diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index d4b1d65b42b2..db8066c8dc56 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -13,6 +13,7 @@
   writeShellScriptBin,
   nixpkgs ? { },
   markdown-code-runner,
+  roboto,
 }:
 
 stdenvNoCC.mkDerivation (
@@ -98,6 +99,8 @@ stdenvNoCC.mkDerivation (
       mv out "$dest"
       mv "$dest/index.html" "$dest/manual.html"
 
+      cp ${roboto.src}/web/Roboto\[ital\,wdth\,wght\].ttf "$dest/Roboto.ttf"
+
       cp ${epub} "$dest/nixpkgs-manual.epub"
 
       mkdir -p $out/nix-support/
diff --git a/doc/style.css b/doc/style.css
index f517733be972..4ba76cc39114 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -7,25 +7,29 @@ body {
     margin: 0;
 }
 
-.book {
+.book,
+.appendix {
     margin: auto;
     width: 100%;
 }
 
 @media screen and (min-width: 768px) {
-    .book {
+    .book,
+    .appendix {
         max-width: 46rem;
     }
 }
 
 @media screen and (min-width: 992px) {
-    .book {
+    .book,
+    .appendix {
         max-width: 60rem;
     }
 }
 
 @media screen and (min-width: 1200px) {
-    .book {
+    .book,
+    .appendix {
         max-width: 73rem;
     }
 }
@@ -113,10 +117,10 @@ html {
 
 body {
     font-size: 1rem;
-    font-family: 'Roboto', sans-serif;
+    font-family: "Roboto", sans-serif;
     font-weight: 300;
-    color: #000000;
-    background-color: #ffffff;
+    color: var(--main-text-color);
+    background-color: var(--background);
     min-height: 100vh;
     display: flex;
     flex-direction: column;
@@ -132,7 +136,7 @@ body {
 a {
     text-decoration: none;
     border-bottom: 1px solid;
-    color: #405d99;
+    color: var(--link-color);
 }
 
 ul {
@@ -163,7 +167,7 @@ h1 {
     line-height: 110%;
     font-size: 200%;
     margin-bottom: 1rem;
-    color: #6586c8;
+    color: var(--heading-color);
 }
 
 h2 {
@@ -171,7 +175,7 @@ h2 {
     line-height: 110%;
     font-size: 170%;
     margin-bottom: 0.625rem;
-    color: #6586c8;
+    color: var(--heading-color);
 }
 
 h2:not(:first-child) {
@@ -183,7 +187,7 @@ h3 {
     line-height: 110%;
     margin-bottom: 1rem;
     font-size: 150%;
-    color: #6586c8;
+    color: var(--heading-color);
 }
 
 .note h3,
@@ -199,7 +203,7 @@ h4 {
     line-height: 110%;
     margin-bottom: 1rem;
     font-size: 140%;
-    color: #6586c8;
+    color: var(--heading-color);
 }
 
 h5 {
@@ -207,14 +211,14 @@ h5 {
     line-height: 110%;
     margin-bottom: 1rem;
     font-size: 130%;
-    color: #6a6a6a;
+    color: var(--small-heading-color);
 }
 
 h6 {
     font-weight: 800;
     line-height: 110%;
     margin-bottom: 1rem;
-    font-size: 120%
+    font-size: 120%;
 }
 
 strong {
@@ -226,13 +230,13 @@ p {
     margin-bottom: 1rem;
 }
 
-dt>*:first-child,
-dd>*:first-child {
+dt > *:first-child,
+dd > *:first-child {
     margin-top: 0;
 }
 
-dt>*:last-child,
-dd>*:last-child {
+dt > *:last-child,
+dd > *:last-child {
     margin-bottom: 0;
 }
 
@@ -256,8 +260,8 @@ div.appendix .programlisting {
     border-radius: 0.5rem;
     padding: 1rem;
     overflow: auto;
-    background: #f2f8fd;
-    color: #000000;
+    background: var(--codeblock-background);
+    color: var(--codeblock-text-color);
 }
 
 div.book .note,
@@ -277,47 +281,46 @@ div.appendix .important {
     background: #f4f4f4;
 }
 
-div.book .note>.title,
-div.book .tip>.title,
-div.book .warning>.title,
-div.book .caution>.title,
-div.book .important>.title,
-div.appendix .note>.title,
-div.appendix .tip>.title,
-div.appendix .warning>.title,
-div.appendix .caution>.title,
-div.appendix .important>.title {
+div.book .note > .title,
+div.book .tip > .title,
+div.book .warning > .title,
+div.book .caution > .title,
+div.book .important > .title,
+div.appendix .note > .title,
+div.appendix .tip > .title,
+div.appendix .warning > .title,
+div.appendix .caution > .title,
+div.appendix .important > .title {
     font-weight: 800;
-    /* font-family: 'Overpass', serif; */
     line-height: 110%;
     margin-bottom: 1rem;
     color: inherit;
     margin-bottom: 0;
 }
 
-div.book .note> :first-child,
-div.book .tip> :first-child,
-div.book .warning> :first-child,
-div.book .caution> :first-child,
-div.book .important> :first-child,
-div.appendix .note> :first-child,
-div.appendix .tip> :first-child,
-div.appendix .warning> :first-child,
-div.appendix .caution> :first-child,
-div.appendix .important> :first-child {
+div.book .note > :first-child,
+div.book .tip > :first-child,
+div.book .warning > :first-child,
+div.book .caution > :first-child,
+div.book .important > :first-child,
+div.appendix .note > :first-child,
+div.appendix .tip > :first-child,
+div.appendix .warning > :first-child,
+div.appendix .caution > :first-child,
+div.appendix .important > :first-child {
     margin-top: 0;
 }
 
-div.book .note> :last-child,
-div.book .tip> :last-child,
-div.book .warning> :last-child,
-div.book .caution> :last-child,
-div.book .important> :last-child,
-div.appendix .note> :last-child,
-div.appendix .tip> :last-child,
-div.appendix .warning> :last-child,
-div.appendix .caution> :last-child,
-div.appendix .important> :last-child {
+div.book .note > :last-child,
+div.book .tip > :last-child,
+div.book .warning > :last-child,
+div.book .caution > :last-child,
+div.book .important > :last-child,
+div.appendix .note > :last-child,
+div.appendix .tip > :last-child,
+div.appendix .warning > :last-child,
+div.appendix .caution > :last-child,
+div.appendix .important > :last-child {
     margin-bottom: 0;
 }
 
@@ -325,16 +328,16 @@ div.book .note,
 div.book .tip,
 div.appendix .note,
 div.appendix .tip {
-    color: #5277c3;
-    background: #f2f8fd;
+    color: var(--note-text-color);
+    background: var(--note-background);
 }
 
 div.book .warning,
 div.book .caution,
 div.appendix .warning,
 div.appendix .caution {
-    color: #cc3900;
-    background-color: #fff5e1;
+    color: var(--warning-text-color);
+    background-color: var(--warning-background);
 }
 
 div.book .section,
@@ -358,8 +361,8 @@ div.appendix div.example details[open] {
     border-radius: 4px;
 }
 
-div.book div.example details>summary,
-div.appendix div.example details>summary {
+div.book div.example details > summary,
+div.appendix div.example details > summary {
     cursor: pointer;
 }
 
@@ -368,13 +371,13 @@ div.appendix br.example-break {
     display: none;
 }
 
-div.book div.footnotes>hr,
-div.appendix div.footnotes>hr {
+div.book div.footnotes > hr,
+div.appendix div.footnotes > hr {
     border-color: #d8d8d8;
 }
 
-div.book div.footnotes>br,
-div.appendix div.footnotes>br {
+div.book div.footnotes > br,
+div.appendix div.footnotes > br {
     display: none;
 }
 
@@ -444,3 +447,47 @@ div.appendix .variablelist .term {
     user-select: none;
     -webkit-user-select: none;
 }
+
+:root {
+    --background: #fff;
+    --main-text-color: #000;
+    --link-color: #405d99;
+    --heading-color: #6586c8;
+    --small-heading-color: #6a6a6a;
+    --note-text-color: #5277c3;
+    --note-background: #f2f8fd;
+    --warning-text-color: #cc3900;
+    --warning-background: #fff5e1;
+    --codeblock-background: #f2f8fd;
+    --codeblock-text-color: #000;
+}
+
+@media (prefers-color-scheme: dark) {
+    :root {
+        --background: #242424;
+        --main-text-color: #fff;
+        --link-color: #6586c8;
+        --small-heading-color: #fff;
+        --note-background: none;
+        --warning-background: none;
+        --codeblock-background: #393939;
+        --codeblock-text-color: #fff;
+    }
+
+    div.book .note,
+    div.book .tip,
+    div.appendix .note,
+    div.appendix .tip,
+    div.book .warning,
+    div.book .caution,
+    div.appendix .warning,
+    div.appendix .caution {
+        border: 2px solid;
+        font-weight: 400;
+    }
+}
+
+@font-face {
+    font-family: Roboto;
+    src: url(Roboto.ttf);
+}
diff --git a/lib/options.nix b/lib/options.nix
index 85ce6ca77e92..007a14f15b67 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -30,6 +30,7 @@ let
   inherit (lib.attrsets)
     attrByPath
     optionalAttrs
+    showAttrPath
     ;
   inherit (lib.strings)
     concatMapStrings
@@ -40,6 +41,7 @@ let
     ;
   inherit (lib.lists)
     last
+    toList
     ;
   prioritySuggestion = ''
     Use `lib.mkForce value` or `lib.mkDefault value` to change the priority on any of these definitions.
@@ -310,14 +312,14 @@ rec {
     }:
     let
       name' = if isList name then last name else name;
-      default' = if isList default then default else [ default ];
-      defaultText = concatStringsSep "." default';
+      default' = toList default;
+      defaultText = showAttrPath default';
       defaultValue = attrByPath default' (throw "${defaultText} cannot be found in ${pkgsText}") pkgs;
       defaults =
         if default != null then
           {
             default = defaultValue;
-            defaultText = literalExpression ("${pkgsText}." + defaultText);
+            defaultText = literalExpression "${pkgsText}.${defaultText}";
           }
         else
           optionalAttrs nullable {
@@ -333,7 +335,7 @@ rec {
       }
       // optionalAttrs (example != null) {
         example = literalExpression (
-          if isList example then "${pkgsText}." + concatStringsSep "." example else example
+          if isList example then "${pkgsText}.${showAttrPath example}" else example
         );
       }
     );
diff --git a/lib/path/default.nix b/lib/path/default.nix
index be559eadf182..1284bed94bb0 100644
--- a/lib/path/default.nix
+++ b/lib/path/default.nix
@@ -165,7 +165,7 @@ let
     # This is a workaround for https://github.com/NixOS/nix/issues/12361 which
     # was needed during the experimental phase of ca-derivations and should be
     # removed once the issue has been resolved.
-    || match "[0-9a-z]{52}" (head components) != null;
+    || components != [ ] && match "[0-9a-z]{52}" (head components) != null;
 
 in
 # No rec! Add dependencies on this file at the top.
diff --git a/lib/path/tests/unit.nix b/lib/path/tests/unit.nix
index a52b4f44e51d..fa2e004e9c3a 100644
--- a/lib/path/tests/unit.nix
+++ b/lib/path/tests/unit.nix
@@ -110,6 +110,12 @@ let
       expected = false;
     };
 
+    # Root path (empty path components list)
+    testHasStorePathPrefixRoot = {
+      expr = hasStorePathPrefix /.;
+      expected = false;
+    };
+
     testHasStorePathPrefixExample1 = {
       expr = hasStorePathPrefix (storeDirPath + "/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo/bar/baz");
       expected = true;
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index d0f25c283dcb..3b19c8c63f26 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -315,14 +315,26 @@ checkConfigOutput '^false$' config.enableAlias ./alias-with-priority-can-overrid
 checkConfigOutput '^"hello"$' config.package.pname ./declare-mkPackageOption.nix
 checkConfigOutput '^"hello"$' config.namedPackage.pname ./declare-mkPackageOption.nix
 checkConfigOutput '^".*Hello.*"$' options.namedPackage.description ./declare-mkPackageOption.nix
+checkConfigOutput '^"literalExpression"$' options.namedPackage.defaultText._type ./declare-mkPackageOption.nix
+checkConfigOutput '^"pkgs\.hello"$' options.namedPackage.defaultText.text ./declare-mkPackageOption.nix
+checkConfigOutput '^"hello"$' config.namedPackageSingletonDefault.pname ./declare-mkPackageOption.nix
+checkConfigOutput '^".*Hello.*"$' options.namedPackageSingletonDefault.description ./declare-mkPackageOption.nix
+checkConfigOutput '^"pkgs\.hello"$' options.namedPackageSingletonDefault.defaultText.text ./declare-mkPackageOption.nix
 checkConfigOutput '^"hello"$' config.pathPackage.pname ./declare-mkPackageOption.nix
+checkConfigOutput '^"literalExpression"$' options.packageWithExample.example._type ./declare-mkPackageOption.nix
 checkConfigOutput '^"pkgs\.hello\.override \{ stdenv = pkgs\.clangStdenv; \}"$' options.packageWithExample.example.text ./declare-mkPackageOption.nix
+checkConfigOutput '^"literalExpression"$' options.packageWithPathExample.example._type ./declare-mkPackageOption.nix
+checkConfigOutput '^"pkgs\.hello"$' options.packageWithPathExample.example.text ./declare-mkPackageOption.nix
 checkConfigOutput '^".*Example extra description\..*"$' options.packageWithExtraDescription.description ./declare-mkPackageOption.nix
 checkConfigError 'The option .undefinedPackage. was accessed but has no value defined. Try setting the option.' config.undefinedPackage ./declare-mkPackageOption.nix
 checkConfigOutput '^null$' config.nullablePackage ./declare-mkPackageOption.nix
-checkConfigOutput '^"null or package"$' options.nullablePackageWithDefault.type.description ./declare-mkPackageOption.nix
+checkConfigOutput '^"null or package"$' options.nullablePackage.type.description ./declare-mkPackageOption.nix
+checkConfigOutput '^"hello"$' config.nullablePackageWithDefault.pname ./declare-mkPackageOption.nix
 checkConfigOutput '^"myPkgs\.hello"$' options.packageWithPkgsText.defaultText.text ./declare-mkPackageOption.nix
 checkConfigOutput '^"hello-other"$' options.packageFromOtherSet.default.pname ./declare-mkPackageOption.nix
+checkConfigOutput '^"hello"$' config.packageInvalidIdentifier.pname ./declare-mkPackageOption.nix
+checkConfigOutput '^"pkgs\.\\"123\\"\.\\"with\\\\\\"quote\\"\.hello"$' options.packageInvalidIdentifier.defaultText.text ./declare-mkPackageOption.nix
+checkConfigOutput '^"pkgs\.\\"123\\"\.\\"with\\\\\\"quote\\"\.hello"$' options.packageInvalidIdentifierExample.example.text ./declare-mkPackageOption.nix
 
 # submoduleWith
 
diff --git a/lib/tests/modules/declare-mkPackageOption.nix b/lib/tests/modules/declare-mkPackageOption.nix
index 058c0addc0c3..3f4f91d7497e 100644
--- a/lib/tests/modules/declare-mkPackageOption.nix
+++ b/lib/tests/modules/declare-mkPackageOption.nix
@@ -57,5 +57,19 @@ in
         };
       in
       lib.mkPackageOption myPkgs "hello" { };
+
+    packageInvalidIdentifier =
+      let
+        myPkgs."123"."with\"quote" = { inherit (pkgs) hello; };
+      in
+      lib.mkPackageOption myPkgs [ "123" "with\"quote" "hello" ] { };
+
+    packageInvalidIdentifierExample = lib.mkPackageOption pkgs "hello" {
+      example = [
+        "123"
+        "with\"quote"
+        "hello"
+      ];
+    };
   };
 }
diff --git a/lib/tests/modules/pathWith.nix b/lib/tests/modules/pathWith.nix
index 273bc06dfc00..98ba39cb2c4b 100644
--- a/lib/tests/modules/pathWith.nix
+++ b/lib/tests/modules/pathWith.nix
@@ -58,6 +58,9 @@ in
   pathInStore.ok1 = "${storeDir}/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv";
   pathInStore.ok2 = "${storeDir}/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15";
   pathInStore.ok3 = "${storeDir}/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash";
+  pathInStore.ok4 = "/1121rp0gvr1qya7hvy925g5kjwg66acz6sn1ra1hca09f1z5dsab"; # CA derivation
+  pathInStore.ok5 = "/1121rp0gvr1qya7hvy925g5kjwg66acz6sn1ra1hca09f1z5dsab/bin/bash"; # CA derivation
+  pathInStore.ok6 = /1121rp0gvr1qya7hvy925g5kjwg66acz6sn1ra1hca09f1z5dsab; # CA derivation, path type
   pathInStore.bad1 = "";
   pathInStore.bad2 = "${storeDir}";
   pathInStore.bad3 = "${storeDir}/";
diff --git a/lib/types.nix b/lib/types.nix
index 92cdb1491c7c..715da842ac01 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -678,7 +678,14 @@ let
             check =
               x:
               let
-                isInStore = builtins.match "${builtins.storeDir}/[^.].*" (toString x) != null;
+                isInStore = lib.path.hasStorePathPrefix (
+                  if builtins.isPath x then
+                    x
+                  # Discarding string context is necessary to convert the value to
+                  # a path and safe as the result is never used in any derivation.
+                  else
+                    /. + builtins.unsafeDiscardStringContext x
+                );
                 isAbsolute = builtins.substring 0 1 (toString x) == "/";
                 isExpectedType = (
                   if inStore == null || inStore then isStringLike x else isString x # Do not allow a true path, which could be copied to the store later on.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f3b0bee2de9b..e5b22f2d6af7 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12539,12 +12539,6 @@
     github = "keenanweaver";
     githubId = 37268985;
   };
-  kekschen = {
-    email = "kx@imkx.dev";
-    github = "kek5chen";
-    githubId = 52585984;
-    name = "Kek5chen";
-  };
   keksgesicht = {
     name = "Jan Braun";
     email = "git@keksgesicht.de";
@@ -26035,6 +26029,12 @@
     githubId = 20464732;
     name = "Willi Butz";
   };
+  willow = {
+    email = "git@willow.moe";
+    github = "kek5chen";
+    githubId = 52585984;
+    name = "Willow";
+  };
   willow_ch = {
     email = "nix@w.wolo.dev";
     github = "spaghetus";
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 824b5eabb965..fd9f6761ac17 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -160,6 +160,8 @@ rec {
           ./manual.md \
           $dst/${common.indexPath}
 
+        cp ${pkgs.roboto.src}/web/Roboto\[ital\,wdth\,wght\].ttf "$dst/Roboto.ttf"
+
         mkdir -p $out/nix-support
         echo "nix-build out $out" >> $out/nix-support/hydra-build-products
         echo "doc manual $dst" >> $out/nix-support/hydra-build-products
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 0a4aedba87fc..b11f36719035 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -139,7 +139,7 @@ The pre-existing `services.ankisyncd` has been marked deprecated and will be dro
 
 - [Netbird](https://netbird.io), an open-source VPN management platform, now has a self-hosted management server. Available as [services.netbird.server](#opt-services.netbird.server.enable).
 
-- [nh](https://github.com/viperML/nh), yet another Nix CLI helper. Available as [programs.nh](#opt-programs.nh.enable).
+- [nh](https://github.com/nix-community/nh), yet another Nix CLI helper. Available as [programs.nh](#opt-programs.nh.enable).
 
 - [oink](https://github.com/rlado/oink), a dynamic DNS client for Porkbun. Available as [services.oink](#opt-services.oink.enable).
 
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
index 2f5c42d5af2b..89a6d7e91767 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
@@ -7,14 +7,14 @@
 }:
 vimUtils.buildVimPlugin {
   pname = "cmp-async-path";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2025-04-13";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "FelipeLema";
     repo = "cmp-async-path";
-    rev = "d6d1ffa2075039632a2d71e8fa139818e15ac757";
-    hash = "sha256-MZFpNPtSDMZNkfoz+3ZcDxLb8PvDtm9nb1dE0CbYIPQ=";
+    rev = "0ed1492f59e730c366d261a5ad822fa37e44c325";
+    hash = "sha256-J1Iw7yNfvWq7Jul25Eyx4qk9lSiLpZt4TRvTYi1DXtk=";
   };
 
   checkInputs = [ vimPlugins.nvim-cmp ];
diff --git a/pkgs/by-name/aw/awsebcli/package.nix b/pkgs/by-name/aw/awsebcli/package.nix
index 2d0a1e3cb865..ed83a519a8ab 100644
--- a/pkgs/by-name/aw/awsebcli/package.nix
+++ b/pkgs/by-name/aw/awsebcli/package.nix
@@ -25,14 +25,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "awsebcli";
-  version = "3.21";
+  version = "3.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-elastic-beanstalk-cli";
     tag = version;
-    hash = "sha256-VU8bXvS4m4eIamjlgGmHE2qwDXWAXvWTa0QHomXR5ZE=";
+    hash = "sha256-I85VteUjPPWRixXC1mEiMmk46mYPzQJoaYcHV8ztMU4=";
   };
 
   pythonRelaxDeps = [
@@ -45,12 +45,6 @@ python.pkgs.buildPythonApplication rec {
     "urllib3"
   ];
 
-  postPatch = ''
-    # https://github.com/aws/aws-elastic-beanstalk-cli/pull/469
-    substituteInPlace setup.py \
-      --replace-fail "scripts=['bin/eb']," ""
-  '';
-
   dependencies = with python.pkgs; [
     blessed
     botocore
@@ -88,6 +82,9 @@ python.pkgs.buildPythonApplication rec {
     "test_generate_and_upload_keypair__exit_code_1"
     "test_generate_and_upload_keypair__exit_code_is_other_than_1_and_0"
     "test_generate_and_upload_keypair__ssh_keygen_not_present"
+
+    # AssertionError: Expected 'echo' to be called once. Called 2 times
+    "test_multiple_modules__one_or_more_of_the_specified_modules_lacks_an_env_yaml"
   ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/ca/cargo-mobile2/package.nix b/pkgs/by-name/ca/cargo-mobile2/package.nix
index 89cd6327686f..72813c771b27 100644
--- a/pkgs/by-name/ca/cargo-mobile2/package.nix
+++ b/pkgs/by-name/ca/cargo-mobile2/package.nix
@@ -13,7 +13,7 @@
 let
   inherit (darwin.apple_sdk.frameworks) CoreServices;
   pname = "cargo-mobile2";
-  version = "0.17.6";
+  version = "0.20.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
     owner = "tauri-apps";
     repo = pname;
     rev = "cargo-mobile2-v${version}";
-    hash = "sha256-kIy5Ic7Zk6twcEbZN/wRLwMK0XeMF0lNkFDIc2vO944=";
+    hash = "sha256-7/ol4Jb/2s007LeSMo6YYDT5vipsZZF6O4hfJ7ylHGg=";
   };
 
   # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage {
   # sourceRoot = "${src.name}/tooling/cli";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-An9EuNv+6ttNKp50RutzxtHl/RS5gn9sUNlWtipAujk=";
+  cargoHash = "sha256-zSUT2zClpSlBDu6vgMv4TZn9Jp0Ych6EQKo1AwkSMXU=";
 
   preBuild = ''
     mkdir -p $out/share/
diff --git a/pkgs/by-name/cp/cpuid/package.nix b/pkgs/by-name/cp/cpuid/package.nix
index e656212991f9..0278b1cc9f9a 100644
--- a/pkgs/by-name/cp/cpuid/package.nix
+++ b/pkgs/by-name/cp/cpuid/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cpuid";
-  version = "20241023";
+  version = "20250419";
 
   src = fetchurl {
     url = "http://etallen.com/cpuid/${pname}-${version}.src.tar.gz";
-    sha256 = "sha256-/HdDWo1dKzVRcTMB6M24PmKjz+3IQTKw7JsbteUkT9w=";
+    sha256 = "sha256-Mcz8A/k92ISKZ5jydPoDeR9cO/uxp2f+IIamnONyess=";
   };
 
   # For pod2man during the build process.
diff --git a/pkgs/by-name/di/discordchatexporter-desktop/package.nix b/pkgs/by-name/di/discordchatexporter-desktop/package.nix
index ad643bceca4d..836913be9ff7 100644
--- a/pkgs/by-name/di/discordchatexporter-desktop/package.nix
+++ b/pkgs/by-name/di/discordchatexporter-desktop/package.nix
@@ -40,7 +40,7 @@ buildDotnetModule rec {
     homepage = "https://github.com/Tyrrrz/DiscordChatExporter";
     license = licenses.gpl3Plus;
     changelog = "https://github.com/Tyrrrz/DiscordChatExporter/blob/${version}/Changelog.md";
-    maintainers = with maintainers; [ kekschen ];
+    maintainers = with maintainers; [ willow ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "discordchatexporter";
   };
diff --git a/pkgs/by-name/fi/firezone-gateway/package.nix b/pkgs/by-name/fi/firezone-gateway/package.nix
index 0e6010b3b92d..5157879a57d1 100644
--- a/pkgs/by-name/fi/firezone-gateway/package.nix
+++ b/pkgs/by-name/fi/firezone-gateway/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "firezone-gateway";
-  version = "1.4.5";
+  version = "1.4.6";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "gateway-${version}";
-    hash = "sha256-2MDQyMCQIqV1Kbem53jnE8DGUZ6SrZqp2LpGJXvLBgA=";
+    hash = "sha256-ra5ZWPwNhyZEc9pBkcITvQyomgQ22yiWI16dnv1Fm3E=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Yz9xuH8Eph1pzv0siTpvdSXZLj/AjS5PR06CitK9NdE=";
+  cargoHash = "sha256-5B9nvFanHXZV8p8m2vsRLC5pSzwL2lX+V651oV8joJs=";
   sourceRoot = "${src.name}/rust";
   buildAndTestSubdir = "gateway";
   RUSTFLAGS = "--cfg system_certs";
diff --git a/pkgs/by-name/fi/firezone-headless-client/package.nix b/pkgs/by-name/fi/firezone-headless-client/package.nix
index 459411058d54..f29c84710b6b 100644
--- a/pkgs/by-name/fi/firezone-headless-client/package.nix
+++ b/pkgs/by-name/fi/firezone-headless-client/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "firezone-headless-client";
-  version = "1.4.5";
+  version = "1.4.6";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "headless-client-${version}";
-    hash = "sha256-IVbMdRtb6cu4obTFYPAYQXu9sXH7vT7K9j79IXg0KXk=";
+    hash = "sha256-ra5ZWPwNhyZEc9pBkcITvQyomgQ22yiWI16dnv1Fm3E=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-8//Gg45iJw9rfEn08FW+wDbg7Dz2MyKFGf3p2Td7kHA=";
+  cargoHash = "sha256-5B9nvFanHXZV8p8m2vsRLC5pSzwL2lX+V651oV8joJs=";
   sourceRoot = "${src.name}/rust";
   buildAndTestSubdir = "headless-client";
   RUSTFLAGS = "--cfg system_certs";
diff --git a/pkgs/by-name/ga/gaw/package.nix b/pkgs/by-name/ga/gaw/package.nix
index d65c354f633f..91a0c4d43b4b 100644
--- a/pkgs/by-name/ga/gaw/package.nix
+++ b/pkgs/by-name/ga/gaw/package.nix
@@ -1,19 +1,78 @@
 {
   stdenv,
-  fetchurl,
+  runCommandLocal,
   lib,
+  htmlq,
+  curl,
+  cacert,
   gtk3,
   pkg-config,
 }:
 
 stdenv.mkDerivation rec {
-  pname = "gaw";
-  version = "20220315";
+  pname = "gaw3";
+  version = "20250128";
 
-  src = fetchurl {
-    url = "https://download.tuxfamily.org/gaw/download/gaw3-${version}.tar.gz";
-    sha256 = "0j2bqi9444s1mfbr7x9rqp232xf7ab9z7ifsnl305jsklp6qmrbg";
-  };
+  # https://www.rvq.fr/php/ndl.php?id=gaw.*
+  # https://www.rvq.fr/php/ndl.php?id=gaw3-20250128.tar.gz
+  src =
+    runCommandLocal "gaw3-${version}.tar.gz"
+      {
+        BASE = "https://www.rvq.fr/php/ndl.php";
+        FNAME = "gaw3-${version}.tar.gz";
+
+        nativeBuildInputs = [
+          htmlq
+          curl
+        ];
+        SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+        outputHashMode = "recursive";
+        outputHashAlgo = "sha256";
+        outputHash = "sha256-3uO+209+cmu231iabyYmABmgegyxAxswWDWA/v8WSy0=";
+      }
+      ''
+        # fetch download page
+        html_form=$(
+          curl "$BASE?id=$FNAME" |
+            tr '\n' ' ' | tr -s ' ' | # minimize whitespace
+            htmlq tr | # select table rows, one per line
+            grep "<td>$FNAME</td>" | # filter for row of interest
+            head -n1 | # first match, just in case
+            htmlq form --base "$BASE"
+        )
+
+        declare -a curl_args=()
+
+        # hidden fields
+        declare -a input_names=()
+        readarray -td $'\n' input_names < <(
+          htmlq <<<"$html_form" "input[type=hidden]" -a name
+        )
+        for input_name in "''${input_names[@]}"; do
+          input_value=$(
+            htmlq <<<"$html_form" "input[type=hidden][name=''${input_name}]" -a value
+          )
+          echo "$input_name = $input_value"
+          curl_args+=( --form "$input_name=$input_value" )
+        done
+
+        # destination
+        curl_args+=(
+          "https://www.rvq.fr/$( htmlq <<<"$html_form"  form -a action )"
+        )
+
+        # POST and download
+        (set -x
+          curl -X POST "''${curl_args[@]}" $NIX_CURL_FLAGS --output "$FNAME"
+        )
+
+        # unpack and strip root dir
+        mkdir unpack/
+        tar xvf "$FNAME" --directory=unpack/
+        [[ "$(printf "%s\n" unpack/* | wc -l)" -eq 1 ]]
+        cp -a unpack/* $out
+      '';
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -28,7 +87,7 @@ stdenv.mkDerivation rec {
       input from sound cards. Data can be imported to gaw using files,
       direct tcp/ip connection or directly from the sound card.
     '';
-    homepage = "http://gaw.tuxfamily.org";
+    homepage = "https://www.rvq.fr/linux/gaw.php";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ fbeffa ];
     platforms = platforms.linux;
diff --git a/pkgs/by-name/go/golangci-lint-langserver/package.nix b/pkgs/by-name/go/golangci-lint-langserver/package.nix
index 34a13d3a6602..7a0f959cec5a 100644
--- a/pkgs/by-name/go/golangci-lint-langserver/package.nix
+++ b/pkgs/by-name/go/golangci-lint-langserver/package.nix
@@ -21,9 +21,6 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  # renable after https://github.com/nametake/golangci-lint-langserver/pull/52
-  doCheck = false;
-
   nativeCheckInputs = [
     golangci-lint
     writableTmpDirAsHomeHook
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index ea361f736518..371ce858ca15 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.29.0";
+  version = "0.29.1";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-wsCUB3UO5czqJPGctb3ZsTtcVXMqBB7/8/uk5ShL8ZA=";
+    hash = "sha256-bar4AdLovV8MBGF/yGHbcw1w3MQ4FFbmJkiDDS2Iq5g=";
   };
 
   buildAndTestSubdir = "harper-ls";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-KrW4I4Tg30/Yg5PuZCEWkrtjNUKMZmzqCmFAnKtj7A4=";
+  cargoHash = "sha256-CJZSBs8EtUstUNDUt3QQhv/f/GriaGzF9fw9IJWDNAk=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/kr/krillinai/package.nix b/pkgs/by-name/kr/krillinai/package.nix
index 901fea10e0e8..36da42a9b2a7 100644
--- a/pkgs/by-name/kr/krillinai/package.nix
+++ b/pkgs/by-name/kr/krillinai/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "krillinai";
-  version = "1.1.0";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "krillinai";
     repo = "KrillinAI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AAlefejME+XLERcDJDeVgzySVX+KGrCMt7PJyWaxnoM=";
+    hash = "sha256-hEKjqQcHnrxY266EP5uoLMzw6csi2bS5Q+ghGb6TJ4c=";
   };
 
   vendorHash = "sha256-mpvypCZmvVVljftGpcV1aea3s7Xmhr0jLfKZIZ0nkX8=";
diff --git a/pkgs/by-name/nb/nb/package.nix b/pkgs/by-name/nb/nb/package.nix
index 6b5455b2e2ba..ad70f417c4ef 100644
--- a/pkgs/by-name/nb/nb/package.nix
+++ b/pkgs/by-name/nb/nb/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nb";
-  version = "7.16.1";
+  version = "7.17.0";
 
   src = fetchFromGitHub {
     owner = "xwmx";
     repo = "nb";
     rev = version;
-    hash = "sha256-RX3DEjk+/tivTyv0+j3lZAKYgca4Zq9zQ+P1a/RXj2I=";
+    hash = "sha256-gUI7hAZabYPHkSwGtFZxEoi5Hw76fOLYbMZQIvsnSas=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/nh/nh/package.nix b/pkgs/by-name/nh/nh/package.nix
index aeef324f1a0b..90b23a32c65c 100644
--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@@ -9,22 +9,22 @@
   nix-update-script,
   nvd,
   nix-output-monitor,
+  buildPackages,
 }:
 let
-  version = "3.6.0";
   runtimeDeps = [
     nvd
     nix-output-monitor
   ];
 in
-rustPlatform.buildRustPackage {
-  inherit version;
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nh";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
-    owner = "viperML";
+    owner = "nix-community";
     repo = "nh";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-k8rz5RF1qi7RXzQYWGbw5pJRNRFIdX85SIYN+IHiVL4=";
   };
 
@@ -39,14 +39,19 @@ rustPlatform.buildRustPackage {
     darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
-  preFixup = ''
-    mkdir completions
-    $out/bin/nh completions --shell bash > completions/nh.bash
-    $out/bin/nh completions --shell zsh > completions/nh.zsh
-    $out/bin/nh completions --shell fish > completions/nh.fish
+  preFixup = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      mkdir completions
+      ${emulator} $out/bin/nh completions --shell bash > completions/nh.bash
+      ${emulator} $out/bin/nh completions --shell zsh > completions/nh.zsh
+      ${emulator} $out/bin/nh completions --shell fish > completions/nh.fish
 
-    installShellCompletion completions/*
-  '';
+      installShellCompletion completions/*
+    ''
+  );
 
   postFixup = ''
     wrapProgram $out/bin/nh \
@@ -60,7 +65,7 @@ rustPlatform.buildRustPackage {
 
   meta = {
     description = "Yet another nix cli helper";
-    homepage = "https://github.com/viperML/nh";
+    homepage = "https://github.com/nix-community/nh";
     license = lib.licenses.eupl12;
     mainProgram = "nh";
     maintainers = with lib.maintainers; [
@@ -68,4 +73,4 @@ rustPlatform.buildRustPackage {
       viperML
     ];
   };
-}
+})
diff --git a/pkgs/by-name/ru/ruff-lsp/package.nix b/pkgs/by-name/ru/ruff-lsp/package.nix
deleted file mode 100644
index 17640924a42f..000000000000
--- a/pkgs/by-name/ru/ruff-lsp/package.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  lib,
-  python3Packages,
-  fetchFromGitHub,
-
-  # tests
-  versionCheckHook,
-
-  # passthru
-  nix-update-script,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "ruff-lsp";
-  version = "0.0.62";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "astral-sh";
-    repo = "ruff-lsp";
-    tag = "v${version}";
-    hash = "sha256-aYhNvT4rcaEzuqwql7TpFkCoyH77uSG7r6uY5aIzhrk=";
-  };
-
-  build-system = with python3Packages; [ hatchling ];
-
-  dependencies = with python3Packages; [
-    lsprotocol
-    packaging
-    pygls
-    ruff
-    typing-extensions
-  ];
-
-  nativeCheckInputs = with python3Packages; [
-    pytest-asyncio
-    pytestCheckHook
-    python-lsp-jsonrpc
-    ruff
-    versionCheckHook
-  ];
-  versionCheckProgramArg = "--version";
-
-  makeWrapperArgs = [
-    # prefer ruff from user's PATH, that's usually desired behavior
-    "--suffix PATH : ${lib.makeBinPath (with python3Packages; [ ruff ])}"
-    # Unset ambient PYTHONPATH in the wrapper, so ruff-lsp only ever runs with
-    # its own, isolated set of dependencies. This works because the correct
-    # PYTHONPATH is set in the Python script, which runs after the wrapper.
-    "--unset PYTHONPATH"
-  ];
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    changelog = "https://github.com/astral-sh/ruff-lsp/releases/tag/v${version}";
-    description = "Language Server Protocol implementation for Ruff";
-    homepage = "https://github.com/astral-sh/ruff-lsp";
-    license = lib.licenses.mit;
-    mainProgram = "ruff-lsp";
-    maintainers = with lib.maintainers; [
-      figsoda
-      kalekseev
-    ];
-  };
-}
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 4a780d34ff46..de384b3ad805 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -10,7 +10,6 @@
   versionCheckHook,
 
   # passthru
-  ruff-lsp,
   nixosTests,
   nix-update-script,
 }:
@@ -70,13 +69,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doInstallCheck = true;
 
   passthru = {
-    tests =
-      {
-        inherit ruff-lsp;
-      }
-      // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-        nixos-test-driver-busybox = nixosTests.nixos-test-driver.busybox;
-      };
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      nixos-test-driver-busybox = nixosTests.nixos-test-driver.busybox;
+    };
     updateScript = nix-update-script { };
   };
 
diff --git a/pkgs/by-name/ry/ryubing/package.nix b/pkgs/by-name/ry/ryubing/package.nix
index 68e8353bd1f8..a3f1951ef483 100644
--- a/pkgs/by-name/ry/ryubing/package.nix
+++ b/pkgs/by-name/ry/ryubing/package.nix
@@ -143,7 +143,7 @@ buildDotnetModule rec {
     maintainers = with maintainers; [
       jk
       artemist
-      kekschen
+      willow
     ];
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/sd/SDL2_image/package.nix b/pkgs/by-name/sd/SDL2_image/package.nix
index 2672f76d3f8b..6baa7311a5c2 100644
--- a/pkgs/by-name/sd/SDL2_image/package.nix
+++ b/pkgs/by-name/sd/SDL2_image/package.nix
@@ -14,6 +14,7 @@
   stdenv,
   zlib,
   # Boolean flags
+  enableSTB ? true,
   ## Darwin headless will hang when trying to run the SDL test program
   enableSdltest ? (!stdenv.hostPlatform.isDarwin),
 }:
@@ -36,16 +37,17 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs = [
-    SDL2
-    giflib
-    libXpm
-    libjpeg
-    libpng
-    libtiff
-    libwebp
-    zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
+  buildInputs =
+    [
+      SDL2
+      libtiff
+      libwebp
+      zlib
+    ]
+    ++ lib.optionals (!enableSTB) [
+      libjpeg
+      libpng
+    ];
 
   configureFlags =
     [
@@ -54,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.enableFeature false "png-shared")
       (lib.enableFeature false "tif-shared")
       (lib.enableFeature false "webp-shared")
+      (lib.enableFeature enableSTB "stb-image")
       (lib.enableFeature enableSdltest "sdltest")
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/sd/SDL2_image_2_0/package.nix b/pkgs/by-name/sd/SDL2_image_2_0/package.nix
deleted file mode 100644
index 4897ff5ad44a..000000000000
--- a/pkgs/by-name/sd/SDL2_image_2_0/package.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-# Dependency of pygame, toppler
-{ SDL2_image, fetchurl }:
-
-SDL2_image.overrideAttrs (oldAttrs: {
-  version = "2.0.5";
-  src = fetchurl {
-    inherit (oldAttrs.src) url;
-    hash = "sha256-vdX24CZoL31+G+C2BRsgnaL0AqLdi9HEvZwlrSYxCNA";
-  };
-
-  postPatch =
-    (oldAttrs.postPatch or "")
-    + ''
-      # allow newer autoreconf to run successfully
-      touch NEWS README AUTHORS ChangeLog
-    '';
-})
diff --git a/pkgs/by-name/ti/timewarrior/package.nix b/pkgs/by-name/ti/timewarrior/package.nix
index 054a32860248..a525b591c614 100644
--- a/pkgs/by-name/ti/timewarrior/package.nix
+++ b/pkgs/by-name/ti/timewarrior/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "timewarrior";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "GothenburgBitFactory";
     repo = "timewarrior";
     rev = "v${version}";
-    hash = "sha256-sc4AfdXLuA9evoGU6Z97+Hq7zj9nx093+nPALRkhziQ=";
+    hash = "sha256-6WZ5k9cxWe+eS9me700ITq0rKEiIuDhTtmuzhOnUM4k=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/tr/trilium-next-desktop/package.nix b/pkgs/by-name/tr/trilium-next-desktop/package.nix
index 584b271af68e..dae3d5de6729 100644
--- a/pkgs/by-name/tr/trilium-next-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-next-desktop/package.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-next-desktop";
-  version = "0.92.7";
+  version = "0.93.0";
 
   triliumSource = os: arch: sha256: {
     url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-${os}-${arch}.zip";
@@ -26,10 +26,10 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.sha256 = "0m907hc7bvamkvijsbxqg6ns7dv7qz02d5fsl6wgqx5vi6w02y9w";
-  aarch64-linux.sha256 = "1hb3sjkzz3d9vrjramz47l4aqqm7ah2k7a9s14csxllcjqjmv8nz";
-  x86_64-darwin.sha256 = "0qscjw2j0nyxvx9w6m4n9yb30wzk5xmg7ylf8yp0k58jxvi7b87q";
-  aarch64-darwin.sha256 = "1ah25g41x7kpjvwih59mfcf2lylwppdklrmmm1s1p2fn4261jds4";
+  x86_64-linux.sha256 = "02cz98bgv8l5c96irmxla93h9vpxpfh2l25q5h4r1wcyg00k0gqc";
+  aarch64-linux.sha256 = "0ahkskdaggff34zn6ml8s3v3ig8fq3isrcrckpvy9acyhk2nm924";
+  x86_64-darwin.sha256 = "0p1db3bij5pipwjjh0vyscvd6anq1qriny7y7yxx2sviksgyl0i8";
+  aarch64-darwin.sha256 = "0fkqlxssrdz2g63yhs1l74h037xac04y3dng7kqnrzhn740p2wjc";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.sha256;
diff --git a/pkgs/by-name/tr/trilium-next-server/package.nix b/pkgs/by-name/tr/trilium-next-server/package.nix
index 2ee833043e27..1c7fb0d25739 100644
--- a/pkgs/by-name/tr/trilium-next-server/package.nix
+++ b/pkgs/by-name/tr/trilium-next-server/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.92.7";
+  version = "0.93.0";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.sha256 = "0ckwfk27wfskd8pk5blvcvn6pd4jmq0dys283gsqk271n8ca4537";
+  serverSource_x64.sha256 = "0gm0j8w16ynwb1rsgxd7g4pa4vm47728d8393bazppxgf91gnh3d";
   serverSource_arm64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.sha256 = "1lk0mf4h74d9z1w5jdfwbxsdh1mbbjr6gx0q0w0wg6y3ylyjcii9";
+  serverSource_arm64.sha256 = "0in1y3zsx4mni02lq17q0camn07p7fngl1qjmjnhkps7pr799d2q";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then
diff --git a/pkgs/by-name/ul/ultrastardx/package.nix b/pkgs/by-name/ul/ultrastardx/package.nix
index 11804121cc81..5e903092fc25 100644
--- a/pkgs/by-name/ul/ultrastardx/package.nix
+++ b/pkgs/by-name/ul/ultrastardx/package.nix
@@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ultrastardx";
-  version = "2025.3.0";
+  version = "2025.4.0";
 
   src = fetchFromGitHub {
     owner = "UltraStar-Deluxe";
     repo = "USDX";
     rev = "v${version}";
-    hash = "sha256-tMYw+nkyEEK7AqG9AvMchCGzzKWlfut4poXc1WK6vkA=";
+    hash = "sha256-Ymz4RwPJCGV8HW5pXBIitiQmTMPGH6qLVLpCa7N3EMg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/up/update-python-libraries/package.nix b/pkgs/by-name/up/update-python-libraries/package.nix
index 46e0e3b7f772..0bf7b9b697ee 100644
--- a/pkgs/by-name/up/update-python-libraries/package.nix
+++ b/pkgs/by-name/up/update-python-libraries/package.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   python3,
   runCommand,
   git,
@@ -9,8 +10,6 @@
 runCommand "update-python-libraries"
   {
     buildInputs = [
-      nix
-      nix-prefetch-git
       (python3.withPackages (
         ps: with ps; [
           packaging
@@ -18,11 +17,14 @@ runCommand "update-python-libraries"
           toolz
         ]
       ))
-      git
     ];
   }
   ''
     cp ${./update-python-libraries.py} $out
     patchShebangs $out
-    substituteInPlace $out --replace 'GIT = "git"' 'GIT = "${git}/bin/git"'
+    substituteInPlace $out \
+      --replace-fail 'NIX = "nix"' 'NIX = "${lib.getExe nix}"' \
+      --replace-fail 'NIX_PREFETCH_URL = "nix-prefetch-url"' 'NIX_PREFETCH_URL = "${lib.getExe' nix "nix-prefetch-url"}"' \
+      --replace-fail 'NIX_PREFETCH_GIT = "nix-prefetch-git"' 'NIX_PREFETCH_GIT = "${lib.getExe nix-prefetch-git}"' \
+      --replace-fail 'GIT = "git"' 'GIT = "${lib.getExe git}"'
   ''
diff --git a/pkgs/by-name/up/update-python-libraries/update-python-libraries.py b/pkgs/by-name/up/update-python-libraries/update-python-libraries.py
index 6ee3d05c3465..0c8f81c763f6 100755
--- a/pkgs/by-name/up/update-python-libraries/update-python-libraries.py
+++ b/pkgs/by-name/up/update-python-libraries/update-python-libraries.py
@@ -36,10 +36,13 @@ PRERELEASES = False
 
 BULK_UPDATE = False
 
+NIX = "nix"
+NIX_PREFETCH_URL = "nix-prefetch-url"
+NIX_PREFETCH_GIT = "nix-prefetch-git"
 GIT = "git"
 
 NIXPKGS_ROOT = (
-    subprocess.check_output(["git", "rev-parse", "--show-toplevel"])
+    subprocess.check_output([GIT, "rev-parse", "--show-toplevel"])
     .decode("utf-8")
     .strip()
 )
@@ -79,7 +82,7 @@ def _get_attr_value(attr_path: str) -> Optional[Any]:
     try:
         response = subprocess.check_output(
             [
-                "nix",
+                NIX,
                 "--extra-experimental-features",
                 "nix-command",
                 "eval",
@@ -164,7 +167,7 @@ def _hash_to_sri(algorithm, value):
     return (
         subprocess.check_output(
             [
-                "nix",
+                NIX,
                 "--extra-experimental-features",
                 "nix-command",
                 "hash",
@@ -260,7 +263,7 @@ def _get_latest_version_github(attr_path, package, extension, current_version, t
     try:
         homepage = subprocess.check_output(
             [
-                "nix",
+                NIX,
                 "--extra-experimental-features",
                 "nix-command",
                 "eval",
@@ -301,7 +304,7 @@ def _get_latest_version_github(attr_path, package, extension, current_version, t
 
         algorithm = "sha256"
         cmd = [
-            "nix-prefetch-git",
+            NIX_PREFETCH_GIT,
             f"https://github.com/{owner}/{repo}.git",
             "--hash",
             algorithm,
@@ -317,7 +320,7 @@ def _get_latest_version_github(attr_path, package, extension, current_version, t
             hash = (
                 subprocess.check_output(
                     [
-                        "nix-prefetch-url",
+                        NIX_PREFETCH_URL,
                         "--type",
                         "sha256",
                         "--unpack",
@@ -336,7 +339,7 @@ def _get_latest_version_github(attr_path, package, extension, current_version, t
             try:
                 hash = (
                     subprocess.check_output(
-                        ["nix-prefetch-url", "--type", "sha256", "--unpack", tag_url],
+                        [NIX_PREFETCH_URL, "--type", "sha256", "--unpack", tag_url],
                         stderr=subprocess.DEVNULL,
                     )
                     .decode("utf-8")
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index 08eff3ae9e67..cbf965f8d0bc 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -155,6 +155,7 @@ python.pkgs.buildPythonApplication rec {
   pythonRelaxDeps = [
     "celery"
     "rapidfuzz"
+    "weblate-schemas"
   ];
 
   # We don't just use wrapGAppsNoGuiHook because we need to expose GI_TYPELIB_PATH
diff --git a/pkgs/by-name/wi/winbox4/package.nix b/pkgs/by-name/wi/winbox4/package.nix
index 8c2a74aa6af7..3a6b335969d7 100644
--- a/pkgs/by-name/wi/winbox4/package.nix
+++ b/pkgs/by-name/wi/winbox4/package.nix
@@ -18,12 +18,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "winbox";
-  version = "4.0beta16";
+  version = "4.0beta18";
 
   src = fetchurl {
     name = "WinBox_Linux-${finalAttrs.version}.zip";
     url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/WinBox_Linux.zip";
-    hash = "sha256-RZpsKew3BaId6+tcwUV6fniUpCH4wIP9ab6P5oE7OAk=";
+    hash = "sha256-Eyvp1hCdYlyGQw+kQOZ4O2CdAMaI75GU4Uucp7RwY+0=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/development/libraries/protobuf/23.nix b/pkgs/development/libraries/protobuf/23.nix
deleted file mode 100644
index e92e418c3186..000000000000
--- a/pkgs/development/libraries/protobuf/23.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ callPackage, ... }@args:
-
-callPackage ./generic.nix (
-  {
-    version = "23.4";
-    hash = "sha256-eI+mrsZAOLEsdyTC3B+K+GjD3r16CmPx1KJ2KhCwFdg=";
-  }
-  // args
-)
diff --git a/pkgs/development/python-modules/equinox/default.nix b/pkgs/development/python-modules/equinox/default.nix
index 0b99125f4fc1..e6b3f9f6f108 100644
--- a/pkgs/development/python-modules/equinox/default.nix
+++ b/pkgs/development/python-modules/equinox/default.nix
@@ -56,10 +56,16 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
-    # SystemError: nanobind::detail::nb_func_error_except(): exception could not be translated!
-    "test_filter"
-  ];
+  disabledTests =
+    [
+      # AssertionError: assert '<function te...n.<locals>.f>' == '<function f>'
+      # https://github.com/patrick-kidger/equinox/issues/1008
+      "test_function"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # SystemError: nanobind::detail::nb_func_error_except(): exception could not be translated!
+      "test_filter"
+    ];
 
   pythonImportsCheck = [ "equinox" ];
 
diff --git a/pkgs/development/python-modules/granian/default.nix b/pkgs/development/python-modules/granian/default.nix
index a208a090471d..de15cffd2dd5 100644
--- a/pkgs/development/python-modules/granian/default.nix
+++ b/pkgs/development/python-modules/granian/default.nix
@@ -19,19 +19,19 @@
 
 buildPythonPackage rec {
   pname = "granian";
-  version = "2.2.4";
+  version = "2.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emmett-framework";
     repo = "granian";
     tag = "v${version}";
-    hash = "sha256-DZFTQLZx+p2SoR1/7atAqxjVqDGgJBkz3fmXGF0iojA=";
+    hash = "sha256-fToH8sKh0M75D9YuyqkMEqY+cQio1NUmYdk/TEGy3fk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-4MwIQTjS+SH0d+wPB4wfRXzo3f8CBMOAUy/3tf2uXYo=";
+    hash = "sha256-ThH4sk3yLvR9bklosUhCbklkcbpLW/5I1ukBNxUyqr8=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/linuxpy/default.nix b/pkgs/development/python-modules/linuxpy/default.nix
index d87bce2598b7..8668b3a1b288 100644
--- a/pkgs/development/python-modules/linuxpy/default.nix
+++ b/pkgs/development/python-modules/linuxpy/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     description = "Human friendly interface to Linux subsystems using Python";
     homepage = "https://github.com/tiagocoutinho/linuxpy";
     license = licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ kekschen ];
+    maintainers = with lib.maintainers; [ willow ];
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/development/python-modules/neo/default.nix b/pkgs/development/python-modules/neo/default.nix
index 27e9c1b5e8d4..170805c655c3 100644
--- a/pkgs/development/python-modules/neo/default.nix
+++ b/pkgs/development/python-modules/neo/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "neo";
-  version = "0.14.0";
+  version = "0.14.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "NeuralEnsemble";
     repo = "python-neo";
     tag = version;
-    hash = "sha256-lLs70BsbFxTmd/qR0EqsceG+fAKI1P+em5Ix2kM9w/w=";
+    hash = "sha256-n0+K1J6K3WYN+1LxcHoVuA+U3LeiRG0EsicJf5uKvnE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pygame-ce/default.nix b/pkgs/development/python-modules/pygame-ce/default.nix
index 649c72c0be2a..3f0c7e30b98c 100644
--- a/pkgs/development/python-modules/pygame-ce/default.nix
+++ b/pkgs/development/python-modules/pygame-ce/default.nix
@@ -19,7 +19,7 @@
   libpng,
   libX11,
   portmidi,
-  SDL2,
+  SDL2_classic,
   SDL2_image,
   SDL2_mixer,
   SDL2_ttf,
@@ -60,8 +60,6 @@ buildPythonPackage rec {
         ]) buildInputs
       );
     })
-    # Skip tests that should be disabled without video driver
-    ./skip-surface-tests.patch
   ];
 
   postPatch =
@@ -101,8 +99,8 @@ buildPythonPackage rec {
     libjpeg
     libpng
     portmidi
-    SDL2
-    SDL2_image
+    SDL2_classic
+    (SDL2_image.override { enableSTB = false; })
     SDL2_mixer
     SDL2_ttf
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
@@ -117,7 +115,7 @@ buildPythonPackage rec {
 
   env =
     {
-      SDL_CONFIG = lib.getExe' (lib.getDev SDL2) "sdl2-config";
+      SDL_CONFIG = lib.getExe' (lib.getDev SDL2_classic) "sdl2-config";
     }
     // lib.optionalAttrs stdenv.cc.isClang {
       NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
diff --git a/pkgs/development/python-modules/pygame-ce/skip-surface-tests.patch b/pkgs/development/python-modules/pygame-ce/skip-surface-tests.patch
deleted file mode 100644
index 21d9c9060f3b..000000000000
--- a/pkgs/development/python-modules/pygame-ce/skip-surface-tests.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/test/surface_test.py b/test/surface_test.py
-index 5ce78b6e..8b8f7ed5 100644
---- a/test/surface_test.py
-+++ b/test/surface_test.py
-@@ -1091,6 +1091,10 @@ class GeneralSurfaceTests(unittest.TestCase):
-         finally:
-             pygame.display.quit()
- 
-+    @unittest.skipIf(
-+        os.environ.get("SDL_VIDEODRIVER") == "dummy",
-+        'requires a non-"dummy" SDL_VIDEODRIVER',
-+    )
-     def test_convert_init(self):
-         """Ensure initialization exceptions are raised
-         for surf.convert()."""
-@@ -1118,6 +1122,10 @@ class GeneralSurfaceTests(unittest.TestCase):
-         finally:
-             pygame.display.quit()
- 
-+    @unittest.skipIf(
-+        os.environ.get("SDL_VIDEODRIVER") == "dummy",
-+        'requires a non-"dummy" SDL_VIDEODRIVER',
-+    )
-     def test_convert_alpha_init(self):
-         """Ensure initialization exceptions are raised
-         for surf.convert_alpha()."""
diff --git a/pkgs/development/python-modules/pygame/default.nix b/pkgs/development/python-modules/pygame/default.nix
index f549bffc1d3b..bb595909e5c9 100644
--- a/pkgs/development/python-modules/pygame/default.nix
+++ b/pkgs/development/python-modules/pygame/default.nix
@@ -87,7 +87,7 @@ buildPythonPackage rec {
     libX11
     portmidi
     SDL2_classic
-    SDL2_image
+    (SDL2_image.override { enableSTB = false; })
     SDL2_mixer
     SDL2_ttf
   ];
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index 7a64582d6058..0a63afaf7fa8 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "pymc-devs";
     repo = "pytensor";
     tag = "rel-${version}";
-    hash = "sha256-Tsu+q3PeJSIVdW5wRB1RRk4oolXpj58ZbBQ20gaHJ7o=";
+    hash = "sha256-Iyiuvt86pfz8MmpwgDecKJFVOw+fKpEaA9m1MBA9Yxs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/python-codon-tables/default.nix b/pkgs/development/python-modules/python-codon-tables/default.nix
index ded3d5103f2d..af0e275321d1 100644
--- a/pkgs/development/python-modules/python-codon-tables/default.nix
+++ b/pkgs/development/python-modules/python-codon-tables/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "python-codon-tables";
-  version = "0.1.13";
+  version = "0.1.15";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "python_codon_tables";
     inherit version;
-    hash = "sha256-3PQLBgZJjefCOrh+PHbaViy4VwZGR68mkwC58usi51o=";
+    hash = "sha256-bK0Y8y5W6xmtGeRUtLDGsg1voVKp1uU37tBqi0/raLY=";
   };
 
   # no tests in tarball
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 10e2d252dc21..da0e9394e585 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.6.6";
+  version = "4.6.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mikedh";
     repo = "trimesh";
     tag = version;
-    hash = "sha256-A/obsrJIItNszMleMP1kkysSVdiFV2WxKTmYG+g1nks=";
+    hash = "sha256-ut5wCEjhC4h299TJufBOmWZHtu24Ve/BsgMaNpRDAPg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/wadler-lindig/default.nix b/pkgs/development/python-modules/wadler-lindig/default.nix
index 8946220eed50..e9e801455661 100644
--- a/pkgs/development/python-modules/wadler-lindig/default.nix
+++ b/pkgs/development/python-modules/wadler-lindig/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "wadler-lindig";
-  version = "0.1.4";
+  version = "0.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "patrick-kidger";
     repo = "wadler_lindig";
     tag = "v${version}";
-    hash = "sha256-ykRyJ5kCxYb3jBb8/8ogGjpgXMcb/mvvvHaSy9fecxA=";
+    hash = "sha256-owqtKooc7b7RRJglDC5K5M88pxAepHRr+lZCsOOzw7E=";
   };
 
   build-system = [
@@ -37,7 +37,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    description = "A Wadler--Lindig pretty printer for Python";
+    description = "Wadler--Lindig pretty printer for Python";
     homepage = "https://github.com/patrick-kidger/wadler_lindig";
     changelog = "https://github.com/patrick-kidger/wadler_lindig/releases/tag/v${version}";
     license = lib.licenses.asl20;
diff --git a/pkgs/development/python-modules/weblate-schemas/default.nix b/pkgs/development/python-modules/weblate-schemas/default.nix
index b08c60fe350d..ac974171355b 100644
--- a/pkgs/development/python-modules/weblate-schemas/default.nix
+++ b/pkgs/development/python-modules/weblate-schemas/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "weblate-schemas";
-  version = "2024.2";
+  version = "2025.1";
 
   pyproject = true;
 
   src = fetchPypi {
     pname = "weblate_schemas";
     inherit version;
-    hash = "sha256-Y7hWqfv1gZ2sT2fNbWLVDzwbVdB/1rT/oND9p/mkYAs=";
+    hash = "sha256-R2G5s51XmZfc3qewNGv5D9K03pvCFeod4RH4VtY9cAA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/misc/documentation-highlighter/mono-blue.css b/pkgs/misc/documentation-highlighter/mono-blue.css
index bc9bceae4b10..44b546b8d207 100644
--- a/pkgs/misc/documentation-highlighter/mono-blue.css
+++ b/pkgs/misc/documentation-highlighter/mono-blue.css
@@ -1,17 +1,17 @@
 pre code.hljs {
-  display: block;
-  overflow-x: auto;
-  padding: 1em
+    display: block;
+    overflow-x: auto;
+    padding: 1em;
 }
 code.hljs {
-  padding: 3px 5px
+    padding: 3px 5px;
 }
 /*
   Five-color theme from a single blue hue.
 */
 .hljs {
-  background: #eaeef3;
-  color: #00193a
+    background: #eaeef3;
+    color: #00193a;
 }
 .hljs-keyword,
 .hljs-selector-tag,
@@ -20,10 +20,10 @@ code.hljs {
 .hljs-doctag,
 .hljs-name,
 .hljs-strong {
-  font-weight: bold
+    font-weight: bold;
 }
 .hljs-comment {
-  color: #738191
+    color: var(--color-1);
 }
 .hljs-string,
 .hljs-title,
@@ -37,7 +37,7 @@ code.hljs {
 .hljs-name,
 .hljs-selector-id,
 .hljs-selector-class {
-  color: #0048ab
+    color: var(--color-2);
 }
 .hljs-meta,
 .hljs-subst,
@@ -49,8 +49,22 @@ code.hljs {
 .hljs-template-variable,
 .hljs-link,
 .hljs-bullet {
-  color: #4c81c9
+    color: var(--color-3);
 }
 .hljs-emphasis {
-  font-style: italic
-}
\ No newline at end of file
+    font-style: italic;
+}
+
+:root {
+    --color-1: #738191;
+    --color-2: #0048ab;
+    --color-3: #4c81c9;
+}
+
+@media (prefers-color-scheme: dark) {
+    :root {
+        --color-1: #8b9caf;
+        --color-2: #3b85e7;
+        --color-3: #5795e7;
+    }
+}
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index c19590b6ea77..579706e1afa0 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -14,13 +14,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.19.2";
+  version = "2.19.3";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-H46lhvM6rA9J4nLRLeFArCc7tqmVmpWztsGFAboSM0k=";
+    hash = "sha256-CMK9snkMXsXqmq3f1hTDYCduL0arwM7XyIg4xq6UfR8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
index 040535f63ed8..8c88fcb6bb30 100644
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@@ -49,6 +49,7 @@ let
         description = "Script used to obtain source hashes for fetch${tool}";
         maintainers = with maintainers; [ bennofs ];
         platforms = platforms.unix;
+        mainProgram = "nix-prefetch-${tool}";
       };
     };
 in
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 566df1693f5f..efce987e47f3 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1470,6 +1470,7 @@ mapAliases {
   prometheus-openldap-exporter = throw "'prometheus-openldap-exporter' has been removed from nixpkgs, as it was unmaintained"; # Added 2024-09-01
   prometheus-minio-exporter = throw "'prometheus-minio-exporter' has been removed from nixpkgs, use Minio's built-in Prometheus integration instead"; # Added 2024-06-10
   prometheus-tor-exporter = throw "'prometheus-tor-exporter' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-10-30
+  protobuf_23 = throw "'protobuf_23' has been removed from nixpkgs. Consider using a more recent version of the protobuf library"; # Added 2025-04-20
   protobuf3_24 = protobuf_24;
   protobuf3_23 = protobuf_23;
   protobuf3_21 = protobuf_21;
@@ -1569,6 +1570,7 @@ mapAliases {
   SDL_classic = SDL1; # Added 2024-09-03
   SDL1 = throw "'SDL1' has been removed as development ended long ago with SDL 2.0 replacing it, use SDL_compat instead"; # Added 2025-03-27
   SDL_gpu = throw "'SDL_gpu' has been removed due to lack of upstream maintenance and known users"; # Added 2025-03-15
+  SDL_image_2_0 = throw "'SDL_image_2_0' has been removed in favor of the latest version"; # Added 2025-04-20
   s2n = throw "'s2n' has been renamed to/replaced by 's2n-tls'"; # Converted to throw 2024-10-17
   sandboxfs = throw "'sandboxfs' has been removed due to being unmaintained, consider using linux namespaces for sandboxing instead"; # Added 2024-06-06
   sane-backends-git = throw "'sane-backends-git' has been renamed to/replaced by 'sane-backends'"; # Converted to throw 2024-10-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2cc78d7b1dfe..44c912ee8e48 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10872,9 +10872,6 @@ with pkgs;
       protobuf_26 = callPackage ../development/libraries/protobuf/26.nix { };
       protobuf_25 = callPackage ../development/libraries/protobuf/25.nix { };
       protobuf_24 = callPackage ../development/libraries/protobuf/24.nix { };
-      protobuf_23 = callPackage ../development/libraries/protobuf/23.nix {
-        abseil-cpp = abseil-cpp_202301;
-      };
       protobuf_21 = callPackage ../development/libraries/protobuf/21.nix {
         abseil-cpp = abseil-cpp_202103;
       };
@@ -10885,7 +10882,6 @@ with pkgs;
     protobuf_26
     protobuf_25
     protobuf_24
-    protobuf_23
     protobuf_21
     ;
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 44cef4e10582..ba96df2c36e6 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -683,7 +683,7 @@ mapAliases ({
   ruamel_base = ruamel-base; # added 2021-11-01
   ruamel_yaml = ruamel-yaml; # added 2021-11-01
   ruamel_yaml_clib = ruamel-yaml-clib; # added 2021-11-01
-  inherit (super.pkgs) ruff-lsp; # added 2023-06-23
+  ruff-lsp = throw "ruff-lsp has been deprecated, use `ruff server` instead"; # added 2025-04-21
   runway-python = throw "SDK has been deprecated and was archived by upstream"; # added 2023-05-03
   safe = throw "safe has been removed, it was unmaintained sinced October 2019"; # added 2024-07-28
   sampledata = throw "sampledata has been removed, it was unmaintained since 2017"; # added 2024-07-27
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 87d90812d817..ebcbb4eefda6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12278,11 +12278,10 @@ self: super: with self; {
 
   pygal = callPackage ../development/python-modules/pygal { };
 
-  pygame = callPackage ../development/python-modules/pygame { SDL2_image = pkgs.SDL2_image_2_0; };
+  pygame = callPackage ../development/python-modules/pygame { };
 
   pygame-ce = callPackage ../development/python-modules/pygame-ce {
     inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
-    SDL2_image = pkgs.SDL2_image_2_0;
     SDL2_mixer = pkgs.SDL2_mixer_2_0;
   };