diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
index b10c787728a0..7c49b40e53d4 100644
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@@ -152,11 +152,6 @@ rec {
       DTB = true;
       autoModules = true;
       preferBuiltin = true;
-      extraConfig = ''
-        # The default (=y) forces us to have the XHCI firmware available in initrd,
-        # which our initrd builder can't currently do easily.
-        USB_XHCI_TEGRA m
-      '';
       target = "Image";
     };
     gcc = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0f62dca72cf4..802dabdd269c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -813,6 +813,13 @@
     githubId = 19290901;
     name = "Andrew Brooks";
   };
+  agentelement = {
+    email = "agentelement@agentelement.net";
+    github = "agentelement";
+    githubId = 38045210;
+    name = "AgentElement";
+    keys = [ { fingerprint = "D37E 581D AD71 2378 A622  5BC0 CD13 9E3B 4354 34F1"; } ];
+  };
   agilesteel = {
     email = "agilesteel@gmail.com";
     github = "agilesteel";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 51583b8e2b6f..5a7ff4b27883 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -12,6 +12,7 @@ cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
 compat53,,,,,,vcunat
+coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@@ -53,8 +54,8 @@ lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
 lsqlite3,,,,,,
-ltreesitter-ts,,,,,,
 ltreesitter,,,,,,
+ltreesitter-ts,,,,,,
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
@@ -174,8 +175,8 @@ tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
 tree-sitter-norg-meta,,,,,,
 tree-sitter-orgmode,,,,,5.1,
-utf8,,,,,,
 tree-sitter-teal,,,,,,
+utf8,,,,,,
 vicious,,,,,,
 vstruct,,,,,,
 vusted,,,,,,
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index a83956a26d17..16d4dce4be25 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -24,6 +24,8 @@
 
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
+- `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
+
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix
index f740dd3cbdf6..7a4c7e31a0e1 100644
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@@ -14,7 +14,7 @@ let
 
   inherit (config) sshBackdoor;
 
-  inherit (hostPkgs.stdenv.hostPlatform) isLinux;
+  inherit (hostPkgs.stdenv.hostPlatform) isLinux isAarch64;
 
   # Reifies and correctly wraps the python test driver for
   # the respective qemu version and with or without ocr support
@@ -256,6 +256,10 @@ in
         #
         # If needed, this can still be turned off.
         virtualisation.qemu.enableSharedMemory = lib.mkDefault isLinux;
+        # Needed for screenshots to work (in e.g `nixosTests.login`)
+        virtualisation.qemu.options = lib.optionals (isLinux && isAarch64) [
+          "-device virtio-gpu-pci"
+        ];
 
         assertions = [
           {
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 8291f55f37cb..c92872d26775 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -950,32 +950,8 @@ in
         };
       };
 
-      # Warn about user accounts with deprecated password hashing schemes
-      # This does not work when the users and groups are created by
-      # systemd-sysusers because the users are created too late then.
-      system.activationScripts.hashes =
-        if !config.systemd.sysusers.enable && !config.services.userborn.enable then
-          {
-            deps = [ "users" ];
-            text = ''
-              users=()
-              while IFS=: read -r user hash _; do
-                if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
-                  users+=("$user")
-                fi
-              done </etc/shadow
-
-              if (( "''${#users[@]}" )); then
-                echo "
-              WARNING: The following user accounts rely on password hashing algorithms
-              that have been removed. They need to be renewed as soon as possible, as
-              they do prevent their users from logging in."
-                printf ' - %s\n' "''${users[@]}"
-              fi
-            '';
-          }
-        else
-          ""; # keep around for backwards compatibility
+      # for backwards compatibility
+      system.activationScripts.hashes = stringAfter [ "users" ] "";
 
       # for backwards compatibility
       system.activationScripts.groups = stringAfter [ "users" ] "";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9f1374926b11..822fedca09c5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -245,6 +245,7 @@
   ./programs/iio-hyprland.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
+  ./programs/jai-jail.nix
   ./programs/java.nix
   ./programs/joycond-cemuhook.nix
   ./programs/k3b.nix
diff --git a/nixos/modules/programs/jai-jail.nix b/nixos/modules/programs/jai-jail.nix
new file mode 100644
index 000000000000..aa493a9ccfcf
--- /dev/null
+++ b/nixos/modules/programs/jai-jail.nix
@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.jai-jail;
+
+in
+{
+  options.programs.jai-jail = {
+    enable = lib.mkEnableOption "jai, a sandbox for AI agents";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.jai-jail;
+      defaultText = lib.literalExpression "pkgs.jai-jail";
+      description = "The jai package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.jai = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package}/bin/jai";
+    };
+
+    users.users.jai = {
+      isSystemUser = true;
+      group = "jai";
+      home = "/";
+      description = "JAI sandbox untrusted user";
+    };
+
+    users.groups.jai = { };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ agentelement ];
+}
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 687128b81f4e..382c09cb0fa3 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -864,12 +864,19 @@ in
 
     networking.firewall.allowedTCPPorts = mkMerge [
       (mkIf cfg.openFirewall [ cfg.config.http.server_port ])
-      (mkIf cfg.openFirewallForComponents
+      (mkIf cfg.openFirewallForComponents (
+        # https://www.home-assistant.io/integrations/homekit/#firewall
+        optionals (useComponent "homekit") [ 21063 ]
         # https://www.home-assistant.io/integrations/sonos/#network-requirements
-        (optionals (useComponent "sonos") [ 1400 ])
-      )
+        ++ optionals (useComponent "sonos") [ 1400 ]
+      ))
     ];
 
+    networking.firewall.allowedUDPPorts = mkIf cfg.openFirewallForComponents (
+      # https://www.home-assistant.io/integrations/homekit/#firewall
+      optionals (useComponent "homekit") [ 5353 ]
+    );
+
     # symlink the configuration to /etc/home-assistant
     environment.etc = mkMerge [
       (mkIf (cfg.config != null && !cfg.configWritable) {
diff --git a/nixos/modules/services/mail/stalwart.nix b/nixos/modules/services/mail/stalwart.nix
index f64f334ee9d4..4e596ad3e572 100644
--- a/nixos/modules/services/mail/stalwart.nix
+++ b/nixos/modules/services/mail/stalwart.nix
@@ -304,7 +304,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
       norpol
     ];
diff --git a/nixos/modules/services/misc/inventree.nix b/nixos/modules/services/misc/inventree.nix
index 2c4b1df16621..70d386e96063 100644
--- a/nixos/modules/services/misc/inventree.nix
+++ b/nixos/modules/services/misc/inventree.nix
@@ -252,12 +252,13 @@ in
             in
             {
               "/" = {
+                # recommendedProxySettings sets the standard headers (Host, X-Forwarded-*), so
+                # don't also set them via proxy_set_header in extraConfig below. Nginx would then
+                # send Host twice and Django rejects it with DisallowedHost. Enabled per-location
+                # so it works even if the host's global recommendedProxySettings is off.
+                recommendedProxySettings = true;
                 extraConfig = ''
-                  proxy_set_header Host $host;
                   proxy_set_header X-Forwarded-By $server_addr:$server_port;
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                  proxy_set_header X-Forwarded-Proto $scheme;
-                  proxy_set_header X-Real-IP $remote_addr;
                   proxy_set_header CLIENT_IP $remote_addr;
 
                   proxy_pass_request_headers on;
@@ -272,6 +273,8 @@ in
                 proxyPass = "http://unix:${unixPath}";
               };
               "/auth" = {
+                # same reasoning as "/"; this subrequest also reaches Django
+                recommendedProxySettings = true;
                 extraConfig = ''
                   internal;
                   proxy_pass_request_body off;
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 7227ac4277e7..75b4143d6810 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -40,6 +40,7 @@ let
     "network-online.target"
     "nss-lookup.target"
     "nss-user-lookup.target"
+    "time-set.target"
     "time-sync.target"
     "first-boot-complete.target"
   ]
@@ -808,7 +809,7 @@ in
     systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
     systemd.services.systemd-importd = lib.mkIf cfg.package.withImportd {
       environment = proxy_env;
-      path = [ pkgs.gnupg ];
+      path = [ pkgs.gnupgMinimal ];
     };
     systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138
 
diff --git a/nixos/modules/system/boot/systemd/logind.nix b/nixos/modules/system/boot/systemd/logind.nix
index f81baae8813e..bdf4ab4d4873 100644
--- a/nixos/modules/system/boot/systemd/logind.nix
+++ b/nixos/modules/system/boot/systemd/logind.nix
@@ -64,13 +64,13 @@
     environment.etc."systemd/logind.conf".text =
       utils.systemdUtils.lib.settingsToSections config.services.logind.settings;
 
-    # Restarting systemd-logind breaks X11
+    # Restarting systemd-logind breaks X11 and other user sessions.
+    # However, reloading the service seems to do the trick of loading new configuration without breaking anything.
     # - upstream commit: https://cgit.freedesktop.org/xorg/xserver/commit/?id=dc48bd653c7e101
     # - systemd announcement: https://github.com/systemd/systemd/blob/22043e4317ecd2bc7834b48a6d364de76bb26d91/NEWS#L103-L112
     # - this might be addressed in the future by xorg
     #systemd.services.systemd-logind.restartTriggers = [ config.environment.etc."systemd/logind.conf".source ];
-    systemd.services.systemd-logind.restartIfChanged = false;
-    systemd.services.systemd-logind.stopIfChanged = false;
+    systemd.services.systemd-logind.reloadIfChanged = true;
 
     # The user-runtime-dir@ service is managed by systemd-logind we should not touch it or else we break the users' sessions.
     systemd.services."user-runtime-dir@".stopIfChanged = false;
diff --git a/nixos/modules/system/boot/systemd/sysupdate.nix b/nixos/modules/system/boot/systemd/sysupdate.nix
index 3fa8dc212ea2..91a165d7d5ab 100644
--- a/nixos/modules/system/boot/systemd/sysupdate.nix
+++ b/nixos/modules/system/boot/systemd/sysupdate.nix
@@ -138,7 +138,7 @@ in
 
     systemd.services.systemd-sysupdated = {
       aliases = [ "dbus-org.freedesktop.sysupdate1.service" ];
-      path = [ pkgs.gnupg ];
+      path = [ pkgs.gnupgMinimal ];
     };
 
     systemd.timers = {
diff --git a/nixos/modules/system/boot/systemd/user.nix b/nixos/modules/system/boot/systemd/user.nix
index 5161a5a2c2ff..6a5b2657446b 100644
--- a/nixos/modules/system/boot/systemd/user.nix
+++ b/nixos/modules/system/boot/systemd/user.nix
@@ -5,16 +5,13 @@
   utils,
   ...
 }:
-with utils;
-with systemdUtils.unitOptions;
-with lib;
 
 let
   cfg = config.systemd.user;
 
   systemd = config.systemd.package;
 
-  inherit (systemdUtils.lib)
+  inherit (utils.systemdUtils.lib)
     generateUnits
     targetToUnit
     serviceToUnit
@@ -53,7 +50,7 @@ let
       user ? null,
     }:
     let
-      suffix = optionalString (user != null) "-${user}";
+      suffix = lib.optionalString (user != null) "-${user}";
     in
     pkgs.writeTextFile {
       name = "nixos-user-tmpfiles.d${suffix}";
@@ -61,74 +58,86 @@ let
       text = ''
         # This file is created automatically and should not be modified.
         # Please change the options ‘systemd.user.tmpfiles’ instead.
-        ${concatStringsSep "\n" rules}
+        ${lib.concatStringsSep "\n" rules}
       '';
     };
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "systemd"
+      "user"
+      "extraConfig"
+    ] "Use systemd.user.settings.Manager instead.")
+  ];
+
   options = {
-    systemd.user.extraConfig = mkOption {
-      default = "";
-      type = types.lines;
-      example = "DefaultTimeoutStartSec=60";
+    systemd.user.settings.Manager = lib.mkOption {
+      default = { };
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+      };
+      example = {
+        DefaultTimeoutStartSec = 60;
+      };
       description = ''
-        Extra config options for systemd user instances. See {manpage}`systemd-user.conf(5)` for
-        available options.
+        Settings for systemd user instances. See {manpage}`systemd-user.conf(5)`
+        for available options.
       '';
     };
 
-    systemd.user.units = mkOption {
+    systemd.user.units = lib.mkOption {
       description = "Definition of systemd per-user units.";
       default = { };
-      type = systemdUtils.types.units;
+      type = utils.systemdUtils.types.units;
     };
 
-    systemd.user.paths = mkOption {
+    systemd.user.paths = lib.mkOption {
       default = { };
-      type = systemdUtils.types.paths;
+      type = utils.systemdUtils.types.paths;
       description = "Definition of systemd per-user path units.";
     };
 
-    systemd.user.services = mkOption {
+    systemd.user.services = lib.mkOption {
       default = { };
-      type = systemdUtils.types.services;
+      type = utils.systemdUtils.types.services;
       description = "Definition of systemd per-user service units.";
     };
 
-    systemd.user.slices = mkOption {
+    systemd.user.slices = lib.mkOption {
       default = { };
-      type = systemdUtils.types.slices;
+      type = utils.systemdUtils.types.slices;
       description = "Definition of systemd per-user slice units.";
     };
 
-    systemd.user.sockets = mkOption {
+    systemd.user.sockets = lib.mkOption {
       default = { };
-      type = systemdUtils.types.sockets;
+      type = utils.systemdUtils.types.sockets;
       description = "Definition of systemd per-user socket units.";
     };
 
-    systemd.user.targets = mkOption {
+    systemd.user.targets = lib.mkOption {
       default = { };
-      type = systemdUtils.types.targets;
+      type = utils.systemdUtils.types.targets;
       description = "Definition of systemd per-user target units.";
     };
 
-    systemd.user.timers = mkOption {
+    systemd.user.timers = lib.mkOption {
       default = { };
-      type = systemdUtils.types.timers;
+      type = utils.systemdUtils.types.timers;
       description = "Definition of systemd per-user timer units.";
     };
 
     systemd.user.tmpfiles = {
       enable =
-        (mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
+        (lib.mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
         // {
           default = true;
           example = false;
         };
 
-      rules = mkOption {
-        type = types.listOf types.str;
+      rules = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "D %C - - - 7d" ];
         description = ''
@@ -139,17 +148,17 @@ in
         '';
       };
 
-      users = mkOption {
+      users = lib.mkOption {
         description = ''
           Per-user rules for creation, deletion and cleaning of volatile and
           temporary files automatically.
         '';
         default = { };
-        type = types.attrsOf (
-          types.submodule {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
             options = {
-              rules = mkOption {
-                type = types.listOf types.str;
+              rules = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
                 default = [ ];
                 example = [ "D %C - - - 7d" ];
                 description = ''
@@ -165,8 +174,8 @@ in
       };
     };
 
-    systemd.user.generators = mkOption {
-      type = types.attrsOf types.path;
+    systemd.user.generators = lib.mkOption {
+      type = lib.types.attrsOf lib.types.path;
       default = { };
       example = {
         systemd-gpt-auto-generator = "/dev/null";
@@ -179,9 +188,9 @@ in
       '';
     };
 
-    systemd.additionalUpstreamUserUnits = mkOption {
+    systemd.additionalUpstreamUserUnits = lib.mkOption {
       default = [ ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       example = [ ];
       description = ''
         Additional units shipped with systemd that should be enabled for per-user systemd instances.
@@ -203,29 +212,26 @@ in
         upstreamWants = [ ];
       };
 
-      "systemd/user.conf".text = ''
-        [Manager]
-        ${cfg.extraConfig}
-      '';
+      "systemd/user.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings;
     };
 
     systemd.user.units =
-      mapAttrs' (n: v: nameValuePair "${n}.path" (pathToUnit v)) cfg.paths
-      // mapAttrs' (n: v: nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
-      // mapAttrs' (n: v: nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices
-      // mapAttrs' (n: v: nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets
-      // mapAttrs' (n: v: nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
-      // mapAttrs' (n: v: nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
+      lib.mapAttrs' (n: v: lib.nameValuePair "${n}.path" (pathToUnit v)) cfg.paths
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.service" (serviceToUnit v)) cfg.services
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.slice" (sliceToUnit v)) cfg.slices
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.socket" (socketToUnit v)) cfg.sockets
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
+      // lib.mapAttrs' (n: v: lib.nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
 
     systemd.user.timers = {
       # enable systemd user tmpfiles
-      systemd-tmpfiles-clean.wantedBy = optional cfg.tmpfiles.enable "timers.target";
+      systemd-tmpfiles-clean.wantedBy = lib.optional cfg.tmpfiles.enable "timers.target";
     }
     # Generate timer units for all services that have a ‘startAt’ value.
-    // (mapAttrs (name: service: {
+    // (lib.mapAttrs (name: service: {
       wantedBy = [ "timers.target" ];
       timerConfig.OnCalendar = service.startAt;
-    }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services));
+    }) (lib.filterAttrs (name: service: service.startAt != [ ]) cfg.services));
 
     # Provide the systemd-user PAM service, required to run systemd
     # user instances.
@@ -244,18 +250,19 @@ in
     systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
 
     # enable systemd user tmpfiles
-    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional cfg.tmpfiles.enable "basic.target";
+    systemd.user.services.systemd-tmpfiles-setup.wantedBy =
+      lib.optional cfg.tmpfiles.enable "basic.target";
 
     # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can
     # write the tmpfiles.d rules for everyone there
-    environment.systemPackages = optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles {
+    environment.systemPackages = lib.optional (cfg.tmpfiles.rules != [ ]) (writeTmpfiles {
       inherit (cfg.tmpfiles) rules;
     });
 
     # /etc/profiles/per-user/$USER/etc/xdg is in systemd's $XDG_CONFIG_DIRS so
     # we can write a single user's tmpfiles.d rules there
-    users.users = mapAttrs (user: cfg': {
-      packages = optional (cfg'.rules != [ ]) (writeTmpfiles {
+    users.users = lib.mapAttrs (user: cfg': {
+      packages = lib.optional (cfg'.rules != [ ]) (writeTmpfiles {
         inherit (cfg') rules;
         inherit user;
       });
diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index d697a5197272..4d20b20090b4 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -238,11 +238,11 @@ in
     '';
 
     systemd.settings.Manager = managerSettings;
-    systemd.user.extraConfig = ''
+    systemd.user.settings.Manager = {
       # Allow very slow start
-      DefaultTimeoutStartSec=300
-      DefaultDeviceTimeoutSec=300
-    '';
+      DefaultTimeoutStartSec = 300;
+      DefaultDeviceTimeoutSec = 300;
+    };
 
     boot.consoleLogLevel = 7;
 
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index c6da8d9aaa6f..4fe5ed1e56c0 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -1379,7 +1379,6 @@ in
         "-device usb-tablet,bus=usb-bus.0"
       ])
       (mkIf pkgs.stdenv.hostPlatform.isAarch [
-        "-device virtio-gpu-pci"
         "-device usb-ehci,id=usb0"
         "-device usb-kbd"
         "-device usb-tablet"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index f3689cc70a59..ef2cc3b52649 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1674,6 +1674,7 @@ in
   systemd-timesyncd-nscd-dnssec = runTest ./systemd-timesyncd-nscd-dnssec.nix;
   systemd-user-linger = runTest ./systemd-user-linger.nix;
   systemd-user-linger-purge = runTest ./systemd-user-linger-purge.nix;
+  systemd-user-settings = runTest ./systemd-user-settings.nix;
   systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
   systemd-userdbd = runTest ./systemd-userdbd.nix;
   systemtap = handleTest ./systemtap.nix { };
diff --git a/nixos/tests/stalwart/stalwart.nix b/nixos/tests/stalwart/stalwart.nix
index 2fa61e0e74fe..dd47543eea90 100644
--- a/nixos/tests/stalwart/stalwart.nix
+++ b/nixos/tests/stalwart/stalwart.nix
@@ -79,7 +79,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
     ];
   };
diff --git a/nixos/tests/systemd-user-settings.nix b/nixos/tests/systemd-user-settings.nix
new file mode 100644
index 000000000000..8e70c07a8656
--- /dev/null
+++ b/nixos/tests/systemd-user-settings.nix
@@ -0,0 +1,24 @@
+{
+  name = "systemd-user-settings";
+  meta = {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      systemd.user.settings.Manager = {
+        DefaultTimeoutStartSec = lib.mkForce "60";
+        DefaultEnvironment = "FOO=bar";
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("settings.Manager renders user.conf"):
+      machine.succeed("grep -F '[Manager]' /etc/systemd/user.conf")
+      machine.succeed("grep -F 'DefaultTimeoutStartSec=60' /etc/systemd/user.conf")
+      machine.succeed("grep -F 'DefaultEnvironment=FOO=bar' /etc/systemd/user.conf")
+  '';
+}
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index d04b3a374570..8cca68465802 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -34,7 +34,7 @@
         RebootWatchdogSec = "10min";
         KExecWatchdogSec = "5min";
       };
-      systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\"";
+      systemd.user.settings.Manager.DefaultEnvironment = "\"XXX_USER=bar\"";
       services.journald.extraConfig = "Storage=volatile";
       test-support.displayManager.auto.user = "alice";
 
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index cf0bdf44e488..7178b8931ca5 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -408,6 +408,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature withSelinux "selinux")
   ];
 
+  __structuredAttrs = true;
+
   env =
     lib.optionalAttrs withNativeCompilation {
       NATIVE_FULL_AOT = "1";
diff --git a/pkgs/applications/editors/rednotebook/default.nix b/pkgs/applications/editors/rednotebook/default.nix
index 535adc0dc200..98a14bbca26d 100644
--- a/pkgs/applications/editors/rednotebook/default.nix
+++ b/pkgs/applications/editors/rednotebook/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   gdk-pixbuf,
   glib,
@@ -9,12 +9,9 @@
   gtksourceview,
   pango,
   webkitgtk_4_1,
-  pygobject3,
-  pyyaml,
-  setuptools,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "rednotebook";
   version = "2.42";
   pyproject = true;
@@ -31,7 +28,7 @@ buildPythonApplication (finalAttrs: {
 
   nativeBuildInputs = [ gobject-introspection ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
   propagatedBuildInputs = [
     gdk-pixbuf
@@ -40,9 +37,11 @@ buildPythonApplication (finalAttrs: {
     gtksourceview
     pango
     webkitgtk_4_1
+  ]
+  ++ (with python3Packages; [
     pygobject3
     pyyaml
-  ];
+  ]);
 
   makeWrapperArgs = [
     "--set GI_TYPELIB_PATH $GI_TYPELIB_PATH"
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index e300c0a3bf1b..0b749e2678af 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -4043,20 +4043,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  coop-nvim = buildVimPlugin {
-    pname = "coop.nvim";
-    version = "0-unstable-2026-04-20";
-    src = fetchFromGitHub {
-      owner = "gregorias";
-      repo = "coop.nvim";
-      rev = "b156e541316aee14be4ae64c93ed8bddb6d03bc1";
-      hash = "sha256-S6iGmdakI714Im0tetgfASbe0K4/olYsjj26+WP+rSU=";
-    };
-    meta.homepage = "https://github.com/gregorias/coop.nvim/";
-    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
-    meta.hydraPlatforms = [ ];
-  };
-
   copilot-cmp = buildVimPlugin {
     pname = "copilot-cmp";
     version = "0-unstable-2024-12-11";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 540a4fb4e206..8eec0b617b60 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -287,7 +287,6 @@ https://github.com/niklasdewally/conjure.nvim/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
 https://github.com/banjo/contextfiles.nvim/,,
-https://github.com/gregorias/coop.nvim/,,
 https://github.com/zbirenbaum/copilot-cmp/,,
 https://github.com/copilotlsp-nvim/copilot-lsp/,,
 https://github.com/AndreM222/copilot-lualine/,,
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index d3685fdf55f0..e72fec4cbe0b 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -113,6 +113,9 @@ buildVscode {
     '';
     homepage = "https://code.visualstudio.com/";
     downloadPage = "https://code.visualstudio.com/Updates";
+    changelog = "https://code.visualstudio.com/updates/v${
+      lib.replaceString "." "_" (lib.versions.majorMinor version)
+    }";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       eadwu
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 1eb119129897..af9fa5cc4eba 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -79,6 +79,7 @@ buildVscode rec {
     '';
     homepage = "https://github.com/VSCodium/vscodium";
     downloadPage = "https://github.com/VSCodium/vscodium/releases";
+    changelog = "https://github.com/VSCodium/vscodium/releases/tag/${version}";
     license = lib.licenses.mit;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [
diff --git a/pkgs/applications/emulators/libretro/cores/opera.nix b/pkgs/applications/emulators/libretro/cores/opera.nix
index ff06084247b9..35dd849c0993 100644
--- a/pkgs/applications/emulators/libretro/cores/opera.nix
+++ b/pkgs/applications/emulators/libretro/cores/opera.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-05-30";
+  version = "0-unstable-2026-06-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "d0a3b910f8bef6b8d48fb5eec4ad72ea5f022394";
-    hash = "sha256-OH9gkbMC4PJnpboiYrKV+XkQqq5ldq5tneyVJHfDzsM=";
+    rev = "5e36d4a9fbb2afbb8de2313b8e2bf83998ec2341";
+    hash = "sha256-TmSk0PIXOLToElUnyRkDFfpq3bvBh7+P8r8brYICJSY=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/misc/bitwarden-menu/default.nix b/pkgs/applications/misc/bitwarden-menu/default.nix
index ed5ef5cb7112..930ad053107b 100644
--- a/pkgs/applications/misc/bitwarden-menu/default.nix
+++ b/pkgs/applications/misc/bitwarden-menu/default.nix
@@ -1,14 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-  hatch-vcs,
-  hatchling,
-  pynput,
-  xdg-base-dirs,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bitwarden-menu";
   version = "0.4.5";
   pyproject = true;
@@ -19,12 +15,12 @@ buildPythonApplication (finalAttrs: {
     hash = "sha256-vUlNqSVdGhfN5WjDjf1ub32Y2WoBndIdFzfCNwo5+Vg=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     hatch-vcs
     hatchling
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pynput
     xdg-base-dirs
   ];
diff --git a/pkgs/applications/misc/bluetooth_battery/default.nix b/pkgs/applications/misc/bluetooth_battery/default.nix
index ae694f30f8f5..afae33d6616a 100644
--- a/pkgs/applications/misc/bluetooth_battery/default.nix
+++ b/pkgs/applications/misc/bluetooth_battery/default.nix
@@ -1,11 +1,10 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
-  buildPythonApplication,
-  pybluez,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bluetooth_battery";
   version = "1.3.1";
 
@@ -16,7 +15,7 @@ buildPythonApplication (finalAttrs: {
     sha256 = "067qfxh228cy1x95bnjp88dx4k00ajj7ay7fz5vr1gkj2yfa203s";
   };
 
-  propagatedBuildInputs = [ pybluez ];
+  propagatedBuildInputs = with python3Packages; [ pybluez ];
 
   pyproject = false;
 
diff --git a/pkgs/applications/misc/mu-repo/default.nix b/pkgs/applications/misc/mu-repo/default.nix
index 8948f9317f54..99f52a5901b3 100644
--- a/pkgs/applications/misc/mu-repo/default.nix
+++ b/pkgs/applications/misc/mu-repo/default.nix
@@ -1,14 +1,13 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  pytestCheckHook,
   git,
   testers,
   mu-repo,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "mu-repo";
   version = "1.9.0";
   format = "setuptools";
@@ -23,7 +22,7 @@ buildPythonApplication rec {
   dependencies = [ git ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    python3Packages.pytestCheckHook
     git
   ];
 
diff --git a/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
index c77cb1ca44f5..f446cac8c610 100644
--- a/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
+++ b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
@@ -1,16 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  libevdev,
-  paramiko,
-  pynput,
-  setuptools,
-  screeninfo,
-  tkinter,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "remarkable-mouse";
   version = "unstable-2024-02-23";
 
@@ -22,9 +16,9 @@ buildPythonApplication {
   };
 
   pyproject = true;
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     screeninfo
     paramiko
     pynput
diff --git a/pkgs/applications/misc/termpdf.py/default.nix b/pkgs/applications/misc/termpdf.py/default.nix
index b09cc763abec..e565a54542c9 100644
--- a/pkgs/applications/misc/termpdf.py/default.nix
+++ b/pkgs/applications/misc/termpdf.py/default.nix
@@ -1,19 +1,11 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   bibtool,
-  pybtex,
-  pymupdf,
-  pynvim,
-  pyperclip,
-  roman,
-  pdfrw,
-  pagelabels,
-  setuptools,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "termpdf.py";
   version = "2022-03-28";
   format = "setuptools";
@@ -27,6 +19,8 @@ buildPythonApplication {
 
   propagatedBuildInputs = [
     bibtool
+  ]
+  ++ (with python3Packages; [
     pybtex
     pymupdf
     pyperclip
@@ -35,7 +29,7 @@ buildPythonApplication {
     pdfrw
     pynvim
     setuptools
-  ];
+  ]);
 
   # upstream doesn't contain tests
   doCheck = false;
diff --git a/pkgs/applications/misc/yokadi/default.nix b/pkgs/applications/misc/yokadi/default.nix
index 2922ac095448..506143bce85d 100644
--- a/pkgs/applications/misc/yokadi/default.nix
+++ b/pkgs/applications/misc/yokadi/default.nix
@@ -1,15 +1,10 @@
 {
   lib,
+  python3Packages,
   fetchurl,
-  buildPythonApplication,
-  python-dateutil,
-  sqlalchemy,
-  setproctitle,
-  icalendar,
-  colorama,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "yokadi";
   version = "1.3.0";
   format = "setuptools";
@@ -19,7 +14,7 @@ buildPythonApplication rec {
     hash = "sha256-zF2ffHeU+i7wzu1u4DhQ5zJXr8AjXboiyFAisXNX6TM=";
   };
 
-  dependencies = [
+  dependencies = with python3Packages; [
     python-dateutil
     sqlalchemy
     setproctitle
diff --git a/pkgs/applications/networking/droopy/default.nix b/pkgs/applications/networking/droopy/default.nix
index a458b4a81af6..18057ff6997c 100644
--- a/pkgs/applications/networking/droopy/default.nix
+++ b/pkgs/applications/networking/droopy/default.nix
@@ -1,9 +1,9 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
-  wrapPython,
   fetchpatch,
+  python3Packages,
 }:
 
 stdenv.mkDerivation {
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  nativeBuildInputs = [ wrapPython ];
+  nativeBuildInputs = [ python3Packages.wrapPython ];
 
   installPhase = ''
     install -vD droopy $out/bin/droopy
@@ -43,5 +43,4 @@ stdenv.mkDerivation {
     maintainers = [ ];
     mainProgram = "droopy";
   };
-
 }
diff --git a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
index 8b435e3f3400..a31c193028cb 100644
--- a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
@@ -1,22 +1,11 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
-  buildPythonApplication,
   cacert,
-  setuptools,
-  matrix-nio,
-  python-magic,
-  markdown,
-  pillow,
-  aiofiles,
-  notify2,
-  dbus-python,
-  pyxdg,
-  python-olm,
-  emoji,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "matrix-commander";
   version = "8.0.5";
 
@@ -41,6 +30,8 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     cacert
+  ]
+  ++ (with python3Packages; [
     setuptools
     (matrix-nio.override { withOlm = true; })
     python-magic
@@ -52,7 +43,7 @@ buildPythonApplication rec {
     pyxdg
     python-olm
     emoji
-  ];
+  ]);
 
   meta = {
     description = "Simple but convenient CLI-based Matrix client app for sending and receiving";
diff --git a/pkgs/applications/science/robotics/mavproxy/default.nix b/pkgs/applications/science/robotics/mavproxy/default.nix
index d7f077670950..872628416793 100644
--- a/pkgs/applications/science/robotics/mavproxy/default.nix
+++ b/pkgs/applications/science/robotics/mavproxy/default.nix
@@ -1,24 +1,13 @@
 {
-  stdenv,
   lib,
-  billiard,
-  buildPythonApplication,
+  stdenv,
+  python3Packages,
   fetchFromGitHub,
   fetchpatch,
-  gnureadline,
-  lxml,
-  matplotlib,
-  numpy,
-  opencv-python,
-  pymavlink,
-  pynmeagps,
-  pyserial,
-  setuptools,
   versionCheckHook,
-  wxpython,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "MAVProxy";
   version = "1.8.74";
   pyproject = true;
@@ -38,23 +27,25 @@ buildPythonApplication rec {
     })
   ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
-    lxml
-    matplotlib
-    numpy
-    opencv-python
-    pymavlink
-    pynmeagps
-    pyserial
-    setuptools # Imports `pkg_resources` at runtime
-    wxpython
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    billiard
-    gnureadline
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      lxml
+      matplotlib
+      numpy
+      opencv-python
+      pymavlink
+      pynmeagps
+      pyserial
+      setuptools # Imports `pkg_resources` at runtime
+      wxpython
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      billiard
+      gnureadline
+    ];
 
   pythonImportsCheck = [ "MAVProxy" ];
 
diff --git a/pkgs/applications/science/robotics/sumorobot-manager/default.nix b/pkgs/applications/science/robotics/sumorobot-manager/default.nix
index 64539e3f8aee..fefee038a714 100644
--- a/pkgs/applications/science/robotics/sumorobot-manager/default.nix
+++ b/pkgs/applications/science/robotics/sumorobot-manager/default.nix
@@ -1,12 +1,9 @@
 {
   lib,
   stdenv,
-  python,
+  python3Packages,
   qt5,
   fetchFromGitHub,
-  wrapPython,
-  pyqt5,
-  pyserial,
   dos2unix,
 }:
 
@@ -21,14 +18,15 @@ stdenv.mkDerivation rec {
     sha256 = "07snhwmqqp52vdgr66vx50zxx0nmpmns5cdjgh50hzlhji2z1fl9";
   };
 
-  buildInputs = [ python ];
-  pythonPath = [
+  buildInputs = [ python3Packages.python ];
+
+  pythonPath = with python3Packages; [
     pyqt5.dev
     pyserial
   ];
 
   nativeBuildInputs = [
-    wrapPython
+    python3Packages.wrapPython
     qt5.wrapQtAppsHook
     dos2unix
   ];
diff --git a/pkgs/applications/video/jellyfin-mpv-shim/default.nix b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
index 72ebac3f7f01..0f1334afafdb 100644
--- a/pkgs/applications/video/jellyfin-mpv-shim/default.nix
+++ b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
@@ -1,25 +1,14 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   copyDesktopItems,
   fetchPypi,
   gobject-introspection,
-  jellyfin-apiclient-python,
-  jinja2,
   makeDesktopItem,
-  mpv,
-  pillow,
-  pystray,
-  python,
-  python-mpv-jsonipc,
-  pywebview,
-  setuptools,
-  tkinter,
   wrapGAppsHook3,
-  pypresence,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "jellyfin-mpv-shim";
   version = "2.9.0";
   pyproject = true;
@@ -35,9 +24,9 @@ buildPythonApplication rec {
     gobject-introspection
   ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     jellyfin-apiclient-python
     mpv
     pillow
@@ -51,7 +40,7 @@ buildPythonApplication rec {
     jinja2
     pywebview
 
-    # discord rich presence dependencie
+    # discord rich presence dependency
     pypresence
   ];
 
@@ -80,7 +69,7 @@ buildPythonApplication rec {
   postInstall = ''
     for s in 16 32 48 64 128 256; do
       mkdir -p $out/share/icons/hicolor/''${s}x''${s}/apps
-      ln -s $out/${python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
+      ln -s $out/${python3Packages.python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
         $out/share/icons/hicolor/''${s}x''${s}/apps/${pname}.png
     done
   '';
diff --git a/pkgs/applications/video/plex-mpv-shim/default.nix b/pkgs/applications/video/plex-mpv-shim/default.nix
index 7044f915d016..7861f5be7edc 100644
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -1,20 +1,13 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  fetchpatch,
-  python,
-  mpv,
-  requests,
-  python-mpv-jsonipc,
-  pystray,
-  tkinter,
   wrapGAppsHook3,
   gobject-introspection,
   mpv-shim-default-shaders,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "plex-mpv-shim";
   version = "1.11.0-unstable-2025-03-17";
   format = "setuptools";
@@ -31,7 +24,7 @@ buildPythonApplication {
     gobject-introspection
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     mpv
     requests
     python-mpv-jsonipc
@@ -47,7 +40,7 @@ buildPythonApplication {
 
   postInstall = ''
     # put link to shaders where upstream package expects them
-    ln -s ${mpv-shim-default-shaders}/share/mpv-shim-default-shaders $out/${python.sitePackages}/plex_mpv_shim/default_shader_pack
+    ln -s ${mpv-shim-default-shaders}/share/mpv-shim-default-shaders $out/${python3Packages.python.sitePackages}/plex_mpv_shim/default_shader_pack
   '';
 
   # does not contain tests
diff --git a/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix b/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
index 13093dded9ac..79f4342066c0 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
@@ -1,15 +1,12 @@
 {
   lib,
-  buildPythonPackage,
+  python3Packages,
   fetchFromGitHub,
-  hatchling,
-  more-itertools,
-  click,
   hyprland,
   makeWrapper,
 }:
 
-buildPythonPackage (finalAttrs: {
+python3Packages.buildPythonPackage (finalAttrs: {
   pname = "hyprshade";
   version = "4.0.1";
   pyproject = true;
@@ -22,11 +19,11 @@ buildPythonPackage (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    hatchling
+    python3Packages.hatchling
     makeWrapper
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     more-itertools
     click
   ];
diff --git a/pkgs/by-name/al/alvr/ffmpeg.nix b/pkgs/by-name/al/alvr/ffmpeg.nix
new file mode 100644
index 000000000000..356b1800bd6d
--- /dev/null
+++ b/pkgs/by-name/al/alvr/ffmpeg.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  ffmpeg_6,
+  alvr,
+}:
+
+(ffmpeg_6.override {
+  version = "6.0";
+  hash = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
+
+  withHardcodedTables = false;
+
+  withHtmlDoc = false;
+  withManPages = false;
+  withPodDoc = false;
+  withTxtDoc = false;
+  withDocumentation = false;
+}).overrideAttrs
+  (old: {
+    # apply our own ffmpeg patches, but skip texinfo-7.1.patch as it does not apply to 6.0.
+    # apply upstream patches for ALVR as well.
+    patches =
+      (lib.filter (p: !(lib.hasSuffix "texinfo-7.1.patch" (baseNameOf (toString p)))) old.patches)
+      ++ [
+        (alvr.src + "/alvr/xtask/patches/0001-Add-AV_VAAPI_DRIVER_QUIRK_HEVC_ENCODER_ALIGN_64_16-f.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-av1-encode-backport.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-clip-constants-used-with-shift-instr.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-guid-conftest.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-lavu-hwcontext_vulkan-Fix-importing-RGBx-frames-to-C.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-update-rc-modes.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Add-filler_data-option.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Allow-to-dynamically-change-bitrate-and.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Enable-global-header.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode_h265-Set-vui_parameters_present_flag.patch")
+      ];
+
+    doCheck = false;
+  })
diff --git a/pkgs/by-name/al/alvr/package.nix b/pkgs/by-name/al/alvr/package.nix
index 6de02465903e..d3ba6a6d1a68 100644
--- a/pkgs/by-name/al/alvr/package.nix
+++ b/pkgs/by-name/al/alvr/package.nix
@@ -2,8 +2,10 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   replaceVars,
   nix-update-script,
+  callPackage,
   pkg-config,
   autoAddDriverRunpath,
   alsa-lib,
@@ -11,7 +13,7 @@
   brotli,
   bzip2,
   celt,
-  ffmpeg_7,
+  ffmpeg-alvr ? callPackage ./ffmpeg.nix { },
   gmp,
   jack2,
   lame,
@@ -42,6 +44,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alvr";
+
   version = "20.14.1";
 
   src = fetchFromGitHub {
@@ -56,20 +59,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   patches = [
     (replaceVars ./fix-finding-libs.patch {
-      ffmpeg = lib.getDev ffmpeg_7;
+      ffmpeg = lib.getDev ffmpeg-alvr;
       x264 = lib.getDev x264;
     })
+    (fetchpatch {
+      url = "https://github.com/alvr-org/ALVR/commit/12a238b9ac9d63438163ff82cbd689733558a1e4.patch";
+      hash = "sha256-yvIGjopXIwGXajs5/RlAo+eqfVNnXlomKy/VO/dL+gc=";
+    })
   ];
 
-  postPatch = ''
-    substituteInPlace alvr/server_openvr/cpp/platform/linux/EncodePipelineVAAPI.cpp \
-      --replace-fail 'FF_PROFILE_H264_MAIN' 'AV_PROFILE_H264_MAIN' \
-      --replace-fail 'FF_PROFILE_H264_BASELINE' 'AV_PROFILE_H264_BASELINE' \
-      --replace-fail 'FF_PROFILE_H264_HIGH' 'AV_PROFILE_H264_HIGH' \
-      --replace-fail 'FF_PROFILE_HEVC_MAIN' 'AV_PROFILE_HEVC_MAIN' \
-      --replace-fail 'FF_PROFILE_AV1_MAIN' 'AV_PROFILE_AV1_MAIN'
-  '';
-
   env = {
     NIX_CFLAGS_COMPILE = toString [
       "-lbrotlicommon"
@@ -107,7 +105,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     brotli
     bzip2
     celt
-    ffmpeg_7
+    ffmpeg-alvr
     gmp
     jack2
     lame
@@ -153,7 +151,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ln -s $out/lib $out/lib64
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit ffmpeg-alvr;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Stream VR games from your PC to your headset via Wi-Fi";
@@ -164,6 +165,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       luNeder
       jopejoe1
+      eyjhb
     ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/an/anytype-heart/package.nix b/pkgs/by-name/an/anytype-heart/package.nix
index 69e632df434c..5b11214a178c 100644
--- a/pkgs/by-name/an/anytype-heart/package.nix
+++ b/pkgs/by-name/an/anytype-heart/package.nix
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
 
   # Use only versions specified in anytype-ts middleware.version file:
   #  https://github.com/anyproto/anytype-ts/blob/v<anytype-ts-version>/middleware.version
-  version = "0.49.0-rc08";
+  version = "0.50.8";
 
   # Update only together with 'anytype' package.
   # nixpkgs-update: no auto update
@@ -34,10 +34,10 @@ buildGoModule (finalAttrs: {
     owner = "anyproto";
     repo = "anytype-heart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gTUesFf6cDwsFCEUjpcy9VA67GwuZ9mNTih4HC0Vi7g=";
+    hash = "sha256-h59Vnmv+iB0NbLQPCHPlmHBDaYoFimrZP/4Cv/IQ7b8=";
   };
 
-  vendorHash = "sha256-1D7v/lgmoKOOHNG3vgpzDpWQ66lmmP8IeZ5rvXe4D9M=";
+  vendorHash = "sha256-uJ/Z2zxqIne3UuxAglZejoqHV/IchYdPhefL9K51U2I=";
 
   subPackages = [ "cmd/grpcserver" ];
   tags = [
@@ -59,16 +59,11 @@ buildGoModule (finalAttrs: {
     cp ${tantivy-go}/lib/libtantivy_go.a deps/libs/${arch}
   '';
 
-  postBuild = ''
-    protoc -I ./  --js_out=import_style=commonjs,binary:./dist/js/pb pb/protos/service/*.proto pb/protos/*.proto pkg/lib/pb/model/protos/*.proto
-    protoc -I ./  --grpc-web_out=import_style=commonjs+dts,mode=grpcwebtext:./dist/js/pb pb/protos/service/*.proto pb/protos/*.proto pkg/lib/pb/model/protos/*.proto
-  '';
-
   postInstall = ''
     mv $out/bin/grpcserver $out/bin/anytypeHelper
-    mkdir -p $out/lib
-    cp -r dist/js/pb/* $out/lib
-    cp -r dist/js/pb/* $out/lib
+    mkdir -p $out/lib/protos
+    find pb -type f -name "*.proto" -exec cp {} $out/lib/protos/ \;
+    find pkg/lib/pb -type f -name "*.proto" -exec cp {} $out/lib/protos/ \;
 
     mkdir -p $out/lib/json/generated
     cp pkg/lib/bundle/system*.json $out/lib/json/generated
diff --git a/pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch b/pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
index 7931ec439968..c8e17042b595 100644
--- a/pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
+++ b/pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
@@ -1,18 +1,8 @@
-From d236396b1da80a7233168e01e8164256e7f69cc1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
-Date: Fri, 25 Apr 2025 12:29:37 +0200
-Subject: [PATCH] feat(update): Disable auto checking for updates and updating
- manually
-
----
- electron/js/update.js | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/electron/js/update.js b/electron/js/update.js
-index 0e34efa..9386c90 100644
---- a/electron/js/update.js
-+++ b/electron/js/update.js
-@@ -29,7 +29,8 @@ class UpdateManager {
+diff --git a/electron/ts/update.ts b/electron/ts/update.ts
+index 8d63cb8eb7..ea2dadf0c9 100644
+--- a/electron/ts/update.ts
++++ b/electron/ts/update.ts
+@@ -31,7 +31,8 @@ class UpdateManager {
  		autoUpdater.autoInstallOnAppQuit = false;
  		autoUpdater.channel = channel;
  
@@ -22,16 +12,13 @@ index 0e34efa..9386c90 100644
  
  		autoUpdater.on('checking-for-update', () => {
  			Util.log('info', 'Checking for update');
-@@ -93,6 +94,9 @@ class UpdateManager {
+@@ -79,6 +80,9 @@ class UpdateManager {
  	};
  
- 	isAllowed () {
+ 	isAllowed (): boolean {
 +		// PATCH(update): Always disallow update check, even when requested by the user manually or when Anytype starts.
 +		return false;
 +
  		const { config } = ConfigManager;
  
  		if (config.updateDisabled) {
--- 
-2.49.0
-
diff --git a/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch b/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch
index b0dad3b73d7b..9e594683b70e 100644
--- a/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch
+++ b/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch
@@ -1,12 +1,12 @@
-diff --git a/electron.js b/electron.js
-index c5d6760882..17afc05e26 100644
---- a/electron.js
-+++ b/electron.js
-@@ -15,7 +15,6 @@ const store = new Store({ name: [ 'localStorage', suffix ].join('-') });
- 
- // gRPC DevTools extension ID
- const GRPC_DEVTOOLS_ID = 'fohdnlaeecihjiendkfhifhlgldpeopm';
--const { installExtension } = require('@tomjs/electron-devtools-installer');
- 
- // Fix notifications app name
- if (is.windows) {
+diff --git a/electron/ts/main.ts b/electron/ts/main.ts
+index 373518ee2d..8eefcd58be 100644
+--- a/electron/ts/main.ts
++++ b/electron/ts/main.ts
+@@ -15,7 +15,6 @@ import storage from 'electron-json-storage';
+ import * as remote from '@electron/remote/main';
+ import { installNativeMessagingHost } from './lib/installNativeMessagingHost';
+ import { getSafeStorage } from './safeStorage';
+-import { installExtension } from '@tomjs/electron-devtools-installer';
+ import Api from './api';
+ import ConfigManager from './config';
+ import UpdateManager from './update';
diff --git a/pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch b/pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch
index e772bdff71c6..2b8eeb826c18 100644
--- a/pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch
+++ b/pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch
@@ -1,13 +1,12 @@
-diff --git a/electron/js/util.js b/electron/js/util.js
-index da18f41ad0..bb07ec9f21 100644
---- a/electron/js/util.js
-+++ b/electron/js/util.js
-@@ -314,7 +314,9 @@ class Util {
- 		if (!is.linux) {
+diff --git a/electron/ts/util.ts b/electron/ts/util.ts
+index 1c5d6fd4b4..8c7811b58e 100644
+--- a/electron/ts/util.ts
++++ b/electron/ts/util.ts
+@@ -318,6 +318,9 @@ class Util {
  			return;
  		};
--
-+		// NixOS: desktop entries are managed by the package, avoid 
+ 
++		// NixOS: desktop entries are managed by the package, avoid
 +		// writing user-local anytype.desktop which goes stale on updates
 +		return;
  		const { execFile } = require('child_process');
diff --git a/pkgs/by-name/an/anytype/package.nix b/pkgs/by-name/an/anytype/package.nix
index 12391fb12824..c51ad8832da4 100644
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@@ -1,57 +1,116 @@
 {
   lib,
   stdenv,
+  stdenvNoCC,
   fetchFromGitHub,
-  buildNpmPackage,
-  nodejs_22,
+  makeWrapper,
+  coreutils,
+  nodejs,
+  node-gyp,
+  python3,
+  bun,
   pkg-config,
   anytype-heart,
   libsecret,
   electron,
   go,
   lsof,
+  protobuf,
   makeDesktopItem,
   copyDesktopItems,
+  writableTmpDirAsHomeHook,
   commandLineArgs ? "",
 }:
 
-buildNpmPackage (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "anytype";
-  version = "0.54.11";
+  version = "0.55.5";
+
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-ts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HF7bP3Ry3djNQnFDl0v6x9hzMpSLMXyI6UBItgGT+DI=";
+    hash = "sha256-9myOd7LTH/NoRY4SjU7+FSSNIhDMGKRPTBOQOURk/Hs=";
   };
 
   locales = fetchFromGitHub {
     owner = "anyproto";
     repo = "l10n-anytype-ts";
-    rev = "afa12aeb0cea6c77ce38c3e3bfd082d532948a1c";
-    hash = "sha256-YpOkmm7vW97t19twfLNExRHQvLVcrC+oDtHjwJL9dx8=";
+    rev = "b96bf7b76f10e764e7a60c7f284854aaabedcec6";
+    hash = "sha256-+vkProHi25CWxG74QB5eo0Pnwj0u5vXoZeeCoXyMOv4=";
   };
 
-  npmDepsHash = "sha256-/QWHJ2grw34LOEIDn93WDTEpQH001vVtuQgncR2SRYQ=";
+  node_modules = stdenvNoCC.mkDerivation {
+    pname = "${finalAttrs.pname}-node_modules";
+    inherit (finalAttrs) version src;
 
-  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+      # https://bun.com/docs/pm/cli/install#configuring-with-environment-variables
+
+      # Bun always tries to use the fastest available installation method for the target platform. On macOS, that’s clonefile and on Linux, that’s hardlink.
+      bun install \
+        --backend=copyfile \
+        --cpu="*" \
+        --frozen-lockfile \
+        --ignore-scripts \
+        --no-progress \
+        --os="*"
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      find . -type d -name node_modules -exec cp -R --parents {} $out \;
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+
+    #TODO: update it in update script
+    outputHash = "sha256-6IHFidjVDDzUOCRXVwjvzcLGKV6dWWS7k2jwrOuJ748=";
+    outputHashMode = "recursive";
+  };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   };
 
   nativeBuildInputs = [
+    bun
+    nodejs
     pkg-config
     go
+    protobuf
     copyDesktopItems
+    makeWrapper
+    node-gyp
+    stdenv.cc
+    python3
   ];
-  buildInputs = [ libsecret ];
 
-  npmFlags = [
-    # keytar needs to be built against electron's ABI
-    "--nodedir=${electron.headers}"
+  buildInputs = [
+    libsecret
   ];
 
   patches = [
@@ -60,26 +119,54 @@ buildNpmPackage (finalAttrs: {
     ./0003-remove-desktop-entry.patch
   ];
 
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -R ${finalAttrs.node_modules}/. .
+    patchShebangs node_modules
+
+    runHook postConfigure
+  '';
+
   buildPhase = ''
     runHook preBuild
 
+    # Building keytar against electron's ABI
+    # Trying to build in temp dir, will not work due to the keytar calling the node -p require('node-addon-api').include_dir
+    # but building inside the node_modules/keytar will find the ../node-addon-api automatically
+    chmod -R u+w node_modules/keytar node_modules/node-addon-api
+    pushd node_modules/keytar
+    HOME=$(mktemp -d) node-gyp rebuild --nodedir=${electron.headers}
+    popd
+
+    substituteInPlace scripts/generate-protos.sh \
+      --replace-fail "/usr/bin/env" "${coreutils}/bin/env"
+
     cp -r ${anytype-heart}/lib dist/
     cp -r ${anytype-heart}/bin/anytypeHelper dist/
 
+    # Without this, build fails when trying to copy/write into that directory during the js bundle step
+    chmod -R u+w dist/
+
+    bash ./scripts/generate-protos.sh --from-dist
+
+    bun run build
+
     for lang in ${finalAttrs.locales}/locales/*; do
       cp "$lang" "dist/lib/json/lang/$(basename $lang)"
     done
 
-    npm run build
-    npm run build:nmh
+    # $HOME/.cache/go-build.
+    export GOCACHE=$(mktemp -d)
+    # Runs "go build -o dist/nativeMessagingHost ./go/nativeMessagingHost.go"
+    bun run build:nmh
 
     runHook postBuild
   '';
 
   # remove unnecessary files
   preInstall = ''
-    npm prune --omit=dev
-    chmod u+w -R dist
+    chmod u+w -R dist node_modules
     find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
   '';
 
@@ -103,7 +190,7 @@ buildNpmPackage (finalAttrs: {
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     wrapProgram $out/lib/anytype/dist/nativeMessagingHost \
-       --prefix PATH : ${lib.makeBinPath [ lsof ]}
+      --prefix PATH : ${lib.makeBinPath [ lsof ]}
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ba/bazaar/package.nix b/pkgs/by-name/ba/bazaar/package.nix
index 0768b6623617..5ef3c44b4f71 100644
--- a/pkgs/by-name/ba/bazaar/package.nix
+++ b/pkgs/by-name/ba/bazaar/package.nix
@@ -34,7 +34,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.8.1";
+  version = "0.8.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bazaar-org";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ni2WfZu4LpCIXueGJYnZ2c7sCQ9VJAeI9zVNNrh7BLE=";
+    hash = "sha256-s0l548kuVD+eNAxA3BnbpuMHD1alq0/xGBIkXb7WpC0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ba/bazel_9/package.nix b/pkgs/by-name/ba/bazel_9/package.nix
index 29838dd3bb6d..4b7d2b692d7a 100644
--- a/pkgs/by-name/ba/bazel_9/package.nix
+++ b/pkgs/by-name/ba/bazel_9/package.nix
@@ -29,7 +29,7 @@
   cctools,
   # Allow to independently override the jdks used to build and run respectively
   jdk_headless,
-  version ? "9.1.0",
+  version ? "9.1.1",
 }:
 
 let
@@ -89,7 +89,7 @@ let
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-RbRM9HxcBij5gbd0aeArslc/IyjvycM5v7zOnaDT3cU=";
+    hash = "sha256-NwZQcycUMAzos1wLdSlwv2EjhDcPVJgQTkLT57AjFvI=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/bl/blackfire/package.nix b/pkgs/by-name/bl/blackfire/package.nix
index d90289827fa2..923a0e46d950 100644
--- a/pkgs/by-name/bl/blackfire/package.nix
+++ b/pkgs/by-name/bl/blackfire/package.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
     homepage = "https://blackfire.io/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ spk ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/bl/blackfire/php-probe.nix b/pkgs/by-name/bl/blackfire/php-probe.nix
index 0216baee623c..d6eedd99df7a 100644
--- a/pkgs/by-name/bl/blackfire/php-probe.nix
+++ b/pkgs/by-name/bl/blackfire/php-probe.nix
@@ -16,57 +16,57 @@ let
   phpMajor = lib.versions.majorMinor php.version;
   inherit (stdenv.hostPlatform) system;
 
-  version = "1.92.51";
+  version = "2026.5.0";
 
   hashes = {
     "x86_64-linux" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-HxVqkPupo3LrKfbQGOqoxpGJjFN17Jlkdya4BjBsBVw=";
-        "8.2" = "sha256-ssbMa4Wa27nwhJZ16FT+qrB4LH/HztOtCx+MI+i16Pg=";
-        "8.3" = "sha256-p9SXxHQGmsjtSeRFt9vYS5XK6nouT7qbqmlWbEpb2Hk=";
-        "8.4" = "sha256-ArI/SNjPIbjwEBMHvKCdSOkth8qqBWT6W0RnoWyWA+o=";
-        "8.5" = "sha256-5e4f9iEn5QPZY6Z+05O7QxTwaW+cjmP6nB5fkpValoM=";
+        "8.1" = "sha256-FQzmRL1Dk4HBnrfbfOclDWGvqflFXTUMK8b1NLIb880=";
+        "8.2" = "sha256-e2+hVsoBXt8gURRvGC4bgAkLpB1GriefokAjFFUuO8c=";
+        "8.3" = "sha256-C/NsbJ8XlkBPlZ0lPeNL4SWxfVWSLxvQYDxTVf2PfyA=";
+        "8.4" = "sha256-gqEV9thI/oe38/dyrGZxhPtv4+ufzMDXJL0zgt8IbOA=";
+        "8.5" = "sha256-kw57CBFOcRpaToXD/V2veXjcQnVaM3uTLC3tgrKyNzc=";
       };
     };
     "i686-linux" = {
       system = "i386";
       hash = {
-        "8.1" = "sha256-mTw8v5DaP7D5qb3XwRZvx8XH4bTiuu2xzzo82KsrrZU=";
-        "8.2" = "sha256-Vtb0DVfPBC0JtK1XOPQ8KmA0Jq0pBBA3jkDaCV7icGg=";
-        "8.3" = "sha256-vnL8gfA6ejMcpnfKXalSOvl7vixwQLJBC3DTO4Dafow=";
-        "8.4" = "sha256-x9/BcZPJib0hal6M2vUVk1cLmN1gc3k6hypViTqForo=";
-        "8.5" = "sha256-aVmQ8vHS/oQeb44RyV5hggOt+VXLqP7wKDxgfpbopQQ=";
+        "8.1" = "sha256-Cccapa4s6Wvo/MOjReCbbJY4H1HNe5uF8Fe4UX8ftFs=";
+        "8.2" = "sha256-1k8m4Mram806XIbR4x0Kf6IH7rvhbLbaqPgM9v1SHS4=";
+        "8.3" = "sha256-Si0boOO5BRDKARZbAbPPrxRIaUjwViQLepZ5tNvkjGk=";
+        "8.4" = "sha256-BOjlJy48fS2SWK28Lcd9/MVhciDEaBJe6mRIhTa9JhI=";
+        "8.5" = "sha256-OBySA7eGI+YqvMnsOlr7p6RznqYq7DJptnYjhMfqk2Q=";
       };
     };
     "aarch64-linux" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-S41qr5wU2dsK0IBsR/mTALguPQU+SKYVTLP7DwGQo40=";
-        "8.2" = "sha256-eQkvDRxwQNXlkZ9XzcSRfkKjp/CTZGaFwolXq6TZWaE=";
-        "8.3" = "sha256-GBjjx0cSJjYCOdDiArUPA4iqOcgpk3y9o0wi6b6UJgM=";
-        "8.4" = "sha256-s4zcHogsOy1GjTAGJuO6i7S6dp/lmRVzbjJk3/t8Zn4=";
-        "8.5" = "sha256-/lFwv6p9izXj7X+pqZe9clcp+wSYtzIPnwqeE/HFqNk=";
+        "8.1" = "sha256-Od+c9X4yg4xW9aAI0x1CacUNp7PdJl1KRIi++m4DLY8=";
+        "8.2" = "sha256-ZI2n0lXkwUg8BvpjdhqHz1F3Z7dlX+oGv6IsjRVzzWA=";
+        "8.3" = "sha256-6NMvylxdwPpbmIN5EDVcBuplP2kEQDyY+fD23k89k48=";
+        "8.4" = "sha256-356ECFSrqu5kJX/qP+SNtKl7bsGGD/ROJd9vgEX5wSM=";
+        "8.5" = "sha256-z7GMQ9wqIr2/BKi3G2Wf3cZBtU/ZC+uKMcbnmYfmm8w=";
       };
     };
     "aarch64-darwin" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-+ko465G24UELdMmEg4ZqOA9p0/0DSs3p+On6Gg2IVMM=";
-        "8.2" = "sha256-TERILY6E1vnl+L6t+oel+1H3HTHWTTeEb1rVXtriJ8w=";
-        "8.3" = "sha256-R5Ue3erVCe1gOPk1SuDRXGA05WPm1IisHCnbXfmjFcw=";
-        "8.4" = "sha256-qqbmZa4qd7Ck87GylHeHP9m3K47DAEiTxlKdtXEnzVo=";
-        "8.5" = "sha256-3d9glqfXCMXwtLZm8fuj9DVzCIczynX7MRxnbMC7/NE=";
+        "8.1" = "sha256-vlb6HCz9KqSL+bSuVixiHVgVVkEAuCaoR7ww0/ZSdR8=";
+        "8.2" = "sha256-3XVHonZ7UW3LENuKgywyZ5q3Mo/6XBhnbiuARRGqPAg=";
+        "8.3" = "sha256-Dw+L0Bo/6BeFi+w3sm5kekR0mXoMUcsCuEksCdFpVA0=";
+        "8.4" = "sha256-i5R+vUn08yNWvPaJGRRHBPAbpxdqDmvPq3l9NPCuqxg=";
+        "8.5" = "sha256-vyBbyS8Y1mD+zFO01bMbim8Riq45+ns9YA4k41KQup8=";
       };
     };
     "x86_64-darwin" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-XvV6x8LKjR4j081PIdKpYCVl+ayXOmPsXf+gsMeFOro=";
-        "8.2" = "sha256-qxFWj1HpWokwzsFTiRhi4vw67H8yLwu1xbhja+fAxqY=";
-        "8.3" = "sha256-ffrwc48MZzX0MJHbaDmWQpday1LicOxhR2+fwylItD0=";
-        "8.4" = "sha256-P8j8gc8lZRbuVd1UmSpYmle88h50vhJfNxTZp3v9/Sg=";
-        "8.5" = "sha256-zy24hLCTajY+BVdkJCiXoy8abhQ82Ntw7Wuqn6zJKOQ=";
+        "8.1" = "sha256-0xf09E58+kOGZbfpUeaCNdeeJx/Sv4QazfgcdV3Fqho=";
+        "8.2" = "sha256-BU3INTjuVXJ+WB16Q/6I1I5y0k+7sR158vKOiuh6H4w=";
+        "8.3" = "sha256-TBTuabrEpQR7ff+ULjZCD99a1xX4KNjTWlMQTJ1l6NU=";
+        "8.4" = "sha256-45R0CrE6MZ4RU4HslaF5/jbMOz32fCMnzj8R1F9tu34=";
+        "8.5" = "sha256-40+kki7h6DLQemLyoKOSdd8hmQXJE+Yt4rcC4V706vs=";
       };
     };
   };
@@ -161,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Blackfire Profiler PHP module";
     homepage = "https://blackfire.io/";
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ spk ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/bl/bluesky-pds/package.nix b/pkgs/by-name/bl/bluesky-pds/package.nix
index cd0355d27cb7..3c990477451a 100644
--- a/pkgs/by-name/bl/bluesky-pds/package.nix
+++ b/pkgs/by-name/bl/bluesky-pds/package.nix
@@ -8,7 +8,7 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   fetchFromGitHub,
-  nodejs_22,
+  nodejs_24,
   vips,
   pkg-config,
   nixosTests,
@@ -18,22 +18,22 @@
 }:
 
 let
-  # build failure against better-sqlite3, so we use nodejs_22; upstream
-  # bluesky-pds uses 20
-  nodejs = nodejs_22;
+  # upstream bluesky-social/atproto uses nodejs 22+
+  nodejs = nodejs_24;
   nodeSources = srcOnly nodejs;
   pythonEnv = python3.withPackages (p: [ p.setuptools ]);
+  pnpm = pnpm_9;
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.219";
+  version = "0.4.5001";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zXNg1rtXN9qdTBvRlSiPlRu6k1Pv3T8nhROsEarev5U=";
+    hash = "sha256-j7XNZYZHHj5HdtEuTAhNU9TD7S7eMILMflZJn0nDVaY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     pythonEnv
     pkg-config
     pnpmConfigHook
-    pnpm_9
+    pnpm
     removeReferencesTo
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -61,9 +61,9 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-rZpimxX4oDXIaUdAkkNPEff6qYJ9C8KptsPWJKwPiFo=";
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-3/gjhQIMxI/mwqmKV1wZ6oMiCGHutXuDY2CFSN3QnE4=";
   };
 
   buildPhase = ''
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     makeWrapper "${lib.getExe nodejs}" "$out/bin/pds" \
       --add-flags --enable-source-maps \
-      --add-flags "$out/lib/pds/index.js" \
+      --add-flags "$out/lib/pds/index.ts" \
       --set-default NODE_ENV production
 
     runHook postBuild
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     mkdir -p $out/{bin,lib/pds}
     mv node_modules $out/lib/pds
-    mv index.js $out/lib/pds
+    mv index.ts $out/lib/pds
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/cl/clickhouse/package.nix b/pkgs/by-name/cl/clickhouse/package.nix
index a8d8e8883c11..e364e6a97376 100644
--- a/pkgs/by-name/cl/clickhouse/package.nix
+++ b/pkgs/by-name/cl/clickhouse/package.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.5.1.882-stable";
-  rev = "5b96a8d8a5e2f4800b43a780911a39dc5a666e1c";
-  hash = "sha256-Z+xcmHIkCuYSqOFdWSRWk2BFuCeI9yXnJIntSa4zXUk=";
+  version = "26.5.2.39-stable";
+  rev = "8462fd8f3dea8603e67666414b2781ab57a8adb6";
+  hash = "sha256-lbVveT6cFT9ZhSl+0qh3NhtO4FHakFWDBJd757J8WJg=";
   lts = false;
 }
diff --git a/pkgs/by-name/cl/clj-kondo/package.nix b/pkgs/by-name/cl/clj-kondo/package.nix
index b482f11963af..36c66478b6f8 100644
--- a/pkgs/by-name/cl/clj-kondo/package.nix
+++ b/pkgs/by-name/cl/clj-kondo/package.nix
@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "clj-kondo";
-  version = "2026.04.15";
+  version = "2026.05.25";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-BJw4A5c9F6S6T5d3dP0VdfEaayqoLbHiXUyEyqKFP94=";
+    sha256 = "sha256-SzrfsIHUW+KzZITesZ9aS00Gx7S4hekLsXXdjQJJxLM=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/by-name/co/copyq/package.nix b/pkgs/by-name/co/copyq/package.nix
index c7797d34a2ce..e0f11443eeba 100644
--- a/pkgs/by-name/co/copyq/package.nix
+++ b/pkgs/by-name/co/copyq/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "CopyQ";
-  version = "15.0.0";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D1huGKvYa/GsVeLQcP69MCWF8p+ytcQxlu0qynmYbGw=";
+    hash = "sha256-QO7iOFwO++tXZMWvJVmzUDrjnuz0Fl2XYsqfIPl5GBA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/dc/dcp/package.nix b/pkgs/by-name/dc/dcp/package.nix
index e6cbf069396a..a6bae8b8afc9 100644
--- a/pkgs/by-name/dc/dcp/package.nix
+++ b/pkgs/by-name/dc/dcp/package.nix
@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dcp";
-  version = "0.24.3";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "dcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SHMthGpQ3zKJXmltIjSEI0vq1fysdUCs1rIiaBHi0JI=";
+    hash = "sha256-9+z+umhxnu4X9Yk76qk5Li/6ltT9qR3IVgkKgFrLf2c=";
   };
 
   vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";
diff --git a/pkgs/by-name/di/dix/package.nix b/pkgs/by-name/di/dix/package.nix
index 3e71f00c6470..7db7dadc9143 100644
--- a/pkgs/by-name/di/dix/package.nix
+++ b/pkgs/by-name/di/dix/package.nix
@@ -7,7 +7,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
-  version = "2.0.0";
+  version = "2.0.1";
 
   __structuredAttrs = true;
 
@@ -15,18 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "manic-systems";
     repo = "dix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5aH8zX/Wm+KHzd1fjmjlxjDB+psDG42JAY5U8lrjGDU=";
+    hash = "sha256-KTlFgBEVKJIXymfN2UU8hvGM71PYRcNgJ1XWUmG2AI4=";
   };
 
-  cargoHash = "sha256-llStz2BaHBH9iHhfbptAE+Td5HPsvzAlPtXohrCxY4w=";
-
-  env.TMPDIR = "/tmp/";
-  checkFlags = [
-    "--skip=store::nix_command::tests::test_query_closure_path_info"
-    "--skip=store::nix_command::tests::test_query_closure_size"
-    "--skip=store::nix_command::tests::test_query_dependents"
-    "--skip=store::nix_command::tests::test_query_system_derivations"
-  ];
+  cargoHash = "sha256-pNkSdsxOpv0E/xXs7tMg2vtP0PBU7p8fh3H4IX/u5k4=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/dt/dtop/package.nix b/pkgs/by-name/dt/dtop/package.nix
index 1cc6abf3a689..6d7cd35ae900 100644
--- a/pkgs/by-name/dt/dtop/package.nix
+++ b/pkgs/by-name/dt/dtop/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dtop";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "amir20";
     repo = "dtop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v4LG0k9eMZiFYmIecHXwQqrTINaMAiqPYiXYEuQxx2A=";
+    hash = "sha256-kYSOJCQfoYXhdZ3cyRv/+Ifov4VzOv0gqvjueVMmnuQ=";
   };
 
-  cargoHash = "sha256-4F5eCt8AaVtGJRe7uBMHqdM3g1mLlWDXIpZCojRUjjc=";
+  cargoHash = "sha256-fspIjgctyhQwyDygrSrtJBb/EYxY8o00/UJy/z89yso=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/gi/git-bug/package.nix b/pkgs/by-name/gi/git-bug/package.nix
index dc9051dc0c64..a426932eb317 100644
--- a/pkgs/by-name/gi/git-bug/package.nix
+++ b/pkgs/by-name/gi/git-bug/package.nix
@@ -53,6 +53,7 @@ buildGoModule (finalAttrs: {
 
   postInstall = ''
     installShellCompletion \
+      --cmd git-bug \
       --bash misc/completion/bash/git-bug \
       --zsh misc/completion/zsh/git-bug \
       --fish misc/completion/fish/git-bug
diff --git a/pkgs/by-name/gi/gitsign/package.nix b/pkgs/by-name/gi/gitsign/package.nix
index 296da485a734..c648c687d265 100644
--- a/pkgs/by-name/gi/gitsign/package.nix
+++ b/pkgs/by-name/gi/gitsign/package.nix
@@ -10,15 +10,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitsign";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "gitsign";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XFeKU956FIfQhaca2M/OtYgCF8qErzPcyMBEGvzPAcc=";
+    hash = "sha256-BkaEI3YSnfMbRQ0r/rGUgZqUaCe3L1BXGxO4Ft19TdQ=";
   };
-  vendorHash = "sha256-fjrdQZVXgBvdKQFnmjtLShBHsKNIp5Y/uW7aU2cP1aY=";
+  vendorHash = "sha256-Sltj/DwS3T7puIaH5HAZ+BE9vlv79+FlvK+t5O2VSM0=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/he/helmify/package.nix b/pkgs/by-name/he/helmify/package.nix
new file mode 100644
index 000000000000..09b6b9505417
--- /dev/null
+++ b/pkgs/by-name/he/helmify/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "helmify";
+  version = "0.4.20";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "arttor";
+    repo = "helmify";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Az/rNrNwWkQCZ8iy2qkix8xqsWA+eUbFw7YstA9usdw=";
+  };
+
+  vendorHash = "sha256-a2uA2P9eenpgb2bFMvy3ioI9crG0FpvD1vEXqCwwwyw=";
+
+  ldflags = [
+    "-s"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.tag}"
+    "-X main.date=19700101"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Creates Helm chart from Kubernetes yaml";
+    homepage = "https://github.com/arttor/helmify";
+    changelog = "https://github.com/arttor/helmify/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
+    mainProgram = "helmify";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ib/ibm-plex/fonts.nix b/pkgs/by-name/ib/ibm-plex/fonts.nix
new file mode 100644
index 000000000000..cda27fb6be87
--- /dev/null
+++ b/pkgs/by-name/ib/ibm-plex/fonts.nix
@@ -0,0 +1,99 @@
+{
+  math = {
+    hash = "sha256-dJA6uqxa/yb3eLY4l39NeP0yIl2NfrbaRpf6h0/F7Xc=";
+    name = "IBM Plex Math";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-math@1.1.0/ibm-plex-math.zip";
+    version = "1.1.0";
+  };
+  mono = {
+    hash = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
+    name = "IBM Plex Mono";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip";
+    version = "1.1.0";
+  };
+  sans = {
+    hash = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
+    name = "IBM Plex Sans";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans@1.1.0/ibm-plex-sans.zip";
+    version = "1.1.0";
+  };
+  sans-arabic = {
+    hash = "sha256-qi4k7kMLftIuq87idyxq46FOD6QYycdG6j3zJmu8mhI=";
+    name = "IBM Plex Sans Arabic";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-arabic@1.1.0/ibm-plex-sans-arabic.zip";
+    version = "1.1.0";
+  };
+  sans-condensed = {
+    hash = "sha256-prqyJIPs+UpQxFTbn/eAfsG/jKwQTOO72fZNzAtXUWg=";
+    name = "IBM Plex Sans Condensed";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-condensed@2.0.0/ibm-plex-sans-condensed.zip";
+    version = "2.0.0";
+  };
+  sans-devanagari = {
+    hash = "sha256-K57OVqcH5r9tZx8NFEoz1P3xpUooqpF7xxJzNmnObwE=";
+    name = "IBM Plex Sans Devanagari";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-devanagari@1.1.0/ibm-plex-sans-devanagari.zip";
+    version = "1.1.0";
+  };
+  sans-hebrew = {
+    hash = "sha256-rTuBQYLI+6gEFTumCdaWpeoLzRoyFSmqWbXziq+UG6I=";
+    name = "IBM Plex Sans Hebrew";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-hebrew@1.1.0/ibm-plex-sans-hebrew.zip";
+    version = "1.1.0";
+  };
+  sans-jp = {
+    hash = "sha256-2BbhqsutMXEoS2JoZjJprrElIpFa9lgvPaM65pnYdfs=";
+    name = "IBM Plex Sans Japanese";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-jp@3.0.0/ibm-plex-sans-jp.zip";
+    version = "3.0.0";
+  };
+  sans-kr = {
+    hash = "sha256-FsHxMvLlI4yylgG96DOZIdW2DYpk7I+c5QgkVIkNZIE=";
+    name = "IBM Plex Sans Korean";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-kr@1.1.0/ibm-plex-sans-kr.zip";
+    version = "1.1.0";
+  };
+  sans-sc = {
+    hash = "sha256-Q3cEVlR/UkNZaGIhNMIdojId6fHmAsZdLwMsKq1zLRY=";
+    name = "IBM Plex Sans Chinese SC";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-sc@1.1.0/ibm-plex-sans-sc.zip";
+    version = "1.1.0";
+  };
+  sans-tc = {
+    hash = "sha256-kZvzSK6fEjfVMR4kxC4lxtD7GskqvJZx8BBJVT4T9MU=";
+    name = "IBM Plex Sans Chinese TC";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-tc@1.1.1/ibm-plex-sans-tc.zip";
+    version = "1.1.1";
+  };
+  sans-thai = {
+    hash = "sha256-JZVbvZdj+IfBthiqivOXHrvAUe392M9ECGsiJkm0saE=";
+    name = "IBM Plex Sans Thai";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-thai@1.1.0/ibm-plex-sans-thai.zip";
+    version = "1.1.0";
+  };
+  sans-thai-looped = {
+    hash = "sha256-cry/Ctwt1bsrdbvWkJIYWLjsvV6a1lLFsT85znqERnw=";
+    name = "IBM Plex Sans Thai Looped";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-thai-looped@1.1.0/ibm-plex-sans-thai-looped.zip";
+    version = "1.1.0";
+  };
+  sans-variable = {
+    hash = "sha256-W45wPOmmP4KuJ3TVes2x0n25KgyDzX48ce1lQrjAXpw=";
+    name = "IBM Plex Sans (Variable)";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-variable@0.2.0/plex-sans-variable.zip";
+    version = "0.2.0";
+  };
+  serif = {
+    hash = "sha256-PO9KxV4K3a7fB4fR/i7LSf0mhK4I2eUDMsbSYWDQcb4=";
+    name = "IBM Plex Serif";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-serif@2.0.0/ibm-plex-serif.zip";
+    version = "2.0.0";
+  };
+  serif-variable = {
+    hash = "sha256-xhjmeIMT7FAFhfR8fekAxzQEl1hOtPdQ6qsVpnZN6Xg=";
+    name = "IBM Plex Serif (Variable)";
+    stripRoot = false;
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-serif-variable@2.0.0/plex-serif-variable.zip";
+    version = "2.0.0";
+  };
+}
diff --git a/pkgs/by-name/ib/ibm-plex/hashes.nix b/pkgs/by-name/ib/ibm-plex/hashes.nix
deleted file mode 100644
index 87997ed6362f..000000000000
--- a/pkgs/by-name/ib/ibm-plex/hashes.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "serif" = "sha256-8ygaAeMKygYS4GCub4YUQmkh87pYHfi3s0PQ6AbaeGw=";
-  "sans" = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
-  "sans-condensed" = "sha256-/aJTXmrHuoPSrtCKNodBY7I0CriayNTx5LCXw+/MFvE=";
-  "sans-arabic" = "sha256-qi4k7kMLftIuq87idyxq46FOD6QYycdG6j3zJmu8mhI=";
-  "sans-devanagari" = "sha256-K57OVqcH5r9tZx8NFEoz1P3xpUooqpF7xxJzNmnObwE=";
-  "sans-thai" = "sha256-JZVbvZdj+IfBthiqivOXHrvAUe392M9ECGsiJkm0saE=";
-  "sans-thai-looped" = "sha256-cry/Ctwt1bsrdbvWkJIYWLjsvV6a1lLFsT85znqERnw=";
-  "sans-sc" = "sha256-Q3cEVlR/UkNZaGIhNMIdojId6fHmAsZdLwMsKq1zLRY=";
-  "sans-tc" = "sha256-kZvzSK6fEjfVMR4kxC4lxtD7GskqvJZx8BBJVT4T9MU=";
-  "sans-kr" = "sha256-FsHxMvLlI4yylgG96DOZIdW2DYpk7I+c5QgkVIkNZIE=";
-  "sans-jp" = "sha256-hUl/SSkN6q3pDTtrY2mJepw3ljhhLJskGbxfsTl9TuI=";
-  "sans-hebrew" = "sha256-rTuBQYLI+6gEFTumCdaWpeoLzRoyFSmqWbXziq+UG6I=";
-  "mono" = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
-  "math" = "sha256-dJA6uqxa/yb3eLY4l39NeP0yIl2NfrbaRpf6h0/F7Xc=";
-}
diff --git a/pkgs/by-name/ib/ibm-plex/package.nix b/pkgs/by-name/ib/ibm-plex/package.nix
index 56b6d2a6510c..b87f6cabff55 100644
--- a/pkgs/by-name/ib/ibm-plex/package.nix
+++ b/pkgs/by-name/ib/ibm-plex/package.nix
@@ -1,60 +1,71 @@
 {
   lib,
   stdenvNoCC,
-  fetchzip,
   symlinkJoin,
+  fetchzip,
   installFonts,
   families ? [ ],
 }:
 let
-  version = import ./version.nix;
-  availableFamilies = import ./hashes.nix;
-
-  availableFamilyNames = builtins.attrNames availableFamilies;
+  allFonts = import ./fonts.nix;
+  availableFamilyNames = builtins.attrNames allFonts;
   selectedFamilies = if (families == [ ]) then availableFamilyNames else families;
-
   unknownFamilies = lib.subtractLists availableFamilyNames families;
-in
-assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
-stdenvNoCC.mkDerivation {
-  pname = "ibm-plex";
-  inherit version;
+  fontsToBuild = lib.filterAttrs (name: _: lib.elem name selectedFamilies) allFonts;
+  makeFont =
+    font:
+    stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = lib.toLower (lib.replaceStrings [ " (" ")" " " ] [ "-" "" "-" ] font.name);
+      inherit (font) version;
 
-  src = symlinkJoin {
-    name = "ibm-plex-src";
-    paths = map (
-      family:
-      fetchzip {
-        url = "https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip";
-        hash = availableFamilies.${family};
-      }
-    ) selectedFamilies;
-    postBuild = ''
-      find "$out" \( -name unhinted -or -name split \) -exec rm -fr {} +
-    '';
-  };
+      nativeBuildInputs = [ installFonts ];
 
-  sourceRoot = ".";
+      outputs = [
+        "out"
+        "webfont"
+      ];
 
-  nativeBuildInputs = [ installFonts ];
+      src = fetchzip {
+        inherit (font) hash url;
+        stripRoot = font.stripRoot or true;
+      };
 
-  outputs = [
-    "out"
-    "webfont"
-  ];
-
-  passthru.updateScript = ./update.sh;
+      # Some fonts, e.g. "ibm-plex-sans-korean" and "ibm-plex-sans-japanese"
+      # include both unhinted and hinted variants of the ttf and woff/woff2 type
+      # fonts, which collide when using the `installFonts` hook.
+      # Default to installing the hinted variant of the fonts.
+      #
+      # Additionally, fonts with webfonts include complete and split forms.
+      # Default to the complete forms.
+      preInstall = ''
+        find . -type d \( -name unhinted -or -name split \) -exec rm -rf {} +
+      '';
 
+      meta = meta // {
+        description = font.name;
+      };
+    });
+  fontDerivations = lib.mapAttrs (_: v: makeFont v) fontsToBuild;
   meta = {
     description = "IBM Plex Typeface";
     homepage = "https://www.ibm.com/plex/";
-    changelog = "https://github.com/IBM/plex/raw/v${version}/CHANGELOG.md";
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [
+      magicquark
       ners
       romildo
       ryanccn
     ];
   };
+in
+assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
+symlinkJoin {
+  pname = "ibm-plex";
+  version = "0-unstable-2026-02-12";
+  paths = lib.attrValues fontDerivations;
+  passthru = fontDerivations // {
+    updateScript = ./update.py;
+  };
+  inherit meta;
 }
diff --git a/pkgs/by-name/ib/ibm-plex/update.py b/pkgs/by-name/ib/ibm-plex/update.py
new file mode 100755
index 000000000000..17e8493110c8
--- /dev/null
+++ b/pkgs/by-name/ib/ibm-plex/update.py
@@ -0,0 +1,85 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p nix nix-prefetch python3
+import json
+import subprocess
+import urllib.request
+
+fonts_file = "fonts.nix"
+fonts_data = json.loads(
+    subprocess.check_output(["nix", "eval", "--json", "-f", fonts_file])
+)
+
+releases_url = "https://api.github.com/repos/IBM/plex/releases"
+releases = json.loads(urllib.request.urlopen(releases_url).read())
+
+for font in fonts_data.keys():
+    font_tag = f"@ibm/plex-{font}@"
+    font_file = f"plex-{font}.zip"
+    current_version = fonts_data.get(font, {}).get("version")
+
+    latest_release = next(
+        (r for r in releases if r["tag_name"].lower().startswith(font_tag)), None
+    )
+
+    if latest_release is None:
+        print(f"No release found for {font}")
+        continue
+
+    latest_version = latest_release["tag_name"].split("@")[-1]
+
+    if current_version == latest_version:
+        print(f"Font {font} is up-to-date")
+        continue
+
+    print(f"Updating {font} from {current_version} to {latest_version}")
+
+    asset = next(
+        (
+            a
+            for a in latest_release["assets"]
+            if font_file.lower() in a["name"].lower()
+        ),
+        None,
+    )
+
+    if asset is None:
+        print(f"Warning: No asset found for {font}")
+        continue
+
+    asset_url = asset["browser_download_url"]
+
+    raw_hash = (
+        subprocess.check_output(["nix-prefetch-url", "--unpack", asset_url])
+        .decode()
+        .strip()
+    )
+
+    sri_hash = (
+        subprocess.check_output(
+            ["nix", "--extra-experimental-features", "nix-command", "hash", "convert", "--hash-algo", "sha256", raw_hash]
+        )
+        .decode()
+        .strip()
+    )
+
+    for x, y in zip(
+        ["version", "hash", "url"],
+        [latest_version, sri_hash, asset_url]
+    ):
+        if fonts_data[font].get(x) != y:
+            fonts_data[font][x] = y
+
+
+with open(fonts_file, "w") as f:
+    f.write("{\n")
+    for font in sorted(fonts_data.keys()):
+        attrs = fonts_data[font]
+        f.write(f"  {font} = {{\n")
+        for k in sorted(attrs.keys()):
+            v = attrs[k]
+            if isinstance(v, bool):
+                f.write(f"    {k} = {'true' if v else 'false'};\n")
+            else:
+                f.write(f'    {k} = "{v}";\n')
+        f.write("  };\n")
+    f.write("}\n")
diff --git a/pkgs/by-name/ib/ibm-plex/update.sh b/pkgs/by-name/ib/ibm-plex/update.sh
deleted file mode 100755
index c44aac891530..000000000000
--- a/pkgs/by-name/ib/ibm-plex/update.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix nix-prefetch jq
-#  shellcheck shell=bash
-set -eo pipefail
-
-families=(
-    "serif"
-    "sans"
-    "sans-condensed"
-    "sans-arabic"
-    "sans-devanagari"
-    "sans-thai"
-    "sans-thai-looped"
-    "sans-sc"
-    "sans-tc"
-    "sans-kr"
-    "sans-jp"
-    "sans-hebrew"
-    "mono"
-    "math"
-)
-
-version=$(curl --silent 'https://api.github.com/repos/IBM/plex/releases/latest' | jq -r '.tag_name | sub("^@ibm/[\\w-]+@"; "")')
-
-dirname="$(dirname "$0")"
-echo \""${version}"\" >"$dirname/version-new.nix"
-if diff -q "$dirname/version-new.nix" "$dirname/version.nix"; then
-    echo No new version available, current: "$version"
-    rm "$dirname/version-new.nix"
-    exit 0
-else
-    echo Updated to version "$version"
-    mv "$dirname/version-new.nix" "$dirname/version.nix"
-fi
-
-printf '{\n' > "$dirname/hashes.nix"
-
-for family in "${families[@]}"; do
-    url="https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip"
-    printf '  "%s" = "%s";\n' "$family" "$(nix-prefetch-url --unpack "$url" | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)" >>"$dirname/hashes.nix"
-done
-
-printf '}\n' >> "$dirname/hashes.nix"
diff --git a/pkgs/by-name/ib/ibm-plex/version.nix b/pkgs/by-name/ib/ibm-plex/version.nix
deleted file mode 100644
index f0947f091566..000000000000
--- a/pkgs/by-name/ib/ibm-plex/version.nix
+++ /dev/null
@@ -1 +0,0 @@
-"1.1.0"
diff --git a/pkgs/by-name/ja/jai-jail/package.nix b/pkgs/by-name/ja/jai-jail/package.nix
new file mode 100644
index 000000000000..ba62001d368c
--- /dev/null
+++ b/pkgs/by-name/ja/jai-jail/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  gcc15Stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  pandoc,
+  systemd,
+  util-linux,
+  acl,
+}:
+
+gcc15Stdenv.mkDerivation (finalAttrs: {
+  pname = "jai-jail";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "stanford-scs";
+    repo = "jai";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AByC7Xh1FYbQ/4Au396m2zYUxsLqcF1PEbpdz7x6LaQ=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    pandoc
+    systemd
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  buildInputs = [
+    util-linux # libmount
+    acl
+  ];
+
+  configureFlags = [ "--with-untrusted-user=jai" ];
+
+  meta = {
+    description = "Lightweight jail for AI CLIs";
+    mainProgram = "jai";
+    homepage = "https://jai.scs.stanford.edu";
+    changelog = "https://github.com/stanford-scs/jai/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ agentelement ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
index 4100158669c9..0b5e59a90e85 100644
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "7.1.4-1";
+  version = "7.1.4-3";
 in
 
 (ffmpeg_7-full.override {
@@ -14,7 +14,7 @@ in
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     tag = "v${version}";
-    hash = "sha256-VijSSbtcaeQNf1UwpPKTIfzAHHp2BHvBdhXeigTQEbI=";
+    hash = "sha256-3aPiR4BJrR/5UFKRbrK8IbyW6HN9wC6oTSYKH4Ak4EU=";
   };
 }).overrideAttrs
   (old: {
diff --git a/pkgs/by-name/je/jellyfin-web/package.nix b/pkgs/by-name/je/jellyfin-web/package.nix
index 9a3cdc75d5f3..29f64fc61ab8 100644
--- a/pkgs/by-name/je/jellyfin-web/package.nix
+++ b/pkgs/by-name/je/jellyfin-web/package.nix
@@ -13,7 +13,7 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "jellyfin-web";
-  version = "10.11.10";
+  version = "10.11.11";
 
   src =
     assert finalAttrs.version == jellyfin.version;
@@ -21,7 +21,7 @@ buildNpmPackage (finalAttrs: {
       owner = "jellyfin";
       repo = "jellyfin-web";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-fSpzF6Arx0JfL9fuQHjzf3m82XZR2BZkV0lA37L4DN4=";
+      hash = "sha256-3Gyg0eSbOXO0wgdgzuOtD8nDmSM37z7Bc0fKcbo9ffA=";
     };
 
   nodejs = nodejs_22;
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
       --replace-fail "git describe --always --dirty" "echo ${finalAttrs.src.rev}"
   '';
 
-  npmDepsHash = "sha256-DCFgivbZrDufRaB+4PeFxO6ISbEM9lXhXmlzc/5GbVU=";
+  npmDepsHash = "sha256-4kZo50xY/SvjpHToeIt0E91yeM7ab6Q6XtBMU5zSrF4=";
 
   preBuild = ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart
diff --git a/pkgs/by-name/je/jellyfin/package.nix b/pkgs/by-name/je/jellyfin/package.nix
index 89353c557a47..15505b3a49a6 100644
--- a/pkgs/by-name/je/jellyfin/package.nix
+++ b/pkgs/by-name/je/jellyfin/package.nix
@@ -14,13 +14,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jellyfin";
-  version = "10.11.10"; # ensure that jellyfin-web has matching version
+  version = "10.11.11"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bad532F8Ln5Y3TV4x5c7mgsiI+ZJGTZoahuSZhefMvQ=";
+    hash = "sha256-HCs4ZsutVoVH+bBZANjpPeMyV8e63Yemjg9DSr0R9zg=";
   };
 
   propagatedBuildInputs = [ sqlite ];
diff --git a/pkgs/by-name/k3/k3d/package.nix b/pkgs/by-name/k3/k3d/package.nix
index 7a6642680f83..d26b809d552a 100644
--- a/pkgs/by-name/k3/k3d/package.nix
+++ b/pkgs/by-name/k3/k3d/package.nix
@@ -17,16 +17,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "k3d";
-  version = "5.8.3";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "k3d-io";
     repo = "k3d";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UBiDDZf/UtgPGRV9WUnoC32wc64nthBpBheEYOTp6Hk=";
+    hash = "sha256-W/fcpIgpE6kn87EXNVU+K9rFis5QAvVC2LgthI9M6yg=";
   };
 
-  vendorHash = "sha256-lFmIRtkUiohva2Vtg4AqHaB5McVOWW5+SFShkNqYVZ8=";
+  vendorHash = "sha256-QRr8dmiqoNHu30OILwrS9AXK68hnNIqXlKMkASbcKVo=";
   deleteVendor = true;
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/ke/keepassxc/package.nix b/pkgs/by-name/ke/keepassxc/package.nix
index f4849334326b..682337647b57 100644
--- a/pkgs/by-name/ke/keepassxc/package.nix
+++ b/pkgs/by-name/ke/keepassxc/package.nix
@@ -196,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
       using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
     '';
     homepage = "https://keepassxc.org/";
+    donationPage = "https://keepassxc.org/donate/";
     changelog = "https://github.com/keepassxreboot/keepassxc/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.gpl2Plus;
     mainProgram = "keepassxc";
diff --git a/pkgs/by-name/li/libslirp/package.nix b/pkgs/by-name/li/libslirp/package.nix
index ed2e91c3e706..a7984b9e5b66 100644
--- a/pkgs/by-name/li/libslirp/package.nix
+++ b/pkgs/by-name/li/libslirp/package.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libslirp";
-  version = "4.9.1";
+  version = "4.9.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "slirp";
     repo = "libslirp";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-MKP3iBExaPQryiahI1l/4bTgVht5Vu8AxaDyMotqmMo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY=";
   };
 
   separateDebugInfo = true;
@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    changelog = "https://gitlab.freedesktop.org/slirp/libslirp/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "General purpose TCP-IP emulator";
     homepage = "https://gitlab.freedesktop.org/slirp/libslirp";
     license = lib.licenses.bsd3;
diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix
index ff93f8a46789..58f4552604a4 100644
--- a/pkgs/by-name/mi/misskey/package.nix
+++ b/pkgs/by-name/mi/misskey/package.nix
@@ -108,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
       runHook preInstall
 
       mkdir -p $out/data
+      sed -i '/"packageManager":/d' package.json
       cp -r . $out/data
 
       # Set up symlink for use at runtime
@@ -119,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
       makeWrapper ${pnpm}/bin/pnpm $out/bin/misskey \
         --run "${checkEnvVarScript} || exit" \
         --chdir $out/data \
+        --add-flag "--config.store-dir=/tmp/pnpm-store" \
         --add-flag "--config.verify-deps-before-run=false" \
         --add-flag run \
         --set-default NODE_ENV production \
diff --git a/pkgs/by-name/mu/muffet/package.nix b/pkgs/by-name/mu/muffet/package.nix
index 3fc4f08fc6b9..6e119f51b85c 100644
--- a/pkgs/by-name/mu/muffet/package.nix
+++ b/pkgs/by-name/mu/muffet/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "muffet";
-  version = "2.11.4";
+  version = "2.11.5";
 
   src = fetchFromGitHub {
     owner = "raviqqe";
     repo = "muffet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xczs3H1Jcr+WH8SCOhXRZx7Aft2BNpI+Kg4He8YEVVA=";
+    hash = "sha256-dPScTdOGR3cgcFBa09iez0/DkCugXseIGGRMiCPJeYo=";
   };
 
-  vendorHash = "sha256-94ytPGPbpXADIyDl28wWU2KmtwT17GyQFUe/bUc4RkA=";
+  vendorHash = "sha256-FXV+wP22R3gPAMGbhyz/v1Rk7w6z2ovoWirbLM1Wl24=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/ne/necesse-server/package.nix b/pkgs/by-name/ne/necesse-server/package.nix
index 73e8e1bf9b73..88e7c558b6e1 100644
--- a/pkgs/by-name/ne/necesse-server/package.nix
+++ b/pkgs/by-name/ne/necesse-server/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.2.0-22728942";
+  version = "1.2.0-23522718";
   urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
 in
@@ -15,8 +15,8 @@ stdenvNoCC.mkDerivation {
   inherit version;
 
   src = fetchzip {
-    url = "https://necessegame.com/content/server/${urlVersion}/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-kSBql3oHG368DczSM7FkWeAZcfTrNP1x31LX7HRrgTE=";
+    url = "https://necesse.pwn.sh/server/necesse-server-linux64-${urlVersion}.zip";
+    hash = "sha256-PIguTYULddLKj6PpoSvX3gNSvqrS7oRTOPuwoA0/XOc=";
   };
 
   # removing packaged jre since we use our own
diff --git a/pkgs/by-name/ne/necesse-server/update.sh b/pkgs/by-name/ne/necesse-server/update.sh
index 19c409d3700a..d034702d1713 100755
--- a/pkgs/by-name/ne/necesse-server/update.sh
+++ b/pkgs/by-name/ne/necesse-server/update.sh
@@ -3,13 +3,30 @@
 
 set -eu -o pipefail
 
+website=$(curl -sL https://necessegame.com/server)
+
 version=$(
-    curl -s http://www.necessegame.com/server \
+    echo "$website" \
         | pup 'a[href*="linux64"] text{}' \
         | awk -F'[v ]' '/Linux64/ {print $4"-"$6}' \
         | sort -Vu \
         | tail -n1
 )
 
-[[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]] \
-    && update-source-version necesse-server "$version"
+if [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]]; then
+    version_url=${version//./-}
+
+    # extract the expiring presigned S3 URL for the new zip
+    url=$(
+        echo "$website" \
+            | pup "a[href*=\"linux64-${version_url}\"] attr{href}" \
+            | sed 's/\&amp;/\&/g'
+    )
+
+    # call API to remote-fetch the zip immediately and keep it cached,
+    # then fetch the zip locally to get the SRI hash, then update.
+    # fails early if the zip cannot be remote-fetched / cached.
+    curl -s --fail-with-body "https://necesse.pwn.sh/cache.php?version=${version_url}" \
+        && sri=$(nix-prefetch-url --unpack "$url" | xargs nix hash convert --hash-algo sha256 --to sri) \
+        && update-source-version necesse-server "$version" "$sri"
+fi
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index 0f0f799d5ccd..ae0c858bf89f 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   gettext,
   libuv,
@@ -123,6 +124,11 @@ stdenv.mkDerivation (
       # necessary so that nix can handle `UpdateRemotePlugins` for the plugins
       # it installs. See https://github.com/neovim/neovim/issues/9413.
       ./system_rplugin_manifest.patch
+      (fetchpatch {
+        name = "CVE-2026-11487.patch";
+        url = "https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf.patch";
+        hash = "sha256-iWnq0ezbKYJqjvevVlcTJBvUc17ZvrhsanhtuKrh8zM=";
+      })
     ];
 
     inherit lua;
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
index 7ec6def5ca21..218eaa8d395f 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
@@ -314,13 +314,16 @@ It must be one of the following:
 	be made using _nixos_ function in nixpkgs or importing and calling
 	nixos/lib/eval-config.nix from nixpkgs. If specified without *--attr*
 	option, builds the configuration from the top-level attribute set of the
-	file.
+	file. Using this option disables automatic flake detection, same as
+	*--no-flake*.
 
 *--attr* _attrPath_, *-A* _attrPath_
 	Build the NixOS system from a nix file and use the specified
 	attribute path from the file specified by the *--file* option.
 	If specified without *--file* option, uses _system.nix_ in current directory,
 	the system-wide _<nixos-system>_ file, or finally, /etc/nixos/system.nix.
+	Using this option disables automatic flake detection, same as
+	*--no-flake*.
 
 *--flake* _flake-uri[#name]_, *-F* _flake-uri[#name]_
 	Build the NixOS system from the specified flake. It defaults to the
@@ -379,6 +382,10 @@ NIX_SSHOPTS
 NIX_SUDOOPTS
 	Additional options to be passed to sudo on the command line.
 
+NIXOS_REBUILD_NO_SYSTEMD_RUN
+	If set, then *nixos-rebuild* will run without the
+	_systemd-run_ wrapper.
+
 # FILES
 
 /etc/nixos/system.nix
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index c1ad2bde3d00..db0fe7a4ec5c 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -329,6 +329,10 @@ def parse_args(
     if args.flake and (args.file or args.attr):
         parser.error("--flake cannot be used with --file or --attr")
 
+    if (args.file or args.attr) and args.flake is None:
+        # Disable flake auto-detection when --file or --attr is used
+        args.flake = False
+
     if args.store_path:
         if args.rollback:
             parser.error("--store-path and --rollback are mutually exclusive")
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index c9d79868f8f4..4fbe7fbe2b9d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -708,6 +708,8 @@ def switch_to_configuration(
             "not working in target host"
         )
         cmd = []
+    elif os.environ.get("NIXOS_REBUILD_NO_SYSTEMD_RUN"):
+        cmd = []
 
     run_wrapper(
         [*cmd, path_to_config / "bin/switch-to-configuration", str(action)],
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 1e0e5779ac90..12bacafba8d5 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -89,6 +89,22 @@ def test_parse_args() -> None:
     assert r_store_path.flake is False
     assert r_store_path.store_path == "/nix/store/foo"
 
+    # --file and --attr should disable flake auto-detection
+    r_file, _ = nr.parse_args(["nixos-rebuild", "switch", "--file", "foo.nix"])
+    assert r_file.flake is False
+    assert r_file.file == "foo.nix"
+
+    r_attr, _ = nr.parse_args(["nixos-rebuild", "switch", "--attr", "bar"])
+    assert r_attr.flake is False
+    assert r_attr.attr == "bar"
+
+    r_file_attr, _ = nr.parse_args(
+        ["nixos-rebuild", "switch", "--file", "foo.nix", "--attr", "bar"]
+    )
+    assert r_file_attr.flake is False
+    assert r_file_attr.file == "foo.nix"
+    assert r_file_attr.attr == "bar"
+
     r1, g1 = nr.parse_args(
         [
             "nixos-rebuild",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 8100f396cdb7..1cdccc9a874e 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -819,6 +819,38 @@ def test_switch_to_configuration_without_systemd_run(
     )
 
 
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
+def test_switch_to_configuration_without_systemd_run_env_var(
+    mock_run: Any, monkeypatch: MonkeyPatch
+) -> None:
+    profile_path = Path("/path/to/profile")
+    mock_run.return_value = CompletedProcess([], 0)
+
+    with monkeypatch.context() as mp:
+        mp.setenv("LOCALE_ARCHIVE", "")
+        mp.setenv("NIXOS_REBUILD_NO_SYSTEMD_RUN", "1")
+
+        n.switch_to_configuration(
+            profile_path,
+            m.Action.SWITCH,
+            elevate=e.NO_ELEVATOR,
+            target_host=None,
+            specialisation=None,
+            install_bootloader=False,
+        )
+    mock_run.assert_called_with(
+        [profile_path / "bin/switch-to-configuration", "switch"],
+        env={
+            "LOCALE_ARCHIVE": e.PRESERVE_ENV,
+            "NIXOS_NO_CHECK": e.PRESERVE_ENV,
+            "NIXOS_INSTALL_BOOTLOADER": "0",
+        },
+        elevate=e.NO_ELEVATOR,
+        remote=None,
+        stdout=sys.stderr,
+    )
+
+
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_switch_to_configuration_with_systemd_run(
     mock_run: Mock, monkeypatch: MonkeyPatch
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 86699d35e31d..d2f5b86b850b 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.30.5";
+  version = "0.30.6";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jh/B/FkmAliCVzqc8DGCPYa5+XejE3cFZTzSuRxjPvw=";
+    hash = "sha256-qO+Tsjg64QekGHNNiNy5YGSDoToGSnqiN5hN+0LCp4Q=";
   };
 
   vendorHash = "sha256-lZdGzGb9xRjTm1Rm7/wHjqM490gLznLEndmb4mNbCX0=";
diff --git a/pkgs/by-name/op/openfga-cli/package.nix b/pkgs/by-name/op/openfga-cli/package.nix
index d91004e90f34..732640969d02 100644
--- a/pkgs/by-name/op/openfga-cli/package.nix
+++ b/pkgs/by-name/op/openfga-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga-cli";
-  version = "0.7.13";
+  version = "0.7.15";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nV0Y0oCPH0zRWdhjGhXqX7dkMwhlEjwucr3K6dN0vDg=";
+    hash = "sha256-KChWGGbrgAAbIW6JU6FBaxMbkxv50hNzcOK44ebt7hI=";
   };
 
-  vendorHash = "sha256-kzxuFP1D3oD2P2goU48nj40/4KyY9bDhf9gTtpuoz1I=";
+  vendorHash = "sha256-4PLtThxswBnxHhCI6zDePOge8lpqTfAYXkKbktP+C5E=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/op/openfga/package.nix b/pkgs/by-name/op/openfga/package.nix
index 4ec3cacd1cec..84df0c3a1540 100644
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga";
-  version = "1.14.2";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "openfga";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nY5HRkZCKgjr1a5XxxRcUwCms9PCQs3IZiFgAEaD7To=";
+    hash = "sha256-4vp2lyONLP5YJzbzJidg3+LAsQ/NhJAh+mvI2IrZWKI=";
   };
 
-  vendorHash = "sha256-q5NZLPtdwFeHzLi+ZmRzGScxkl0OOxTVo/W6yUL1lO8=";
+  vendorHash = "sha256-S47vnGCnDiXUMINc53X1n0vVqU8fs0LHz3vbdtNZjlY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pi/pipeform/package.nix b/pkgs/by-name/pi/pipeform/package.nix
new file mode 100644
index 000000000000..c4f6b3e4f529
--- /dev/null
+++ b/pkgs/by-name/pi/pipeform/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  libx11,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pipeform";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "magodo";
+    repo = "pipeform";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qmA+4xNstR1VRoYZW+xukNCEuEq6aGVkja3DYxZZVyY=";
+  };
+
+  vendorHash = "sha256-QI6Rnq3JxQuKRMkeo9Fvv6wfcTMgDEQ3Ot+es3IAUIA=";
+
+  subPackages = [ "." ];
+
+  __structuredAttrs = true;
+
+  # Clipboard support
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libx11 ];
+
+  meta = {
+    description = "TUI for Terraform runtime progress";
+    homepage = "https://github.com/magodo/pipeform";
+    license = lib.licenses.mpl20;
+    mainProgram = "pipeform";
+    maintainers = with lib.maintainers; [ jlesquembre ];
+  };
+})
diff --git a/pkgs/by-name/po/pocketbase/package.nix b/pkgs/by-name/po/pocketbase/package.nix
index 513a14fdb9d6..29a13537b49d 100644
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pocketbase";
-  version = "0.39.0";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4myp2MleKb6mAwDKhN39uyc5PZJhB3lvm2x/KDR9u0g=";
+    hash = "sha256-eCOGApbp/PLFpsX1GC2p56t3H+ksjiw5TL3iT7wnPGM=";
   };
 
-  vendorHash = "sha256-VBsClxCOA9Mp/kCHQKuBPd2Nt5sfXkVRx/8mGk5Gkcg=";
+  vendorHash = "sha256-ZKDMy+XUjCAvyis8wp9ddjuH+nFHh/A4bl5QZ33wtLE=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 17283dbc80ae..092a1e01d824 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -54,14 +54,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.5.0";
+  version = "2026.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-twXz3RaFujhZmARzZ5zIjGAwWchwhV8knq8Cr3h0Gjg=";
+    hash = "sha256-p4ZZzfoR4Wg65xeqk9JyCdZ+S7RqBVd1drWpHjj8oqc=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix b/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
index 415c77e9b913..75300aa7f258 100644
--- a/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
+++ b/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rabbitmqadmin-ng";
-  version = "2.29.0";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "rabbitmq";
     repo = "rabbitmqadmin-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-On4eUeFM4/GDfbGJ7249LTAu3srAbxU6vizsGP3sXj4=";
+    hash = "sha256-RCDjMOKPRRm1l9hcLPyxa6Qzf7fHXe1898SLqwZ+n7I=";
   };
 
-  cargoHash = "sha256-Xr6j5lCdl0CXj3nWBMawHAWoizrMR7KABC3nIFc9kgk=";
+  cargoHash = "sha256-VO7Kwm2mtED4/eirL6lsYSFMsyE8A2LdAFkXIjHFgUE=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 75992b42240e..8566e5251408 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.15";
+  version = "0.15.16";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-WpjOOCYLZ1d8XPUx3qNHD+fuK6t65u/1/ZezABWpBD0=";
+    hash = "sha256-krmHCLijp+D4gBjKV9cdicPob4ry5I6QwB3MUz0z7zA=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-SfkoLl43Y1DNqIRW+HljVcEHWhedTS99SGhMvkQ4dmo=";
+  cargoHash = "sha256-d2iV7iWf7lVhj1Bbaxxk5Zao4KK3oC7whppRvk0erzA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sp/spotiflac/package.nix b/pkgs/by-name/sp/spotiflac/package.nix
index 01c5c871325b..ad19754db2c0 100644
--- a/pkgs/by-name/sp/spotiflac/package.nix
+++ b/pkgs/by-name/sp/spotiflac/package.nix
@@ -18,14 +18,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "spotiflac";
-  version = "7.1.7";
+  version = "7.1.8";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "afkarxyz";
     repo = "SpotiFLAC";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2bCKsgrJH8jfggluNdNqX+LdG8NLcsuhrJwkaRTXAOs=";
+    hash = "sha256-Uz+9vsneP8xLGi5pgwYIufCPUzKSH4CRAdt0o+FifAM=";
   };
 
   nativeBuildInputs = [
@@ -88,7 +88,7 @@ buildGoModule (finalAttrs: {
     runHook postInstall;
   '';
 
-  vendorHash = "sha256-0H3U+i7SbbO7WkF9O8U8JoRxtroyEofzi2XrrWi6HWY=";
+  vendorHash = "sha256-dTrfLnuo7W3m3mg32wBDv8IbmQA44KXsazRLdanIi/Y=";
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/by-name/te/telemt/package.nix b/pkgs/by-name/te/telemt/package.nix
index b4df4da56277..254fdca322b0 100644
--- a/pkgs/by-name/te/telemt/package.nix
+++ b/pkgs/by-name/te/telemt/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "telemt";
-  version = "3.4.13";
+  version = "3.4.15";
 
   src = fetchFromGitHub {
     owner = "telemt";
     repo = "telemt";
     tag = version;
-    hash = "sha256-ChzvbbWS/h7bZXqG4h3Iftslzsv2Rad+hXx+SyY2p30=";
+    hash = "sha256-YnV6lE+NyI8Wqj4Lf37G0McJyWYatebTnGn7yObXs5k=";
   };
 
-  cargoHash = "sha256-UicmtNQvGUZJtj3I8zztyGiy+oU66LWwNV+MNpZ3omc=";
+  cargoHash = "sha256-ekVPICi/UyVrtAB9kHaFhBe0PXoxjgF85cQMtVEPGjY=";
 
   checkFlags = [
     # flaky: races between MiddleClientWriterCancelled and TrafficBudgetWaitCancelled observation paths
diff --git a/pkgs/by-name/te/tempo/package.nix b/pkgs/by-name/te/tempo/package.nix
index 4f8005cb77eb..35ecfead06ae 100644
--- a/pkgs/by-name/te/tempo/package.nix
+++ b/pkgs/by-name/te/tempo/package.nix
@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "tempo";
-  version = "2.10.5";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tempo";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-1eacaqyKyHF/uS0Ja7oq+YKn/3K2QpDmd6jysGVBOjg=";
+    hash = "sha256-KYb3QJ4jdPsEmxVCezpakRRDtdyeGc4JUgeCHkZTG50=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/tr/traccar/package.nix b/pkgs/by-name/tr/traccar/package.nix
index 856a07b8d20e..d91f3869b083 100644
--- a/pkgs/by-name/tr/traccar/package.nix
+++ b/pkgs/by-name/tr/traccar/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "traccar";
-  version = "6.13.0";
+  version = "6.13.3";
   nativeBuildInputs = [ pkgs.makeWrapper ];
 
   src = fetchzip {
     stripRoot = false;
     url = "https://github.com/traccar/traccar/releases/download/v${version}/traccar-other-${version}.zip";
-    hash = "sha256-nrAT/ewMpRXTN7bTU02VIJ4YoK5yvgfVZqMvQ1fXPo8=";
+    hash = "sha256-QQJ3+QByXkdfGBPA38F8+sQ72NnRbet6zcD3K82JLbI=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/tr/treefmt/check-wrapper.nix b/pkgs/by-name/tr/treefmt/check-wrapper.nix
new file mode 100644
index 000000000000..a7f16e0bdf90
--- /dev/null
+++ b/pkgs/by-name/tr/treefmt/check-wrapper.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  gitMinimal,
+  runCommandLocal,
+  stdenv,
+  wrapper,
+}:
+/**
+  Test that the given project tree is formatted with the treefmt config.
+
+  Input argument is the path to the project tree.
+*/
+project:
+runCommandLocal "${lib.getName wrapper}-check"
+  {
+    __structuredAttrs = true;
+    strictDeps = true;
+    nativeBuildInputs = [
+      gitMinimal
+      wrapper
+    ];
+    inherit project;
+    env = {
+      LANG = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+      LC_ALL = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+    };
+    meta.description = "Check that the project tree is formatted";
+  }
+  ''
+    # Copy project files into the build-dir
+    cp -r "$project" project
+    chmod -R a+w project
+    cd project
+
+    # Setup a git repo
+    git init --initial-branch main
+    git config user.name nixbld
+    git config user.email nixbld@example.com
+    git add .
+    git commit -m init --quiet
+
+    # Run treefmt
+    treefmt --version
+    treefmt --no-cache
+
+    # Ensure nothing changed
+    git status
+    git --no-pager diff --exit-code
+    touch "$out"
+  ''
diff --git a/pkgs/by-name/tr/treefmt/lib.nix b/pkgs/by-name/tr/treefmt/lib.nix
index a38fb5354bca..d7515833ed6c 100644
--- a/pkgs/by-name/tr/treefmt/lib.nix
+++ b/pkgs/by-name/tr/treefmt/lib.nix
@@ -40,6 +40,20 @@
   /**
     Wrap treefmt, configured using structured settings.
 
+    # Check
+
+    The resulting package has a `check` attribute of type `Path -> Derivation`.
+    The derivation returned will only build if the path supplied is already formatted correctly.
+
+    ```
+    { pkgs }:
+    let
+      myTreefmt = pkgs.treefmt.withConfig ./treefmt-config.nix;
+      project = ../.;
+    in
+    myTreefmt.check project
+    ```
+
     # Type
 
     ```
diff --git a/pkgs/by-name/tr/treefmt/modules/wrapper.nix b/pkgs/by-name/tr/treefmt/modules/wrapper.nix
index d736db5b5d77..b394912ce0b1 100644
--- a/pkgs/by-name/tr/treefmt/modules/wrapper.nix
+++ b/pkgs/by-name/tr/treefmt/modules/wrapper.nix
@@ -15,7 +15,7 @@
     internal = true;
   };
 
-  config.result = pkgs.symlinkJoin {
+  config.result = pkgs.symlinkJoin (finalAttrs: {
     pname = config.name;
     inherit (config.package) meta version;
     nativeBuildInputs = [ pkgs.makeBinaryWrapper ];
@@ -27,11 +27,14 @@
     passthru = {
       inherit (config) runtimeInputs;
       inherit config options;
+      check = pkgs.callPackage ../check-wrapper.nix {
+        wrapper = finalAttrs.finalPackage;
+      };
     };
     postBuild = ''
       wrapProgram "$out/bin/treefmt" \
         --prefix PATH : "$binPath" \
         --add-flags "--config-file $configFile"
     '';
-  };
+  });
 }
diff --git a/pkgs/by-name/tr/treefmt/tests.nix b/pkgs/by-name/tr/treefmt/tests.nix
index 57bcfda45cd3..80b3a9e8712e 100644
--- a/pkgs/by-name/tr/treefmt/tests.nix
+++ b/pkgs/by-name/tr/treefmt/tests.nix
@@ -1,6 +1,7 @@
 {
   lib,
   runCommand,
+  runCommandLocal,
   testers,
   treefmt,
   nixfmt,
@@ -31,6 +32,28 @@ let
     settings = nixfmtExampleConfig;
     runtimeInputs = [ nixfmt ];
   };
+
+  wellFormattedTree = runCommandLocal "well-formatted-project" { } ''
+    mkdir "$out"
+    cat > "$out/file.nix" <<EOF
+    {
+      foo = "bar";
+      attrs = { };
+      list = [ ];
+    }
+    EOF
+  '';
+
+  unformattedTree = runCommandLocal "unformatted-project" { } ''
+    mkdir "$out"
+    cat > "$out/file.nix" <<EOF
+    {
+      foo="bar";
+      attrs={};
+      list=[];
+    }
+    EOF
+  '';
 in
 {
   buildConfigEmpty = testEqualContents {
@@ -68,6 +91,22 @@ in
     '';
   };
 
+  nixfmtExampleCheckPasses = nixfmtExamplePackage.check wellFormattedTree;
+
+  nixfmtExampleCheckFails = testers.testBuildFailure' {
+    drv = nixfmtExamplePackage.check unformattedTree;
+    expectedBuilderExitCode = 1;
+    expectedBuilderLogEntries = [
+      "diff --git a/file.nix b/file.nix"
+      "-  foo=\"bar\";"
+      "+  foo = \"bar\";"
+      "-  attrs={};"
+      "+  attrs = { };"
+      "-  list=[];"
+      "+  list = [ ];"
+    ];
+  };
+
   runNixfmtExample =
     runCommand "run-nixfmt-example"
       {
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 8b1c65bf1be6..fad959f944ae 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.40";
+  version = "0.0.44";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-kdfPnyQXYtf3BDrYCFGfX0bMoPGjRpyH3aUeRZBiUKY=";
+    hash = "sha256-P19+C6u0mkIrR0H8M/l7Wn3r8JSY4Ul9p64oXaLdWCQ=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-yUbHTzUGNdpm3b1s/SkcpFGdp7WjN+xO+CVrPPwrh6A=";
+  cargoHash = "sha256-d2iV7iWf7lVhj1Bbaxxk5Zao4KK3oC7whppRvk0erzA=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
diff --git a/pkgs/by-name/un/unblob/package.nix b/pkgs/by-name/un/unblob/package.nix
index 0a8c427d0947..552040ab866e 100644
--- a/pkgs/by-name/un/unblob/package.nix
+++ b/pkgs/by-name/un/unblob/package.nix
@@ -46,21 +46,21 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "unblob";
-  version = "26.3.30";
+  version = "26.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "onekey-sec";
     repo = "unblob";
     tag = version;
-    hash = "sha256-wYWuKvxAagctlmdO5Fi9/WzfJ4zkDgfXejgDTJPHsTI=";
+    hash = "sha256-NV4xnTejDW8mTxv0BGB4n+M/bxTMd4GWQQPXhqw5f2Y=";
     forceFetchGit = true;
     fetchLFS = true;
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-wjN4QPOUYFWWYMWL9aAgGqEucM7q+H6YyoS9Mv2dpp4=";
+    hash = "sha256-lEpnpvPwred1KRXxuM1KPxKbIIJUGvR0tmj16QyL5UQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
index 0358e2142496..472f808922dd 100644
--- a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
+++ b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
@@ -9,12 +9,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20260531040030";
+    version = "20260609060640";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-+3lr7x+Ye2FcNjPNlxzI51yaNjQZl0CKeJ497HQZkm0=";
+      hash = "sha256-iedleoE+KXtCSEVgC7R8nSWgTFBXEVnp56J/PsmQ41I=";
     };
     vendorHash = "sha256-9tXv+rDBowxDN9gH4zHCr4TRbic4kijco3Y6bojJKRk=";
     meta = {
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index 19a3314a36e9..aac3d80afcfe 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -100,12 +100,12 @@ let
   allPkgs = pkgs;
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.2.0";
+  version = "11.3.0";
   pname = "octave";
 
   src = fetchurl {
     url = "mirror://gnu/octave/octave-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-zV0nMbYchh/yDKMN3ezrNmREuRjHoulZmG8DrsNuT6I=";
+    sha256 = "sha256-y1if6zzvhNE0hUaDcYycE+C0ceqRbQdhvnqMTiYaMtE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 6a1c35e82706..5b0e2f5593e9 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -490,6 +490,38 @@ final: prev: {
     }
   ) { };
 
+  coop-nvim = callPackage (
+    {
+      buildLuarocksPackage,
+      fetchFromGitHub,
+      fetchurl,
+      luaOlder,
+    }:
+    buildLuarocksPackage {
+      pname = "coop.nvim";
+      version = "1.2.0-0";
+      knownRockspec =
+        (fetchurl {
+          url = "mirror://luarocks/coop.nvim-1.2.0-0.rockspec";
+          sha256 = "1fkpdddk2c2wibk0khgmvr03in2hz8wd3gdmmfbfbpb6jybhcckg";
+        }).outPath;
+      src = fetchFromGitHub {
+        owner = "gregorias";
+        repo = "coop.nvim";
+        rev = "b156e541316aee14be4ae64c93ed8bddb6d03bc1";
+        hash = "sha256-S6iGmdakI714Im0tetgfASbe0K4/olYsjj26+WP+rSU=";
+      };
+
+      disabled = luaOlder "5.1";
+
+      meta = {
+        homepage = "https://github.com/gregorias/coop.nvim";
+        license = lib.licenses.gpl3Only;
+        description = "A Neovim plugin for structured concurrency with coroutines.";
+      };
+    }
+  ) { };
+
   cosmo = callPackage (
     {
       buildLuarocksPackage,
diff --git a/pkgs/development/python-modules/emmiai-noether/default.nix b/pkgs/development/python-modules/emmiai-noether/default.nix
index 0568a24f7acd..d2e626088d01 100644
--- a/pkgs/development/python-modules/emmiai-noether/default.nix
+++ b/pkgs/development/python-modules/emmiai-noether/default.nix
@@ -51,6 +51,7 @@ buildPythonPackage (finalAttrs: {
 
   pythonRelaxDeps = [
     "numpy"
+    "torch"
   ];
   dependencies = [
     aistore
@@ -87,6 +88,23 @@ buildPythonPackage (finalAttrs: {
     "test_total_cpu_count_linux"
     "test_total_cpu_count_mac"
     "test_total_cpu_count_windows"
+
+    # Numerical precision asertion errors since torch was updated to 2.12.0
+    # AssertionError: Output is not as expected
+    "test_ab_upt_determinism_regression_check"
+    "test_double_kwargs"
+    "test_forward_shape"
+    "test_forward_transolver_attention"
+    "test_forward_with_mask"
+    "test_perceiver_attention_forward_shape"
+    "test_perceiver_block_forward"
+    "test_rope_perceiver"
+    "test_rope_transformer"
+    "test_single"
+    "test_transformer_block_forward"
+    "test_transformer_determinism_regression_check"
+    "test_transolver_determinism_regression_check"
+    "test_upt_determinism_regression_check"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # flaky: assert 0.32007395901018754 == 0.3 ± 0.02
diff --git a/pkgs/development/python-modules/libmobility/default.nix b/pkgs/development/python-modules/libmobility/default.nix
new file mode 100644
index 000000000000..bb4b74e1ffe7
--- /dev/null
+++ b/pkgs/development/python-modules/libmobility/default.nix
@@ -0,0 +1,170 @@
+{
+  lib,
+  config,
+  buildPythonPackage,
+  fetchFromGitHub,
+  python,
+
+  # build-system
+  cmake,
+  nanobind,
+  setuptools,
+
+  # nativeBuildInputs
+  autoAddDriverRunpath,
+  cudaPackages,
+
+  # buildInputs
+  blas,
+  lapack,
+
+  # dependencies
+  numpy,
+  scipy,
+
+  # tests
+  pytest-xdist,
+  pytestCheckHook,
+
+  # passthru
+  libmobility,
+}:
+let
+  uammd-src = fetchFromGitHub {
+    owner = "RaulPPelaez";
+    repo = "uammd";
+    tag = "v3.0.1";
+    hash = "sha256-/7ceXlA96dZQs1WzkV1OpRv61xa0Tdt5gFe17I0s1BI=";
+  };
+in
+buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs: {
+  pname = "libmobility";
+  version = "1.1.2";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "stochasticHydroTools";
+    repo = "libMobility";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7jUpVR4bS9vkgeKN68of6VNZzGPlQMcRMBStQ+wFEx4=";
+  };
+
+  postPatch =
+    # Various setup.py patches:
+    # - Inject nix's cmakeFlags
+    # - Patch install destination
+    # - Don't let setuptools ship the `solvers/` directory as the package is
+    #   already installed by cmake
+    # - Patch the version
+    ''
+      substituteInPlace setup.py \
+        --replace-fail \
+          "cmake_args = [" \
+          "cmake_args = [${lib.concatStringsSep "," (map (f: "'${f}'") finalAttrs.cmakeFlags)}," \
+        --replace-fail \
+          "sys.prefix" \
+          'os.environ["out"]' \
+        --replace-fail \
+          "packages=find_packages()," \
+          "packages=[]," \
+        --replace-fail \
+          'version = "0"' \
+          'version = "${finalAttrs.version}"'
+    ''
+    # Upstream installs the modules into the (read-only) absolute `Python_SITEARCH`.
+    # Make the destination relative so it lands under CMAKE_INSTALL_PREFIX ($out).
+    + ''
+      substituteInPlace solvers/CMakeLists.txt \
+        --replace-fail "$""{Python_SITEARCH}" "${python.sitePackages}"
+    ''
+    # The C++ test suite unconditionally fetches googletest over the network and
+    # is not run here (it requires a GPU); drop it.
+    + ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail "add_subdirectory(tests/cpp)" ""
+    '';
+
+  build-system = [
+    cmake
+    nanobind
+    setuptools
+  ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    cudaPackages.cuda_nvcc
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_UAMMD" uammd-src.outPath)
+    (lib.cmakeFeature "nanobind_DIR" "${nanobind}/${python.sitePackages}/nanobind/cmake")
+  ];
+
+  env = {
+    CMAKE_CUDA_ARCHITECTURES = cudaPackages.flags.cmakeCudaArchitecturesString;
+  };
+
+  preBuild = ''
+    export BUILD_JOBS="$NIX_BUILD_CORES"
+  '';
+
+  buildInputs = [
+    blas
+    lapack
+  ]
+  ++ (with cudaPackages; [
+    cuda_cccl # <nv/target>
+    cuda_cudart # CUDA::cuda_driver (driver stub)
+    libcublas
+    libcufft
+    libcurand
+    libcusolver
+  ]);
+
+  dependencies = [
+    numpy
+    scipy
+  ];
+
+  pythonImportsCheck = [ "libMobility" ];
+
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # FileNotFoundError: [Errno 2] No such file or directory: './ref/pair_mobility_nbody_freespace.npz'
+    "test_pair_mobility_angular_nbody"
+
+    # AssertionError (numerical assertion)
+    "test_deterministic_divM_matches_rfd"
+    "test_non_square_box"
+
+    # TypeError: Iterator operand 1 dtype could not be cast from dtype('complex128') to
+    # dtype('float64') according to the rule 'safe'
+    "test_fluctuation_dissipation_angular_displacements"
+
+    # Extremely long
+    "test_fluctuation_dissipation_linear_displacements"
+  ];
+
+  # Tests require GPU access
+  doCheck = false;
+  passthru.gpuCheck = libmobility.overridePythonAttrs {
+    requiredSystemFeatures = [ "cuda" ];
+    doCheck = true;
+  };
+
+  meta = {
+    description = "Python interface to a collection of GPU hydrodynamic mobility solvers";
+    homepage = "https://github.com/stochasticHydroTools/libMobility";
+    changelog = "https://github.com/stochasticHydroTools/libMobility/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.linux;
+    broken = !config.cudaSupport;
+  };
+})
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index 81de08cf79c3..3ce65bf5f059 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
-  pythonRelaxDeps = [ "rns" ];
-
   buildInputs = lib.optionals (!propagateRns) [
     rns
   ];
diff --git a/pkgs/development/python-modules/python-duco-connectivity/default.nix b/pkgs/development/python-modules/python-duco-connectivity/default.nix
new file mode 100644
index 000000000000..987422109bdd
--- /dev/null
+++ b/pkgs/development/python-modules/python-duco-connectivity/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  aioresponses,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "python-duco-connectivity";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ronaldvdmeer";
+    repo = "python-duco-connectivity";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AH8EhC0v8GDNvPSUaTownV9d4upvKRiO//2sipGHz9g=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [
+    aioresponses
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "duco_connectivity" ];
+
+  meta = {
+    description = "Async HTTP client for the local Duco Connectivity API";
+    homepage = "https://github.com/ronaldvdmeer/python-duco-connectivity";
+    changelog = "https://github.com/ronaldvdmeer/python-duco-connectivity/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 2ab0dc34895e..81b59755d7c4 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   cryptography,
   esptool,
-  fetchFromGitHub,
+  fetchPypi,
   netifaces,
   pyserial,
   replaceVars,
@@ -14,15 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.3.4";
+  version = "1.3.5";
   pyproject = true;
   __structuredAttrs = true;
 
-  src = fetchFromGitHub {
-    owner = "markqvist";
-    repo = "Reticulum";
-    tag = finalAttrs.version;
-    hash = "sha256-rhZfkSV2OtCVPbUyTrYry2lwIeSfz3JnX+mVTkZt+Rc=";
+  src = fetchPypi {
+    pname = "rns";
+    version = finalAttrs.version;
+    hash = "sha256-YxReocD6Ump5FMCnLEqCJ5tZcZh1kYsFWNBJ0pGYzuM=";
   };
 
   patches = [
@@ -49,7 +48,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Cryptography-based networking stack for wide-area networks";
     homepage = "https://reticulum.network";
-    changelog = "https://github.com/markqvist/Reticulum/blob/${finalAttrs.src.tag}/Changelog.md";
+    changelog = "https://github.com/markqvist/Reticulum/blob/${finalAttrs.version}/Changelog.md";
     # Reticulum License
     # https://github.com/markqvist/Reticulum/blob/master/LICENSE
     license = lib.licenses.unfree;
diff --git a/pkgs/development/python-modules/transformer-engine/default.nix b/pkgs/development/python-modules/transformer-engine/default.nix
index 6cb337762753..6a656dd359d8 100644
--- a/pkgs/development/python-modules/transformer-engine/default.nix
+++ b/pkgs/development/python-modules/transformer-engine/default.nix
@@ -80,7 +80,7 @@ let
 in
 buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
   pname = "transformer-engine";
-  version = "2.15";
+  version = "2.16";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -90,7 +90,7 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
     tag = "v${finalAttrs.version}";
     # Their CMakeLists.txt does not easily let us inject dependencies
     fetchSubmodules = true;
-    hash = "sha256-0a6etDttNoTL1pe2OZb1CcS0/AtozeAG8NFz2Hkppn8=";
+    hash = "sha256-PUs/qIdF894232GmdjLsDD2rzU5NPTt/u20v93yZTog=";
   };
 
   patches = optionals cudaSupport [
diff --git a/pkgs/development/tools/asn2quickder/default.nix b/pkgs/development/tools/asn2quickder/default.nix
index 14c5fe339cf7..99c6dcee3e9e 100644
--- a/pkgs/development/tools/asn2quickder/default.nix
+++ b/pkgs/development/tools/asn2quickder/default.nix
@@ -1,16 +1,11 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitLab,
   makeWrapper,
-  cmake,
-  six,
-  pyparsing,
-  asn1ate,
-  colored,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "asn2quickder";
   version = "1.7.1";
   format = "setuptools";
@@ -33,10 +28,10 @@ buildPythonApplication rec {
 
   nativeBuildInputs = [
     makeWrapper
-    cmake
+    python3Packages.cmake
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pyparsing
     asn1ate
     six
diff --git a/pkgs/development/tools/enochecker-test/default.nix b/pkgs/development/tools/enochecker-test/default.nix
index 54fe3e3521a3..bda92eaf7153 100644
--- a/pkgs/development/tools/enochecker-test/default.nix
+++ b/pkgs/development/tools/enochecker-test/default.nix
@@ -1,25 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-
-  certifi,
-  charset-normalizer,
-  enochecker-core,
-  exceptiongroup,
-  idna,
-  iniconfig,
-  jsons,
-  packaging,
-  pluggy,
-  pytest,
-  requests,
-  tomli,
-  typish,
-  urllib3,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "enochecker-test";
   version = "0.9.0";
   format = "setuptools";
@@ -35,7 +20,7 @@ buildPythonApplication rec {
 
   pythonRelaxDeps = true;
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     certifi
     charset-normalizer
     enochecker-core
diff --git a/pkgs/development/tools/misc/cvise/default.nix b/pkgs/development/tools/misc/cvise/default.nix
index 9c170e7c3ea9..0dc731809d4f 100644
--- a/pkgs/development/tools/misc/cvise/default.nix
+++ b/pkgs/development/tools/misc/cvise/default.nix
@@ -1,23 +1,18 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   clang-tools,
-  cmake,
   colordiff,
   flex,
   libclang,
   llvm,
   unifdef,
-  chardet,
-  pebble,
-  psutil,
-  pytestCheckHook,
   testers,
   cvise,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cvise";
   version = "2.12.0";
   pyproject = false;
@@ -46,7 +41,7 @@ buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
-    cmake
+    python3Packages.cmake # TODO: swap this out for the non-python cmake
     flex
     llvm.dev
   ];
@@ -58,14 +53,14 @@ buildPythonApplication rec {
     unifdef
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     chardet
     pebble
     psutil
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    python3Packages.pytestCheckHook
     unifdef
   ];
 
diff --git a/pkgs/development/tools/misc/gdbgui/default.nix b/pkgs/development/tools/misc/gdbgui/default.nix
index 0998ecaa38ba..a64c37640a15 100644
--- a/pkgs/development/tools/misc/gdbgui/default.nix
+++ b/pkgs/development/tools/misc/gdbgui/default.nix
@@ -1,23 +1,19 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
   gdb,
-  eventlet,
-  flask-compress,
-  flask-socketio,
-  pygdbmi,
-  pygments,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "gdbgui";
 
   version = "0.15.3.0";
   format = "setuptools";
 
   buildInputs = [ gdb ];
-  propagatedBuildInputs = [
+
+  propagatedBuildInputs = with python3Packages; [
     eventlet
     flask-compress
     flask-socketio
diff --git a/pkgs/development/tools/misc/yakut/default.nix b/pkgs/development/tools/misc/yakut/default.nix
index 5380c7e1d6ff..12bd27538ddc 100644
--- a/pkgs/development/tools/misc/yakut/default.nix
+++ b/pkgs/development/tools/misc/yakut/default.nix
@@ -1,22 +1,11 @@
 {
   lib,
-  buildPythonApplication,
-  fetchPypi,
   stdenv,
-  click,
-  coloredlogs,
-  mido,
-  psutil,
-  pycyphal,
-  pysdl2,
-  python-rtmidi,
-  ruamel-yaml,
-  requests,
-  scipy,
-  simplejson,
+  python3Packages,
+  fetchPypi,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "yakut";
   version = "0.14.2";
   format = "setuptools";
@@ -29,7 +18,8 @@ buildPythonApplication rec {
   buildInputs = [
     (lib.getLib stdenv.cc.cc)
   ];
-  dependencies = [
+
+  dependencies = with python3Packages; [
     click
     coloredlogs
     psutil
@@ -39,7 +29,8 @@ buildPythonApplication rec {
     scipy
     simplejson
   ];
-  optional-dependencies.joystick = [
+
+  optional-dependencies.joystick = with python3Packages; [
     pysdl2
     mido
     python-rtmidi
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
index 243bae936cf9..b823fdb21359 100644
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -1,10 +1,9 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
   fetchpatch,
-  buildPythonApplication,
   appstream-glib,
-  dbus-python,
   desktop-file-utils,
   gettext,
   glib,
@@ -14,14 +13,11 @@
   libappindicator,
   libhandy,
   meson,
-  ninja,
   pkg-config,
-  pygobject3,
-  pyxdg,
   wrapGAppsHook3,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cpupower-gui";
   version = "1.0.0";
 
@@ -57,15 +53,13 @@ buildPythonApplication rec {
     gobject-introspection # need for gtk namespace to be available
     hicolor-icon-theme # needed for postinstall script
     meson
-    ninja
+    python3Packages.ninja # TODO: maybe swap out for the non-python package
     pkg-config
     wrapGAppsHook3
-
-    # Python packages
-    dbus-python
+    python3Packages.dbus-python
     libappindicator
-    pygobject3
-    pyxdg
+    python3Packages.pygobject3
+    python3Packages.pyxdg
   ];
 
   buildInputs = [
@@ -75,10 +69,10 @@ buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = [
-    dbus-python
+    python3Packages.dbus-python
     libappindicator
-    pygobject3
-    pyxdg
+    python3Packages.pygobject3
+    python3Packages.pyxdg
   ];
 
   mesonFlags = [
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index e5f06e7d481d..f46e25f2c6be 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -248,6 +248,10 @@ let
       BOUNCE = option yes;
     };
 
+    iommu = lib.optionalAttrs stdenv.hostPlatform.isAarch64 {
+      ARM_SMMU_V3_SVA = whenAtLeast "5.9" yes;
+    };
+
     memtest = {
       MEMTEST = yes;
     };
@@ -672,6 +676,10 @@ let
       USB_DWC3_DUAL_ROLE = yes;
 
       USB_XHCI_SIDEBAND = whenAtLeast "6.16" yes; # needed for audio offload
+
+      # The default (=y) forces us to have the XHCI firmware available in initrd,
+      # which our initrd builder can't currently do easily.
+      USB_XHCI_TEGRA = lib.mkIf stdenv.hostPlatform.isAarch64 module;
     };
 
     usb-serial = {
@@ -798,7 +806,9 @@ let
       FORTIFY_SOURCE = option yes;
 
       # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
-      DEBUG_LIST = yes;
+      DEBUG_LIST = whenOlder "6.6" yes;
+      # https://git.kernel.org/torvalds/c/aebc7b0d8d91bbc69e976909963046bc48bca4fd
+      LIST_HARDENED = whenAtLeast "6.6" yes;
 
       HARDENED_USERCOPY = yes;
       RANDOMIZE_BASE = option yes;
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index f2e87f79b99c..a44bc74bacac 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.1-rc6",
-        "hash": "sha256:1fmbsjhdrkzim6vzqc40raikv1szfw28q0lbvap8a1g77an0qi58",
+        "version": "7.1-rc7",
+        "hash": "sha256:1jncfqvbiwsvvhiqs23paiy7xvsbmqcpxj02jwvy0albp16kfxd7",
         "lts": false
     },
     "6.1": {
@@ -25,18 +25,18 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.92",
-        "hash": "sha256:0gly5wld3x8l0f3zk9pspsw1q2d7zbjbx4c2ndb49b1wvfvpdqqg",
+        "version": "6.12.93",
+        "hash": "sha256:18sg154hqw8l98pfim2hjm1y604h5dwn9gj3gyncas8bgjl4h9j9",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.34",
-        "hash": "sha256:0q6palsvwx0gnisjr658hlngfpvyzv0k5q4pvdk23122zcr4f334",
+        "version": "6.18.35",
+        "hash": "sha256:0dpjprjzc4w44kw49jcgx1ffrm6gxn2gsnsz3hhmw4hr4a9h51pp",
         "lts": true
     },
     "7.0": {
-        "version": "7.0.11",
-        "hash": "sha256:012307ni1v555a1rgzsxsg99pj8fplrghvhw0jk3c4d0vmb86v75",
+        "version": "7.0.12",
+        "hash": "sha256:1nk5lans9qg1avmmcwyadfps43d3hyjz9a5gjyvsc77w3sjckvap",
         "lts": false
     }
 }
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 2f3e5ad9d191..57517472e08f 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -142,14 +142,12 @@ optionalAttrs allowAliases aliases
           runCommand name
             {
               nativeBuildInputs = [ jq ];
-              value = builtins.toJSON value;
+              inherit value;
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              valuePath="$TMPDIR/value"
-              printf "%s" "$value" > "$valuePath"
-              jq . "$valuePath" > $out
+              jq .value "$NIX_ATTRS_JSON_FILE" > $out
             ''
         ) { };
 
@@ -167,14 +165,12 @@ optionalAttrs allowAliases aliases
           runCommand name
             {
               nativeBuildInputs = [ remarshal_0_17 ];
-              value = builtins.toJSON value;
+              inherit value;
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              valuePath="$TMPDIR/value"
-              printf "%s" "$value" > "$valuePath"
-              json2yaml "$valuePath" "$out"
+              json2yaml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out"
             ''
         ) { };
 
@@ -192,14 +188,12 @@ optionalAttrs allowAliases aliases
           runCommand name
             {
               nativeBuildInputs = [ remarshal ];
-              value = builtins.toJSON value;
+              inherit value;
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              valuePath="$TMPDIR/value"
-              printf "%s" "$value" > "$valuePath"
-              json2yaml "$valuePath" "$out"
+              json2yaml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out"
             ''
         ) { };
 
@@ -938,8 +932,8 @@ optionalAttrs allowAliases aliases
                 python3
                 black
               ];
-              imports = builtins.toJSON (value._imports or [ ]);
-              value = builtins.toJSON (removeAttrs value [ "_imports" ]);
+              imports = value._imports or [ ];
+              value = removeAttrs value [ "_imports" ];
               pythonGen = pkgs.writeText "pythonGen" ''
                 import json
                 import os
@@ -962,26 +956,20 @@ optionalAttrs allowAliases aliases
                     else:
                         return repr(value)
 
-                with open(os.environ["importsPath"], "r") as f:
-                    imports = json.load(f)
-                    if imports is not None:
-                        for i in imports:
+                with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
+                    attrs = json.load(f)
+                    if attrs["imports"] is not None:
+                        for i in attrs["imports"]:
                             print(f"import {i}")
                         print()
 
-                with open(os.environ["valuePath"], "r") as f:
-                    for key, value in json.load(f).items():
+                    for key, value in attrs["value"].items():
                         print(f"{key} = {recursive_repr(value)}")
               '';
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              export importsPath="$TMPDIR/imports"
-              printf "%s" "$imports" > "$importsPath"
-              export valuePath="$TMPDIR/value"
-              printf "%s" "$value" > "$valuePath"
-              cat "$valuePath"
               python3 "$pythonGen" > $out
               black $out
             ''
@@ -1011,14 +999,14 @@ optionalAttrs allowAliases aliases
                   python3Packages.xmltodict
                   libxml2Python
                 ];
-                value = builtins.toJSON value;
+                inherit value;
                 pythonGen = pkgs.writeText "pythonGen" ''
                   import json
                   import os
                   import xmltodict
 
-                  with open(os.environ["valuePath"], "r") as f:
-                      print(xmltodict.unparse(json.load(f), full_document=${
+                  with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
+                      print(xmltodict.unparse(json.load(f)["value"], full_document=${
                         if withHeader then "True" else "False"
                       }, pretty=True, indent=" " * 2))
                 '';
@@ -1026,8 +1014,6 @@ optionalAttrs allowAliases aliases
                 __structuredAttrs = true;
               }
               ''
-                export valuePath="$TMPDIR/value"
-                printf "%s" "$value" > "$valuePath"
                 python3 "$pythonGen" > $out
                 xmllint $out > /dev/null
               ''
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 4ac6ec7ea259..5f244f47270b 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -1496,7 +1496,8 @@
       ];
     "duco" =
       ps: with ps; [
-      ]; # missing inputs: python-duco-connectivity
+        python-duco-connectivity
+      ];
     "dunehd" =
       ps: with ps; [
         pdunehd
@@ -7927,6 +7928,7 @@
     "dsmr"
     "dsmr_reader"
     "duckdns"
+    "duco"
     "dunehd"
     "duotecno"
     "dwd_weather_warnings"
diff --git a/pkgs/tools/inputmethods/input-remapper/default.nix b/pkgs/tools/inputmethods/input-remapper/default.nix
index 6a27efe55775..3b7a60156f8e 100644
--- a/pkgs/tools/inputmethods/input-remapper/default.nix
+++ b/pkgs/tools/inputmethods/input-remapper/default.nix
@@ -1,8 +1,7 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  pkgconfig,
   wrapGAppsHook3,
   gettext,
   gtk3,
@@ -10,12 +9,6 @@
   dbus,
   gobject-introspection,
   xmodmap,
-  pygobject3,
-  setuptools,
-  evdev,
-  pydantic,
-  pydbus,
-  psutil,
   procps,
   gtksourceview4,
   bash,
@@ -37,7 +30,7 @@
 let
   maybeXmodmap = lib.optional withXmodmap xmodmap;
 in
-(buildPythonApplication rec {
+(python3Packages.buildPythonApplication rec {
   pname = "input-remapper";
   version = "2.2.0";
   format = "setuptools";
@@ -66,11 +59,11 @@ in
     gtk3
     glib
     gobject-introspection
-    pygobject3
+    python3Packages.pygobject3
   ]
   ++ maybeXmodmap;
 
-  dependencies = [
+  dependencies = with python3Packages; [
     setuptools # needs pkg_resources
     pygobject3
     evdev
@@ -86,7 +79,7 @@ in
     udevCheckHook
     versionCheckHook
   ]
-  ++ lib.optionals withDoCheck [ psutil ];
+  ++ lib.optionals withDoCheck [ python3Packages.psutil ];
 
   versionCheckProgram = "${placeholder "out"}/bin/input-remapper-control";
 
diff --git a/pkgs/tools/misc/online-judge-template-generator/default.nix b/pkgs/tools/misc/online-judge-template-generator/default.nix
index 1335fcc6a52e..1f4592222a88 100644
--- a/pkgs/tools/misc/online-judge-template-generator/default.nix
+++ b/pkgs/tools/misc/online-judge-template-generator/default.nix
@@ -1,21 +1,10 @@
 {
   lib,
-  buildPythonApplication,
-  appdirs,
-  beautifulsoup4,
-  colorlog,
+  python3Packages,
   fetchFromGitHub,
-  mako,
-  online-judge-api-client,
-  online-judge-tools,
-  ply,
-  pyyaml,
-  requests,
-  setuptools,
-  toml,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "online-judge-template-generator";
   version = "4.8.1";
   format = "setuptools";
@@ -27,7 +16,7 @@ buildPythonApplication rec {
     sha256 = "sha256-cS1ED1a92fEFqy6ht8UFjxocWIm35IA/VuaPSLsdlqg=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     appdirs
     beautifulsoup4
     colorlog
diff --git a/pkgs/tools/misc/pandoc-acro/default.nix b/pkgs/tools/misc/pandoc-acro/default.nix
index 95f15d32d76c..73b6c937ff55 100644
--- a/pkgs/tools/misc/pandoc-acro/default.nix
+++ b/pkgs/tools/misc/pandoc-acro/default.nix
@@ -1,9 +1,7 @@
 {
-  buildPythonApplication,
-  fetchPypi,
-  pandocfilters,
-  panflute,
   lib,
+  python3Packages,
+  fetchPypi,
   pandoc,
   pandoc-acro,
   texliveTeTeX,
@@ -19,11 +17,11 @@ let
     hash = "sha256-JMfSQXX+BCGdFQYPFB+r08WRnhT3aXfnBNINROxCUA0=";
   };
 in
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   format = "setuptools";
   inherit pname version src;
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pandocfilters
     panflute
   ];
diff --git a/pkgs/tools/misc/pandoc-drawio-filter/default.nix b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
index c49a057289b1..dad4b5e784be 100644
--- a/pkgs/tools/misc/pandoc-drawio-filter/default.nix
+++ b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
@@ -1,10 +1,9 @@
 {
-  buildPythonApplication,
-  drawio-headless,
-  fetchFromGitHub,
   lib,
+  python3Packages,
+  fetchFromGitHub,
+  drawio-headless,
   pandoc,
-  pandocfilters,
   runCommand,
   texliveTeTeX,
 }:
@@ -19,7 +18,7 @@ let
     sha256 = "sha256-2XJSAfxqEmmamWIAM3vZqi0mZjUUugmR3zWw8Imjadk=";
   };
 
-  pandoc-drawio-filter = buildPythonApplication {
+  pandoc-drawio-filter = python3Packages.buildPythonApplication {
     format = "setuptools";
     pname = "pandoc-drawio-filter";
 
@@ -27,7 +26,7 @@ let
 
     propagatedBuildInputs = [
       drawio-headless
-      pandocfilters
+      python3Packages.pandocfilters
     ];
 
     passthru.tests.example-doc =
diff --git a/pkgs/tools/misc/pandoc-eqnos/default.nix b/pkgs/tools/misc/pandoc-eqnos/default.nix
index 4c5521b1d7aa..edc639a84c7b 100644
--- a/pkgs/tools/misc/pandoc-eqnos/default.nix
+++ b/pkgs/tools/misc/pandoc-eqnos/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  pandoc-xnos,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-eqnos";
   version = "2.5.0";
   pyproject = true;
@@ -18,11 +16,11 @@ buildPythonApplication rec {
     hash = "sha256-7GQdfGHhtQs6LZK+ZyMmcPSkoFfBWmATTMejMiFcS7Y=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [ pandoc-xnos ];
+  propagatedBuildInputs = with python3Packages; [ pandoc-xnos ];
 
   # Different pandoc executables are not available
   doCheck = false;
diff --git a/pkgs/tools/misc/pandoc-fignos/default.nix b/pkgs/tools/misc/pandoc-fignos/default.nix
index 75ef5eb4559b..eb257c306ae4 100644
--- a/pkgs/tools/misc/pandoc-fignos/default.nix
+++ b/pkgs/tools/misc/pandoc-fignos/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  pandoc-xnos,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-fignos";
   version = "2.4.0";
   pyproject = true;
@@ -18,11 +16,11 @@ buildPythonApplication rec {
     sha256 = "sha256-eDwAW0nLB4YqrWT3Ajt9bmX1A43wl+tOPm2St5VpCLk=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [ pandoc-xnos ];
+  propagatedBuildInputs = with python3Packages; [ pandoc-xnos ];
 
   # Different pandoc executables are not available
   doCheck = false;
diff --git a/pkgs/tools/misc/pandoc-imagine/default.nix b/pkgs/tools/misc/pandoc-imagine/default.nix
index 8307eda4974c..aed98010d7f3 100644
--- a/pkgs/tools/misc/pandoc-imagine/default.nix
+++ b/pkgs/tools/misc/pandoc-imagine/default.nix
@@ -1,12 +1,10 @@
 {
-  fetchFromGitHub,
-  buildPythonApplication,
   lib,
-  pandocfilters,
-  six,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-imagine";
   version = "0.1.7";
   format = "setuptools";
@@ -18,7 +16,7 @@ buildPythonApplication rec {
     sha256 = "sha256-IJAXrJakKjROF2xi9dsLvGzyGIyB+GDnx/Z7BRlwSqc=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pandocfilters
     six
   ];
diff --git a/pkgs/tools/misc/pandoc-include/default.nix b/pkgs/tools/misc/pandoc-include/default.nix
index ee39ddd10259..99263c7495f1 100644
--- a/pkgs/tools/misc/pandoc-include/default.nix
+++ b/pkgs/tools/misc/pandoc-include/default.nix
@@ -1,15 +1,11 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  natsort,
-  panflute,
-  lxml,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
   nix-update-script,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-include";
   version = "1.4.4";
   pyproject = true;
@@ -21,13 +17,13 @@ buildPythonApplication rec {
     hash = "sha256-M0frQGg2nHbgY53ejMdbXKLJjXQgx8aNUVxeDDIHdp4=";
   };
 
-  build-system = [
+  build-system = with python3Packages; [
     setuptools
   ];
 
   passthru.updateScript = nix-update-script { };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     natsort
     panflute
     lxml
diff --git a/pkgs/tools/misc/pandoc-plantuml-filter/default.nix b/pkgs/tools/misc/pandoc-plantuml-filter/default.nix
index 194c804fd990..f84e72e72f8b 100644
--- a/pkgs/tools/misc/pandoc-plantuml-filter/default.nix
+++ b/pkgs/tools/misc/pandoc-plantuml-filter/default.nix
@@ -1,13 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-  setuptools,
-  setuptools-scm,
-  pandocfilters,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-plantuml-filter";
   version = "0.1.5";
   pyproject = true;
@@ -17,12 +14,12 @@ buildPythonApplication rec {
     hash = "sha256-9qXeIZuCu44m9EoPCPL7MgEboEwN91OylLfbkwhkZYQ=";
   };
 
-  build-system = [
+  build-system = with python3Packages; [
     setuptools
     setuptools-scm
   ];
 
-  dependencies = [ pandocfilters ];
+  dependencies = with python3Packages; [ pandocfilters ];
 
   meta = {
     homepage = "https://github.com/timofurrer/pandoc-plantuml-filter";
diff --git a/pkgs/tools/misc/pandoc-secnos/default.nix b/pkgs/tools/misc/pandoc-secnos/default.nix
index 70616ec5adc3..c32530bf5a32 100644
--- a/pkgs/tools/misc/pandoc-secnos/default.nix
+++ b/pkgs/tools/misc/pandoc-secnos/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  pandoc-xnos,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-secnos";
   version = "2.2.2";
   pyproject = true;
@@ -18,11 +16,11 @@ buildPythonApplication rec {
     sha256 = "sha256-J9KLZvioYM3Pl2UXjrEgd4PuLTwCLYy9SsJIzgw5/jU=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [ pandoc-xnos ];
+  propagatedBuildInputs = with python3Packages; [ pandoc-xnos ];
 
   patches = [
     ./patch/fix-manifest.patch
diff --git a/pkgs/tools/misc/pandoc-tablenos/default.nix b/pkgs/tools/misc/pandoc-tablenos/default.nix
index f8202cd8f695..318c7725b84d 100644
--- a/pkgs/tools/misc/pandoc-tablenos/default.nix
+++ b/pkgs/tools/misc/pandoc-tablenos/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  pandoc-xnos,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-tablenos";
   version = "2.3.0";
   pyproject = true;
@@ -18,11 +16,11 @@ buildPythonApplication rec {
     hash = "sha256-FwzsRziY3PoySo9hIFuLw6tOO9oQij6oQEyoY8HgnII=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [ pandoc-xnos ];
+  propagatedBuildInputs = with python3Packages; [ pandoc-xnos ];
 
   # Different pandoc executables are not available
   doCheck = false;
diff --git a/pkgs/tools/misc/pdd/default.nix b/pkgs/tools/misc/pdd/default.nix
index 433d28c19b0b..41dbd38ece0d 100644
--- a/pkgs/tools/misc/pdd/default.nix
+++ b/pkgs/tools/misc/pdd/default.nix
@@ -1,11 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  python-dateutil,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pdd";
   version = "1.7";
   pyproject = false;
@@ -27,7 +26,7 @@ buildPythonApplication rec {
     mkdir -p $out/share/fish/vendor_completions.d
   '';
 
-  dependencies = [ python-dateutil ];
+  dependencies = with python3Packages; [ python-dateutil ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/tools/misc/remote-exec/default.nix b/pkgs/tools/misc/remote-exec/default.nix
index fb4c4e1e3355..ed738f85dd7b 100644
--- a/pkgs/tools/misc/remote-exec/default.nix
+++ b/pkgs/tools/misc/remote-exec/default.nix
@@ -1,19 +1,13 @@
 {
   lib,
   stdenv,
+  python3Packages,
   fetchpatch,
   fetchFromGitHub,
-  buildPythonApplication,
-  click,
-  pydantic,
-  toml,
-  watchdog,
-  pytestCheckHook,
-  pytest-cov-stub,
   rsync,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "remote-exec";
   version = "1.13.3";
   format = "setuptools";
@@ -40,7 +34,7 @@ buildPythonApplication rec {
       --replace-fail '"mremote' '#"mremote'
   '';
 
-  dependencies = [
+  dependencies = with python3Packages; [
     click
     pydantic
     toml
@@ -53,7 +47,7 @@ buildPythonApplication rec {
     rsync
   ];
 
-  checkInputs = [
+  checkInputs = with python3Packages; [
     pytestCheckHook
     pytest-cov-stub
   ];
diff --git a/pkgs/tools/misc/vimwiki-markdown/default.nix b/pkgs/tools/misc/vimwiki-markdown/default.nix
index 00cf23aa9b36..f0214cacddbb 100644
--- a/pkgs/tools/misc/vimwiki-markdown/default.nix
+++ b/pkgs/tools/misc/vimwiki-markdown/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-  markdown,
-  pygments,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   version = "0.4.1";
   format = "setuptools";
   pname = "vimwiki-markdown";
@@ -16,7 +14,7 @@ buildPythonApplication rec {
     hash = "sha256-hJl0OTE6kHucVGOxgOZBG0noYRfxma3yZSrUWEssLN4=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     markdown
     pygments
   ];
diff --git a/pkgs/tools/networking/namespaced-openvpn/default.nix b/pkgs/tools/networking/namespaced-openvpn/default.nix
index a19e2aa53903..2325c09d8d44 100644
--- a/pkgs/tools/networking/namespaced-openvpn/default.nix
+++ b/pkgs/tools/networking/namespaced-openvpn/default.nix
@@ -1,14 +1,14 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
-  buildPythonPackage,
   openvpn,
   iproute2,
   iptables,
   util-linux,
 }:
 
-buildPythonPackage rec {
+python3Packages.buildPythonPackage rec {
   pname = "namespaced-openvpn";
   version = "0.6.0";
   pyproject = false;
diff --git a/pkgs/tools/networking/s3cmd/default.nix b/pkgs/tools/networking/s3cmd/default.nix
index 72d23e85acbe..7e76de2f114d 100644
--- a/pkgs/tools/networking/s3cmd/default.nix
+++ b/pkgs/tools/networking/s3cmd/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  python-magic,
-  python-dateutil,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "s3cmd";
   version = "2.4.0";
   format = "setuptools";
@@ -18,7 +16,7 @@ buildPythonApplication rec {
     sha256 = "sha256-cxwf6+9WFt3U7+JdKRgZxFElD+Dgf2P2VyejHVoiDJk=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     python-magic
     python-dateutil
   ];
diff --git a/pkgs/tools/networking/vpn-slice/default.nix b/pkgs/tools/networking/vpn-slice/default.nix
index 6d4abb23d99f..6c534086972c 100644
--- a/pkgs/tools/networking/vpn-slice/default.nix
+++ b/pkgs/tools/networking/vpn-slice/default.nix
@@ -1,18 +1,15 @@
 {
   lib,
   stdenv,
-  buildPythonApplication,
+  python3Packages,
   nix-update-script,
   fetchFromGitHub,
-  dnspython,
   iproute2,
   iptables,
-  setproctitle,
-  setuptools,
   unixtools,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "vpn-slice";
   version = "0.16.1";
   pyproject = true;
@@ -35,11 +32,11 @@ buildPythonApplication rec {
         --replace-fail "'/sbin/iptables'" "'${iptables}/bin/iptables'"
     '';
 
-  build-system = [
+  build-system = with python3Packages; [
     setuptools
   ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     setuptools # can be removed with next package update, upstream no longer has a dependency on distutils
     setproctitle
     dnspython
diff --git a/pkgs/tools/security/cve-bin-tool/default.nix b/pkgs/tools/security/cve-bin-tool/default.nix
index 07ca4a07e60c..acabb46b2584 100644
--- a/pkgs/tools/security/cve-bin-tool/default.nix
+++ b/pkgs/tools/security/cve-bin-tool/default.nix
@@ -1,37 +1,8 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
 
-  # build-system
-  setuptools,
-
-  # dependencies
-  aiohttp,
-  beautifulsoup4,
-  brotlipy,
-  cvss,
-  distro,
-  filetype,
-  jinja2,
-  jsonschema,
-  lib4sbom,
-  lib4vex,
-  packageurl-python,
-  packaging,
-  plotly,
-  python-gnupg,
-  pyyaml,
-  requests,
-  rich,
-  rpmfile,
-  xmlschema,
-  zipp,
-  zstandard,
-
-  # optional-dependencies
-  reportlab,
-
   # runtime-dependencies
   google-cloud-sdk,
 
@@ -39,7 +10,7 @@
   versionCheckHook,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cve-bin-tool";
   version = "3.4";
   pyproject = true;
@@ -51,35 +22,37 @@ buildPythonApplication rec {
     hash = "sha256-pv8XjKjZBUw5FmmUn1dakGeS1uw2xzF3wSIZOYQ2/3c=";
   };
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
-    aiohttp
-    beautifulsoup4
-    brotlipy
-    cvss
-    distro
-    filetype
-    jinja2
-    jsonschema
-    lib4sbom
-    lib4vex
-    packageurl-python
-    packaging
-    plotly
-    python-gnupg
-    pyyaml
-    requests
-    rich
-    rpmfile
-    setuptools
-    xmlschema
-    zipp
-    zstandard
-  ]
-  ++ aiohttp.optional-dependencies.speedups;
+  dependencies =
+    with python3Packages;
+    [
+      aiohttp
+      beautifulsoup4
+      brotlipy
+      cvss
+      distro
+      filetype
+      jinja2
+      jsonschema
+      lib4sbom
+      lib4vex
+      packageurl-python
+      packaging
+      plotly
+      python-gnupg
+      pyyaml
+      requests
+      rich
+      rpmfile
+      setuptools
+      xmlschema
+      zipp
+      zstandard
+    ]
+    ++ aiohttp.optional-dependencies.speedups;
 
-  optional-dependencies = {
+  optional-dependencies = with python3Packages; {
     pdf = [ reportlab ];
   };
 
diff --git a/pkgs/tools/security/nitrokey-app2/default.nix b/pkgs/tools/security/nitrokey-app2/default.nix
index a7942093436a..6dc5284cfe4b 100644
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@@ -1,13 +1,8 @@
 {
   lib,
   stdenv,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  poetry-core,
-  fido2,
-  nitrokey,
-  pyside6,
-  usb-monitor,
   qt6,
 }:
 
@@ -20,7 +15,7 @@ let
     ;
 in
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "nitrokey-app2";
   version = "2.5.2";
   pyproject = true;
@@ -44,11 +39,11 @@ buildPythonApplication rec {
     qtsvg
   ];
 
-  build-system = [
+  build-system = with python3Packages; [
     poetry-core
   ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     fido2
     nitrokey
     pyside6
diff --git a/pkgs/tools/security/pass2csv/default.nix b/pkgs/tools/security/pass2csv/default.nix
index 8325ebe8fef8..1bcc2707c964 100644
--- a/pkgs/tools/security/pass2csv/default.nix
+++ b/pkgs/tools/security/pass2csv/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchPypi,
   lib,
-  python-gnupg,
-  setuptools,
+  python3Packages,
+  fetchPypi,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pass2csv";
   version = "1.2.0";
   pyproject = true;
@@ -16,11 +14,11 @@ buildPythonApplication rec {
     hash = "sha256-IdcSwQ9O2HmCvT8p4tC7e2GQuhkE3kvMINszZH970og=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     python-gnupg
   ];
 
diff --git a/pkgs/tools/system/cm-rgb/default.nix b/pkgs/tools/system/cm-rgb/default.nix
index 1a0510a646c9..2333e32b0b8c 100644
--- a/pkgs/tools/system/cm-rgb/default.nix
+++ b/pkgs/tools/system/cm-rgb/default.nix
@@ -1,19 +1,14 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   atk,
   gobject-introspection,
   wrapGAppsHook3,
-  click,
-  hidapi,
-  psutil,
-  pygobject3,
   udevCheckHook,
-  stdenv,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cm-rgb";
   version = "0.3.6";
   format = "setuptools";
@@ -34,7 +29,7 @@ buildPythonApplication rec {
     udevCheckHook
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     click
     hidapi
     psutil
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 54b44200ed48..e11c0d101567 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -407,7 +407,7 @@ with pkgs;
 
   dnf4 = python3Packages.callPackage ../development/python-modules/dnf4/wrapper.nix { };
 
-  enochecker-test = with python3Packages; callPackage ../development/tools/enochecker-test { };
+  enochecker-test = callPackage ../development/tools/enochecker-test { };
 
   inherit (gridlock) nyarr;
 
@@ -1433,7 +1433,7 @@ with pkgs;
     bitwarden-directory-connector
     ;
 
-  bitwarden-menu = python3Packages.callPackage ../applications/misc/bitwarden-menu { };
+  bitwarden-menu = callPackage ../applications/misc/bitwarden-menu { };
 
   blocksat-cli = with python3Packages; toPythonApplication blocksat-cli;
 
@@ -1746,7 +1746,7 @@ with pkgs;
     cairo = cairo.override { xcbSupport = true; };
   };
 
-  hyprshade = python3Packages.callPackage ../applications/window-managers/hyprwm/hyprshade { };
+  hyprshade = callPackage ../applications/window-managers/hyprwm/hyprshade { };
 
   hyprlandPlugins = recurseIntoAttrs (
     callPackage ../applications/window-managers/hyprwm/hyprland-plugins { }
@@ -1754,7 +1754,7 @@ with pkgs;
 
   intensity-normalization = with python3Packages; toPythonApplication intensity-normalization;
 
-  jellyfin-mpv-shim = python3Packages.callPackage ../applications/video/jellyfin-mpv-shim { };
+  jellyfin-mpv-shim = callPackage ../applications/video/jellyfin-mpv-shim { };
 
   klaus = with python3Packages; toPythonApplication klaus;
 
@@ -1823,9 +1823,7 @@ with pkgs;
 
   ocrmypdf = with python3.pkgs; toPythonApplication ocrmypdf;
 
-  online-judge-template-generator =
-    python3Packages.callPackage ../tools/misc/online-judge-template-generator
-      { };
+  online-judge-template-generator = callPackage ../tools/misc/online-judge-template-generator { };
 
   online-judge-tools = with python3.pkgs; toPythonApplication online-judge-tools;
 
@@ -1835,7 +1833,7 @@ with pkgs;
 
   pixcat = with python3Packages; toPythonApplication pixcat;
 
-  remarkable-mouse = python3Packages.callPackage ../applications/misc/remarkable/remarkable-mouse { };
+  remarkable-mouse = callPackage ../applications/misc/remarkable/remarkable-mouse { };
 
   ropgadget = with python3Packages; toPythonApplication ropgadget;
 
@@ -1995,7 +1993,7 @@ with pkgs;
 
   blacken-docs = with python3Packages; toPythonApplication blacken-docs;
 
-  bluetooth_battery = python3Packages.callPackage ../applications/misc/bluetooth_battery { };
+  bluetooth_battery = callPackage ../applications/misc/bluetooth_battery { };
 
   cffconvert = python3Packages.toPythonApplication python3Packages.cffconvert;
 
@@ -2070,7 +2068,7 @@ with pkgs;
     ngtcp2 = ngtcp2-gnutls;
   };
 
-  cve-bin-tool = python3Packages.callPackage ../tools/security/cve-bin-tool { };
+  cve-bin-tool = callPackage ../tools/security/cve-bin-tool { };
 
   dconf2nix = callPackage ../development/tools/haskell/dconf2nix { };
 
@@ -2260,6 +2258,10 @@ with pkgs;
     pinentry = if stdenv.hostPlatform.isDarwin then pinentry_mac else pinentry-gtk2;
   };
   gnupg = gnupg24;
+  gnupgMinimal = gnupg.override {
+    enableMinimal = true;
+    guiSupport = false;
+  };
 
   gnused = callPackage ../tools/text/gnused { };
 
@@ -2423,7 +2425,7 @@ with pkgs;
 
   infisical = callPackage ../development/tools/infisical { };
 
-  input-remapper = python3Packages.callPackage ../tools/inputmethods/input-remapper { };
+  input-remapper = callPackage ../tools/inputmethods/input-remapper { };
 
   internetarchive = with python3Packages; toPythonApplication internetarchive;
 
@@ -2784,21 +2786,20 @@ with pkgs;
 
   nvfetcher = haskell.lib.compose.justStaticExecutables haskellPackages.nvfetcher;
 
-  pandoc-acro = python3Packages.callPackage ../tools/misc/pandoc-acro { };
+  pandoc-acro = callPackage ../tools/misc/pandoc-acro { };
 
-  pandoc-imagine = python3Packages.callPackage ../tools/misc/pandoc-imagine { };
+  pandoc-imagine = callPackage ../tools/misc/pandoc-imagine { };
 
-  pandoc-include = python3Packages.callPackage ../tools/misc/pandoc-include { };
+  pandoc-include = callPackage ../tools/misc/pandoc-include { };
 
-  pandoc-drawio-filter = python3Packages.callPackage ../tools/misc/pandoc-drawio-filter { };
+  pandoc-drawio-filter = callPackage ../tools/misc/pandoc-drawio-filter { };
 
-  pandoc-plantuml-filter = python3Packages.callPackage ../tools/misc/pandoc-plantuml-filter { };
+  pandoc-plantuml-filter = callPackage ../tools/misc/pandoc-plantuml-filter { };
 
-  # pandoc-*nos is a filter suite, where pandoc-xnos has all functionality and the others are used for only specific functionality
-  pandoc-eqnos = python3Packages.callPackage ../tools/misc/pandoc-eqnos { };
-  pandoc-fignos = python3Packages.callPackage ../tools/misc/pandoc-fignos { };
-  pandoc-secnos = python3Packages.callPackage ../tools/misc/pandoc-secnos { };
-  pandoc-tablenos = python3Packages.callPackage ../tools/misc/pandoc-tablenos { };
+  pandoc-eqnos = callPackage ../tools/misc/pandoc-eqnos { };
+  pandoc-fignos = callPackage ../tools/misc/pandoc-fignos { };
+  pandoc-secnos = callPackage ../tools/misc/pandoc-secnos { };
+  pandoc-tablenos = callPackage ../tools/misc/pandoc-tablenos { };
 
   pgbadger = perlPackages.callPackage ../tools/misc/pgbadger { };
 
@@ -2868,7 +2869,7 @@ with pkgs;
     inherit (llvmPackages) stdenv;
   };
 
-  namespaced-openvpn = python3Packages.callPackage ../tools/networking/namespaced-openvpn { };
+  namespaced-openvpn = callPackage ../tools/networking/namespaced-openvpn { };
 
   update-dotdee = with python3Packages; toPythonApplication update-dotdee;
 
@@ -2927,7 +2928,7 @@ with pkgs;
     polkitSupport = true;
   };
 
-  pdd = python3Packages.callPackage ../tools/misc/pdd { };
+  pdd = callPackage ../tools/misc/pdd { };
 
   pdfminer = with python3Packages; toPythonApplication pdfminer-six;
 
@@ -3035,7 +3036,7 @@ with pkgs;
 
   recoll-nox = recoll.override { withGui = false; };
 
-  remote-exec = python3Packages.callPackage ../tools/misc/remote-exec { };
+  remote-exec = callPackage ../tools/misc/remote-exec { };
 
   reptor = with python3.pkgs; toPythonApplication reptor;
 
@@ -3061,7 +3062,7 @@ with pkgs;
 
   ruby-lsp = rubyPackages.ruby-lsp;
 
-  s3cmd = python3Packages.callPackage ../tools/networking/s3cmd { };
+  s3cmd = callPackage ../tools/networking/s3cmd { };
 
   s3-credentials = with python3Packages; toPythonApplication s3-credentials;
 
@@ -3111,9 +3112,7 @@ with pkgs;
 
   strip-nondeterminism = perlPackages.strip-nondeterminism;
 
-  sumorobot-manager =
-    python3Packages.callPackage ../applications/science/robotics/sumorobot-manager
-      { };
+  sumorobot-manager = callPackage ../applications/science/robotics/sumorobot-manager { };
 
   sslscan = callPackage ../tools/security/sslscan {
     openssl = openssl.override { withZlib = true; };
@@ -3203,12 +3202,12 @@ with pkgs;
   vimpager = callPackage ../tools/misc/vimpager { };
   vimpager-latest = callPackage ../tools/misc/vimpager/latest.nix { };
 
-  vimwiki-markdown = python3Packages.callPackage ../tools/misc/vimwiki-markdown { };
+  vimwiki-markdown = callPackage ../tools/misc/vimwiki-markdown { };
 
   voxtype-vulkan = callPackage ../by-name/vo/voxtype/package.nix { vulkanSupport = true; };
   voxtype-onnx = callPackage ../by-name/vo/voxtype/package.nix { onnxSupport = true; };
 
-  vpn-slice = python3Packages.callPackage ../tools/networking/vpn-slice { };
+  vpn-slice = callPackage ../tools/networking/vpn-slice { };
 
   openconnectPackages = callPackage ../tools/networking/openconnect { };
 
@@ -5026,7 +5025,7 @@ with pkgs;
 
   ansible-builder = with python3Packages; toPythonApplication ansible-builder;
 
-  yakut = python3Packages.callPackage ../development/tools/misc/yakut { };
+  yakut = callPackage ../development/tools/misc/yakut { };
 
   ### DEVELOPMENT / TOOLS / LANGUAGE-SERVERS
 
@@ -5058,7 +5057,7 @@ with pkgs;
 
   apacheKafka = apacheKafka_4_2;
 
-  asn2quickder = python3Packages.callPackage ../development/tools/asn2quickder { };
+  asn2quickder = callPackage ../development/tools/asn2quickder { };
 
   libastyle = astyle.override { asLibrary = true; };
 
@@ -5333,7 +5332,7 @@ with pkgs;
 
   css-html-js-minify = with python3Packages; toPythonApplication css-html-js-minify;
 
-  cvise = python3Packages.callPackage ../development/tools/misc/cvise {
+  cvise = callPackage ../development/tools/misc/cvise {
     # cvise needs a port to latest llvm-21:
     #   https://github.com/marxin/cvise/issues/340
     inherit (llvmPackages_20) llvm libclang;
@@ -5410,7 +5409,7 @@ with pkgs;
     haskellPackages.callPackage ../tools/misc/fffuu { }
   );
 
-  gdbgui = python3Packages.callPackage ../development/tools/misc/gdbgui { };
+  gdbgui = callPackage ../development/tools/misc/gdbgui { };
 
   flex_2_5_35 = callPackage ../development/tools/parsing/flex/2.5.35.nix { };
   flex = callPackage ../development/tools/parsing/flex { };
@@ -5471,7 +5470,7 @@ with pkgs;
   maven3 = maven;
   inherit (maven) buildMaven;
 
-  mavproxy = python3Packages.callPackage ../applications/science/robotics/mavproxy { };
+  mavproxy = callPackage ../applications/science/robotics/mavproxy { };
 
   python-matter-server =
     with python3Packages;
@@ -8042,7 +8041,7 @@ with pkgs;
   };
   busybox-sandbox-shell = callPackage ../os-specific/linux/busybox/sandbox-shell.nix { };
 
-  cm-rgb = python3Packages.callPackage ../tools/system/cm-rgb { };
+  cm-rgb = callPackage ../tools/system/cm-rgb { };
 
   conky = callPackage ../os-specific/linux/conky (
     {
@@ -8052,9 +8051,7 @@ with pkgs;
     // config.conky or { }
   );
 
-  cpupower-gui = python3Packages.callPackage ../os-specific/linux/cpupower-gui {
-    inherit (pkgs) meson;
-  };
+  cpupower-gui = callPackage ../os-specific/linux/cpupower-gui { };
 
   # Darwin package set
   #
@@ -8855,7 +8852,7 @@ with pkgs;
 
   drawterm-wayland = callPackage ../by-name/dr/drawterm/package.nix { withWayland = true; };
 
-  droopy = python3Packages.callPackage ../applications/networking/droopy { };
+  droopy = callPackage ../applications/networking/droopy { };
 
   evilwm = callPackage ../applications/window-managers/evilwm {
     patches = config.evilwm.patches or [ ];
@@ -9172,7 +9169,7 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
-  pass2csv = python3Packages.callPackage ../tools/security/pass2csv { };
+  pass2csv = callPackage ../tools/security/pass2csv { };
 
   pinboard = with python3Packages; toPythonApplication pinboard;
 
@@ -9362,9 +9359,7 @@ with pkgs;
     shelfMultiBand = callPackage ../applications/audio/magnetophonDSP/shelfMultiBand { };
   };
 
-  matrix-commander =
-    python3Packages.callPackage ../applications/networking/instant-messengers/matrix-commander
-      { };
+  matrix-commander = callPackage ../applications/networking/instant-messengers/matrix-commander { };
 
   mediaelch-qt5 = callPackage ../by-name/me/mediaelch/package.nix { qtVersion = 5; };
   mediaelch-qt6 = mediaelch;
@@ -9427,7 +9422,7 @@ with pkgs;
 
   mpvScripts = callPackage ../by-name/mp/mpv/scripts.nix { };
 
-  mu-repo = python3Packages.callPackage ../applications/misc/mu-repo { };
+  mu-repo = callPackage ../applications/misc/mu-repo { };
 
   murmur =
     (callPackages ../applications/networking/mumble {
@@ -9567,7 +9562,7 @@ with pkgs;
 
   inherit (pidginPackages) pidgin;
 
-  plex-mpv-shim = python3Packages.callPackage ../applications/video/plex-mpv-shim { };
+  plex-mpv-shim = callPackage ../applications/video/plex-mpv-shim { };
 
   # perhaps there are better apps for this task? It's how I had configured my previous system.
   # And I don't want to rewrite all rules
@@ -9655,7 +9650,7 @@ with pkgs;
     withXineBackend = true;
   };
 
-  rednotebook = python3Packages.callPackage ../applications/editors/rednotebook { };
+  rednotebook = callPackage ../applications/editors/rednotebook { };
 
   ringboard-wayland = callPackage ../by-name/ri/ringboard/package.nix { displayServer = "wayland"; };
 
@@ -10175,7 +10170,7 @@ with pkgs;
 
   ydiff = with python3.pkgs; toPythonApplication ydiff;
 
-  yokadi = python3Packages.callPackage ../applications/misc/yokadi { };
+  yokadi = callPackage ../applications/misc/yokadi { };
 
   your-editor = callPackage ../applications/editors/your-editor { stdenv = gccStdenv; };
 
@@ -11325,7 +11320,7 @@ with pkgs;
     hasktags = haskellPackages.hasktags;
   };
 
-  termpdfpy = python3Packages.callPackage ../applications/misc/termpdf.py { };
+  termpdfpy = callPackage ../applications/misc/termpdf.py { };
 
   inherit (callPackage ../applications/networking/cluster/terraform { })
     mkTerraform
@@ -11437,7 +11432,7 @@ with pkgs;
 
   torcs-without-data = callPackage ../by-name/to/torcs/without-data.nix { };
 
-  nitrokey-app2 = python3Packages.callPackage ../tools/security/nitrokey-app2 { };
+  nitrokey-app2 = callPackage ../tools/security/nitrokey-app2 { };
 
   hy = with python3Packages; toPythonApplication hy;
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4a559e567ce2..8ec16679a94c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -9997,11 +9997,11 @@ with self;
 
   DBI = buildPerlPackage {
     pname = "DBI";
-    version = "1.644";
+    version = "1.648";
 
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.644.tar.gz";
-      hash = "sha256-Ipe5neCeZwhmQLWQaZ4OmC+0adpjqT/ijcFHgtt6U8g=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.648.tgz";
+      hash = "sha256-7yZqrWAQzi6rt+Rl69c8owILxYFQ9pib2Jwrj5usaoY=";
     };
 
     env = lib.optionalAttrs stdenv.cc.isGNU {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 011468b93d5c..e915a154e236 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8908,6 +8908,8 @@ self: super: with self; {
 
   libmambapy = callPackage ../development/python-modules/libmambapy { };
 
+  libmobility = callPackage ../development/python-modules/libmobility { };
+
   libmodulemd = lib.pipe pkgs.libmodulemd [
     toPythonModule
     (
@@ -15932,6 +15934,8 @@ self: super: with self; {
 
   python-duco-client = callPackage ../development/python-modules/python-duco-client { };
 
+  python-duco-connectivity = callPackage ../development/python-modules/python-duco-connectivity { };
+
   python-ecobee-api = callPackage ../development/python-modules/python-ecobee-api { };
 
   python-editor = callPackage ../development/python-modules/python-editor { };