diff --git a/.gitattributes b/.gitattributes
index 32cd96ef9e2c..6f006049e92d 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -18,3 +18,28 @@ nixos/modules/module-list.nix merge=union
 # pkgs/top-level/all-packages.nix merge=union
 
 ci/OWNERS linguist-language=CODEOWNERS
+
+# Avoid munging line endings when using Git for Windows, and instead keep files
+# using LF line endings.  This particularly affects scripts committed in the
+# nixpkgs repository.
+#
+# - `text` without `=auto` would mean "Git should always munge line endings on
+#   this file so there will never be a CRLF in the repository, and the line
+#   endings in the working directory should respect the local Git
+#   configuration."
+# - `text=auto` means "Git should try to work out if this file is a text file.
+#   If it is, it should do the line-ending munging as for `text`, and if it
+#   isn't, it should leave the file alone."
+# - `eol=lf` means "Ignore any local configuration about how line
+#   endings normally work on this platform. This file should always and only
+#   have LF line endings in the repo (so if there's a CR in the repo, it's
+#   meant to be there in addition to any end-of-line mark), and the selected
+#   attribute is how the file should appear in the working directory."
+#
+# See https://github.com/NixOS/nixpkgs/issues/423762 for historical context.
+* text=auto eol=lf
+
+# Don't force LF line endings for diff/patch files, as they might be correctly
+# patching CRLF line endings from an upstream source package.
+*.diff !text !eol
+*.patch !text !eol
diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 5807f8ef52f7..81eebcc9adb1 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -122,7 +122,8 @@ let
 in
 runCommand "compare"
   {
-    nativeBuildInputs = [
+    # Don't depend on -dev outputs to reduce closure size for CI.
+    nativeBuildInputs = map lib.getBin [
       jq
       (python3.withPackages (
         ps: with ps; [
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 21285757a277..2b7f59ae6b43 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -14,10 +14,9 @@
   runCommand,
   writeShellScript,
   symlinkJoin,
-  time,
-  procps,
-  nix,
+  busybox,
   jq,
+  nix,
 }:
 
 let
@@ -48,9 +47,10 @@ let
     runCommand "attrpaths-superset.json"
       {
         src = nixpkgs;
-        nativeBuildInputs = [
+        # Don't depend on -dev outputs to reduce closure size for CI.
+        nativeBuildInputs = map lib.getBin [
+          busybox
           nix
-          time
         ];
       }
       ''
@@ -72,11 +72,11 @@ let
       # The system to evaluate.
       # Note that this is intentionally not called `system`,
       # because `--argstr system` would only be passed to the ci/default.nix file!
-      evalSystem,
+      evalSystem ? builtins.currentSystem,
       # The path to the `paths.json` file from `attrpathsSuperset`
       attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
       # The number of attributes per chunk, see ./README.md for more info.
-      chunkSize,
+      chunkSize ? 5000,
       checkMeta ? true,
 
       # Don't try to eval packages marked as broken.
@@ -131,11 +131,11 @@ let
     in
     runCommand "nixpkgs-eval-${evalSystem}"
       {
-        nativeBuildInputs = [
-          nix
-          time
-          procps
+        # Don't depend on -dev outputs to reduce closure size for CI.
+        nativeBuildInputs = map lib.getBin [
+          busybox
           jq
+          nix
         ];
         env = {
           inherit evalSystem chunkSize;
@@ -160,14 +160,14 @@ let
         # Record and print stats on free memory and swap in the background
         (
           while true; do
-            availMemory=$(free -b | grep Mem | awk '{print $7}')
-            freeSwap=$(free -b | grep Swap | awk '{print $4}')
-            echo "Available memory: $(( availMemory / 1024 / 1024 )) MiB, free swap: $(( freeSwap / 1024 / 1024 )) MiB"
+            availMemory=$(free -m | grep Mem | awk '{print $7}')
+            freeSwap=$(free -m | grep Swap | awk '{print $4}')
+            echo "Available memory: $(( availMemory )) MiB, free swap: $(( freeSwap )) MiB"
 
             if [[ ! -f "$out/${evalSystem}/min-avail-memory" ]] || (( availMemory < $(<$out/${evalSystem}/min-avail-memory) )); then
               echo "$availMemory" > $out/${evalSystem}/min-avail-memory
             fi
-            if [[ ! -f $out/${evalSystem}/min-free-swap ]] || (( availMemory < $(<$out/${evalSystem}/min-free-swap) )); then
+            if [[ ! -f $out/${evalSystem}/min-free-swap ]] || (( freeSwap < $(<$out/${evalSystem}/min-free-swap) )); then
               echo "$freeSwap" > $out/${evalSystem}/min-free-swap
             fi
             sleep 4
@@ -206,7 +206,8 @@ let
     }:
     runCommand "combined-eval"
       {
-        nativeBuildInputs = [
+        # Don't depend on -dev outputs to reduce closure size for CI.
+        nativeBuildInputs = map lib.getBin [
           jq
         ];
       }
diff --git a/nixos/modules/services/security/hockeypuck.nix b/nixos/modules/services/security/hockeypuck.nix
index 4352241a1ae9..5bfe2a5c1328 100644
--- a/nixos/modules/services/security/hockeypuck.nix
+++ b/nixos/modules/services/security/hockeypuck.nix
@@ -10,7 +10,7 @@ let
   settingsFormat = pkgs.formats.toml { };
 in
 {
-  meta.maintainers = with lib.maintainers; [ etu ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   options.services.hockeypuck = {
     enable = lib.mkEnableOption "Hockeypuck OpenPGP Key Server";
diff --git a/nixos/tests/hockeypuck.nix b/nixos/tests/hockeypuck.nix
index d1b5037fbe26..f1609087ac66 100644
--- a/nixos/tests/hockeypuck.nix
+++ b/nixos/tests/hockeypuck.nix
@@ -25,7 +25,7 @@ let
 in
 {
   name = "hockeypuck";
-  meta.maintainers = with lib.maintainers; [ etu ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes.machine =
     { ... }:
diff --git a/nixos/tests/jackett.nix b/nixos/tests/jackett.nix
index 9ce8209f49dd..77f05a6bad76 100644
--- a/nixos/tests/jackett.nix
+++ b/nixos/tests/jackett.nix
@@ -5,7 +5,7 @@ let
 in
 {
   name = "jackett";
-  meta.maintainers = with lib.maintainers; [ etu ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/nixos/tests/lidarr.nix b/nixos/tests/lidarr.nix
index 8f32ce14673f..ee6dd83f38aa 100644
--- a/nixos/tests/lidarr.nix
+++ b/nixos/tests/lidarr.nix
@@ -2,7 +2,7 @@
 
 {
   name = "lidarr";
-  meta.maintainers = with lib.maintainers; [ etu ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/nixos/tests/radarr.nix b/nixos/tests/radarr.nix
index 00949dcc7695..dfdf23582354 100644
--- a/nixos/tests/radarr.nix
+++ b/nixos/tests/radarr.nix
@@ -2,7 +2,7 @@
 
 {
   name = "radarr";
-  meta.maintainers = with lib.maintainers; [ etu ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/nixos/tests/sonarr.nix b/nixos/tests/sonarr.nix
index 44dcaf3c893a..7205a5f640ef 100644
--- a/nixos/tests/sonarr.nix
+++ b/nixos/tests/sonarr.nix
@@ -2,7 +2,7 @@
 
 {
   name = "sonarr";
-  meta.maintainers = with lib.maintainers; [ etu ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 9b2c1ee89478..85ef3908b0fd 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = pname;
-  version = "142.0b3";
+  version = "142.0b8";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "707781fcc59798c0ecbf11532eac41f4f134f24b1d670234cf674e433525ca83fe4fff75874d1a16d2be2039959731e71a5aa56e727d2b46e5bc40f63277b188";
+    sha512 = "048325c583dc3c6716be3fcb9d793448ab6e2b18b7b5f7d6aafa76cbc9e790489f7cd59644ded4b7e7929e19021e04b21e5d11c298057bb60fe018a791494ce8";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index e93b0cfff180..50d327a69b93 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = pname;
-  version = "142.0b3";
+  version = "142.0b8";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "5752c77307e59ad188385bb7bbb440e01a256f437088e051d1bc74e0ccdbde4ddf68c97fdcf0401c03636293753c5e8f7132352aed5f5e9e537c96eaf8784f21";
+    sha512 = "a5a89cdbfe3e05e6d329011476d571625094546e0eb2bea4f4ce426fd8d6ce23ce51ce19fd0a4d44ea7cb134d3f6c1510dcc1403d6aab5981862845a250c9dae";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
diff --git a/pkgs/by-name/ca/cargo-edit/package.nix b/pkgs/by-name/ca/cargo-edit/package.nix
index ed49120217b9..00cb3e0e06aa 100644
--- a/pkgs/by-name/ca/cargo-edit/package.nix
+++ b/pkgs/by-name/ca/cargo-edit/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-edit";
-  version = "0.13.6";
+  version = "0.13.7";
 
   src = fetchFromGitHub {
     owner = "killercup";
     repo = "cargo-edit";
     rev = "v${version}";
-    hash = "sha256-z+LTgCeTUr3D0LEbw0yHlk1di2W95XewbYlgusD2TLg=";
+    hash = "sha256-doNQzXB+tW+5UI3PCuZo8aZErsXeafL6lldi/yXyBhs=";
   };
 
-  cargoHash = "sha256-/+DDA64kemZKzKdaKnXK+R4e8FV59qT5HCGcwyOz7R8=";
+  cargoHash = "sha256-N3Q3rK9GsVf9mI9SFqF7lnU8CWxmueDCgBjP6n9dUoY=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 89a9bbd637d2..cb8e32a0263f 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.71"
+        "@anthropic-ai/claude-code": "^1.0.72"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.71",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.71.tgz",
-      "integrity": "sha512-2Z1HU8TiOSRZSZdHCPs+ih942cteUQ9Yx1EHHW5fO9y+gwxPYDR8Xbh/rAJMl/G58cJIn2jRiZmkWcGMN+Iqqg==",
+      "version": "1.0.72",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.72.tgz",
+      "integrity": "sha512-nA/l/xKX4sgOE0Y6P3o6czNGQqlyqJPjs9CHFxantsmyKvOot9VlRW4AiEAn42hQrZReCXeSnt8LOMx9ev7Erg==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index e4dab3449ef5..b7685095154a 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.71";
+  version = "1.0.72";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-ZJUvscbEaWHILL77R5/sPdNcxCLc2BL9P6tR+S7QnHg=";
+    hash = "sha256-1vIElqZ5sk62o1amdfOqhmSG4B5wzKWDLcCgvQO4a5o=";
   };
 
-  npmDepsHash = "sha256-wQ/DRPefziSRv6aFZXRpmz2vC6mQRqgc7r3++cDpYSg=";
+  npmDepsHash = "sha256-LkQf2lW6TM1zRr10H7JgtnE+dy0CE7WCxF4GhTd4GT4=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/co/comrak/package.nix b/pkgs/by-name/co/comrak/package.nix
index 7aaa2254f70b..a58afa43e28e 100644
--- a/pkgs/by-name/co/comrak/package.nix
+++ b/pkgs/by-name/co/comrak/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comrak";
-  version = "0.40.0";
+  version = "0.41.0";
 
   src = fetchFromGitHub {
     owner = "kivikakk";
     repo = "comrak";
     rev = "v${version}";
-    sha256 = "sha256-lPO0i6oQtJqcmXDsqhTQV+7a6V04cMcvm2Jn3eWEceg=";
+    sha256 = "sha256-GYUMSn276XrGPIYRQf6+w3eIvKB5lMayBgSFyGb0DVw=";
   };
 
-  cargoHash = "sha256-TA8tC/8LfXzoxYJZlVELZirg9Xzr677VugzFwm5NHM4=";
+  cargoHash = "sha256-GxWhSYsCxOxcRbEtHj7V+4Wu2uoZjTpG04NFidS8sSQ=";
 
   meta = {
     description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";
diff --git a/pkgs/by-name/er/errbot/package.nix b/pkgs/by-name/er/errbot/package.nix
index d164c7be9c78..5c3b421698b3 100644
--- a/pkgs/by-name/er/errbot/package.nix
+++ b/pkgs/by-name/er/errbot/package.nix
@@ -50,9 +50,6 @@ python3.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
-  # errbot-backend-slackv3 has not been packaged
-  disabledTestPaths = [ "tests/backend_tests/slack_test.py" ];
-
   disabledTests = [
     # require networking
     "test_backup"
diff --git a/pkgs/by-name/he/heroic/package.nix b/pkgs/by-name/he/heroic/package.nix
index 77dc9a494db8..4884a733ecd1 100644
--- a/pkgs/by-name/he/heroic/package.nix
+++ b/pkgs/by-name/he/heroic/package.nix
@@ -19,4 +19,6 @@ steam.buildRuntimeEnv {
     ln -s ${heroic-unwrapped}/share/applications $out/share
     ln -s ${heroic-unwrapped}/share/icons $out/share
   '';
+
+  privateTmp = false;
 }
diff --git a/pkgs/by-name/li/lidarr/package.nix b/pkgs/by-name/li/lidarr/package.nix
index 0a21e62a45dd..8c6e13698666 100644
--- a/pkgs/by-name/li/lidarr/package.nix
+++ b/pkgs/by-name/li/lidarr/package.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
     description = "Usenet/BitTorrent music downloader";
     homepage = "https://lidarr.audio/";
     license = licenses.gpl3;
-    maintainers = [ maintainers.etu ];
+    maintainers = [ ];
     mainProgram = "Lidarr";
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/me/mesen/desktop-make-non-absolute-exec.patch b/pkgs/by-name/me/mesen/desktop-make-non-absolute-exec.patch
new file mode 100644
index 000000000000..e8c78d46e994
--- /dev/null
+++ b/pkgs/by-name/me/mesen/desktop-make-non-absolute-exec.patch
@@ -0,0 +1,13 @@
+diff --git a/UI/Config/FileAssociationHelper.cs b/UI/Config/FileAssociationHelper.cs
+index bcd40ce..4965c7a 100644
+--- a/UI/Config/FileAssociationHelper.cs
++++ b/UI/Config/FileAssociationHelper.cs
+@@ -152,7 +152,7 @@ namespace Mesen.Config
+ 				"Comment=Emulator" + Environment.NewLine +
+ 				"Keywords=game;emulator;emu" + Environment.NewLine +
+ 				"Categories=GNOME;GTK;Game;Emulator;" + Environment.NewLine +
+-				"Exec=" + mainModule.FileName + " %f" + Environment.NewLine +
++				"Exec=" + "Mesen" + " %f" + Environment.NewLine +
+ 				"NoDisplay=false" + Environment.NewLine +
+ 				"StartupNotify=true" + Environment.NewLine +
+ 				"Icon=MesenIcon" + Environment.NewLine;
diff --git a/pkgs/by-name/me/mesen/package.nix b/pkgs/by-name/me/mesen/package.nix
index cb7bca0d47c1..0fc87dc8ce19 100644
--- a/pkgs/by-name/me/mesen/package.nix
+++ b/pkgs/by-name/me/mesen/package.nix
@@ -26,6 +26,8 @@ buildDotnetModule rec {
     ./dont-use-nightly-avalonia.patch
     # upstream has a weird library loading mechanism, which we override with a more sane alternative
     ./dont-zip-libraries.patch
+    # without this the generated .desktop file uses an absolute (and incorrect) path for the binary
+    ./desktop-make-non-absolute-exec.patch
   ];
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index a3ef5f272334..6d3dfa0eab3f 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-08-07";
+  version = "0-unstable-2025-08-08";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "f7d8b3932adea23b2cb4d0be615e7dff7870b8bc";
-    hash = "sha256-4bzXnZhILxtVMKtj54gXXtuTvh6KY9bLNCLnB1INy/E=";
+    rev = "429b76581cd3b63ba5e51be8fd543d4a0ca98f6a";
+    hash = "sha256-0A+BGq6+NR78bbCtPDqeG227phLm7/tuompUkdt2+6U=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/mo/mount-zip/package.nix b/pkgs/by-name/mo/mount-zip/package.nix
index 26cbce771521..037bc80413c0 100644
--- a/pkgs/by-name/mo/mount-zip/package.nix
+++ b/pkgs/by-name/mo/mount-zip/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mount-zip";
-  version = "1.8";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mount-zip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HxHXQfyX3jdTJ5s/QwC9tkjU+JbPDEm7FUGss7tB0EM=";
+    hash = "sha256-d6cjqsqIYFPuAWKxjlLXCWNKT33xbMW8gLriZWj0SSc=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index 13c6cdd72f8f..1c125f038fff 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nuclei-templates";
-  version = "10.2.6";
+  version = "10.2.7";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${version}";
-    hash = "sha256-76PtEYXvZxKEBky0fqdWmjWxrKHfYLBWe+3nqqXUNOw=";
+    hash = "sha256-lawVAx/YmvRgeIWX5rQbqeX0+YAORG84aE/6Qw6okhg=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/on/oniux/package.nix b/pkgs/by-name/on/oniux/package.nix
index 1ea07b4360a8..e5a831835093 100644
--- a/pkgs/by-name/on/oniux/package.nix
+++ b/pkgs/by-name/on/oniux/package.nix
@@ -2,21 +2,26 @@
   lib,
   rustPlatform,
   fetchFromGitLab,
+  perl,
   nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oniux";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
     owner = "tpo/core";
     repo = "oniux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rtQUHTDPQXL4gT8/Nl0hV/F06ybPIfemibCzH3mFHaY=";
+    hash = "sha256-KLtII1pO1G9dsmu7Fq+CwvgYfrWCaSRiCs1+VhlU3Ck=";
   };
 
-  cargoHash = "sha256-79KNytAXxuYi9VBmkkOJg2ugjjoKJ/BPBqWa7Z72HGI=";
+  cargoHash = "sha256-tYHGuBEuwrB/gSCWbSKEavlADIYiNpWjOpVQxYgEC+U=";
+
+  nativeBuildInputs = [
+    perl
+  ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/op/opencommit/package.nix b/pkgs/by-name/op/opencommit/package.nix
index 450f4750a8ee..db9d8a2bb113 100644
--- a/pkgs/by-name/op/opencommit/package.nix
+++ b/pkgs/by-name/op/opencommit/package.nix
@@ -8,13 +8,13 @@
 
 buildNpmPackage rec {
   pname = "opencommit";
-  version = "3.2.9";
+  version = "3.2.10";
 
   src = fetchFromGitHub {
     owner = "di-sukharev";
     repo = "opencommit";
     rev = "v${version}";
-    hash = "sha256-nn+Whjs3qLXhydrELXzogr66H6btY/TPbmWT/MH6w+M=";
+    hash = "sha256-FsPtTuvBvbDIldwxLbuXOxNfOIQ8THboRB6ghTSzTbI=";
     postFetch = ''
       cd $out
       # Fix lockfile issues with bundled dependencies
@@ -22,7 +22,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-1lUMtQFGlM1Z2oQ4nktsePyce/EwAu75BbkBiqBrdnQ=";
+  npmDepsHash = "sha256-Ilf9lfFegraQRkYU5v7Zv6MubpN5m6bck3j5UkTXk+4=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/pe/peazip/package.nix b/pkgs/by-name/pe/peazip/package.nix
index edfbb7c30c42..07982d807d5f 100644
--- a/pkgs/by-name/pe/peazip/package.nix
+++ b/pkgs/by-name/pe/peazip/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "peazip";
-  version = "10.5.0";
+  version = "10.6.0";
 
   src = fetchFromGitHub {
     owner = "peazip";
     repo = "peazip";
     rev = version;
-    hash = "sha256-tEx0ZSvv+byn8OPSFprFJwMFxuEQzyrkvk4FbvGtH2A=";
+    hash = "sha256-oRgsT2j5P6jbaBAgLMGArJ+pCVSgC/CJcHM45mRw6Bs=";
   };
   sourceRoot = "${src.name}/peazip-sources";
 
diff --git a/pkgs/by-name/pi/picocrypt/package.nix b/pkgs/by-name/pi/picocrypt/package.nix
index 3700983f5760..b9085ca4be4b 100644
--- a/pkgs/by-name/pi/picocrypt/package.nix
+++ b/pkgs/by-name/pi/picocrypt/package.nix
@@ -15,18 +15,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "picocrypt";
-  version = "1.48";
+  version = "1.49";
 
   src = fetchFromGitHub {
     owner = "Picocrypt";
     repo = "Picocrypt";
     tag = finalAttrs.version;
-    hash = "sha256-Gvh6t/jFRBCX+I9CYkXV265PiRSSvH6qAgkU0fA/v4A=";
+    hash = "sha256-B10PP/V8xvYbA6rQHWdav/KtQKecNUmwvj9qMYqml8E=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
-  vendorHash = "sha256-HvtQFoAK4+DX2Mwzf5f39tTnxJcH7Dox/otlvPVczeA=";
+  vendorHash = "sha256-0fEy/YuZa7dENfL3y+NN4SLWYwOLmXqHHJEiU37AkX4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/se/sentry-native/package.nix b/pkgs/by-name/se/sentry-native/package.nix
index 8ae15d686976..40ee50c38261 100644
--- a/pkgs/by-name/se/sentry-native/package.nix
+++ b/pkgs/by-name/se/sentry-native/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentry-native";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     tag = version;
-    hash = "sha256-jB744MO5GaZMQWIToyv1g4WzVu99qt/Cx0shvK7SW/c=";
+    hash = "sha256-65Eylc0l3R0bQeKyb7JgULbZCldaR7TZmMvYB9wz/1M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/steam/package.nix b/pkgs/by-name/st/steam/package.nix
index 06c08f7490ef..99b28d32bb68 100644
--- a/pkgs/by-name/st/steam/package.nix
+++ b/pkgs/by-name/st/steam/package.nix
@@ -21,6 +21,7 @@ let
       extraPreBwrapCmds ? "",
       extraBwrapArgs ? [ ],
       extraEnv ? { },
+      privateTmp ? true,
       ...
     }@args:
     buildFHSEnv (
@@ -150,6 +151,7 @@ buildRuntimeEnv {
     extraPreBwrapCmds
     extraBwrapArgs
     extraEnv
+    privateTmp
     ;
 
   runScript = writeShellScript "steam-wrapped" ''
@@ -175,6 +177,7 @@ buildRuntimeEnv {
             extraPreBwrapCmds
             extraBwrapArgs
             extraEnv
+            privateTmp
             ;
 
           runScript = writeShellScript "steam-run" ''
diff --git a/pkgs/by-name/st/stupidterm/package.nix b/pkgs/by-name/st/stupidterm/package.nix
index 7d82681b92df..c39e182127ab 100644
--- a/pkgs/by-name/st/stupidterm/package.nix
+++ b/pkgs/by-name/st/stupidterm/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation {
     description = "Simple wrapper around the VTE terminal emulator widget for GTK";
     homepage = "https://github.com/esmil/stupidterm";
     license = licenses.lgpl3Plus;
-    maintainers = [ maintainers.etu ];
+    maintainers = [ ];
     platforms = platforms.linux;
     mainProgram = "stupidterm";
   };
diff --git a/pkgs/by-name/te/tessen/package.nix b/pkgs/by-name/te/tessen/package.nix
index f60ee3a7aa68..e660bfa23e3d 100644
--- a/pkgs/by-name/te/tessen/package.nix
+++ b/pkgs/by-name/te/tessen/package.nix
@@ -55,7 +55,7 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://sr.ht/~ayushnix/tessen";
+    homepage = "https://git.sr.ht/~ayushnix/tessen";
     description = "Interactive menu to autotype and copy Pass and GoPass data";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/by-name/te/testssl/package.nix b/pkgs/by-name/te/testssl/package.nix
index 929940124146..994ed20c04f0 100644
--- a/pkgs/by-name/te/testssl/package.nix
+++ b/pkgs/by-name/te/testssl/package.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://testssl.sh/";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ etu ];
+    maintainers = with maintainers; [ ];
     mainProgram = "testssl.sh";
   };
 }
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 579341272f36..c0e220cb0099 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.198.3";
+  version = "0.198.5";
 
   outputs = [
     "out"
@@ -112,7 +112,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-icLiruC219iuT5vO1Cc77mz01z/Afx9Xt23uxXhbPPo=";
+    hash = "sha256-jDwHw5kbm0qfV2WJ5tbFl9z/1S1ICp8bCZbhUD5o0VI=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         --replace-fail "inner.redirect(policy)" "inner.redirect_policy(policy)"
     '';
 
-  cargoHash = "sha256-z8xlU25L+LZxLOfSQowpVEnKM0BU+dgNqlFG3mh1HAQ=";
+  cargoHash = "sha256-MHwMsMdv7TjnWi2Kmr7vA+TUK+VyHMm4faYOssJ5Z1o=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/python-modules/canopen/default.nix b/pkgs/development/python-modules/canopen/default.nix
index 320dfd776b2d..0a2ec5b2093d 100644
--- a/pkgs/development/python-modules/canopen/default.nix
+++ b/pkgs/development/python-modules/canopen/default.nix
@@ -1,32 +1,30 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  setuptools-scm,
-  python-can,
   canmatrix,
+  fetchPypi,
   pytestCheckHook,
-  pythonOlder,
+  python-can,
+  setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "canopen";
-  version = "2.3.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  version = "2.4.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eSCEqTwTjVsqQG3dLU61ziCPA72P2mD4GtK7jVbGuCc=";
+    hash = "sha256-IKhLxJizTa3XnOzkZ9O74ZWRwcAqjzkzG8xgZcTYsus=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
-    python-can
-    canmatrix
-  ];
+  dependencies = [ python-can ];
+
+  optional-dependencies = {
+    db_export = [ canmatrix ];
+  };
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/ping3/default.nix b/pkgs/development/python-modules/ping3/default.nix
index 548e38c388d5..3598ec21f729 100644
--- a/pkgs/development/python-modules/ping3/default.nix
+++ b/pkgs/development/python-modules/ping3/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "ping3";
-  version = "4.0.8";
+  version = "5.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mrRg61fwBrcfl3ppPRVyFaq9a7y8bNZCi2lR6q4MKHU=";
+    hash = "sha256-UTD12FxxRnTlRMGo5TwIo+fsM3Ka1zEMWYjM4BAH0t8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/synology-srm/default.nix b/pkgs/development/python-modules/synology-srm/default.nix
new file mode 100644
index 000000000000..193ed83d258f
--- /dev/null
+++ b/pkgs/development/python-modules/synology-srm/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  requests,
+  poetry-core,
+  pythonRelaxDepsHook,
+  pytestCheckHook,
+  requests-mock,
+}:
+
+buildPythonPackage rec {
+  pname = "synology-srm";
+  version = "0.2.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "aerialls";
+    repo = "synology-srm";
+    tag = "v${version}";
+    hash = "sha256-qQxctw1UUs3jYve//irBni8rNKeld5u/bVtOwD2ofEQ=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "requests"
+  ];
+
+  dependencies = [
+    requests
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    requests-mock
+  ];
+
+  pythonImportsCheck = [
+    "synology_srm"
+  ];
+
+  meta = {
+    description = "Python 3 library for Synology SRM (Router Manager)";
+    homepage = "https://github.com/aerialls/synology-srm";
+    changelog = "https://github.com/aerialls/synology-srm/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/yamlloader/default.nix b/pkgs/development/python-modules/yamlloader/default.nix
index 388e88284bc7..0add590d5bfb 100644
--- a/pkgs/development/python-modules/yamlloader/default.nix
+++ b/pkgs/development/python-modules/yamlloader/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "yamlloader";
-  version = "1.5.1";
+  version = "1.5.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jezhmwUKyxxqjKFKoweTOI+b4VT3NLgmVB+aGCjUHOw=";
+    hash = "sha256-wQrBMhpiaxyosJ0/Ov6YVbgYORxZmSp2tl5KLZXqxBs=";
   };
 
   build-system = [
diff --git a/pkgs/kde/misc/ktextaddons/default.nix b/pkgs/kde/misc/ktextaddons/default.nix
index c845e53b9109..d5976aa08f9e 100644
--- a/pkgs/kde/misc/ktextaddons/default.nix
+++ b/pkgs/kde/misc/ktextaddons/default.nix
@@ -9,11 +9,11 @@
 }:
 mkKdeDerivation rec {
   pname = "ktextaddons";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchurl {
     url = "mirror://kde/stable/ktextaddons/ktextaddons-${version}.tar.xz";
-    hash = "sha256-7JtimpC0shZgaGfoA08UszRDQgwreybz/UFNjB+jyuQ=";
+    hash = "sha256-kM8l4pjglcQLMoanFT0E+WHvTmWYMhvesA8r5+mYrn4=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index ef7b545ed548..ed1f723d5ee2 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -106,6 +106,10 @@ stdenv.mkDerivation rec {
       url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2023-42364-CVE-2023-42365.patch?id=8a4bf5971168bf48201c05afda7bee0fbb188e13";
       hash = "sha256-nQPgT9eA1asCo38Z9X7LR9My0+Vz5YBPba3ARV3fWcc=";
     })
+    (fetchurl {
+      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-tar-fix-TOCTOU-symlink-race-condition.patch?id=9e42dea5fba84a8afad1f1910b7d3884128a567e";
+      hash = "sha256-GmXQhwB1/IPVjXXpGi5RjRvuGJgIMIb7lQKB63m306g=";
+    })
   ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
 
diff --git a/pkgs/servers/hockeypuck/server.nix b/pkgs/servers/hockeypuck/server.nix
index deb5a52ee200..ab031dd2c96f 100644
--- a/pkgs/servers/hockeypuck/server.nix
+++ b/pkgs/servers/hockeypuck/server.nix
@@ -21,6 +21,6 @@ buildGoModule {
     description = "OpenPGP Key Server";
     homepage = "https://github.com/hockeypuck/hockeypuck";
     license = licenses.agpl3Plus;
-    maintainers = [ maintainers.etu ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/servers/hockeypuck/web.nix b/pkgs/servers/hockeypuck/web.nix
index 2d6a75975ad4..a2f35a4d0cdb 100644
--- a/pkgs/servers/hockeypuck/web.nix
+++ b/pkgs/servers/hockeypuck/web.nix
@@ -28,6 +28,6 @@ stdenv.mkDerivation {
     description = "OpenPGP Key Server web resources";
     homepage = "https://github.com/hockeypuck/hockeypuck";
     license = licenses.gpl3Plus;
-    maintainers = [ maintainers.etu ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index c5414b241c54..09a98b9fa0d3 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -5774,7 +5774,8 @@
       ];
     "synology_srm" =
       ps: with ps; [
-      ]; # missing inputs: synology-srm
+        synology-srm
+      ];
     "syslog" =
       ps: with ps; [
       ];
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 272297f584ce..020efc57e85b 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -60,8 +60,8 @@ let
 in
 {
   tomcat9 = common {
-    version = "9.0.107";
-    hash = "sha256-08qgrQpltJMafTrsok5VQc90O6X6nlGr2ls6MdC0hX0=";
+    version = "9.0.108";
+    hash = "sha256-qpEnzHOPUyqjTjR7MGqCFX+1tJm/wCi0/69521lW0o0=";
   };
 
   tomcat10 = common {
diff --git a/pkgs/servers/sql/postgresql/ext/citus.nix b/pkgs/servers/sql/postgresql/ext/citus.nix
index 2b197e70719f..7dd9874a2821 100644
--- a/pkgs/servers/sql/postgresql/ext/citus.nix
+++ b/pkgs/servers/sql/postgresql/ext/citus.nix
@@ -66,7 +66,14 @@ postgresqlBuildExtension (finalAttrs: {
     # "Our soft policy for Postgres version compatibility is to support Citus'
     # latest release with Postgres' 3 latest releases."
     # https://www.citusdata.com/updates/v12-0/#deprecated_features
-    broken = lib.versionOlder postgresql.version "15";
+    broken =
+      lib.versionOlder postgresql.version "15"
+      ||
+        # PostgreSQL 18 support issue upstream: https://github.com/citusdata/citus/issues/7978
+        # Check after next package update.
+        lib.warnIf (finalAttrs.version != "13.0.3") "Is postgresql18Packages.citus still broken?" (
+          lib.versionAtLeast postgresql.version "18"
+        );
     description = "Distributed PostgreSQL as an extension";
     homepage = "https://www.citusdata.com/";
     changelog = "https://github.com/citusdata/citus/blob/${finalAttrs.src.rev}/CHANGELOG.md";
diff --git a/pkgs/servers/sql/postgresql/ext/lantern.nix b/pkgs/servers/sql/postgresql/ext/lantern.nix
index 8cd89a145bde..449be22a31ec 100644
--- a/pkgs/servers/sql/postgresql/ext/lantern.nix
+++ b/pkgs/servers/sql/postgresql/ext/lantern.nix
@@ -51,6 +51,11 @@ postgresqlBuildExtension (finalAttrs: {
   };
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/lanterndata/lantern/issues/375
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "0.5.0"
+    ) "Is postgresql18Packages.lantern still broken?" (lib.versionAtLeast postgresql.version "18");
     description = "PostgreSQL vector database extension for building AI applications";
     homepage = "https://lantern.dev/";
     changelog = "https://github.com/lanterndata/lantern/blob/${finalAttrs.src.rev}/CHANGELOG.md";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix b/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
index 3bf237c88b45..4cc2eb58e73d 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_auto_failover.nix
@@ -19,6 +19,11 @@ postgresqlBuildExtension (finalAttrs: {
   buildInputs = postgresql.buildInputs;
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/hapostgres/pg_auto_failover/issues/1083
+    # Check after next package update.
+    broken =
+      lib.warnIf (finalAttrs.version != "2.2") "Is postgresql18Packages.pg_auto_failover still broken?"
+        (lib.versionAtLeast postgresql.version "18");
     description = "PostgreSQL extension and service for automated failover and high-availability";
     mainProgram = "pg_autoctl";
     homepage = "https://github.com/citusdata/pg_auto_failover";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
index 9db198216bb6..f4ed12e2f902 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
@@ -19,6 +19,11 @@ postgresqlBuildExtension (finalAttrs: {
   makeFlags = [ "USE_PGXS=1" ];
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/pgbigm/pg_bigm/issues/28
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "1.2-20240606"
+    ) "Is postgresql18Packages.pg_bigm still broken?" (lib.versionAtLeast postgresql.version "18");
     description = "Text similarity measurement and index searching based on bigrams";
     homepage = "https://pgbigm.osdn.jp/";
     maintainers = [ ];
diff --git a/pkgs/servers/sql/postgresql/ext/pg_cron.nix b/pkgs/servers/sql/postgresql/ext/pg_cron.nix
index 1345dc4b1051..ef019030ddb1 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_cron.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_cron.nix
@@ -17,6 +17,12 @@ postgresqlBuildExtension (finalAttrs: {
   };
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/citusdata/pg_cron/issues/396
+    # Note: already fixed on `main` branch.
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "1.6.5"
+    ) "Is postgresql18Packages.pg_cron still broken?" (lib.versionAtLeast postgresql.version "18");
     description = "Run Cron jobs through PostgreSQL";
     homepage = "https://github.com/citusdata/pg_cron";
     changelog = "https://github.com/citusdata/pg_cron/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_hll.nix b/pkgs/servers/sql/postgresql/ext/pg_hll.nix
index e63191a4a85f..bd3bd7bcdb09 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_hll.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_hll.nix
@@ -16,6 +16,9 @@ postgresqlBuildExtension (finalAttrs: {
     hash = "sha256-Latdxph1Ura8yKEokEjalJ+/GY+pAKOT3GXjuLprj6c=";
   };
 
+  # https://github.com/citusdata/postgresql-hll/issues/166#issuecomment-3165489050
+  NIX_CFLAGS_COMPILE = "-Wno-error=missing-variable-declarations";
+
   meta = {
     description = "HyperLogLog for PostgreSQL";
     homepage = "https://github.com/citusdata/postgresql-hll";
diff --git a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
index 4e2e3c3d3776..1c57b2502482 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
@@ -23,6 +23,14 @@ postgresqlBuildExtension (finalAttrs: {
     maintainers = with lib.maintainers; [ ivan ];
     platforms = postgresql.meta.platforms;
     license = lib.licenses.postgresql;
-    broken = lib.versionOlder postgresql.version "13";
+    broken =
+      lib.versionOlder postgresql.version "13"
+      ||
+        # PostgreSQL 18 support issue upstream: https://github.com/sraoss/pg_ivm/issues/133
+        # Note: already fixed on `main` branch.
+        # Check after next package update.
+        lib.warnIf (finalAttrs.version != "1.11") "Is postgresql18Packages.pg_ivm still broken?" (
+          lib.versionAtLeast postgresql.version "18"
+        );
   };
 })
diff --git a/pkgs/servers/sql/postgresql/ext/pg_tle.nix b/pkgs/servers/sql/postgresql/ext/pg_tle.nix
index 20355bc0bda0..ea1fbcbcfe4c 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_tle.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_tle.nix
@@ -19,6 +19,11 @@ postgresqlBuildExtension rec {
   buildInputs = postgresql.buildInputs;
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/aws/pg_tle/issues/302
+    # Check after next package update.
+    broken = lib.warnIf (version != "1.5.1") "Is postgresql18Packages.pg_tle still broken?" (
+      lib.versionAtLeast postgresql.version "18"
+    );
     description = "Framework for building trusted language extensions for PostgreSQL";
     homepage = "https://github.com/aws/pg_tle";
     changelog = "https://github.com/aws/pg_tle/releases/tag/v${version}";
diff --git a/pkgs/servers/sql/postgresql/ext/pgroonga.nix b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
index c365aea52bae..82611345c418 100644
--- a/pkgs/servers/sql/postgresql/ext/pgroonga.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
@@ -34,6 +34,11 @@ postgresqlBuildExtension (finalAttrs: {
   ];
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/pgroonga/pgroonga/issues/708
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "4.0.1"
+    ) "Is postgresql18Packages.pgroonga still broken?" (lib.versionAtLeast postgresql.version "18");
     description = "PostgreSQL extension to use Groonga as the index";
     longDescription = ''
       PGroonga is a PostgreSQL extension to use Groonga as the index.
diff --git a/pkgs/servers/sql/postgresql/ext/pgvector.nix b/pkgs/servers/sql/postgresql/ext/pgvector.nix
index 36789689bae0..3b440e537ffc 100644
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@@ -17,6 +17,12 @@ postgresqlBuildExtension (finalAttrs: {
   };
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/pgvector/pgvector/issues/869
+    # Note: already fixed on `master` branch.
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "0.8.0"
+    ) "Is postgresql18Packages.pgvector still broken?" (lib.versionAtLeast postgresql.version "18");
     description = "Open-source vector similarity search for PostgreSQL";
     homepage = "https://github.com/pgvector/pgvector";
     changelog = "https://github.com/pgvector/pgvector/raw/v${finalAttrs.version}/CHANGELOG.md";
diff --git a/pkgs/servers/sql/postgresql/ext/pgvectorscale/package.nix b/pkgs/servers/sql/postgresql/ext/pgvectorscale/package.nix
index ffc2f2682d52..8da7420f3bea 100644
--- a/pkgs/servers/sql/postgresql/ext/pgvectorscale/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvectorscale/package.nix
@@ -65,6 +65,11 @@ buildPgrxExtension (finalAttrs: {
   };
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/timescale/pgvectorscale/issues/249
+    # Check after next package update.
+    broken =
+      lib.warnIf (finalAttrs.version != "0.7.0") "Is postgresql18Packages.pgvectorscale still broken?"
+        (lib.versionAtLeast postgresql.version "18");
     homepage = "https://github.com/timescale/pgvectorscale";
     teams = [ lib.teams.flyingcircus ];
     description = "Complement to pgvector for high performance, cost efficient vector search on large workloads";
diff --git a/pkgs/servers/sql/postgresql/ext/pgx_ulid.nix b/pkgs/servers/sql/postgresql/ext/pgx_ulid.nix
index d1a7ed141f96..456d7bca4efa 100644
--- a/pkgs/servers/sql/postgresql/ext/pgx_ulid.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgx_ulid.nix
@@ -40,7 +40,15 @@ buildPgrxExtension (finalAttrs: {
 
   meta = {
     # Support for PostgreSQL 13 was removed in 0.2.0: https://github.com/pksunkara/pgx_ulid/blob/084778c3e2af08d16ec5ec3ef4e8f345ba0daa33/CHANGELOG.md?plain=1#L6
-    broken = lib.versionOlder postgresql.version "14";
+    broken =
+      lib.versionOlder postgresql.version "14"
+      ||
+        # PostgreSQL 18 support issue upstream: https://github.com/pksunkara/pgx_ulid/issues/65
+        # Note: already fixed on `master` branch.
+        # Check after next package update.
+        lib.warnIf (finalAttrs.version != "0.2.0") "Is postgresql18Packages.pgx_ulid still broken?" (
+          lib.versionAtLeast postgresql.version "18"
+        );
     description = "ULID Postgres extension written in Rust";
     homepage = "https://github.com/pksunkara/pgx_ulid";
     changelog = "https://github.com/pksunkara/pgx_ulid/blob/v${finalAttrs.version}/CHANGELOG.md";
diff --git a/pkgs/servers/sql/postgresql/ext/rum.nix b/pkgs/servers/sql/postgresql/ext/rum.nix
index bc93ff3b76a6..99f0d336d525 100644
--- a/pkgs/servers/sql/postgresql/ext/rum.nix
+++ b/pkgs/servers/sql/postgresql/ext/rum.nix
@@ -29,6 +29,11 @@ postgresqlBuildExtension (finalAttrs: {
   };
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/postgrespro/rum/issues/156
+    # Check after next package update.
+    broken = lib.warnIf (finalAttrs.version != "1.3.14") "Is postgresql18Packages.rum still broken?" (
+      lib.versionAtLeast postgresql.version "18"
+    );
     description = "Full text search index method for PostgreSQL";
     homepage = "https://github.com/postgrespro/rum";
     license = lib.licenses.postgresql;
diff --git a/pkgs/servers/sql/postgresql/ext/sqlite_fdw.nix b/pkgs/servers/sql/postgresql/ext/sqlite_fdw.nix
index 1ade4b6e90fa..dd5da727beee 100644
--- a/pkgs/servers/sql/postgresql/ext/sqlite_fdw.nix
+++ b/pkgs/servers/sql/postgresql/ext/sqlite_fdw.nix
@@ -22,6 +22,12 @@ postgresqlBuildExtension (finalAttrs: {
   makeFlags = [ "USE_PGXS=1" ];
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/pgspider/sqlite_fdw/issues/117
+    # Note: already fixed on `master` branch.
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "2.5.0"
+    ) "Is postgresql18Packages.sqlite_fdw still broken?" (lib.versionAtLeast postgresql.version "18");
     description = "SQLite Foreign Data Wrapper for PostgreSQL";
     homepage = "https://github.com/pgspider/sqlite_fdw";
     changelog = "https://github.com/pgspider/sqlite_fdw/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/servers/sql/postgresql/ext/tds_fdw.nix b/pkgs/servers/sql/postgresql/ext/tds_fdw.nix
index e89acc14811e..f6a4ba6f9607 100644
--- a/pkgs/servers/sql/postgresql/ext/tds_fdw.nix
+++ b/pkgs/servers/sql/postgresql/ext/tds_fdw.nix
@@ -20,6 +20,11 @@ postgresqlBuildExtension (finalAttrs: {
   };
 
   meta = {
+    # PostgreSQL 18 support issue upstream: https://github.com/tds-fdw/tds_fdw/issues/384
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "2.0.4"
+    ) "Is postgresql18Packages.tds_fdw still broken?" (lib.versionAtLeast postgresql.version "18");
     description = "PostgreSQL foreign data wrapper to connect to TDS databases (Sybase and Microsoft SQL Server)";
     homepage = "https://github.com/tds-fdw/tds_fdw";
     changelog = "https://github.com/tds-fdw/tds_fdw/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 2fe5cf171589..ea60aa516889 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -101,6 +101,13 @@ postgresqlBuildExtension (finalAttrs: {
     maintainers = with lib.maintainers; [ kirillrdy ];
     platforms = postgresql.meta.platforms;
     license = with lib.licenses; if enableUnfree then tsl else asl20;
-    broken = lib.versionOlder postgresql.version "15";
+    broken =
+      lib.versionOlder postgresql.version "15"
+      ||
+        # PostgreSQL 18 support issue upstream: https://github.com/timescale/timescaledb/issues/8233
+        # Check after next package update.
+        lib.warnIf (finalAttrs.version != "2.21.1") "Is postgresql18Packages.timescaledb still broken?" (
+          lib.versionAtLeast postgresql.version "18"
+        );
   };
 })
diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index 2217c9b0d275..eeb3bcef1e3e 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -123,6 +123,12 @@ buildPgrxExtension (finalAttrs: {
   };
 
   meta = {
+    # PostgreSQL 18 is not yet supported
+    # Will be supported in the next release (likely 0.5.0), as it's already supported in the main branch
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "0.4.2"
+    ) "Is postgresql18Packages.vectorchord still broken?" (lib.versionAtLeast postgresql.version "18");
     changelog = "https://github.com/tensorchord/VectorChord/releases/tag/${finalAttrs.version}";
     description = "Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs";
     homepage = "https://github.com/tensorchord/VectorChord";
diff --git a/pkgs/servers/web-apps/freshrss/default.nix b/pkgs/servers/web-apps/freshrss/default.nix
index 7b4f54db4dd0..24ce7ec4bda7 100644
--- a/pkgs/servers/web-apps/freshrss/default.nix
+++ b/pkgs/servers/web-apps/freshrss/default.nix
@@ -53,7 +53,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://www.freshrss.org/";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [
-      etu
       stunkymonkey
     ];
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 323b48f55023..4870605e1404 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17595,6 +17595,8 @@ self: super: with self; {
 
   synergy = callPackage ../development/python-modules/synergy { };
 
+  synology-srm = callPackage ../development/python-modules/synology-srm { };
+
   syrupy = callPackage ../development/python-modules/syrupy { };
 
   syslog-rfc5424-formatter = callPackage ../development/python-modules/syslog-rfc5424-formatter { };