diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 96dec589dadc..c38c14e763b0 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -50,7 +50,6 @@ sets are
 
 * `pkgs.python27Packages`
 * `pkgs.python3Packages`
-* `pkgs.python39Packages`
 * `pkgs.python310Packages`
 * `pkgs.python311Packages`
 * `pkgs.python312Packages`
diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index 158bb7d3775c..e2460b1128f9 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -63,6 +63,8 @@
 
 - The `ephemeral` package was removed due to upstream archival in early 2022.
 
+- The `vocal` package was removed due to upstream archival. The upstream developer suggests using `gnome-podcasts` or `kasts` instead.
+
 - [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided.
   The `name` argument will become mandatory in a future release.
 
diff --git a/nixos/doc/manual/development/option-declarations.section.md b/nixos/doc/manual/development/option-declarations.section.md
index 112c4f054f2a..efccba3da37c 100644
--- a/nixos/doc/manual/development/option-declarations.section.md
+++ b/nixos/doc/manual/development/option-declarations.section.md
@@ -158,14 +158,14 @@ lib.mkOption {
 ::: {#ex-options-declarations-util-mkPackageOption-extraDescription .example}
 ### `mkPackageOption` with additional description text
 ```nix
-mkPackageOption pkgs [ "python39Packages" "pytorch" ] {
+mkPackageOption pkgs [ "python312Packages" "torch" ] {
   extraDescription = "This is an example and doesn't actually do anything.";
 }
 # is like
 lib.mkOption {
   type = lib.types.package;
-  default = pkgs.python39Packages.pytorch;
-  defaultText = lib.literalExpression "pkgs.python39Packages.pytorch";
+  default = pkgs.python312Packages.torch;
+  defaultText = lib.literalExpression "pkgs.python312Packages.torch";
   description = "The pytorch package to use. This is an example and doesn't actually do anything.";
 }
 ```
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 08e1b85a7544..7da42084550d 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -722,7 +722,7 @@ in
       '';
 
       serviceConfig = {
-        Type = "simple";
+        Type = "notify";
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.stateDir;
diff --git a/pkgs/applications/audio/easyabc/default.nix b/pkgs/applications/audio/easyabc/default.nix
index 16026b12750d..c04a26d20483 100644
--- a/pkgs/applications/audio/easyabc/default.nix
+++ b/pkgs/applications/audio/easyabc/default.nix
@@ -1,9 +1,8 @@
 {
   lib,
   fetchFromGitHub,
-  fetchPypi,
   replaceVars,
-  python39,
+  python3,
   fluidsynth,
   soundfont-fluid,
   wrapGAppsHook3,
@@ -12,51 +11,18 @@
   ghostscript,
 }:
 
-let
-  # requires python39 due to https://stackoverflow.com/a/71902541 https://github.com/jwdj/EasyABC/issues/52
-  python = python39.override {
-    self = python;
-    packageOverrides = self: super: {
-      # currently broken with 4.2.1
-      # https://github.com/jwdj/EasyABC/issues/75
-      wxpython = super.wxpython.overrideAttrs (args: rec {
-        version = "4.2.0";
-        src = fetchPypi {
-          inherit version;
-          pname = "wxPython";
-          hash = "sha256-ZjzrxFCdfl0RNRiGX+J093+VQ0xdV7w4btWNZc7thsc=";
-        };
-      });
-    };
-  };
-in
-python.pkgs.buildPythonApplication {
+python3.pkgs.buildPythonApplication {
   pname = "easyabc";
-  version = "1.3.8.6";
+  version = "1.3.8.7-unstable-2025-01-12";
+  format = "other";
 
   src = fetchFromGitHub {
     owner = "jwdj";
     repo = "easyabc";
-    rev = "6461b2c14280cb64224fc5299c31cfeef9b7d43c";
-    hash = "sha256-leC3A4HQMeJNeZXArb3YAYr2mddGPcws618NrRh2Q1Y=";
+    rev = "2cfa74d138d485523cae9b889186add3a249f2e4";
+    hash = "sha256-96Rh7hFWITIC62vs0bUtatDDgJ27UdZYhku8uqJBJew=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook3 ];
-
-  propagatedBuildInputs = with python.pkgs; [
-    cx-freeze
-    wxpython
-    pygame
-  ];
-
-  # apparently setup.py only supports Windows and Darwin
-  # everything is very non-standard in this project
-  dontBuild = true;
-  format = "other";
-
-  # https://discourse.nixos.org/t/packaging-mcomix3-python-gtk-missing-gsettings-schemas-issue/10190/2
-  strictDeps = false;
-
   patches = [
     (replaceVars ./hardcoded-paths.patch {
       fluidsynth = "${fluidsynth}/lib/libfluidsynth.so";
@@ -65,6 +31,22 @@ python.pkgs.buildPythonApplication {
     })
   ];
 
+  nativeBuildInputs = [ wrapGAppsHook3 ];
+
+  dependencies = with python3.pkgs; [
+    cx-freeze
+    wxpython
+    pygame
+    pyparsing
+  ];
+
+  # apparently setup.py only supports Windows and Darwin
+  # everything is very non-standard in this project
+  dontBuild = true;
+
+  # https://discourse.nixos.org/t/packaging-mcomix3-python-gtk-missing-gsettings-schemas-issue/10190/2
+  strictDeps = false;
+
   installPhase = ''
     runHook preInstall
 
@@ -76,7 +58,7 @@ python.pkgs.buildPythonApplication {
     ln -s ${abcmidi}/bin/abc2abc $out/share/easyabc/bin/abc2abc
     ln -s ${abcm2ps}/bin/abcm2ps $out/share/easyabc/bin/abcm2ps
 
-    makeWrapper ${python.interpreter} $out/bin/easyabc \
+    makeWrapper ${python3.interpreter} $out/bin/easyabc \
       --set PYTHONPATH "$PYTHONPATH:$out/share/easyabc" \
       --add-flags "-O $out/share/easyabc/easy_abc.py"
 
diff --git a/pkgs/applications/networking/irc/quassel/default.nix b/pkgs/applications/networking/irc/quassel/default.nix
index 0807b51f6fca..e87c9896370a 100644
--- a/pkgs/applications/networking/irc/quassel/default.nix
+++ b/pkgs/applications/networking/irc/quassel/default.nix
@@ -124,6 +124,13 @@ in
     '';
     license = licenses.gpl3;
     maintainers = with maintainers; [ ttuegel ];
+    mainProgram =
+      if monolithic then
+        "quassel"
+      else if buildClient then
+        "quasselclient"
+      else
+        "quasselcore";
     inherit (qtbase.meta) platforms;
   };
 }
diff --git a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev-non-workspace-nested-crate/default.nix b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev-non-workspace-nested-crate/default.nix
index 5b1dcc1aef61..6dac7a801284 100644
--- a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev-non-workspace-nested-crate/default.nix
+++ b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-rev-non-workspace-nested-crate/default.nix
@@ -2,9 +2,8 @@
   rustPlatform,
   pkg-config,
   openssl,
+  zlib,
   lib,
-  darwin,
-  stdenv,
 }:
 let
   fs = lib.fileset;
@@ -26,13 +25,10 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   cargoLock = {
     lockFile = ./Cargo.lock;
diff --git a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-workspace-inheritance/want.toml b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-workspace-inheritance/want.toml
index ec1331455bec..cd1cb594a769 100644
--- a/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-workspace-inheritance/want.toml
+++ b/pkgs/build-support/rust/test/import-cargo-lock/git-dependency-workspace-inheritance/want.toml
@@ -12,8 +12,8 @@ keywords = [
 bar = "1.0.0"
 
 [dependencies.foo]
+version = "1.0.0"
 features = [
     "cat",
     "meow",
 ]
-version = "1.0.0"
diff --git a/pkgs/by-name/al/aldente/package.nix b/pkgs/by-name/al/aldente/package.nix
index afc5e4b820b6..b951c444ace3 100644
--- a/pkgs/by-name/al/aldente/package.nix
+++ b/pkgs/by-name/al/aldente/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aldente";
-  version = "1.31.3";
+  version = "1.32";
 
   src = fetchurl {
     url = "https://github.com/davidwernhart/aldente-charge-limiter/releases/download/${finalAttrs.version}/AlDente.dmg";
-    hash = "sha256-O1PGjq5W/BSnfHrmbd4FrtZ7+k+Be9l/5mmvOtlMXRo=";
+    hash = "sha256-pUFcP7J60lLeuX9v3qhCMcsRmurfw0LnoCcbRONnxKM=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/cj/cjdns/package.nix b/pkgs/by-name/cj/cjdns/package.nix
index 9b6979ba9a20..45616081a481 100644
--- a/pkgs/by-name/cj/cjdns/package.nix
+++ b/pkgs/by-name/cj/cjdns/package.nix
@@ -5,7 +5,7 @@
   rustPlatform,
   nodejs,
   which,
-  python39,
+  python3,
   libuv,
   util-linux,
   nixosTests,
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs =
     [
       which
-      python39
+      python3
       nodejs
       pkg-config
     ]
@@ -66,11 +66,11 @@ rustPlatform.buildRustPackage rec {
   passthru.tests.basic = nixosTests.cjdns;
 
   meta = with lib; {
+    broken = true; # outdated, incompatible with supported python versions
     homepage = "https://github.com/cjdelisle/cjdns";
     description = "Encrypted networking for regular people";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ehmry ];
     platforms = platforms.linux;
-    broken = stdenv.hostPlatform.isAarch64;
   };
 }
diff --git a/pkgs/by-name/co/cosmic-ext-ctl/package.nix b/pkgs/by-name/co/cosmic-ext-ctl/package.nix
index 9812b7f88eff..dfc2d23e4987 100644
--- a/pkgs/by-name/co/cosmic-ext-ctl/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-ctl/package.nix
@@ -6,22 +6,19 @@
   nix-update-script,
   cosmic-comp,
 }:
-let
-  version = "1.1.0";
-in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-ext-ctl";
-  inherit version;
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ctl";
-    tag = "v${version}";
-    hash = "sha256-dcUzrJcwJpzbYPuqdHgm43NYbaowsFmFP4sS0cfzNAg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4UbmzBKxJwpyzucPRguQV1078961goiQlhtDjOGz1kA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-EReo2hkBaIO1YOBx4D9rQSXlx+3NK5VQtj59jfZZI/0=";
+  cargoHash = "sha256-53lpHzHQ6SoZzd+h6O0NvSJHsPgbW0/kqnDrM5D6SWQ=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -31,11 +28,11 @@ rustPlatform.buildRustPackage {
 
   meta = {
     description = "CLI for COSMIC Desktop configuration management";
-    changelog = "https://github.com/cosmic-utils/cosmic-ctl/releases/tag/v${version}";
+    changelog = "https://github.com/cosmic-utils/cosmic-ctl/releases/tag/v${finalAttrs.version}";
     homepage = "https://github.com/cosmic-utils/cosmic-ctl";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ HeitorAugustoLN ];
     mainProgram = "cosmic-ctl";
     inherit (cosmic-comp.meta) platforms;
   };
-}
+})
diff --git a/pkgs/by-name/dx/dxvk_2/package.nix b/pkgs/by-name/dx/dxvk_2/package.nix
index 7490ff83e73b..240b73c34fe3 100644
--- a/pkgs/by-name/dx/dxvk_2/package.nix
+++ b/pkgs/by-name/dx/dxvk_2/package.nix
@@ -37,13 +37,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dxvk";
-  version = "2.6";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "doitsujin";
     repo = "dxvk";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1/9XFqVGW5izlP3rggfB+PK3ewFiOQoGcB/Vjn9MYOQ=";
+    hash = "sha256-edu9JQAKu8yUZLh+37RB1s1A3+s8xeUYQ5Oibdes9ZI=";
     fetchSubmodules = true; # Needed for the DirectX headers and libdisplay-info
   };
 
diff --git a/pkgs/by-name/ex/exabgp/package.nix b/pkgs/by-name/ex/exabgp/package.nix
index a604c08427c2..2bd1a8c59fff 100644
--- a/pkgs/by-name/ex/exabgp/package.nix
+++ b/pkgs/by-name/ex/exabgp/package.nix
@@ -41,6 +41,7 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/Exa-Networks/exabgp";
     changelog = "https://github.com/Exa-Networks/exabgp/blob/${src.tag}/CHANGELOG.rst";
     license = licenses.bsd3;
+    mainProgram = "exabgp";
     maintainers = with maintainers; [
       hexa
       raitobezarius
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index fc8f061b46de..be90390c771d 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2025-04-10";
+  version = "2025-04-11";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-vbcFCeQv1ZQX/SI6LAr04L2ncaE8fcI7TATfwCRNcQA=";
+    hash = "sha256-sR1VHGFsnLmzO7umcJn88jFWU57LlanPuDu708pSBW0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-10/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-10/package.nix
deleted file mode 100644
index 7c7ff8a24b47..000000000000
--- a/pkgs/by-name/gc/gcc-arm-embedded-10/package.nix
+++ /dev/null
@@ -1,79 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  ncurses5,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gcc-arm-embedded";
-  version = "10.3.1";
-  release = "10.3-2021.10";
-
-  suffix =
-    {
-      aarch64-linux = "aarch64-linux";
-      x86_64-darwin = "mac";
-      x86_64-linux = "x86_64-linux";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://developer.arm.com/-/media/Files/downloads/gnu-rm/${release}/gcc-arm-none-eabi-${release}-${suffix}.tar.bz2";
-    sha256 =
-      {
-        aarch64-linux = "020j8gkzc0i0b74vz98gvngnwjm5222j1gk5nswfk6587krba1gn";
-        x86_64-darwin = "0fr8pki2g4bfk1rk90dzwql37d0b71ngzs9zyx0g2jainan3sqgv";
-        x86_64-linux = "18y92vpl22hf74yqdvmpw8adrkl92s4crzzs6avm05md37qb9nwp";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  dontStrip = true;
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r * $out
-    ln -s $out/share/doc/gcc-arm-none-eabi/man $out/man
-  '';
-
-  preFixup = ''
-    find $out -type f | while read f; do
-      patchelf "$f" > /dev/null 2>&1 || continue
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${
-        lib.makeLibraryPath [
-          "$out"
-          stdenv.cc.cc
-          ncurses5
-        ]
-      } "$f" || true
-    done
-  '';
-
-  meta = with lib; {
-    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
-    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
-    license = with licenses; [
-      bsd2
-      gpl2
-      gpl3
-      lgpl21
-      lgpl3
-      mit
-    ];
-    maintainers = with maintainers; [
-      prusnak
-      prtzl
-    ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-      "x86_64-darwin"
-    ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-11/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-11/package.nix
deleted file mode 100644
index 8cbc326a3f48..000000000000
--- a/pkgs/by-name/gc/gcc-arm-embedded-11/package.nix
+++ /dev/null
@@ -1,90 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  ncurses5,
-  python39,
-  libxcrypt-legacy,
-  runtimeShell,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gcc-arm-embedded";
-  version = "11.3.rel1";
-
-  platform =
-    {
-      aarch64-linux = "aarch64";
-      x86_64-darwin = "darwin-x86_64";
-      x86_64-linux = "x86_64";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://developer.arm.com/-/media/Files/downloads/gnu/${version}/binrel/arm-gnu-toolchain-${version}-${platform}-arm-none-eabi.tar.xz";
-    sha256 =
-      {
-        aarch64-linux = "0pmm5r0k5mxd5drbn2s8a7qkm8c4fi8j5y31c70yrp0qs08kqwbc";
-        x86_64-darwin = "1kr9kd9p2xk84fa99zf3gz5lkww2i9spqkjigjwakfkzbva56qw2";
-        x86_64-linux = "08b1w1zmj4z80k59zmlc1bf34lg8d7z65fwvp5ir2pb1d1zxh86l";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  dontStrip = true;
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r * $out
-  '';
-
-  preFixup = ''
-    find $out -type f | while read f; do
-      patchelf "$f" > /dev/null 2>&1 || continue
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${
-        lib.makeLibraryPath [
-          "$out"
-          stdenv.cc.cc
-          ncurses5
-          python39
-          libxcrypt-legacy
-        ]
-      } "$f" || true
-    done
-  '';
-
-  postFixup = ''
-    mv $out/bin/arm-none-eabi-gdb $out/bin/arm-none-eabi-gdb-unwrapped
-    cat <<EOF > $out/bin/arm-none-eabi-gdb
-    #!${runtimeShell}
-    export PYTHONPATH=${python39}/lib/python3.9
-    export PYTHONHOME=${python39.interpreter}
-    exec $out/bin/arm-none-eabi-gdb-unwrapped "\$@"
-    EOF
-    chmod +x $out/bin/arm-none-eabi-gdb
-  '';
-
-  meta = with lib; {
-    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
-    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
-    license = with licenses; [
-      bsd2
-      gpl2
-      gpl3
-      lgpl21
-      lgpl3
-      mit
-    ];
-    maintainers = with maintainers; [ prusnak ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-      "x86_64-darwin"
-    ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-13/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-13/package.nix
index 6eac3bc060ca..2fc5c091f53d 100644
--- a/pkgs/by-name/gc/gcc-arm-embedded-13/package.nix
+++ b/pkgs/by-name/gc/gcc-arm-embedded-13/package.nix
@@ -3,9 +3,7 @@
   stdenv,
   fetchurl,
   ncurses5,
-  python39,
   libxcrypt-legacy,
-  runtimeShell,
 }:
 
 stdenv.mkDerivation rec {
@@ -42,9 +40,11 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out
     cp -r * $out
+    # these binaries require ancient Python 3.8 not available in Nixpkgs
+    rm $out/bin/{arm-none-eabi-gdb-py,arm-none-eabi-gdb-add-index-py} || :
   '';
 
-  preFixup = ''
+  preFixup = lib.optionalString stdenv.isLinux ''
     find $out -type f | while read f; do
       patchelf "$f" > /dev/null 2>&1 || continue
       patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
@@ -53,24 +53,12 @@ stdenv.mkDerivation rec {
           "$out"
           stdenv.cc.cc
           ncurses5
-          python39
           libxcrypt-legacy
         ]
       } "$f" || true
     done
   '';
 
-  postFixup = ''
-    mv $out/bin/arm-none-eabi-gdb $out/bin/arm-none-eabi-gdb-unwrapped
-    cat <<EOF > $out/bin/arm-none-eabi-gdb
-    #!${runtimeShell}
-    export PYTHONPATH=${python39}/lib/python3.9
-    export PYTHONHOME=${python39.interpreter}
-    exec $out/bin/arm-none-eabi-gdb-unwrapped "\$@"
-    EOF
-    chmod +x $out/bin/arm-none-eabi-gdb
-  '';
-
   meta = with lib; {
     description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
     homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-12/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-14/package.nix
similarity index 68%
rename from pkgs/by-name/gc/gcc-arm-embedded-12/package.nix
rename to pkgs/by-name/gc/gcc-arm-embedded-14/package.nix
index 97a122f3034e..b18edddb55d4 100644
--- a/pkgs/by-name/gc/gcc-arm-embedded-12/package.nix
+++ b/pkgs/by-name/gc/gcc-arm-embedded-14/package.nix
@@ -2,15 +2,15 @@
   lib,
   stdenv,
   fetchurl,
-  ncurses5,
-  python39,
+  ncurses6,
   libxcrypt-legacy,
-  runtimeShell,
+  xz,
+  zstd,
 }:
 
 stdenv.mkDerivation rec {
   pname = "gcc-arm-embedded";
-  version = "12.3.rel1";
+  version = "14.2.rel1";
 
   platform =
     {
@@ -23,12 +23,13 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://developer.arm.com/-/media/Files/downloads/gnu/${version}/binrel/arm-gnu-toolchain-${version}-${platform}-arm-none-eabi.tar.xz";
+    # hashes obtained from location ${url}.sha256asc
     sha256 =
       {
-        aarch64-darwin = "sha256-Oy7uC99xwbvrPDt0JPv3vZ1cPw9aOkp4FZyeOtIZ570=";
-        aarch64-linux = "sha256-FMBIfVdT9gcdJOVoiB98fmf4DdgxZd7FFks3MTlK9DE=";
-        x86_64-darwin = "sha256-5u2L+TD62c4z4SCrkLNpV7H3efzKpt5snKmliYLAQpE=";
-        x86_64-linux = "sha256-EqKBVkQxjrzOr4S+q7Zl0JJLbnniEEhFLFMxpWMyswk=";
+        aarch64-darwin = "c7c78ffab9bebfce91d99d3c24da6bf4b81c01e16cf551eb2ff9f25b9e0a3818";
+        aarch64-linux = "87330bab085dd8749d4ed0ad633674b9dc48b237b61069e3b481abd364d0a684";
+        x86_64-darwin = "2d9e717dd4f7751d18936ae1365d25916534105ebcb7583039eff1092b824505";
+        x86_64-linux = "62a63b981fe391a9cbad7ef51b17e49aeaa3e7b0d029b36ca1e9c3b2a9b78823";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
@@ -41,9 +42,11 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out
     cp -r * $out
+    # these binaries require ancient Python 3.8 not available in Nixpkgs
+    rm $out/bin/{arm-none-eabi-gdb-py,arm-none-eabi-gdb-add-index-py} || :
   '';
 
-  preFixup = ''
+  preFixup = lib.optionalString stdenv.isLinux ''
     find $out -type f | while read f; do
       patchelf "$f" > /dev/null 2>&1 || continue
       patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
@@ -51,25 +54,15 @@ stdenv.mkDerivation rec {
         lib.makeLibraryPath [
           "$out"
           stdenv.cc.cc
-          ncurses5
-          python39
+          ncurses6
           libxcrypt-legacy
+          xz
+          zstd
         ]
       } "$f" || true
     done
   '';
 
-  postFixup = ''
-    mv $out/bin/arm-none-eabi-gdb $out/bin/arm-none-eabi-gdb-unwrapped
-    cat <<EOF > $out/bin/arm-none-eabi-gdb
-    #!${runtimeShell}
-    export PYTHONPATH=${python39}/lib/python3.9
-    export PYTHONHOME=${python39.interpreter}
-    exec $out/bin/arm-none-eabi-gdb-unwrapped "\$@"
-    EOF
-    chmod +x $out/bin/arm-none-eabi-gdb
-  '';
-
   meta = with lib; {
     description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
     homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-6/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-6/package.nix
deleted file mode 100644
index 70e1481e2dd4..000000000000
--- a/pkgs/by-name/gc/gcc-arm-embedded-6/package.nix
+++ /dev/null
@@ -1,74 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  ncurses5,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gcc-arm-embedded";
-  version = "6.3.1";
-  release = "6-2017-q2-update";
-  subdir = "6-2017q2";
-
-  suffix =
-    {
-      x86_64-darwin = "mac";
-      x86_64-linux = "linux";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://developer.arm.com/-/media/Files/downloads/gnu-rm/${subdir}/gcc-arm-none-eabi-${release}-${suffix}.tar.bz2";
-    sha256 =
-      {
-        x86_64-darwin = "0019ylpq4inq7p5gydpmc9m8ni72fz2csrjlqmgx1698998q0c3x";
-        x86_64-linux = "1hvwi02mx34al525sngnl0cm7dkmzxfkb1brq9kvbv28wcplp3p6";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  dontStrip = true;
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r * $out
-    ln -s $out/share/doc/gcc-arm-none-eabi/man $out/man
-  '';
-
-  preFixup = ''
-    find $out -type f | while read f; do
-      patchelf "$f" > /dev/null 2>&1 || continue
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${
-        lib.makeLibraryPath [
-          "$out"
-          stdenv.cc.cc
-          ncurses5
-        ]
-      } "$f" || true
-    done
-  '';
-
-  meta = with lib; {
-    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
-    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
-    license = with licenses; [
-      bsd2
-      gpl2
-      gpl3
-      lgpl21
-      lgpl3
-      mit
-    ];
-    maintainers = with maintainers; [ prusnak ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-7/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-7/package.nix
deleted file mode 100644
index 10fdd294649c..000000000000
--- a/pkgs/by-name/gc/gcc-arm-embedded-7/package.nix
+++ /dev/null
@@ -1,74 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  ncurses5,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gcc-arm-embedded";
-  version = "7.3.1";
-  release = "7-2018-q2-update";
-  subdir = "7-2018q2";
-
-  suffix =
-    {
-      x86_64-darwin = "mac";
-      x86_64-linux = "linux";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://developer.arm.com/-/media/Files/downloads/gnu-rm/${subdir}/gcc-arm-none-eabi-${release}-${suffix}.tar.bz2";
-    sha256 =
-      {
-        x86_64-darwin = "0nc7m0mpa39qyhfyydxkkyqm7spfc27xf6ygi2vd2aym4r9azi61";
-        x86_64-linux = "0sgysp3hfpgrkcbfiwkp0a7ymqs02khfbrjabm52b5z61sgi05xv";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  dontStrip = true;
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r * $out
-    ln -s $out/share/doc/gcc-arm-none-eabi/man $out/man
-  '';
-
-  preFixup = ''
-    find $out -type f | while read f; do
-      patchelf "$f" > /dev/null 2>&1 || continue
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${
-        lib.makeLibraryPath [
-          "$out"
-          stdenv.cc.cc
-          ncurses5
-        ]
-      } "$f" || true
-    done
-  '';
-
-  meta = with lib; {
-    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
-    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
-    license = with licenses; [
-      bsd2
-      gpl2
-      gpl3
-      lgpl21
-      lgpl3
-      mit
-    ];
-    maintainers = with maintainers; [ prusnak ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-8/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-8/package.nix
deleted file mode 100644
index ff63cb58bd99..000000000000
--- a/pkgs/by-name/gc/gcc-arm-embedded-8/package.nix
+++ /dev/null
@@ -1,74 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  ncurses5,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gcc-arm-embedded";
-  version = "8.3.1";
-  release = "8-2019-q3-update";
-  subdir = "8-2019q3/RC1.1";
-
-  suffix =
-    {
-      x86_64-darwin = "mac";
-      x86_64-linux = "linux";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://developer.arm.com/-/media/Files/downloads/gnu-rm/${subdir}/gcc-arm-none-eabi-${release}-${suffix}.tar.bz2";
-    sha256 =
-      {
-        x86_64-darwin = "fc235ce853bf3bceba46eff4b95764c5935ca07fc4998762ef5e5b7d05f37085";
-        x86_64-linux = "b50b02b0a16e5aad8620e9d7c31110ef285c1dde28980b1a9448b764d77d8f92";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  dontStrip = true;
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r * $out
-    ln -s $out/share/doc/gcc-arm-none-eabi/man $out/man
-  '';
-
-  preFixup = ''
-    find $out -type f | while read f; do
-      patchelf "$f" > /dev/null 2>&1 || continue
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${
-        lib.makeLibraryPath [
-          "$out"
-          stdenv.cc.cc
-          ncurses5
-        ]
-      } "$f" || true
-    done
-  '';
-
-  meta = with lib; {
-    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
-    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
-    license = with licenses; [
-      bsd2
-      gpl2
-      gpl3
-      lgpl21
-      lgpl3
-      mit
-    ];
-    maintainers = with maintainers; [ prusnak ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-9/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-9/package.nix
deleted file mode 100644
index 3dda27e3b853..000000000000
--- a/pkgs/by-name/gc/gcc-arm-embedded-9/package.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  ncurses5,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gcc-arm-embedded";
-  version = "9.3.1";
-  release = "9-2020-q2-update";
-  subdir = "9-2020q2";
-
-  suffix =
-    {
-      aarch64-linux = "aarch64-linux";
-      x86_64-darwin = "mac";
-      x86_64-linux = "x86_64-linux";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://developer.arm.com/-/media/Files/downloads/gnu-rm/${subdir}/gcc-arm-none-eabi-${release}-${suffix}.tar.bz2";
-    sha256 =
-      {
-        aarch64-linux = "1b5q2y710hy7lddj8vj3zl54gfl74j30kx3hk3i81zrcbv16ah8z";
-        x86_64-darwin = "1ils9z16wrvglh72m428y5irmd36biq79yj86756whib8izbifdv";
-        x86_64-linux = "07zi2yr5gvhpbij5pnj49zswb9g2gw7zqp4xwwniqmq477h2xp2s";
-      }
-      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontPatchELF = true;
-  dontStrip = true;
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r * $out
-    ln -s $out/share/doc/gcc-arm-none-eabi/man $out/man
-  '';
-
-  preFixup = ''
-    find $out -type f | while read f; do
-      patchelf "$f" > /dev/null 2>&1 || continue
-      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-      patchelf --set-rpath ${
-        lib.makeLibraryPath [
-          "$out"
-          stdenv.cc.cc
-          ncurses5
-        ]
-      } "$f" || true
-    done
-  '';
-
-  meta = with lib; {
-    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
-    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
-    license = with licenses; [
-      bsd2
-      gpl2
-      gpl3
-      lgpl21
-      lgpl3
-      mit
-    ];
-    maintainers = with maintainers; [ prusnak ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-      "x86_64-darwin"
-    ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-  };
-}
diff --git a/pkgs/by-name/hu/hubble/package.nix b/pkgs/by-name/hu/hubble/package.nix
index 9bf6a0bfc5af..6bf3874fd9ff 100644
--- a/pkgs/by-name/hu/hubble/package.nix
+++ b/pkgs/by-name/hu/hubble/package.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   buildGo124Module,
   fetchFromGitHub,
@@ -19,7 +20,6 @@ buildGo124Module rec {
 
   nativeBuildInputs = [
     installShellFiles
-    versionCheckHook
   ];
 
   vendorHash = null;
@@ -32,27 +32,25 @@ buildGo124Module rec {
     "-X=github.com/cilium/cilium/hubble/pkg.Version=${version}"
   ];
 
-  # Test fails at Test_getFlowsRequestWithInvalidRawFilters in github.com/cilium/hubble/cmd/observe
-  # https://github.com/NixOS/nixpkgs/issues/178976
-  # https://github.com/cilium/hubble/pull/656
-  # https://github.com/cilium/hubble/pull/655
-  doCheck = false;
+  doCheck = true;
 
   doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd hubble \
       --bash <($out/bin/hubble completion bash) \
       --fish <($out/bin/hubble completion fish) \
       --zsh <($out/bin/hubble completion zsh)
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Network, Service & Security Observability for Kubernetes using eBPF";
     homepage = "https://github.com/cilium/hubble/";
-    changelog = "https://github.com/cilium/hubble/releases/tag/${src.tag}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    changelog = "https://github.com/cilium/hubble/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       humancalico
       bryanasdev000
       FKouhai
diff --git a/pkgs/by-name/hy/hyprlang/package.nix b/pkgs/by-name/hy/hyprlang/package.nix
index d4dbe9584dd8..6ebe958762ca 100644
--- a/pkgs/by-name/hy/hyprlang/package.nix
+++ b/pkgs/by-name/hy/hyprlang/package.nix
@@ -9,13 +9,13 @@
 
 gcc14Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlang";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlang";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-oj8V4kvzor5AOStzj4/B4W1ZIObAPxT9K4NfXx7dyKE=";
+    hash = "sha256-9HySx+EtsbbKlZDlY+naqqOV679VdxP6x6fP3wxDXJk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/le/letsdns/package.nix b/pkgs/by-name/le/letsdns/package.nix
new file mode 100644
index 000000000000..0c49b01d1150
--- /dev/null
+++ b/pkgs/by-name/le/letsdns/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+let
+  version = "1.2.1";
+in
+python3Packages.buildPythonApplication {
+  pname = "letsdns";
+  inherit version;
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "LetsDNS";
+    repo = "letsdns";
+    tag = version;
+    hash = "sha256-TwGVm7sEOPvUqtvaAuIU/X5W3H4VAC8dskNunt8UO0I=";
+  };
+
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+    versionCheckHook
+  ];
+
+  dependencies = with python3Packages; [
+    cryptography
+    dnspython
+    requests
+  ];
+
+  disabledTestPaths = [
+    # These tests require upstream certificates
+    "tests/test_action.py"
+  ];
+
+  env = {
+    UNITTEST_CONF = "tests/citest.conf";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Manage DANE TLSA records in DNS servers";
+    homepage = "https://www.letsdns.de/";
+    downloadPage = "https://github.com/LetsDNS/letsdns";
+    changelog = "https://github.com/LetsDNS/letsdns/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ rseichter ];
+    mainProgram = "letsdns";
+  };
+}
diff --git a/pkgs/by-name/ma/magic-vlsi/package.nix b/pkgs/by-name/ma/magic-vlsi/package.nix
index 6f82114d2cb5..41d3debe3e95 100644
--- a/pkgs/by-name/ma/magic-vlsi/package.nix
+++ b/pkgs/by-name/ma/magic-vlsi/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "magic-vlsi";
-  version = "8.3.524";
+  version = "8.3.526";
 
   src = fetchurl {
     url = "http://opencircuitdesign.com/magic/archive/magic-${version}.tgz";
-    sha256 = "sha256-PmnxTICQlcrdA+Xd0VP9pC66hsOBhxxKRlQUk1NFHcI=";
+    sha256 = "sha256-u6Z/Nfrlzn6JFDbPLPrpaZoR/nUGtE1H1roM6khme1Q=";
   };
 
   nativeBuildInputs = [ python3 ];
diff --git a/pkgs/by-name/ni/nitrokey-start-firmware/package.nix b/pkgs/by-name/ni/nitrokey-start-firmware/package.nix
index 8bad7ed5fbc2..4169ccf702c0 100644
--- a/pkgs/by-name/ni/nitrokey-start-firmware/package.nix
+++ b/pkgs/by-name/ni/nitrokey-start-firmware/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  gcc-arm-embedded,
+  gcc-arm-embedded-13,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-certdo"
   ];
 
-  nativeBuildInputs = [ gcc-arm-embedded ];
+  nativeBuildInputs = [ gcc-arm-embedded-13 ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/pr/prowler/package.nix b/pkgs/by-name/pr/prowler/package.nix
index 44f4c275b330..487d388bbc9f 100644
--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@@ -21,14 +21,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "prowler";
-  version = "5.4.3";
+  version = "5.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "prowler-cloud";
     repo = "prowler";
     tag = version;
-    hash = "sha256-Rg1r1G1INmDK5bN4NIrs51CTnxNiwOOSoTFC3AlEUoI=";
+    hash = "sha256-OuPhP4PMBqs3dAwY/Ln0Z4hwO3lPaJm4eYcl7AHy9vM=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/qd/qdl/package.nix b/pkgs/by-name/qd/qdl/package.nix
index 991385f72052..068fee74de2d 100644
--- a/pkgs/by-name/qd/qdl/package.nix
+++ b/pkgs/by-name/qd/qdl/package.nix
@@ -9,7 +9,7 @@
   unstableGitUpdater,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qdl";
   version = "0-unstable-2025-03-19";
 
@@ -20,18 +20,20 @@ stdenv.mkDerivation {
     hash = "sha256-5ZV39whIm8qJIBLNdAsR2e8+f0jYjwE9dGNgh6ARPUY=";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile --replace-fail 'pkg-config' '${stdenv.cc.targetPrefix}pkg-config'
+  '';
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    systemd
     libxml2
     libusb1
   ];
 
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 ./qdl -t $out/bin
-    runHook postInstall
-  '';
+  makeFlags = [
+    "VERSION=${finalAttrs.src.rev}"
+    "prefix=${placeholder "out"}"
+  ];
 
   meta = {
     homepage = "https://github.com/linux-msm/qdl";
@@ -46,4 +48,4 @@ stdenv.mkDerivation {
   };
 
   passthru.updateScript = unstableGitUpdater { };
-}
+})
diff --git a/pkgs/by-name/so/sourcepawn-studio/package.nix b/pkgs/by-name/so/sourcepawn-studio/package.nix
new file mode 100644
index 000000000000..b6208dca0514
--- /dev/null
+++ b/pkgs/by-name/so/sourcepawn-studio/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "sourcepawn-studio";
+  version = "8.1.2";
+
+  src = fetchFromGitHub {
+    owner = "Sarrus1";
+    repo = "sourcepawn-studio";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-L/xgzWbhfRTvoRElKApb9JKXNfqJF+nfDk9Xo/qwL00=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-5Zd3Stoi8AqsZE38pnilmjuRMgTPAGB+R8QI2JFZ7s4=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  checkFlags = [
+    # requires rustup and rustfmt
+    "--skip tests::sourcegen::generate_node_kinds"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "sourcepawn-studio";
+    description = "LSP implementation for the SourcePawn programming language written in Rust";
+    homepage = "https://sarrus1.github.io/sourcepawn-studio/";
+    changelog = "https://github.com/Sarrus1/sourcepawn-studio/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.awwpotato ];
+  };
+})
diff --git a/pkgs/by-name/vo/vocal/package.nix b/pkgs/by-name/vo/vocal/package.nix
deleted file mode 100644
index dd43e0263909..000000000000
--- a/pkgs/by-name/vo/vocal/package.nix
+++ /dev/null
@@ -1,98 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  nix-update-script,
-  cmake,
-  ninja,
-  vala,
-  pkg-config,
-  pantheon,
-  gtk3,
-  glib,
-  glib-networking,
-  libxml2,
-  webkitgtk_4_0,
-  clutter-gtk,
-  clutter-gst,
-  libunity,
-  libnotify,
-  sqlite,
-  gst_all_1,
-  json-glib,
-  libgee,
-  wrapGAppsHook3,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "vocal";
-  version = "2.4.2";
-
-  src = fetchFromGitHub {
-    owner = "needle-and-thread";
-    repo = pname;
-    rev = version;
-    sha256 = "1c4n89rdl9r13kmmh2qymmy9sa6shjwai7df48k2kfn0pnzq5mad";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    libxml2
-    ninja
-    vala
-    pkg-config
-    wrapGAppsHook3
-  ];
-
-  buildInputs = with gst_all_1; [
-    clutter-gst
-    clutter-gtk
-    glib
-    gst-plugins-base
-    gst-plugins-good
-    gstreamer
-    gtk3
-    json-glib
-    libgee
-    libnotify
-    libunity
-    pantheon.granite
-    sqlite
-    webkitgtk_4_0
-    glib-networking
-  ];
-
-  patches = [
-    # granite 6.0.0 removed about dialogs
-    # see: https://github.com/needle-and-thread/vocal/issues/483
-    (fetchpatch {
-      name = "remove-about.patch";
-      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/03543ffdb6cd52ce1a8293f3303225b3afac2431/trunk/remove-about.patch";
-      sha256 = "sha256-yGD7BYOTmqs4h+Odh/mB3fI1HM7GDO6F+QaHpRUD5p4=";
-    })
-  ];
-
-  postPatch = ''
-    # Fix build with vala 0.56
-    # https://github.com/needle-and-thread/vocal/pull/503
-    substituteInPlace src/Vocal.vala \
-      --replace "public const OptionEntry[] app_options" "private const OptionEntry[] app_options"
-  '';
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
-  meta = with lib; {
-    description = "Podcast client for the modern free desktop";
-    longDescription = ''
-      Vocal is a powerful, fast, and intuitive application that helps users find new podcasts, manage their libraries, and enjoy the best that independent audio and video publishing has to offer. Vocal features full support for both episode downloading and streaming, native system integration, iTunes store search and top 100 charts (with international results support), iTunes link parsing, OPML importing and exporting, and so much more. Plus, it has great smart features like automatically keeping your library clean from old files, and the ability to set custom skip intervals.
-    '';
-    homepage = "https://github.com/needle-and-thread/vocal";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ] ++ teams.pantheon.members;
-    platforms = platforms.linux;
-    mainProgram = "com.github.needleandthread.vocal";
-  };
-}
diff --git a/pkgs/by-name/wl/wlx-overlay-s/package.nix b/pkgs/by-name/wl/wlx-overlay-s/package.nix
index 5010e6bce075..f34c70f0d683 100644
--- a/pkgs/by-name/wl/wlx-overlay-s/package.nix
+++ b/pkgs/by-name/wl/wlx-overlay-s/package.nix
@@ -26,17 +26,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wlx-overlay-s";
-  version = "25.3.0";
+  version = "25.4.2";
 
   src = fetchFromGitHub {
     owner = "galister";
     repo = "wlx-overlay-s";
     rev = "v${version}";
-    hash = "sha256-m2YVXF9bEjovZOWa+X1CYHAUaAsUI4dBMG2ni3jP9L4=";
+    hash = "sha256-lWUfhiHRxu72p9ZG2f2fZH6WZECm/fOKcK05MLZV+MI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-y4pWUQFPR0jOTdukQZe4d1v0DFDfQtAg0Bi4V4ue5+Y=";
+  cargoHash = "sha256-em5sWSty2/pZp2jTwBnLUIBgPOcoMpwELwj984XYf+k=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
index 2274dd104681..ad5d3b4dfca3 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -10,6 +10,7 @@
   libgbm,
   pipewire,
   gst_all_1,
+  cosmic-wallpapers,
   coreutils,
   nix-update-script,
   nixosTests,
@@ -59,8 +60,22 @@ rustPlatform.buildRustPackage (finalAttrs: {
     })
   ];
 
-  # Also modifies the functionality by replacing 'false' with 'true' to enable the portal to start properly.
   postPatch = ''
+    # While the `kate-hazen-COSMIC-desktop-wallpaper.png` image is present
+    # in the `pop-wallpapers` package, we're using the Orion Nebula image
+    # from NASA available in the `cosmic-wallpapers` package. Mainly because
+    # the previous image was used in the GNOME shell extension and the
+    # Orion Nebula image is widely used in the Rust-based COSMIC DE's
+    # marketing materials. Another reason to use the Orion Nebula image
+    # is that it's actually the default wallpaper as configured by the
+    # `cosmic-bg` package's configuration in upstream [1] [2].
+    #
+    # [1]: https://github.com/pop-os/cosmic-bg/blob/epoch-1.0.0-alpha.6/config/src/lib.rs#L142
+    # [2]: https://github.com/pop-os/cosmic-bg/blob/epoch-1.0.0-alpha.6/data/v1/all#L3
+    substituteInPlace src/screenshot.rs src/widget/screenshot.rs \
+      --replace-fail '/usr/share/backgrounds/pop/kate-hazen-COSMIC-desktop-wallpaper.png' '${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg'
+
+    # Also modifies the functionality by replacing 'false' with 'true' to enable the portal to start properly.
     substituteInPlace data/org.freedesktop.impl.portal.desktop.cosmic.service \
       --replace-fail 'Exec=/bin/false' 'Exec=${lib.getExe' coreutils "true"}'
   '';
diff --git a/pkgs/by-name/ya/yazi/plugins/duckdb/default.nix b/pkgs/by-name/ya/yazi/plugins/duckdb/default.nix
index 80432ea97b14..92a797a83ba4 100644
--- a/pkgs/by-name/ya/yazi/plugins/duckdb/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/duckdb/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Yazi plugin that uses duckdb to preview data files.";
+    description = "Yazi plugin that uses duckdb to preview data files";
     homepage = "https://github.com/wylie102/duckdb.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/glow/default.nix b/pkgs/by-name/ya/yazi/plugins/glow/default.nix
index b37e7481151c..aa28f4825e36 100644
--- a/pkgs/by-name/ya/yazi/plugins/glow/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/glow/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Glow preview plugin for yazi.";
+    description = "Glow preview plugin for yazi";
     homepage = "https://github.com/Reledia/glow.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/lazygit/default.nix b/pkgs/by-name/ya/yazi/plugins/lazygit/default.nix
index c837eebcfdc3..69dab6a2bab7 100644
--- a/pkgs/by-name/ya/yazi/plugins/lazygit/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/lazygit/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Lazygit plugin for yazi.";
+    description = "Lazygit plugin for yazi";
     homepage = "https://github.com/Lil-Dank/lazygit.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
index a1612b59e64a..7cd544dfc927 100644
--- a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Yazi plugin for previewing media files.";
+    description = "Yazi plugin for previewing media files";
     homepage = "https://github.com/boydaihungst/mediainfo.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/miller/default.nix b/pkgs/by-name/ya/yazi/plugins/miller/default.nix
index abc48218c54f..9f2ff752c3df 100644
--- a/pkgs/by-name/ya/yazi/plugins/miller/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/miller/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Miller, now in yazi.";
+    description = "Miller, now in yazi";
     homepage = "https://github.com/Reledia/miller.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
index ea9f3bc51893..aec407f88dad 100644
--- a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
@@ -5,17 +5,17 @@
 }:
 mkYaziPlugin {
   pname = "ouch.yazi";
-  version = "0-unstable-2025-04-09";
+  version = "0-unstable-2025-04-12";
 
   src = fetchFromGitHub {
     owner = "ndtoan96";
     repo = "ouch.yazi";
-    rev = "73b7842bbccb12f15e1af54b8b06fc88f5efe82d";
-    hash = "sha256-pdnQB9NSqCndqbeJLeSg2og2vBDg5zKx8EKWKVixqTM=";
+    rev = "2496cd9ac2d1fb52597b22ae84f3af06c826a86d";
+    hash = "sha256-OsNfR7rtnq+ceBTiFjbz+NFMSV/6cQ1THxEFzI4oPJk=";
   };
 
   meta = {
-    description = "A Yazi plugin to preview archives.";
+    description = "Yazi plugin to preview archives";
     homepage = "https://github.com/ndtoan96/ouch.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/projects/default.nix b/pkgs/by-name/ya/yazi/plugins/projects/default.nix
index 5657853d0002..cf8c7d54b35a 100644
--- a/pkgs/by-name/ya/yazi/plugins/projects/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/projects/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "A yazi plugin that adds the functionality to save and load projects.";
+    description = "Yazi plugin that adds the functionality to save and load projects";
     homepage = "https://github.com/MasouShizuka/projects.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/relative-motions/default.nix b/pkgs/by-name/ya/yazi/plugins/relative-motions/default.nix
index 1ea04f712255..f215b9c0b7f3 100644
--- a/pkgs/by-name/ya/yazi/plugins/relative-motions/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/relative-motions/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Yazi plugin based about vim motions.";
+    description = "Yazi plugin based about vim motions";
     homepage = "https://github.com/dedukun/relative-motions.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/restore/default.nix b/pkgs/by-name/ya/yazi/plugins/restore/default.nix
index ec1a45c27a9f..b2734f0f09c9 100644
--- a/pkgs/by-name/ya/yazi/plugins/restore/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/restore/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Undo/Recover trashed files/folders.";
+    description = "Undo/Recover trashed files/folders";
     homepage = "https://github.com/boydaihungst/restore.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/rich-preview/default.nix b/pkgs/by-name/ya/yazi/plugins/rich-preview/default.nix
index 2ed0f2425f31..ae6e5e8be0f0 100644
--- a/pkgs/by-name/ya/yazi/plugins/rich-preview/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/rich-preview/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Preview file types using rich in Yazi.";
+    description = "Preview file types using rich in Yazi";
     homepage = "https://github.com/AnirudhG07/rich-preview.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/starship/default.nix b/pkgs/by-name/ya/yazi/plugins/starship/default.nix
index 5d7394d9c9a9..d08ed87232b0 100644
--- a/pkgs/by-name/ya/yazi/plugins/starship/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/starship/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Starship prompt plugin for yazi.";
+    description = "Starship prompt plugin for yazi";
     homepage = "https://github.com/Rolv-Apneseth/starship.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/sudo/default.nix b/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
index 94a6d3538431..cdcfaa332cbd 100644
--- a/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Call `sudo` in yazi.";
+    description = "Call `sudo` in yazi";
     homepage = "https://github.com/TD-Sky/sudo.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/time-travel/default.nix b/pkgs/by-name/ya/yazi/plugins/time-travel/default.nix
index 16d2f2cf8802..a1894e8b2653 100644
--- a/pkgs/by-name/ya/yazi/plugins/time-travel/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/time-travel/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "A yazi plugin for browsing backwards and forwards in time via BTRFS / ZFS snapshots.";
+    description = "Yazi plugin for browsing backwards and forwards in time via BTRFS / ZFS snapshots";
     homepage = "https://github.com/iynaix/time-travel.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/ya/yazi/plugins/yatline-catppuccin/default.nix b/pkgs/by-name/ya/yazi/plugins/yatline-catppuccin/default.nix
new file mode 100644
index 000000000000..e1de72b64bf7
--- /dev/null
+++ b/pkgs/by-name/ya/yazi/plugins/yatline-catppuccin/default.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkYaziPlugin,
+}:
+mkYaziPlugin {
+  pname = "yatline-catppuccin.yazi";
+  version = "0-unstable-2025-03-05";
+
+  src = fetchFromGitHub {
+    owner = "imsi32";
+    repo = "yatline-catppuccin.yazi";
+    rev = "8cc4773ecab8ee8995485d53897e1c46991a7fea";
+    hash = "sha256-Wz53zjwFyflnxCIMjAv+nzcgDriJwVYBX81pFXJUzc4=";
+  };
+
+  meta = {
+    description = "Soothing pastel theme for Yatline";
+    homepage = "https://github.com/imsi32/yatline-catppuccin.yazi";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ khaneliman ];
+  };
+}
diff --git a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
index 17b78fd76452..59368312f9f0 100644
--- a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
@@ -15,7 +15,7 @@ mkYaziPlugin {
   };
 
   meta = {
-    description = "Yazi plugin for customizing both header-line and status-line.";
+    description = "Yazi plugin for customizing both header-line and status-line";
     homepage = "https://github.com/imsi32/yatline.yazi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ khaneliman ];
diff --git a/pkgs/by-name/zi/zitadel/console.nix b/pkgs/by-name/zi/zitadel/console.nix
index 1b64430717d8..46b62a41c40e 100644
--- a/pkgs/by-name/zi/zitadel/console.nix
+++ b/pkgs/by-name/zi/zitadel/console.nix
@@ -5,7 +5,6 @@
 }:
 
 {
-  lib,
   stdenv,
   fetchYarnDeps,
   yarnConfigHook,
@@ -29,7 +28,7 @@ let
     workDir = "console";
     bufArgs = "../proto --include-imports --include-wkt";
     outputPath = "src/app/proto";
-    hash = "sha256-3WvfbhLpp03yP7Nb8bmZXYSlGJuEnBkBuyEzNVkIYZg=";
+    hash = "sha256-UzmwUUYg0my3noAQNtlUEBQ+K6GVnBSkWj4CzoaoLKw=";
   };
 in
 stdenv.mkDerivation {
@@ -42,7 +41,7 @@ stdenv.mkDerivation {
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${zitadelRepo}/console/yarn.lock";
-    hash = "sha256-+7CFBEKfRsqXbJR+BkLdB+pZ/dEEk4POGwZOVQ1LAUo=";
+    hash = "sha256-ekgLd5DTOBZWuT63QnTjx40ZYvLKZh+FXCn+h5vj9qQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zi/zitadel/package.nix b/pkgs/by-name/zi/zitadel/package.nix
index 78eab2712375..78e2fa9c2274 100644
--- a/pkgs/by-name/zi/zitadel/package.nix
+++ b/pkgs/by-name/zi/zitadel/package.nix
@@ -16,14 +16,14 @@
 }:
 
 let
-  version = "2.71.1";
+  version = "2.71.7";
   zitadelRepo = fetchFromGitHub {
     owner = "zitadel";
     repo = "zitadel";
     rev = "v${version}";
-    hash = "sha256-izYsf2Cc0jG8Wf82K6HsTVP+kAhmoEJVU7OJXhSzXLo=";
+    hash = "sha256-0ZOiwJ/ehDBkbd7iTTyVJzLj6Etph5/oxrDrck30ZL8=";
   };
-  goModulesHash = "sha256-mE0vhW1nW16SzqIu0C3q8qCXabJO7fZgkp7GeLWCwog=";
+  goModulesHash = "sha256-iZCjHSpQ7Gy41Dd4svRLbyEh1N8VE8U0uCOlN9rfJQU=";
 
   buildZitadelProtocGen =
     name:
@@ -100,7 +100,7 @@ let
       protoc-gen-zitadel
     ];
     outputPath = ".artifacts";
-    hash = "sha256-QUUe3jK9rOWzI1jzevgZ/UB6SqB6GXtd9CVtAqiStdo=";
+    hash = "sha256-rc5A2bQ2iWkybprQ7IWsQ/LLAQxPqhlxzVvPn8Ec56E=";
   };
 in
 buildGoModule rec {
diff --git a/pkgs/development/compilers/flutter/engine/package.nix b/pkgs/development/compilers/flutter/engine/package.nix
index e18c31ccdbec..f960a9d99f28 100644
--- a/pkgs/development/compilers/flutter/engine/package.nix
+++ b/pkgs/development/compilers/flutter/engine/package.nix
@@ -37,7 +37,6 @@
   pkg-config,
   ninja,
   python312,
-  python39,
   gitMinimal,
   version,
   flutterVersion,
@@ -58,7 +57,7 @@ let
 
   constants = callPackage ./constants.nix { platform = stdenv.targetPlatform; };
 
-  python3 = if lib.versionAtLeast flutterVersion "3.20" then python312 else python39;
+  python3 = python312;
 
   src = callPackage ./source.nix {
     inherit
diff --git a/pkgs/development/cuda-modules/cuda/overrides.nix b/pkgs/development/cuda-modules/cuda/overrides.nix
index ece0788fb46f..a8ccbff06aa9 100644
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@@ -159,7 +159,6 @@ filterAndCreateOverrides {
       expat,
       libxcrypt-legacy,
       ncurses6,
-      python39,
       python310,
       python311,
       python312,
@@ -176,7 +175,6 @@ filterAndCreateOverrides {
         ++ lib.lists.optionals (cudaAtLeast "12.5") [
           libxcrypt-legacy
           ncurses6
-          python39
           python310
           python311
           python312
diff --git a/pkgs/development/cuda-modules/cudatoolkit/default.nix b/pkgs/development/cuda-modules/cudatoolkit/default.nix
index 234bbf6c76b2..15681c2b31c3 100644
--- a/pkgs/development/cuda-modules/cudatoolkit/default.nix
+++ b/pkgs/development/cuda-modules/cudatoolkit/default.nix
@@ -29,7 +29,6 @@
   patchelf,
   perl,
   python3, # FIXME: CUDAToolkit 10 may still need python27
-  python39,
   python310,
   python311,
   pulseaudio,
@@ -155,7 +154,6 @@ backendStdenv.mkDerivation rec {
       # libcrypt.so.1
       libxcrypt-legacy
       ncurses6
-      python39
       python310
       python311
     ];
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 55ffdafc4c61..e3a354623953 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -309,14 +309,9 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ buildInputs;
 
-  prePatch =
-    optionalString stdenv.hostPlatform.isDarwin ''
-      substituteInPlace configure --replace-fail '`/usr/bin/arch`' '"i386"'
-    ''
-    + optionalString (pythonOlder "3.9" && stdenv.hostPlatform.isDarwin && x11Support) ''
-      # Broken on >= 3.9; replaced with ./3.9/darwin-tcl-tk.patch
-      substituteInPlace setup.py --replace-fail /Library/Frameworks /no-such-path
-    '';
+  prePatch = optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace configure --replace-fail '`/usr/bin/arch`' '"i386"'
+  '';
 
   patches =
     [
@@ -759,14 +754,6 @@ stdenv.mkDerivation (finalAttrs: {
       inherit src;
       name = "python${pythonVersion}-${version}-doc";
 
-      patches = optionals (pythonAtLeast "3.9" && pythonOlder "3.10") [
-        # https://github.com/python/cpython/issues/98366
-        (fetchpatch {
-          url = "https://github.com/python/cpython/commit/5612471501b05518287ed61c1abcb9ed38c03942.patch";
-          hash = "sha256-p41hJwAiyRgyVjCVQokMSpSFg/VDDrqkCSxsodVb6vY=";
-        })
-      ];
-
       postPatch = lib.optionalString (pythonAtLeast "3.9" && pythonOlder "3.11") ''
         substituteInPlace Doc/tools/extensions/pyspecific.py \
           --replace-fail "from sphinx.util import status_iterator" "from sphinx.util.display import status_iterator"
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 5b2ca9fe2cf8..af2a4a5b749d 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -44,18 +44,6 @@
       inherit passthruFun;
     };
 
-    python39 = callPackage ./cpython {
-      self = __splicedPackages.python39;
-      sourceVersion = {
-        major = "3";
-        minor = "9";
-        patch = "22";
-        suffix = "";
-      };
-      hash = "sha256-jBNtGZ02N6H86YoWrcgJwdg8ki0C1B82FLNPi259OOw=";
-      inherit passthruFun;
-    };
-
     python310 = callPackage ./cpython {
       self = __splicedPackages.python310;
       sourceVersion = {
diff --git a/pkgs/development/python-modules/cx-freeze/default.nix b/pkgs/development/python-modules/cx-freeze/default.nix
index 953db6e32236..f6b327721f05 100644
--- a/pkgs/development/python-modules/cx-freeze/default.nix
+++ b/pkgs/development/python-modules/cx-freeze/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     sed -i /patchelf/d pyproject.toml
     # Build system requirements
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=70.1,<75" "setuptools"
+      --replace-fail "setuptools>=70.1,<76" "setuptools"
   '';
 
   build-system = [
diff --git a/pkgs/development/python-modules/dask-glm/default.nix b/pkgs/development/python-modules/dask-glm/default.nix
index 97cfa6100313..ff4eb30f6339 100644
--- a/pkgs/development/python-modules/dask-glm/default.nix
+++ b/pkgs/development/python-modules/dask-glm/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -59,9 +60,14 @@ buildPythonPackage rec {
   disabledTests = [
     # ValueError: <class 'bool'> can be computed for one-element arrays only.
     "test_dot_with_sparse"
+
+    # ValueError: `shape` was not provided.
+    "test_sparse"
   ];
 
-  __darwinAllowLocalNetworking = true;
+  # On darwin, tests saturate the entire system, even when constrained to run single-threaded
+  # Removing pytest-xdist AND setting --cores to one does not prevent the load from exploding
+  doCheck = !stdenv.hostPlatform.isDarwin;
 
   meta = {
     description = "Generalized Linear Models with Dask";
diff --git a/pkgs/development/python-modules/dscribe/default.nix b/pkgs/development/python-modules/dscribe/default.nix
index c2644b3da134..22fe43bed74f 100644
--- a/pkgs/development/python-modules/dscribe/default.nix
+++ b/pkgs/development/python-modules/dscribe/default.nix
@@ -67,10 +67,14 @@ buildPythonPackage rec {
       # AttributeError: module 'numpy' has no attribute 'product'
       "test_extended_system"
     ]
+    ++
+      lib.optionals
+        ((stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) || stdenv.hostPlatform.isDarwin)
+        [
+          # AssertionError on a numerical test
+          "test_cell_list"
+        ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # AssertionError on a numerical test
-      "test_cell_list"
-
       # Fatal Python error: Aborted
       # matplotlib/backend_bases.py", line 2654 in create_with_canvas
       "test_examples"
diff --git a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
index 7f1a5e388b1f..dc7b30c4aca9 100644
--- a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
@@ -71,14 +71,14 @@
 
 stdenv.mkDerivation rec {
   pname = "home-assistant-chip-wheels";
-  version = "2024.11.4";
+  version = "2025.4.0";
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "chip-wheels";
     tag = version;
     fetchSubmodules = false;
     leaveDotGit = true;
-    hash = "sha256-hWdTm/Ojdvz0s9qIXbOs3yll7XfAdoTZrg4dgu7ISns=";
+    hash = "sha256-20dqVXHPgSxBveTxlbHEjTtp9NI1oVCVpBTDbjDI2QA=";
     postFetch = ''
       cd $out
       # Download connectedhomeip.
diff --git a/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix b/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
index 8292fd3ce7ee..e160ec6136e6 100644
--- a/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-indices-managed-llama-cloud";
-  version = "0.6.10";
+  version = "0.6.11";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_indices_managed_llama_cloud";
     inherit version;
-    hash = "sha256-lI7PRcTYuWy0/pRq6/plk82eXtvhbl8QciScezxW07U=";
+    hash = "sha256-klUy92DNLrsllIKNoxGtrD1UzSyuPf8pCEke67K4vQ8=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/lxml-html-clean/default.nix b/pkgs/development/python-modules/lxml-html-clean/default.nix
index 2ace7889c047..36c2e7e478eb 100644
--- a/pkgs/development/python-modules/lxml-html-clean/default.nix
+++ b/pkgs/development/python-modules/lxml-html-clean/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "lxml-html-clean";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fedora-python";
     repo = "lxml_html_clean";
     tag = version;
-    hash = "sha256-tZDFpJg7YySJ6CrSesD9+WWZS/guQFNmpSVsMzfzbpU=";
+    hash = "sha256-KGUFRbcaeDcX2jyoyyZMZsVTbN+h8uy+ugcritkZe38=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pypdfium2/default.nix b/pkgs/development/python-modules/pypdfium2/default.nix
index 933302eb81e3..66cdf166a6fb 100644
--- a/pkgs/development/python-modules/pypdfium2/default.nix
+++ b/pkgs/development/python-modules/pypdfium2/default.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   pkgs,
   buildPythonPackage,
@@ -9,6 +10,9 @@
   numpy,
   pillow,
   pytestCheckHook,
+  removeReferencesTo,
+  python,
+  replaceVars,
 }:
 
 let
@@ -37,6 +41,12 @@ let
       hash = "sha256-3JA7cW/xaEj/DxMHEypROwrKGo7EwUEcipRqALTvydw=";
     };
 
+    patches = [
+      (replaceVars ./fix-cc-detection.patch {
+        cc = "${stdenv.cc.targetPrefix}cc";
+      })
+    ];
+
     build-system = [
       setuptools-scm
     ];
@@ -62,6 +72,10 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  nativeBuildInputs = [
+    removeReferencesTo
+  ];
+
   propagatedBuildInputs = [
     pdfium-binaries
   ];
@@ -104,6 +118,11 @@ buildPythonPackage rec {
     '';
   env.PDFIUM_PLATFORM = "system:${pdfiumVersion}";
 
+  # Remove references to stdenv in comments.
+  postInstall = ''
+    remove-references-to -t ${stdenv.cc.cc} $out/${python.sitePackages}/pypdfium2_raw/bindings.py
+  '';
+
   nativeCheckInputs = [
     numpy
     pillow
diff --git a/pkgs/development/python-modules/pypdfium2/fix-cc-detection.patch b/pkgs/development/python-modules/pypdfium2/fix-cc-detection.patch
new file mode 100644
index 000000000000..e01cc90901f5
--- /dev/null
+++ b/pkgs/development/python-modules/pypdfium2/fix-cc-detection.patch
@@ -0,0 +1,25 @@
+diff --git a/src/ctypesgen/__main__.py b/src/ctypesgen/__main__.py
+index 23ee014..2d0cfc1 100644
+--- a/src/ctypesgen/__main__.py
++++ b/src/ctypesgen/__main__.py
+@@ -89,17 +89,9 @@ def main_impl(args, cmd_str):
+         assert _is_relative_to(args.output, args.linkage_anchor)
+     
+     if args.cpp:
+-        assert shutil.which(args.cpp[0]), f"Given pre-processor {args.cpp[0]!r} is not available."
+-    else:
+-        if shutil.which("gcc"):
+-            args.cpp = ["gcc", "-E"]
+-        elif shutil.which("cpp"):
+-            args.cpp = ["cpp"]
+-        elif shutil.which("clang"):
+-            args.cpp = ["clang", "-E"]
+-        else:
+-            raise RuntimeError("C pre-processor auto-detection failed: neither gcc nor clang available.")
+-    
++        print("cpp argument ignored for nix build")
++    args.cpp = ["@cc@", "-E"]
++ 
+     # Important: must not use +=, this would mutate the original object, which is problematic when default=[] is used and ctypesgen called repeatedly from within python
+     args.compile_libdirs = args.compile_libdirs + args.universal_libdirs
+     args.runtime_libdirs = args.runtime_libdirs + args.universal_libdirs
diff --git a/pkgs/development/python-modules/sparse/default.nix b/pkgs/development/python-modules/sparse/default.nix
index 81e567f46ec4..6100873d5b42 100644
--- a/pkgs/development/python-modules/sparse/default.nix
+++ b/pkgs/development/python-modules/sparse/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "sparse";
-  version = "0.15.5";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydata";
     repo = "sparse";
     tag = version;
-    hash = "sha256-W4rcq7G/bQsT9oTLieOzWNst5LnIAelRMbm+uUPeQgs=";
+    hash = "sha256-ChSEb+IwzutDgYBJxhlunRaF8VvkLHW/ae5RdrljWj0=";
   };
 
   build-system = [
@@ -56,10 +56,5 @@ buildPythonPackage rec {
     downloadPage = "https://github.com/pydata/sparse/releases/tag/${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
-    badPlatforms = [
-      # Most tests fail with: Fatal Python error: Segmentation fault
-      # numba/typed/typedlist.py", line 344 in append
-      "aarch64-linux"
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/ufomerge/default.nix b/pkgs/development/python-modules/ufomerge/default.nix
index 8f59f650ccc9..ed03839cfa3e 100644
--- a/pkgs/development/python-modules/ufomerge/default.nix
+++ b/pkgs/development/python-modules/ufomerge/default.nix
@@ -13,20 +13,16 @@
 
 buildPythonPackage rec {
   pname = "ufomerge";
-  version = "1.8.2";
+  version = "1.8.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "ufomerge";
     tag = "v${version}";
-    hash = "sha256-D+BhKCKWgprQn+eXFgwnSN/06+JF5CiUS0VAS1Kvedw=";
+    hash = "sha256-E/RgFJXyA6/ZktsjydqDecysi03+XQDOD0SeH3rlFZI=";
   };
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-
-  pythonRelaxDeps = [ "fonttools" ];
-
   build-system = [
     setuptools
     setuptools-scm
@@ -42,9 +38,9 @@ buildPythonPackage rec {
     fontfeatures
   ];
 
-  disabledTestPaths = [
-    # Failing due to fonttools being to old
-    "tests/test_layout.py"
+  disabledTests = [
+    # Fails with `KeyError: 'B'`
+    "test_28"
   ];
 
   pythonImportsCheck = [ "ufomerge" ];
@@ -52,7 +48,7 @@ buildPythonPackage rec {
   meta = {
     description = "Command line utility and Python library that merges two UFO source format fonts into a single file";
     homepage = "https://github.com/googlefonts/ufomerge";
-    changelog = "https://github.com/googlefonts/ufomerge/releases/tag/v${version}";
+    changelog = "https://github.com/googlefonts/ufomerge/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ jopejoe1 ];
   };
diff --git a/pkgs/development/python-modules/unstructured-client/default.nix b/pkgs/development/python-modules/unstructured-client/default.nix
index 19862dc60c7e..261c343d5c9f 100644
--- a/pkgs/development/python-modules/unstructured-client/default.nix
+++ b/pkgs/development/python-modules/unstructured-client/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "unstructured-client";
-  version = "0.32.0";
+  version = "0.32.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-python-client";
     tag = "v${version}";
-    hash = "sha256-2BAhjLHVWGjjbWTXmG/+GMKQutJaBCMLhU+/Dq/LK5c=";
+    hash = "sha256-bHiYV86c3ViCLix6vR55GiM8qTv64jj9tD8nF/jMUm4=";
   };
 
   preBuild = ''
diff --git a/pkgs/games/crossfire/crossfire-server.nix b/pkgs/games/crossfire/crossfire-server.nix
index 43d71aaede35..435d87beb547 100644
--- a/pkgs/games/crossfire/crossfire-server.nix
+++ b/pkgs/games/crossfire/crossfire-server.nix
@@ -9,7 +9,7 @@
   perl,
   check,
   pkg-config,
-  python39, # crossfire-server relies on a parser wich was removed in python >3.9
+  python3,
   version,
   rev,
   sha256,
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
     perl
     check
     pkg-config
-    python39
+    python3
   ];
   hardeningDisable = [ "format" ];
 
@@ -49,13 +49,14 @@ stdenv.mkDerivation {
     sh autogen.sh
   '';
 
-  configureFlags = [ "--with-python=${python39}" ];
+  configureFlags = [ "--with-python=${python3}" ];
 
   postInstall = ''
     ln -s ${maps} "$out/share/crossfire/maps"
   '';
 
   meta = with lib; {
+    broken = true; # cfpython.c:63:10: fatal error: node.h: No such file or directory
     description = "Server for the Crossfire free MMORPG";
     homepage = "http://crossfire.real-time.com/";
     license = licenses.gpl2Plus;
diff --git a/pkgs/servers/web-apps/outline/default.nix b/pkgs/servers/web-apps/outline/default.nix
index 49f0ae356713..763044bd5129 100644
--- a/pkgs/servers/web-apps/outline/default.nix
+++ b/pkgs/servers/web-apps/outline/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "outline";
-  version = "0.82.0";
+  version = "0.83.0";
 
   src = fetchFromGitHub {
     owner = "outline";
     repo = "outline";
     rev = "v${version}";
-    hash = "sha256-nCXyR4k/Ny0OLAE18B+GJDyOMTjt6rc375yj+d+c8zQ=";
+    hash = "sha256-r8E+N6C9EGah7qEomD+c64lW2L3XjAj+TIVHByLckag=";
   };
 
   nativeBuildInputs = [
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-RDMVlSVYPGAuyOTcI2CBgaaZ5wNT7lznYb4jbirKmqk=";
+    hash = "sha256-XiVg/HesOooj7aJHMMVKx+JUd6cA0E4koxHZAm3cFiQ=";
   };
 
   configurePhase = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5ef6715e396b..cccd8a9925f6 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -669,6 +669,13 @@ mapAliases {
   gcc8Stdenv = throw "gcc8Stdenv has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-11-20
   gcc10StdenvCompat =
     if stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11" then gcc10Stdenv else stdenv; # Added 2024-03-21
+  gcc-arm-embedded-6 = throw "gcc-arm-embedded-6 has been removed from Nixpkgs as it is unmaintained and obsolete"; # Added 2025-04-12
+  gcc-arm-embedded-7 = throw "gcc-arm-embedded-7 has been removed from Nixpkgs as it is unmaintained and obsolete"; # Added 2025-04-12
+  gcc-arm-embedded-8 = throw "gcc-arm-embedded-8 has been removed from Nixpkgs as it is unmaintained and obsolete"; # Added 2025-04-12
+  gcc-arm-embedded-9 = throw "gcc-arm-embedded-9 has been removed from Nixpkgs as it is unmaintained and obsolete"; # Added 2025-04-12
+  gcc-arm-embedded-10 = throw "gcc-arm-embedded-10 has been removed from Nixpkgs as it is unmaintained and obsolete"; # Added 2025-04-12
+  gcc-arm-embedded-11 = throw "gcc-arm-embedded-11 has been removed from Nixpkgs as it is unmaintained and obsolete"; # Added 2025-04-12
+  gcc-arm-embedded-12 = throw "gcc-arm-embedded-12 has been removed from Nixpkgs as it is unmaintained and obsolete"; # Added 2025-04-12
   gcj = gcj6; # Added 2024-09-13
   gcj6 = throw "gcj6 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   gcolor2 = throw "'gcolor2' has been removed due to lack of maintenance upstream and depending on gtk2. Consider using 'gcolor3' or 'eyedropper' instead"; # Added 2024-09-15
@@ -1813,6 +1820,7 @@ mapAliases {
   vistafonts-cht = vista-fonts-cht; # Added 2025-02-03
   vkBasalt = vkbasalt; # Added 2022-11-22
   vkdt-wayland = vkdt; # Added 2024-04-19
+  vocal = throw "'vocal' has been archived upstream. Consider using 'gnome-podcasts' or 'kasts' instead."; # Added 2025-04-12
   void = throw "'void' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   volnoti = throw "'volnoti' has been removed due to lack of maintenance upstream."; # Added 2024-12-04
   vuze = throw "'vuze' was removed because it is unmaintained upstream and insecure (CVE-2018-13417). BiglyBT is a maintained fork."; # Added 2024-11-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f1ecc485062c..ca28f1d18df4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2541,9 +2541,7 @@ with pkgs;
 
   klipper = callPackage ../servers/klipper { };
 
-  klipper-firmware = callPackage ../servers/klipper/klipper-firmware.nix {
-    gcc-arm-embedded = gcc-arm-embedded-13;
-  };
+  klipper-firmware = callPackage ../servers/klipper/klipper-firmware.nix { };
 
   klipper-flash = callPackage ../servers/klipper/klipper-flash.nix { };
 
@@ -6371,7 +6369,7 @@ with pkgs;
     inherit (llvmPackages_15) llvm;
   };
 
-  gcc-arm-embedded = gcc-arm-embedded-12;
+  gcc-arm-embedded = gcc-arm-embedded-14;
 
   # It would be better to match the default gcc so that there are no linking errors
   # when using C/C++ libraries in D packages, but right now versions >= 12 are broken.
@@ -7591,12 +7589,6 @@ with pkgs;
     bluezSupport = lib.meta.availableOn stdenv.hostPlatform bluez;
     x11Support = true;
   };
-  python39Full = python39.override {
-    self = python39Full;
-    pythonAttr = "python39Full";
-    bluezSupport = lib.meta.availableOn stdenv.hostPlatform bluez;
-    x11Support = true;
-  };
   python310Full = python310.override {
     self = python310Full;
     pythonAttr = "python310Full";
@@ -7641,7 +7633,6 @@ with pkgs;
   pythonInterpreters = callPackage ./../development/interpreters/python { };
   inherit (pythonInterpreters)
     python27
-    python39
     python310
     python311
     python312
@@ -7657,7 +7648,6 @@ with pkgs;
 
   # Python package sets.
   python27Packages = python27.pkgs;
-  python39Packages = python39.pkgs;
   python310Packages = python310.pkgs;
   python311Packages = python311.pkgs;
   python312Packages = recurseIntoAttrs python312.pkgs;
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 3a5ad71b68a9..43c91f01609a 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -38,14 +38,12 @@ mapAliases ({
   python2Packages = throw "do not use python2Packages when building Python packages, specify each used package as a separate argument"; # do not remove
   python27Packages = throw "do not use python27Packages when building Python packages, specify each used package as a separate argument"; # do not remove
   python3Packages = throw "do not use python3Packages when building Python packages, specify each used package as a separate argument"; # do not remove
-  python39Packages = throw "do not use python39Packages when building Python packages, specify each used package as a separate argument"; # do not remove
   python310Packages = throw "do not use python310Packages when building Python packages, specify each used package as a separate argument"; # do not remove
   python311Packages = throw "do not use python311Packages when building Python packages, specify each used package as a separate argument"; # do not remove
   python312Packages = throw "do not use python312Packages when building Python packages, specify each used package as a separate argument"; # do not remove
   python313Packages = throw "do not use python313Packages when building Python packages, specify each used package as a separate argument"; # do not remove
   python2 = throw "do not use python2 when building Python packages, use the generic python parameter instead"; # do not remove
   python3 = throw "do not use python3 when building Python packages, use the generic python parameter instead"; # do not remove
-  python39 = throw "do not use python39 when building Python packages, use the generic python parameter instead"; # do not remove
   python310 = throw "do not use python310 when building Python packages, use the generic python parameter instead"; # do not remove
   python311 = throw "do not use python311 when building Python packages, use the generic python parameter instead"; # do not remove
   python312 = throw "do not use python312 when building Python packages, use the generic python parameter instead"; # do not remove