diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index 8ae1797aaf1a..537ccfc101a2 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -272,7 +272,7 @@
 
 - `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.
 
-- The default version of `z3` has been updated from 4.8 to 4.14, and all old versions have been dropped. Note that `fstar` still depends on specific versions, and maintains them as overrides.
+- The default version of `z3` has been updated from 4.8 to 4.15, and all old versions have been dropped. Note that `fstar` still depends on specific versions, and maintains them as overrides.
 
 - `prometheus` has been updated from 2.55.0 to 3.1.0.
   Read the [release blog post](https://prometheus.io/blog/2024/11/14/prometheus-3-0/) and
diff --git a/lib/tests/maintainers.nix b/lib/tests/maintainers.nix
index d04bb07ea2c8..1d3fd5630c26 100644
--- a/lib/tests/maintainers.nix
+++ b/lib/tests/maintainers.nix
@@ -1,6 +1,6 @@
 # to run these tests (and the others)
 # nix-build nixpkgs/lib/tests/release.nix
-# These tests should stay in sync with the comment in maintainers/maintainers-list.nix
+# These tests should stay in sync with the comment in maintainers/maintainer-list.nix
 {
   # The pkgs used for dependencies for the testing itself
   pkgs ? import ../.. { },
diff --git a/maintainers/scripts/README.md b/maintainers/scripts/README.md
index d2ab587fb397..02d90afe441b 100644
--- a/maintainers/scripts/README.md
+++ b/maintainers/scripts/README.md
@@ -16,7 +16,7 @@ a given nixpkgs maintainer, equivalent to `lib.maintainers.${x} // { handle = x;
 
 This allows looking up a maintainer's attrset (including GitHub and Matrix
 handles, email address etc.) based on any of their handles, more correctly and
-robustly than text search through `maintainers-list.nix`.
+robustly than text search through `maintainer-list.nix`.
 
 ```
 ❯ ./get-maintainer.sh nicoo
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index adcf95671354..c66a6df50721 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -23,6 +23,7 @@ let
       PAPERLESS_THUMBNAIL_FONT_NAME = defaultFont;
       GRANIAN_HOST = cfg.address;
       GRANIAN_PORT = toString cfg.port;
+      GRANIAN_WORKERS_KILL_TIMEOUT = "60";
     }
     // lib.optionalAttrs (config.time.timeZone != null) {
       PAPERLESS_TIME_ZONE = config.time.timeZone;
diff --git a/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix b/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix
index 1c88d3a0f416..ea93d2c11368 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix
@@ -9,8 +9,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "jupyter";
     publisher = "ms-toolsai";
-    version = "2025.3.0";
-    hash = "sha256-dH74EX5PDq4t/CukjsswtKLVwbE+q0J+fpZ1MA8CDZI=";
+    version = "2025.4.1";
+    hash = "sha256-RLkelWU5chIpGS6dToQ+/jNeEbZYGi2JxeZTqqHAdVA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/yacreader/darwin-unarr-use-pkg-config.patch b/pkgs/applications/graphics/yacreader/darwin-unarr-use-pkg-config.patch
new file mode 100644
index 000000000000..dff2b69df514
--- /dev/null
+++ b/pkgs/applications/graphics/yacreader/darwin-unarr-use-pkg-config.patch
@@ -0,0 +1,13 @@
+diff --git a/compressed_archive/unarr/unarr-wrapper.pri b/compressed_archive/unarr/unarr-wrapper.pri
+index 0115267..5d3d6f5 100644
+--- a/compressed_archive/unarr/unarr-wrapper.pri
++++ b/compressed_archive/unarr/unarr-wrapper.pri
+@@ -6,7 +6,7 @@ HEADERS += $$PWD/extract_delegate.h \
+ 
+ SOURCES += $$PWD/compressed_archive.cpp
+ 
+-if(mingw|unix):!macx:!contains(QT_CONFIG, no-pkg-config):packagesExist(libunarr) {
++if(mingw|unix):!contains(QT_CONFIG, no-pkg-config):packagesExist(libunarr) {
+   message(Using system provided unarr installation found by pkg-config.)
+   CONFIG += link_pkgconfig
+   PKGCONFIG += libunarr
diff --git a/pkgs/applications/graphics/yacreader/default.nix b/pkgs/applications/graphics/yacreader/default.nix
index 33a06d30ec71..f47f5a0a022f 100644
--- a/pkgs/applications/graphics/yacreader/default.nix
+++ b/pkgs/applications/graphics/yacreader/default.nix
@@ -2,11 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  libsForQt5,
-  poppler,
-  pkg-config,
-  libunarr,
   libGLU,
+  libunarr,
+  libsForQt5,
+  pkg-config,
 }:
 
 stdenv.mkDerivation rec {
@@ -15,28 +14,63 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "YACReader";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-5vCjr8WRwa7Q/84Itgg07K1CJKGnWA1z53et2IxxReE=";
+    repo = "yacreader";
+    tag = version;
+    hash = "sha256-5vCjr8WRwa7Q/84Itgg07K1CJKGnWA1z53et2IxxReE=";
   };
 
+  patches = [
+    # make the unarr backend logic use pkg-config even on Darwin
+    ./darwin-unarr-use-pkg-config.patch
+  ];
+
+  qmakeFlags = [
+    # force unarr backend on all platforms
+    "CONFIG+=unarr"
+  ];
+
   nativeBuildInputs = [
     libsForQt5.qmake
-    pkg-config
+    libsForQt5.qttools # for translations
     libsForQt5.wrapQtAppsHook
+    pkg-config
   ];
-  buildInputs = [
-    libunarr
-    libGLU
-    libsForQt5.poppler
-    libsForQt5.qtmultimedia
-    libsForQt5.qtscript
-  ];
-  propagatedBuildInputs = [
-    libsForQt5.qtquickcontrols2
-    libsForQt5.qtgraphicaleffects
-    libsForQt5.qtdeclarative
-  ];
+
+  buildInputs =
+    [
+      libGLU
+      libsForQt5.poppler
+      libsForQt5.qtgraphicaleffects # imported, but not declared as a dependency
+      libsForQt5.qtmultimedia
+      libsForQt5.qtquickcontrols2
+      libunarr
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libsForQt5.qtmacextras # can be removed when using qt6
+    ];
+
+  # custom Darwin install instructions taken from the upsteam compileOSX.sh script
+  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    runHook preInstall
+
+    mkdir -p "$out"/Applications
+
+    cp -r YACReader/YACReader.app "$out"/Applications/
+    cp -r YACReaderLibrary/YACReaderLibrary.app "$out"/Applications/
+    cp -r YACReaderLibraryServer/YACReaderLibraryServer.app "$out"/Applications/
+
+    cp -r release/server "$out"/Applications/YACReaderLibrary.app/Contents/MacOS/
+    cp -r release/server "$out"/Applications/YACReaderLibraryServer.app/Contents/MacOS/
+    cp -r release/languages "$out"/Applications/YACReader.app/Contents/MacOS/
+    cp -r release/languages "$out"/Applications/YACReaderLibrary.app/Contents/MacOS/
+    cp -r release/languages "$out"/Applications/YACReaderLibraryServer.app/Contents/MacOS/
+
+    makeWrapper "$out"/Applications/YACReader.app/Contents/MacOS/YACReader "$out/bin/YACReader"
+    makeWrapper "$out"/Applications/YACReaderLibrary.app/Contents/MacOS/YACReaderLibrary "$out/bin/YACReaderLibrary"
+    makeWrapper "$out"/Applications/YACReaderLibraryServer.app/Contents/MacOS/YACReaderLibraryServer "$out/bin/YACReaderLibraryServer"
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "Comic reader for cross-platform reading and managing your digital comic collection";
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 3f3a71d9c14f..b7a9bb82e1a8 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -17,20 +17,20 @@
 
 buildNpmPackage rec {
   pname = "bruno";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     tag = "v${version}";
-    hash = "sha256-4SIOLVXVxRSaSmZcje//+o/dyLINDAM2CvLQGEAykq0=";
+    hash = "sha256-ch8xqa4XZJvK6HDrDidgL+z8E9rezDkAqcpgBRy4E9E=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-W4qF2/AAcygqykB4zcBjb8KhfVaMrj8FLgadalDNF+0=";
+  npmDepsHash = "sha256-ZUZZWnp10Z4vQTZTTPenAXXpez6WbmB/S1VBiARuNP4=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ca/cargo-bazel/package.nix b/pkgs/by-name/ca/cargo-bazel/package.nix
index a92331c607d5..9816cd19f6fc 100644
--- a/pkgs/by-name/ca/cargo-bazel/package.nix
+++ b/pkgs/by-name/ca/cargo-bazel/package.nix
@@ -1,7 +1,9 @@
 {
   lib,
+  stdenv,
   fetchCrate,
   rustPlatform,
+  libz,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -13,6 +15,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-FS1WFlK0YNq1QCi3S3f5tMN+Bdcfx2dxhDKRLXLcios=";
   };
 
+  buildInputs = lib.optional stdenv.isDarwin libz;
+
   useFetchCargoVendor = true;
   cargoHash = "sha256-E/yF42Vx9tv8Ik1j23El3+fI19ZGzq6nikVMATY7m3E=";
 
diff --git a/pkgs/by-name/da/daq/package.nix b/pkgs/by-name/da/daq/package.nix
deleted file mode 100644
index 40e7fec92598..000000000000
--- a/pkgs/by-name/da/daq/package.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  flex,
-  bison,
-  libpcap,
-  libdnet,
-  libnfnetlink,
-  libnetfilter_queue,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "daq";
-  version = "2.2.2";
-
-  src = fetchurl {
-    name = "${pname}-${version}.tar.gz";
-    url = "https://snort.org/downloads/archive/snort/${pname}-${version}.tar.gz";
-    sha256 = "0yvzscy7vqj7s5rccza0f7p6awghfm3yaxihx1h57lqspg51in3w";
-  };
-
-  buildInputs = [
-    flex
-    bison
-    libpcap
-    libdnet
-    libnfnetlink
-    libnetfilter_queue
-  ];
-
-  configureFlags = [
-    "--enable-nfq-module=yes"
-    "--with-dnet-includes=${libdnet}/includes"
-    "--with-dnet-libraries=${libdnet}/lib"
-  ];
-
-  NIX_CFLAGS_COMPILE = "-Wno-incompatible-pointer-types";
-
-  meta = {
-    description = "Data AcQuisition library (DAQ), for packet I/O";
-    mainProgram = "daq-modules-config";
-    homepage = "https://www.snort.org";
-    maintainers = with lib.maintainers; [ aycanirican ];
-    license = lib.licenses.gpl2;
-    platforms = with lib.platforms; linux;
-  };
-}
diff --git a/pkgs/by-name/db/dbvisualizer/package.nix b/pkgs/by-name/db/dbvisualizer/package.nix
index f52042021b7c..2c76599a1500 100644
--- a/pkgs/by-name/db/dbvisualizer/package.nix
+++ b/pkgs/by-name/db/dbvisualizer/package.nix
@@ -13,7 +13,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "25.1.3";
+  version = "25.1.4";
 
   src =
     let
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "https://www.dbvis.com/product_download/dbvis-${finalAttrs.version}/media/dbvis_linux_${underscoreVersion}.tar.gz";
-      hash = "sha256-K9RbQPCqU9t6i0zKl2P1aRhgfAs69GORtVA2KU6fqLw=";
+      hash = "sha256-oEp0+HCfI//ukcqxVX5j6ep25TsuOHplHteWnrzlLu8=";
     };
 
   strictDeps = true;
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index d3d637ac5c11..9cd4bb609d5d 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.0.0";
+  version = "18.0.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-IhFKEBYCEORLPEplPDRdV61kY5ZgFAxJmfmoG9Q58ec=";
+      hash = "sha256-yVDe5X/WGkfWdSEWEZZqjykZNz0mJ52tPHLabGDThOk=";
     };
 
     vendorHash = "sha256-PXONynRY5ZLQO2yQdtljDmLhVBIgfEYmyez9pIm9vtw=";
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 11c92b5580c0..e1bfaa98eb11 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule rec {
   pname = "gitlab-container-registry";
-  version = "4.21.0";
+  version = "4.22.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-EUJRXN/xOxNG6pIvsZ/MvVU7arSphOWdpJK0Qo8JcTY=";
+    hash = "sha256-r7IVX4xH/K+tfoEKfO9HITHUZT6yfBP2Zr6EPZQUxfw=";
   };
 
-  vendorHash = "sha256-rAY0lG1ELGO8f6SciEr7F3LL8+fTzlXvUrn4p00v0TI=";
+  vendorHash = "sha256-e7EIScdd0k5iFTDutFotNkKj1rKtBqfEexdkpjSHAoE=";
 
   checkFlags =
     let
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index e7c025c71124..5ddb95744cfc 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.0.0";
+  version = "18.0.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-c2y11lMeHBi62Ql63HGolF454GkFp7UCErHGk5Bvgvw=";
+    hash = "sha256-EslNXyCzGpsJAG3SOQF56xbU2vhVVo4qdtfFtf9qqW0=";
   };
 
   vendorHash = "sha256-BjCwPt1duDINHP7L0qT2KNTjOZ62bWgVij88ztjjyPg=";
diff --git a/pkgs/by-name/gi/gitlab-shell/package.nix b/pkgs/by-name/gi/gitlab-shell/package.nix
index cccff4044587..2bc9ba46c36a 100644
--- a/pkgs/by-name/gi/gitlab-shell/package.nix
+++ b/pkgs/by-name/gi/gitlab-shell/package.nix
@@ -8,14 +8,14 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.41.0";
+  version = "14.42.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    hash = "sha256-6bRiw8TC7E/eUc0Zwp46kLbe5QzZ+nXL6YY2u+mjFRw=";
+    hash = "sha256-U42xSb9kZpxBIE+tua5m3iNMBfcLRlujSI3K5eWiuME=";
   };
 
   buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule rec {
     ./remove-hardcoded-locations.patch
   ];
 
-  vendorHash = "sha256-Xz6l0gvjS2nPt/mpOvZDJlnfEmIWPXc/RwBntzfLc1Y=";
+  vendorHash = "sha256-aBANgvo9kWiHoytaB10J3hf9vOWVsz/vJApVHet93xg=";
 
   subPackages = [
     "cmd/gitlab-shell"
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index 9c83119e467a..f410364b0919 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "18.0.0",
-  "repo_hash": "03x2ypyn7kkald6pzvzh19cmlr6km9fdssw823565rd1kikywb87",
+  "version": "18.0.1",
+  "repo_hash": "0d4bpk0fip34cjgp7a1pcfa0q7vkn8vz1ig41zgxncgwbr5lik1h",
   "yarn_hash": "0vv09y1pjcm2723jh842pgnmnrf4yqk7558v57dp08rxrqnsni5x",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.0.0-ee",
+  "rev": "v18.0.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.0.0",
-    "GITLAB_PAGES_VERSION": "18.0.0",
-    "GITLAB_SHELL_VERSION": "14.41.0",
+    "GITALY_SERVER_VERSION": "18.0.1",
+    "GITLAB_PAGES_VERSION": "18.0.1",
+    "GITLAB_SHELL_VERSION": "14.42.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.1",
-    "GITLAB_WORKHORSE_VERSION": "18.0.0"
+    "GITLAB_WORKHORSE_VERSION": "18.0.1"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index f182dc8d039a..11e3e8f868e5 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.0.0";
+  version = "18.0.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index e2e58ba5de40..8be009495335 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -333,9 +333,6 @@ gem 'connection_pool', '~> 2.4', feature_category: :shared
 # Redis session store
 gem 'redis-actionpack', '~> 5.5.0', feature_category: :redis
 
-# Discord integration
-gem 'discordrb-webhooks', '~> 3.5', require: false, feature_category: :integrations
-
 # Jira integration
 gem 'jira-ruby', '~> 2.3.0', feature_category: :integrations
 gem 'atlassian-jwt', '~> 0.2.1', feature_category: :integrations
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index 6b6cd2b37bf5..bfb3ebad0845 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -544,8 +544,6 @@ GEM
     diffy (3.4.3)
     digest-crc (0.6.5)
       rake (>= 12.0.0, < 14.0.0)
-    discordrb-webhooks (3.5.0)
-      rest-client (>= 2.0.0)
     docile (1.4.0)
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
@@ -2120,7 +2118,6 @@ DEPENDENCIES
   devise-two-factor (~> 4.1.1)
   diff_match_patch (~> 0.1.0)!
   diffy (~> 3.4)
-  discordrb-webhooks (~> 3.5)
   doorkeeper (~> 5.8, >= 5.8.1)
   doorkeeper-device_authorization_grant (~> 1.0.0)
   doorkeeper-openid_connect (~> 1.8.10)
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 42cb501aac19..4e033992dc9f 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -1732,17 +1732,6 @@ src: {
     };
     version = "0.6.5";
   };
-  discordrb-webhooks = {
-    dependencies = [ "rest-client" ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1c933kq48sqja1a2fc4ki9w8x5ajl6lp67hslka5k05hwfyaiysj";
-      type = "gem";
-    };
-    version = "3.5.0";
-  };
   docile = {
     groups = [
       "coverage"
diff --git a/pkgs/by-name/kc/kcl/package.nix b/pkgs/by-name/kc/kcl/package.nix
index 7df5288488e1..b99a85421cc8 100644
--- a/pkgs/by-name/kc/kcl/package.nix
+++ b/pkgs/by-name/kc/kcl/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "kcl";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "kcl-lang";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-Ron+8pK/1VYwL0HO97QvBpWhKeAlhM+sVi1Djc++4n4=";
+    hash = "sha256-9QPGQ8PfXtb37RIrfqLeezobmXSpgvYzxJOWldmgnyc=";
   };
 
-  vendorHash = "sha256-yvhRHzVIkPE7ZDaX+98K4PW3/uh/6esxc/1KwpOvGfY=";
+  vendorHash = "sha256-zToyM20ykPAd+EHwSUsX+4BvBPT8iXk5suGK2ZYBjvc=";
 
   subPackages = [ "cmd/kcl" ];
 
diff --git a/pkgs/by-name/li/libdaq/package.nix b/pkgs/by-name/li/libdaq/package.nix
index 36c4df30b053..4f01a909114f 100644
--- a/pkgs/by-name/li/libdaq/package.nix
+++ b/pkgs/by-name/li/libdaq/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdaq";
-  version = "3.0.18";
+  version = "3.0.19";
 
   src = fetchFromGitHub {
     owner = "snort3";
     repo = "libdaq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PMb8q8QcfUXxEf0s2UdaZogmxzqUCw0wRdzfT1xio/E=";
+    hash = "sha256-ma+M/rIbChqL0pjhE0a1UfJLm/r7I7IvIuSwcnQWvAQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lo/lon/package.nix b/pkgs/by-name/lo/lon/package.nix
index cd48fec975f3..0296246aa5b4 100644
--- a/pkgs/by-name/lo/lon/package.nix
+++ b/pkgs/by-name/lo/lon/package.nix
@@ -10,19 +10,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lon";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "nikstur";
     repo = "lon";
     tag = version;
-    hash = "sha256-tF9nzTIX0pU/N+h6i7ftn8RhwVB1o3O9+g+sziJvGwc=";
+    hash = "sha256-/7RelKn3pzC8n+b2OV1pcUEaWeEoH4qC2TvAWwni5AA=";
   };
 
   sourceRoot = "source/rust/lon";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Aa8Rkny5hBfQpGcZYJrbzU00ExJPTfhQzKDbHAt8rXE=";
+  cargoHash = "sha256-2/lHRv3bD0hX/JVSucsA3G5gM9NMgRrBf21JtEvzu64=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index aea81d315293..ce550636506c 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -19,8 +19,8 @@
     #
     # Ensure you also check ../mattermostLatest/package.nix.
     regex = "^v(10\\.5\\.[0-9]+)$";
-    version = "10.5.5";
-    srcHash = "sha256-ptyBYZvxCnqD3SX1Cy1uNFjM8wvBHDrroGsu1SnnuJs=";
+    version = "10.5.6";
+    srcHash = "sha256-etHEJ3EBTolXZr/2Kd39Jdtf1qBMuVO5zRkuM6k4F3w=";
     vendorHash = "sha256-9Jl+lxvSoxUReziTqkDRyeNrijGWcBDbqoywJRIeD2k=";
     npmDepsHash = "sha256-tIeuDUZbqgqooDm5TRfViiTT5OIyN0BPwvJdI+wf7p0=";
     lockfileOverlay = ''
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index c8b423013b10..1a79e395ed91 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -11,9 +11,9 @@ mattermost.override {
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
     regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.8.0";
-    srcHash = "sha256-JfMQXwRXb3KdZssi5z4KU+X6oBu4+SZRN7KeCBd2Q1E=";
-    vendorHash = "sha256-K51Ps1hvi4O0sCYAiAhYHJa2Igpt1dF16VUJPA3S3XA=";
+    version = "10.8.1";
+    srcHash = "sha256-bgXdLCH/lL9LFPfFk5uwdd61+fnG/WrzftWWH+BNcTY=";
+    vendorHash = "sha256-OJCVcD/k3AuZJzsJsayw413mTwIaodd+iHqy5akNDSw=";
     npmDepsHash = "sha256-iddiDUXW9o6bCvswxCQTk9GbaZ1Kk0RN7RY9dPrClXQ=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
diff --git a/pkgs/by-name/ne/nerd-font-patcher/package.nix b/pkgs/by-name/ne/nerd-font-patcher/package.nix
index 0cc66507523e..bb66a717bda7 100644
--- a/pkgs/by-name/ne/nerd-font-patcher/package.nix
+++ b/pkgs/by-name/ne/nerd-font-patcher/package.nix
@@ -6,11 +6,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nerd-font-patcher";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchzip {
     url = "https://github.com/ryanoasis/nerd-fonts/releases/download/v${version}/FontPatcher.zip";
-    sha256 = "sha256-/LbO8+ZPLFIUjtZHeyh6bQuplqRfR6SZRu9qPfVZ0Mw=";
+    sha256 = "sha256-koZj0Tn1HtvvSbQGTc3RbXQdUU4qJwgClOVq1RXW6aM=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ne/netron/package.nix b/pkgs/by-name/ne/netron/package.nix
index 8c15bc2c612e..6d37b7073c9c 100644
--- a/pkgs/by-name/ne/netron/package.nix
+++ b/pkgs/by-name/ne/netron/package.nix
@@ -16,16 +16,16 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "netron";
-  version = "8.3.3";
+  version = "8.3.4";
 
   src = fetchFromGitHub {
     owner = "lutzroeder";
     repo = "netron";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7OdHg0nLVz7xno1FTE+fr6FZkzkI+6KjX3EsDzyZbOM=";
+    hash = "sha256-P7lv0pnhrdU9zFwCzQYwYilq6qJ1UUaYgVDMiRZP5M8=";
   };
 
-  npmDepsHash = "sha256-oOGHo/KCc/qlJRdIyUmoRayV1i+e0mEqMr7TTCo5YKA=";
+  npmDepsHash = "sha256-gPRxgf4XTxIZIKTZbr07zzEJW1n0Waas+zms6Ap6RAY=";
 
   nativeBuildInputs = [ jq ];
 
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 3a1fa7f93294..4ca8929f10be 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -26,13 +26,13 @@
   xorg,
 }:
 let
-  version = "2.15.3";
+  version = "2.16.1";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-zkOOUMyAvYYJnYn4s7D4tsYhodVX5kvPdXBBknBsusY=";
+    hash = "sha256-wdcwSWaixNceVqrCXStf+0jnWbigd3k5FXRF0o2UbW0=";
   };
 
   python = python3.override {
@@ -69,7 +69,7 @@ let
 
       pnpmDeps = pnpm.fetchDeps {
         inherit pname version src;
-        hash = "sha256-yoTXlxXLcWD2DMxqjb02ZORJ+E0xE1DbZm1VL7vXM4g=";
+        hash = "sha256-tSBpZ+1aPLUI0SKpOyKo+OLsJZiyDCxRb+5hKMPrxL8=";
       };
 
       nativeBuildInputs =
@@ -149,15 +149,7 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
-    "celery"
     "django-allauth"
-    "django-extensions"
-    "drf-spectacular-sidecar"
-    "filelock"
-    "python-dotenv"
-    "rapidfuzz"
-    # TODO: https://github.com/NixOS/nixpkgs/pull/373099
-    "zxing-cpp"
   ];
 
   dependencies =
@@ -320,14 +312,14 @@ python.pkgs.buildPythonApplication rec {
     tests = { inherit (nixosTests) paperless; };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Tool to scan, index, and archive all of your physical documents";
     homepage = "https://docs.paperless-ngx.com/";
-    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/v${version}";
-    license = licenses.gpl3Only;
-    platforms = platforms.unix;
+    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/${src.tag}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
     mainProgram = "paperless-ngx";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       leona
       SuperSandro2000
       erikarvstedt
diff --git a/pkgs/by-name/po/portfolio/package.nix b/pkgs/by-name/po/portfolio/package.nix
index ee2b9cc6a976..12123603ca29 100644
--- a/pkgs/by-name/po/portfolio/package.nix
+++ b/pkgs/by-name/po/portfolio/package.nix
@@ -34,11 +34,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "PortfolioPerformance";
-  version = "0.76.2";
+  version = "0.76.3";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${finalAttrs.version}/PortfolioPerformance-${finalAttrs.version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-Kb57COhAYOTZvRNriPw6ZGKczENz+RCnWs+P8rtJyeY=";
+    hash = "sha256-HbmNIRKNV1vmDX6PdjBvBNfyLP/pqtRCZRBHNADyiqM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sn/snort2/package.nix b/pkgs/by-name/sn/snort2/package.nix
deleted file mode 100644
index cb1e8185e7e1..000000000000
--- a/pkgs/by-name/sn/snort2/package.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  lib,
-  stdenv,
-  pkg-config,
-  luajit,
-  openssl,
-  fetchurl,
-  libpcap,
-  pcre,
-  libdnet,
-  daq,
-  zlib,
-  flex,
-  bison,
-  makeWrapper,
-  libtirpc,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  version = "2.9.20";
-  pname = "snort2";
-
-  # TODO: remove this package after 25.05 release
-  # https://github.com/NixOS/nixpkgs/pull/381363#issuecomment-2653483597
-  src = fetchurl rec {
-    name = "snort-${finalAttrs.version}.tar.gz";
-    url = "https://snort.org/downloads/snort/${name}";
-    sha256 = "sha256-KUAOE/U7GDHguLEOwSJKHLqm3BUzpTIqIN2Au4S0mBw=";
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-    pkg-config
-  ];
-  buildInputs = [
-    luajit
-    openssl
-    libpcap
-    pcre
-    libdnet
-    daq
-    zlib
-    flex
-    bison
-    libtirpc
-  ];
-
-  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
-
-  enableParallelBuilding = true;
-
-  configureFlags = [
-    "--disable-static-daq"
-    "--enable-control-socket"
-    "--with-daq-includes=${daq}/includes"
-    "--with-daq-libraries=${daq}/lib"
-  ];
-
-  postInstall = ''
-    wrapProgram $out/bin/snort --add-flags "--daq-dir ${daq}/lib/daq --dynamic-preprocessor-lib-dir $out/lib/snort_dynamicpreprocessor/ --dynamic-engine-lib-dir $out/lib/snort_dynamicengine"
-  '';
-
-  meta = {
-    description = "Network intrusion prevention and detection system (IDS/IPS)";
-    homepage = "https://www.snort.org";
-    maintainers = with lib.maintainers; [ aycanirican ];
-    license = lib.licenses.gpl2;
-    platforms = with lib.platforms; linux;
-  };
-})
diff --git a/pkgs/by-name/tr/trezor-suite/package.nix b/pkgs/by-name/tr/trezor-suite/package.nix
index ef9e9a592c17..b3df7dd19a1a 100644
--- a/pkgs/by-name/tr/trezor-suite/package.nix
+++ b/pkgs/by-name/tr/trezor-suite/package.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "trezor-suite";
-  version = "25.4.2";
+  version = "25.5.2";
 
   suffix =
     {
@@ -24,8 +24,8 @@ let
     hash =
       {
         # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-        aarch64-linux = "sha512-BqZjccLs1eHcHmmzyWa3L37KjKjHJFxEhk+BtAD52Z9Mg8wq2Qpz0+z5JrCOXdqLf+j5jfmAQae2HpQhQrqV3g==";
-        x86_64-linux = "sha512-P4+FQd5Uis1rCzCOCpNNAbGS70t/u7FYHkz2+ylF+yBHauARsyvLm1IbUKZyqCsruae0O8n2wIuIltpLImNtqA==";
+        aarch64-linux = "sha512-WfEFKfmILqJADNvYq5C5OOuZgCJmri6i/i6/QHFukeDrvAsUmIqcIIN1zpCoPyJBS4tc+mAlOXIEx0AkYfJVVA==";
+        x86_64-linux = "sha512-ZGdqXkwlvjLhOFIEhpwCdmLodODmi/oq92+qSLRmKO37XvSJEvCNAHriLJiaIofqy8XSJmjT2MuHRzh0W+83sw==";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index 0440719e89f0..391cc5e91fd6 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -44,19 +44,21 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-CJVUEwYnpXDaYgXoi1Qk0uyB/CHM3UDQzQfhtDxDKdE=";
   };
 
-  nativeBuildInputs =
-    [
-      gradle_jdk17
-      makeBinaryWrapper
-    ]
-    ++ lib.optionals withVelocityNative [
-      # libraries for velocity-native
-      openssl
-      libdeflate
+  nativeBuildInputs = [
+    gradle_jdk17
+    makeBinaryWrapper
+  ];
 
-      # needed for building velocity-native jni
-      jdk17
-    ];
+  buildInputs = lib.optionals withVelocityNative [
+    # libraries for velocity-native
+    openssl
+    libdeflate
+
+    # needed for building velocity-native jni
+    jdk17
+  ];
+
+  strictDeps = true;
 
   mitmCache = gradle_jdk17.fetchDeps {
     inherit (finalAttrs) pname;
@@ -99,6 +101,13 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper ${lib.getExe jre_headless} "$out/bin/velocity" \
       --append-flags "-jar $out/share/velocity/velocity.jar"
 
+    ${lib.optionalString withVelocityNative ''
+      # Nix doesn't pick up references in compressed JAR file
+      mkdir $out/nix-support
+      echo ${lib.getLib openssl} >> $out/nix-support/runtime-dependencies
+      echo ${lib.getLib libdeflate} >> $out/nix-support/runtime-dependencies
+    ''}
+
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 49dfc25da975..ba80b7978426 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,14 +1,14 @@
 {
   "darwin": {
-    "hash": "sha256-c6+LEdAWgRrm3UrHRK8N0IGuxoxHpz4j5sgCz+eJOco=",
-    "version": "0.2025.05.07.08.12.stable_02"
+    "hash": "sha256-AxPUNdZbvc6T4sFFTkQnOAg26vmzf86oaGbtzapybFc=",
+    "version": "0.2025.05.14.08.11.stable_03"
   },
   "linux_x86_64": {
-    "hash": "sha256-uEaQecj5h6if5Hc7BjuXxxVO+SqOYE/xop08ujQFgGg=",
-    "version": "0.2025.05.07.08.12.stable_02"
+    "hash": "sha256-vdBTwn3ElyOIIyPXNbScvymq6P5d15b41NKAg7QSigk=",
+    "version": "0.2025.05.14.08.11.stable_03"
   },
   "linux_aarch64": {
-    "hash": "sha256-543oTSzBZLxWem3EnpqVyWgQvrbduurEhFEC7XpKHWk=",
-    "version": "0.2025.05.07.08.12.stable_02"
+    "hash": "sha256-jpTVEvZUmLlsiYTJtECT2G899PyFTXZz5qa9+RPWzaI=",
+    "version": "0.2025.05.14.08.11.stable_03"
   }
 }
diff --git a/pkgs/by-name/wa/wash-cli/package.nix b/pkgs/by-name/wa/wash-cli/package.nix
index f3e1ff341860..06d743e2b33c 100644
--- a/pkgs/by-name/wa/wash-cli/package.nix
+++ b/pkgs/by-name/wa/wash-cli/package.nix
@@ -20,15 +20,15 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "wash-cli";
-  version = "0.29.2";
+  version = "0.39.0";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-A66KSDYFbByguhnlzzU5nf8pE3lhnYQjI3h73SKB2Zo=";
+    hash = "sha256-qOxYBhwkcn4g1cUBHuF0AoecpxN4ukgTjBnzVhWtw7A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-m8NkYqfWRNJn+1Qym1C5ZwKhvXrwFd01TSpVigYwsJ8=";
+  cargoHash = "sha256-dPHzRZh5jBxbPt+1a9wVbsBclAkfrcAXhpZgTw7e4Qo=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/we/wealthfolio/package.nix b/pkgs/by-name/we/wealthfolio/package.nix
index c7ce95234a5a..4f8b7ac07faf 100644
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@@ -18,18 +18,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wealthfolio";
-  version = "1.0.24";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "afadil";
     repo = "wealthfolio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3EuZXP4CTUcc9tlIdfAQfvwK5RZXcBe/8YkyjL/ZOVg=";
+    hash = "sha256-lN7P8FPcMU9COTyKs1hswvmHIKFqrL3Svp77q4pI6+I=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) src pname version;
-    hash = "sha256-0mjflUoqVJzshgpmyk32+Br61nkvcSjmjN7nf+7ZXJE=";
+    hash = "sha256-wKj1jy/TDi8Cckx9et2XzX3yPnmfXMDrqv9c4+Yyhu4=";
   };
 
   cargoRoot = "src-tauri";
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
-    hash = "sha256-QFIDiuoT4J4pv1VrU5twrcb9Eqo77bgsWQl1DURpghE=";
+    hash = "sha256-MmdvEutdkX98DgX1aVuxs4gabuMX5aM8yC4eqgvd8Q4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xa/xaos/package.nix b/pkgs/by-name/xa/xaos/package.nix
index 6dd1c768b85b..ce4c27c92a7b 100644
--- a/pkgs/by-name/xa/xaos/package.nix
+++ b/pkgs/by-name/xa/xaos/package.nix
@@ -11,7 +11,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "xaos";
-  version = "4.3.3";
+  version = "4.3.4";
   outputs = [
     "out"
     "man"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "xaos-project";
     repo = "XaoS";
     tag = "release-${version}";
-    hash = "sha256-EUhh1j0OVpCggpKcUJTRJOMKKy3ZF5Fdrk9yuXc2uEY=";
+    hash = "sha256-vOFwZbdbcrcJLHUa1QzxzadPcx5GF5uNPg+MZ7NbAPc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index 85195dade4aa..40c5e97d731b 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -17,13 +17,13 @@ python3Packages.buildPythonApplication rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2025.4.30";
+  version = "2025.5.22";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "yt_dlp";
-    hash = "sha256-0BNn0MOulONcseLsy3p8cOGBxMpEj07iN08mSJ0mNgM=";
+    hash = "sha256-6nOFTF2rwSTymjWo+um8XUIu8yMb6+6ivfqCrBkanCk=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/z3/z3/package.nix b/pkgs/by-name/z3/z3/package.nix
index cc80e0151581..3883b4d3840e 100644
--- a/pkgs/by-name/z3/z3/package.nix
+++ b/pkgs/by-name/z3/z3/package.nix
@@ -1,6 +1,129 @@
 {
-  z3_4_14,
-  ...
-}@args:
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3,
+  fixDarwinDylibNames,
+  nix-update-script,
+  versionCheckHook,
 
-z3_4_14.override args
+  javaBindings ? false,
+  ocamlBindings ? false,
+  pythonBindings ? true,
+  jdk ? null,
+  ocaml ? null,
+  findlib ? null,
+  zarith ? null,
+  ...
+}:
+
+assert javaBindings -> jdk != null;
+assert ocamlBindings -> ocaml != null && findlib != null && zarith != null;
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "z3";
+  version = "4.15.0";
+
+  src = fetchFromGitHub {
+    owner = "Z3Prover";
+    repo = "z3";
+    rev = "z3-${finalAttrs.version}";
+    hash = "sha256-fk3NyV6vIDXivhiNOW2Y0i5c+kzc7oBqaeBWj/JjpTM=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [ python3 ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
+    ++ lib.optionals javaBindings [ jdk ]
+    ++ lib.optionals ocamlBindings [
+      ocaml
+      findlib
+    ];
+  propagatedBuildInputs = [ python3.pkgs.setuptools ] ++ lib.optionals ocamlBindings [ zarith ];
+  enableParallelBuilding = true;
+
+  postPatch = lib.optionalString ocamlBindings ''
+    export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
+    mkdir -p $OCAMLFIND_DESTDIR/stublibs
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+
+    ${python3.pythonOnBuildForHost.interpreter} \
+      scripts/mk_make.py \
+      --prefix=$out \
+      ${lib.optionalString javaBindings "--java"} \
+      ${lib.optionalString ocamlBindings "--ml"} \
+      ${lib.optionalString pythonBindings "--python --pypkgdir=$out/${python3.sitePackages}"}
+
+    cd build
+
+    runHook postConfigure
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+
+    make -j $NIX_BUILD_CORES test
+    ./test-z3 -a
+
+    runHook postCheck
+  '';
+
+  postInstall =
+    ''
+      mkdir -p $dev $lib
+      mv $out/lib $lib/lib
+      mv $out/include $dev/include
+    ''
+    + lib.optionalString pythonBindings ''
+      mkdir -p $python/lib
+      mv $lib/lib/python* $python/lib/
+      ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python3.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
+    ''
+    + lib.optionalString javaBindings ''
+      mkdir -p $java/share/java
+      mv com.microsoft.z3.jar $java/share/java
+      moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
+    '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  outputs =
+    [
+      "out"
+      "lib"
+      "dev"
+      "python"
+    ]
+    ++ lib.optionals javaBindings [ "java" ]
+    ++ lib.optionals ocamlBindings [ "ocaml" ];
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "^z3-([0-9]+\\.[0-9]+\\.[0-9]+)$"
+      ];
+    };
+  };
+
+  meta = {
+    description = "High-performance theorem prover and SMT solver";
+    mainProgram = "z3";
+    homepage = "https://github.com/Z3Prover/z3";
+    changelog = "https://github.com/Z3Prover/z3/releases/tag/z3-${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
+      thoughtpolice
+      ttuegel
+      numinit
+    ];
+  };
+})
diff --git a/pkgs/by-name/z3/z3_4_14/package.nix b/pkgs/by-name/z3/z3_4_14/package.nix
deleted file mode 100644
index 60339b94e30f..000000000000
--- a/pkgs/by-name/z3/z3_4_14/package.nix
+++ /dev/null
@@ -1,130 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  python3,
-  fixDarwinDylibNames,
-  nix-update-script,
-  javaBindings ? false,
-  ocamlBindings ? false,
-  pythonBindings ? true,
-  jdk ? null,
-  ocaml ? null,
-  findlib ? null,
-  zarith ? null,
-  versionInfo ? {
-    regex = "^v(4\\.14\\.[0-9]+)$";
-    version = "4.14.1";
-    hash = "sha256-pTsDzf6Frk4mYAgF81wlR5Kb1x56joFggO5Fa3G2s70=";
-  },
-  ...
-}:
-
-assert javaBindings -> jdk != null;
-assert ocamlBindings -> ocaml != null && findlib != null && zarith != null;
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "z3";
-  inherit (versionInfo) version;
-
-  src = fetchFromGitHub {
-    owner = "Z3Prover";
-    repo = "z3";
-    rev = "z3-${finalAttrs.version}";
-    inherit (versionInfo) hash;
-  };
-
-  strictDeps = true;
-
-  nativeBuildInputs =
-    [ python3 ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames
-    ++ lib.optional javaBindings jdk
-    ++ lib.optionals ocamlBindings [
-      ocaml
-      findlib
-    ];
-  propagatedBuildInputs = [ python3.pkgs.setuptools ] ++ lib.optionals ocamlBindings [ zarith ];
-  enableParallelBuilding = true;
-
-  postPatch = lib.optionalString ocamlBindings ''
-    export OCAMLFIND_DESTDIR=$ocaml/lib/ocaml/${ocaml.version}/site-lib
-    mkdir -p $OCAMLFIND_DESTDIR/stublibs
-  '';
-
-  configurePhase =
-    lib.concatStringsSep " " (
-      [ "${python3.pythonOnBuildForHost.interpreter} scripts/mk_make.py --prefix=$out" ]
-      ++ lib.optional javaBindings "--java"
-      ++ lib.optional ocamlBindings "--ml"
-      ++ lib.optional pythonBindings "--python --pypkgdir=$out/${python3.sitePackages}"
-    )
-    + "\n"
-    + "cd build";
-
-  doCheck = true;
-  checkPhase = ''
-    make -j $NIX_BUILD_CORES test
-    ./test-z3 -a
-  '';
-
-  postInstall =
-    ''
-      mkdir -p $dev $lib
-      mv $out/lib $lib/lib
-      mv $out/include $dev/include
-    ''
-    + lib.optionalString pythonBindings ''
-      mkdir -p $python/lib
-      mv $lib/lib/python* $python/lib/
-      ln -sf $lib/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary} $python/${python3.sitePackages}/z3/lib/libz3${stdenv.hostPlatform.extensions.sharedLibrary}
-    ''
-    + lib.optionalString javaBindings ''
-      mkdir -p $java/share/java
-      mv com.microsoft.z3.jar $java/share/java
-      moveToOutput "lib/libz3java.${stdenv.hostPlatform.extensions.sharedLibrary}" "$java"
-    '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/z3 -version 2>&1 | grep -F "Z3 version $version"
-  '';
-
-  outputs =
-    [
-      "out"
-      "lib"
-      "dev"
-      "python"
-    ]
-    ++ lib.optional javaBindings "java"
-    ++ lib.optional ocamlBindings "ocaml";
-
-  passthru = {
-    updateScript = nix-update-script {
-      extraArgs =
-        [
-          "--version-regex"
-          versionInfo.regex
-        ]
-        ++ lib.optionals (versionInfo.autoUpdate or null != null) [
-          "--override-filename"
-          versionInfo.autoUpdate
-        ];
-    };
-  };
-
-  meta = {
-    description = "High-performance theorem prover and SMT solver";
-    mainProgram = "z3";
-    homepage = "https://github.com/Z3Prover/z3";
-    changelog = "https://github.com/Z3Prover/z3/releases/tag/z3-${finalAttrs.version}";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [
-      thoughtpolice
-      ttuegel
-      numinit
-    ];
-  };
-})
diff --git a/pkgs/development/python-modules/bc-detect-secrets/default.nix b/pkgs/development/python-modules/bc-detect-secrets/default.nix
index d5b47d86b6d9..b13b8067c13c 100644
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.5.42";
+  version = "1.5.43";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     tag = version;
-    hash = "sha256-ADK9zopoO7rOslJx3imxiKbziVK6oInfYHytgTVbq/w=";
+    hash = "sha256-A9qDkAi414wJ7cuAwr1r6FgIa1tOJb+EkAGsvFrw/Fo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 525c03ccb7e8..76abfdc488dd 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.38.19";
+  version = "1.38.20";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-Vm1Q7HAQXwb4YEHQP9SvaiQyL0Bj7NL2rIm5szgDjRQ=";
+    hash = "sha256-fx17//c1XrTRfnmE+/J/RHCc2EhKu1S9a6NOxzpVJgU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fastapi-mail/default.nix b/pkgs/development/python-modules/fastapi-mail/default.nix
index d0a0ebb50366..4fb8c7b1b621 100644
--- a/pkgs/development/python-modules/fastapi-mail/default.nix
+++ b/pkgs/development/python-modules/fastapi-mail/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "fastapi-mail";
-  version = "1.4.2";
+  version = "1.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "sabuhish";
     repo = "fastapi-mail";
     tag = version;
-    hash = "sha256-QypW7yE5jBkS1Q4XPIOktWnCmCXGoUzZF/SdWmFsPX8=";
+    hash = "sha256-v8cf4GlYAdl5+iD7hJHW+FuDN/I/VygWaaZLEotDNCU=";
   };
 
   pythonRelaxDeps = [
@@ -64,6 +64,7 @@ buildPythonPackage rec {
     # Tests require access to /etc/resolv.conf
     "test_default_checker"
     "test_redis_checker"
+    "test_local_hostname_resolving"
   ];
 
   pythonImportsCheck = [ "fastapi_mail" ];
@@ -72,7 +73,7 @@ buildPythonPackage rec {
     description = "Module for sending emails and attachments";
     homepage = "https://github.com/sabuhish/fastapi-mail";
     changelog = "https://github.com/sabuhish/fastapi-mail/releases/tag/${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/glueviz/default.nix b/pkgs/development/python-modules/glueviz/default.nix
index ea4fe11a18f5..31d3a412118c 100644
--- a/pkgs/development/python-modules/glueviz/default.nix
+++ b/pkgs/development/python-modules/glueviz/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "glueviz";
-  version = "1.21.1";
+  version = "1.22.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "glue-viz";
     repo = "glue";
     tag = "v${version}";
-    hash = "sha256-/awIgfKbDFKM2WFlfpo5f/Px/N1aMXkV9eSTXts0aGo=";
+    hash = "sha256-5YwZxVer3icA/7YmUIXTuyIlZYKrlFn5+4OYMbfvIlU=";
   };
 
   buildInputs = [ pyqt-builder ];
diff --git a/pkgs/development/python-modules/influxdb3-python/default.nix b/pkgs/development/python-modules/influxdb3-python/default.nix
index 0df3381a91c9..27c19da11a9c 100644
--- a/pkgs/development/python-modules/influxdb3-python/default.nix
+++ b/pkgs/development/python-modules/influxdb3-python/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "influxdb3-python";
-  version = "0.12.0";
+  version = "0.13.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "InfluxCommunity";
     repo = "influxdb3-python";
     tag = "v${version}";
-    hash = "sha256-WD4andK52w3daIqTEzBRouEqfTrrVV63Hm220RdQr8o=";
+    hash = "sha256-QYf1XUmnP0nPo5F1nFwVCw7W2CdUCgp7vJNV+QM4pPE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jsonargparse/default.nix b/pkgs/development/python-modules/jsonargparse/default.nix
index 749f7d4c3868..12f8b6267dee 100644
--- a/pkgs/development/python-modules/jsonargparse/default.nix
+++ b/pkgs/development/python-modules/jsonargparse/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "jsonargparse";
-  version = "4.39.0";
+  version = "4.40.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "omni-us";
     repo = "jsonargparse";
     tag = "v${version}";
-    hash = "sha256-MarJ1lTIZa7FyT/y/o/iBSwtqTXXrVXRWp7yk6lH0dM=";
+    hash = "sha256-2FEFAFEi+IRvFbFwto0YKJ/1JdSjb4kbTm1n9t/Ix4Y=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/klayout/default.nix b/pkgs/development/python-modules/klayout/default.nix
index 643bb4bf8b9f..eaa44f2a9027 100644
--- a/pkgs/development/python-modules/klayout/default.nix
+++ b/pkgs/development/python-modules/klayout/default.nix
@@ -7,6 +7,8 @@
   expat,
   libpng,
   setuptools,
+  stdenv,
+  fixDarwinDylibNames,
 }:
 
 buildPythonPackage rec {
@@ -30,6 +32,12 @@ buildPythonPackage rec {
     libpng
   ];
 
+  # libpng-config is needed for the build on Darwin
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    libpng.dev
+    fixDarwinDylibNames
+  ];
+
   pythonImportsCheck = [ "klayout" ];
 
   meta = with lib; {
@@ -37,6 +45,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/KLayout/klayout";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ fbeffa ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/python-modules/llama-cloud-services/default.nix b/pkgs/development/python-modules/llama-cloud-services/default.nix
index ece413d0f18a..d6f8eb464e93 100644
--- a/pkgs/development/python-modules/llama-cloud-services/default.nix
+++ b/pkgs/development/python-modules/llama-cloud-services/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "llama-cloud-services";
-  version = "0.6.22";
+  version = "0.6.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "run-llama";
     repo = "llama_cloud_services";
     tag = "v${version}";
-    hash = "sha256-o2nSiMj/vQq4xWV0lgL3LUdlQg+3EzrhASfd0NILMfA=";
+    hash = "sha256-G1qjm7GpSZDgGWys+toXiQoRJHIQUcwG6+0JK8k3XfE=";
   };
 
   pythonRelaxDeps = [ "llama-cloud" ];
diff --git a/pkgs/development/python-modules/llama-index-agent-openai/default.nix b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
index d6ffbbec17bd..e21d96a3b984 100644
--- a/pkgs/development/python-modules/llama-index-agent-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-agent-openai";
-  version = "0.4.7";
+  version = "0.4.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_agent_openai";
     inherit version;
-    hash = "sha256-+xu6sfCkIzCVA2QaLO2Nwa5sB9WomLT3Ft4NuZV0bg0=";
+    hash = "sha256-unbyHht/D2bjJtxBnCzEA8u2FK4o95BFQLEQNpWWX2g=";
   };
 
   pythonRelaxDeps = [ "llama-index-llms-openai" ];
diff --git a/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix b/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
index 7d37e2b4e729..8eaea6ae5860 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai-like/default.nix
@@ -2,16 +2,16 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  hatchling,
   llama-index-core,
   llama-index-llms-openai,
-  poetry-core,
   pythonOlder,
   transformers,
 }:
 
 buildPythonPackage rec {
   pname = "llama-index-llms-openai-like";
-  version = "0.3.4";
+  version = "0.3.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,10 +19,10 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_openai_like";
     inherit version;
-    hash = "sha256-bLjVdNicRrC9oH5/l0e2Qo9wpzNWBpIrQxh9qZ2WdR0=";
+    hash = "sha256-1TId/2bYHYuQCMdvROlcSZFTZDUyrMhZop5xRicvrNk=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     llama-index-core
diff --git a/pkgs/development/python-modules/llama-index-llms-openai/default.nix b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
index 933ec25e387a..94a57df95017 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
@@ -4,13 +4,13 @@
   fetchPypi,
   llama-index-core,
   openai,
-  poetry-core,
+  hatchling,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "llama-index-llms-openai";
-  version = "0.3.38";
+  version = "0.3.42";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_openai";
     inherit version;
-    hash = "sha256-vNHVISv3yUgwGVhxmh3zYb5is3tWIHMuTJzoBLwHi3c=";
+    hash = "sha256-O1yLSwbtod1743ATe215OI+dIcan7d2HK15jNuYYsjU=";
   };
 
   pythonRemoveDeps = [
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     "llama-index-agent-openai"
   ];
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     llama-index-core
diff --git a/pkgs/development/python-modules/llama-parse/default.nix b/pkgs/development/python-modules/llama-parse/default.nix
index 333ccf577131..6010964e118b 100644
--- a/pkgs/development/python-modules/llama-parse/default.nix
+++ b/pkgs/development/python-modules/llama-parse/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "llama-parse";
-  version = "0.6.4.post1";
+  version = "0.6.23";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_parse";
     inherit version;
-    hash = "sha256-hG2ZWfTgNPjZaB3R8APUL419wCjTlKsEhntZBGtDkNY=";
+    hash = "sha256-7lddEmYN5XJkkArkFOfGFkbbn73QMP15X7TOTSjYP4U=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/meilisearch/default.nix b/pkgs/development/python-modules/meilisearch/default.nix
index 0cebca839e57..74220864148c 100644
--- a/pkgs/development/python-modules/meilisearch/default.nix
+++ b/pkgs/development/python-modules/meilisearch/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.34.1";
+  version = "0.35";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "meilisearch";
     repo = "meilisearch-python";
     tag = "v${version}";
-    hash = "sha256-y4iGA0SJxjzddej5uXH2k3doaKBfXFVHlrRAjrD0CBA=";
+    hash = "sha256-/Y02+XaImJfZj/6+mkUR31LA9HkVXelFdcJok3/Ui+g=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/msgraph-sdk/default.nix b/pkgs/development/python-modules/msgraph-sdk/default.nix
index b1e60408f4e7..728d9013a0e9 100644
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "msgraph-sdk";
-  version = "1.30.0";
+  version = "1.31.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "microsoftgraph";
     repo = "msgraph-sdk-python";
     tag = "v${version}";
-    hash = "sha256-YKeQkgEOiblG7RJUAf7qI8F9MYU8sFDxrVUbdYj/H0Y=";
+    hash = "sha256-edDf3w7QXQd19B68S85OwV2rI5FpYwvuJ+DkF3da0HE=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 7588685aae4c..a023f3fe55f7 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -382,8 +382,8 @@ rec {
       "sha256-BpMkYM5+cchfhg+xJR9/cXd75fzl44rwsXXEe5ofowU=";
 
   mypy-boto3-datasync =
-    buildMypyBoto3Package "datasync" "1.38.0"
-      "sha256-Sk/XtOjc04Da6tfmbGg0feQah3mnsXDjXwKwCrLZ8ms=";
+    buildMypyBoto3Package "datasync" "1.38.20"
+      "sha256-/tlmBxr4MvI1YuPq5+BgHzQj2J+c1nN/C/poOxE0Xd8=";
 
   mypy-boto3-dax =
     buildMypyBoto3Package "dax" "1.38.0"
@@ -446,8 +446,8 @@ rec {
       "sha256-RQh46jrXqj4bXTRJ+tPR9sql7yUn7Ek9u4p0OU0A7b0=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.38.19"
-      "sha256-FonE4x7zpgXEgLAtwv2qJ1I//IRUHSvSvvCLmy8CF1Y=";
+    buildMypyBoto3Package "ec2" "1.38.20"
+      "sha256-8OsQwmsPFIkDkFJdNiE8YF4OXtHOsrnzPtOeKQRM5+g=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.38.0"
@@ -574,8 +574,8 @@ rec {
       "sha256-abALPaOoxM8dvwqd8j41mTT1Zmcn/sEVzlopSMc+fYM=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.38.18"
-      "sha256-iqCNIirn02Gl0oQW00xKxwp+3yOFrGXpkskIH4C5njs=";
+    buildMypyBoto3Package "glue" "1.38.20"
+      "sha256-4N+T4SvRqraR3juc+0jfbhmGrfCUALfpbrL8kmzygTw=";
 
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.38.0"
@@ -626,8 +626,8 @@ rec {
       "sha256-MaOetVmIqI8vVaVt6HCUXxrLO7lUm4i5DDzwfxEdLIg=";
 
   mypy-boto3-inspector2 =
-    buildMypyBoto3Package "inspector2" "1.38.0"
-      "sha256-swUv9KcYm0bsj11n5hRJayUXuFsLUZCQVrOQ+UaDJcE=";
+    buildMypyBoto3Package "inspector2" "1.38.20"
+      "sha256-Yz+NR/OXOQeeQROMuxGKSY85Z8wrS7TCg1KeUGg7k0c=";
 
   mypy-boto3-internetmonitor =
     buildMypyBoto3Package "internetmonitor" "1.38.0"
@@ -962,8 +962,8 @@ rec {
       "sha256-gs9eGyRaZN7Fsl0D5fSqtTiYZ+Exp0s8QW/X8ZR7guA=";
 
   mypy-boto3-oam =
-    buildMypyBoto3Package "oam" "1.38.0"
-      "sha256-FoA7KFsR9go+ijXjC1DlH893S/OVu+aR/LDbbcp8oUc=";
+    buildMypyBoto3Package "oam" "1.38.20"
+      "sha256-MM1WMowSubk22b/CG1OGxfozZ/svWVx4EpI5QHXPo1E=";
 
   mypy-boto3-omics =
     buildMypyBoto3Package "omics" "1.38.0"
@@ -1086,8 +1086,8 @@ rec {
       "sha256-ZgecmO3dz66i2COSXzBjyUCtTkGGi9gnvb/HNNEq1AE=";
 
   mypy-boto3-rds =
-    buildMypyBoto3Package "rds" "1.38.2"
-      "sha256-vfZRgJZfcaPrd3hwb4exziyfE0DPOrE28ZA6YAdOScw=";
+    buildMypyBoto3Package "rds" "1.38.20"
+      "sha256-xqpwwMxbxZlZ/sQ0IG+/ggA4a1g/8ffjchVOqkHrUuk=";
 
   mypy-boto3-rds-data =
     buildMypyBoto3Package "rds-data" "1.38.0"
diff --git a/pkgs/development/python-modules/narwhals/default.nix b/pkgs/development/python-modules/narwhals/default.nix
index 96484762249a..c1082a14be28 100644
--- a/pkgs/development/python-modules/narwhals/default.nix
+++ b/pkgs/development/python-modules/narwhals/default.nix
@@ -6,25 +6,29 @@
   fetchFromGitHub,
   hatchling,
   hypothesis,
+  ibis-framework,
+  packaging,
   pandas,
   polars,
+  pyarrow-hotfix,
   pyarrow,
   pyspark,
   pytest-env,
   pytestCheckHook,
+  rich,
   sqlframe,
 }:
 
 buildPythonPackage rec {
   pname = "narwhals";
-  version = "1.38.2";
+  version = "1.40.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "narwhals-dev";
     repo = "narwhals";
     tag = "v${version}";
-    hash = "sha256-zqtYTqirAXLcpFA2sXczl0HPWL/3cYWws2yUfE8I8NY=";
+    hash = "sha256-cCgWKH4DzENTI1vwxOU+GRp/poUe55XqSPY8UHYy9PI=";
   };
 
   build-system = [ hatchling ];
@@ -37,6 +41,12 @@ buildPythonPackage rec {
     polars = [ polars ];
     pyarrow = [ pyarrow ];
     pyspark = [ pyspark ];
+    ibis = [
+      ibis-framework
+      rich
+      packaging
+      pyarrow-hotfix
+    ];
     sqlframe = [ sqlframe ];
   };
 
@@ -54,6 +64,9 @@ buildPythonPackage rec {
     "test_rolling_var_hypothesis"
     # Missing file
     "test_pyspark_connect_deps_2517"
+    # Timezone issue
+    "test_to_datetime"
+    "test_unary_two_elements"
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/pubnub/default.nix b/pkgs/development/python-modules/pubnub/default.nix
index 95fd04ad8d97..d5fba5cab28a 100644
--- a/pkgs/development/python-modules/pubnub/default.nix
+++ b/pkgs/development/python-modules/pubnub/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pubnub";
-  version = "10.3.0";
+  version = "10.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "pubnub";
     repo = "python";
     tag = version;
-    hash = "sha256-GkROhb8kgiHTLcXTMg9vYcuGNW8xpa5NKUzge78AqBU=";
+    hash = "sha256-yAQK56X6DKuaijAvUgQtAmpR4V5FioZogAqzZ/yhbHE=";
   };
 
   pythonRelaxDeps = [ "httpx" ];
diff --git a/pkgs/development/python-modules/py-ocsf-models/default.nix b/pkgs/development/python-modules/py-ocsf-models/default.nix
index c3820ab59c0e..6a1501a7ea83 100644
--- a/pkgs/development/python-modules/py-ocsf-models/default.nix
+++ b/pkgs/development/python-modules/py-ocsf-models/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "py-ocsf-models";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "prowler-cloud";
     repo = "py-ocsf-models";
     tag = version;
-    hash = "sha256-OCHhqsP0RlqBPvK4e6m5v3/W6N7T/rzp0xL950dY//A=";
+    hash = "sha256-AK/QaeJNVrVa5TRMJZAjZnemvRwHuxqIWA/mK7Cs4Xc=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
index b1cecd44d086..337adeadf07f 100644
--- a/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pysigma-backend-elasticsearch";
-  version = "1.1.5";
+  version = "1.1.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-backend-elasticsearch";
     tag = "v${version}";
-    hash = "sha256-qIP+TP6lzviEAunYge/SIZQ6PI0EFnJo64FVpPmkdLY=";
+    hash = "sha256-v+OTMcSvFXfjm4R3wCgLRCG0yKNqvY1mgRcmq2Jws0s=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index 63ca789b70ba..be8e1f24826a 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.31.0";
+  version = "2.31.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     postFetch = ''
       sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pytensor/_version.py
     '';
-    hash = "sha256-RgJeKA0dRSY1xn+7pgzUg5Hn5KKAWUilimbZOn43xHQ=";
+    hash = "sha256-R/qHLAqNbFqoi2MQeptlVE148cInVOpN5n/wGr1AB9M=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/scim2-models/default.nix b/pkgs/development/python-modules/scim2-models/default.nix
index 5e625418d8af..72b184d0ddd7 100644
--- a/pkgs/development/python-modules/scim2-models/default.nix
+++ b/pkgs/development/python-modules/scim2-models/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "scim2-models";
-  version = "0.3.2";
+  version = "0.3.3";
 
   pyproject = true;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "scim2_models";
-    hash = "sha256-CHXvg7okGvUKJ2tND/EduUPPpUAwIc97BM/nGAeDiYE=";
+    hash = "sha256-od+1KaAwmZ1slsACYRYRpy92xz5s8hcopz0LiwVJhfA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 64e537fcfc1b..1a37b3a31292 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1383";
+  version = "3.0.1384";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-xC16Y4fLEvGgMnZGx2KV/a3HTIrXwPSwxlQwDzB52fo=";
+    hash = "sha256-EzQWxfUQy/1a3TU449cClcj2WHwDqfEVG5qpGwYI+f8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index 7e42c6d2b82b..0a58a72af669 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "velbus-aio";
-  version = "2025.4.2";
+  version = "2025.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = "velbus-aio";
     tag = version;
-    hash = "sha256-3H5lFIMLHyucX0h7JagGPsqGyO1RMVPJ1L91iDbdEww=";
+    hash = "sha256-oRcTiFYWVOlM6jHuIUpE4OapWn/4VyWD+MYZI5pgW3s=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/games/wesnoth/default.nix b/pkgs/games/wesnoth/default.nix
index ed13f5807693..a38830086375 100644
--- a/pkgs/games/wesnoth/default.nix
+++ b/pkgs/games/wesnoth/default.nix
@@ -22,48 +22,20 @@
   icu,
   lua,
   curl,
-  fetchpatch,
   nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wesnoth";
-  version = "1.18.4";
+  version = "1.18.5";
 
   src = fetchFromGitHub {
     owner = "wesnoth";
     repo = "wesnoth";
     tag = finalAttrs.version;
-    hash = "sha256-c3BoTFnSUqtp71QeSCsC2teVuzsQwV8hOJtIcZdP+1E=";
+    hash = "sha256-0VZJAmaCg12x4S07H1kl5s2NGMEo/NSVnzMniREmPJk=";
   };
 
-  # LLVM 19 removed support for types not officially supported by `std::char_traits`:
-  # https://libcxx.llvm.org/ReleaseNotes/19.html#deprecations-and-removals
-  # Wesnoth <1.19 relies on this previously supported non-standard behavior for
-  # some types that should either have been a vector or span:
-  # https://github.com/wesnoth/wesnoth/issues/9546
-  # Wesnoth moved to a `std::span` wrapper for byte views in the 1.19 branch, which we apply as
-  # patches until 1.20 is released.
-  patches = lib.optionals (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "19") [
-    # The next two patches are cherry-picked from https://github.com/wesnoth/wesnoth/pull/10102,
-    # which is already included in the 1.19 branch.
-    # Introduces the `std::span` wrapper based on `boost::span`.
-    (fetchpatch {
-      url = "https://github.com/wesnoth/wesnoth/commit/63266cc2c88fefa7e0792ac59d14c14e3711440c.patch";
-      hash = "sha256-3Zi/njG7Kovmyd7yiKUoeu4u0QPQxxw+uLz+k9isOLU=";
-    })
-    # Replace all string views with spans.
-    (fetchpatch {
-      url = "https://github.com/wesnoth/wesnoth/commit/d3daa161eb2c02670b5ffbcf86cd0ec787f6b9ee.patch";
-      hash = "sha256-9DCeZQZKE6fN91T5DCpNJsKGXbv5ihZC8UpuNkiA9zc=";
-    })
-    # Wesnoth <1.19 uses `std::basic_string` for lightmap computations, which is not standard compliant
-    # and incompatible to LLVM 19.
-    # While this was fixed in https://github.com/wesnoth/wesnoth/pull/10128, the fix is not
-    # trivially backportable to 1.18 so we apply a simpler fix instead.
-    ./llvm19-lightmap.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -142,6 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
     homepage = "https://www.wesnoth.org/";
+    changelog = "https://github.com/wesnoth/wesnoth/blob/${finalAttrs.version}/changelog.md";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
       abbradar
diff --git a/pkgs/games/wesnoth/llvm19-lightmap.patch b/pkgs/games/wesnoth/llvm19-lightmap.patch
deleted file mode 100644
index 34edc173ff0c..000000000000
--- a/pkgs/games/wesnoth/llvm19-lightmap.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-diff --git a/src/display.cpp b/src/display.cpp
-index 0f6552222b7..9d50046de2f 100644
---- a/src/display.cpp
-+++ b/src/display.cpp
-@@ -1082,7 +1082,8 @@ void display::get_terrain_images(const map_location& loc, const std::string& tim
-
- 		// add the directional transitions
- 		tod_color acol = atod1.color + color_adjust_;
--		lt += image::get_light_string(d + 1, acol.r, acol.g, acol.b);
-+		auto new_lt = image::get_light_string(d + 1, acol.r, acol.g, acol.b);
-+		lt.insert(lt.end(), new_lt.begin(), new_lt.end());
- 	}
-
- 	for(int d = 0; d < 6; ++d) {
-@@ -1114,7 +1115,8 @@ void display::get_terrain_images(const map_location& loc, const std::string& tim
-
- 		// add the directional transitions
- 		tod_color acol = atod1.color + color_adjust_;
--		lt += image::get_light_string(d + 7, acol.r, acol.g, acol.b);
-+		auto new_lt = image::get_light_string(d + 7, acol.r, acol.g, acol.b);
-+		lt.insert(lt.end(), new_lt.begin(), new_lt.end());
- 	}
-
- 	for(int d = 0; d < 6; ++d) {
-@@ -1146,7 +1148,8 @@ void display::get_terrain_images(const map_location& loc, const std::string& tim
-
- 		// add the directional transitions
- 		tod_color acol = atod2.color + color_adjust_;
--		lt += image::get_light_string(d + 13, acol.r, acol.g, acol.b);
-+		auto new_lt = image::get_light_string(d + 13, acol.r, acol.g, acol.b);
-+		lt.insert(lt.end(), new_lt.begin(), new_lt.end());
- 	}
-
- 	if(lt.empty()){
-diff --git a/src/picture.cpp b/src/picture.cpp
-index e7aeddaa821..5ad1ebcbcbc 100644
---- a/src/picture.cpp
-+++ b/src/picture.cpp
-@@ -526,7 +526,9 @@ static surface apply_light(surface surf, const light_string& ls)
-
- 		// decompose into atomic lightmap operations (4 chars)
- 		for(std::size_t c = 0; c + 3 < ls.size(); c += 4) {
--			light_string sls = ls.substr(c, 4);
-+			auto start = ls.begin() + c;
-+			auto end = start + 4;
-+			light_string sls(start, end);
-
- 			// get the corresponding image and apply the lightmap operation to it
- 			// This allows to also cache lightmap parts.
-diff --git a/src/picture.hpp b/src/picture.hpp
-index 85a3b3a15a1..a26e1e27bc7 100644
---- a/src/picture.hpp
-+++ b/src/picture.hpp
-@@ -120,7 +120,7 @@ std::ostream& operator<<(std::ostream&, const locator&);
-  *  7-12: convex half-corners 1
-  * 13-19: convex half-corners 2
-  */
--typedef std::basic_string<signed char> light_string;
-+typedef std::vector<signed char> light_string;
diff --git a/pkgs/os-specific/linux/v86d/default.nix b/pkgs/os-specific/linux/v86d/default.nix
index e6ca1d0e99f8..eb80c0d9cdb7 100644
--- a/pkgs/os-specific/linux/v86d/default.nix
+++ b/pkgs/os-specific/linux/v86d/default.nix
@@ -16,14 +16,17 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "mjanusz";
     repo = "v86d";
-    rev = "v86d-${pversion}";
+    tag = "v86d-${pversion}";
     hash = "sha256-95LRzVbO/DyddmPwQNNQ290tasCGoQk7FDHlst6LkbA=";
   };
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs configure
   '';
 
+  # GCC 14 makes this an error by default, remove when fixed upstream
+  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration -Wno-implicit-int";
+
   configureFlags = [
     "--with-klibc"
     "--with-x86emu"
@@ -37,17 +40,21 @@ stdenv.mkDerivation {
   ];
 
   configurePhase = ''
+    runHook preConfigure
+
     ./configure $configureFlags
+
+    runHook postConfigure
   '';
 
   buildInputs = [ klibc ];
 
-  meta = with lib; {
+  meta = {
     description = "Daemon to run x86 code in an emulated environment";
     mainProgram = "v86d";
     homepage = "https://github.com/mjanusz/v86d";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ codyopel ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ codyopel ];
     platforms = [
       "i686-linux"
       "x86_64-linux"
diff --git a/pkgs/tools/backup/ugarit/eggs.nix b/pkgs/tools/backup/ugarit/eggs.nix
index dbbb9a56c47b..cc8af0585382 100644
--- a/pkgs/tools/backup/ugarit/eggs.nix
+++ b/pkgs/tools/backup/ugarit/eggs.nix
@@ -192,6 +192,11 @@ rec {
     buildInputs = [
 
     ];
+
+    patches = [
+      # missing include <sys/sysmacros.h> since Jan 2025, cause unknown
+      ./posix-extras-add-sysmacros-include.patch
+    ];
   };
 
   record-variants = eggDerivation {
diff --git a/pkgs/tools/backup/ugarit/posix-extras-add-sysmacros-include.patch b/pkgs/tools/backup/ugarit/posix-extras-add-sysmacros-include.patch
new file mode 100644
index 000000000000..bd374b679d84
--- /dev/null
+++ b/pkgs/tools/backup/ugarit/posix-extras-add-sysmacros-include.patch
@@ -0,0 +1,10 @@
+--- a/posix-extras.scm	1970-01-01 01:00:01.000000000 +0100
++++ b/posix-extras.scm	1970-01-01 01:00:01.000000000 +0100
+@@ -110,6 +110,7 @@ static void *C_not_implemented_ptr(void)
+ #endif
+ 
+ #if defined (__unix__) || defined (C_XXXBSD)
++#include <sys/sysmacros.h>
+ #include <sys/types.h>
+ #define C_mknod(fn, m, d) C_fix(mknod(C_data_pointer(fn), C_unfix(m), C_unfix(d)))
+ #define C_mknod64(fn, m, maj, min) C_fix(mknod(C_data_pointer(fn), C_unfix(m), makedev(C_num_to_int(maj), C_num_to_int(min))))
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index 13f6d88828e6..df64103e8a45 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -254,7 +254,10 @@ stdenv.mkDerivation (finalAttrs: {
       # Enable LTO, since it improves eval performance a fair amount
       # LTO is disabled on:
       # - static builds (strange linkage errors)
-      (lib.mesonBool "b_lto" (!stdenv.hostPlatform.isStatic && (isLLVMOnly || stdenv.cc.isGNU)))
+      # - darwin builds (install test failures. see fj#568 & fj#832)
+      (lib.mesonBool "b_lto" (
+        !stdenv.hostPlatform.isStatic && !stdenv.hostPlatform.isDarwin && (isLLVMOnly || stdenv.cc.isGNU)
+      ))
       (lib.mesonEnable "gc" true)
       (lib.mesonBool "enable-tests" true)
       (lib.mesonBool "enable-docs" enableDocumentation)
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 096ea612fb8c..b47c52c32819 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.88.30";
+  version = "3.88.32";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${version}";
-    hash = "sha256-94mJNq0D0Fo4wH/uylp+YsYMwsHDyhE9KnBh21Ne2/0=";
+    hash = "sha256-KU9wKqdQLiJOoeEW3NRgxB2rfmu9bSe61Z+Wo0UqVa4=";
   };
 
-  vendorHash = "sha256-0mwItAv8w9G9CmGmmHDu5jZPYUv/wJYAAiXAYNUTisY=";
+  vendorHash = "sha256-sF7+2IrVlGskoQjVYrnmFC7KSNSh0fl3BErSMJESrcA=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e063687dcdc5..ad609df10c42 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -509,6 +509,7 @@ mapAliases {
   ### D ###
 
   dap = throw "'dap' has been removed because it doesn't compile and has been unmaintained since 2014"; # Added 2025-05-10
+  daq = throw "'daq' has been removed as it is unmaintained and broken. Snort2 has also been removed, which depended on this"; # Added 2025-05-21
   darling = throw "'darling' has been removed due to vendoring Python2"; # Added 2025-05-10
   dart_stable = throw "'dart_stable' has been renamed to/replaced by 'dart'"; # Converted to throw 2024-10-17
   dart-sass-embedded = throw "dart-sass-embedded has been removed from nixpkgs, as is now included in Dart Sass itself.";
@@ -1749,6 +1750,7 @@ mapAliases {
   sm64ex-coop = throw "'sm64ex-coop' was removed as it was archived upstream. Consider migrating to 'sm64coopdx'"; # added 2024-11-23
   smartgithg = smartgit; # renamed March 2025
   snapTools = throw "snapTools was removed because makeSnap produced broken snaps and it was the only function in snapTools. See https://github.com/NixOS/nixpkgs/issues/100618 for more details."; # 2024-03-04;
+  snort2 = throw "snort2 has been removed as it is deprecated and unmaintained by upstream. Consider using snort (snort3) package instead."; # 2025-05-21
   soldat-unstable = opensoldat; # Added 2022-07-02
   soundOfSorting = sound-of-sorting; # Added 2023-07-07
   SP800-90B_EntropyAssessment = sp800-90b-entropyassessment; # Added on 2024-06-12
@@ -2090,6 +2092,12 @@ mapAliases {
 
   ### Z ###
 
+  z3_4_11 = throw "'z3_4_11' has been removed in favour of the latest version. Use 'z3'."; # Added 2025-05-18
+  z3_4_12 = throw "'z3_4_12' has been removed in favour of the latest version. Use 'z3'."; # Added 2025-05-18
+  z3_4_13 = throw "'z3_4_13' has been removed in favour of the latest version. Use 'z3'."; # Added 2025-05-18
+  z3_4_14 = throw "'z3_4_14' has been removed in favour of the latest version. Use 'z3'."; # Added 2025-05-18
+  z3_4_8_5 = throw "'z3_4_8_5' has been removed in favour of the latest version. Use 'z3'."; # Added 2025-05-18
+  z3_4_8 = throw "'z3_4_8' has been removed in favour of the latest version. Use 'z3'."; # Added 2025-05-18
   zabbix50 = throw "'zabbix50' has been removed, it would have reached its End of Life a few days after the release of NixOS 25.05. Consider upgrading to 'zabbix60' or 'zabbix70'.";
   zabbix64 = throw "'zabbix64' has been removed because it reached its End of Life. Consider upgrading to 'zabbix70'.";
   zeroadPackages = recurseIntoAttrs {