diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 62af18754cb5..0b50f0616c26 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -403,6 +403,7 @@
   ./security/please.nix
   ./security/polkit.nix
   ./security/rtkit.nix
+  ./security/run0.nix
   ./security/soteria.nix
   ./security/sudo-rs.nix
   ./security/sudo.nix
diff --git a/nixos/modules/security/run0.nix b/nixos/modules/security/run0.nix
new file mode 100644
index 000000000000..430c03706063
--- /dev/null
+++ b/nixos/modules/security/run0.nix
@@ -0,0 +1,52 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.security.run0;
+
+  sudoAlias = pkgs.writeScriptBin "sudo" ''
+    if [[ "$1" == -* ]]; then
+      echo "This script is a sudo-alias to systemd's run0 and does not support any sudo parameters."
+      exit 1
+    fi
+    exec run0 "$@"
+  '';
+in
+{
+  options.security.run0 = {
+    wheelNeedsPassword = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Whether users of the `wheel` group must
+        provide a password to run commands as super user via {command}`run0`.
+      '';
+    };
+
+    enableSudoAlias = lib.mkEnableOption "make {command}`sudo` an alias to {command}`run0`.";
+  };
+
+  config = {
+    assertions = [
+      {
+        assertion =
+          cfg.enableSudoAlias -> (!config.security.sudo.enable && !config.security.sudo-rs.enable);
+        message = "`security.run0.enableSudoAlias` cannot be enabled if `security.sudo` or `security.sudo-rs` are enabled.";
+      }
+    ];
+
+    security.polkit.extraConfig = lib.mkIf (!cfg.wheelNeedsPassword) ''
+      polkit.addRule(function(action, subject) {
+        if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
+          return polkit.Result.YES;
+        }
+      });
+    '';
+
+    environment.systemPackages = lib.optional cfg.enableSudoAlias sudoAlias;
+  };
+}
diff --git a/nixos/modules/services/computing/slurm/slurm.nix b/nixos/modules/services/computing/slurm/slurm.nix
index 52e6ef873f17..f6f3fac6c5f0 100644
--- a/nixos/modules/services/computing/slurm/slurm.nix
+++ b/nixos/modules/services/computing/slurm/slurm.nix
@@ -3,6 +3,7 @@
   lib,
   options,
   pkgs,
+  utils,
   ...
 }:
 let
@@ -83,6 +84,28 @@ in
             slurm to work properly (see `services.munge.password`).
           '';
         };
+
+        flags = lib.mkOption {
+          type = lib.types.attrsOf (
+            lib.types.oneOf [
+              lib.types.str
+              lib.types.bool
+              lib.types.float
+              lib.types.int
+            ]
+          );
+          default = { };
+          example = {
+            "i" = true;
+            "systemd" = true;
+            "L" = "/var/log/file with space.log";
+            "n" = 10;
+          };
+          description = ''
+            Flags passed to `slurmctld` daemon, see {manpage}`slurmctld(8)`.
+            Special characters are properly escaped.
+          '';
+        };
       };
 
       dbdserver = {
@@ -484,7 +507,17 @@ in
 
           serviceConfig = {
             Type = "forking";
-            ExecStart = "${wrappedSlurm}/bin/slurmctld";
+            ExecStart =
+              let
+                isLong = optionName: builtins.stringLength optionName > 1;
+                flagFormat = optionName: {
+                  option = if isLong optionName then "--${optionName}" else "-${optionName}";
+                  sep = null;
+                  explicitBool = false;
+                };
+                cli = [ "${wrappedSlurm}/bin/slurmctld" ] ++ lib.cli.toCommandLine flagFormat cfg.server.flags;
+              in
+              utils.escapeSystemdExecArgs cli;
             PIDFile = "/run/slurmctld.pid";
             ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           };
diff --git a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
index 8fb1a0775808..9441cb137224 100644
--- a/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/sourcegraph.amp/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "sourcegraph";
     name = "amp";
-    version = "0.0.1766678962";
-    hash = "sha256-XjRgrdoefafCkKYazPtjhLUdyOqoMByaCCtgbfqKHSg=";
+    version = "0.0.1767211791";
+    hash = "sha256-r8CjaSOXgnFkzcnyospFI3IwVpvc18KmYzwBpuv1Ab0=";
   };
 
   meta = {
diff --git a/pkgs/applications/graphics/sane/frontends.nix b/pkgs/applications/graphics/sane/frontends.nix
index 684b477187f8..21c34ad95c6c 100644
--- a/pkgs/applications/graphics/sane/frontends.nix
+++ b/pkgs/applications/graphics/sane/frontends.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   fetchpatch,
+  autoconf,
   sane-backends,
   libX11,
   gtk2,
@@ -67,10 +68,18 @@ stdenv.mkDerivation rec {
     gtk2
   ]
   ++ lib.optional (libusb-compat-0_1 != null) libusb-compat-0_1;
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    autoconf
+  ];
 
   enableParallelBuilding = true;
 
+  # https://bugzilla.redhat.com/show_bug.cgi?id=2341321
+  preConfigure = ''
+    autoconf
+  '';
+
   meta = {
     description = "Scanner Access Now Easy";
     homepage = "http://www.sane-project.org/";
diff --git a/pkgs/by-name/am/amp-cli/package-lock.json b/pkgs/by-name/am/amp-cli/package-lock.json
index 0a30fc04566b..db9f7dfd8bec 100644
--- a/pkgs/by-name/am/amp-cli/package-lock.json
+++ b/pkgs/by-name/am/amp-cli/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1766634431-g578c41"
+        "@sourcegraph/amp": "^0.0.1767172180-g2c9ff0"
       }
     },
     "node_modules/@napi-rs/keyring": {
@@ -228,9 +228,9 @@
       }
     },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1766634431-g578c41",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1766634431-g578c41.tgz",
-      "integrity": "sha512-k5qEQdnWGeLTjrov69uGCGRXZG7IxJbkqr5RUhB/8AkiD+XcKz3CwzyZqFBoaZXZ2Q6KxZ6Ws2k9p611K89b7w==",
+      "version": "0.0.1767172180-g2c9ff0",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1767172180-g2c9ff0.tgz",
+      "integrity": "sha512-CPLZmfgEh3WiG9LmYEACUHW3UuR3srvW/Bz/L5ORabUUk5cCVfPv8XuU027cPAoDLDN0pVczOLJDudZVOzICEQ==",
       "license": "Amp Commercial License",
       "dependencies": {
         "@napi-rs/keyring": "1.1.9"
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index de6ccb8159c1..2c51c5c0b607 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1766634431-g578c41";
+  version = "0.0.1767172180-g2c9ff0";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-Bp9fvN7KgkTSr23iVY1FLWqac+gjC/WO+YjMf9pv0B8=";
+    hash = "sha256-9GjpmqjGXVY4sWUaLdCvcZandoHTE5KPDfkisNuguSw=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-mmNPrBTnTQ96rrVFAELl2o9YCApWmkJEHHnmPHozkt0=";
+  npmDepsHash = "sha256-6eDkFSNKDU2eC5FOStVXqt0rLqN6k7r1+s+lDTEf5xw=";
 
   propagatedBuildInputs = [
     ripgrep
diff --git a/pkgs/by-name/an/anvil-editor/package.nix b/pkgs/by-name/an/anvil-editor/package.nix
index ed1a9e3d91ee..1e63152d690f 100644
--- a/pkgs/by-name/an/anvil-editor/package.nix
+++ b/pkgs/by-name/an/anvil-editor/package.nix
@@ -16,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "anvil-editor";
-  version = "0.6.3";
+  version = "0.7";
 
   # has to update vendorHash of extra package manually
   # nixpkgs-update: no auto update
   src = fetchzip {
     url = "https://anvil-editor.net/releases/anvil-src-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-GPzd1oKkf160ya0sxUd72wego0BvwCerZ5SiY2q0EDE=";
+    hash = "sha256-9lJg8IMt6+GJm5a7j7ZyhbwvAmlBKvtdOv9FD9MQdrA=";
   };
 
   modRoot = "anvil/editor";
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
   anvilExtras = buildGoModule {
     pname = "anvil-editor-extras";
     inherit (finalAttrs) version src meta;
-    vendorHash = "sha256-q/PunSBe+gWTWyf8rjfikK56rP2PeZqpuiFG9HIVMTk=";
+    vendorHash = "sha256-Hnq1aq1DGM7IJwjU38yEk6yXmQQLyisMeaktNZNysy8=";
     modRoot = "anvil/extras";
     # Include dependency on anvil api
     postPatch = ''
diff --git a/pkgs/by-name/ca/cage/package.nix b/pkgs/by-name/ca/cage/package.nix
index a113607dbd5e..0d7e15158985 100644
--- a/pkgs/by-name/ca/cage/package.nix
+++ b/pkgs/by-name/ca/cage/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -31,6 +32,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-P9MhIl2YIE2hwT5Yr0Cpes5S12evb0aj9oOPLeehkw0=";
   };
 
+  patches = [
+    # backport of https://github.com/cage-kiosk/cage/pull/461
+    # to fix https://github.com/cage-kiosk/cage/issues/456
+    # remove on next release
+    (fetchpatch {
+      url = "https://github.com/cage-kiosk/cage/commit/832e88b0c964a324bb09c7af02ed0650b73dfb9b.patch";
+      hash = "sha256-8dyJL46xXGkw3pF9uskX8H72s0hUO1BhU2UMaoEwz4U=";
+    })
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/by-name/ch/chow-kick/package.nix b/pkgs/by-name/ch/chow-kick/package.nix
index b65941f8d089..fb4716d53c96 100644
--- a/pkgs/by-name/ch/chow-kick/package.nix
+++ b/pkgs/by-name/ch/chow-kick/package.nix
@@ -55,6 +55,23 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
+    # Fix width/height naming in chowdsp_GraphicsHelpers.h
+    substituteInPlace modules/chowdsp_utils/modules/common/chowdsp_core/DataStructures/chowdsp_GraphicsHelpers.h --replace-fail \
+      'position.y += r.h;' \
+      'position.y += r.height;'
+
+    substituteInPlace modules/chowdsp_utils/modules/common/chowdsp_core/DataStructures/chowdsp_GraphicsHelpers.h --replace-fail \
+      'height -= r.h;' \
+      'height -= r.height;'
+
+    substituteInPlace modules/chowdsp_utils/modules/common/chowdsp_core/DataStructures/chowdsp_GraphicsHelpers.h --replace-fail \
+      'position.x += r.w;' \
+      'position.x += r.width;'
+
+    substituteInPlace modules/chowdsp_utils/modules/common/chowdsp_core/DataStructures/chowdsp_GraphicsHelpers.h --replace-fail \
+      'width -= r.w;' \
+      'width -= r.width;'
+
     substituteInPlace modules/chowdsp_wdf/CMakeLists.txt --replace-fail \
       'cmake_minimum_required(VERSION 3.1)' \
       'cmake_minimum_required(VERSION 4.0)'
diff --git a/pkgs/by-name/cp/cpulimit/package.nix b/pkgs/by-name/cp/cpulimit/package.nix
index 14a9d4d28b05..49ecd04353f5 100644
--- a/pkgs/by-name/cp/cpulimit/package.nix
+++ b/pkgs/by-name/cp/cpulimit/package.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "1dz045yhcsw1rdamzpz4bk8mw888in7fyqk1q1b3m1yk4pd1ahkh";
   };
 
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   patches = [
     ./remove-sys-sysctl.h.patch
     ./get-missing-basename.patch
diff --git a/pkgs/by-name/df/dfu-programmer/package.nix b/pkgs/by-name/df/dfu-programmer/package.nix
index dba65f84e364..404804530ea1 100644
--- a/pkgs/by-name/df/dfu-programmer/package.nix
+++ b/pkgs/by-name/df/dfu-programmer/package.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--disable-libusb_1_0" ];
 
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   meta = {
     license = lib.licenses.gpl2;
     description = "Device Firmware Update based USB programmer for Atmel chips with a USB bootloader";
diff --git a/pkgs/by-name/dn/dnsrecon/package.nix b/pkgs/by-name/dn/dnsrecon/package.nix
index f34cef256e01..eb106a49e36d 100644
--- a/pkgs/by-name/dn/dnsrecon/package.nix
+++ b/pkgs/by-name/dn/dnsrecon/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dnsrecon";
-  version = "1.5.2";
+  version = "1.5.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "darkoperator";
     repo = "dnsrecon";
     tag = version;
-    hash = "sha256-FFe421hB1V8EQd3Uyl/3PvWwgn3YcRtz6k+umpiwfW4=";
+    hash = "sha256-MkeHQZXWCqZ9/Z8WEVZIkDeLB/bnSxi8NBpgrcxAo+s=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/dr/draupnir/package.nix b/pkgs/by-name/dr/draupnir/package.nix
index cbbc893f2c32..8fc178985773 100644
--- a/pkgs/by-name/dr/draupnir/package.nix
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   makeBinaryWrapper,
-  nodejs,
+  nodejs_22,
   matrix-sdk-crypto-nodejs,
   python3,
   sqlite,
@@ -17,7 +17,7 @@
   nix-update-script,
 }:
 let
-  nodeSources = srcOnly nodejs;
+  nodeSources = srcOnly nodejs_22;
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     yarnConfigHook
     yarnBuildHook
-    nodejs
+    nodejs_22
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin cctools.libtool;
 
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
     mv ./lib ./version.txt ./node_modules ./package.json $out/lib/node_modules/draupnir
 
     # Create wrapper executable
-    makeWrapper ${lib.getExe nodejs} $out/bin/draupnir \
+    makeWrapper ${lib.getExe nodejs_22} $out/bin/draupnir \
       --add-flags "--enable-source-maps" \
       --add-flags "$out/lib/node_modules/draupnir/lib/index.js"
 
diff --git a/pkgs/by-name/e-/e-search/package.nix b/pkgs/by-name/e-/e-search/package.nix
index 5931508b137f..6d7b1fa47a6a 100644
--- a/pkgs/by-name/e-/e-search/package.nix
+++ b/pkgs/by-name/e-/e-search/package.nix
@@ -54,13 +54,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "e-search";
-  version = "15.2.1";
+  version = "15.2.3";
 
   src = fetchFromGitHub {
     owner = "xushengfeng";
     repo = "eSearch";
     tag = finalAttrs.version;
-    hash = "sha256-K4GFLUeq/IbJC3FZBgvKnZq7JrXkqe6eVGsUxxlpWF0=";
+    hash = "sha256-wzSspt1qJpBgw4MyiK+vhRjoybNcaaa9nWBPV0bctiM=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     nativeBuildInputs = [ gitMinimal ];
     pnpm = pnpm';
     fetcherVersion = 2;
-    hash = "sha256-wPwsFY7wvbE1LW5PMwMZKejELtqmdsYO2RVrEuOzdcg=";
+    hash = "sha256-q0+6vkDZdcDXwsTxby2RuQUYTgEnxGx1CeXROSrG9lU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fl/fleet/package.nix b/pkgs/by-name/fl/fleet/package.nix
index 407f7c471b8c..2a002ddcb349 100644
--- a/pkgs/by-name/fl/fleet/package.nix
+++ b/pkgs/by-name/fl/fleet/package.nix
@@ -7,15 +7,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "fleet";
-  version = "4.77.0";
+  version = "4.78.0";
 
   src = fetchFromGitHub {
     owner = "fleetdm";
     repo = "fleet";
     tag = "fleet-v${finalAttrs.version}";
-    hash = "sha256-3GrEjXNHts4qEjv8GhQSwAtcC6/I94SWbr6D4aPXW5c=";
+    hash = "sha256-iUgOBF3vPfr3VCfUc+pASith7R6TA29AuWKCJfbHbQw=";
   };
-  vendorHash = "sha256-DXCfuEGMmcbVcV2LBa6oPMPDtkbkomdgbV4LlMV9qe8=";
+  vendorHash = "sha256-EwPbZLcqJV5J7ieoQwAJLIn4wwMlwZoTtWaXgvY3pR0=";
 
   subPackages = [
     "cmd/fleet"
diff --git a/pkgs/by-name/fo/foundry/package.nix b/pkgs/by-name/fo/foundry/package.nix
index 2f6b138fe16b..aad6d8bfde95 100644
--- a/pkgs/by-name/fo/foundry/package.nix
+++ b/pkgs/by-name/fo/foundry/package.nix
@@ -7,7 +7,6 @@
   nix-update-script,
   pkg-config,
   rustPlatform,
-  solc,
   versionCheckHook,
 }:
 
@@ -29,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ];
 
-  buildInputs = [ solc ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libusb1 ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libusb1 ];
 
   # Tests are run upstream, and many perform I/O
   # incompatible with the nix build sandbox.
diff --git a/pkgs/by-name/ge/gemini-cli-bin/package.nix b/pkgs/by-name/ge/gemini-cli-bin/package.nix
index 38a6aeeff552..8634e95963b0 100644
--- a/pkgs/by-name/ge/gemini-cli-bin/package.nix
+++ b/pkgs/by-name/ge/gemini-cli-bin/package.nix
@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gemini-cli-bin";
-  version = "0.22.4";
+  version = "0.22.5";
 
   src = fetchurl {
     url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
-    hash = "sha256-7Dy2/dkNCC/TaUEixP6iMegOh9SoeTHUn7K0VGi4Rwg=";
+    hash = "sha256-g6b45+EWBiZ6Ij0nXp0L5jBW8wv1y0KK5CgiThk8Y7U=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/gt/gtkwave/package.nix b/pkgs/by-name/gt/gtkwave/package.nix
index d87503a827a2..025eb2b8745d 100644
--- a/pkgs/by-name/gt/gtkwave/package.nix
+++ b/pkgs/by-name/gt/gtkwave/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkwave";
-  version = "3.3.125";
+  version = "3.3.126";
 
   src = fetchurl {
     url = "mirror://sourceforge/gtkwave/${pname}-gtk3-${version}.tar.gz";
-    sha256 = "sha256-Musd9N/Vbg3eF+igjeYPIBOK8BeoqK1kUi9pYnVixDc=";
+    sha256 = "sha256-llAZ10gpdGtdHTgqnPHiciRskRAdDhMfDaUSyUulgWo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/jo/john/package.nix b/pkgs/by-name/jo/john/package.nix
index b1dee316ce36..e1cbaef70ce0 100644
--- a/pkgs/by-name/jo/john/package.nix
+++ b/pkgs/by-name/jo/john/package.nix
@@ -40,6 +40,9 @@ stdenv.mkDerivation {
     })
   ];
 
+  # Fix build with gcc 15
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   postPatch = ''
     sed -ri -e '
       s!^(#define\s+CFG_[A-Z]+_NAME\s+).*/!\1"'"$out"'/etc/john/!
diff --git a/pkgs/by-name/li/libloot/package.nix b/pkgs/by-name/li/libloot/package.nix
index 83c66c1bd578..65940b449752 100644
--- a/pkgs/by-name/li/libloot/package.nix
+++ b/pkgs/by-name/li/libloot/package.nix
@@ -119,7 +119,13 @@ stdenv.mkDerivation (finalAttrs: {
       owner = "loot";
       repo = "yaml-cpp";
       tag = "0.8.0+merge-key-support.2";
-      hash = "sha256-whYorebrLiDeO75LC2SMUX/8OD528BR0+DEgnJxxpoQ=";
+
+      # fixes error: 'uint16_t' was not declared in this scope
+      postFetch = ''
+        sed -e '1i #include <cstdint>' -i "$out/src/emitterutils.cpp"
+      '';
+
+      hash = "sha256-5xbqOI4L3XCqx+4k6IcZUwOdHAfbBy7nZgRKGkRJabQ=";
     };
 
     buildRustFFIPackage =
diff --git a/pkgs/by-name/li/libstrophe/package.nix b/pkgs/by-name/li/libstrophe/package.nix
index 0f521177883e..32e9326b0f90 100644
--- a/pkgs/by-name/li/libstrophe/package.nix
+++ b/pkgs/by-name/li/libstrophe/package.nix
@@ -22,10 +22,17 @@ stdenv.mkDerivation rec {
     hash = "sha256-53O8hHyw9y0Bzs+BpGouAxuSGJxh6NSNNWZqi7RHAsY=";
   };
 
+  patches = [
+    # Newer GCC rejects implicitly weak-typed pointer casting.
+    # Upstream PR: https://github.com/strophe/libstrophe/pull/267
+    ./pointer-cast.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
     openssl
     expat
diff --git a/pkgs/by-name/li/libstrophe/pointer-cast.patch b/pkgs/by-name/li/libstrophe/pointer-cast.patch
new file mode 100644
index 000000000000..b929636e021f
--- /dev/null
+++ b/pkgs/by-name/li/libstrophe/pointer-cast.patch
@@ -0,0 +1,65 @@
+diff --git a/src/handler.c b/src/handler.c
+index 1c9bf9f..168df75 100644
+--- a/src/handler.c
++++ b/src/handler.c
+@@ -320,7 +320,7 @@ static void _timed_handler_delete(xmpp_ctx_t *ctx,
+  */
+ void xmpp_timed_handler_delete(xmpp_conn_t *conn, xmpp_timed_handler handler)
+ {
+-    _timed_handler_delete(conn->ctx, &conn->timed_handlers, handler);
++    _timed_handler_delete(conn->ctx, &conn->timed_handlers, (xmpp_void_handler)handler);
+ }
+ 
+ static void _id_handler_add(xmpp_conn_t *conn,
+@@ -349,7 +349,7 @@ static void _id_handler_add(xmpp_conn_t *conn,
+         return;
+ 
+     item->user_handler = user_handler;
+-    item->handler = handler;
++    item->handler = (xmpp_void_handler)handler;
+     item->userdata = userdata;
+     item->enabled = 0;
+     item->next = NULL;
+@@ -451,7 +451,7 @@ static void _handler_add(xmpp_conn_t *conn,
+ 
+     memset(item, 0, sizeof(*item));
+     item->user_handler = user_handler;
+-    item->handler = handler;
++    item->handler = (xmpp_void_handler)handler;
+     item->userdata = userdata;
+ 
+     if (_dup_string(conn->ctx, ns, &item->u.ns))
+@@ -530,7 +530,7 @@ void xmpp_timed_handler_add(xmpp_conn_t *conn,
+                             unsigned long period,
+                             void *userdata)
+ {
+-    _timed_handler_add(conn->ctx, &conn->timed_handlers, handler, period,
++    _timed_handler_add(conn->ctx, &conn->timed_handlers, (xmpp_void_handler)handler, period,
+                        userdata, 1);
+ }
+ 
+@@ -548,7 +548,7 @@ void handler_add_timed(xmpp_conn_t *conn,
+                        unsigned long period,
+                        void *userdata)
+ {
+-    _timed_handler_add(conn->ctx, &conn->timed_handlers, handler, period,
++    _timed_handler_add(conn->ctx, &conn->timed_handlers, (xmpp_void_handler)handler, period,
+                        userdata, 0);
+ }
+ 
+@@ -747,7 +747,7 @@ void xmpp_global_timed_handler_add(xmpp_ctx_t *ctx,
+                                    unsigned long period,
+                                    void *userdata)
+ {
+-    _timed_handler_add(ctx, &ctx->timed_handlers, handler, period, userdata, 1);
++    _timed_handler_add(ctx, &ctx->timed_handlers, (xmpp_void_handler)handler, period, userdata, 1);
+ }
+ 
+ /** Delete a global timed handler.
+@@ -760,5 +760,5 @@ void xmpp_global_timed_handler_add(xmpp_ctx_t *ctx,
+ void xmpp_global_timed_handler_delete(xmpp_ctx_t *ctx,
+                                       xmpp_global_timed_handler handler)
+ {
+-    _timed_handler_delete(ctx, &ctx->timed_handlers, handler);
++    _timed_handler_delete(ctx, &ctx->timed_handlers, (xmpp_void_handler)handler);
+ }
diff --git a/pkgs/by-name/li/linux-wifi-hotspot/package.nix b/pkgs/by-name/li/linux-wifi-hotspot/package.nix
index 4f10506fc3e3..2eda4a32df4d 100644
--- a/pkgs/by-name/li/linux-wifi-hotspot/package.nix
+++ b/pkgs/by-name/li/linux-wifi-hotspot/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   which,
   pkg-config,
   glib,
@@ -50,6 +51,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputs = [ "out" ];
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/lakinduakash/linux-wifi-hotspot/commit/a3fce4b3ee9371eeb7b300fa7e9f291d93986db3.patch";
+      hash = "sha256-tvWoYvQELYVq1Cr6NG+9kafYFHZloNMuOvaPeIbYlSI=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace ./src/scripts/Makefile \
       --replace "etc" "$out/etc"
diff --git a/pkgs/by-name/lr/lrs/fix-signal-handler-type.patch b/pkgs/by-name/lr/lrs/fix-signal-handler-type.patch
new file mode 100644
index 000000000000..c1bdcb5779eb
--- /dev/null
+++ b/pkgs/by-name/lr/lrs/fix-signal-handler-type.patch
@@ -0,0 +1,43 @@
+diff '--color=auto' -u -r a/lrslib.c b/lrslib.c
+--- a/lrslib.c
++++ b/lrslib.c
+@@ -84,10 +84,10 @@
+ /* signals handling            */
+ /*******************************/
+ #ifndef SIGNALS
+-static void checkpoint ();
+-static void die_gracefully ();
++static void checkpoint (int);
++static void die_gracefully (int);
+ static void setup_signals (void);
+-static void timecheck ();
++static void timecheck (int);
+ #endif
+ 
+ /*******************************/
+@@ -6368,7 +6368,7 @@
+ }
+ 
+ static void
+-timecheck ()
++timecheck (int)
+ {
+   lrs_dump_state ();
+   errcheck ("signal", signal (SIGALRM, timecheck));
+@@ -6376,14 +6376,14 @@
+ }
+ 
+ static void
+-checkpoint ()
++checkpoint (int)
+ {
+   lrs_dump_state ();
+   errcheck ("signal", signal (SIGUSR1, checkpoint));
+ }
+ 
+ static void
+-die_gracefully ()
++die_gracefully (int)
+ {
+   lrs_dump_state ();
+ 
diff --git a/pkgs/by-name/lr/lrs/package.nix b/pkgs/by-name/lr/lrs/package.nix
index 51f51296f9f5..94791a31e6a3 100644
--- a/pkgs/by-name/lr/lrs/package.nix
+++ b/pkgs/by-name/lr/lrs/package.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation {
     sha256 = "sha256-xJpOvYVhg0c9HVpieF/N/hBX1dZx1LlvOhJQ6xr+ToM=";
   };
 
+  patches = [
+    # fix passing argument 2 of 'signal' from incompatible pointer type error
+    ./fix-signal-handler-type.patch
+  ];
+
   buildInputs = [ gmp ];
 
   makeFlags = [
diff --git a/pkgs/by-name/ma/mani/package.nix b/pkgs/by-name/ma/mani/package.nix
index 273d01bf1f8e..1fb0363f8e15 100644
--- a/pkgs/by-name/ma/mani/package.nix
+++ b/pkgs/by-name/ma/mani/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mani";
-  version = "0.31.1";
+  version = "0.31.2";
 
   src = fetchFromGitHub {
     owner = "alajmo";
     repo = "mani";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-GB9BlicNiExDUi9s4PdvsqFHqwvekme/Usqp6I/k5kc=";
+    sha256 = "sha256-vQpwU+zU4xplN2Rp1v/uXIWgIYRb47s/HWREyHH226k=";
   };
 
-  vendorHash = "sha256-PnQocOtnIBl0+5mDG7irEqGjAnzJ9Wk/fA4NW/nU+zw=";
+  vendorHash = "sha256-Ob3yD7UblWMRc7EyvEStrLStTT3wV/XssUPTos/olyI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ma/matrix-tuwunel/package.nix b/pkgs/by-name/ma/matrix-tuwunel/package.nix
index b4e0b3948e38..9c72a558ef38 100644
--- a/pkgs/by-name/ma/matrix-tuwunel/package.nix
+++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix
@@ -88,16 +88,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-tuwunel";
-  version = "1.4.8";
+  version = "1.4.9.1";
 
   src = fetchFromGitHub {
     owner = "matrix-construct";
     repo = "tuwunel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NKq5bEn40nHIewmaVPQ2aFJEZ4jkmnXDAZ/lL3rD8iQ=";
+    hash = "sha256-Hm0k6N8nSj3nRsppqledtXOKlnWBwG1SjpB4IE5R4vk=";
   };
 
-  cargoHash = "sha256-7BC8I3urT9/fArVm9Ji5U0jzAqovUE914jgZz8ejiUk=";
+  cargoHash = "sha256-uXZyAXajWstZ8+fm9BC5ru2BVAXx+vYoe1GXivCOY/8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/mm/mmixware/package.nix b/pkgs/by-name/mm/mmixware/package.nix
index b70467b2b5c1..488792b4f6dc 100644
--- a/pkgs/by-name/mm/mmixware/package.nix
+++ b/pkgs/by-name/mm/mmixware/package.nix
@@ -23,9 +23,13 @@ stdenv.mkDerivation {
     substituteInPlace Makefile --replace 'rm abstime.h' ""
   '';
 
-  # Workaround build failure on -fno-common toolchains:
-  #   ld: mmix-config.o:(.bss+0x600): multiple definition of `buffer'; /build/ccDuGrwH.o:(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = toString [
+    # Workaround build failure on -fno-common toolchains:
+    #   ld: mmix-config.o:(.bss+0x600): multiple definition of `buffer'; /build/ccDuGrwH.o:(.bss+0x20): first defined here
+    "-fcommon"
+    # Workaround to build with GCC 15
+    "-std=gnu17"
+  ];
 
   nativeBuildInputs = [ tetex ];
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/mo/mongosh/package.nix b/pkgs/by-name/mo/mongosh/package.nix
index 29a85204d78a..4c925831bd69 100644
--- a/pkgs/by-name/mo/mongosh/package.nix
+++ b/pkgs/by-name/mo/mongosh/package.nix
@@ -2,9 +2,10 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  nodejs_22,
 }:
 
-buildNpmPackage (finalAttrs: {
+buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
   pname = "mongosh";
   version = "2.5.10";
 
diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index bcb76f454105..3822e983512d 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -100,13 +100,13 @@ let
 
   finalAttrs = {
     pname = "ncps";
-    version = "0.5.1";
+    version = "0.5.2";
 
     src = fetchFromGitHub {
       owner = "kalbasit";
       repo = "ncps";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-dPCzfy29wjRL5eXaueM8qLtKMmsNcwTqtSDBNOJ4NMc=";
+      hash = "sha256-uGghoADkD2eJYZwt8QSiVzw68dRDLI+OxMa1VAQhBKQ=";
     };
 
     ldflags = [
diff --git a/pkgs/by-name/ne/nethack/function-parameters.patch b/pkgs/by-name/ne/nethack/function-parameters.patch
new file mode 100644
index 000000000000..7060916d0392
--- /dev/null
+++ b/pkgs/by-name/ne/nethack/function-parameters.patch
@@ -0,0 +1,86 @@
+diff --git a/include/system.h b/include/system.h
+index a2cb51f..9f40fdd 100644
+--- a/include/system.h
++++ b/include/system.h
+@@ -60,17 +60,17 @@ typedef long off_t;
+ #endif
+ #ifndef SIG_RET_TYPE
+ #if defined(NHSTDC) || defined(POSIX_TYPES) || defined(OS2) || defined(__DECC)
+-#define SIG_RET_TYPE void (*)()
++#define SIG_RET_TYPE void (*)(int)
+ #endif
+ #endif
+ #ifndef SIG_RET_TYPE
+ #if defined(ULTRIX) || defined(SUNOS4) || defined(SVR3) || defined(SVR4)
+ /* SVR3 is defined automatically by some systems */
+-#define SIG_RET_TYPE void (*)()
++#define SIG_RET_TYPE void (*)(int)
+ #endif
+ #endif
+ #ifndef SIG_RET_TYPE /* BSD, SIII, SVR2 and earlier, Sun3.5 and earlier */
+-#define SIG_RET_TYPE int (*)()
++#define SIG_RET_TYPE int (*)(int)
+ #endif
+ 
+ #if !defined(__cplusplus) && !defined(__GO32__)
+@@ -96,7 +96,7 @@ E long NDECL(lrand48);
+ E void FDECL(srand48, (long));
+ #else
+ E long lrand48();
+-E void srand48();
++E void srand48(long);
+ #endif /* MACOSX */
+ #endif /* BSD || ULTRIX || RANDOM */
+ 
+@@ -352,10 +352,10 @@ E char *FDECL(memset, (char *, int, int));
+ #endif /* MICRO */
+ 
+ #if defined(BSD) && defined(ultrix) /* i.e., old versions of Ultrix */
+-E void sleep();
++E void sleep(unsigned);
+ #endif
+ #if defined(ULTRIX) || defined(SYSV)
+-E unsigned sleep();
++E unsigned sleep(unsigned);
+ #endif
+ #if defined(HPUX)
+ E unsigned int FDECL(sleep, (unsigned int));
+@@ -519,7 +519,7 @@ E char *FDECL(tgoto, (const char *, int, int));
+ #else
+ #if !(defined(HPUX) && defined(_POSIX_SOURCE))
+ E int FDECL(tgetent, (char *, const char *));
+-E void FDECL(tputs, (const char *, int, int (*)()));
++E void FDECL(tputs, (const char *, int, int (*)(int)));
+ #endif
+ E int FDECL(tgetnum, (const char *));
+ E int FDECL(tgetflag, (const char *));
+diff --git a/include/winX.h b/include/winX.h
+index a1a5605..1d6b84b 100644
+--- a/include/winX.h
++++ b/include/winX.h
+@@ -279,7 +279,7 @@ typedef struct {
+ } AppResources;
+ 
+ E AppResources appResources;
+-E void (*input_func)();
++E void (*input_func)(Widget, XEvent *, String *, Cardinal *);
+ 
+ extern struct window_procs X11_procs;
+ 
+diff --git a/include/xwindow.h b/include/xwindow.h
+index 8b9cfa0..8307c25 100644
+--- a/include/xwindow.h
++++ b/include/xwindow.h
+@@ -76,8 +76,10 @@
+ #define XtNexposeCallback "exposeCallback"
+ #define XtNresizeCallback "resizeCallback"
+ 
+-extern XFontStruct *WindowFontStruct(/* Widget */);
+-extern Font WindowFont(/* Widget */);
++struct Widget;
++
++extern XFontStruct *WindowFontStruct(Widget);
++extern Font WindowFont(Widget);
+ 
+ #define XtCWindowResource "WindowResource"
+ #define XtCRows "Rows"
diff --git a/pkgs/by-name/ne/nethack/package.nix b/pkgs/by-name/ne/nethack/package.nix
index 40e0e2e301d0..4f1f7b44ccc2 100644
--- a/pkgs/by-name/ne/nethack/package.nix
+++ b/pkgs/by-name/ne/nethack/package.nix
@@ -67,6 +67,11 @@ stdenvUsed.mkDerivation (finalAttrs: {
     hash = "sha256-mM9n323r+WaKYXRaqEwJvKs2Ll0z9blE7FFV1E0qrLI=";
   };
 
+  patches = [
+    # Newer GCC rejects function declarations without explicit parameters.
+    ./function-parameters.patch
+  ];
+
   buildInputs = [
     ncurses
   ]
diff --git a/pkgs/by-name/ne/nezha/package.nix b/pkgs/by-name/ne/nezha/package.nix
index c1e4c6a610c9..9c91ca4a577d 100644
--- a/pkgs/by-name/ne/nezha/package.nix
+++ b/pkgs/by-name/ne/nezha/package.nix
@@ -48,13 +48,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "nezha";
-  version = "1.14.10";
+  version = "1.14.12";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tgjLkNSNEQCJP1/Pcgfldl5DGQnzca6KMrqEjl45ex4=";
+    hash = "sha256-gNXbg5JaHHogJaRGmAjOXskrbkSRu1fnIqQMu8U3lzk=";
   };
 
   proxyVendor = true;
@@ -94,7 +94,7 @@ buildGoModule (finalAttrs: {
     GOROOT=''${GOROOT-$(go env GOROOT)} swag init --pd -d . -g ./cmd/dashboard/main.go -o ./cmd/dashboard/docs --parseGoList=false
   '';
 
-  vendorHash = "sha256-Q+ur9hIG0xVJHdi79K5e4sV8xuR45qp195ptEDbHAvc=";
+  vendorHash = "sha256-9vJzQqXkoENRapcHp/afSCcdOrt8bxrIyJT/cBeas+A=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ri/ride/package.nix b/pkgs/by-name/ri/ride/package.nix
index 09f6a6eeb6d4..f690c035c227 100644
--- a/pkgs/by-name/ri/ride/package.nix
+++ b/pkgs/by-name/ri/ride/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildNpmPackage,
   fetchFromGitHub,
-  fetchpatch,
   replaceVars,
   jq,
   moreutils,
@@ -25,7 +24,7 @@ buildNpmPackage rec {
     hash = "sha256-11wlKK0z3/KRKMKNrDvZLvK7vV0UzrMTaG0ei9n6VEk=";
   };
 
-  npmDepsHash = "sha256-1+RjSr5FSaQFqkL/yzlAQhm56NVG2kjzZC/DsEi3HJE=";
+  npmDepsHash = "sha256-o8pwjx5P/1eFV3HTWlHGV1/ad9YUSOI0zUWvqkqIf3I=";
 
   patches = [
     # Fix info in the "about" page, enable asar, add option to build for the detected system
@@ -33,7 +32,7 @@ buildNpmPackage rec {
       inherit version;
     })
 
-    # would not build with nodejs_22 and above without this
+    # would not build with nodejs_24 and above without this
     ./update-nan.patch
   ];
 
diff --git a/pkgs/by-name/ri/ride/update-nan.patch b/pkgs/by-name/ri/ride/update-nan.patch
index 64f835915f3e..801743fb6575 100644
--- a/pkgs/by-name/ri/ride/update-nan.patch
+++ b/pkgs/by-name/ri/ride/update-nan.patch
@@ -1,31 +1,31 @@
 diff --git a/package-lock.json b/package-lock.json
-index a0bd285..5a5ec59 100644
+index cc8b8bd..13b4bed 100644
 --- a/package-lock.json
 +++ b/package-lock.json
-@@ -8034,9 +8034,10 @@
+@@ -8190,9 +8190,10 @@
        "dev": true
      },
      "node_modules/nan": {
 -      "version": "2.17.0",
 -      "resolved": "https://registry.npmjs.org/nan/-/nan-2.17.0.tgz",
 -      "integrity": "sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ==",
-+      "version": "2.22.0",
-+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.0.tgz",
-+      "integrity": "sha512-nbajikzWTMwsW+eSsNm3QwlOs7het9gGJU5dDZzRTQGk03vyBOauxgI4VakDzE0PtsGTmXPsXTbbjVhRwR5mpw==",
++      "version": "2.24.0",
++      "resolved": "https://registry.npmjs.org/nan/-/nan-2.24.0.tgz",
++      "integrity": "sha512-Vpf9qnVW1RaDkoNKFUvfxqAbtI8ncb8OJlqZ9wwpXzWPEsvsB1nvdUi6oYrHIkQ1Y/tMDnr1h4nczS0VB9Xykg==",
 +      "license": "MIT",
        "optional": true
      },
      "node_modules/nanomatch": {
-@@ -18258,9 +18259,9 @@
+@@ -18572,9 +18573,9 @@
        "dev": true
      },
      "nan": {
 -      "version": "2.17.0",
 -      "resolved": "https://registry.npmjs.org/nan/-/nan-2.17.0.tgz",
 -      "integrity": "sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ==",
-+      "version": "2.22.0",
-+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.0.tgz",
-+      "integrity": "sha512-nbajikzWTMwsW+eSsNm3QwlOs7het9gGJU5dDZzRTQGk03vyBOauxgI4VakDzE0PtsGTmXPsXTbbjVhRwR5mpw==",
++      "version": "2.24.0",
++      "resolved": "https://registry.npmjs.org/nan/-/nan-2.24.0.tgz",
++      "integrity": "sha512-Vpf9qnVW1RaDkoNKFUvfxqAbtI8ncb8OJlqZ9wwpXzWPEsvsB1nvdUi6oYrHIkQ1Y/tMDnr1h4nczS0VB9Xykg==",
        "optional": true
      },
      "nanomatch": {
diff --git a/pkgs/by-name/sh/shntool/bool-type.patch b/pkgs/by-name/sh/shntool/bool-type.patch
new file mode 100644
index 000000000000..ed3dcd8d480d
--- /dev/null
+++ b/pkgs/by-name/sh/shntool/bool-type.patch
@@ -0,0 +1,48 @@
+diff --git a/include/format.h b/include/format.h
+index 567993e..ab293f8 100644
+--- a/include/format.h
++++ b/include/format.h
+@@ -35,7 +35,7 @@ void tagcpy(unsigned char *,unsigned char *);
+ int tagcmp(unsigned char *,unsigned char *);
+ 
+ /* function to check if a file name is about to be clobbered, and if so, asks whether this is OK */
+-int clobber_check(char *);
++bool clobber_check(char *);
+ 
+ /* find an output format module with the given name */
+ format_module *find_format(char *);
+diff --git a/include/mode.h b/include/mode.h
+index a9c8cd0..fc13d4f 100644
+--- a/include/mode.h
++++ b/include/mode.h
+@@ -78,7 +78,7 @@ void create_output_filename(char *,char *,char *);
+ FILE *open_output_stream(char *,proc_info *);
+ 
+ /* function to determine if two filenames point to the same file */
+-int files_are_identical(char *,char *);
++bool files_are_identical(char *,char *);
+ 
+ /* function to remove a file if it exists */
+ void remove_file(char *);
+diff --git a/include/module-types.h b/include/module-types.h
+index c49c661..2d7b0a3 100644
+--- a/include/module-types.h
++++ b/include/module-types.h
+@@ -23,6 +23,8 @@
+ #ifndef __MODULE_TYPES_H__
+ #define __MODULE_TYPES_H__
+ 
++#include <stdbool.h>
++
+ #ifdef HAVE_CONFIG_H
+ #include "config.h"
+ #endif
+@@ -44,8 +46,6 @@
+ #define PATHSEPCHAR '/'
+ #endif
+ 
+-/* boolean type */
+-typedef int bool;
+ 
+ /* wtypes */
+ typedef unsigned long wlong;
diff --git a/pkgs/by-name/sh/shntool/function-pointer-type.patch b/pkgs/by-name/sh/shntool/function-pointer-type.patch
new file mode 100644
index 000000000000..c88e0dc5d835
--- /dev/null
+++ b/pkgs/by-name/sh/shntool/function-pointer-type.patch
@@ -0,0 +1,26 @@
+diff --git a/src/core_mode.c b/src/core_mode.c
+index d67e317..21d3b9e 100644
+--- a/src/core_mode.c
++++ b/src/core_mode.c
+@@ -564,17 +564,17 @@ static int compare_ascii(const wave_info **w1,const wave_info **w2)
+ 
+ static void ascii_sort_files(wave_info **filenames, int numfiles)
+ {
+-  int (*cmpfunc) ();
++  int (*cmpfunc) (const void *, const void *);
+ 
+-  cmpfunc = compare_ascii;
++  cmpfunc = (int (*)(const void *, const void *))compare_ascii;
+   qsort(filenames,numfiles,sizeof(wave_info *),cmpfunc);
+ }
+ 
+ static void version_sort_files(wave_info **filenames,int numfiles)
+ {
+-  int (*cmpfunc) ();
++  int (*cmpfunc) (const void *, const void *);
+ 
+-  cmpfunc = compare_version;
++  cmpfunc = (int (*)(const void *, const void *))compare_version;
+   qsort(filenames,numfiles,sizeof(wave_info *),cmpfunc);
+ }
+ 
diff --git a/pkgs/by-name/sh/shntool/package.nix b/pkgs/by-name/sh/shntool/package.nix
index a176c11ce5e2..fdd6919eb0ef 100644
--- a/pkgs/by-name/sh/shntool/package.nix
+++ b/pkgs/by-name/sh/shntool/package.nix
@@ -5,7 +5,7 @@
   flac,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "3.0.10+git20130108.4ca41f4-1";
   pname = "shntool";
 
@@ -13,16 +13,26 @@ stdenv.mkDerivation rec {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "shntool";
-    rev = "debian/${version}";
+    rev = "debian/${finalAttrs.version}";
     sha256 = "sha256-Qn4LwVx34EhypiZDIxuveNhePigkuiICn1nBukoQf5Y=";
   };
 
-  buildInputs = [ flac ];
+  patches = [
+    # Fix conflicts between reserved keywords `bool` (starting from C23) and custom `typedef`s.
+    ./bool-type.patch
+    # Fix implicit weak-typed pointer casting.
+    ./function-pointer-type.patch
+  ];
 
   prePatch = ''
-    patches=$(grep -v '#' ./debian/patches/series | while read patch; do echo "./debian/patches/$patch"; done | tr '\n' ' ')
+    additional_patches=$(grep -v '#' ./debian/patches/series | while read patch; do echo "./debian/patches/$patch"; done | tr '\n' ' ')
+    patches="$patches $additional_patches"
   '';
 
+  buildInputs = [
+    flac
+  ];
+
   meta = {
     description = "Multi-purpose WAVE data processing and reporting utility";
     homepage = "https://packages.qa.debian.org/s/shntool.html";
@@ -30,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ jcumming ];
   };
-}
+})
diff --git a/pkgs/by-name/sm/smpmgr/package.nix b/pkgs/by-name/sm/smpmgr/package.nix
index 5f9a63eca5e7..40155c7c5368 100644
--- a/pkgs/by-name/sm/smpmgr/package.nix
+++ b/pkgs/by-name/sm/smpmgr/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "smpmgr";
-  version = "0.16.0";
+  version = "0.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "intercreate";
     repo = "smpmgr";
     tag = version;
-    hash = "sha256-woQ8NxHZ9lYKvEFjGbvBu7/949bzAV6hs9t/3+N7bJc=";
+    hash = "sha256-EWvTt0bfkHA+E9nkoI8u17j6zevbDofGUxHpFXoUGyo=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/su/surrealdb/package.nix b/pkgs/by-name/su/surrealdb/package.nix
index affd7a93ed0a..724799abd25e 100644
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "surrealdb";
-  version = "2.3.10";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "surrealdb";
     repo = "surrealdb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0j1AzdSbeIyyHtK7zFL1JWDat8cry0z+VD5toCX0RmY=";
+    hash = "sha256-I9TVV+gSn/VCId0Ar3Yn9NWLw6GPOJvwPi8RIedIQ0U=";
   };
 
-  cargoHash = "sha256-ep04Nt3pIQVnFPuauzuk0YMQGMJOqlT0rWFOEmBVkPY=";
+  cargoHash = "sha256-aZb2+6Xnn7gq4Lwo411yBfOFlo3YabkdewYNJ2TGbzo=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index fd1e5b7abd82..df8edd29a7b8 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -43,16 +43,26 @@ let
 
     postInstall = ''
       installManPage target/${stdenv.hostPlatform.rust.cargoShortTarget}/assets/tv.1
-
-      # These are actually shell integrations with keybindings
-      install -Dm644 television/utils/shell/completion.* -t $out/share/television/
     ''
     + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      installShellCompletion --cmd tv \
-        --bash <($out/bin/tv init bash) \
-        --fish <($out/bin/tv init fish) \
-        --zsh <($out/bin/tv init zsh) \
-        --nushell <($out/bin/tv init nu)
+      mkdir -p $out/share/television
+      for shell in bash zsh fish; do
+        "$out/bin/tv" init $shell > completion.$shell
+
+        # split shell completion and shell integration
+        awk -v C=completion_pure.$shell -v D=$out/share/television/completion.$shell '
+          NR==FNR { key=$0; nextfile }
+          {
+            if (!found && index($0, key)) found=1
+            print > (found ? D : C)
+          }
+        ' television/utils/shell/completion.$shell completion.$shell
+
+        installShellCompletion --cmd tv completion_pure.$shell
+      done
+
+      # nushell doesn't contain regular completion for now
+      "$out/bin/tv" init nu > $out/share/television/completion.nu
     '';
 
     passthru = {
diff --git a/pkgs/by-name/tr/trilium-desktop/package.nix b/pkgs/by-name/tr/trilium-desktop/package.nix
index 494eecec07ba..d37cca9bcfdd 100644
--- a/pkgs/by-name/tr/trilium-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-desktop/package.nix
@@ -42,7 +42,7 @@ let
 
   meta = {
     description = "Hierarchical note taking application with focus on building large personal knowledge bases";
-    homepage = "https://github.com/TriliumNext/Notes";
+    homepage = "https://triliumnotes.org/";
     license = lib.licenses.agpl3Plus;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ty/typescript-go/package.nix b/pkgs/by-name/ty/typescript-go/package.nix
index d4a816611693..42cbbb1cc178 100644
--- a/pkgs/by-name/ty/typescript-go/package.nix
+++ b/pkgs/by-name/ty/typescript-go/package.nix
@@ -10,13 +10,13 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2025-12-19";
+  version = "0-unstable-2025-12-28";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "d9178cc1fef3cedc3c1a48a652e63dd83310ea20";
-    hash = "sha256-W6EIyS/EpqkN45vK30qrS7dc2zMUsjkrDGzMJ4eHADE=";
+    rev = "1611cc951fa772cfca09c38fe2d981f6da5d20b8";
+    hash = "sha256-lFyHFg6u0G6E5fEOYt/N55LrLOHDCiZ6OA+NAZABkGE=";
     fetchSubmodules = false;
   };
 
diff --git a/pkgs/by-name/um/umami/package.nix b/pkgs/by-name/um/umami/package.nix
index 41ca017fda94..f3eae890c435 100644
--- a/pkgs/by-name/um/umami/package.nix
+++ b/pkgs/by-name/um/umami/package.nix
@@ -95,18 +95,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       version
       src
       ;
-    # prevent downloading dependencies for windows
-    # which bloat derivation size and fail to build on hydra
-    # https://github.com/NixOS/nixpkgs/pull/467820#issuecomment-3624054271
-    pnpmInstallFlags = [
-      "--force=false"
-      "--os=linux"
-      "--os=darwin"
-      "--cpu=x64"
-      "--cpu=arm64"
-    ];
-    fetcherVersion = 2;
-    hash = "sha256-bqeJ0wzCtnuR6V67Qe1N9UcaHPLziuBhsn7eN8JVJbQ=";
+    fetcherVersion = 3;
+    hash = "sha256-GFN94oySPCZA5K13XR8f/tByuHS571ohlYTFqaVw/Ns=";
   };
 
   env.CYPRESS_INSTALL_BINARY = "0";
diff --git a/pkgs/by-name/un/units/package.nix b/pkgs/by-name/un/units/package.nix
index bea3a448ed0b..6cdc6a276af6 100644
--- a/pkgs/by-name/un/units/package.nix
+++ b/pkgs/by-name/un/units/package.nix
@@ -21,6 +21,9 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-HlAsTt+s8gspKEcWxy5d21GklaI2XXsD55YElMSgyQI=";
   };
 
+  # Until upstream updates their code to work with GCC 15.
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   outputs = [
     "out"
     "info"
@@ -71,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = with lib.licenses; [ gpl3Plus ];
     mainProgram = "units";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ galen ];
     platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index 471ce807f6d0..5a33971c385d 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.21.7";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eTwoK/AysxoTId6IM76b/euyYEE/9cwXcbDcm4wLjM0=";
+    hash = "sha256-WVseXIGUwvoBCVWqM5+OQTkReS8/K1Bq2pDs+n9r7Nk=";
   };
 
-  vendorHash = "sha256-aTQEt1vBdzwOE99CHmCkodvGReR30Jq7iWkMtwK3620=";
+  vendorHash = "sha256-9Gu1FarlMZthq9PYCU3DsCCR+Uxii05ePfcPZIQJhtQ=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/by-name/ve/vector/package.nix b/pkgs/by-name/ve/vector/package.nix
index aa599f06f90d..a6f5f79f5f4e 100644
--- a/pkgs/by-name/ve/vector/package.nix
+++ b/pkgs/by-name/ve/vector/package.nix
@@ -61,6 +61,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     zlib
   ];
 
+  # Fix build with gcc 15
+  # https://github.com/vectordotdev/vector/issues/22888
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   # Without this, we get SIGSEGV failure
   RUST_MIN_STACK = 33554432;
 
@@ -130,6 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     changelog = "https://github.com/vectordotdev/vector/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [
+      adamcstephens
       thoughtpolice
       happysalada
     ];
diff --git a/pkgs/by-name/wi/windmill/package.nix b/pkgs/by-name/wi/windmill/package.nix
index faf587652245..2db1ab463f8f 100644
--- a/pkgs/by-name/wi/windmill/package.nix
+++ b/pkgs/by-name/wi/windmill/package.nix
@@ -47,13 +47,13 @@
 
 let
   pname = "windmill";
-  version = "1.601.0";
+  version = "1.601.1";
 
   src = fetchFromGitHub {
     owner = "windmill-labs";
     repo = "windmill";
     rev = "v${version}";
-    hash = "sha256-yaIQFK3ECP8DccfwaaMwAEisnzM5JijznDsY6mRBNHA=";
+    hash = "sha256-3Djrk8gHW3NjNzSy4A38LmTfl18LKDKgFeNMBPKlhfM=";
   };
 in
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -66,7 +66,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     RUSTY_V8_ARCHIVE = librusty_v8;
   };
 
-  cargoHash = "sha256-b+qSk2DgVJkWeSB+qXosVtMOM+kUobmYB5Av68/tr68=";
+  cargoHash = "sha256-ivfseD1zWcy4P8Anbo/e1r2rRma/6mj25blkrXpwNHE=";
 
   buildFeatures = [
     "agent_worker_server"
@@ -195,7 +195,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     sourceRoot = "${src.name}/frontend";
 
-    npmDepsHash = "sha256-4Sy7C9zzVjw4HIHFFWKfhMUtn97XWyNBDaWAV4WicK4=";
+    npmDepsHash = "sha256-eVN7q8hRH7NYjZiE5dLRMUKlyrtnAPGPdYV6/S4Sc+4=";
 
     # without these you get a
     # FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
diff --git a/pkgs/by-name/wi/windmill/ui_builder.nix b/pkgs/by-name/wi/windmill/ui_builder.nix
index 2bd251fa0e36..2f46d263497b 100644
--- a/pkgs/by-name/wi/windmill/ui_builder.nix
+++ b/pkgs/by-name/wi/windmill/ui_builder.nix
@@ -2,7 +2,7 @@
 { fetchzip }:
 
 fetchzip {
-  url = "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev/ui_builder-9e76079.tar.gz";
-  sha256 = "1lxbfqfx8dhrf585gfh7x7098nbmyarja94cjp43sygvp4c6yw4g";
+  url = "https://pub-06154ed168a24e73a86ab84db6bf15d8.r2.dev/ui_builder-7a79f03.tar.gz";
+  sha256 = "1r5dkymjlqngwvpiv11pr0sdhkw0wp4jg0rhrwzczl3jjnc2azwq";
   stripRoot = false;
 }
diff --git a/pkgs/by-name/xl/xl2tpd/package.nix b/pkgs/by-name/xl/xl2tpd/package.nix
index 2cb59b0c20a9..9ce06a11249a 100644
--- a/pkgs/by-name/xl/xl2tpd/package.nix
+++ b/pkgs/by-name/xl/xl2tpd/package.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -std=gnu17";
+
   meta = {
     homepage = src.meta.homepage;
     description = "Layer 2 Tunnelling Protocol Daemon (RFC 2661)";
diff --git a/pkgs/by-name/xs/xsane/package.nix b/pkgs/by-name/xs/xsane/package.nix
index 574504608a66..0e953e621821 100644
--- a/pkgs/by-name/xs/xsane/package.nix
+++ b/pkgs/by-name/xs/xsane/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
         { name, hash }:
         fetchpatch {
           inherit name hash;
-          url = "https://src.fedoraproject.org/rpms/xsane/raw/846ace0a29063335c708b01e9696eda062d7459c/f/${name}";
+          url = "https://src.fedoraproject.org/rpms/xsane/raw/67c7f6591398ab46f71ba4f0eb33cb0539e56a4b/f/${name}";
         };
     in
     map fetchFedoraPatch [
@@ -43,6 +43,10 @@ stdenv.mkDerivation rec {
         name = "0001-Follow-new-convention-for-registering-gimp-plugin.patch";
         hash = "sha256-yOY7URyc8HEHHynvdcZAV1Pri31N/rJ0ddPavOF5zLw=";
       }
+      {
+        name = "0001-replace-gtk_timeout-with-g_timeout.patch";
+        hash = "sha256-OMeukfbpagK05HI2R/2Gxrvk2nfrDK8ZmLmw0a6o10k=";
+      }
       {
         name = "xsane-0.995-close-fds.patch";
         hash = "sha256-qE7larHpBEikz6OaOQmmi9jl6iQxy/QM7iDg9QrVV1o=";
@@ -107,6 +111,10 @@ stdenv.mkDerivation rec {
         name = "xsane-configure-c99.patch";
         hash = "sha256-ukaNGgzCGiQwbOzSguAqBIKOUzXofSC3lct812U/8gY=";
       }
+      {
+        name = "xsane-gcc15-c23.patch";
+        hash = "sha256-a1ZkVufpbwqL/bCFE2w44PoR42chl8aoRqeOP6L74Uw=";
+      }
     ];
 
   preConfigure = ''
diff --git a/pkgs/by-name/zi/zigbee2mqtt/package.nix b/pkgs/by-name/zi/zigbee2mqtt/package.nix
index 390da59ecb47..3f2c167da4ac 100644
--- a/pkgs/by-name/zi/zigbee2mqtt/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix
@@ -14,20 +14,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "zigbee2mqtt";
-  version = "2.7.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "Koenkk";
     repo = "zigbee2mqtt";
     tag = finalAttrs.version;
-    hash = "sha256-aKLgp8/BkxBu2lQwFeG4VhjzN9/X8sYuhILXjUreZBQ=";
+    hash = "sha256-eIuIWjLsjpvgIgnQC3opsSYc34GD5vLvPvO7DhKyVFA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 1;
-    hash = "sha256-XHDSjjYt/wbCdafLQ73dxDD+1ClbFtI7NejS9h5SNmE=";
+    hash = "sha256-HOYGJzcLyrvhhYnIIwhLiSiYyDdEob3+LNdlfmbspeQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 1752e5a2cf3a..5955fea3e628 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -4,6 +4,7 @@
   cmake,
   python3,
   fetchFromGitHub,
+  fetchpatch2,
   emscripten,
   gtest,
   lit,
@@ -29,6 +30,17 @@ stdenv.mkDerivation rec {
     hash = "sha256-QG8ZhvjcTbhIfYkVfrjxd97v9KaG/A8jO69rPg99/ME=";
   };
 
+  patches = [
+    # TODO: remove at next release
+    # fix build on aarch64/riscv64 with gcc15 but bug exists on all platforms.
+    (fetchpatch2 {
+      name = "fix-uninitialized-small-vector.patch";
+      # https://github.com/WebAssembly/binaryen/pull/8094
+      url = "https://github.com/WebAssembly/binaryen/commit/3ff3762bf7c83edcdfccad522de640f2b0928ae2.patch?full_index=1";
+      hash = "sha256-lhrXQJAaQ/4ofnpyVqhD08IuDxPRc7UPyZ8DoCfM9NE=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     python3
diff --git a/pkgs/development/python-modules/bloodyad/default.nix b/pkgs/development/python-modules/bloodyad/default.nix
index 3ebac8e802e1..08444aa02e8e 100644
--- a/pkgs/development/python-modules/bloodyad/default.nix
+++ b/pkgs/development/python-modules/bloodyad/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "bloodyad";
-  version = "2.5.1";
+  version = "2.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CravateRouge";
     repo = "bloodyAD";
     tag = "v${version}";
-    hash = "sha256-qz7jhFBkJdIDnnGOz4SvDI/YcSXdP7B1FPKxaGRJRWE=";
+    hash = "sha256-RWh73ZlzvTn1nGjQm9Keacvgm0AP0MGCYo/fM45nsmk=";
   };
 
   pythonRelaxDeps = [ "cryptography" ];
diff --git a/pkgs/development/python-modules/paddlepaddle/default.nix b/pkgs/development/python-modules/paddlepaddle/default.nix
index 250ec8a11d89..c0a6212a3380 100644
--- a/pkgs/development/python-modules/paddlepaddle/default.nix
+++ b/pkgs/development/python-modules/paddlepaddle/default.nix
@@ -13,7 +13,7 @@
   zlib,
   setuptools,
   cudaSupport ? config.cudaSupport or false,
-  cudaPackages_12_9,
+  cudaPackages,
   addDriverRunpath,
   # runtime dependencies
   httpx,
@@ -23,6 +23,7 @@
   decorator,
   astor,
   opt-einsum,
+  rdma-core,
   safetensors,
   typing-extensions,
 }:
@@ -33,15 +34,20 @@ let
   version = sources.version;
   format = "wheel";
   pyShortVersion = "cp${builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion}";
-  cpuOrGpu = if cudaSupport then "gpu" else "cpu";
   hash =
-    sources."${stdenv.hostPlatform.system}"."${cpuOrGpu}"."${pyShortVersion}"
-      or (throw "${pname} has no sources.nix entry for '${stdenv.hostPlatform.system}.${cpuOrGpu}.${pyShortVersion}' attribute");
+    if cudaSupport then
+      sources."${stdenv.hostPlatform.system}"."gpu"."cu${
+        lib.replaceStrings [ "." ] [ "" ] cudaPackages.cudatoolkit.version
+      }"."${pyShortVersion}"
+    else
+      sources."${stdenv.hostPlatform.system}"."cpu"."${pyShortVersion}";
   platform = sources."${stdenv.hostPlatform.system}".platform;
   src =
     if cudaSupport then
       (fetchurl {
-        url = "https://paddle-whl.bj.bcebos.com/stable/cu129/paddlepaddle-gpu/paddlepaddle_gpu-${version}-${pyShortVersion}-${pyShortVersion}-linux_x86_64.whl";
+        url = "https://paddle-whl.bj.bcebos.com/stable/cu${
+          lib.replaceStrings [ "." ] [ "" ] cudaPackages.cudatoolkit.version
+        }/paddlepaddle-gpu/paddlepaddle_gpu-${version}-${pyShortVersion}-${pyShortVersion}-linux_x86_64.whl";
         inherit hash;
       })
     else
@@ -73,6 +79,8 @@ buildPythonPackage {
   ]
   ++ lib.optionals cudaSupport [ autoPatchelfHook ];
 
+  buildInputs = lib.optionals cudaSupport [ rdma-core ];
+
   dependencies = [
     setuptools
     httpx
@@ -101,7 +109,7 @@ buildPythonPackage {
             (lib.getLib stdenv.cc.cc)
           ]
           ++ lib.optionals cudaSupport (
-            with cudaPackages_12_9;
+            with cudaPackages;
             [
               cudatoolkit.lib
               cudatoolkit.out
diff --git a/pkgs/development/python-modules/paddlepaddle/sources.nix b/pkgs/development/python-modules/paddlepaddle/sources.nix
index 13684502a438..4b1f0fbc1aef 100644
--- a/pkgs/development/python-modules/paddlepaddle/sources.nix
+++ b/pkgs/development/python-modules/paddlepaddle/sources.nix
@@ -7,8 +7,18 @@
       cp313 = "sha256-xPSFWWpobqcqsN3/yeQRePRWMUqZ1FOPXRgaAVapJ/o=";
     };
     gpu = {
-      cp312 = "sha256-t2beVNEfz+JcesM5+i9BVNKKXIsI3zvz1VrTSd/79+c=";
-      cp313 = "sha256-0thm6aAGpqSLfJdI0MZKuJPn2e4CsNU5S19ohzkukSs=";
+      cu126 = {
+        cp312 = "sha256-gY5/W2BR9+wVcPKdi5gZiHNH/t/rCv2g76rJ0E1wRt4=";
+        cp313 = "sha256-CRNQl+8pRVbfJX172H2KNgsAeSiX+AYHoilMcw1pPXw=";
+      };
+      cu129 = {
+        cp312 = "sha256-t2beVNEfz+JcesM5+i9BVNKKXIsI3zvz1VrTSd/79+c=";
+        cp313 = "sha256-0thm6aAGpqSLfJdI0MZKuJPn2e4CsNU5S19ohzkukSs=";
+      };
+      cu130 = {
+        cp312 = "sha256-70uOCNrFH9QB9G/0e5aAufBHPthJOjoJt39uprt68sE=";
+        cp313 = "sha256-+aNoFQgqsrN9Jtqf0uChifIAacmbDdf8JkqjOqMsFpU=";
+      };
     };
   };
   aarch64-linux = {
diff --git a/pkgs/development/python-modules/paddlepaddle/update.sh b/pkgs/development/python-modules/paddlepaddle/update.sh
index ecf3bcce0f97..b436690526d3 100755
--- a/pkgs/development/python-modules/paddlepaddle/update.sh
+++ b/pkgs/development/python-modules/paddlepaddle/update.sh
@@ -15,7 +15,9 @@ for system in $systems; do
     done
 done
 
-for pythonPackages in "python313Packages" "python312Packages"; do
-    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw --file . pkgsCuda.$pythonPackages.paddlepaddle.src.url --system x86_64-linux)))
-    update-source-version pkgsCuda.$pythonPackages.paddlepaddle $latestVersion $hash --file=pkgs/development/python-modules/paddlepaddle/sources.nix --system=x86_64-linux --ignore-same-version --ignore-same-hash
+for cuda in "12_6" "12_9" "13_0"; do
+    for pythonPackages in "python313Packages" "python312Packages"; do
+        hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw --file . pkgsCuda.cudaPackages_${cuda}.pkgs.$pythonPackages.paddlepaddle.src.url --system x86_64-linux)))
+        update-source-version pkgsCuda.cudaPackages_${cuda}.pkgs.$pythonPackages.paddlepaddle $latestVersion $hash --file=pkgs/development/python-modules/paddlepaddle/sources.nix --system=x86_64-linux --ignore-same-version --ignore-same-hash
+    done
 done
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index 55052cd320f5..daaf959139f8 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -46,6 +46,9 @@ buildPythonPackage rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ trezor-udev-rules ];
 
+  # fix "click<8.2,>=7 not satisfied by version 8.3.1"
+  pythonRelaxDeps = [ "click" ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/unstructured/default.nix b/pkgs/development/python-modules/unstructured/default.nix
index 8cc4fde2938d..27eec40c661e 100644
--- a/pkgs/development/python-modules/unstructured/default.nix
+++ b/pkgs/development/python-modules/unstructured/default.nix
@@ -116,7 +116,7 @@
   grpcio,
 }:
 let
-  version = "0.18.22";
+  version = "0.18.24";
 in
 buildPythonPackage rec {
   pname = "unstructured";
@@ -127,7 +127,7 @@ buildPythonPackage rec {
     owner = "Unstructured-IO";
     repo = "unstructured";
     tag = version;
-    hash = "sha256-m5sBFra/7qjJ/mBq+r7HA+ZURGpiaK1FzR9crL16jtQ=";
+    hash = "sha256-rB+PGRpJGQLJv6L4gzNLADIQhAApwfxWfHBYg2+dhoI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/parsing/flex/default.nix b/pkgs/development/tools/parsing/flex/default.nix
index 31029af8a5fc..6721ac53862a 100644
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@@ -30,7 +30,14 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/lede-project/source/0fb14a2b1ab2f82ce63f4437b062229d73d90516/tools/flex/patches/200-build-AC_USE_SYSTEM_EXTENSIONS-in-configure.ac.patch";
       sha256 = "0mpp41zdg17gx30kcpj83jl8hssks3adbks0qzbhcz882b9c083r";
     })
-  ];
+  ]
+  ++ (lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    (fetchurl {
+      name = "gcc-15.patch";
+      url = "https://github.com/westes/flex/commit/bf254c75b1e0d2641ebbd7fc85fb183f36a62ea7.patch";
+      hash = "sha256-Bnv23M2K1Qf7pEaEz0ueSNzTCdjMTDiMm+H7JaxUISs=";
+    })
+  ]);
 
   postPatch = ''
     patchShebangs tests
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index d012dc1f899d..7632190672b7 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -91,6 +91,8 @@ let
       hash = "sha256-i5KseBz/SuicEhoj6s197AWiqr7azMI6GdGglYtAEqg=";
     };
 
+    patches = [ ./fix-build-with-c23.patch ];
+
     nativeBuildInputs = [ unzip ];
     buildInputs = [
       libjpeg
diff --git a/pkgs/games/xonotic/fix-build-with-c23.patch b/pkgs/games/xonotic/fix-build-with-c23.patch
new file mode 100644
index 000000000000..ce540aa92f5a
--- /dev/null
+++ b/pkgs/games/xonotic/fix-build-with-c23.patch
@@ -0,0 +1,43 @@
+---
+ dpsoftrast.c | 4 ----
+ qtypes.h     | 7 +------
+ 2 files changed, 1 insertion(+), 10 deletions(-)
+
+diff --git a/dpsoftrast.c b/dpsoftrast.c
+index fff29b8..1eda341 100644
+--- a/dpsoftrast.c
++++ b/dpsoftrast.c
+@@ -10,10 +10,6 @@
+ #pragma warning(disable : 4324)
+ #endif
+
+-#ifndef __cplusplus
+-typedef qboolean bool;
+-#endif
+-
+ #define ALIGN_SIZE 16
+ #define ATOMIC_SIZE 4
+
+diff --git a/qtypes.h b/qtypes.h
+index 6c09614..e6e277b 100644
+--- a/qtypes.h
++++ b/qtypes.h
+@@ -2,14 +2,9 @@
+ #ifndef QTYPES_H
+ #define QTYPES_H
+
+-#undef true
+-#undef false
++#include <stdbool.h>
+
+-#ifndef __cplusplus
+-typedef enum qboolean_e {false, true} qboolean;
+-#else
+ typedef bool qboolean;
+-#endif
+
+ #ifndef NULL
+ #define NULL ((void *)0)
+--
+2.50.1
+
diff --git a/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix b/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
index 4d2d6a607474..4faa428147a9 100644
--- a/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
@@ -1,7 +1,6 @@
 {
   buildHomeAssistantComponent,
   fetchFromGitHub,
-  fetchpatch2,
   lib,
 
   # dependencies
diff --git a/pkgs/tools/package-management/nix/common-meson.nix b/pkgs/tools/package-management/nix/common-meson.nix
index 08bc79029321..19d3f30fc654 100644
--- a/pkgs/tools/package-management/nix/common-meson.nix
+++ b/pkgs/tools/package-management/nix/common-meson.nix
@@ -174,17 +174,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs --build tests
-  ''
-  # The ability to chmod the root filesystem only exist in filesystem namespacing capable Nix interpreters.
-  # At the time of writing, only Linux can do it.
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    # The build system produces $HOME during the install check phase
-    # and will fail when ran without build user separation.
-    # This will surface as a FIFO synchronization deadlock.
-    # To avoid this, the $HOME directory is barred from being mkdir()
-    # by the build system here.
-    # https://github.com/NixOS/nix/issues/11295
-    chmod 555 /
   '';
 
   preConfigure =