diff --git a/.github/ISSUE_TEMPLATE/01_bug_report.yml b/.github/ISSUE_TEMPLATE/01_bug_report.yml
index 1e27276435ef..d2ed16e343e9 100644
--- a/.github/ISSUE_TEMPLATE/01_bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/01_bug_report.yml
@@ -36,8 +36,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.05)"
-        - "- Beta (25.11)"
-        - "- Stable (25.05)"
+        - "- Stable (25.11)"
+        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml b/.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml
index 0d8464766a31..7acda0e781c5 100644
--- a/.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml
+++ b/.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml
@@ -36,8 +36,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.05)"
-        - "- Beta (25.11)"
-        - "- Stable (25.05)"
+        - "- Stable (25.11)"
+        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml b/.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml
index f92ee67d7848..532d7851e989 100644
--- a/.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml
+++ b/.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml
@@ -36,8 +36,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.05)"
-        - "- Beta (25.11)"
-        - "- Stable (25.05)"
+        - "- Stable (25.11)"
+        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/04_build_failure.yml b/.github/ISSUE_TEMPLATE/04_build_failure.yml
index c89e6c3dc977..3d5354adca71 100644
--- a/.github/ISSUE_TEMPLATE/04_build_failure.yml
+++ b/.github/ISSUE_TEMPLATE/04_build_failure.yml
@@ -38,8 +38,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.05)"
-        - "- Beta (25.11)"
-        - "- Stable (25.05)"
+        - "- Stable (25.11)"
+        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/05_update_request.yml b/.github/ISSUE_TEMPLATE/05_update_request.yml
index 6ea00d41e9b5..a575550eaee5 100644
--- a/.github/ISSUE_TEMPLATE/05_update_request.yml
+++ b/.github/ISSUE_TEMPLATE/05_update_request.yml
@@ -38,8 +38,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.05)"
-        - "- Beta (25.11)"
-        - "- Stable (25.05)"
+        - "- Stable (25.11)"
+        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/06_module_request.yml b/.github/ISSUE_TEMPLATE/06_module_request.yml
index 435cc9821272..fbe5a2a62a44 100644
--- a/.github/ISSUE_TEMPLATE/06_module_request.yml
+++ b/.github/ISSUE_TEMPLATE/06_module_request.yml
@@ -36,8 +36,8 @@ body:
       options:
         - "Please select a version."
         - "- Unstable (26.05)"
-        - "- Beta (25.11)"
-        - "- Stable (25.05)"
+        - "- Stable (25.11)"
+        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index 15387f261b2b..65d3a5192c45 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -283,23 +283,23 @@ in
             ''}
 
             tmpMetadataMount=$(TMPDIR="/run" mktemp --directory -t nixos-etc-metadata.XXXXXXXXXX)
-            mount --type erofs --options ro,nodev,nosuid ${config.system.build.etcMetadataImage} $tmpMetadataMount
+            mount --type erofs --options ro,nodev,nosuid ${config.system.build.etcMetadataImage} "$tmpMetadataMount"
 
             # There was no previous /etc mounted. This happens when we're called
             # directly without an initrd, like with nixos-enter.
             if ! mountpoint -q /etc; then
               mount --type overlay \
-                --options nodev,nosuid,lowerdir=$tmpMetadataMount::${config.system.build.etcBasedir},${etcOverlayOptions} \
+                --options nodev,nosuid,lowerdir="$tmpMetadataMount"::${config.system.build.etcBasedir},${etcOverlayOptions} \
                 overlay /etc
             else
               # Mount the new /etc overlay to a temporary private mount.
               # This needs the indirection via a private bind mount because you
               # cannot move shared mounts.
               tmpEtcMount=$(TMPDIR="/run" mktemp --directory -t nixos-etc.XXXXXXXXXX)
-              mount --bind --make-private $tmpEtcMount $tmpEtcMount
+              mount --bind --make-private "$tmpEtcMount" "$tmpEtcMount"
               mount --type overlay \
-                --options nodev,nosuid,lowerdir=$tmpMetadataMount::${config.system.build.etcBasedir},${etcOverlayOptions} \
-                overlay $tmpEtcMount
+                --options nodev,nosuid,lowerdir="$tmpMetadataMount"::${config.system.build.etcBasedir},${etcOverlayOptions} \
+                overlay "$tmpEtcMount"
 
               # Before moving the new /etc overlay under the old /etc, we have to
               # move mounts on top of /etc to the new /etc mountpoint.
@@ -334,7 +334,7 @@ in
               # This should eventually use util-linux to perform this move beneath,
               # however, this functionality is not yet in util-linux. See this
               # tracking issue: https://github.com/util-linux/util-linux/issues/2604
-              ${pkgs.move-mount-beneath}/bin/move-mount --move --beneath $tmpEtcMount /etc
+              ${pkgs.move-mount-beneath}/bin/move-mount --move --beneath "$tmpEtcMount" /etc
 
               # Unmount the top /etc mount to atomically reveal the new mount.
               umount --lazy --recursive /etc
@@ -345,9 +345,6 @@ in
             fi
 
             # Unmount old metadata mounts
-            # For some reason, `findmnt /tmp --submounts` does not show the nested
-            # mounts. So we'll just find all mounts of type erofs and filter on the
-            # name of the mountpoint.
             findmnt --type erofs --list --kernel --output TARGET | while read -r mountPoint; do
               if [[ ("$mountPoint" =~ ^/run/nixos-etc-metadata\..{10}$ || "$mountPoint" =~ ^/run/nixos-etc-metadata$ ) &&
                     "$mountPoint" != "$tmpMetadataMount" ]]; then
diff --git a/nixos/tests/appliance-repart-image.nix b/nixos/tests/appliance-repart-image.nix
index d35654c56a64..edad11043a84 100644
--- a/nixos/tests/appliance-repart-image.nix
+++ b/nixos/tests/appliance-repart-image.nix
@@ -118,11 +118,14 @@ in
       # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
       os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
 
-      os_release = machine.succeed("cat /etc/os-release")
-      assert 'IMAGE_ID="${imageId}"' in os_release
-      assert 'IMAGE_VERSION="${imageVersion}"' in os_release
+      with subtest("/etc/os-release contains the right fileds"):
+        os_release = machine.succeed("cat /etc/os-release")
+        t.assertIn('IMAGE_ID="${imageId}"', os_release)
+        t.assertIn('IMAGE_VERSION="${imageVersion}"', os_release)
 
-      bootctl_status = machine.succeed("bootctl status")
-      assert "Boot Loader Specification Type #2 (.efi)" in bootctl_status
+      with subtest("Bootctl reports the right boot loader type"):
+        bootctl_status = machine.succeed("bootctl status")
+        print(bootctl_status)
+        t.assertIn("Boot Loader Specification Type #2", bootctl_status)
     '';
 }
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index a20d85029c84..d2b456dc2e16 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -29,28 +29,28 @@
   },
   "beta": {
     "linux": {
-      "version": "8.11.18-34.BETA",
+      "version": "8.11.22-25.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.18-34.BETA.x64.tar.gz",
-          "hash": "sha256-1x0FwxQ6oWGdcJ7Up9S+f423IpFAMEJ08WQnbgaesVU="
+          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.22-25.BETA.x64.tar.gz",
+          "hash": "sha256-ysIeDVE84PvNSgHliNQLo7v1qSmTd2HT6qZCS9FZFMA="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.18-34.BETA.arm64.tar.gz",
-          "hash": "sha256-ita34logGU5zd6USi4XgOQosWooebHssyIobPZ8wlVg="
+          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.22-25.BETA.arm64.tar.gz",
+          "hash": "sha256-+AmPecbADQ7lUW4Od58mty/S+7xH3aFt9TstX7BE5g8="
         }
       }
     },
     "darwin": {
-      "version": "8.11.18-34.BETA",
+      "version": "8.11.22-25.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.18-34.BETA-x86_64.zip",
-          "hash": "sha256-NONcgqasLQd9nQnEQfibcYLPagvt2VuIFUxgkTMVRxE="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.22-25.BETA-x86_64.zip",
+          "hash": "sha256-ZUFlsExUccqIXagggwTFj99Efd1i5Lo07P/XgTZuHBs="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.18-34.BETA-aarch64.zip",
-          "hash": "sha256-SVPXpEFBI0mutj/J5vvb2o20za+5d/zzB7altIHADYw="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.22-25.BETA-aarch64.zip",
+          "hash": "sha256-ALY5Kj/Wt/p3OTCv085q+TWFS5rLXp6MctCBUSG0ZSI="
         }
       }
     }
diff --git a/pkgs/by-name/bi/bikeshed/package.nix b/pkgs/by-name/bi/bikeshed/package.nix
index d7d2f20e0ff6..2774c5e7d208 100644
--- a/pkgs/by-name/bi/bikeshed/package.nix
+++ b/pkgs/by-name/bi/bikeshed/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bikeshed";
-  version = "5.4.1";
+  version = "5.4.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vgjS8jAtLA2OvJG/pJAJnvaaMPMLkbKHgzIMsdzXTBM=";
+    hash = "sha256-6V4hj+Ech/vft9cNPwg2LqKTPzGqgVERooOok3lda94=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/bo/boogie/package.nix b/pkgs/by-name/bo/boogie/package.nix
index 1e200709409c..b9a8330680db 100644
--- a/pkgs/by-name/bo/boogie/package.nix
+++ b/pkgs/by-name/bo/boogie/package.nix
@@ -62,7 +62,7 @@ buildDotnetModule rec {
 
       This derivation may be used as a vim plugin to provide syntax highlighting.
     '';
-    license = lib.licenses.mspl;
+    license = lib.licenses.mit;
     mainProgram = "boogie";
     maintainers = with lib.maintainers; [ taktoa ];
     platforms = with lib.platforms; linux ++ darwin;
diff --git a/pkgs/by-name/ce/ceph-csi/package.nix b/pkgs/by-name/ce/ceph-csi/package.nix
index 1997af1e7d07..19d3e61306db 100644
--- a/pkgs/by-name/ce/ceph-csi/package.nix
+++ b/pkgs/by-name/ce/ceph-csi/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ceph-csi";
-  version = "3.15.0";
+  version = "3.15.1";
 
   src = fetchFromGitHub {
     owner = "ceph";
     repo = "ceph-csi";
     rev = "v${version}";
-    hash = "sha256-F9sVFW0KY7PCjeK1RPdvLyO2RMlyROLfpQ49QThrWLY=";
+    hash = "sha256-eLF/V6NaBU8r3ttJku4lSGrIuP2vao24rsAsEAWB0wk=";
   };
 
   preConfigure = ''
diff --git a/pkgs/by-name/cf/cfspeedtest/package.nix b/pkgs/by-name/cf/cfspeedtest/package.nix
index 52d44bf519b2..b3670b6b7961 100644
--- a/pkgs/by-name/cf/cfspeedtest/package.nix
+++ b/pkgs/by-name/cf/cfspeedtest/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cfspeedtest";
-  version = "1.4.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "code-inflation";
     repo = "cfspeedtest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MWHZllH0QVylmvwEwCX2uhNSEx9p5xEeW0u/zGyjNZE=";
+    hash = "sha256-uqWTYhC+ADwGpUSYXKKD4t0ZSEsVxVM6hNHKewuW0Ts=";
   };
 
-  cargoHash = "sha256-wTytRbue26KVaGb3LarTCNdq56psIayVDul4iQkwH2s=";
+  cargoHash = "sha256-VuCYy8awQTmOxh9efJb0t6BXcxwlkz/uJNb8bCzXMdc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/fc/fcgi/package.nix b/pkgs/by-name/fc/fcgi/package.nix
index 3d9bb21863d1..f6ceef9cea7f 100644
--- a/pkgs/by-name/fc/fcgi/package.nix
+++ b/pkgs/by-name/fc/fcgi/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fcgi";
-  version = "2.4.6";
+  version = "2.4.7";
 
   src = fetchFromGitHub {
     owner = "FastCGI-Archives";
     repo = "fcgi2";
     rev = finalAttrs.version;
-    hash = "sha256-rVurW9zcUT4IFVmrq/kuGuMbv6geQZC+WyAtqtN778Q=";
+    hash = "sha256-uMYuVb68zHJgMUdgM/R9QIRCxrQdtVHWA/9IZOdktGc=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/by-name/gi/gitleaks/package.nix b/pkgs/by-name/gi/gitleaks/package.nix
index 5d4abc642e48..446ae128209c 100644
--- a/pkgs/by-name/gi/gitleaks/package.nix
+++ b/pkgs/by-name/gi/gitleaks/package.nix
@@ -11,21 +11,21 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.28.0";
+  version = "8.30.0";
 
   src = fetchFromGitHub {
     owner = "gitleaks";
     repo = "gitleaks";
     tag = "v${version}";
-    hash = "sha256-smh3Ge278lYVEcs6r1F43daexgjgddy1HKhU5E4CBYM=";
+    hash = "sha256-nCalZlKvH3d75GKo3Qr5580kG77A2zTvsddLElYwZ8A=";
   };
 
-  vendorHash = "sha256-dd9sHt5t0s4Vff1rOwQY1OC+0FIw0SDt/cwJN+IL5D8=";
+  vendorHash = "sha256-whJtl34dNltH/dk9qWSThcCYXC0x9PzbAUOO97Int+k=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X=github.com/zricethezav/gitleaks/v${lib.versions.major version}/cmd.Version=${version}"
+    "-X=github.com/zricethezav/gitleaks/v${lib.versions.major version}/version.Version=${version}"
   ];
 
   nativeBuildInputs = [
@@ -53,8 +53,8 @@ buildGoModule rec {
       API keys and tokens in git repos.
     '';
     homepage = "https://github.com/gitleaks/gitleaks";
-    changelog = "https://github.com/gitleaks/gitleaks/releases/tag/v${version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/gitleaks/gitleaks/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       fab
       friedow
diff --git a/pkgs/by-name/go/goreleaser/package.nix b/pkgs/by-name/go/goreleaser/package.nix
index 4ff91d2b9224..bb0ab5ce168b 100644
--- a/pkgs/by-name/go/goreleaser/package.nix
+++ b/pkgs/by-name/go/goreleaser/package.nix
@@ -10,16 +10,16 @@
 }:
 buildGo125Module rec {
   pname = "goreleaser";
-  version = "2.12.7";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = "goreleaser";
     rev = "v${version}";
-    hash = "sha256-McLE7o5eUTluIOlsArIo5Dh7fizxxCMVAdXXnSBKhQU=";
+    hash = "sha256-Z0DadF4wiDwykr0NIhL/IbwARwTjMXQDYmQevvjN2W8=";
   };
 
-  vendorHash = "sha256-M8+KJV7LemD6AHjJS8nZ70AZ30kZIgyYQv/yWB3lmsw=";
+  vendorHash = "sha256-pDu3ZYQQEhSugOUGD2Xi5mBJRjOWr3AWKS/PPy1MEvs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gu/gurobi/package.nix b/pkgs/by-name/gu/gurobi/package.nix
index 26099b0de9fe..c4f46219617e 100644
--- a/pkgs/by-name/gu/gurobi/package.nix
+++ b/pkgs/by-name/gu/gurobi/package.nix
@@ -16,14 +16,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gurobi";
-  version = "12.0.3";
+  version = "13.0.0";
 
   src = fetchurl {
     url = "https://packages.gurobi.com/${lib.versions.majorMinor version}/gurobi${version}_${platform}.tar.gz";
     hash =
       {
-        aarch64-linux = "sha256-NrHyudaioPE34qulwQNe3RFk4KnjFTGmLRj8B9jGRu4=";
-        x86_64-linux = "sha256-Ib2ruq+Dzi2kKk8T7N56H9F7buxNdMl7rYoFGIfRECE=";
+        aarch64-linux = "sha256-0wFhMzLK1QViDc0ZLM/oVemtRW0g+FRJRFFOL/eiOFE=";
+        x86_64-linux = "sha256-mEVUVXCeizSzQDLtkNS/EkaxT0MToxL3x3UGb/XB9lI=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
@@ -49,10 +49,6 @@ stdenv.mkDerivation rec {
 
     mkdir -p $out/bin
     cp bin/* $out/bin/
-    rm $out/bin/gurobi.sh
-    rm $out/bin/python*
-
-    cp lib/gurobi.py $out/bin/gurobi.sh
 
     mkdir -p $out/include
     cp include/gurobi*.h $out/include/
diff --git a/pkgs/by-name/in/infisicalsdk/package.nix b/pkgs/by-name/in/infisicalsdk/package.nix
index e55bf9f88e97..b36f007eff43 100644
--- a/pkgs/by-name/in/infisicalsdk/package.nix
+++ b/pkgs/by-name/in/infisicalsdk/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "infisicalsdk";
-  version = "1.0.11";
+  version = "1.0.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Infisical";
     repo = "python-sdk-official";
     tag = "v${version}";
-    hash = "sha256-iapdd59Bsz80yRuEWY6zIVYrsoz+WMEOUymmVHzUOd8=";
+    hash = "sha256-fuUun4vm8MBdl8MmR9cV+OWSRGsSaRoh7IF1vHRGm1k=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ki/kiro/package.nix b/pkgs/by-name/ki/kiro/package.nix
index 98f94898129e..a10537b2708f 100644
--- a/pkgs/by-name/ki/kiro/package.nix
+++ b/pkgs/by-name/ki/kiro/package.nix
@@ -15,7 +15,7 @@ in
   inherit useVSCodeRipgrep;
   commandLineArgs = extraCommandLineArgs;
 
-  version = "0.5.9";
+  version = "0.6.0";
   pname = "kiro";
 
   # You can find the current VSCode version in the About dialog:
diff --git a/pkgs/by-name/ki/kiro/sources.json b/pkgs/by-name/ki/kiro/sources.json
index 9bd3bc43de19..9fbe867aca8d 100644
--- a/pkgs/by-name/ki/kiro/sources.json
+++ b/pkgs/by-name/ki/kiro/sources.json
@@ -1,14 +1,14 @@
 {
   "x86_64-linux": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/202511032205--distro-linux-x64-tar-gz/202511032205-distro-linux-x64.tar.gz",
-    "hash": "sha256-Xm7uRogux3bQMsWjdaamrHELnxNltRmjPLM8Mgt5+5Y="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/linux-x64/signed/0.6.0/tar/kiro-ide-0.6.0-stable-linux-x64.tar.gz",
+    "hash": "sha256-FOMfF/rJIzBnAqR5dxUlcDaMV2I/7dWMqU2UtMvJZIo="
   },
   "x86_64-darwin": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/202511032205-Kiro-dmg-darwin-x64.dmg",
-    "hash": "sha256-oJ5Xr/wJQIX3R5cLnBCv1kpULLy3ljW53LGqw4zYY5c="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-x64/signed/0.6.0/kiro-ide-0.6.0-stable-darwin-x64.dmg",
+    "hash": "sha256-3Bf5a+9yw4WyCy1ADn64YomkjH4Qr7wGPO0kMVd8ZzM="
   },
   "aarch64-darwin": {
-    "url": "https://prod.download.desktop.kiro.dev/releases/202511032205-Kiro-dmg-darwin-arm64.dmg",
-    "hash": "sha256-dtc/Wfs8GzVPHny58MDRFSr9gG0hwdZC5qz5uIJh6N4="
+    "url": "https://prod.download.desktop.kiro.dev/releases/stable/darwin-arm64/signed/0.6.0/kiro-ide-0.6.0-stable-darwin-arm64.dmg",
+    "hash": "sha256-H5AEQgvG1JtBUVUaQp2cYLkpxOgaZdblVUWLCo0HweU="
   }
 }
diff --git a/pkgs/by-name/ki/kiro/update.sh b/pkgs/by-name/ki/kiro/update.sh
old mode 100755
new mode 100644
index 1f74336dd597..211dd624d020
--- a/pkgs/by-name/ki/kiro/update.sh
+++ b/pkgs/by-name/ki/kiro/update.sh
@@ -42,7 +42,7 @@ for platform in "${!PLATFORM_URLS[@]}"; do
 
     # Extract file URL and version from metadata
     file_url=$(echo "$response" | jq -r '
-        .releases[0].updateTo
+        .releases[].updateTo
         | select(.url | test("\\.(tar|dmg)(\\.|$)"))
         | .url' | head -1)
 
diff --git a/pkgs/by-name/lu/lubelogger/package.nix b/pkgs/by-name/lu/lubelogger/package.nix
index 01d6c6c99188..9eb99bbc2e2b 100644
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "lubelogger";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "hargata";
     repo = "lubelog";
     rev = "v${version}";
-    hash = "sha256-YynkoqifKgEH8yiewcVVmMT0kX+NXaansJ7Z78NfXm4=";
+    hash = "sha256-xoq1EgwA4MScuyVN4djqWPjlRXouMR3JnZviOIaDNUU=";
   };
 
   projectFile = "CarCareTracker.sln";
diff --git a/pkgs/by-name/ly/LycheeSlicer/package.nix b/pkgs/by-name/ly/LycheeSlicer/package.nix
index b944570be8c4..d5ce649830d2 100644
--- a/pkgs/by-name/ly/LycheeSlicer/package.nix
+++ b/pkgs/by-name/ly/LycheeSlicer/package.nix
@@ -9,11 +9,11 @@
 }:
 let
   pname = "LycheeSlicer";
-  version = "7.5.0";
+  version = "7.5.1";
 
   src = fetchurl {
     url = "https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/LycheeSlicer-${version}.AppImage";
-    hash = "sha256-jI/V8tczgBHl3/LOEui+DbjWB5kD67+mL2HMvPz80+8=";
+    hash = "sha256-mjpBE896mKQbJZysGW6skzisrUhcanU0tMB8bk4YauM=";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/ma/matio/package.nix b/pkgs/by-name/ma/matio/package.nix
index 77a71345ae13..9cc0c0cf155a 100644
--- a/pkgs/by-name/ma/matio/package.nix
+++ b/pkgs/by-name/ma/matio/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "matio";
-  version = "1.5.28";
+  version = "1.5.29";
 
   src = fetchurl {
     url = "mirror://sourceforge/matio/matio-${finalAttrs.version}.tar.gz";
-    hash = "sha256-naaYk0ohVprwWOY0hWRmb0UCnmwrCHjKDY+WCb93uNg=";
+    hash = "sha256-2eX3ovLFlO/xX1UONHKbAZkc3VoCilWL6M5ZWzIjOvs=";
   };
 
   configureFlags = [ "ac_cv_va_copy=1" ];
diff --git a/pkgs/by-name/mi/micromamba/package.nix b/pkgs/by-name/mi/micromamba/package.nix
index fa003a439763..6c6ed46282bd 100644
--- a/pkgs/by-name/mi/micromamba/package.nix
+++ b/pkgs/by-name/mi/micromamba/package.nix
@@ -1,80 +1,65 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  bzip2,
-  cli11,
-  cmake,
-  curl,
-  ghc_filesystem,
-  libarchive,
-  libsolv,
-  yaml-cpp,
-  nlohmann_json,
-  python3,
-  reproc,
-  spdlog,
-  tl-expected,
+  mamba-cpp,
+  testers,
+  runCommand,
 }:
 
-let
-  libsolv' = libsolv.overrideAttrs (oldAttrs: {
-    cmakeFlags = oldAttrs.cmakeFlags ++ [
-      "-DENABLE_CONDA=true"
-    ];
-
-    patches = [
-      # Apply the same patch as in the "official" boa-forge build:
-      # https://github.com/mamba-org/boa-forge/tree/master/libsolv
-      (fetchpatch {
-        url = "https://raw.githubusercontent.com/mamba-org/boa-forge/20530f80e2e15012078d058803b6e2c75ed54224/libsolv/conda_variant_priorization.patch";
-        sha256 = "1iic0yx7h8s662hi2jqx68w5kpyrab4fr017vxd4wyxb6wyk35dd";
-      })
-    ];
-  });
-in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "micromamba";
-  version = "1.5.8";
+  version = mamba-cpp.version;
 
-  src = fetchFromGitHub {
-    owner = "mamba-org";
-    repo = "mamba";
-    rev = "micromamba-" + version;
-    hash = "sha256-sxZDlMFoMLq2EAzwBVO++xvU1C30JoIoZXEX/sqkXS0=";
+  dontUnpack = true;
+  dontBuild = true;
+  dontConfigure = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+
+    # We copy the binary instead of symlinking.
+    # Mamba determines its identity (mamba vs micromamba) by reading /proc/self/exe.
+    # If we symlink, it resolves to 'mamba', causing shell init scripts to fail.
+    # Ref: <https://github.com/NixOS/nixpkgs/pull/460788#issuecomment-3585230714>
+    cp ${mamba-cpp}/bin/mamba $out/bin/micromamba
+  '';
+
+  passthru.tests = {
+    # 1. Standard version check
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "micromamba --version";
+    };
+
+    # 2. Regression test for the shell initialization issue
+    # This ensures that after sourcing the shell hook, `micromamba activate` works.
+    # If the binary were a symlink resolving to 'mamba', the hook would define a
+    # `mamba()` function instead of `micromamba()`, causing `micromamba activate` to fail.
+    shell-init =
+      runCommand "test-micromamba-shell-hook"
+        {
+          nativeBuildInputs = [ finalAttrs.finalPackage ];
+        }
+        ''
+          # The shell hook includes 'complete' commands for bash completion,
+          # which fail in non-interactive bash. We temporarily ignore errors
+          # during eval since we only care about the function definition.
+          set +e
+          eval "$(micromamba shell hook --shell bash)" 2>/dev/null
+          set -e
+
+          # Test that the micromamba function works (not mamba).
+          # If shell initialization fails above, then we expect to see an
+          # error beginning with something like:
+          #     'mamba' is running as a subprocess and can't modify the parent shell.
+          micromamba activate
+
+          touch $out
+        '';
   };
 
-  nativeBuildInputs = [ cmake ];
-
-  buildInputs = [
-    bzip2
-    cli11
-    nlohmann_json
-    curl
-    libarchive
-    yaml-cpp
-    libsolv'
-    reproc
-    spdlog
-    ghc_filesystem
-    python3
-    tl-expected
-  ];
-
-  cmakeFlags = [
-    "-DBUILD_LIBMAMBA=ON"
-    "-DBUILD_SHARED=ON"
-    "-DBUILD_MICROMAMBA=ON"
-    # "-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON"
-  ];
-
-  meta = with lib; {
-    description = "Reimplementation of the conda package manager";
-    homepage = "https://github.com/mamba-org/mamba";
-    license = licenses.bsd3;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ mausch ];
+  meta = mamba-cpp.meta // {
+    maintainers = with lib.maintainers; [ mausch ];
     mainProgram = "micromamba";
   };
-}
+})
diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeysAudio/package.nix
index 2cbf5e467743..992fdd7cf2ae 100644
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.87";
+  version = "11.88";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-m6CG0Ar6w2fF4h3CjVsdjWWHxau2Cl3iqxh4JLH+91k=";
+    hash = "sha256-dnVcCdIGLWU7CwWdYGNxAF4f41sjFUDRG0L0dNS6yTU=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/po/pomerium/package.json b/pkgs/by-name/po/pomerium/package.json
deleted file mode 100644
index eb48ee5cab7b..000000000000
--- a/pkgs/by-name/po/pomerium/package.json
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "name": "pomerium",
-  "version": "1.0.0",
-  "main": "src/index.tsx",
-  "license": "Apache-2.0",
-  "scripts": {
-    "build": "ts-node ./scripts/esbuild.ts",
-    "format": "prettier --write .",
-    "lint": "eslint .",
-    "watch": "ts-node ./scripts/esbuild.ts --watch"
-  },
-  "browserslist": {
-    "production": [
-      ">0.2%",
-      "not dead",
-      "not op_mini all"
-    ],
-    "development": [
-      "last 1 chrome version",
-      "last 1 firefox version",
-      "last 1 safari version"
-    ]
-  },
-  "dependencies": {
-    "@babel/core": "^7.0.0",
-    "@emotion/react": "^11.7.1",
-    "@emotion/styled": "^11.11.0",
-    "@fontsource/dm-mono": "^5.0.14",
-    "@fontsource/dm-sans": "^5.0.13",
-    "@mui/icons-material": "^5.14.9",
-    "@mui/material": "^5.4.0",
-    "lodash": "^4.17.21",
-    "markdown-to-jsx": "^7.2.1",
-    "react": "^17.0.2",
-    "react-dom": "^17.0.2",
-    "react-feather": "^2.0.10"
-  },
-  "devDependencies": {
-    "@trivago/prettier-plugin-sort-imports": "^4.2.1",
-    "@types/lodash": "^4.17.1",
-    "@types/node": "^20.12.11",
-    "@types/react": "^17.0.34",
-    "@types/react-dom": "^17.0.11",
-    "@typescript-eslint/eslint-plugin": "^5.10.2",
-    "@typescript-eslint/parser": "^5.59.11",
-    "esbuild": "^0.25.0",
-    "eslint": "7.32.0",
-    "eslint-config-prettier": "^8.3.0",
-    "eslint-plugin-react": "^7.28.0",
-    "prettier": "^2.4.1",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.1.3"
-  },
-  "prettier": {
-    "importOrder": [
-      "^[./]"
-    ],
-    "importOrderSeparation": true,
-    "importOrderSortSpecifiers": true
-  }
-}
diff --git a/pkgs/by-name/po/pomerium/package.nix b/pkgs/by-name/po/pomerium/package.nix
index 29cdd4ffb67c..80dd0bd31fb4 100644
--- a/pkgs/by-name/po/pomerium/package.nix
+++ b/pkgs/by-name/po/pomerium/package.nix
@@ -1,10 +1,13 @@
 {
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   lib,
   envoy,
-  mkYarnPackage,
+  yarnConfigHook,
+  yarnBuildHook,
   fetchYarnDeps,
+  nodejs,
   nixosTests,
   pomerium-cli,
 }:
@@ -29,29 +32,27 @@ buildGoModule rec {
 
   vendorHash = "sha256-mOTjBH8VqsMdyW5jTIZ76bf55WnHw9XuUSh6zsBktt0=";
 
-  ui = mkYarnPackage {
+  ui = stdenv.mkDerivation {
+    pname = "pomerium-ui";
     inherit version;
     src = "${src}/ui";
 
-    packageJSON = ./package.json;
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/ui/yarn.lock";
-      sha256 = lib.fileContents ./yarn-hash;
+      hash = "sha256-V2nSSMvTCK+SYmEhTbLMArIOmNs/AgB5xfhQGx3e/x8=";
     };
 
-    buildPhase = ''
-      runHook preBuild
-      yarn --offline build
-      runHook postBuild
-    '';
+    nativeBuildInputs = [
+      yarnConfigHook
+      yarnBuildHook
+      nodejs
+    ];
 
     installPhase = ''
       runHook preInstall
-      cp -R deps/pomerium/dist $out
+      cp -R dist $out
       runHook postInstall
     '';
-
-    doDist = false;
   };
 
   subPackages = [
diff --git a/pkgs/by-name/po/pomerium/updater.sh b/pkgs/by-name/po/pomerium/updater.sh
index 0df47268ca96..4ba7ef103a74 100755
--- a/pkgs/by-name/po/pomerium/updater.sh
+++ b/pkgs/by-name/po/pomerium/updater.sh
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p gnugrep coreutils curl wget jq nix-update prefetch-yarn-deps
+#! nix-shell -i bash -p gnugrep coreutils curl jq nix-update prefetch-yarn-deps
 
 set -euo pipefail
 pushd "$(dirname "${BASH_SOURCE[0]}")"
@@ -14,10 +14,6 @@ if [[ "$UPDATE_NIX_OLD_VERSION" == "$version" ]]; then
     exit 0
 fi
 
-rm -f package.json yarn.lock
-wget "$url/ui/yarn.lock" "$url/ui/package.json"
-echo $(prefetch-yarn-deps) > yarn-hash
-rm -f yarn.lock
-
 popd
 nix-update pomerium --version $version
+nix-update pomerium --version=skip --subpackage ui
diff --git a/pkgs/by-name/po/pomerium/yarn-hash b/pkgs/by-name/po/pomerium/yarn-hash
deleted file mode 100644
index 579ad09e4e27..000000000000
--- a/pkgs/by-name/po/pomerium/yarn-hash
+++ /dev/null
@@ -1 +0,0 @@
-07zzvqfinl7qqmwh00izvfc0xch2rjr4s8b1ca9ay26krd4d4sap
diff --git a/pkgs/by-name/pr/pr-tracker/package.nix b/pkgs/by-name/pr/pr-tracker/package.nix
index 253d3a874c42..b39cb54fca29 100644
--- a/pkgs/by-name/pr/pr-tracker/package.nix
+++ b/pkgs/by-name/pr/pr-tracker/package.nix
@@ -8,14 +8,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pr-tracker";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchzip {
     url = "https://git.qyliss.net/pr-tracker/snapshot/pr-tracker-${version}.tar.xz";
-    hash = "sha256-8ZA+FjTO/8GdzYFskz8G0ihxtddsiZ9W44cXbExllZE=";
+    hash = "sha256-lAraMuhAvTV/PX0R/SSga3bebuK0lizcyEK7Qo3iUmc=";
   };
 
-  cargoHash = "sha256-dFyJX2X+bR3h/opAETTJpvy1vDAmBYQ/gq4ywVRnWaM=";
+  cargoHash = "sha256-gD2J3yp2ICNU9bQSXp2ks5GV+vL76t278WwiWCsAT8k=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/pr/pretalx/package.nix b/pkgs/by-name/pr/pretalx/package.nix
index d20227d64687..f74ea8ffd78f 100644
--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@@ -4,7 +4,6 @@
   gettext,
   python3,
   fetchFromGitHub,
-  fetchPypi,
   plugins ? [ ],
   nixosTests,
 }:
@@ -13,42 +12,38 @@ let
   python = python3.override {
     self = python;
     packageOverrides = final: prev: {
-      django = prev.django_5_1;
+      django = prev.django_5_2;
 
-      django-csp = prev.django-csp.overridePythonAttrs rec {
-        version = "3.8";
-        src = fetchPypi {
-          inherit version;
-          pname = "django_csp";
-          hash = "sha256-7w8an32Nporm4WnALprGYcDs8E23Dg0dhWQFEqaEccA=";
-        };
-      };
-
-      django-extensions = prev.django-extensions.overridePythonAttrs {
-        # Compat issues with Django 5.1
-        # https://github.com/django-extensions/django-extensions/issues/1885
-        doCheck = false;
-      };
-
-      django-hierarkey = prev.django-hierarkey.overridePythonAttrs rec {
-        version = "1.2.1";
+      django-countries = prev.django-countries.overridePythonAttrs (oldAttrs: rec {
+        version = "8.1.0";
         src = fetchFromGitHub {
-          owner = "raphaelm";
-          repo = "django-hierarkey";
-          tag = version;
-          hash = "sha256-GkCNVovo2bDCp6m2GBvusXsaBhcmJkPNu97OdtsYROY=";
+          owner = "SmileyChris";
+          repo = "django-countries";
+          tag = "v${version}";
+          hash = "sha256-KtBFSkYNKwivCFlqlWm4idiMybqsqiV0SNZx3egLl6c=";
         };
-      };
+        build-system = with final; [ uv-build ];
+      });
+
+      django-tables2 = prev.django-tables2.overridePythonAttrs (oldAttrs: rec {
+        version = "2.7.0";
+        src = fetchFromGitHub {
+          owner = "jieter";
+          repo = "django-tables2";
+          tag = "v${version}";
+          hash = "sha256-Cb8XhCLqhc2Dx/5uAHnN9zTVL6/1+WekC4qTloBurzM=";
+        };
+      });
     };
   };
 
-  version = "2025.1.0";
+  version = "2025.2.0";
 
   src = fetchFromGitHub {
     owner = "pretalx";
     repo = "pretalx";
-    rev = "v${version}";
-    hash = "sha256-BlPmrfHbpsLI8DCldzoRudpf7T4SUpJXQA5h9o4Thek=";
+    tag = "v${version}";
+    hash = "sha256-em5bPKKlT3qUAv4zGGjOkjDPY7U8vbuqMZ8NQXwZg4k=";
   };
 
   meta = {
@@ -68,7 +63,7 @@ let
 
     sourceRoot = "${src.name}/src/pretalx/frontend/schedule-editor";
 
-    npmDepsHash = "sha256-8difCdoG7j75wqwuWA/VBRk9oTjsM0QqLnR0iLkd/FY=";
+    npmDepsHash = "sha256-voHiml0nFWZIST39D5ErB0xTiWAOHN9OZinYutuQcdg=";
 
     npmBuildScript = "build";
 
@@ -101,15 +96,14 @@ python.pkgs.buildPythonApplication rec {
   pythonRelaxDeps = [
     "beautifulsoup4"
     "bleach"
-    "beautifulsoup4"
     "celery"
     "css_inline"
     "cssutils"
     "defusedcsv"
     "defusedxml"
-    "django-compressor"
     "django-csp"
     "django-filter"
+    "django-formset-js-improved"
     "django-i18nfield"
     "djangorestframework"
     "markdown"
@@ -128,13 +122,12 @@ python.pkgs.buildPythonApplication rec {
       beautifulsoup4
       bleach
       celery
-      csscompressor
       css-inline
       cssutils
       defusedcsv
       defusedxml
+      diff-match-patch
       django
-      django-compressor
       django-context-decorator
       django-countries
       django-csp
@@ -143,12 +136,12 @@ python.pkgs.buildPythonApplication rec {
       django-formtools
       django-hierarkey
       django-i18nfield
-      django-libsass
+      django-minify-html
       django-scopes
+      django-tables2
       djangorestframework
       drf-flex-fields
       drf-spectacular
-      libsass
       markdown
       pillow
       publicsuffixlist
diff --git a/pkgs/by-name/pr/pretalx/plugins/llm.nix b/pkgs/by-name/pr/pretalx/plugins/llm.nix
index bb043355a8e9..6720d177821f 100644
--- a/pkgs/by-name/pr/pretalx/plugins/llm.nix
+++ b/pkgs/by-name/pr/pretalx/plugins/llm.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pretalx-llm";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "why2025-datenzone";
     repo = "pretalx-llm";
     rev = "v${version}";
-    hash = "sha256-Ga6Itvc+yL+p6K7w6WYTeNfxahaohDidDWnt0GtcWEM=";
+    hash = "sha256-KnL4X24RESAgO0Oh1k9c+K4zaho6CEFHMQvDeRdLBzs=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/pretalx/plugins/pages.nix b/pkgs/by-name/pr/pretalx/plugins/pages.nix
index 6df8a7472148..20ac7ccbae9d 100644
--- a/pkgs/by-name/pr/pretalx/plugins/pages.nix
+++ b/pkgs/by-name/pr/pretalx/plugins/pages.nix
@@ -1,20 +1,20 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "pretalx-pages";
-  version = "1.7.0";
+  version = "1.7.0-unstable-2025-10-10";
   pyproject = true;
 
-  # TODO: https://github.com/pretalx/pretalx-pages/issues/6
-  src = fetchPypi {
-    pname = "pretalx_pages";
-    inherit version;
-    hash = "sha256-XFZS0FUzouZzVh9AADK5dnezFZiAWoBihD4C184+690=";
+  src = fetchFromGitHub {
+    owner = "pretalx";
+    repo = "pretalx-pages";
+    rev = "58cfe9b227a5cf5597c30285500546d2d3d84b8a";
+    hash = "sha256-kfGdb7vcUvK4yXqJd1XftTNWPLvjE4zrZSy4xgrmkMg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/by-name/pr/prowlarr/package.nix b/pkgs/by-name/pr/prowlarr/package.nix
index dc0dfdfb4343..e0f76cd71104 100644
--- a/pkgs/by-name/pr/prowlarr/package.nix
+++ b/pkgs/by-name/pr/prowlarr/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   stdenvNoCC,
   fetchFromGitHub,
   buildDotnetModule,
@@ -19,7 +20,7 @@
   applyPatches,
 }:
 let
-  version = "2.1.5.5216";
+  version = "2.3.0.5236";
   # The dotnet8 compatibility patches also change `yarn.lock`, so we must pass
   # the already patched lockfile to `fetchYarnDeps`.
   src = applyPatches {
@@ -27,7 +28,7 @@ let
       owner = "Prowlarr";
       repo = "Prowlarr";
       tag = "v${version}";
-      hash = "sha256-/7U1V1/fF8fobVwQa/IzCGWIUIKMrSxTyj9KZhmfJ/E=";
+      hash = "sha256-ImRmOn53TMgozdkVPK5B0pXJTbFWoxy8PLQ2WoOdUcE=";
     };
     postPatch = ''
       mv src/NuGet.config NuGet.Config
@@ -72,7 +73,7 @@ buildDotnetModule {
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
   dotnet-runtime = dotnetCorePackages.aspnetcore_8_0;
 
-  doCheck = true;
+  doCheck = !stdenv.hostPlatform.isDarwin;
 
   __darwinAllowLocalNetworking = true; # for tests
 
diff --git a/pkgs/by-name/pv/pv/package.nix b/pkgs/by-name/pv/pv/package.nix
index 6155b8d1812e..9bd4f52e4414 100644
--- a/pkgs/by-name/pv/pv/package.nix
+++ b/pkgs/by-name/pv/pv/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pv";
-  version = "1.10.1";
+  version = "1.10.2";
 
   src = fetchurl {
     url = "https://www.ivarch.com/programs/sources/pv-${finalAttrs.version}.tar.gz";
-    hash = "sha256-INOHlLAPqThKHd+eOVqDV6B4LNlci3TPHfjfY4iVDuw=";
+    hash = "sha256-P3tH8Or2b5wqSH/F28QJzQC/5ezYqbGY128e0595Lck=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ra/ranger/package.nix b/pkgs/by-name/ra/ranger/package.nix
index c1bb5db49936..8beaf1154d5c 100644
--- a/pkgs/by-name/ra/ranger/package.nix
+++ b/pkgs/by-name/ra/ranger/package.nix
@@ -3,6 +3,8 @@
   fetchFromGitHub,
   python3Packages,
   file,
+  coreutils,
+  bashNonInteractive,
   less,
   highlight,
   w3m,
@@ -12,13 +14,13 @@
   neoVimSupport ? true,
   improvedEncodingDetection ? true,
   rightToLeftTextSupport ? false,
-  unstableGitUpdater,
+  nix-update-script,
 }:
 
 python3Packages.buildPythonApplication {
   pname = "ranger";
-  version = "1.9.3-unstable-2025-11-14";
-  format = "setuptools";
+  version = "1.9.4-unstable-2025-11-14";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ranger";
@@ -27,29 +29,38 @@ python3Packages.buildPythonApplication {
     hash = "sha256-vn1rAOFB2vq04Y/WAE44iH/b/zamAmvq8putUKwNqR8=";
   };
 
-  LC_ALL = "en_US.UTF-8";
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies =
+    [ ]
+    ++ lib.optionals imagePreviewSupport [ python3Packages.pillow ]
+    ++ lib.optionals neoVimSupport [ python3Packages.pynvim ]
+    ++ lib.optionals improvedEncodingDetection [ python3Packages.chardet ]
+    ++ lib.optionals rightToLeftTextSupport [ python3Packages.python-bidi ];
 
   nativeCheckInputs = with python3Packages; [
     pytestCheckHook
     astroid
     pylint
   ];
-  propagatedBuildInputs = [
-    less
-    file
-  ]
-  ++ lib.optionals imagePreviewSupport [ python3Packages.pillow ]
-  ++ lib.optionals sixelPreviewSupport [ imagemagick ]
-  ++ lib.optionals neoVimSupport [ python3Packages.pynvim ]
-  ++ lib.optionals improvedEncodingDetection [ python3Packages.chardet ]
-  ++ lib.optionals rightToLeftTextSupport [ python3Packages.python-bidi ];
 
-  preConfigure = ''
-    ${lib.optionalString (highlight != null) ''
-      sed -i -e 's|^\s*highlight\b|${highlight}/bin/highlight|' \
-        ranger/data/scope.sh
-    ''}
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath (
+      [
+        file
+        coreutils
+        bashNonInteractive
+      ]
+      ++ lib.optionals sixelPreviewSupport [ imagemagick ]
+    ))
+  ];
 
+  postPatch = ''
     substituteInPlace ranger/__init__.py \
       --replace "DEFAULT_PAGER = 'less'" "DEFAULT_PAGER = '${lib.getBin less}/bin/less'"
 
@@ -58,6 +69,10 @@ python3Packages.buildPythonApplication {
       --replace /usr/share $out/share \
       --replace "#set preview_script ~/.config/ranger/scope.sh" "set preview_script $out/share/doc/ranger/config/scope.sh"
   ''
+  + lib.optionalString (highlight != null) ''
+    sed -i -e 's|^\s*highlight\b|${highlight}/bin/highlight|' \
+      ranger/data/scope.sh
+  ''
   + lib.optionalString imagePreviewSupport ''
     substituteInPlace ranger/ext/img_display.py \
       --replace /usr/lib/w3m ${w3m}/libexec/w3m
@@ -67,11 +82,13 @@ python3Packages.buildPythonApplication {
       --replace "set preview_images false" "set preview_images true"
   '';
 
-  passthru.updateScript = unstableGitUpdater { tagPrefix = "v"; };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "File manager with minimalistic curses interface";
-    homepage = "https://ranger.github.io/";
+    homepage = "https://ranger.fm/";
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/si/simple-binary-encoding/deps.json b/pkgs/by-name/si/simple-binary-encoding/deps.json
index 490af168c51d..e48a93b279ac 100644
--- a/pkgs/by-name/si/simple-binary-encoding/deps.json
+++ b/pkgs/by-name/si/simple-binary-encoding/deps.json
@@ -323,10 +323,10 @@
    "jar": "sha256-jzqSFqU3NnEyKT6su6nfBi6s6PixahhK9Z4uSDnUzUE=",
    "pom": "sha256-+IDp0dQAyZwYkvWWTl/JIN0d7wViI1m5sFjzK1tCaXU="
   },
-  "org/agrona#agrona/2.3.1": {
-   "jar": "sha256-1c6VoTOazhPd0tAxVUMsalMonoN4E/aTIVpsq/AeZvg=",
-   "module": "sha256-d72z4nnWH8K9nGf46cf0HB6+sAeQNZL7wZlizuQmDro=",
-   "pom": "sha256-4kiqvmvUW54FQjK8jRMrV94UTxGFw65oFv84HYzF7bk="
+  "org/agrona#agrona/2.3.2": {
+   "jar": "sha256-Bfdqmcs6Q8xzVd76x4YWIdRqLhAzTlfAsl3+3xY3xis=",
+   "module": "sha256-nIL43vXt39VpH7+dK9OhrUQwkHrxGP8WM/F7a7CuA94=",
+   "pom": "sha256-Y+/XRNcac8io1ZRWB1ddQOT7uXZ4339vJQdQwOYB11o="
   },
   "org/antlr#antlr4-master/4.13.2": {
    "pom": "sha256-Ct2gJmhYc/ZRNgF4v/xEbO7kgzCBc5466dbo8H6NkCo="
diff --git a/pkgs/by-name/si/simple-binary-encoding/package.nix b/pkgs/by-name/si/simple-binary-encoding/package.nix
index 07a577fd5191..10307587d882 100644
--- a/pkgs/by-name/si/simple-binary-encoding/package.nix
+++ b/pkgs/by-name/si/simple-binary-encoding/package.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "simple-binary-encoding";
-  version = "1.36.1";
+  version = "1.36.2";
 
   src = fetchFromGitHub {
     owner = "aeron-io";
     repo = "simple-binary-encoding";
     tag = finalAttrs.version;
-    hash = "sha256-BP4JsxW1kTmS7yoqe1FdBDKy5bEzr3VYdfoNy9jTDEA=";
+    hash = "sha256-GQNJI/QZh7EZk06OhDoh4znnEBC4d5pnrQyhHL+HbzA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/terraform-compliance/package.nix b/pkgs/by-name/te/terraform-compliance/package.nix
index d579f9d4fdf2..81d81a92363c 100644
--- a/pkgs/by-name/te/terraform-compliance/package.nix
+++ b/pkgs/by-name/te/terraform-compliance/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "terraform-compliance";
-  version = "1.13.0";
+  version = "1.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "terraform-compliance";
     repo = "cli";
     tag = version;
-    hash = "sha256-YajEWo+yibAeJv/laZ7J8EMSXN2aIFh8O/geP6e9LsI=";
+    hash = "sha256-wWwYM1ZCHiBdbjl5kRI9dFSWp7mpYb/2HlV7lbU/Xeg=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index 882d4a5b03d5..4eec94e26bfc 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.7.0";
+  version = "11.8.1";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-BbHsOiySt9q2S2GfYuTm9Q9gF7+X7cHIyiaBZ5Ze+14=";
+    hash = "sha256-KQjs9oVFUQIL9aAorQ5kZiGJdHBDfCI9ENHjfz/mdng=";
   };
-  npmDepsHash = "sha256-evhtWDx3gBw+A8GlVrOQ0+5i84ASTSoq0/zgl6QibSE=";
+  npmDepsHash = "sha256-bucQdw3DYCUSUl78fR+/Tt8BL18o5wdtZP6rLzadoEQ=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/development/libraries/qodeassist-plugin/default.nix b/pkgs/development/libraries/qodeassist-plugin/default.nix
index 03359800638b..2549454e2cb5 100644
--- a/pkgs/development/libraries/qodeassist-plugin/default.nix
+++ b/pkgs/development/libraries/qodeassist-plugin/default.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "qodeassist-plugin";
-  version = "0.9.1";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "Palm1r";
     repo = "QodeAssist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o544kRkgODT9woBTyfua+f7GBJ28WL7UCmX4B8hYxsQ=";
+    hash = "sha256-RAq6SUVE5KkkaPuDS6Hb6UUoGe8PHSnoGM1UToqrKo0=";
   };
 
   dontWrapQtApps = true;
diff --git a/pkgs/development/python-modules/django-minify-html/default.nix b/pkgs/development/python-modules/django-minify-html/default.nix
new file mode 100644
index 000000000000..f8dff2911d45
--- /dev/null
+++ b/pkgs/development/python-modules/django-minify-html/default.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  asgiref,
+  django,
+  minify-html,
+
+  # tests
+  pytest-django,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "django-minify-html";
+  version = "1.14.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "adamchainz";
+    repo = "django-minify-html";
+    tag = version;
+    hash = "sha256-mTFHIZo1E9+d7bOfelFCUZRt5eEo6w+xKB5qf9jc8hY=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    asgiref
+    django
+    minify-html
+  ];
+
+  nativeCheckInputs = [
+    pytest-django
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=tests.settings
+  '';
+
+  pythonImportsCheck = [
+    "django_minify_html"
+  ];
+
+  meta = {
+    description = "Use minify-html, the extremely fast HTML + JS + CSS minifier, with Django";
+    homepage = "https://github.com/adamchainz/django-minify-html";
+    changelog = "https://github.com/adamchainz/django-minify-html/blob/${src.rev}/CHANGELOG.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/django/5_1.nix b/pkgs/development/python-modules/django/5_1.nix
deleted file mode 100644
index 87f5fa371a59..000000000000
--- a/pkgs/development/python-modules/django/5_1.nix
+++ /dev/null
@@ -1,151 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildPythonPackage,
-  fetchFromGitHub,
-  fetchpatch,
-  pythonAtLeast,
-  pythonOlder,
-  replaceVars,
-
-  # build-system
-  setuptools,
-
-  # patched in
-  geos,
-  gdal,
-  withGdal ? false,
-
-  # dependencies
-  asgiref,
-  sqlparse,
-
-  # optional-dependencies
-  argon2-cffi,
-  bcrypt,
-
-  # tests
-  aiosmtpd,
-  docutils,
-  geoip2,
-  jinja2,
-  numpy,
-  pillow,
-  pylibmc,
-  pymemcache,
-  python,
-  pyyaml,
-  pytz,
-  redis,
-  selenium,
-  tblib,
-  tzdata,
-}:
-
-buildPythonPackage rec {
-  pname = "django";
-  version = "5.1.14";
-  pyproject = true;
-
-  disabled = pythonOlder "3.10";
-
-  src = fetchFromGitHub {
-    owner = "django";
-    repo = "django";
-    rev = "refs/tags/${version}";
-    hash = "sha256-zRyI1aSRTyOjRogRj2Kgtr1jMPUTvoGHKypK2vQumhw=";
-  };
-
-  patches = [
-    (replaceVars ./django_5_set_zoneinfo_dir.patch {
-      zoneinfo = tzdata + "/share/zoneinfo";
-    })
-    # prevent tests from messing with our pythonpath
-    ./django_5_tests_pythonpath.patch
-    # disable test that expects timezone issues
-    ./django_5_disable_failing_tests.patch
-
-    # fix filename length limit tests on bcachefs
-    # FIXME: remove in 5.2
-    (fetchpatch {
-      url = "https://github.com/django/django/commit/12f4f95405c7857cbf2f4bf4d0261154aac31676.patch";
-      hash = "sha256-+K20/V8sh036Ox9U7CSPgfxue7f28Sdhr3MsB7erVOk=";
-    })
-  ]
-  ++ lib.optionals withGdal [
-    (replaceVars ./django_5_set_geos_gdal_lib.patch {
-      geos = geos;
-      gdal = gdal;
-      extension = stdenv.hostPlatform.extensions.sharedLibrary;
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace tests/utils_tests/test_autoreload.py \
-      --replace-fail "/usr/bin/python" "${python.interpreter}"
-  '';
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    asgiref
-    sqlparse
-  ];
-
-  optional-dependencies = {
-    argon2 = [ argon2-cffi ];
-    bcrypt = [ bcrypt ];
-  };
-
-  nativeCheckInputs = [
-    # tests/requirements/py3.txt
-    aiosmtpd
-    docutils
-    geoip2
-    jinja2
-    numpy
-    pillow
-    pylibmc
-    pymemcache
-    pyyaml
-    pytz
-    redis
-    selenium
-    tblib
-    tzdata
-  ]
-  ++ lib.concatAttrValues optional-dependencies;
-
-  preCheck = ''
-    # make sure the installed library gets imported
-    rm -rf django
-
-    # fails to import github_links from docs/_ext/github_links.py
-    rm tests/sphinx/test_github_links.py
-
-    # provide timezone data, works only on linux
-    export TZDIR=${tzdata}/${python.sitePackages}/tzdata/zoneinfo
-
-    export PYTHONPATH=$PWD/docs/_ext:$PYTHONPATH
-  '';
-
-  checkPhase = ''
-    runHook preCheck
-
-    pushd tests
-    ${python.interpreter} runtests.py --settings=test_sqlite
-    popd
-
-    runHook postCheck
-  '';
-
-  __darwinAllowLocalNetworking = true;
-
-  meta = with lib; {
-    changelog = "https://docs.djangoproject.com/en/${lib.versions.majorMinor version}/releases/${version}/";
-    description = "High-level Python Web framework that encourages rapid development and clean, pragmatic design";
-    homepage = "https://www.djangoproject.com";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ hexa ];
-  };
-}
diff --git a/pkgs/development/python-modules/gurobipy/default.nix b/pkgs/development/python-modules/gurobipy/default.nix
index 4c06dc57ddf8..7243c2ea8672 100644
--- a/pkgs/development/python-modules/gurobipy/default.nix
+++ b/pkgs/development/python-modules/gurobipy/default.nix
@@ -10,22 +10,21 @@ let
   format = "wheel";
   pyShortVersion = "cp" + builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion;
   platforms = rec {
-    aarch64-darwin =
-      if pyShortVersion == "cp313" then "macosx_10_13_universal2" else "macosx_10_9_universal2";
-    aarch64-linux = "manylinux2014_aarch64.manylinux_2_17_aarch64";
+    aarch64-darwin = "macosx_10_13_universal2";
+    aarch64-linux = "manylinux_2_26_aarch64";
     x86_64-darwin = aarch64-darwin;
     x86_64-linux = "manylinux2014_x86_64.manylinux_2_17_x86_64";
   };
   platform = platforms.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
   hashes = rec {
-    cp312-aarch64-darwin = "sha256-Ag8jJ39jDgeerBFDheq9G9n7SsIvh5btW6bZFc5PFBs=";
-    cp312-aarch64-linux = "sha256-crv1RLwFBgu5OQm3lxWs5MD0FhmPdiKphcq7no6Zqhw=";
+    cp312-aarch64-darwin = "sha256-qbdDlsAHHrRDijyLgYZMVKjoqxBPEFhNf+ZHQ0Qo+08=";
+    cp312-aarch64-linux = "sha256-1cfo6K3h1l6hzbHNIK2H0Y9uejjyFWAYlczUSvyTLOE=";
     cp312-x86_64-darwin = cp312-aarch64-darwin;
-    cp312-x86_64-linux = "sha256-s/lxyvJw9nG2/89bk3s8BDClJksPAVKdyGgdYcIh8hU=";
-    cp313-aarch64-darwin = "sha256-qFUuR2c8tvH9NR7fj8rYawL4Msv7V9kO8h4Dl+ltE44=";
-    cp313-aarch64-linux = "sha256-vgXAdBQcihJsiq7MxBeVqwkaZm6rs5yh/5inS96B5mM=";
+    cp312-x86_64-linux = "sha256-nXcNqkw/Chn+tmcRa1GaQSjTgn3wdnaUbskLOyOSEpo=";
+    cp313-aarch64-darwin = "sha256-9anXslqv9KIxf/Dt7xCAqF6/tQFDlWwOMkQookmXDBE=";
+    cp313-aarch64-linux = "sha256-0x5gOK+m0LygVFuh6hGfNyaWXclNdfuBppqq7Pu3FoI=";
     cp313-x86_64-darwin = cp313-aarch64-darwin;
-    cp313-x86_64-linux = "sha256-eaMzdm4n/veQLO7vvPAnmhyjk6J6cupi+OMBshqhfVk=";
+    cp313-x86_64-linux = "sha256-rSAMw5aAp+Emz2Xlo2GXrbVsvKRw/CcxcF441N/IsTw=";
   };
   hash =
     hashes."${pyShortVersion}-${stdenv.system}"
@@ -33,7 +32,7 @@ let
 in
 buildPythonPackage rec {
   pname = "gurobipy";
-  version = "12.0.3";
+  version = "13.0.0";
   inherit format;
 
   src = fetchPypi {
diff --git a/pkgs/development/python-modules/langchain-openai/default.nix b/pkgs/development/python-modules/langchain-openai/default.nix
index 6aa836529f8c..3d2727d403af 100644
--- a/pkgs/development/python-modules/langchain-openai/default.nix
+++ b/pkgs/development/python-modules/langchain-openai/default.nix
@@ -33,14 +33,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-openai";
-  version = "1.0.3";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-openai==${version}";
-    hash = "sha256-6xJEzwJlKGJg6LBQdKIt1E0dkSJcnocUOXq+NzUVEEc=";
+    hash = "sha256-dmuDgKQW1yAz/8tjQx7LaUiuz5Sh4cAyd9nt33mCPbI=";
   };
 
   sourceRoot = "${src.name}/libs/partners/openai";
diff --git a/pkgs/development/python-modules/locust-cloud/default.nix b/pkgs/development/python-modules/locust-cloud/default.nix
index b06851608411..42354d7b107a 100644
--- a/pkgs/development/python-modules/locust-cloud/default.nix
+++ b/pkgs/development/python-modules/locust-cloud/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "locust-cloud";
-  version = "1.29.0";
+  version = "1.29.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "locustcloud";
     repo = "locust-cloud";
     tag = version;
-    hash = "sha256-cWcP1haQQcdOgjxDLZcbsQX18x68l3LSD9NZ/jZJiqE=";
+    hash = "sha256-3rlHtOSYMfHbNdWpo59OXS1Z1BWY99d7AKmZZuxAz9E=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mistral-common/default.nix b/pkgs/development/python-modules/mistral-common/default.nix
index 2daf4cf77c13..ca5151b94c62 100644
--- a/pkgs/development/python-modules/mistral-common/default.nix
+++ b/pkgs/development/python-modules/mistral-common/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -14,7 +15,6 @@
   pydantic,
   pydantic-extra-types,
   requests,
-  sentencepiece,
   tiktoken,
   typing-extensions,
 
@@ -26,6 +26,7 @@
   pycountry,
   pydantic-settings,
   pytestCheckHook,
+  sentencepiece,
   soundfile,
   soxr,
   uvicorn,
@@ -53,7 +54,6 @@ buildPythonPackage rec {
     pydantic
     pydantic-extra-types
     requests
-    sentencepiece
     tiktoken
     typing-extensions
   ];
@@ -62,7 +62,8 @@ buildPythonPackage rec {
     opencv = [
       opencv-python-headless
     ];
-    sentencepiece = [
+    # Broken on Darwin. See https://github.com/NixOS/nixpkgs/issues/466092
+    sentencepiece = lib.optionals (!stdenv.hostPlatform.isDarwin) [
       sentencepiece
     ];
     soundfile = [
@@ -97,7 +98,8 @@ buildPythonPackage rec {
     soundfile
     soxr
     uvicorn
-  ];
+  ]
+  ++ lib.concatAttrValues optional-dependencies;
 
   disabledTests = [
     # Require internet
@@ -112,6 +114,20 @@ buildPythonPackage rec {
     "test_openai_chat_fields"
   ];
 
+  # Requires sentencepiece which segfaults when initialized on Darwin
+  # See https://github.com/NixOS/nixpkgs/issues/466092
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    "tests/experimental/test_app.py"
+    "tests/experimental/test_tools.py"
+    "tests/test_fim_tokenizer.py"
+    "tests/test_integration_samples.py"
+    "tests/test_mistral_tokenizer.py"
+    "tests/test_tokenize_v1.py"
+    "tests/test_tokenize_v2.py"
+    "tests/test_tokenize_v3.py"
+    "tests/test_tokenizer_v7.py"
+  ];
+
   meta = {
     description = "Tools to help you work with Mistral models";
     homepage = "https://github.com/mistralai/mistral-common";
diff --git a/pkgs/development/python-modules/pyglm/default.nix b/pkgs/development/python-modules/pyglm/default.nix
index f485417c6250..2d8cb9742d35 100644
--- a/pkgs/development/python-modules/pyglm/default.nix
+++ b/pkgs/development/python-modules/pyglm/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyglm";
-  version = "2.8.2";
+  version = "2.8.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Zuzu-Typ";
     repo = "PyGLM";
     tag = version;
-    hash = "sha256-oLPZ6sCIAt12iolcSBNXEjbHGE4ou+dgoFhB400pyRk=";
+    hash = "sha256-7IN/kqFCwAMeVUrBB/CfCm9bSt1dHMbbLtqVInRFCk0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/pyngrok/default.nix b/pkgs/development/python-modules/pyngrok/default.nix
index f08e4fe6a250..6b8749c2a2af 100644
--- a/pkgs/development/python-modules/pyngrok/default.nix
+++ b/pkgs/development/python-modules/pyngrok/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pyngrok";
-  version = "7.4.1";
+  version = "7.5.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rYY3c4ztW9uIwosIf+o5ylUoYMLTAASsAQM8D460824=";
+    hash = "sha256-L+kcuiwlMez7EktQcfN3gIthpooUyjyZ/Lfz/a4FJ48=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pytorch-tokenizers/default.nix b/pkgs/development/python-modules/pytorch-tokenizers/default.nix
index e87b613b887a..c8d04e185462 100644
--- a/pkgs/development/python-modules/pytorch-tokenizers/default.nix
+++ b/pkgs/development/python-modules/pytorch-tokenizers/default.nix
@@ -90,5 +90,10 @@ buildPythonPackage rec {
     homepage = "https://github.com/meta-pytorch/tokenizers";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
+    badPlatforms = [
+      # sentencepiece 0.21.0 segfaults when initialized on Darwin
+      # See https://github.com/NixOS/nixpkgs/issues/466092
+      lib.systems.inspect.patterns.isDarwin
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/torchdata/default.nix b/pkgs/development/python-modules/torchdata/default.nix
index 6dd33d7ba112..f74d9e159970 100644
--- a/pkgs/development/python-modules/torchdata/default.nix
+++ b/pkgs/development/python-modules/torchdata/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -54,6 +55,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    # RuntimeError: DataLoader timed out after 5 seconds
+    "test_ind_worker_queue"
+  ];
+
   meta = {
     description = "Iterative enhancement to the PyTorch torch.utils.data.DataLoader and torch.utils.data.Dataset/IterableDataset";
     homepage = "https://github.com/meta-pytorch/data";
diff --git a/pkgs/development/python-modules/torchtune/default.nix b/pkgs/development/python-modules/torchtune/default.nix
index d205aa25f51d..b086be9d1f53 100644
--- a/pkgs/development/python-modules/torchtune/default.nix
+++ b/pkgs/development/python-modules/torchtune/default.nix
@@ -119,5 +119,10 @@ buildPythonPackage rec {
     changelog = "https://github.com/meta-pytorch/torchtune/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
+    badPlatforms = [
+      # sentencepiece 0.21.0 segfaults when initialized on Darwin
+      # See https://github.com/NixOS/nixpkgs/issues/466092
+      lib.systems.inspect.patterns.isDarwin
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/weconnect-mqtt/default.nix b/pkgs/development/python-modules/weconnect-mqtt/default.nix
index d8ee33f4fcab..2a550085fb2f 100644
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@@ -6,23 +6,20 @@
   pytest-cov-stub,
   pytestCheckHook,
   python-dateutil,
-  pythonOlder,
   setuptools,
   weconnect,
 }:
 
 buildPythonPackage rec {
   pname = "weconnect-mqtt";
-  version = "0.49.2";
+  version = "0.49.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "tillsteinbach";
     repo = "WeConnect-mqtt";
     tag = "v${version}";
-    hash = "sha256-jTScDPTj7aIQcGuL2g8MvuYln6iaj6abEyCfd8vvT2I=";
+    hash = "sha256-I1//jAF7Exz5d+5B3lhcdokh7xlUoJUFryqTQwFqWuM=";
   };
 
   postPatch = ''
@@ -55,7 +52,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python client that publishes data from Volkswagen WeConnect";
     homepage = "https://github.com/tillsteinbach/WeConnect-mqtt";
-    changelog = "https://github.com/tillsteinbach/WeConnect-mqtt/releases/tag/v${version}";
+    changelog = "https://github.com/tillsteinbach/WeConnect-mqtt/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "weconnect-mqtt";
diff --git a/pkgs/development/python-modules/weconnect/default.nix b/pkgs/development/python-modules/weconnect/default.nix
index ed1c14c863b5..dc47594440dd 100644
--- a/pkgs/development/python-modules/weconnect/default.nix
+++ b/pkgs/development/python-modules/weconnect/default.nix
@@ -5,25 +5,23 @@
   fetchFromGitHub,
   oauthlib,
   pillow,
+  pyjwt,
   pytest-cov-stub,
   pytestCheckHook,
-  pythonOlder,
   requests,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "weconnect";
-  version = "0.60.8";
+  version = "0.60.10";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "tillsteinbach";
     repo = "WeConnect-python";
     tag = "v${version}";
-    hash = "sha256-o8g409R+3lXlwPiDFi9eCzTwcDcZhMEMcc8a1YvlomM=";
+    hash = "sha256-ZvJoZ4mUNkUJ5sOxOHDsuxGZO2s3PSEfidt3aDfmBeg=";
   };
 
   postPatch = ''
@@ -40,6 +38,7 @@ buildPythonPackage rec {
 
   dependencies = [
     oauthlib
+    pyjwt
     requests
   ];
 
@@ -62,7 +61,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client for the Volkswagen WeConnect Services";
     homepage = "https://github.com/tillsteinbach/WeConnect-python";
-    changelog = "https://github.com/tillsteinbach/WeConnect-python/releases/tag/v${version}";
+    changelog = "https://github.com/tillsteinbach/WeConnect-python/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 4aaab8ea4c9b..321d01c9ba12 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -115,7 +115,8 @@ mapAliases {
   django-crispy-bootstrap3 = crispy-bootstrap3; # added 2025-06-11
   django-crispy-bootstrap4 = crispy-bootstrap4; # added 2025-06-11
   django-crispy-bootstrap5 = crispy-bootstrap5; # added 2025-06-11
-  django_3 = throw "Django 3 has reached it#s EOL in 2024-04 and has therefore been removed."; # added 2025-01-25
+  django_3 = throw "Django 3 has reached it's EOL in 2024-04 and has therefore been removed."; # added 2025-01-25
+  django_5_1 = throw "Django 5.1 has reached it's EOL in 2025-12 and has therefore been removed."; # added 2025-11-30"
   django_appconf = throw "'django_appconf' has been renamed to/replaced by 'django-appconf'"; # Converted to throw 2025-10-29
   django_classytags = throw "'django_classytags' has been renamed to/replaced by 'django-classy-tags'"; # Converted to throw 2025-10-29
   django_colorful = throw "'django_colorful' has been renamed to/replaced by 'django-colorful'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e1bba01f0de6..6051daa09f6a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4129,6 +4129,8 @@ self: super: with self; {
 
   django-mfa3 = callPackage ../development/python-modules/django-mfa3 { };
 
+  django-minify-html = callPackage ../development/python-modules/django-minify-html { };
+
   django-model-utils = callPackage ../development/python-modules/django-model-utils { };
 
   django-modelcluster = callPackage ../development/python-modules/django-modelcluster { };
@@ -4300,8 +4302,6 @@ self: super: with self; {
 
   django_5 = self.django_5_2;
 
-  django_5_1 = callPackage ../development/python-modules/django/5_1.nix { };
-
   django_5_2 = callPackage ../development/python-modules/django/5_2.nix { };
 
   djangocms-admin-style = callPackage ../development/python-modules/djangocms-admin-style { };