goa-plugin";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ doronbehar ];
-  };
-}
diff --git a/pkgs/build-support/dev-shell-tools/default.nix b/pkgs/build-support/dev-shell-tools/default.nix
index 264b6a31f07a..9a0520229c35 100644
--- a/pkgs/build-support/dev-shell-tools/default.nix
+++ b/pkgs/build-support/dev-shell-tools/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  writeTextFile,
+  writeText,
 }:
 let
   inherit (builtins) typeOf;
@@ -36,24 +36,7 @@ rec {
           str = valueToString value;
         in
         if lib.elem name (drvAttrs.passAsFile or [ ]) then
-          let
-            nameHash =
-              if builtins ? convertHash then
-                builtins.convertHash {
-                  hash = "sha256:" + builtins.hashString "sha256" name;
-                  toHashFormat = "nix32";
-                }
-              else
-                builtins.hashString "sha256" name;
-            basename = ".attr-${nameHash}";
-          in
-          lib.nameValuePair "${name}Path" "${
-            writeTextFile {
-              name = "shell-passAsFile-${name}";
-              text = str;
-              destination = "/${basename}";
-            }
-          }/${basename}"
+          lib.nameValuePair "${name}Path" "${writeText "shell-passAsFile-${name}" str}"
         else
           lib.nameValuePair name str
       )
diff --git a/pkgs/build-support/dev-shell-tools/tests/default.nix b/pkgs/build-support/dev-shell-tools/tests/default.nix
index 074aa8462a7c..d1be8699b751 100644
--- a/pkgs/build-support/dev-shell-tools/tests/default.nix
+++ b/pkgs/build-support/dev-shell-tools/tests/default.nix
@@ -170,10 +170,6 @@ lib.recurseIntoAttrs {
             set -x
 
             diff $exampleBarPathString $barPath
-
-            ${lib.optionalString (builtins ? convertHash) ''
-              [[ "$(basename $exampleBarPathString)" = "$(basename $barPath)" ]]
-            ''}
           )
 
           ''${args:+fail "args should not be set by Nix. We don't expect it to and unstructuredDerivationInputEnv removes it."}
diff --git a/pkgs/by-name/ar/armips/package.nix b/pkgs/by-name/ar/armips/package.nix
index 047ee07e522d..38a741b51356 100644
--- a/pkgs/by-name/ar/armips/package.nix
+++ b/pkgs/by-name/ar/armips/package.nix
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
-      --replace-fail c++11 c++17
+      --replace-fail c++11 c++17 \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.13)" # done by https://github.com/Kingcom/armips/commit/e1ed5bf0f4565250b98b0ddfb9112f15dc8e8e3b upstream, patch not directly compatible
   '';
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ba/backward-cpp/package.nix b/pkgs/by-name/ba/backward-cpp/package.nix
index 44ce9e1d01d0..285d2f342088 100644
--- a/pkgs/by-name/ba/backward-cpp/package.nix
+++ b/pkgs/by-name/ba/backward-cpp/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
@@ -16,6 +17,14 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-2k5PjwFxgA/2XPqJrPHxgSInM61FBEcieppBx+MAUKw=";
   };
 
+  patches = [
+    # update depreciated cmake minimum version
+    (fetchpatch {
+      url = "https://github.com/bombela/backward-cpp/commit/8cb73c397f38b0a375d49335e17980b6c3345ca1.patch?full_index=1";
+      hash = "sha256-i+ywKsCdTIS9sqqwAOcf2Mhdz5ReKfThNLHjhvRRQQ0=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/by-name/ca/cabinpkg/package.nix b/pkgs/by-name/ca/cabinpkg/package.nix
index 2672addf2fff..472d56fd7615 100644
--- a/pkgs/by-name/ca/cabinpkg/package.nix
+++ b/pkgs/by-name/ca/cabinpkg/package.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
     homepage = "https://cabinpkg.com";
     description = "Package manager and build system for C++";
     license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.eihqnh ];
+    maintainers = [ ];
     platforms = lib.platforms.unix;
     mainProgram = "cabin";
   };
diff --git a/pkgs/by-name/ca/cargo-seek/package.nix b/pkgs/by-name/ca/cargo-seek/package.nix
index cc44c9330682..30cfdc3e53f1 100644
--- a/pkgs/by-name/ca/cargo-seek/package.nix
+++ b/pkgs/by-name/ca/cargo-seek/package.nix
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/tareqimbasher/cargo-seek";
     changelog = "https://github.com/tareqimbasher/cargo-seek/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ eihqnh ];
+    maintainers = [ ];
     mainProgram = "cargo-seek";
   };
 })
diff --git a/pkgs/by-name/co/colima/package.nix b/pkgs/by-name/co/colima/package.nix
index e28197b411f0..5ab0b0f2fee5 100644
--- a/pkgs/by-name/co/colima/package.nix
+++ b/pkgs/by-name/co/colima/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.8.4";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = "colima";
     tag = "v${version}";
-    hash = "sha256-TNq0lHNF6jwUqamJXYTxuF0Q9mfVwi8BaesQv87eRiE=";
+    hash = "sha256-oRhpABYyP4T6kfmvJ4llPXcXWrSbxU7uUfvXQhm2huc=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
diff --git a/pkgs/by-name/do/dokieli/missing-hashes.json b/pkgs/by-name/do/dokieli/missing-hashes.json
index fc0ef7e8cd5a..2e2ac1107d8a 100644
--- a/pkgs/by-name/do/dokieli/missing-hashes.json
+++ b/pkgs/by-name/do/dokieli/missing-hashes.json
@@ -1,47 +1,48 @@
 {
-  "@esbuild/aix-ppc64@npm:0.25.4": "0d8f2e73ed75c2273cfe01452ad86585d5205a3f4abaddb5a040cfdb144b83a3e6192e34ab0ceaa77ce1bb08a5d8e5feb98cc30f1f1f6e4a2dccd177fbe6ccda",
-  "@esbuild/android-arm64@npm:0.25.4": "a6bc6be3a75c575e21a4f5135faed0575628ad41fdfa582e5a27e992c66fa0fc7e61fb5edce0eb9dcc28bd33656945bcb48d6e4eaa3f197a56c7399e04d3dd07",
-  "@esbuild/android-arm@npm:0.25.4": "2840ee03556a470145a14416348c7bc8e3e93c7f4c1ab1579f0b1e428f242c9349987c74501d3740bc2679cfd86e63e6288a8ce01e81459e00f95a812fb19e13",
-  "@esbuild/android-x64@npm:0.25.4": "4808d422695cf0f9674bbbd50bd7773d2594563375bbbb24b774cd2060373533bdf726653b16daa73a85cc222e16ccf33bfff1fa14e365aea28293e8df8b027d",
-  "@esbuild/darwin-arm64@npm:0.25.4": "73a6b24a30432074dffc4b725d291a9fb30d787f28b3a17b6c99072854e3317af7ef510577b8c2732636ac4aa51465be8dd71f6443e3113944e8f8bcd8315fe2",
-  "@esbuild/darwin-x64@npm:0.25.4": "cdbe0cdcf8a14402cb8180b1189dd08c457ffbfc23a49f83b6a47d56802bdca5d3701b97e5fea0f11639f455822d29d74aa9a0dceb4b36b02a2bc38d3570c7b9",
-  "@esbuild/freebsd-arm64@npm:0.25.4": "583d6a4649eaed0db27bc06e997ec786df2f854ff7f979b8b24d76750f90f50f8b356ee159466cf08f95c6fe86fad4650817f3812b7b78901974f47ccc5a0f29",
-  "@esbuild/freebsd-x64@npm:0.25.4": "e1a092fa2493d1c193abb9858aa01111287457318f43f167c351fbb5baf32848a78813f2e14bbbb05124bf34f0f2fe5d54bee2514b5aed5171616a9c8e130fe8",
-  "@esbuild/linux-arm64@npm:0.25.4": "6ab9f163a787e1209c87ce2029ff7223645646aa05d1ef7c8d0f33b3230ccdcd62b4cf3fc05636dc4c8209cf58ccb1bd9306ce5eac76add4448c8175fc13311e",
-  "@esbuild/linux-arm@npm:0.25.4": "ab5c452fd502b04d88729cf8fa2b39ae866f0bd7a61e3fd1704f0c4423e4c6a2bee8ae7d03dd5942edbd68d2008e8cfc3dd18e99b5298f366bef452a4e350eb3",
-  "@esbuild/linux-ia32@npm:0.25.4": "ca88f8357a8af3bb7baae8f8cef3c0b19c6fcb5737f75e9d53ec05ac171516abedbfd5072c0a3e0eea5faab4f38f876ea54fa996609803af0b4fd4c8fc8fa963",
-  "@esbuild/linux-loong64@npm:0.25.4": "cfbf0ab09f7ad3576fc85d8d7081e454f89f2b17b4be77aa40e1e6352b79b112adb6db536817954533e7da1a3cfe17cfcb66552f485a8eae1acc54764242c165",
-  "@esbuild/linux-mips64el@npm:0.25.4": "0d530ac0cbf26b5c6595f3bbce0828a36cb00b42e41759e9bd98344aaeafc20c9850f3adf86447f43258bca043236cca36f1617114c65db5155c3e5dd00d083b",
-  "@esbuild/linux-ppc64@npm:0.25.4": "0b9663f108192b8781b4993b406ec6a6beeffba81de689f9fc3d798a012a0e1b270858c8554a4a7bc5d11f43f619b6cef96bf3abdf7ea1b435c3dd3857ba3315",
-  "@esbuild/linux-riscv64@npm:0.25.4": "b24ce37a0b2b573782bf3cd530c5754baea8c1fa22320f6f2baa2bb3f530056a1ac15ea75e0bb2e744b90d197c9fc305e5372a6bfa50e1c71614e2c9dced8e97",
-  "@esbuild/linux-s390x@npm:0.25.4": "4207474583d46be6657390b9f440ddae0e9643cea20fb9d2f80df63ed780efb07acfb34b29ddd67ded8f6bf8a7e2ce2349db61772814d862294a2e081c61e643",
-  "@esbuild/linux-x64@npm:0.25.4": "bf208856a7b9d9b161f02717704fcf5473055994e25d6f7ddd323cf749dc4232193d15a8a69deadf5e803c33bd9cc99e8e2f452fe9ca006c9fe258245b35745c",
-  "@esbuild/netbsd-arm64@npm:0.25.4": "b0c09632d59399fec5f05aa772a649f1812a8b14ec38a6c688113c10be056a7202dc2383b5b9ac74f78ba9abd5a48485aa1ca0b70faf38cce95ab23682f9b7ed",
-  "@esbuild/netbsd-x64@npm:0.25.4": "4c7b46aa8855d1a6d3bae0bd552aa6e8c4662d8c0cff80c33a6d94169cdeb9c576a6d7a44f9b0eacc95435faa7db779c117ac2c7aabb4eddcbd0738423d30e5e",
-  "@esbuild/openbsd-arm64@npm:0.25.4": "55bb5cea852eef8de2e44e0486257a3841988f8114ad1dbaf1b47c869c6e449a69f12d0d2dc82a20830496d9f06a5b1ee109d856dd1285b3a48963eedb70c5e1",
-  "@esbuild/openbsd-x64@npm:0.25.4": "fdfd19bd660a545a648413ba255e3e07e3a1de7b81fde1fc25ede3ff5d8c5f1cf23355655709805d207781850f850e728c91f32e90431e2125a8ef87d66a98f3",
-  "@esbuild/sunos-x64@npm:0.25.4": "78934b4622c935f975e96819cfcbcb223bba65a272b06213ce16177eb3afb92f5e82ec6b9ca4eabefc90bf05a69e22f1788e6b269d4150c090a20446fdbf2e3c",
-  "@esbuild/win32-arm64@npm:0.25.4": "d7d751f6787f2aa56b1e7158e77c81f327502f42ebd2a8685811e19ea4b7536d73a0c4bc3850a7fea0e8ea1de5f89d2b8328d8a41d79b11c03341ba1facf9360",
-  "@esbuild/win32-ia32@npm:0.25.4": "72d90ea6406e58f3fa423e3736aab7da3475a2b8e98713106106218536186501367e19822463d78fd0ce25a1412ab52610313f4b878fed977e179d2a8794dd1a",
-  "@esbuild/win32-x64@npm:0.25.4": "b929850a2cd8cec7431867dc26bb8cb9f8654ddff5a8417be176eea51fa83f7925bdbc61933575d2db5e12bbc44042ed97e30507e5d7bcf5dc590f7808adaad6",
-  "@rollup/rollup-android-arm-eabi@npm:4.41.0": "4bd62501cc9b5571ec314bba4ff5db2ea5216e96eb06bd7e020c4dd569968e54b23ef3d67a13c9a33514ee032ca8bf375e6de5b2be56a7f0db5c57654c0c223a",
-  "@rollup/rollup-android-arm64@npm:4.41.0": "d1f27fe5e0616ceb88208267ccda7aa2cf6e6390af3b32c4f2826b5ec06d8815a7b44e0d29484b92afa92a38915066f0ee5dcbe507870be0b0849a2699962e82",
-  "@rollup/rollup-darwin-arm64@npm:4.41.0": "431ff15144dd58823b17754f16e484e05d16a49818efeb725220497cef265da2080611aebb19eb4283f48085dc7e3fd504f6c7493945f85c2d8887cabadcb1e2",
-  "@rollup/rollup-darwin-x64@npm:4.41.0": "715a2e161a0ea6d1d92ad39fd97cae3ec01c8ae9a0cc6ae0a533d451c187968533bafba0c4695947a4bcd1249dca9478fdb1ebac35f649f0995d34922d06a486",
-  "@rollup/rollup-freebsd-arm64@npm:4.41.0": "b12cf55a85baf59ddb9a03095b13255fea65a4875c38af292dc92c8ef7f1e811ab5e5e79b423ebdb1936bb446fec004a7a42bbf376f94fa94126a2a64901ea6d",
-  "@rollup/rollup-freebsd-x64@npm:4.41.0": "9bf78726c78eeb0c1212ec3e3605744a9b1087fd0e1469d0f54fdd08b4dc81302f1621fc31ea2249d8fb944407343ec7d2857ef57a06d56c6d287d2e3574d06d",
-  "@rollup/rollup-linux-arm-gnueabihf@npm:4.41.0": "b117d0f6f4aaee502b27930d3b3523171528bfbbd31a1791ac7ec36f7aebd8b6cf7f8bd40a3adba8d7048c0a11e9cc665ad1c785740a4422d9b3353dd3f67886",
-  "@rollup/rollup-linux-arm-musleabihf@npm:4.41.0": "7fafe40a34e0095d96f8b610e6d0052d105c734121d3f79c5d44eccee0006d8ccb69ae3bfb8c8cf6f29fc5460347601eaa6a118e51f783dc30031ee8b9998be0",
-  "@rollup/rollup-linux-arm64-gnu@npm:4.41.0": "9f0cd0828e56f7d15975767d7f0ac7163614df9838e37baa716b628ab780d879df13ed84f5ed8de2f324dffa35ee7952fdd4de73b8598de3ccba307c7b2a4c44",
-  "@rollup/rollup-linux-arm64-musl@npm:4.41.0": "7bbd1323a9acc4e7803561f5c19e5d38f3db8d58e0eafcfc8ea08c3a3fdadd4ebc85c3c535a1b9d94f6f3ff62e6c69160d7769887bbda8324f5030f364d88c1a",
-  "@rollup/rollup-linux-loongarch64-gnu@npm:4.41.0": "e3322d87f3ab12c5dbed3ffdcc6c4a341e4d8714454758707af5ec4460003b00d18d44b210313f4e6233f505a30da4af5f46480bd983454c5595f6970c752d0e",
-  "@rollup/rollup-linux-powerpc64le-gnu@npm:4.41.0": "3b7f57d9ce5ffa72f79075261c052017e80927f513926526902b362c1f328ba16b9dd62938e084e394f9dbb77deccaf32dc330434581384fb18bd1d2f2384a43",
-  "@rollup/rollup-linux-riscv64-gnu@npm:4.41.0": "1f64fa850a0952f62e77a5096c6cd81b32710d9d9f8a699fc4d4a39d086c6aff13675f67c359823eed016c1967b157861e96847eb5e8b0663f5db25d42ae0fc3",
-  "@rollup/rollup-linux-riscv64-musl@npm:4.41.0": "e6588e3a75b87a602ed1ece39680bc3b67792e53cc9835757b6b91ce9a728aaab64fe6b25b83aef5f05933addef49ae5f7e80ea206b0c9be488c8d896087f61c",
-  "@rollup/rollup-linux-s390x-gnu@npm:4.41.0": "c664fb7c55d800371fa7ab549242f5e46ab52ec9eadbf998beaf745712e6e00a27aa7074b32098fc0a571acb29be403c206e71c4ce7cfccf00783985eb0c6554",
-  "@rollup/rollup-linux-x64-gnu@npm:4.41.0": "cf9337ee96b3cd3d7165cab9d8514fa6022607e99bf95ba147512bb62ad6af5000971ddcac04c65e7329eb63f505328b5a4f33e78e46f4ebf132e333938678b4",
-  "@rollup/rollup-linux-x64-musl@npm:4.41.0": "357fc65d5db7e66d80a4ef9d4820430db8ae14e0cf7d3f9c78dc2e2c2d9902d680c763f6695ca32703669009dd26f6f969b1ccfd4318eafece4ea754fc014ee8",
-  "@rollup/rollup-win32-arm64-msvc@npm:4.41.0": "abb25ae4c9566d0cba63cfe30d59a141b3c2b84d6742f1ca80bdad62919d3cd0f9237e4ed76bdeac130de2071df1290a5985f6e48f02cba7713cedebfb5c22f8",
-  "@rollup/rollup-win32-ia32-msvc@npm:4.41.0": "914685bea8d942d350528ce7bd36db3b223ec0cb42cdbe2a7368359fab43a7b90bc37cedaa134c43be6a0c068187f130d301d7a0d6301758095b283c00205969",
-  "@rollup/rollup-win32-x64-msvc@npm:4.41.0": "60dd4af8bccaa9148ab8be40d650e3254fc584500927951468b5ec533a59578cdd2269c4c33139fc24e2c890c16f34b9df98dba70d0359e9a500264c620e3a41"
+  "@esbuild/aix-ppc64@npm:0.25.8": "37fc14b17214c1f6bf41175029b62a43664a6a5a5b802614fe1d837bbf7abf5eaf2f6b735b6a446ebcfabb632e038c8ad9cccd87a259c45a1846689f8527874a",
+  "@esbuild/android-arm64@npm:0.25.8": "e367e989238292ccee72013511dde1aef2d2160d8d5d669a12272f693cf9a0970fac9d7835178b3c46ed6936a0c4b29d21d58ed11851a3697bf98b4320be4b74",
+  "@esbuild/android-arm@npm:0.25.8": "cbfa2c802d8931e5f4d06582f20573cb34774ab713b4712c37eb15bfab6f90b693878b661de2a3bb9c81eecf45b37e0ddf2e9c79ef4ff932bbc37da588c40183",
+  "@esbuild/android-x64@npm:0.25.8": "1d4b900dd2f43790415745d20ae6cadb53e9412911578aaf43462277169c22800eca1f49a9f8ce9c37236e1691279494f91967d28310720707911910ec765013",
+  "@esbuild/darwin-arm64@npm:0.25.8": "a8a50e303056e668e99370a88d1744de4a83e62e2f3f7fcf2ff611142346505229568b0ec5edda93ec96e33e842a585880a312790553202750f123d9636fa97d",
+  "@esbuild/darwin-x64@npm:0.25.8": "9806fe9d54f3228a01f535e7c51aea26bd1bab3c5d64d5f77f4606de44f361f049222776d32bfd262d45991b7aecca645ed576ea338edbf4f8044b22b3e331ad",
+  "@esbuild/freebsd-arm64@npm:0.25.8": "8e6cbdd45819390ecdb62a70a4f119a9269a90895f3e1237788b36a512248a756233ef59f55f9033658af372a196f0edc3567f078f1387e150238d2bd51f733b",
+  "@esbuild/freebsd-x64@npm:0.25.8": "3f920c686037f825859a2fe82104085f4b254b77821cc71a71db512ef0679dd01481c136c3f7057ba7250daff2458aa3ffd101cc28cb5fff2d55270ba5930ec8",
+  "@esbuild/linux-arm64@npm:0.25.8": "234edc9f815cdc74d21c6a90a3542c941deeaf3a24b408c74a4651616bd270383ba5a15eaef837ab347a374032c7028fc29e4f1da0becb33f0b8dd8f744934d7",
+  "@esbuild/linux-arm@npm:0.25.8": "dc6dc225ae278cb3383e11d9829d22f301e1b79f2ed4efde1a01896ae67e45efde98caa61f10cb425a809e9b61e9a4651b60d2b6a3e9ad6174519e8ce74bc02a",
+  "@esbuild/linux-ia32@npm:0.25.8": "1c780012035552e27adea34d11f959a3ddd4a4d576cddd03d320b1db18110e777c1adca2c6d10affd587a4454900d3ffcad9371956855e56739babdc2e4edcd3",
+  "@esbuild/linux-loong64@npm:0.25.8": "d3d39691d301d144c7d61f52163a2fe64caaf928f4117d906707dc1456f3d88d1a7a3b16fb988ccfc0b0bc203f4bcd56665a9c7405dc380b3165a26ab195b9ec",
+  "@esbuild/linux-mips64el@npm:0.25.8": "437e51b2be977cf7774114e04c141e3c0f1ceb7f12b961b7b3ac7f99c4e203afdd74c41e072ecdc4bab3cde4f14feedd78653727d1b2013ed3611bd89117ee8c",
+  "@esbuild/linux-ppc64@npm:0.25.8": "29d2e344b1c8b767518d25b23eb9e98d85deae1f2def2e01c1939536ac7d1fc9e92749a8d29b29277b3340d3613e4b0f96213c6aa2de7e06885a19d3d269870a",
+  "@esbuild/linux-riscv64@npm:0.25.8": "82b2ef7fd5a00b465da97bd797246269d7460ed710c0533517a1f8ad8e32527f405509b2ce27e29f8f3df1affa04e45cf5d1a71205f69dab5c1a27118cf10fb8",
+  "@esbuild/linux-s390x@npm:0.25.8": "74168a6e8927d12c883dba56006f5277f8888c7b1b5e4d132a3c235b8629c3015b4715968ba128a79ff55c9f08a23df84fe44047e8cda4366b9699c5c45f27a4",
+  "@esbuild/linux-x64@npm:0.25.8": "d531002ac2ead0bdb293ec1a4eceea687d37815e298196af2471107cdd4c1f76ef7d12417052b51852b80f66111abfb5ad8375c58b97da92306b975e9a8f0649",
+  "@esbuild/netbsd-arm64@npm:0.25.8": "55626924ae946a6225707062648aabb79c70d61e7e094b067338ea1adf72493b502e99e59440fe0d3abfe20eb36c33f78115815d63e72fa99f5e90146c2ee5d9",
+  "@esbuild/netbsd-x64@npm:0.25.8": "d03122aaa3e9a8bda686bc4120820805b5d9701099458a2c928ee1a292fabcc47df0cb178c8c428edb78a058e75cf7c0d80fa25b71fb91db43d73fe6e4062c41",
+  "@esbuild/openbsd-arm64@npm:0.25.8": "113ed8722788986b5b703c791bb9c954e80a861b92f453c66c79318d71cc6eac509c1dc79d20671b4af92165eee05a28eb7b3122537d8701447d30f58c428942",
+  "@esbuild/openbsd-x64@npm:0.25.8": "dfa68d80d68ae825de85aeccc118724ced6b232dcf25da6d862ba03abda2f55e75483dccbf8cb3a7338e7882a05e5425fcf5a902b7dced72c9f1a9c2650912bd",
+  "@esbuild/openharmony-arm64@npm:0.25.8": "8dab5710d93ad4a78a34a0016f6ea0bf2e16489845f9895ecaf354c1c3db209bed8f05a31309b95c358bfeaea53829605f4e315e9a53dae4d9fdb58e31ca4688",
+  "@esbuild/sunos-x64@npm:0.25.8": "ccc940bd687d1f6d320d2538ac594b7fe5e291e194380a8b392dd2348d738cf8d322f9f62bcea82b3809f98796a0a004cd02ba9c4d563e5e336665e1ec8e1e1d",
+  "@esbuild/win32-arm64@npm:0.25.8": "b0a9a86548d4a62e68b12a89e21aaadda3d6d3e96541a2714b74df370cc344e1a2d91604998a26951da28c2f932bd2ee033adc9346bb232622c3ac419107136a",
+  "@esbuild/win32-ia32@npm:0.25.8": "5880e933c8fb8dc1de1225128c171ea64f4b27fe52fc11ed9cfe6b0ca8ae091c2703d4cb629f08c06731810c46f48cf881516d0d54b3ac408dec34586ea84d27",
+  "@esbuild/win32-x64@npm:0.25.8": "9e98fe0e7eef7a0e774ab761c59d520ea1c997a7a6e4c7f9cbc967471a4a7ffb14bc27c60d2aa10796c4e945c3da2613fcc297054566fe3f5191e1250691d622",
+  "@rollup/rollup-android-arm-eabi@npm:4.46.2": "d7d021a87cd3504c8d71b00a94199e13c4e07c14fe20ed7300cf1e6436a5f3fe8496c9e5f206e023b15f9b6f8991b2d95a48b47fa41d5c00b44f37fe5f4d5eb8",
+  "@rollup/rollup-android-arm64@npm:4.46.2": "ca901edbf95bbdd2505c979f777e2a01e2e885a597b6daeed5362dac523ea2a1eb9c0c0d22b9b436f3613c22abdd442bd2764491948890930333a9e40ade35be",
+  "@rollup/rollup-darwin-arm64@npm:4.46.2": "ed2b07c4803915d46ff642abd659e179fae524dcd3cb88c810a5b71290d16b498e0371dcb91fe98f6301b8c6600d579a099be1e9450278326281002df4a80019",
+  "@rollup/rollup-darwin-x64@npm:4.46.2": "c53e31df756cb8d44e179c167db1ec5d321225561a1aff2b320091c226c2dfafd080a98a1466f2dc697ff0173b52c41d89c60cae97f73b41fbd128d4c87fde66",
+  "@rollup/rollup-freebsd-arm64@npm:4.46.2": "9495d87e670bbea87e43d06df53ae83fcd46e2c82a80927556f3516ac76613b8b7739bbd4b43c3f264bbab57a50a3b6cd2dfa6c1b2741bd3acdeba8af7c47018",
+  "@rollup/rollup-freebsd-x64@npm:4.46.2": "890a965b45f4c4b9beb4696912ee30472180a040dafb24ce32f8811aed4d0d0ee90bf675d234abc6d8e66266d2966a72483fff7e6f1dbd116424b23e18fe38a9",
+  "@rollup/rollup-linux-arm-gnueabihf@npm:4.46.2": "ce9720f61b4f7d9a791ba78e13cbbea67ef5f46c465e054c08f009cd06de8c1e4518df8e8578366a27cc9ae4280d37528dd0762906a19e820ca1a95158b47090",
+  "@rollup/rollup-linux-arm-musleabihf@npm:4.46.2": "b884f568a681d8c13ffdfa77ad6183ed6f7f9fe5bc952b1c82dc21e36b4bc8eb7ee292168929a2575ff5ff14582060d7d73c583aef7edf04fd0bddd67140f4b0",
+  "@rollup/rollup-linux-arm64-gnu@npm:4.46.2": "519477372d8358a4d3f1f1245bc2b5b57b65960f9a7d02bc5795ba68aed471fe87b20391a63c334bf0abb94085ad8c89d8d3b2e4d79ca0fed702537e9a0949eb",
+  "@rollup/rollup-linux-arm64-musl@npm:4.46.2": "a5dec7799dd832b5374171a73a6b57cffef8be317482dd9ea4e6554db6fc8afb4bdb91ec725502f1b378aa9cb9a1333684056d55c9120262cb7744a33b961a76",
+  "@rollup/rollup-linux-loongarch64-gnu@npm:4.46.2": "76ebbf40535f68c6922edf7d866dad00608cd475c8436d199653341ea09124cb4478f67c12d32b5363634f3f811926acb14a086eb146a1fe6b310fdbde01f2c8",
+  "@rollup/rollup-linux-ppc64-gnu@npm:4.46.2": "31b62a51393e0f2608e1133701523e894ff5d04038e3d9af95abf595ab7fbe827167a651b200e9975d0e76904699cde3428aa1afbf46bf939f836f8ef90b1d88",
+  "@rollup/rollup-linux-riscv64-gnu@npm:4.46.2": "4f22bc5fe58730026085d1a5372b51d9ed933b314cde2d3dec1d73ad76106406915c313d331f094176ed917863c0041667e63184d9730da7107b11266dad477f",
+  "@rollup/rollup-linux-riscv64-musl@npm:4.46.2": "1bc37b77ac38d7e82e7d661b67fc043a1db01272a0566e5432c61e3c7a5e6c11b5ecb4a49547da2de33a8e0a7b0d685f3c7341572fa77c90e9b71e515f753e86",
+  "@rollup/rollup-linux-s390x-gnu@npm:4.46.2": "1b1821a848d8bf86fa5e01ae57f60ebe5566cbcb0c605b5d05050821e94b8b45a72515ef302a3021196018b289aaffade5c41a5f89b3f8324d509a25d28dcfc4",
+  "@rollup/rollup-linux-x64-gnu@npm:4.46.2": "66231802689c1ac1d6ecec6fd65d14c01c900537e588808e0a2c92ba34e322665bb6df3853500717cf600f40a93de4c490838290e21bb10eed4249f587a08109",
+  "@rollup/rollup-linux-x64-musl@npm:4.46.2": "064ed54e9ddb05eec1b5da5ac8366f3290b7b65e63959a76a26d6940ce44d741c30488e39ce94c51a2679b2c56217c2e0aaf74e123a1c0928503712c115d6047",
+  "@rollup/rollup-win32-arm64-msvc@npm:4.46.2": "b59089cddf652e3da278744f6b8b2105360d1219833e54791380322913d40073ed4197ccd06d6091e83e1e12a5290d7a2e4aeae7947ff20c45943d07d1f0af0c",
+  "@rollup/rollup-win32-ia32-msvc@npm:4.46.2": "d0aae1f80a64d9148426a7ff25b9df7f3abf7aca912c358a952f4b3bc541e030b5959f52e0b67abe01b9c8c8fb6567d1bbd30e31daabb7e2c4dc0488faf875f7",
+  "@rollup/rollup-win32-x64-msvc@npm:4.46.2": "740ca3c1d07f5af76fc9c2db917edbf6d0c1cf3eeee8330a0c571db4990ec44f0b272696a215ab118e8a32d7529f84bd47225e85dfab458a989b4b18d0bbea49"
 }
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index 4b0267558af3..9524664729a1 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2025-08-04";
+  version = "0-unstable-2025-09-10";
 
   src = fetchFromGitHub {
     owner = "dokieli";
     repo = "dokieli";
-    rev = "64374c6b9a53b68ae7921604a1fbe231d3e4f067";
-    hash = "sha256-5baBKXmOxS0BOKNedMSbmw21rDBONZwmim9hlXn5OzQ=";
+    rev = "7c9f3d9f02d8725822594009ffa1742db44fc857";
+    hash = "sha256-ah7Qct0MHRsH5bktyat/Q5mxJKACJl/ci2IVOl5mzvE=";
   };
 
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-4SK1ecjEnnaow5Z2biCPaHirpX6J/5cytQWWicPgmB0=";
+    hash = "sha256-8LBMHdjWaxno4I+ZAwTw9WCVotX7O0eufhGJGg1a0w4=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/fa/faugus-launcher/package.nix b/pkgs/by-name/fa/faugus-launcher/package.nix
new file mode 100644
index 000000000000..90c77d359724
--- /dev/null
+++ b/pkgs/by-name/fa/faugus-launcher/package.nix
@@ -0,0 +1,96 @@
+{
+  fetchFromGitHub,
+  gamemode,
+  gobject-introspection,
+  icoextract,
+  imagemagick,
+  lib,
+  libayatana-appindicator,
+  libcanberra-gtk3,
+  meson,
+  ninja,
+  nix-update-script,
+  python3Packages,
+  umu-launcher,
+  wrapGAppsHook3,
+  xdg-utils,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "faugus-launcher";
+  version = "1.9.6";
+  pyproject = false;
+
+  src = fetchFromGitHub {
+    owner = "Faugus";
+    repo = "faugus-launcher";
+    tag = version;
+    hash = "sha256-7brHeRwrH6MbRcGCb5qufU1PHLgg5fCfgLhvdCQr+ak=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    libayatana-appindicator
+  ];
+
+  build-system = [
+    meson
+    ninja
+  ];
+
+  dependencies = with python3Packages; [
+    filelock
+    pillow
+    psutil
+    pygobject3
+    requests
+    vdf
+  ];
+
+  postPatch = ''
+    substituteInPlace faugus_launcher.py \
+      --replace-fail "PathManager.find_binary('faugus-run')" "'$out/bin/.faugus-run-wrapped'" \
+      --replace-fail "PathManager.find_binary('faugus-proton-manager')" "'$out/bin/.faugus-proton-manager-wrapped'" \
+      --replace-fail "PathManager.user_data('faugus-launcher/umu-run')" "'${lib.getExe umu-launcher}'" \
+      --replace-fail 'Exec={faugus_run}' 'Exec=faugus-run'
+
+    substituteInPlace faugus_run.py \
+      --replace-fail "PathManager.find_binary('faugus-components')" "'$out/bin/.faugus-components-wrapped'" \
+      --replace-fail "PathManager.user_data('faugus-launcher/umu-run')" "'${lib.getExe umu-launcher}'" \
+      --replace-fail "PathManager.find_library('libgamemode.so.0')" "'${lib.getLib gamemode}/lib/libgamemode.so.0'" \
+      --replace-fail "PathManager.find_library('libgamemodeauto.so.0')" "'${lib.getLib gamemode}/lib/libgamemodeauto.so.0'"
+  '';
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+      --suffix PATH : "${
+        lib.makeBinPath [
+          icoextract
+          imagemagick
+          libcanberra-gtk3
+          umu-launcher
+          xdg-utils
+        ]
+      }"
+    )
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple and lightweight app for running Windows games using UMU-Launcher";
+    homepage = "https://github.com/Faugus/faugus-launcher";
+    changelog = "https://github.com/Faugus/faugus-launcher/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ RoGreat ];
+    mainProgram = "faugus-launcher";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/fl/flare-signal/package.nix b/pkgs/by-name/fl/flare-signal/package.nix
index ee3ad8d23303..a36029891702 100644
--- a/pkgs/by-name/fl/flare-signal/package.nix
+++ b/pkgs/by-name/fl/flare-signal/package.nix
@@ -28,29 +28,29 @@ let
     owner = "whisperfish";
     repo = "presage";
     # match with commit from Cargo.toml
-    rev = "123c1f926e359c21b34d099279ee8a92462ce96d";
-    hash = "sha256-qKpPbK5ToFnWucujDlV8qxeT+XrRGYYnm7jp8UOXgZ0=";
+    rev = "31a418d0a35ad746590165520b652d6adb7a0384";
+    hash = "sha256-Mf8RvwfrVpbsUj+mA9L7IjnbMKoZDjZKYor2iqFWSx4=";
   };
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flare";
   # NOTE: also update presage commit
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "schmiddi-on-mobile";
     repo = "flare";
     tag = finalAttrs.version;
-    hash = "sha256-Zdzs9ZLvrI5rGhC1K0SLPsv/xMtJEu5vFRnH3+z/keA=";
+    hash = "sha256-3SYsVF3aUJYSr3pM/BGXYExQwbwckExYwEcF3cZ/94g=";
   };
 
   cargoDeps =
     let
       cargoDeps = rustPlatform.fetchCargoVendor {
         inherit (finalAttrs) pname version src;
-        hash = "sha256-XBUpFQy68qwrKgsKi5TeoakalNLTqolv6z5YfyiaEZI=";
+        hash = "sha256-cxhnfdYcsyXxvTpGGXm2rK3cKVsNk66FYif7/c16NhU=";
       };
     in
     # Replace with simpler solution:
diff --git a/pkgs/by-name/fo/foundry/package.nix b/pkgs/by-name/fo/foundry/package.nix
index 2209002c7185..c0fd7199c5cb 100644
--- a/pkgs/by-name/fo/foundry/package.nix
+++ b/pkgs/by-name/fo/foundry/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "foundry";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "foundry-rs";
     repo = "foundry";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g3iPUAVrn/hEzfn5kZ6kbRlhDwq6BSCwxiYxdxwc7OY=";
+    hash = "sha256-aqJzroRXUT1zO+RyH5QE9ZedapfkIwRmZtAfn0GYEX4=";
   };
 
-  cargoHash = "sha256-arJdqOggUaaiVLeuJuCumT5rIPrKA1WxUCbHfsN4BIw=";
+  cargoHash = "sha256-wmHC6Jpd+6VUjb21cCQEg11kLW0J4EM+FTQn/boQxRI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/im/immich-kiosk/package.nix b/pkgs/by-name/im/immich-kiosk/package.nix
new file mode 100644
index 000000000000..2d8ec6500313
--- /dev/null
+++ b/pkgs/by-name/im/immich-kiosk/package.nix
@@ -0,0 +1,92 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nodejs,
+  pnpm_9,
+}:
+
+buildGoModule rec {
+  pname = "immich-kiosk";
+  version = "0.25.0";
+
+  src = fetchFromGitHub {
+    owner = "damongolding";
+    repo = "immich-kiosk";
+    tag = "v${version}";
+    hash = "sha256-p/DP0rTO+1CVtREAIcP43mTd5zeeQaYRM2BlfqCfUm4=";
+  };
+
+  # Remove pnpm-workspace.yaml as it causes monorepo detection issues
+  # Delete vendor directory to regenerate it consistently across platforms
+  postPatch = ''
+    rm -f frontend/pnpm-workspace.yaml
+    rm -rf vendor
+  '';
+  vendorHash = "sha256-kVyAGBOTgfvddsGlT4/wCnK9YYuks0OplUE3Z124z1k=";
+
+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit pname version src;
+    sourceRoot = "${src.name}/frontend";
+    hash = "sha256-Gqd63bsipy/zpY75krSsQeaMsTpbNg8w0VIu7JYyv/k=";
+    fetcherVersion = 2;
+    postPatch = ''
+      rm -f pnpm-workspace.yaml
+    '';
+  };
+
+  # Frontend is in a subdirectory
+  pnpmRoot = "frontend";
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_9.configHook
+  ];
+
+  # Generate templ templates during vendor hash calculation
+  # Don't run pnpm in this phase - filter out pnpm.configHook
+  overrideModAttrs = oldAttrs: {
+    nativeBuildInputs = builtins.filter (drv: drv != pnpm_9.configHook) (
+      oldAttrs.nativeBuildInputs or [ ]
+    );
+    preBuild = ''
+      go run github.com/a-h/templ/cmd/templ generate
+    '';
+  };
+
+  # Generate templ templates and build frontend assets before Go build
+  # Frontend assets are embedded into the binary via go:embed
+  preBuild = ''
+    go run github.com/a-h/templ/cmd/templ generate
+
+    pushd frontend
+    pnpm build
+    popd
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+
+  # Tests require network access to an Immich server
+  doCheck = false;
+
+  meta = {
+    description = "Lightweight slideshow for running on kiosk devices and browsers that uses Immich as a data source";
+    longDescription = ''
+      Immich Kiosk is a lightweight slideshow for running on kiosk devices and
+      browsers that uses Immich as a data source. It displays photos and videos
+      from your Immich server in a configurable slideshow format, perfect for
+      digital photo frames and kiosk displays.
+
+      This is not an official Immich project and is not affiliated with Immich.
+    '';
+    homepage = "https://github.com/damongolding/immich-kiosk";
+    changelog = "https://github.com/damongolding/immich-kiosk/releases/tag/v${version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ tlvince ];
+    mainProgram = "immich-kiosk";
+  };
+}
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index 0c002e42fbf4..5bf139509ae9 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -146,6 +146,12 @@ let
       runHook postInstall
     '';
   };
+
+  # Without this thumbnail generation for raw photos fails with
+  #     Error: Input file has corrupt header: tiff2vips: samples_per_pixel not a whole number of bytes
+  vips' = vips.overrideAttrs (prev: {
+    mesonFlags = prev.mesonFlags ++ [ "-Dtiff=disabled" ];
+  });
 in
 stdenv.mkDerivation {
   pname = "immich";
@@ -182,7 +188,7 @@ stdenv.mkDerivation {
     pango
     pixman
     # Required for sharp
-    vips
+    vips'
   ];
 
   env.SHARP_FORCE_GLOBAL_LIBVIPS = 1;
diff --git a/pkgs/by-name/ka/karabiner-dk/package.nix b/pkgs/by-name/ka/karabiner-dk/package.nix
index 1b2deda61d05..1b8d61238d32 100644
--- a/pkgs/by-name/ka/karabiner-dk/package.nix
+++ b/pkgs/by-name/ka/karabiner-dk/package.nix
@@ -12,14 +12,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "karabiner-dk";
-  sourceVersion = "6.3.0";
+  sourceVersion = "6.4.0";
   version = lib.defaultTo finalAttrs.sourceVersion driver-version;
 
   src = fetchFromGitHub {
     owner = "pqrs-org";
     repo = "Karabiner-DriverKit-VirtualHIDDevice";
     tag = "v${finalAttrs.sourceVersion}";
-    hash = "sha256-nLu//qG3RzrEDWvNmSJH7YmgVgiTiYTg5FaliiEtdpo=";
+    hash = "sha256-NlzIb9srGVdYUOAOL8W9UJZVrf5IQOm6TVjm73epemM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libqalculate/package.nix b/pkgs/by-name/li/libqalculate/package.nix
index 71e78c35832a..886ad3b2f7bb 100644
--- a/pkgs/by-name/li/libqalculate/package.nix
+++ b/pkgs/by-name/li/libqalculate/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libqalculate";
-  version = "5.7.0";
+  version = "5.8.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "libqalculate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S2WO/bHZ+L4EZgcgdDVB3jJZjqqk/GoksmhKJ7qTw+Q=";
+    hash = "sha256-8rw+SPRGWTdlJkrqSk7FXKMgOWSfErlC8FXqQM49o8A=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libresprite/cmake4.diff b/pkgs/by-name/li/libresprite/cmake4.diff
new file mode 100644
index 000000000000..23b59ba020dd
--- /dev/null
+++ b/pkgs/by-name/li/libresprite/cmake4.diff
@@ -0,0 +1,23 @@
+diff --git i/emscripten/CMakeLists.txt w/emscripten/CMakeLists.txt
+index 7c6ea6a0e..b53a4b6cc 100644
+--- i/emscripten/CMakeLists.txt
++++ w/emscripten/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 3.4.1)
++cmake_minimum_required(VERSION 3.10)
+ project(LibreSprite C CXX)
+ set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
+ set(CMAKE_CXX_STANDARD 20)
+diff --git i/third_party/observable/CMakeLists.txt w/third_party/observable/CMakeLists.txt
+index 3ef458975..4d1f186dc 100644
+--- i/third_party/observable/CMakeLists.txt
++++ w/third_party/observable/CMakeLists.txt
+@@ -1,7 +1,7 @@
+ # Observable Library
+ # Copyright (C) 2016-2021 David Capello
+ 
+-cmake_minimum_required(VERSION 3.2)
++cmake_minimum_required(VERSION 3.10)
+ 
+ project(observable CXX)
+ option(OBSERVABLE_TESTS "Compile observable tests" ON)
diff --git a/pkgs/by-name/li/libresprite/package.nix b/pkgs/by-name/li/libresprite/package.nix
index c7038e432b5f..14df46eb85e8 100644
--- a/pkgs/by-name/li/libresprite/package.nix
+++ b/pkgs/by-name/li/libresprite/package.nix
@@ -7,7 +7,6 @@
   pkg-config,
   ninja,
   gtest,
-
   curl,
   freetype,
   giflib,
@@ -38,7 +37,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
     hash = "sha256-jXjrA859hR46Cp5qi6Z1C+hLWCUR7yGlASOGlTveeW8=";
   };
-
+  patches = [
+    # From https://github.com/LibreSprite/LibreSprite/pull/565
+    ./cmake4.diff
+  ];
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/by-name/lp/lpcnet/package.nix b/pkgs/by-name/lp/lpcnet/package.nix
index 75865e7abb69..8fd8f58bf052 100644
--- a/pkgs/by-name/lp/lpcnet/package.nix
+++ b/pkgs/by-name/lp/lpcnet/package.nix
@@ -47,6 +47,10 @@ stdenv.mkDerivation (finalAttrs: {
     codec2
   ];
 
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+  ];
+
   doCheck = true;
   nativeCheckInputs = [
     # NOTE: From some reason, the tests pass without this on x86_64-linux, but
diff --git a/pkgs/by-name/mc/mcpelauncher-client/fix-cmake4-build.patch b/pkgs/by-name/mc/mcpelauncher-client/fix-cmake4-build.patch
new file mode 100644
index 000000000000..3ec736f980db
--- /dev/null
+++ b/pkgs/by-name/mc/mcpelauncher-client/fix-cmake4-build.patch
@@ -0,0 +1,31 @@
+diff --git a/mcpelauncher-errorwindow/CMakeLists.txt b/mcpelauncher-errorwindow/CMakeLists.txt
+index c9a01b9..448b50b 100644
+--- a/mcpelauncher-errorwindow/CMakeLists.txt
++++ b/mcpelauncher-errorwindow/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 3.1)
++cmake_minimum_required(VERSION 3.10)
+ 
+ project(mcpelauncher-errorwindow LANGUAGES CXX)
+ 
+diff --git a/mcpelauncher-webview/CMakeLists.txt b/mcpelauncher-webview/CMakeLists.txt
+index 7a6b8fe..af80cbf 100644
+--- a/mcpelauncher-webview/CMakeLists.txt
++++ b/mcpelauncher-webview/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 2.8.12)
++cmake_minimum_required(VERSION 3.10)
+ 
+ project(mcpelauncher-webview)
+ 
+diff --git a/simple-ipc/CMakeLists.txt b/simple-ipc/CMakeLists.txt
+index 2f475e1..09b800a 100644
+--- a/simple-ipc/CMakeLists.txt
++++ b/simple-ipc/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required (VERSION 2.6)
++cmake_minimum_required (VERSION 3.10)
+ 
+ project(simpleipc LANGUAGES CXX)
+ 
+
diff --git a/pkgs/by-name/mc/mcpelauncher-client/package.nix b/pkgs/by-name/mc/mcpelauncher-client/package.nix
index a040bae9f356..598fe0b50c14 100644
--- a/pkgs/by-name/mc/mcpelauncher-client/package.nix
+++ b/pkgs/by-name/mc/mcpelauncher-client/package.nix
@@ -26,7 +26,7 @@
 # Bionic libc part doesn't compile with GCC
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "mcpelauncher-client";
-  version = "1.4.0-qt6";
+  version = "1.5.3-qt6";
 
   # NOTE: check mcpelauncher-ui-qt when updating
   src = fetchFromGitHub {
@@ -34,12 +34,15 @@ clangStdenv.mkDerivation (finalAttrs: {
     repo = "mcpelauncher-manifest";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-2YmsxcR4EipnBIBqoM8g6hOCCh1WKooukqXhP/1X6tU=";
+    hash = "sha256-uVtvPeGfiCpXIN1aQzF0nw8qNddIeIjFeoKXJUInqwg=";
   };
 
-  patches = [ ./dont_download_glfw_client.patch ];
+  patches = [
+    ./dont_download_glfw_client.patch
+    ./fix-cmake4-build.patch
+  ];
 
-  # Path hard-coded paths.
+  # Patch hard-coded paths.
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace mcpelauncher-client/src/jni/main_activity.cpp \
       --replace-fail /usr/bin/xdg-open ${xdg-utils}/bin/xdg-open \
diff --git a/pkgs/by-name/mc/mcpelauncher-ui-qt/fix-cmake4-build.patch b/pkgs/by-name/mc/mcpelauncher-ui-qt/fix-cmake4-build.patch
new file mode 100644
index 000000000000..d2e9d1afde4f
--- /dev/null
+++ b/pkgs/by-name/mc/mcpelauncher-ui-qt/fix-cmake4-build.patch
@@ -0,0 +1,51 @@
+diff --git a/axml-parser/CMakeLists.txt b/axml-parser/CMakeLists.txt
+index 633c915..50c5ffb 100644
+--- a/axml-parser/CMakeLists.txt
++++ b/axml-parser/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 3.0)
++cmake_minimum_required(VERSION 3.10)
+ project(axml_parser)
+ 
+ set(CMAKE_CXX_STANDARD 11)
+diff --git a/mcpelauncher-common/CMakeLists.txt b/mcpelauncher-common/CMakeLists.txt
+index 393162f..b1aefdb 100644
+--- a/mcpelauncher-common/CMakeLists.txt
++++ b/mcpelauncher-common/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required (VERSION 2.6)
++cmake_minimum_required (VERSION 3.10)
+ 
+ project(mcpelauncher-common LANGUAGES CXX)
+ 
+diff --git a/mcpelauncher-extract/CMakeLists.txt b/mcpelauncher-extract/CMakeLists.txt
+index 164cfc8..1406fc9 100644
+--- a/mcpelauncher-extract/CMakeLists.txt
++++ b/mcpelauncher-extract/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required (VERSION 3.1)
++cmake_minimum_required (VERSION 3.10)
+ 
+ project(mcpelauncher-extract LANGUAGES CXX)
+ 
+diff --git a/mcpelauncher-ui-qt/CMakeLists.txt b/mcpelauncher-ui-qt/CMakeLists.txt
+index a396838..53693cf 100644
+--- a/mcpelauncher-ui-qt/CMakeLists.txt
++++ b/mcpelauncher-ui-qt/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 3.1)
++cmake_minimum_required(VERSION 3.10)
+ 
+ project(mcpelauncher-ui-qt LANGUAGES CXX)
+ 
+diff --git a/playdl-signin-ui-qt/CMakeLists.txt b/playdl-signin-ui-qt/CMakeLists.txt
+index 7f02ff3..c00b1a8 100644
+--- a/playdl-signin-ui-qt/CMakeLists.txt
++++ b/playdl-signin-ui-qt/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 2.8.12)
++cmake_minimum_required(VERSION 3.10)
+ 
+ project(playdl-signin-ui-qt)
+ 
+
diff --git a/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix b/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
index ee83e179fe40..9cc1ff056f02 100644
--- a/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
+++ b/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
@@ -22,11 +22,12 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "mcpelauncher-ui-manifest";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-W97PIb2NTfmqLsIQgrJkOb+8n3fDzlE91sDvgJbNFwY=";
+    hash = "sha256-utL70loiS1itxbX6Pp10dzIIYssNiQOZKfkPYIsXrvU=";
   };
 
   patches = [
     ./dont_download_glfw_ui.patch
+    ./fix-cmake4-build.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/mongodb-compass/package.nix b/pkgs/by-name/mo/mongodb-compass/package.nix
index d6a3587100d8..2497a1809e75 100644
--- a/pkgs/by-name/mo/mongodb-compass/package.nix
+++ b/pkgs/by-name/mo/mongodb-compass/package.nix
@@ -40,7 +40,7 @@
 
 let
   pname = "mongodb-compass";
-  version = "1.46.11";
+  version = "1.47.1";
 
   selectSystem =
     attrs:
@@ -55,9 +55,9 @@ let
       }
     }";
     hash = selectSystem {
-      x86_64-linux = "sha256-GelQnhrc68xEd4q4ZPgldCnbuLqYZ76LQbWi1LsvL9o=";
-      x86_64-darwin = "sha256-SiwwK7ApifjvCqBeVPtjnafKLKETnP8tegVfXaiCJ8c=";
-      aarch64-darwin = "sha256-g2X9zOk7rjuTFxXXX8t9kvjF11VknlIvjAhYU09fjBQ=";
+      x86_64-linux = "sha256-L+IhvRqUllrFkntYeuE+3Ox59U60fu0P2VP6Zb/1ORA=";
+      x86_64-darwin = "sha256-NYgXtCdrny6pKACYmWDHvrlCOJupyP4GqobDr+13WqU=";
+      aarch64-darwin = "sha256-mZ6bLY6hnOhPb2pxPKpiVQpF3ffZlC265QvkIIjpM9A=";
     };
   };
 
diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeysAudio/package.nix
index 80889bb794ab..5aee7560a85a 100644
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.54";
+  version = "11.61";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-6QYy0AKzh1dA2Myy3i2/0Dw/v6qrZFLLGS2WAiCOgRo=";
+    hash = "sha256-xjFAsnocqar53mBnbi34Q7tRr0OyJoK2S9e1t7O7r9U=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/mu/muparserx/package.nix b/pkgs/by-name/mu/muparserx/package.nix
index d30fac0d67f6..e1a3fda9d1f4 100644
--- a/pkgs/by-name/mu/muparserx/package.nix
+++ b/pkgs/by-name/mu/muparserx/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation rec {
@@ -18,6 +19,22 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  patches = [
+    # must be applied in order
+
+    # cmake min required 2.8.12 -> 3.3
+    (fetchpatch {
+      url = "https://github.com/beltoforion/muparserx/commit/d671af0882d4ba09a4bba810877b796f1877d41e.patch?full_index=1";
+      hash = "sha256-4pJrPTMVpTLZWu+PpTtgmtzryObw6vY/kjgsrPDqljw=";
+    })
+
+    # cmake min required 3.3 -> 3.17
+    (fetchpatch {
+      url = "https://github.com/beltoforion/muparserx/commit/c605872591d542e1630e3fcc4b292d8a0702acd2.patch?full_index=1";
+      hash = "sha256-CZPh/+vBhuUXGGEE1fPQiaojpInWhGmFk1HG9pGuAPw=";
+    })
+  ];
+
   doCheck = true;
   checkPhase = ''
     echo "***Muparserx self-test***"
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 524c40644aa0..4ed4bd770cfe 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nats-server";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${version}";
-    hash = "sha256-Ln4e58jIrZZRbgf1+b28sNT1hyNSZepH5oo71OWVFII=";
+    hash = "sha256-H+2v90LI4WFQ8B7o1AFY2aV3SJcF3BgktpASjiVSvxE=";
   };
 
-  vendorHash = "sha256-533w30v681ZYOEL+gCkF7XOXsUmW1DV2+Eukgd/OcxE=";
+  vendorHash = "sha256-3B8ob5cVDL6adzEu5j5P7ZeVtJkQI3uJOAbzyIu8x20=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ne/netbox_4_1/custom-static-root.patch b/pkgs/by-name/ne/netbox_4_1/custom-static-root.patch
deleted file mode 100644
index c9219fa2b871..000000000000
--- a/pkgs/by-name/ne/netbox_4_1/custom-static-root.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/netbox/netbox/settings.py b/netbox/netbox/settings.py
-index 2de06dd10..00406af48 100644
---- a/netbox/netbox/settings.py
-+++ b/netbox/netbox/settings.py
-@@ -410,7 +412,7 @@ USE_X_FORWARDED_HOST = True
- X_FRAME_OPTIONS = 'SAMEORIGIN'
- 
- # Static files (CSS, JavaScript, Images)
--STATIC_ROOT = BASE_DIR + '/static'
-+STATIC_ROOT = getattr(configuration, 'STATIC_ROOT', os.path.join(BASE_DIR, 'static')).rstrip('/')
- STATIC_URL = f'/{BASE_PATH}static/'
- STATICFILES_DIRS = (
-     os.path.join(BASE_DIR, 'project-static', 'dist'),
diff --git a/pkgs/by-name/ne/netbox_4_1/package.nix b/pkgs/by-name/ne/netbox_4_1/package.nix
deleted file mode 100644
index f2b36a10cf3d..000000000000
--- a/pkgs/by-name/ne/netbox_4_1/package.nix
+++ /dev/null
@@ -1,138 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  fetchpatch,
-  python3,
-  plugins ? _ps: [ ],
-  nixosTests,
-}:
-let
-  py = python3.override {
-    packageOverrides = _final: prev: { django = prev.django_5; };
-  };
-
-  extraBuildInputs = plugins py.pkgs;
-in
-py.pkgs.buildPythonApplication rec {
-  pname = "netbox";
-  version = "4.1.11";
-
-  format = "other";
-
-  src = fetchFromGitHub {
-    owner = "netbox-community";
-    repo = "netbox";
-    tag = "v${version}";
-    hash = "sha256-Nd8HWXn7v0llmg934KGtS5+Tj2RvBhJDuXEvB2Pg3nQ=";
-  };
-
-  patches = [
-    ./custom-static-root.patch
-
-    # Rebase of PR 17620 "Upgrade to Django 5.1"
-    # https://github.com/netbox-community/netbox/pull/17620
-    (fetchpatch {
-      url = "https://github.com/netbox-community/netbox/commit/cda9e0525dc850ddd82bf46762a64607bf97df83.patch";
-      hash = "sha256-iJiz5f926Np1k4c9DpfPe0HefJy1CH6c0wjwBIt1vWQ=";
-    })
-  ];
-
-  propagatedBuildInputs =
-    (
-      with py.pkgs;
-      [
-        django
-        django-cors-headers
-        django-debug-toolbar
-        django-filter
-        django-graphiql-debug-toolbar
-        django-htmx
-        django-mptt
-        django-pglocks
-        django-prometheus
-        django-redis
-        django-rq
-        django-tables2
-        django-taggit
-        django-timezone-field
-        djangorestframework
-        drf-spectacular
-        drf-spectacular-sidecar
-        feedparser
-        jinja2
-        markdown
-        netaddr
-        nh3
-        pillow
-        psycopg
-        psycopg.optional-dependencies.c
-        psycopg.optional-dependencies.pool
-        pyyaml
-        requests
-        social-auth-core
-        social-auth-app-django
-        strawberry-graphql
-        strawberry-django
-        svgwrite
-        tablib
-
-        # Optional dependencies, kept here for backward compatibility
-
-        # for the S3 data source backend
-        boto3
-        # for Git data source backend
-        dulwich
-        # for error reporting
-        sentry-sdk
-      ]
-      ++ social-auth-core.passthru.optional-dependencies.openidconnect
-    )
-    ++ extraBuildInputs;
-
-  buildInputs = with py.pkgs; [
-    mkdocs-material
-    mkdocs-material-extensions
-    mkdocstrings
-    mkdocstrings-python
-  ];
-
-  nativeBuildInputs = [ py.pkgs.mkdocs ];
-
-  postBuild = ''
-    PYTHONPATH=$PYTHONPATH:netbox/
-    python -m mkdocs build
-  '';
-
-  installPhase = ''
-    mkdir -p $out/opt/netbox
-    cp -r . $out/opt/netbox
-    chmod +x $out/opt/netbox/netbox/manage.py
-    makeWrapper $out/opt/netbox/netbox/manage.py $out/bin/netbox \
-      --prefix PYTHONPATH : "$PYTHONPATH"
-  '';
-
-  passthru = {
-    python = python3;
-    # PYTHONPATH of all dependencies used by the package
-    pythonPath = py.pkgs.makePythonPath propagatedBuildInputs;
-    inherit (py.pkgs) gunicorn;
-    tests = {
-      netbox = nixosTests.netbox_4_1;
-      inherit (nixosTests) netbox-upgrade;
-    };
-  };
-
-  meta = {
-    homepage = "https://github.com/netbox-community/netbox";
-    description = "IP address management (IPAM) and data center infrastructure management (DCIM) tool";
-    mainProgram = "netbox";
-    license = lib.licenses.asl20;
-    knownVulnerabilities = [
-      "Netbox version ${version} is EOL; please upgrade by following the current release notes instructions."
-    ];
-    maintainers = with lib.maintainers; [
-      minijackson
-      raitobezarius
-    ];
-  };
-}
diff --git a/pkgs/by-name/ow/owi/package.nix b/pkgs/by-name/ow/owi/package.nix
index c21d43e056b4..2c28ae6c87aa 100644
--- a/pkgs/by-name/ow/owi/package.nix
+++ b/pkgs/by-name/ow/owi/package.nix
@@ -15,14 +15,14 @@ let
 in
 ocamlPackages.buildDunePackage {
   pname = "owi";
-  version = "0.2-unstable-2025-09-25";
+  version = "0.2-unstable-2025-10-09";
 
   src = fetchFromGitHub {
     owner = "ocamlpro";
     repo = "owi";
-    rev = "3c5ea7f07bf0c530286870bfb37010e44b75677d";
+    rev = "8500bc99a5a88515a019b1dc0d736152ab7d1767";
     fetchSubmodules = true;
-    hash = "sha256-3YGNm60ro9DzjxnjRpE2b1fde4tCxo+y8DM8nS73Hwc=";
+    hash = "sha256-vskIVgtgUpjuJFzweDg6w2/ml31/6HQWMEjE08KibmM=";
   };
 
   nativeBuildInputs = with ocamlPackages; [
diff --git a/pkgs/by-name/pm/pmbootstrap/package.nix b/pkgs/by-name/pm/pmbootstrap/package.nix
index 78ff5db4c519..4e4c90d5a183 100644
--- a/pkgs/by-name/pm/pmbootstrap/package.nix
+++ b/pkgs/by-name/pm/pmbootstrap/package.nix
@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "3.5.2";
+  version = "3.6.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "postmarketOS";
     repo = "pmbootstrap";
     tag = version;
-    hash = "sha256-fkzDVMO0huAuJDJIt0dyNGnRD6Go7XZ/YRv/JMtlbss=";
+    hash = "sha256-sO042kmozpGbiojkivs4xbYDgVV4nVbiWkfxnbJFOJg=";
     domain = "gitlab.postmarketos.org";
   };
 
diff --git a/pkgs/by-name/po/podlet/package.nix b/pkgs/by-name/po/podlet/package.nix
index c55a43ae0f60..edf6d5cf001c 100644
--- a/pkgs/by-name/po/podlet/package.nix
+++ b/pkgs/by-name/po/podlet/package.nix
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/containers/podlet";
     changelog = "https://github.com/containers/podlet/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [ eihqnh ];
+    maintainers = [ ];
     mainProgram = "podlet";
   };
 }
diff --git a/pkgs/by-name/po/postman/package.nix b/pkgs/by-name/po/postman/package.nix
index fda3daa7bcd0..bc1241c7b0fc 100644
--- a/pkgs/by-name/po/postman/package.nix
+++ b/pkgs/by-name/po/postman/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "postman";
-  version = "11.58.4";
+  version = "11.67.0";
 
   src =
     let
@@ -27,10 +27,10 @@ let
       name = "postman-${version}.${if stdenvNoCC.hostPlatform.isLinux then "tar.gz" else "zip"}";
       url = "https://dl.pstmn.io/download/version/${version}/${system}";
       hash = selectSystem {
-        aarch64-darwin = "sha256-J6vJNTfkBdPXUp3H3GmT85fnvNCs1xcgH+xa4StwPio=";
-        aarch64-linux = "sha256-4AaG5ifi/x0rftT3iKSERMvlGBKYrLZrnZIKvwlnqWg=";
-        x86_64-darwin = "sha256-YhdmpNl3TKJlVDG2UAAX4lAVSGdHBAQxFtjTqyMuHdw=";
-        x86_64-linux = "sha256-qoEShs3JJ51UOEdhDcFWd2qiMgd1RPdsMql1HqK7Q3s=";
+        aarch64-darwin = "sha256-WDXYSHhwvNo4IifeuYOZmF7KX/5ZArPXtoBe30bmGIg=";
+        aarch64-linux = "sha256-7rtKBx5axftXEXmps1mUPIKPypFUVwhSGA/yJstVU2I=";
+        x86_64-darwin = "sha256-7cm9u0zdvEBfjId6Xp0i4X2E/dtAZ0HeI3y0guzyMp4=";
+        x86_64-linux = "sha256-xg9d1E3S6yR3BOMLb5OXmMfZj5e+GmW9p1FFMBj/5mI=";
       };
     };
 
diff --git a/pkgs/by-name/qa/qalculate-gtk/package.nix b/pkgs/by-name/qa/qalculate-gtk/package.nix
index 2ede6a7f609d..ecc3701fc1cf 100644
--- a/pkgs/by-name/qa/qalculate-gtk/package.nix
+++ b/pkgs/by-name/qa/qalculate-gtk/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qalculate-gtk";
-  version = "5.7.0";
+  version = "5.8.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "qalculate-gtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VPwPf1cQ7jGx9aGv4sjdwu945Nlh3ZqgH9dxtFxiMP4=";
+    hash = "sha256-cK710enmkSgp3r4MEfyWac/V7mMs+CPxq0LrdX2jZTQ=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/by-name/re/re-isearch/package.nix b/pkgs/by-name/re/re-isearch/package.nix
index 5215a005a77d..091036fb9fd6 100644
--- a/pkgs/by-name/re/re-isearch/package.nix
+++ b/pkgs/by-name/re/re-isearch/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation {
   pname = "re-Isearch";
-  version = "2.20220925.4.0a-unstable-2025-09-22";
+  version = "2.20220925.4.0a-unstable-2025-10-10";
 
   src = fetchFromGitHub {
     owner = "re-Isearch";
     repo = "re-Isearch";
-    rev = "d2e16c1f62aa4951d331668908f8dd17638be351";
-    hash = "sha256-6sBIrmngdNG7hCg6NS3MkghVIf58ZNZFITpTBtfZ5RA=";
+    rev = "27dd5bc90a85cb168ebb96be173d0c3a98d714e7";
+    hash = "sha256-aNAAdFeGnZG0EhGLU94mhTFeDAOnWbvXVf9N5KRpbUs=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ro/rofi-file-browser/fix_cmake_min_version.patch b/pkgs/by-name/ro/rofi-file-browser/fix_cmake_min_version.patch
new file mode 100644
index 000000000000..aa50495a86ef
--- /dev/null
+++ b/pkgs/by-name/ro/rofi-file-browser/fix_cmake_min_version.patch
@@ -0,0 +1,21 @@
+From 4b5e65169f2cc5654685841fa7e7553d3aacce3f Mon Sep 17 00:00:00 2001
+From: Bob van der Linden <bobvanderlinden@gmail.com>
+Date: Mon, 13 Oct 2025 17:19:52 +0200
+Subject: [PATCH] cmake: minimum version 2.8 -> 3.10
+
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 6d8b58f..6dff2c0 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,6 +1,6 @@
+ include(CheckSymbolExists)
+ 
+-cmake_minimum_required(VERSION 2.8)
++cmake_minimum_required(VERSION 3.10)
+ project(rofi-file-browser-extended)
+ 
+ 
diff --git a/pkgs/by-name/ro/rofi-file-browser/package.nix b/pkgs/by-name/ro/rofi-file-browser/package.nix
index 87a0c68619b9..280af2b819d5 100644
--- a/pkgs/by-name/ro/rofi-file-browser/package.nix
+++ b/pkgs/by-name/ro/rofi-file-browser/package.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
     ./fix_incompatible_pointer_type.patch
     ./fix_build_on_i686.patch
     ./fix_recent_glib_deprecation_warning.patch
+    ./fix_cmake_min_version.patch
   ];
 
   prePatch = ''
diff --git a/pkgs/by-name/sc/schroot/bump-cmake-minimum.patch b/pkgs/by-name/sc/schroot/bump-cmake-minimum.patch
new file mode 100644
index 000000000000..b63b8c6b9988
--- /dev/null
+++ b/pkgs/by-name/sc/schroot/bump-cmake-minimum.patch
@@ -0,0 +1,12 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -13,8 +13,7 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
+-cmake_minimum_required(VERSION 2.8.12)
+-cmake_policy(VERSION 2.8.12)
++cmake_minimum_required(VERSION 3.10)
+ 
+ project(schroot)
+ 
diff --git a/pkgs/by-name/sc/schroot/package.nix b/pkgs/by-name/sc/schroot/package.nix
index ca012cc05f25..7046d2344fbf 100644
--- a/pkgs/by-name/sc/schroot/package.nix
+++ b/pkgs/by-name/sc/schroot/package.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation {
     ./no-default-config.patch
     ./fix-absolute-paths.patch
     ./fix-boost-includes.patch
+    ./bump-cmake-minimum.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/sdr-j-fm/default.nix b/pkgs/by-name/sd/sdr-j-fm/package.nix
similarity index 51%
rename from pkgs/applications/radio/sdr-j-fm/default.nix
rename to pkgs/by-name/sd/sdr-j-fm/package.nix
index b970a59139d4..cc588fdff082 100644
--- a/pkgs/applications/radio/sdr-j-fm/default.nix
+++ b/pkgs/by-name/sd/sdr-j-fm/package.nix
@@ -3,76 +3,98 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  wrapQtAppsHook,
   pkg-config,
-  qtbase,
-  qwt6_1,
+  qt5,
+  libsForQt5,
   fftwFloat,
   libsamplerate,
   portaudio,
   libusb1,
   libsndfile,
   featuresOverride ? { },
+  airspy,
+  hackrf,
+  libiio,
+  limesuite,
+  rtl-sdr,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdr-j-fm";
-  # The stable release doen't include the commit the came after 3.16 which
-  # added support for cmake options instead of using cmake set() commands. See
-  # also: https://github.com/JvanKatwijk/sdr-j-fm/pull/25
-  version = "3.16-unstable-2023-12-07";
+  version = "3.20-2025-10-07";
 
   src = fetchFromGitHub {
     owner = "JvanKatwijk";
     repo = "sdr-j-fm";
-    rev = "8e3a67f8fbf72dd6968cbeb2e3d7d513fd107c71";
-    hash = "sha256-l9WqfhDp2V01lhleYZqRpmyL1Ww+tJj10bjkMMlvyA0=";
+    rev = "e348cc0a4b4b16f716f36115400dfd861b9a0bd5";
+    hash = "sha256-Do2W+B4U8xxCwGRjrJNWkSpgcXG+2PXoemju5oef+jU=";
   };
 
   nativeBuildInputs = [
     cmake
-    wrapQtAppsHook
+    qt5.wrapQtAppsHook
     pkg-config
   ];
 
   buildInputs = [
-    qtbase
-    qwt6_1
+    qt5.qtbase
+    qt5.qtmultimedia
+    libsForQt5.qwt6_1
     fftwFloat
     libsamplerate
     portaudio
     libusb1
     libsndfile
   ];
-  cmakeFlags = lib.mapAttrsToList lib.cmakeBool finalAttrs.passthru.features;
+  cmakeFlags = lib.mapAttrsToList lib.cmakeBool finalAttrs.passthru.features ++ [
+    # https://github.com/JvanKatwijk/sdr-j-fm/issues/27#issuecomment-3371932903
+    # https://github.com/NixOS/nixpkgs/issues/445447
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+  ];
 
   passthru = {
     features = {
       # All of these features don't require an external dependencies, although it
       # may be implied - upstraem bundles everything they need in their repo.
       AIRSPY = true;
-      SDRPLAY = true;
       SDRPLAY_V3 = true;
       HACKRF = true;
+      LIME = true;
       PLUTO = true;
+      RTLSDR = true;
       # Some more cmake flags are mentioned in upstream's CMakeLists.txt file
       # but they don't actually make a difference.
     }
     // featuresOverride;
+    runtimeDependencies = [
+      airspy
+      hackrf
+      libiio
+      limesuite
+      rtl-sdr
+    ];
   };
 
   postInstall = ''
     # Weird default of upstream
     mv $out/linux-bin $out/bin
+    mv $out/bin/fmreceiver{-3.15,}
+
+    # Ideally, upstream's cmake files should link these libraries to the
+    # executable, but it'd require a bit of work. See:
+    # https://github.com/JvanKatwijk/sdr-j-fm/issues/27
+    wrapProgram $out/bin/fmreceiver \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath finalAttrs.finalPackage.passthru.runtimeDependencies}
   '';
 
-  meta = with lib; {
+  meta = {
     description = "SDR based FM radio receiver software";
     homepage = "https://github.com/JvanKatwijk/sdr-j-fm";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ doronbehar ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ doronbehar ];
     # Upstream doesn't find libusb1 on Darwin. Upstream probably doesn't
     # support it officially.
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
+    mainProgram = "fmreceiver";
   };
 })
diff --git a/pkgs/by-name/sf/sftool-gui/package.nix b/pkgs/by-name/sf/sftool-gui/package.nix
index 17897cdf86c4..c8624f85b52e 100644
--- a/pkgs/by-name/sf/sftool-gui/package.nix
+++ b/pkgs/by-name/sf/sftool-gui/package.nix
@@ -69,7 +69,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Download tool for the SiFli family of chips";
     homepage = "https://github.com/OpenSiFli/sftool-gui";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ eihqnh ];
+    maintainers = [ ];
     mainProgram = "sftool";
   };
 })
diff --git a/pkgs/by-name/sf/sftool/package.nix b/pkgs/by-name/sf/sftool/package.nix
index 58676d2fa6a2..a67399ac43c4 100644
--- a/pkgs/by-name/sf/sftool/package.nix
+++ b/pkgs/by-name/sf/sftool/package.nix
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Download tool for the SiFli family of chips";
     homepage = "https://github.com/OpenSiFli/sftool";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ eihqnh ];
+    maintainers = [ ];
     mainProgram = "sftool";
   };
 })
diff --git a/pkgs/by-name/si/simbaplusplus/package.nix b/pkgs/by-name/si/simbaplusplus/package.nix
index 43b67ebd5c56..3ab7db0559ba 100644
--- a/pkgs/by-name/si/simbaplusplus/package.nix
+++ b/pkgs/by-name/si/simbaplusplus/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   llvmPackages,
   z3,
@@ -19,6 +20,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-h2in203bwfb7ArhoBN0PoWM6DZtxI4jSGQuSTTaBJ7A=";
   };
 
+  patches = [
+    # CMakeLists: minimum cmake version 3.5
+    (fetchpatch {
+      url = "https://github.com/pgarba/SiMBA-/commit/0d5dcaf0a0e85e342141a9c525cc8a10934c2f9d.patch?full_index=1";
+      hash = "sha256-rL/jzq4eoJI6j1aEK8vg6b2uqGjxN6P+8vsC8oYTxng=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail ' ''${LLVM_TOOLS_BINARY_DIR}/llvm-config' " ${lib.getDev llvmPackages.libllvm}/bin/llvm-config" \
diff --git a/pkgs/by-name/sk/skytemple/package.nix b/pkgs/by-name/sk/skytemple/package.nix
index a38c59fd5ccf..9f8bdfb98c2d 100644
--- a/pkgs/by-name/sk/skytemple/package.nix
+++ b/pkgs/by-name/sk/skytemple/package.nix
@@ -4,7 +4,6 @@
   gobject-introspection,
   gtk3,
   gtksourceview4,
-  webkitgtk_4_0,
   wrapGAppsHook3,
   python3Packages,
 }:
@@ -26,10 +25,11 @@ python3Packages.buildPythonApplication rec {
   buildInputs = [
     gtk3
     gtksourceview4
-    # webkitgtk is used for rendering interactive statistics graph which
-    # can be seen by opening a ROM, entering Pokemon section, selecting
-    # any Pokemon, and clicking Stats and Moves tab.
-    webkitgtk_4_0
+    # SkyTemple uses webkitgtk 4.0 which is depend on libsoup2, an
+    # unmaintained library. Since it is optional, do not use it.
+    # It is only used to add interactive monster XP curver, that
+    # can alternatively be opened in the web browser (and is also
+    # rendered in-app as non-interactive image)
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stepmania/package.nix b/pkgs/by-name/st/stepmania/package.nix
index 96c590de81bb..66cfca7cd573 100644
--- a/pkgs/by-name/st/stepmania/package.nix
+++ b/pkgs/by-name/st/stepmania/package.nix
@@ -42,6 +42,9 @@ stdenv.mkDerivation {
 
   postPatch = ''
     sed '1i#include <ctime>' -i src/arch/ArchHooks/ArchHooks.h # gcc12
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'cmake_minimum_required(VERSION 2.8.12)' 'cmake_minimum_required(VERSION 3.10)'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/su/surgescript/package.nix b/pkgs/by-name/su/surgescript/package.nix
index f6e94b484a83..2df7182faab7 100644
--- a/pkgs/by-name/su/surgescript/package.nix
+++ b/pkgs/by-name/su/surgescript/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   ninja,
   versionCheckHook,
@@ -19,6 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-m6H9cyoUY8Mgr0FDqPb98PRJTgF7DgSa+jC+EM0TDEw=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/alemart/surgescript/commit/21a9c0696d592b7cc21e07db828fb93a12c95a7e.patch?full_index=1";
+      hash = "sha256-d0l0xSrhJPIE5dMpEHdRlAMaD3f9x1IGBUpvjcMwDMs=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/by-name/ta/tagutil/package.nix b/pkgs/by-name/ta/tagutil/package.nix
index cdd6b7901d66..b39aaeecde2e 100644
--- a/pkgs/by-name/ta/tagutil/package.nix
+++ b/pkgs/by-name/ta/tagutil/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tagutil";
-  version = "3.1";
+  version = "3.1-unstable-2025-06-16";
 
   src = fetchFromGitHub {
     owner = "kaworu";
     repo = "tagutil";
-    rev = "v${version}";
-    sha256 = "sha256-oY1aGl5CKVtpOfh8Wskio/huWYMiPuxWPqxlooTutcw=";
+    rev = "c8b20ef350b1a8a67a747590e2e88b41f802cce4";
+    sha256 = "sha256-sKnBS9kXhJ2atN6A3qcX9A+0A7WfNkOe+nKSblL3i0o=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/by-name/ta/target-isns/package.nix b/pkgs/by-name/ta/target-isns/package.nix
index acdffceb3a98..0f83d59425bc 100644
--- a/pkgs/by-name/ta/target-isns/package.nix
+++ b/pkgs/by-name/ta/target-isns/package.nix
@@ -26,6 +26,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/open-iscsi/target-isns/commit/3d0c47dd89bcf83d828bcc22ecaaa5f58d78b58e.patch";
       sha256 = "1x2bkc1ff15621svhpq1r11m0q4ajv0j4fng6hm7wkkbr2s6d1vx";
     })
+
+    (fetchpatch {
+      name = "minimal-cmake-version.patch";
+      url = "https://github.com/open-iscsi/target-isns/commit/e209821423f936d1cc9b946fb8f7a8979b8e751b.patch?full_index=1";
+      hash = "sha256-86nl8wTiI9WSZ+Hhw/a9VtgS8OLqoFwiot5iU5IK0f8=";
+    })
   ];
 
   cmakeFlags = [ "-DSUPPORT_SYSTEMD=ON" ];
diff --git a/pkgs/by-name/ta/tasksh/package.nix b/pkgs/by-name/ta/tasksh/package.nix
index 55a4f6f7e854..9d0e252df021 100644
--- a/pkgs/by-name/ta/tasksh/package.nix
+++ b/pkgs/by-name/ta/tasksh/package.nix
@@ -18,6 +18,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ readline ];
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    # Fix the build with CMake 4.
+    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
+  ];
+
   meta = with lib; {
     description = "REPL for taskwarrior";
     homepage = "http://tasktools.org";
diff --git a/pkgs/by-name/te/temporal-cli/package.nix b/pkgs/by-name/te/temporal-cli/package.nix
index 4160e8915212..a8b9aa69f393 100644
--- a/pkgs/by-name/te/temporal-cli/package.nix
+++ b/pkgs/by-name/te/temporal-cli/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "temporal-cli";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fbaqRjYFDeGuCheg3EIUVh/QMhFzLNUb6MUoc/J51Ko=";
+    hash = "sha256-V0ob6Y7ns0ZEH1nZUIDFXxw8JFSzqbMoS4x2KT8pV+k=";
   };
 
-  vendorHash = "sha256-dWcf4X8/Wy/TULdT6PbiMaOd1d+haBlnII+6VKazrD4=";
+  vendorHash = "sha256-ZftQ1jt4y6HUF4aI2x3i7hnqNO4GKgblzjS1Zzb9sWo=";
 
   overrideModAttrs = old: {
     # https://gitlab.com/cznic/libc/-/merge_requests/10
diff --git a/pkgs/by-name/te/termcolor/package.nix b/pkgs/by-name/te/termcolor/package.nix
index 6741ffdb4470..2f2078a59c6d 100644
--- a/pkgs/by-name/te/termcolor/package.nix
+++ b/pkgs/by-name/te/termcolor/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
@@ -16,6 +17,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-2RXQ8sn2VNhQ2WZfwCCeQuM6x6C+sLA6ulAaFtaDMZw=";
   };
 
+  patches = [
+    # bump minimal required cmake version
+    (fetchpatch {
+      url = "https://github.com/ikalnytskyi/termcolor/commit/89f20096bef51de347ec6f99345f65147359bd7c.patch?full_index=1";
+      hash = "sha256-xouiacA+Kpjz+KOw6PgNRCXHAMENiqMww2WTvAvUpCE=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [ "-DTERMCOLOR_TESTS=ON" ];
diff --git a/pkgs/by-name/wl/wla-dx/package.nix b/pkgs/by-name/wl/wla-dx/package.nix
index 317bd36b00dc..5156383739cb 100644
--- a/pkgs/by-name/wl/wla-dx/package.nix
+++ b/pkgs/by-name/wl/wla-dx/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
@@ -16,6 +17,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-t+X1Y1NhAGi4NOPik2fuLZAR3A7NQMAkSgWvqAFaIik=";
   };
 
+  patches = [
+    # bymp minimum required cmake
+    (fetchpatch {
+      url = "https://github.com/vhelin/wla-dx/commit/6fa1f673f010e4fa4571c40929019cd7e67d1bbd.patch?full_index=1";
+      hash = "sha256-SBjTzJxJ8XL9h2fMtjYu9RkaH8H/V+pFdiAobL2D98Y=";
+    })
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/xa/xapp/package.nix b/pkgs/by-name/xa/xapp/package.nix
index b67b16d55923..5fffab2ae0a8 100644
--- a/pkgs/by-name/xa/xapp/package.nix
+++ b/pkgs/by-name/xa/xapp/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation rec {
   pname = "xapp";
-  version = "2.8.13";
+  version = "3.0.1";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     owner = "linuxmint";
     repo = "xapp";
     rev = version;
-    hash = "sha256-CbMwkz+4+uADkfdZEqWCJvbJqkVcvQBmcRISjVb090Q=";
+    hash = "sha256-y7NRlRgITXtSpd0RMt6Am8loUNs734RlIobogqSVo9o=";
   };
 
   # Recommended by upstream, which enables the build of xapp-debug.
diff --git a/pkgs/by-name/xl/xlink/package.nix b/pkgs/by-name/xl/xlink/package.nix
index de021dd3fa94..4b0ba60a0fd8 100644
--- a/pkgs/by-name/xl/xlink/package.nix
+++ b/pkgs/by-name/xl/xlink/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   pkg-config,
   libusb1,
@@ -26,6 +27,11 @@ stdenv.mkDerivation (finalAttrs: {
   # Remove CMake Hunter package manager - needs network connection
   patches = [
     ./001-remove-hunter.patch
+    # Bump CMakeLists.txt to 3.10
+    (fetchpatch {
+      url = "https://github.com/luxonis/XLink/commit/160c6c918c07e28a6a8c5c080a257f7619223304.patch?full_index=1";
+      hash = "sha256-1VMCteJf/an20fI3UTT/X9cH96dCxPRQolfN+e+6jnU=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ym/ympd/bump-cmake-version.patch b/pkgs/by-name/ym/ympd/bump-cmake-version.patch
new file mode 100644
index 000000000000..ecafab2a91d3
--- /dev/null
+++ b/pkgs/by-name/ym/ympd/bump-cmake-version.patch
@@ -0,0 +1,20 @@
+From 5c5862071e7ae982de6f39c9d1679dc496f38a20 Mon Sep 17 00:00:00 2001
+From: "Felix J. Ogris" <fjo@core7.intra.ogris.net>
+Date: Fri, 20 Jun 2025 15:10:38 +0200
+Subject: [PATCH] bump required cmake version to 3.10
+
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 02ee5141d..a8ee3730d 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 2.6)
++cmake_minimum_required(VERSION 3.10)
+ 
+ project (ympd C)
+ set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${PROJECT_SOURCE_DIR}/cmake/")
+
diff --git a/pkgs/by-name/ym/ympd/package.nix b/pkgs/by-name/ym/ympd/package.nix
index 89bb628e8c2f..771daa96d27d 100644
--- a/pkgs/by-name/ym/ympd/package.nix
+++ b/pkgs/by-name/ym/ympd/package.nix
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
     sha256 = "1nvb19jd556v2h2bi7w4dcl507p3p8xvjkqfzrcsy7ccy3502brq";
   };
 
+  patches = [
+    # https://github.com/notandy/ympd/pull/199.patch
+    ./bump-cmake-version.patch
+  ];
+
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: CMakeFiles/ympd.dir/src/mpd_client.c.o:(.bss+0x0): multiple definition of `mpd';
diff --git a/pkgs/by-name/zd/zdbsp/fix-cmake-version.patch b/pkgs/by-name/zd/zdbsp/fix-cmake-version.patch
new file mode 100644
index 000000000000..bcdd0faa8b7f
--- /dev/null
+++ b/pkgs/by-name/zd/zdbsp/fix-cmake-version.patch
@@ -0,0 +1,10 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b0ac4c0..fa681a9 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required( VERSION 2.4 )
++cmake_minimum_required( VERSION 2.4...4.0.2 )
+ if( COMMAND cmake_policy )
+ 	cmake_policy( SET CMP0003 NEW )
+ endif( COMMAND cmake_policy )
diff --git a/pkgs/by-name/zd/zdbsp/package.nix b/pkgs/by-name/zd/zdbsp/package.nix
index bef477e1fc15..f5d31d58702d 100644
--- a/pkgs/by-name/zd/zdbsp/package.nix
+++ b/pkgs/by-name/zd/zdbsp/package.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
     stripRoot = false;
   };
 
+  patches = [
+    # https://github.com/rheit/zdbsp/pull/7
+    ./fix-cmake-version.patch
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/desktops/xfce/core/tumbler/default.nix b/pkgs/desktops/xfce/core/tumbler/default.nix
index 4a569bbbfb09..ff7b9cceda6e 100644
--- a/pkgs/desktops/xfce/core/tumbler/default.nix
+++ b/pkgs/desktops/xfce/core/tumbler/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   mkXfceDerivation,
-  fetchpatch,
   ffmpegthumbnailer,
   gdk-pixbuf,
   glib,
@@ -22,19 +21,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "tumbler";
-  version = "4.20.0";
+  version = "4.20.1";
 
-  sha256 = "sha256-GmEMdG8Ikd4Tq/1ntCHiN0S7ehUXqzMX7OtXsycLd6E=";
-
-  patches = [
-    # Fixes PDF previews staying low resolution
-    # https://gitlab.xfce.org/xfce/tumbler/-/merge_requests/35
-    (fetchpatch {
-      name = "only-use-embedded-pdf-thumbnail-if-resolution-suffices.patch";
-      url = "https://gitlab.xfce.org/xfce/tumbler/-/commit/69a704e0f4e622861ce4007f6f3f4f6f6b962689.patch";
-      hash = "sha256-aFJoWWzTaikqCw6C1LH+BFxst/uKkOGT1QK9Mx8/8/c=";
-    })
-  ];
+  sha256 = "sha256-p4lAFNvCakqrsDa2FP0xbc/khx6eYqAlHwWkk8yEB7Y=";
 
   buildInputs = [
     libxfce4util
diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index 7814ea5de06c..752d3d28bc57 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2025.9.17.17";
+  version = "2025.9.30.16";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-Quupd3I5OM4VtTblHup0z0lX5fSy6h9U1dnbjocAziM=";
+    hash = "sha256-PnFQGfGXwDzSwGuQiEOuFsYVpSQnZE+w+2BWQ2SkxX0=";
   };
 
   pythonRelaxDeps = [ "typer" ];
diff --git a/pkgs/development/python-modules/explorerscript/default.nix b/pkgs/development/python-modules/explorerscript/default.nix
index e612e1fe1d9b..9ea011866ca0 100644
--- a/pkgs/development/python-modules/explorerscript/default.nix
+++ b/pkgs/development/python-modules/explorerscript/default.nix
@@ -28,6 +28,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace-fail "pybind11>=2.13.6, < 2.14" "pybind11" \
       --replace-fail "scikit-build-core>=0.10.7, < 0.11" "scikit-build-core"
   '';
 
diff --git a/pkgs/development/python-modules/freud/default.nix b/pkgs/development/python-modules/freud/default.nix
index c296049807e5..b011267f4c1e 100644
--- a/pkgs/development/python-modules/freud/default.nix
+++ b/pkgs/development/python-modules/freud/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "freud";
-  version = "3.4.0";
+  version = "3.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "glotzerlab";
     repo = "freud";
     tag = "v${version}";
-    hash = "sha256-JX3pbzNTj85UTAtWYnDRvtJSjS27qgY/vitaAjmXbjA=";
+    hash = "sha256-NRI3cv3yQxAwkGxh0CFYEERNkjP51Z58vtCV9GlIESY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/mpi4py/default.nix b/pkgs/development/python-modules/mpi4py/default.nix
index 93162a1bff7f..b95bb5d0142e 100644
--- a/pkgs/development/python-modules/mpi4py/default.nix
+++ b/pkgs/development/python-modules/mpi4py/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "mpi4py";
-  version = "4.1.0";
+  version = "4.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "mpi4py";
     owner = "mpi4py";
     tag = version;
-    hash = "sha256-Hm+x79utOrjAbprud2MECgakyOzgShSwNuoyZUcTluQ=";
+    hash = "sha256-I7b4x3pxtfbmlbno5OIxo4HutRX3/RjdsoNtBRKgE5w=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/parsnip/default.nix b/pkgs/development/python-modules/parsnip/default.nix
index e9dcf670fbeb..7c6ba834ab68 100644
--- a/pkgs/development/python-modules/parsnip/default.nix
+++ b/pkgs/development/python-modules/parsnip/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "parsnip";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "glotzerlab";
     repo = "parsnip";
     rev = "v${version}";
-    hash = "sha256-Nac0afep7+HkpSBpqClHpPFSc8H3g8l4q067RQe5K54=";
+    hash = "sha256-P1Ls+UtWdhYmuwISpPCZYsXFJTBqS6uVaU2PV072BOE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index fc5bb111b935..fd7e9c688a4c 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -4,12 +4,12 @@
   aiohttp,
   aiomqtt,
   aioresponses,
-  async-timeout,
   buildPythonPackage,
   click,
   construct,
   dacite,
   fetchFromGitHub,
+  fetchpatch,
   freezegun,
   paho-mqtt,
   poetry-core,
@@ -40,6 +40,16 @@ buildPythonPackage rec {
     hash = "sha256-66kSNkivq6BHnqIqx1INtdoysBJfCqV76yIAJiHmfxQ=";
   };
 
+  patches = [
+    # https://github.com/Python-roborock/python-roborock/pull/527
+    (fetchpatch {
+      name = "replace async-timeout with asyncio.timeout.patch";
+      url = "https://github.com/Python-roborock/python-roborock/commit/f376027f5933e163441cf1815b820056731a3632.patch";
+      excludes = [ "poetry.lock" ];
+      hash = "sha256-53xsQ3yxh9CilC9hNS31rDXZVFG+mMhe7ffOb4L6bUE=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "poetry-core==1.8.0" "poetry-core"
@@ -52,7 +62,6 @@ buildPythonPackage rec {
   dependencies = [
     aiohttp
     aiomqtt
-    async-timeout
     click
     construct
     dacite
diff --git a/pkgs/development/python-modules/snakemake-interface-executor-plugins/default.nix b/pkgs/development/python-modules/snakemake-interface-executor-plugins/default.nix
index fd8982e9fdd0..e901c2080007 100644
--- a/pkgs/development/python-modules/snakemake-interface-executor-plugins/default.nix
+++ b/pkgs/development/python-modules/snakemake-interface-executor-plugins/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "snakemake-interface-executor-plugins";
-  version = "9.3.5";
+  version = "9.3.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = "snakemake-interface-executor-plugins";
     tag = "v${version}";
-    hash = "sha256-mmaMzb+nhnLb06OGbjjdVeEQQc81OjVNdrUXdToHJ7Y=";
+    hash = "sha256-NiOVUHB9UU1ZqNAVomZmpzyzDwtbLCd+2MaIvpo5G7k=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/terminaltexteffects/default.nix b/pkgs/development/python-modules/terminaltexteffects/default.nix
index 162d0788d84c..be27e31c2960 100644
--- a/pkgs/development/python-modules/terminaltexteffects/default.nix
+++ b/pkgs/development/python-modules/terminaltexteffects/default.nix
@@ -23,13 +23,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "terminaltexteffects" ];
 
-  meta = with lib; {
+  meta = {
     description = "Collection of visual effects that can be applied to terminal piped stdin text";
     homepage = "https://chrisbuilds.github.io/terminaltexteffects";
     changelog = "https://chrisbuilds.github.io/terminaltexteffects/changeblog/";
-    license = licenses.mit;
-    platforms = with platforms; unix;
-    maintainers = with maintainers; [ eihqnh ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = [ ];
     mainProgram = "tte";
   };
 }
diff --git a/pkgs/servers/nextcloud/packages/31.json b/pkgs/servers/nextcloud/packages/31.json
index c190087f6ab3..7e09c6e53010 100644
--- a/pkgs/servers/nextcloud/packages/31.json
+++ b/pkgs/servers/nextcloud/packages/31.json
@@ -339,6 +339,16 @@
       "agpl"
     ]
   },
+  "repod": {
+    "hash": "sha256-k+Y+KMQ15AEJ5hk5GlGg3vOKKRgEql49hrLCoammwoE=",
+    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/3.8.1/repod.tar.gz",
+    "version": "3.8.1",
+    "description": "## Features\n- 🔍 Browse and subscribe huge collection of podcasts\n- 🔊 Listen to episodes directly in Nextcloud\n- 🌐 Sync your activity with [AntennaPod](https://antennapod.org/) and [other apps](https://git.crystalyx.net/Xefir/repod#clients-supporting-sync-of-gpoddersync)\n- 📱 Mobile friendly interface\n- 📡 Import and export your subscriptions\n- ➡️ Full features comparison [here](https://git.crystalyx.net/Xefir/repod#comparaison-with-similar-apps-for-nextcloud)\n\n## Requirements\nYou need to have [GPodderSync](https://apps.nextcloud.com/apps/gpoddersync) installed to use this app!",
+    "homepage": "https://git.crystalyx.net/Xefir/repod",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "richdocuments": {
     "hash": "sha256-jXYNk3adLm+Umxx/pCrKeNidq6M9ayTquJFMU3eM8Rw=",
     "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.7.5/richdocuments-v8.7.5.tar.gz",
diff --git a/pkgs/servers/nextcloud/packages/32.json b/pkgs/servers/nextcloud/packages/32.json
index 31c26047222c..f8a338b81268 100644
--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@@ -289,6 +289,16 @@
       "agpl"
     ]
   },
+  "repod": {
+    "hash": "sha256-k+Y+KMQ15AEJ5hk5GlGg3vOKKRgEql49hrLCoammwoE=",
+    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/3.8.1/repod.tar.gz",
+    "version": "3.8.1",
+    "description": "## Features\n- 🔍 Browse and subscribe huge collection of podcasts\n- 🔊 Listen to episodes directly in Nextcloud\n- 🌐 Sync your activity with [AntennaPod](https://antennapod.org/) and [other apps](https://git.crystalyx.net/Xefir/repod#clients-supporting-sync-of-gpoddersync)\n- 📱 Mobile friendly interface\n- 📡 Import and export your subscriptions\n- ➡️ Full features comparison [here](https://git.crystalyx.net/Xefir/repod#comparaison-with-similar-apps-for-nextcloud)\n\n## Requirements\nYou need to have [GPodderSync](https://apps.nextcloud.com/apps/gpoddersync) installed to use this app!",
+    "homepage": "https://git.crystalyx.net/Xefir/repod",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "richdocuments": {
     "hash": "sha256-7cLCcb18m3Of0BovTucR37zckdon6LyjiXg5OwKmWHU=",
     "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v9.0.0/richdocuments-v9.0.0.tar.gz",
diff --git a/pkgs/servers/nextcloud/packages/nextcloud-apps.json b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
index 9cc3e8c4dc58..09f5f318e4ea 100644
--- a/pkgs/servers/nextcloud/packages/nextcloud-apps.json
+++ b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
@@ -35,6 +35,7 @@
 , "quota_warning": "agpl3Plus"
 , "qownnotesapi": "agpl3Plus"
 , "registration": "agpl3Plus"
+, "repod": "agpl3Plus"
 , "richdocuments": "agpl3Only"
 , "sociallogin": "agpl3Only"
 , "spreed": "agpl3Plus"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 48b601634ca9..de1c132ba637 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1670,6 +1670,8 @@ mapAliases {
   mailcore2 = throw "'mailcore2' has been removed due to lack of upstream maintenance."; # Added 2025-06-09
   mailctl = throw "mailctl has been renamed to oama"; # Added 2024-08-19
   mailman-rss = throw "The mailman-rss package was dropped since it was unmaintained."; # Added 2024-06-21
+  mailnag = throw "mailnag has been removed because it has been marked as broken since 2022."; # Added 2025-10-12
+  mailnagWithPlugins = throw "mailnagWithPlugins has been removed because mailnag has been marked as broken since 2022."; # Added 2025-10-12
   melmatcheq.lv2 = melmatcheq-lv2; # Added 2025-09-27
   mariadb_105 = throw "'mariadb_105' has been removed because it reached its End of Life. Consider upgrading to 'mariadb_106'."; # Added 2025-04-26
   mariadb_110 = throw "mariadb_110 has been removed from nixpkgs, please switch to another version like mariadb_114"; # Added 2024-08-15
@@ -1819,6 +1821,7 @@ mapAliases {
   netbox_3_3 = throw "netbox 3.3 series has been removed as it was EOL"; # Added 2023-09-02
   netbox_3_5 = throw "netbox 3.5 series has been removed as it was EOL"; # Added 2024-01-22
   netbox_3_7 = throw "netbox 3.7 series has been removed as it was EOL"; # Added 2025-04-23
+  netbox_4_1 = throw "netbox 4.1 series has been removed as it was EOL"; # Added 2025-10-14
   netsurf = recurseIntoAttrs {
     browser = lib.warnOnInstantiate "'netsurf.browser' has been renamed to 'netsurf-browser'" netsurf-browser; # Added 2025-03-26
     buildsystem = lib.warnOnInstantiate "'netsurf.buildsystem' has been renamed to 'netsurf-buildsystem'" netsurf-buildsystem; # Added 2025-03-26
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f4431f30bf21..fd73f3382cf9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3438,15 +3438,6 @@ with pkgs;
 
   madlang = haskell.lib.compose.justStaticExecutables haskellPackages.madlang;
 
-  mailnag = callPackage ../applications/networking/mailreaders/mailnag {
-    availablePlugins = {
-      # More are listed here: https://github.com/pulb/mailnag/#desktop-integration
-      # Use the attributes here as arguments to `plugins` list
-      goa = callPackage ../applications/networking/mailreaders/mailnag/goa-plugin.nix { };
-    };
-  };
-  mailnagWithPlugins = mailnag.withPlugins (builtins.attrValues mailnag.availablePlugins);
-
   man = man-db;
 
   mangohud = callPackage ../tools/graphics/mangohud {
@@ -8611,8 +8602,6 @@ with pkgs;
   SDL = SDL_compat;
   SDL2 = sdl2-compat;
 
-  sdr-j-fm = libsForQt5.callPackage ../applications/radio/sdr-j-fm { };
-
   sigdigger = libsForQt5.callPackage ../applications/radio/sigdigger { };
 
   sev-snp-measure = with python3Packages; toPythonApplication sev-snp-measure;