diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index d77bbceb07f1..04f38641323c 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -45,42 +45,25 @@ jobs:
           filter: tree:0
           path: trusted
 
-      - name: Check cherry-picks
-        id: check
-        continue-on-error: true
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          ./trusted/ci/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA" checked-cherry-picks.md
+      - name: Install dependencies
+        run: npm install bottleneck
 
       - name: Log current API rate limits
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh api /rate_limit | jq
 
-      - name: Prepare review
-        if: steps.check.outcome == 'failure'
+      - name: Check cherry-picks
+        id: check
+        continue-on-error: true
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
-            const { readFile, writeFile } = require('node:fs/promises')
-
-            const job_url = (await github.rest.actions.listJobsForWorkflowRun({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              run_id: context.runId
-            })).data.jobs[0].html_url + '?pr=' + context.payload.pull_request.number
-
-            const header = await readFile('trusted/ci/check-cherry-picks.md')
-            const body = await readFile('checked-cherry-picks.md')
-            const footer =
-              `\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`
-
-            const review = header + body + footer
-            await writeFile('review.md', review)
-            core.summary.addRaw(review)
-            core.summary.write()
+            require('./trusted/ci/github-script/commits.js')({
+              github,
+              context,
+              core,
+            })
 
       - name: Request changes
         if: ${{ github.event_name == 'pull_request_target' && steps.check.outcome == 'failure' }}
diff --git a/ci/check-cherry-picks.sh b/ci/check-cherry-picks.sh
deleted file mode 100755
index 113828f6ee1c..000000000000
--- a/ci/check-cherry-picks.sh
+++ /dev/null
@@ -1,152 +0,0 @@
-#!/usr/bin/env bash
-# Find alleged cherry-picks
-
-set -euo pipefail
-
-if [[ $# != "2" && $# != "3" ]] ; then
-  echo "usage: check-cherry-picks.sh base_rev head_rev [markdown_file]"
-  exit 2
-fi
-
-markdown_file="$(realpath ${3:-/dev/null})"
-[ -v 3 ] && rm -f "$markdown_file"
-
-# Make sure we are inside the nixpkgs repo, even when called from outside
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-PICKABLE_BRANCHES="master staging release-??.?? staging-??.?? haskell-updates python-updates staging-next staging-next-??.??"
-problem=0
-
-# Not everyone calls their remote "origin"
-remote="$(git remote -v | grep -i 'NixOS/nixpkgs' | head -n1 | cut -f1 || true)"
-
-commits="$(git rev-list --reverse "$1..$2")"
-
-log() {
-  type="$1"
-  shift 1
-
-  local -A prefix
-  prefix[success]="  ✔ "
-  if [ -v GITHUB_ACTIONS ]; then
-    prefix[warning]="::warning::"
-    prefix[error]="::error::"
-  else
-    prefix[warning]="  ⚠ "
-    prefix[error]="  ✘ "
-  fi
-
-  echo "${prefix[$type]}$@"
-
-  # Only logging errors and warnings, which allows comparing the markdown file
-  # between pushes to the PR. Even if a new, proper cherry-pick, commit is added
-  # it won't change the markdown file's content and thus not trigger another comment.
-  if [ "$type" != "success" ]; then
-    local -A alert
-    alert[warning]="WARNING"
-    alert[error]="CAUTION"
-    echo >> $markdown_file
-    echo "> [!${alert[$type]}]" >> $markdown_file
-    echo "> $@" >> $markdown_file
-  fi
-}
-
-endgroup() {
-  if [ -v GITHUB_ACTIONS ] ; then
-    echo ::endgroup::
-  fi
-}
-
-while read -r new_commit_sha ; do
-  if [ -v GITHUB_ACTIONS ] ; then
-    echo "::group::Commit $new_commit_sha"
-  else
-    echo "================================================="
-  fi
-  git rev-list --max-count=1 --format=medium "$new_commit_sha"
-  echo "-------------------------------------------------"
-
-  # Using the last line with "cherry" + hash, because a chained backport
-  # can result in multiple of those lines. Only the last one counts.
-  original_commit_sha=$(
-    git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
-    | grep -Ei "cherry.*[0-9a-f]{40}" | tail -n1 \
-    | grep -Eoi -m1 '[0-9a-f]{40}' || true
-  )
-  if [ -z "$original_commit_sha" ] ; then
-    endgroup
-    log warning "Couldn't locate original commit hash in message of $new_commit_sha."
-    problem=1
-    continue
-  fi
-
-  set -f # prevent pathname expansion of patterns
-  for pattern in $PICKABLE_BRANCHES ; do
-    set +f # re-enable pathname expansion
-
-    # Reverse sorting by refname and taking one match only means we can only backport
-    # from unstable and the latest stable. That makes sense, because even right after
-    # branch-off, when we have two supported stable branches, we only ever want to cherry-pick
-    # **to** the older one, but never **from** it.
-    # This makes the job significantly faster in the case when commits can't be found,
-    # because it doesn't need to iterate through 20+ branches, which all need to be fetched.
-    branches="$(git for-each-ref --sort=-refname --format="%(refname)" \
-      "refs/remotes/${remote:-origin}/$pattern" | head -n1)"
-
-    while read -r picked_branch ; do
-      if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
-        range_diff_common='git --no-pager range-diff
-          --no-notes
-          --creation-factor=100
-          '"$original_commit_sha~..$original_commit_sha"'
-          '"$new_commit_sha~..$new_commit_sha"'
-        '
-
-        if $range_diff_common --no-color 2> /dev/null | grep -E '^ {4}[+-]{2}' > /dev/null ; then
-          log success "$original_commit_sha present in branch $picked_branch"
-          endgroup
-          log warning "Difference between $new_commit_sha and original $original_commit_sha may warrant inspection."
-
-          # First line contains commit SHAs, which we already printed.
-          $range_diff_common --color | tail -n +2
-
-          echo -e "> <details><summary>Show diff</summary>\n>" >> $markdown_file
-          echo '> ```diff' >> $markdown_file
-          # The output of `git range-diff` is indented with 4 spaces, which we need to match with the
-          # code blocks indent to get proper syntax highlighting on GitHub.
-          diff="$($range_diff_common | tail -n +2 | sed -Ee 's/^ {4}/> /g')"
-          # Also limit the output to 10k bytes (and remove the last, potentially incomplete line), because
-          # GitHub comments are limited in length. The value of 10k is arbitrary with the assumption, that
-          # after the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff
-          # in GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
-          # Note: This could still lead to a too lengthy comment with multiple commits touching the limit. We
-          # consider this too unlikely to happen, to deal with explicitly.
-          max_length=10000
-          if [ "${#diff}" -gt $max_length ]; then
-            printf -v diff "%s\n>\n> [...truncated...]" "$(echo "$diff" | head -c $max_length | head -n-1)"
-          fi
-          echo "$diff" >> $markdown_file
-          echo '> ```' >> $markdown_file
-          echo "> </details>" >> $markdown_file
-
-          problem=1
-        else
-          log success "$original_commit_sha present in branch $picked_branch"
-          log success "$original_commit_sha highly similar to $new_commit_sha"
-          $range_diff_common --color
-          endgroup
-        fi
-
-        # move on to next commit
-        continue 3
-      fi
-    done <<< "$branches"
-  done
-
-  endgroup
-  log error "$original_commit_sha given in $new_commit_sha not found in any pickable branch."
-
-  problem=1
-done <<< "$commits"
-
-exit $problem
diff --git a/ci/github-script/.gitignore b/ci/github-script/.gitignore
index 3c3629e647f5..6b8a37657bc7 100644
--- a/ci/github-script/.gitignore
+++ b/ci/github-script/.gitignore
@@ -1 +1,2 @@
 node_modules
+step-summary.md
diff --git a/ci/github-script/.npmrc b/ci/github-script/.npmrc
index f91a336f47b6..fb41d64f4679 100644
--- a/ci/github-script/.npmrc
+++ b/ci/github-script/.npmrc
@@ -1 +1,2 @@
 package-lock-only = true
+save-exact = true
diff --git a/ci/github-script/README.md b/ci/github-script/README.md
index caf52eb5bba3..52b78c79d79f 100644
--- a/ci/github-script/README.md
+++ b/ci/github-script/README.md
@@ -8,6 +8,10 @@ To run any of the scripts locally:
 - Enter `nix-shell` in `./ci/github-script`.
 - Ensure `gh` is authenticated.
 
+## Check commits
+
+Run `./run commits OWNER REPO PR`, where OWNER is your username or "NixOS", REPO is the name of your fork or "nixpkgs" and PR is the number of the pull request to check.
+
 ## Labeler
 
 Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
diff --git a/ci/check-cherry-picks.md b/ci/github-script/check-cherry-picks.md
similarity index 100%
rename from ci/check-cherry-picks.md
rename to ci/github-script/check-cherry-picks.md
diff --git a/ci/github-script/commits.js b/ci/github-script/commits.js
new file mode 100644
index 000000000000..99e969591045
--- /dev/null
+++ b/ci/github-script/commits.js
@@ -0,0 +1,199 @@
+module.exports = async function ({ github, context, core }) {
+  const { execFileSync } = require('node:child_process')
+  const { readFile, writeFile } = require('node:fs/promises')
+  const { join } = require('node:path')
+  const { classify } = require('../supportedBranches.js')
+  const withRateLimit = require('./withRateLimit.js')
+
+  await withRateLimit({ github, core }, async (stats) => {
+    stats.prs = 1
+
+    const job_url =
+      context.runId &&
+      (
+        await github.rest.actions.listJobsForWorkflowRun({
+          ...context.repo,
+          run_id: context.runId,
+        })
+      ).data.jobs[0].html_url +
+        '?pr=' +
+        context.payload.pull_request.number
+
+    async function handle({ sha, commit }) {
+      // Using the last line with "cherry" + hash, because a chained backport
+      // can result in multiple of those lines. Only the last one counts.
+      const match = Array.from(
+        commit.message.matchAll(/cherry.*([0-9a-f]{40})/g),
+      ).at(-1)
+
+      if (!match)
+        return {
+          sha,
+          commit,
+          severity: 'warning',
+          message: `Couldn't locate original commit hash in message of ${sha}.`,
+        }
+
+      const original_sha = match[1]
+
+      let branches
+      try {
+        branches = (
+          await github.request({
+            // This is an undocumented endpoint to fetch the branches a commit is part of.
+            // There is no equivalent in neither the REST nor the GraphQL API.
+            // The endpoint itself is unlikely to go away, because GitHub uses it to display
+            // the list of branches on the detail page of a commit.
+            url: `https://github.com/${context.repo.owner}/${context.repo.repo}/branch_commits/${original_sha}`,
+            headers: {
+              accept: 'application/json',
+            },
+          })
+        ).data.branches
+          .map(({ branch }) => branch)
+          .filter((branch) => classify(branch).type.includes('development'))
+      } catch (e) {
+        // For some unknown reason a 404 error comes back as 500 without any more details in a GitHub Actions runner.
+        // Ignore these to return a regular error message below.
+        if (![404, 500].includes(e.status)) throw e
+      }
+      if (!branches?.length)
+        return {
+          sha,
+          commit,
+          severity: 'error',
+          message: `${original_sha} given in ${sha} not found in any pickable branch.`,
+        }
+
+      const diff = execFileSync('git', [
+        '-C',
+        __dirname,
+        'range-diff',
+        '--no-color',
+        '--no-notes',
+        '--creation-factor=100',
+        `${original_sha}~..${original_sha}`,
+        `${sha}~..${sha}`,
+      ])
+        .toString()
+        .split('\n')
+        // First line contains commit SHAs, which we'll print separately.
+        .slice(1)
+        // # The output of `git range-diff` is indented with 4 spaces, but we'll control indentation manually.
+        .map((line) => line.replace(/^ {4}/, ''))
+
+      if (!diff.some((line) => line.match(/^[+-]{2}/)))
+        return {
+          sha,
+          commit,
+          severity: 'info',
+          message: `✔ ${original_sha} is highly similar to ${sha}.`,
+        }
+
+      const colored_diff = execFileSync('git', [
+        '-C',
+        __dirname,
+        'range-diff',
+        '--color',
+        '--no-notes',
+        '--creation-factor=100',
+        `${original_sha}~..${original_sha}`,
+        `${sha}~..${sha}`,
+      ]).toString()
+
+      return {
+        sha,
+        commit,
+        diff,
+        colored_diff,
+        severity: 'warning',
+        message: `Difference between ${sha} and original ${original_sha} may warrant inspection.`,
+      }
+    }
+
+    const commits = await github.paginate(github.rest.pulls.listCommits, {
+      ...context.repo,
+      pull_number: context.payload.pull_request.number,
+    })
+
+    const results = await Promise.all(commits.map(handle))
+
+    // Log all results without truncation and with better highlighting to the job log.
+    results.forEach(({ sha, commit, severity, message, colored_diff }) => {
+      core.startGroup(`Commit ${sha}`)
+      core.info(`Author: ${commit.author.name} ${commit.author.email}`)
+      core.info(`Date: ${new Date(commit.author.date)}`)
+      core[severity](message)
+      core.endGroup()
+      if (colored_diff) core.info(colored_diff)
+    })
+
+    // Only create step summary below in case of warnings or errors.
+    if (results.every(({ severity }) => severity == 'info')) return
+    else process.exitCode = 1
+
+    core.summary.addRaw(
+      await readFile(join(__dirname, 'check-cherry-picks.md'), 'utf-8'),
+      true,
+    )
+    results.forEach(({ severity, message, diff }) => {
+      if (severity == 'info') return
+
+      // The docs for markdown alerts only show examples with markdown blockquote syntax, like this:
+      //   > [!WARNING]
+      //   > message
+      // However, our testing shows that this also works with a `<blockquote>` html tag, as long as there
+      // is an empty line:
+      //   <blockquote>
+      //
+      //   [!WARNING]
+      //   message
+      //   </blockquote>
+      // Whether this is intended or just an implementation detail is unclear.
+      core.summary.addRaw('<blockquote>')
+      core.summary.addRaw(
+        `\n\n[!${severity == 'warning' ? 'WARNING' : 'CAUTION'}]`,
+        true,
+      )
+      core.summary.addRaw(`${message}`, true)
+
+      if (diff) {
+        // Limit the output to 10k bytes and remove the last, potentially incomplete line, because GitHub
+        // comments are limited in length. The value of 10k is arbitrary with the assumption, that after
+        // the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff in
+        // GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
+        // Note: if multiple commits are close to the limit, this approach could still lead to a comment
+        // that's too long. We think this is unlikely to happen, and so don't deal with it explicitly.
+        const truncated = []
+        let total_length = 0
+        for (line of diff) {
+          total_length += line.length
+          if (total_length > 10000) {
+            truncated.push('', '[...truncated...]')
+            break
+          } else {
+            truncated.push(line)
+          }
+        }
+
+        core.summary.addRaw('<details><summary>Show diff</summary>')
+        core.summary.addRaw('\n\n```diff', true)
+        core.summary.addRaw(truncated.join('\n'), true)
+        core.summary.addRaw('```', true)
+        core.summary.addRaw('</details>')
+      }
+
+      core.summary.addRaw('</blockquote>')
+    })
+
+    if (job_url)
+      core.summary.addRaw(
+        `\n\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`,
+      )
+
+    // Write to disk temporarily for next step in GHA.
+    await writeFile('review.md', core.summary.stringify())
+
+    core.summary.write()
+  })
+}
diff --git a/ci/github-script/package-lock.json b/ci/github-script/package-lock.json
index 538083dcea93..0dcc9b68e259 100644
--- a/ci/github-script/package-lock.json
+++ b/ci/github-script/package-lock.json
@@ -6,6 +6,7 @@
     "": {
       "dependencies": {
         "@actions/artifact": "2.3.2",
+        "@actions/core": "1.11.1",
         "@actions/github": "6.0.1",
         "bottleneck": "2.19.5",
         "commander": "14.0.0"
diff --git a/ci/github-script/package.json b/ci/github-script/package.json
index 4671dd41f0cd..860bb09cdd95 100644
--- a/ci/github-script/package.json
+++ b/ci/github-script/package.json
@@ -2,6 +2,7 @@
   "private": true,
   "dependencies": {
     "@actions/artifact": "2.3.2",
+    "@actions/core": "1.11.1",
     "@actions/github": "6.0.1",
     "bottleneck": "2.19.5",
     "commander": "14.0.0"
diff --git a/ci/github-script/run b/ci/github-script/run
index cbf3ea9315e0..3fe6e189eb96 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -1,12 +1,13 @@
 #!/usr/bin/env -S node --import ./run
 import { execSync } from 'node:child_process'
-import { mkdtempSync, rmSync } from 'node:fs'
+import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { program } from 'commander'
+import * as core from '@actions/core'
 import { getOctokit } from '@actions/github'
 
-async function run(action, owner, repo, pull_number, dry) {
+async function run(action, owner, repo, pull_number, dry = true) {
   const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
 
   const github = getOctokit(token)
@@ -19,39 +20,36 @@ async function run(action, owner, repo, pull_number, dry) {
     })).data
   }
 
-  const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
-  try {
-    process.env.GITHUB_WORKSPACE = tmp
-    process.chdir(tmp)
+  process.env['INPUT_GITHUB-TOKEN'] = token
 
-    await action({
-      github,
-      context: {
-        payload,
-        repo: {
-          owner,
-          repo,
-        },
+  closeSync(openSync('step-summary.md', 'w'))
+  process.env.GITHUB_STEP_SUMMARY = 'step-summary.md'
+
+  await action({
+    github,
+    context: {
+      payload,
+      repo: {
+        owner,
+        repo,
       },
-      core: {
-        getInput() {
-          return token
-        },
-        error: console.error,
-        info: console.log,
-        notice: console.log,
-        setFailed(msg) {
-          console.error(msg)
-          process.exitCode = 1
-        },
-      },
-      dry,
-    })
-  } finally {
-    rmSync(tmp, { recursive: true })
-  }
+    },
+    core,
+    dry,
+  })
 }
 
+program
+  .command('commits')
+  .description('Check commit structure of a pull request.')
+  .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')
+  .argument('<pr>', 'Number of the Pull Request to check')
+  .action(async (owner, repo, pr) => {
+    const commits = (await import('./commits.js')).default
+    run(commits, owner, repo, pr)
+  })
+
 program
   .command('labels')
   .description('Manage labels on pull requests.')
@@ -61,7 +59,14 @@ program
   .option('--no-dry', 'Make actual modifications')
   .action(async (owner, repo, pr, options) => {
     const labels = (await import('./labels.js')).default
-    run(labels, owner, repo, pr, options.dry)
+    const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
+    try {
+      process.env.GITHUB_WORKSPACE = tmp
+      process.chdir(tmp)
+      run(labels, owner, repo, pr, options.dry)
+    } finally {
+      rmSync(tmp, { recursive: true })
+    }
   })
 
 await program.parse()
diff --git a/ci/github-script/withRateLimit.js b/ci/github-script/withRateLimit.js
index 03fbd54291a8..ff97c7173fcf 100644
--- a/ci/github-script/withRateLimit.js
+++ b/ci/github-script/withRateLimit.js
@@ -20,6 +20,8 @@ module.exports = async function ({ github, core }, callback) {
   // Pause between mutative requests
   const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
   github.hook.wrap('request', async (request, options) => {
+    // Requests to a different host do not count against the rate limit.
+    if (options.url.startsWith('https://github.com')) return request(options)
     // Requests to the /rate_limit endpoint do not count against the rate limit.
     if (options.url == '/rate_limit') return request(options)
     // Search requests are in a different resource group, which allows 30 requests / minute.
diff --git a/nixos/modules/services/web-servers/minio.nix b/nixos/modules/services/web-servers/minio.nix
index 1f1a595f8700..ec31d06a3924 100644
--- a/nixos/modules/services/web-servers/minio.nix
+++ b/nixos/modules/services/web-servers/minio.nix
@@ -135,6 +135,44 @@ in
                 (legacyCredentials cfg)
               else
                 null;
+
+            # hardening
+            DevicePolicy = "closed";
+            CapabilityBoundingSet = "";
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_NETLINK"
+              "AF_UNIX"
+            ];
+            DeviceAllow = "";
+            NoNewPrivileges = true;
+            PrivateDevices = true;
+            PrivateMounts = true;
+            PrivateTmp = true;
+            PrivateUsers = true;
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            MemoryDenyWriteExecute = true;
+            LockPersonality = true;
+            RemoveIPC = true;
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged"
+            ];
+            ProtectProc = "invisible";
+            ProtectHostname = true;
+            UMask = "0077";
+            # minio opens /proc/mounts on startup
+            ProcSubset = "all";
           };
           environment = {
             MINIO_REGION = "${cfg.region}";
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index cd4f404a58ee..3eaed22f3d35 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -171,6 +171,14 @@ let
           quic_bpf on;
         ''}
 
+        ${optionalString cfg.experimentalZstdSettings ''
+          zstd on;
+          zstd_comp_level 9;
+          zstd_min_length 256;
+          zstd_static on;
+          zstd_types ${lib.concatStringsSep " " compressMimeTypes};
+        ''}
+
         ${cfg.config}
 
         ${optionalString (cfg.eventsConfig != "" || cfg.config == "") ''
@@ -630,11 +638,11 @@ in
         '';
       };
 
-      recommendedZstdSettings = mkOption {
+      experimentalZstdSettings = mkOption {
         default = false;
         type = types.bool;
         description = ''
-          Enable recommended zstd settings.
+          Enable alpha quality zstd module with recommended settings.
           Learn more about compression in Zstd format [here](https://github.com/tokers/zstd-nginx-module).
 
           This adds `pkgs.nginxModules.zstd` to `services.nginx.additionalModules`.
@@ -1305,6 +1313,12 @@ in
       [ "services" "nginx" "proxyCache" "enable" ]
       [ "services" "nginx" "proxyCachePath" "" "enable" ]
     )
+    (mkRemovedOptionModule [ "services" "nginx" "recommendedZstdSettings" ] ''
+      The zstd module for Nginx has known bugs and is not maintained well. It is thus not
+      generally recommend to use it. You may enable anyway by setting
+      `services.nginx.experimentalZstdSettings` which adds the same configuration as the
+      removed option.
+    '')
   ];
 
   config = mkIf cfg.enable {
@@ -1453,7 +1467,7 @@ in
 
     services.nginx.additionalModules =
       optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli
-      ++ lib.optional cfg.recommendedZstdSettings pkgs.nginxModules.zstd;
+      ++ lib.optional cfg.experimentalZstdSettings pkgs.nginxModules.zstd;
 
     services.nginx.virtualHosts.localhost = mkIf cfg.statusPage {
       serverAliases = [ "127.0.0.1" ] ++ lib.optional config.networking.enableIPv6 "[::1]";
diff --git a/pkgs/applications/audio/spek/autoconf.patch b/pkgs/applications/audio/spek/autoconf.patch
new file mode 100644
index 000000000000..e566f465044d
--- /dev/null
+++ b/pkgs/applications/audio/spek/autoconf.patch
@@ -0,0 +1,12 @@
+diff --git a/configure.ac b/configure.ac
+index 5a80c6b..07c37bf 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -3,6 +3,7 @@ AC_CONFIG_SRCDIR([src/spek.cc])
+ AC_CONFIG_HEADERS([config.h])
+ AM_INIT_AUTOMAKE([1.11.1 foreign no-dist-gzip dist-xz serial-tests])
+ AM_SILENT_RULES([yes])
++AC_CONFIG_MACRO_DIRS([m4])
+ 
+ AC_LANG([C++])
+ AM_PROG_AR
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index ad1c2ff5b7e2..721afb7766d4 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VYt2so2k3Rk3sLSV1Tf1G2pESYiXygrKr9Koop8ChCg=";
   };
 
+  patches = [
+    ./autoconf.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     intltool
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 98806af52a85..37d213f6d611 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1789,6 +1789,8 @@ let
         };
       };
 
+      ethersync.ethersync = callPackage ./ethersync.ethersync { };
+
       eugleo.magic-racket = callPackage ./eugleo.magic-racket { };
 
       ExiaHuang.dictionary = buildVscodeMarketplaceExtension {
diff --git a/pkgs/applications/editors/vscode/extensions/ethersync.ethersync/default.nix b/pkgs/applications/editors/vscode/extensions/ethersync.ethersync/default.nix
new file mode 100644
index 000000000000..1eae53b8a780
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ethersync.ethersync/default.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ethersync";
+    name = "ethersync";
+    version = "0.2.1";
+    hash = "sha256-/oRpoYMWSpkAEM89KlJnSJ7TWwcGloYHXh80Ml+vz+M=";
+  };
+
+  meta = {
+    description = "Extension for real-time co-editing of local text files";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ethersync.ethersync";
+    homepage = "https://github.com/ethersync/ethersync/tree/main/vscode-plugin";
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/by-name/am/amp-cli/package-lock.json b/pkgs/by-name/am/amp-cli/package-lock.json
index 172af7d3f9a7..d4a5e1b037d5 100644
--- a/pkgs/by-name/am/amp-cli/package-lock.json
+++ b/pkgs/by-name/am/amp-cli/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1750924878-gfee7d7"
+        "@sourcegraph/amp": "^0.0.1752566512-ga67426"
       }
     },
     "node_modules/@colors/colors": {
@@ -29,9 +29,9 @@
       }
     },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1750924878-gfee7d7",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1750924878-gfee7d7.tgz",
-      "integrity": "sha512-3TZRSPaQY1eSIyAy4m/wSmW8CUq33r1oZfxguq2IWBLYdud90vPoLgOf6Hl9ZX3bkiLVRiU34oXXMmhb2Z5nzA==",
+      "version": "0.0.1752566512-ga67426",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1752566512-ga67426.tgz",
+      "integrity": "sha512-nz+iPJwZs0ONCnh/pCX2sfm47nCCegl9OLMUx2Z3ZW604ZTQ8w0IeiBs1Gzjlt8EnXlBR8tWY6f5ff+DT8UihA==",
       "dependencies": {
         "@vscode/ripgrep": "1.15.11",
         "commander": "^11.1.0",
@@ -43,7 +43,7 @@
         "xdg-basedir": "^5.1.0"
       },
       "bin": {
-        "amp": "dist/amp.js"
+        "amp": "dist/main.js"
       },
       "engines": {
         "node": ">=18"
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index b996cab50b1e..2cd9ba71ddf7 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1750924878-gfee7d7";
+  version = "0.0.1752566512-ga67426";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-scp4Nw6fwn8uB5oLPg6eWkT7+YGFV/B5VlQbbFimsLg=";
+    hash = "sha256-TgSqpczEFIW6doWzgfPg2y+o+64ntPMbTJ0FVzCGNOg=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-INH8Pulds05pZm6DeaFYfZR+1derav2ZjQC6aPx+8qA=";
+  npmDepsHash = "sha256-avgj8q1pyepWSt4RFK1+9Fqwtc7Z1Voz2RUYKuViZA0=";
 
   propagatedBuildInputs = [
     ripgrep
diff --git a/pkgs/by-name/au/audacious-bare/package.nix b/pkgs/by-name/au/audacious-bare/package.nix
index 543f213b3826..8397e3797c4a 100644
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.4.2";
+  version = "4.5";
 
   src = fetchFromGitHub {
     owner = "audacious-media-player";
     repo = "audacious";
     rev = "${pname}-${version}";
-    hash = "sha256-Vh39uY15Pj2TbPk8gU55YykhFf5ytSUxN2gJ0VlC3tQ=";
+    hash = "sha256-oYssIeVAvz2nx/3GRxgmsUjp2mnEFMem0WNPJG9l14E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index d90bf8cd73fe..c23611227e4e 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.14.3";
+  version = "1.15.0";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-Qsf58SQANBic3LHY52vzCHO9W74cdP0EWtHB2uL45R0=";
+    hash = "sha256-TtYKOCnMuStoPSQfwXfLFli+qv2NVgiXJPCYylCgs6A=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/go/gowebly/package.nix b/pkgs/by-name/go/gowebly/package.nix
index df52ccb128e6..9dca725798f0 100644
--- a/pkgs/by-name/go/gowebly/package.nix
+++ b/pkgs/by-name/go/gowebly/package.nix
@@ -8,16 +8,16 @@
 
 buildGo124Module rec {
   pname = "gowebly";
-  version = "3.0.4";
+  version = "3.0.5";
 
   src = fetchFromGitHub {
     owner = "gowebly";
     repo = "gowebly";
     tag = "v${version}";
-    hash = "sha256-oz/O5scGJigWjrmA2wnagDbf+epvwuyRI2CaSQY8K5I=";
+    hash = "sha256-r1yyMbnpt0sDgqkm/EqaYysQnm48uIXzQHqJObVpT9g=";
   };
 
-  vendorHash = "sha256-BDdH6cFicbjT2WOldNRc8NcFKrIaeqy+mw113PRnwa8=";
+  vendorHash = "sha256-N48/67fMPsylNGr6ixay4si+9ifUryxkIJxKDYU46+o=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/md/mdbtools/package.nix b/pkgs/by-name/md/mdbtools/package.nix
index 381245fef2c7..9a581078b72a 100644
--- a/pkgs/by-name/md/mdbtools/package.nix
+++ b/pkgs/by-name/md/mdbtools/package.nix
@@ -10,17 +10,20 @@
   autoreconfHook,
   txt2man,
   which,
+  gettext,
+  nix-update-script,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mdbtools";
   version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "mdbtools";
     repo = "mdbtools";
-    rev = "v${version}";
-    sha256 = "sha256-XWkFgQZKx9/pjVNEqfp9BwgR7w3fVxQ/bkJEYUvCXPs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XWkFgQZKx9/pjVNEqfp9BwgR7w3fVxQ/bkJEYUvCXPs=";
   };
 
   configureFlags = [ "--disable-scrollkeeper" ];
@@ -41,16 +44,27 @@ stdenv.mkDerivation rec {
     readline
   ];
 
+  postUnpack = ''
+    cp -v ${gettext}/share/gettext/m4/lib-{link,prefix,ld}.m4 source/m4
+  '';
+
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/mdb-ver";
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/mdbtools/mdbtools/releases/tag/v${finalAttrs.version}";
     description = ".mdb (MS Access) format tools";
-    license = with licenses; [
+    homepage = "https://mdbtools.github.io/";
+    license = with lib.licenses; [
       gpl2Plus
       lgpl2
     ];
-    maintainers = [ ];
-    platforms = platforms.unix;
-    inherit (src.meta) homepage;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/op/openstack-rs/package.nix b/pkgs/by-name/op/openstack-rs/package.nix
index 9a8fbbe612f5..840f99191b8d 100644
--- a/pkgs/by-name/op/openstack-rs/package.nix
+++ b/pkgs/by-name/op/openstack-rs/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "openstack-rs";
-  version = "0.12.3";
+  version = "0.12.4";
   src = fetchFromGitHub {
     owner = "gtema";
     repo = "openstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bl6Gxoqy9DJf3fwozLSQheL24hHqRCt4Kwb0mvhGhSs=";
+    hash = "sha256-UEnvKqnAY7QHeeEayTk5aBBxHcOrAr7LisvaOiRhRMQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-miwBqy4CPvFgfwlEht3LUd6yrUkARfP5Ed4oWrFDg8U=";
+  cargoHash = "sha256-YytlhN1UtNnB5ZgCEVyBfiPTnhABjCaA87ejkHJsIOk=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/pd/pdfid/package.nix b/pkgs/by-name/pd/pdfid/package.nix
index 321f7ad9f076..18dfd9bfe582 100644
--- a/pkgs/by-name/pd/pdfid/package.nix
+++ b/pkgs/by-name/pd/pdfid/package.nix
@@ -8,12 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pdfid";
-  version = "0.2.8";
+  version = "0.2.10";
   format = "other";
 
   src = fetchzip {
-    url = "https://didierstevens.com/files/software/pdfid_v0_2_8.zip";
-    hash = "sha256-ZLyhBMF2KMX0c1oCvuSCjEjHTnm2gFhJtasaTD9Q1BI=";
+    url = "https://didierstevens.com/files/software/pdfid_v${
+      builtins.replaceStrings [ "." ] [ "_" ] version
+    }.zip";
+    hash = "sha256-GxQOwIwCVaKEruFO+kxXciOiFcXtBO0vvCwb6683lGU=";
     stripRoot = false;
   };
 
@@ -25,7 +27,8 @@ python3Packages.buildPythonApplication rec {
     runHook preInstall
     mkdir -p $out/{bin,share/pdfid}
     cp -a * $out/share/pdfid/
-    makeBinaryWrapper ${lib.getExe python3} $out/bin/${meta.mainProgram} \
+    makeWrapper ${lib.getExe python3} $out/bin/pdfid \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
       --add-flags "$out/share/pdfid/pdfid.py"
     runHook postInstall
   '';
diff --git a/pkgs/by-name/pd/pds/package.nix b/pkgs/by-name/pd/pds/package.nix
index efc4fdf95d0f..ece0d582c89f 100644
--- a/pkgs/by-name/pd/pds/package.nix
+++ b/pkgs/by-name/pd/pds/package.nix
@@ -20,13 +20,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.107";
+  version = "0.4.158";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cS9BVR14CAqT1dMw8afd3jVygG1h9bdF0QZ7mBVlIe8=";
+    hash = "sha256-TesrTKAP2wIQ+H6srvVbS6GF/7Be2xJa1dn/krScPOs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       ;
     fetcherVersion = 1;
-    hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
+    hash = "sha256-+ESVGrgXNCQWOhqH4PM5lKQKcxE/5zxRmIboDZxgxcc=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/pl/plantuml/package.nix b/pkgs/by-name/pl/plantuml/package.nix
index 8c5d89cce5d4..ce4d2eb35de7 100644
--- a/pkgs/by-name/pl/plantuml/package.nix
+++ b/pkgs/by-name/pl/plantuml/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plantuml";
-  version = "1.2025.3";
+  version = "1.2025.4";
 
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml/releases/download/v${finalAttrs.version}/plantuml-pdf-${finalAttrs.version}.jar";
-    hash = "sha256-o8bBO9Crcrf2XLuLbakSiUp4WcIanJJTRwlDr4ydL0I=";
+    hash = "sha256-86qUpDvGLbD3Epr7Iis/vijggqFKpIW5X1zBpP4/lJ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zo/zoneminder/package.nix b/pkgs/by-name/zo/zoneminder/package.nix
index f58c5e7de804..345984657772 100644
--- a/pkgs/by-name/zo/zoneminder/package.nix
+++ b/pkgs/by-name/zo/zoneminder/package.nix
@@ -246,6 +246,6 @@ stdenv.mkDerivation rec {
     homepage = "https://zoneminder.com";
     license = licenses.gpl3;
     maintainers = [ ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/scx/scx_cscheds.nix b/pkgs/os-specific/linux/scx/scx_cscheds.nix
index 6d97e12447fa..e024239ccb50 100644
--- a/pkgs/os-specific/linux/scx/scx_cscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_cscheds.nix
@@ -67,6 +67,10 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     cp ${finalAttrs.fetchLibbpf} meson-scripts/fetch_libbpf
     substituteInPlace meson.build \
       --replace-fail '[build_bpftool' "['${misbehaviorBash}', build_bpftool"
+
+    # TODO: Remove in next release.
+    substituteInPlace lib/scxtest/overrides.h \
+      --replace-fail '#define __builtin_preserve_enum_value(x,y,z) 1' '#define __builtin_preserve_enum_value(x,y) 1'
   '';
 
   nativeBuildInputs =
@@ -114,10 +118,9 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
 
   # We copy the compiled header files to the dev output
   # These are needed for the rust schedulers
-  preInstall = ''
-    mkdir -p ${placeholder "dev"}/libbpf ${placeholder "dev"}/bpftool
-    cp -r libbpf/* ${placeholder "dev"}/libbpf/
-    cp -r bpftool/* ${placeholder "dev"}/bpftool/
+  postFixup = ''
+    mkdir -p ${placeholder "dev"}
+    cp -r libbpf ${placeholder "dev"}
   '';
 
   outputs = [
diff --git a/pkgs/os-specific/linux/scx/scx_rustscheds.nix b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
index ed58e7bc7726..5678a8a788ba 100644
--- a/pkgs/os-specific/linux/scx/scx_rustscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
@@ -20,8 +20,7 @@ rustPlatform.buildRustPackage {
 
   # Copy compiled headers and libs from scx.cscheds
   postPatch = ''
-    mkdir bpftool libbpf
-    cp -r ${scx.cscheds.dev}/bpftool/* bpftool/
+    mkdir libbpf
     cp -r ${scx.cscheds.dev}/libbpf/* libbpf/
   '';
 
diff --git a/pkgs/os-specific/linux/scx/version.json b/pkgs/os-specific/linux/scx/version.json
index f517f6679ee3..822e674361ed 100644
--- a/pkgs/os-specific/linux/scx/version.json
+++ b/pkgs/os-specific/linux/scx/version.json
@@ -1,8 +1,8 @@
 {
   "scx": {
-    "version": "1.0.13",
-    "hash": "sha256-uSYkAsDZEWJ7sB6jd7PZrwYepeLlTdiTi4kAgSDeVsU=",
-    "cargoHash": "sha256-+JDe7l4wX2balOUD11M9z60JSaRyMaIO7Pw1NrjnE30="
+    "version": "1.0.14",
+    "hash": "sha256-Wh+8vaQO93Erj+z8S2C633UDmUrFjQc3Bg+Nm7EML0E=",
+    "cargoHash": "sha256-6uiDx2/5ZcYkz8x8vuOTEUclIttzxVMvh1Q6QHg9N6E="
   },
   "bpftool": {
     "rev": "183e7010387d1fc9f08051426e9a9fbd5f8d409e",
diff --git a/pkgs/servers/monitoring/zabbix/agent.nix b/pkgs/servers/monitoring/zabbix/agent.nix
index ae6e5618167d..aeae46821891 100644
--- a/pkgs/servers/monitoring/zabbix/agent.nix
+++ b/pkgs/servers/monitoring/zabbix/agent.nix
@@ -6,6 +6,7 @@
   libiconv,
   openssl,
   pcre,
+  pcre2,
 }:
 
 import ./versions.nix (
@@ -23,7 +24,7 @@ import ./versions.nix (
     buildInputs = [
       libiconv
       openssl
-      pcre
+      (if (lib.versions.major version >= "7" && lib.versions.minor version >= "4") then pcre2 else pcre)
     ];
 
     configureFlags = [
diff --git a/pkgs/servers/monitoring/zabbix/agent2.nix b/pkgs/servers/monitoring/zabbix/agent2.nix
index e4e009cc64a7..1bd5bae89d3a 100644
--- a/pkgs/servers/monitoring/zabbix/agent2.nix
+++ b/pkgs/servers/monitoring/zabbix/agent2.nix
@@ -7,6 +7,7 @@
   libiconv,
   openssl,
   pcre,
+  pcre2,
   zlib,
 }:
 
@@ -36,7 +37,7 @@ import ./versions.nix (
     buildInputs = [
       libiconv
       openssl
-      pcre
+      (if (lib.versions.major version >= "7" && lib.versions.minor version >= "4") then pcre2 else pcre)
       zlib
     ];
 
diff --git a/pkgs/servers/monitoring/zabbix/proxy.nix b/pkgs/servers/monitoring/zabbix/proxy.nix
index 65cc2c024e1a..cd66c2997046 100644
--- a/pkgs/servers/monitoring/zabbix/proxy.nix
+++ b/pkgs/servers/monitoring/zabbix/proxy.nix
@@ -8,6 +8,7 @@
   libiconv,
   openssl,
   pcre,
+  pcre2,
   zlib,
   buildPackages,
   odbcSupport ? true,
@@ -61,7 +62,7 @@ import ./versions.nix (
         libevent
         libiconv
         openssl
-        pcre
+        (if (lib.versions.major version >= "7" && lib.versions.minor version >= "4") then pcre2 else pcre)
         zlib
       ]
       ++ optional odbcSupport unixODBC
diff --git a/pkgs/servers/monitoring/zabbix/server.nix b/pkgs/servers/monitoring/zabbix/server.nix
index 54968b0bd4ff..a45d0a52eda9 100644
--- a/pkgs/servers/monitoring/zabbix/server.nix
+++ b/pkgs/servers/monitoring/zabbix/server.nix
@@ -10,6 +10,7 @@
   libxml2,
   openssl,
   pcre,
+  pcre2,
   zlib,
   jabberSupport ? true,
   iksemel,
@@ -58,7 +59,7 @@ import ./versions.nix (
         libiconv
         libxml2
         openssl
-        pcre
+        (if (lib.versions.major version >= "7" && lib.versions.minor version >= "4") then pcre2 else pcre)
         zlib
       ]
       ++ optional odbcSupport unixODBC
diff --git a/pkgs/servers/sql/postgresql/ext/hypopg.nix b/pkgs/servers/sql/postgresql/ext/hypopg.nix
index 4389862a5403..0f89f16833dc 100644
--- a/pkgs/servers/sql/postgresql/ext/hypopg.nix
+++ b/pkgs/servers/sql/postgresql/ext/hypopg.nix
@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "hypopg";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "HypoPG";
     repo = "hypopg";
     tag = finalAttrs.version;
-    hash = "sha256-88uKPSnITRZ2VkelI56jZ9GWazG/Rn39QlyHKJKSKMM=";
+    hash = "sha256-J1ltvNHB2v2I9IbYjM8w2mhXvBX31NkMasCL0O7bV8w=";
   };
 
   passthru = {
@@ -26,6 +26,7 @@ postgresqlBuildExtension (finalAttrs: {
   meta = {
     description = "Hypothetical Indexes for PostgreSQL";
     homepage = "https://hypopg.readthedocs.io";
+    changelog = "https://github.com/HypoPG/hypopg/releases/tag/${finalAttrs.version}";
     license = lib.licenses.postgresql;
     platforms = postgresql.meta.platforms;
     maintainers = with lib.maintainers; [ bbigras ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b9b1e511533c..863764b87add 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13797,9 +13797,7 @@ with pkgs;
 
   sonic-visualiser = libsForQt5.callPackage ../applications/audio/sonic-visualiser { };
 
-  spek = callPackage ../applications/audio/spek {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  spek = callPackage ../applications/audio/spek { };
 
   squeezelite-pulse = callPackage ../by-name/sq/squeezelite/package.nix {
     audioBackend = "pulse";