diff --git a/.github/ISSUE_TEMPLATE/01_bug_report.yml b/.github/ISSUE_TEMPLATE/01_bug_report.yml
index d2ed16e343e9..07263b4ca2a4 100644
--- a/.github/ISSUE_TEMPLATE/01_bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/01_bug_report.yml
@@ -37,7 +37,6 @@ body:
         - "Please select a version."
         - "- Unstable (26.05)"
         - "- Stable (25.11)"
-        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml b/.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml
index 7acda0e781c5..dd26d3f658d6 100644
--- a/.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml
+++ b/.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml
@@ -37,7 +37,6 @@ body:
         - "Please select a version."
         - "- Unstable (26.05)"
         - "- Stable (25.11)"
-        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml b/.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml
index 532d7851e989..85daf0cc75cd 100644
--- a/.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml
+++ b/.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml
@@ -37,7 +37,6 @@ body:
         - "Please select a version."
         - "- Unstable (26.05)"
         - "- Stable (25.11)"
-        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/04_build_failure.yml b/.github/ISSUE_TEMPLATE/04_build_failure.yml
index 3d5354adca71..d986cd2fc1fa 100644
--- a/.github/ISSUE_TEMPLATE/04_build_failure.yml
+++ b/.github/ISSUE_TEMPLATE/04_build_failure.yml
@@ -39,7 +39,6 @@ body:
         - "Please select a version."
         - "- Unstable (26.05)"
         - "- Stable (25.11)"
-        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/05_update_request.yml b/.github/ISSUE_TEMPLATE/05_update_request.yml
index a575550eaee5..324d35450048 100644
--- a/.github/ISSUE_TEMPLATE/05_update_request.yml
+++ b/.github/ISSUE_TEMPLATE/05_update_request.yml
@@ -39,7 +39,6 @@ body:
         - "Please select a version."
         - "- Unstable (26.05)"
         - "- Stable (25.11)"
-        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/ISSUE_TEMPLATE/06_module_request.yml b/.github/ISSUE_TEMPLATE/06_module_request.yml
index fbe5a2a62a44..d2451720ccae 100644
--- a/.github/ISSUE_TEMPLATE/06_module_request.yml
+++ b/.github/ISSUE_TEMPLATE/06_module_request.yml
@@ -37,7 +37,6 @@ body:
         - "Please select a version."
         - "- Unstable (26.05)"
         - "- Stable (25.11)"
-        - "- Old Stable (25.05)"
       default: 0
     validations:
       required: true
diff --git a/.github/labeler-no-sync.yml b/.github/labeler-no-sync.yml
index b0bee8d48a72..1cb675a2a57b 100644
--- a/.github/labeler-no-sync.yml
+++ b/.github/labeler-no-sync.yml
@@ -22,17 +22,6 @@
               - doc/**/*
               - nixos/doc/**/*
 
-"backport release-25.05":
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/actions/*
-              - .github/workflows/*
-              - .github/labeler*.yml
-              - ci/**/*.*
-              - maintainers/github-teams.json
-      - base-branch: ['master']
-
 "backport release-25.11":
   - all:
       - changed-files:
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 96d97f6df803..c80f3212ed21 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -31,10 +31,6 @@ jobs:
       max-parallel: 1
       matrix:
         pairs:
-          - from: release-25.05
-            into: staging-next-25.05
-          - from: staging-next-25.05
-            into: staging-25.05
           - from: release-25.11
             into: staging-next-25.11
           - from: staging-next-25.11
diff --git a/README.md b/README.md
index 531af2643e5d..1a4b04896144 100644
--- a/README.md
+++ b/README.md
@@ -47,9 +47,9 @@ Here are some of the main ones:
 Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 25.05 release](https://hydra.nixos.org/jobset/nixos/release-25.05)
+* [Continuous package builds for the NixOS 25.11 release](https://hydra.nixos.org/jobset/nixos/release-25.11)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 25.05 release](https://hydra.nixos.org/job/nixos/release-25.05/tested#tabs-constituents)
+* [Tests for the NixOS 25.11 release](https://hydra.nixos.org/job/nixos/release-25.11/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
 When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a85a897ebb48..6d0c3f8174b3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1260,7 +1260,7 @@
     github = "alexshpilkin";
     githubId = 1010468;
     keys = [ { fingerprint = "B595 D74D 6615 C010 469F  5A13 73E9 AA11 4B3A 894B"; } ];
-    matrix = "@alexshpilkin:matrix.org";
+    matrix = "@alex.shpilkin:matrix.org";
     name = "Alexander Shpilkin";
   };
   AlexSKaye = {
@@ -7964,7 +7964,7 @@
   };
   ericson2314 = {
     email = "John.Ericson@Obsidian.Systems";
-    matrix = "@ericson2314:matrix.org";
+    matrix = "@Ericson2314:matrix.org";
     github = "Ericson2314";
     githubId = 1055245;
     name = "John Ericson";
@@ -25509,7 +25509,7 @@
   };
   syboxez = {
     email = "syboxez@gmail.com";
-    matrix = "@Syboxez:matrix.org";
+    matrix = "@syboxez:matrix.org";
     github = "syboxez";
     githubId = 12841859;
     name = "Syboxez Blank";
@@ -26489,7 +26489,7 @@
   tilcreator = {
     name = "TilCreator";
     email = "contact.nixos@tc-j.de";
-    matrix = "@tilcreator:matrix.org";
+    matrix = "@TilCreator:matrix.org";
     github = "TilCreator";
     githubId = 18621411;
   };
@@ -26799,13 +26799,6 @@
     name = "Tomodachi94";
     keys = [ { fingerprint = "B208 D6E5 B8ED F47D 5687  627B 2E27 5F21 C4D5 54A3"; } ];
   };
-  tomsiewert = {
-    email = "tom@siewert.io";
-    matrix = "@tom:frickel.earth";
-    github = "sinuscosinustan";
-    githubId = 8794235;
-    name = "Tom Siewert";
-  };
   tomsmeets = {
     email = "tom.tsmeets@gmail.com";
     github = "TomSmeets";
diff --git a/nixos/modules/tasks/auto-upgrade.nix b/nixos/modules/tasks/auto-upgrade.nix
index 8bb445db9352..7028c0be444d 100644
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@@ -114,27 +114,6 @@ in
         '';
       };
 
-      rebootTriggers = lib.mkOption {
-        type = lib.types.listOf lib.types.pathInStore;
-        default = [ ];
-        description = ''
-          List of derivations that will cause an auto-reboot when changed when
-          {option}`system.autoUpgrade.allowReboot` is set to true.
-        '';
-        defaultText = lib.literalExpression ''
-          [
-            config.system.build.initialRamdisk
-            config.system.build.kernel
-            config.hardware.firmware
-            (pkgs.writeTextFile {
-              name = "kernel-params";
-              text = lib.concatStringsSep " " config.boot.kernelParams;
-            })
-          ]
-          ++ config.system.switch.inhibitors
-        '';
-      };
-
       randomizedDelaySec = lib.mkOption {
         default = "0";
         type = lib.types.str;
@@ -218,205 +197,133 @@ in
 
   };
 
-  config = lib.mkMerge [
+  config = lib.mkIf cfg.enable {
 
-    {
-      system = {
-        autoUpgrade.rebootTriggers = [
-          config.system.build.initialRamdisk
-          config.system.build.kernel
-          config.hardware.firmware
-          (pkgs.writeTextFile {
-            name = "kernel-params";
-            text = lib.concatStringsSep " " config.boot.kernelParams;
-          })
-        ]
-        ++ config.system.switch.inhibitors;
-
-        systemBuilderCommands = ''
-          ln -s ${config.system.build.rebootTriggers} $out/reboot-triggers
+    assertions = [
+      {
+        assertion = !((cfg.channel != null) && (cfg.flake != null));
+        message = ''
+          The options 'system.autoUpgrade.channel' and 'system.autoUpgrade.flake' cannot both be set.
         '';
+      }
+      {
+        assertion = (cfg.runGarbageCollection -> config.nix.enable);
+        message = ''
+          The option 'system.autoUpgrade.runGarbageCollection = true' requires 'nix.enable = true'.
+        '';
+      }
+    ];
 
-        build.rebootTriggers = pkgs.writeTextFile {
-          name = "reboot-triggers";
-          text = lib.concatMapStringsSep "\n" (drv: drv.outPath) config.system.autoUpgrade.rebootTriggers;
-        };
-      };
-    }
+    system.autoUpgrade.flags = (
+      if cfg.flake == null then
+        [ "--no-build-output" ]
+        ++ lib.optionals (cfg.channel != null) [
+          "-I"
+          "nixpkgs=${cfg.channel}/nixexprs.tar.xz"
+        ]
+      else
+        [
+          "--refresh"
+          "--flake ${cfg.flake}"
+        ]
+    );
 
-    (lib.mkIf cfg.enable {
-      assertions = [
-        {
-          assertion = !((cfg.channel != null) && (cfg.flake != null));
-          message = ''
-            The options 'system.autoUpgrade.channel' and 'system.autoUpgrade.flake' cannot both be set.
-          '';
-        }
-        {
-          assertion = (cfg.runGarbageCollection -> config.nix.enable);
-          message = ''
-            The option 'system.autoUpgrade.runGarbageCollection = true' requires 'nix.enable = true'.
-          '';
+    systemd.services.nixos-upgrade = {
+      description = "NixOS Upgrade";
+
+      restartIfChanged = false;
+      unitConfig.X-StopOnRemoval = false;
+      unitConfig.OnSuccess = lib.optional (
+        cfg.runGarbageCollection && config.nix.enable
+      ) "nix-gc.service";
+
+      serviceConfig.Type = "oneshot";
+
+      environment =
+        config.nix.envVars
+        // {
+          inherit (config.environment.sessionVariables) NIX_PATH;
+          HOME = "/root";
         }
+        // config.networking.proxy.envVars;
+
+      path = with pkgs; [
+        coreutils
+        gnutar
+        xz.bin
+        gzip
+        gitMinimal
+        config.nix.package.out
+        config.programs.ssh.package
       ];
 
-      system.autoUpgrade.flags = (
-        if cfg.flake == null then
-          [ "--no-build-output" ]
-          ++ lib.optionals (cfg.channel != null) [
-            "-I"
-            "nixpkgs=${cfg.channel}/nixexprs.tar.xz"
-          ]
-        else
-          [
-            "--refresh"
-            "--flake ${cfg.flake}"
-          ]
-      );
+      script =
+        let
+          nixos-rebuild = "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
+          date = "${pkgs.coreutils}/bin/date";
+          readlink = "${pkgs.coreutils}/bin/readlink";
+          shutdown = "${config.systemd.package}/bin/shutdown";
+          upgradeFlag = lib.optional (cfg.channel == null && cfg.upgrade) "--upgrade";
+        in
+        if cfg.allowReboot then
+          ''
+            ${nixos-rebuild} boot ${toString (cfg.flags ++ upgradeFlag)}
+            booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
+            built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
 
-      systemd.services.nixos-upgrade = {
-        description = "NixOS Upgrade";
+            ${lib.optionalString (cfg.rebootWindow != null) ''
+              current_time="$(${date} +%H:%M)"
 
-        restartIfChanged = false;
-        unitConfig.X-StopOnRemoval = false;
-        unitConfig.OnSuccess = lib.optional (
-          cfg.runGarbageCollection && config.nix.enable
-        ) "nix-gc.service";
+              lower="${cfg.rebootWindow.lower}"
+              upper="${cfg.rebootWindow.upper}"
 
-        serviceConfig.Type = "oneshot";
-
-        environment =
-          config.nix.envVars
-          // {
-            inherit (config.environment.sessionVariables) NIX_PATH;
-            HOME = "/root";
-          }
-          // config.networking.proxy.envVars;
-
-        path = with pkgs; [
-          coreutils
-          gnutar
-          xz.bin
-          gzip
-          gitMinimal
-          config.nix.package.out
-          config.programs.ssh.package
-          config.system.build.nixos-rebuild
-          config.systemd.package
-        ];
-
-        script =
-          let
-            upgradeFlag = lib.optional (cfg.channel == null && cfg.flake == null) "--upgrade";
-          in
-          if cfg.allowReboot then
-            # bash
-            ''
-              echo "Running nixos-rebuild boot..."
-              new_configuration="$(
-                # For some reason we still get a newline here in the journal between the
-                # nixos-rebuild stderr output and us echoing the store path that was
-                # printed on stdout.
-                # This might have to do with the particular way in which systemd handles
-                # stdout/stderr, they are unix sockets and not normal streams.
-                store_path="$(nixos-rebuild boot ${toString (cfg.flags ++ upgradeFlag)})"
-                echo "$store_path" >&2
-                echo "$store_path"
-              )"
-              if [ -z "$new_configuration" ]; then
-                echo "Looks like nixos-rebuild failed... Aborting"
-                exit 1
+              if [[ "''${lower}" < "''${upper}" ]]; then
+                if [[ "''${current_time}" > "''${lower}" ]] && \
+                   [[ "''${current_time}" < "''${upper}" ]]; then
+                  do_reboot="true"
+                else
+                  do_reboot="false"
+                fi
+              else
+                # lower > upper, so we are crossing midnight (e.g. lower=23h, upper=6h)
+                # we want to reboot if cur > 23h or cur < 6h
+                if [[ "''${current_time}" < "''${upper}" ]] || \
+                   [[ "''${current_time}" > "''${lower}" ]]; then
+                  do_reboot="true"
+                else
+                  do_reboot="false"
+                fi
               fi
-              echo "New configuration is $new_configuration"
-              switch_to_new_configuration="$new_configuration"/bin/switch-to-configuration
+            ''}
 
-              ${lib.optionalString (cfg.rebootWindow != null) # bash
-                ''
-                  current_time="$(date +%H:%M)"
+            if [ "''${booted}" = "''${built}" ]; then
+              ${nixos-rebuild} ${cfg.operation} ${toString cfg.flags}
+            ${lib.optionalString (cfg.rebootWindow != null) ''
+              elif [ "''${do_reboot}" != true ]; then
+                echo "Outside of configured reboot window, skipping."
+            ''}
+            else
+              ${shutdown} -r +1
+            fi
+          ''
+        else
+          ''
+            ${nixos-rebuild} ${cfg.operation} ${toString (cfg.flags ++ upgradeFlag)}
+          '';
 
-                  lower="${cfg.rebootWindow.lower}"
-                  upper="${cfg.rebootWindow.upper}"
+      startAt = cfg.dates;
 
-                  if [[ "''${lower}" < "''${upper}" ]]; then
-                    if [[ "''${current_time}" > "''${lower}" ]] && [[ "''${current_time}" < "''${upper}" ]]; then
-                      do_reboot="true"
-                    else
-                      do_reboot="false"
-                    fi
-                  else
-                    # lower > upper, so we are crossing midnight (e.g. lower=23h, upper=6h)
-                    # we want to reboot if cur > 23h or cur < 6h
-                    if [[ "''${current_time}" < "''${upper}" ]] || [[ "''${current_time}" > "''${lower}" ]]; then
-                      do_reboot="true"
-                    else
-                      do_reboot="false"
-                    fi
-                  fi
-                ''
-              }
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+    };
 
-              booted_triggers="$(realpath /run/booted-system)/reboot-triggers"
-              booted_triggers_sha="$(
-                if [ -f "$booted_triggers" ]; then
-                  sha256sum - < "$booted_triggers"
-                else
-                  echo 'none'
-                fi
-              )"
-
-              new_triggers="$(realpath "$new_configuration")/reboot-triggers"
-              new_triggers_sha="$(
-                if [ -f "$new_triggers" ]; then
-                  sha256sum - < "$new_triggers"
-                else
-                  echo 'none'
-                fi
-              )"
-
-              ${lib.optionalString (cfg.operation == "switch") # bash
-                ''
-                  echo "Running switch-to-configuration check..."
-                  if "$switch_to_new_configuration" check; then
-                    echo "Checking reboot triggers..."
-                    if [ "$new_triggers_sha" == "$booted_triggers_sha" ]; then
-                      echo "Switching into the new generation..."
-                      "$switch_to_new_configuration" ${cfg.operation}
-                      exit 0
-                    fi
-                  fi
-                ''
-              }
-              ${lib.optionalString (cfg.rebootWindow != null) # bash
-                ''
-                  if [ "''${do_reboot}" != true ]; then
-                    echo "Outside of configured reboot window, skipping."
-                    exit 0
-                  fi
-                ''
-              }
-              echo "Scheduling a reboot to activate the new generation"
-              systemctl reboot --when="+2min"
-            ''
-          else
-            # bash
-            ''
-              nixos-rebuild ${cfg.operation} ${toString (cfg.flags ++ upgradeFlag)}
-            '';
-
-        startAt = cfg.dates;
-
-        after = [ "network-online.target" ];
-        wants = [ "network-online.target" ];
+    systemd.timers.nixos-upgrade = {
+      timerConfig = {
+        RandomizedDelaySec = cfg.randomizedDelaySec;
+        FixedRandomDelay = cfg.fixedRandomDelay;
+        Persistent = cfg.persistent;
       };
+    };
+  };
 
-      systemd.timers.nixos-upgrade = {
-        timerConfig = {
-          RandomizedDelaySec = cfg.randomizedDelaySec;
-          FixedRandomDelay = cfg.fixedRandomDelay;
-          Persistent = cfg.persistent;
-        };
-      };
-    })
-
-  ];
 }
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 38035928a633..abb26fae3d78 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2013,6 +2013,8 @@ let
 
       Google.gemini-cli-vscode-ide-companion = callPackage ./Google.gemini-cli-vscode-ide-companion { };
 
+      gplane.wasm-language-tools = callPackage ./gplane.wasm-language-tools { };
+
       grapecity.gc-excelviewer = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "gc-excelviewer";
diff --git a/pkgs/applications/editors/vscode/extensions/gplane.wasm-language-tools/default.nix b/pkgs/applications/editors/vscode/extensions/gplane.wasm-language-tools/default.nix
new file mode 100644
index 000000000000..5fe3da3cabb0
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/gplane.wasm-language-tools/default.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  vscode-utils,
+  wasm-language-tools,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "gplane";
+    name = "wasm-language-tools";
+    version = "1.16.0";
+    hash = "sha256-H2exVPaF8tYdpXBcooFi5bysp85OLOwxbKrB3HJes0Y=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    ln -s ${wasm-language-tools}/bin bin
+    runHook postBuild
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/gplane.wasm-language-tools/changelog";
+    description = "Language support of WebAssembly";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=gplane.wasm-language-tools";
+    homepage = "https://github.com/g-plane/vscode-wasm";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ samestep ];
+  };
+}
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 293b0c148e93..41198695a110 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1310,11 +1310,11 @@
     "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-bhqOLFVoLpGIE2yzHbMokeN+LJZbLgrzqyzrSlwdCu0=",
+    "hash": "sha256-KiHK/tkDDEL+osFp5gRvPTHrP7hEfMhl8aT4VHCCGpw=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.49",
+    "rev": "v1.82.50",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index c4ddc1f91ee5..bb877c2a7ae3 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -298,8 +298,8 @@ rec {
       ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &
 
       # Wait until virtiofsd has created these sockets to avoid race condition.
-      until [[ -e virtio-store.sock ]]; do sleep 1; done
-      until [[ -e virtio-xchg.sock ]]; do sleep 1; done
+      until [[ -e virtio-store.sock ]]; do ${coreutils}/bin/sleep 1; done
+      until [[ -e virtio-xchg.sock ]]; do ${coreutils}/bin/sleep 1; done
 
       ${qemuCommand}
       EOF
diff --git a/pkgs/by-name/ca/cargo-hack/package.nix b/pkgs/by-name/ca/cargo-hack/package.nix
index 9f823bb9f775..26b6dbc916a3 100644
--- a/pkgs/by-name/ca/cargo-hack/package.nix
+++ b/pkgs/by-name/ca/cargo-hack/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-hack";
-  version = "0.6.39";
+  version = "0.6.40";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-0+2bgjCgkZA8oYo5jkykB2US+LVVNo1tVk4smxYB6f4=";
+    hash = "sha256-j2T4ElD69oMDTBVPSO6d1bjsJjoJieiaG+YNEmQ47aU=";
   };
 
-  cargoHash = "sha256-Pn7QL1D4WNMwCbXcm2bEdN2htIMwQhCsXrSaeeK2F7M=";
+  cargoHash = "sha256-1S7e/R3XCbNRQg152CqNuqieU+nfLXf5o8/5kC9UpSY=";
 
   # some necessary files are absent in the crate version
   doCheck = false;
diff --git a/pkgs/by-name/ch/changelogger/package.nix b/pkgs/by-name/ch/changelogger/package.nix
index 74f1680b478d..8327dcff00f9 100644
--- a/pkgs/by-name/ch/changelogger/package.nix
+++ b/pkgs/by-name/ch/changelogger/package.nix
@@ -40,7 +40,7 @@ buildGoModule rec {
     homepage = "https://github.com/MarkusFreitag/changelogger";
     changelog = "https://github.com/MarkusFreitag/changelogger/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ tomsiewert ];
+    maintainers = [ ];
     mainProgram = "changelogger";
   };
 }
diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index 71bb6cdfe415..bfba65be568b 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cook-cli";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${version}";
-    hash = "sha256-CJDWhcnY/HjaJbBJCevH9ytp7oJ734M30DxJ/vCCO/I=";
+    hash = "sha256-kqfbqyShQQSnYOWu6zk/0srb3AXRttWDCmQWhSsoB5I=";
   };
 
-  cargoHash = "sha256-rI/6niK/9QgRc4cWmDLPOc70PN1mRZLXdPym1R3d/Iw=";
+  cargoHash = "sha256-vmIMh7no/3UeFANUdvlRUfEzY3XpwpLW4GIb3URG8Z0=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/cs/csharp-ls/package.nix b/pkgs/by-name/cs/csharp-ls/package.nix
index 5a3bb73c571a..fa60764f1238 100644
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@@ -6,14 +6,14 @@
   nix-update-script,
 }:
 let
-  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
 in
 
 buildDotnetGlobalTool rec {
   pname = "csharp-ls";
-  version = "0.20.0";
+  version = "0.21.0";
 
-  nugetHash = "sha256-OqapGZCn4q8SZZh5Nj8GLaxcZoNdMOeNVPw43bxMEg0=";
+  nugetHash = "sha256-XFzTJ7UWaFQEmFmdY/zY4zjKZaKK9aUq4Zbt3h+19bg=";
 
   inherit dotnet-sdk;
   dotnet-runtime = dotnet-sdk;
diff --git a/pkgs/by-name/da/daemonize/include-write-prototype.patch b/pkgs/by-name/da/daemonize/include-write-prototype.patch
new file mode 100644
index 000000000000..21652c9f53cd
--- /dev/null
+++ b/pkgs/by-name/da/daemonize/include-write-prototype.patch
@@ -0,0 +1,15 @@
+diff --git a/getopt.c b/getopt.c
+index 9b27812..3fac396 100644
+--- a/getopt.c
++++ b/getopt.c
+@@ -43,9 +43,9 @@
+ #include <stdio.h>
+ /* We're ANSI now; we're guaranteed to have strchr(). */
+ #include <string.h>
++#include <unistd.h>
+ 
+ #define ERR(s, c)	if(x_opterr){\
+-	extern int write();\
+ 	char errbuf[2];\
+ 	errbuf[0] = c; errbuf[1] = '\n';\
+ 	(void) write(2, argv[0], (unsigned)strlen(argv[0]));\
diff --git a/pkgs/by-name/da/daemonize/package.nix b/pkgs/by-name/da/daemonize/package.nix
index 7f6e2f82acdb..be5daa3c708b 100644
--- a/pkgs/by-name/da/daemonize/package.nix
+++ b/pkgs/by-name/da/daemonize/package.nix
@@ -15,6 +15,13 @@ stdenv.mkDerivation rec {
     sha256 = "1e6LZXf/lK7sB2CbXwOg7LOi0Q8IBQNAa4d7rX0Ej3A=";
   };
 
+  patches = [
+    # conbination of:
+    # https://github.com/bmc/daemonize/commit/eaf4746d47e171e7b8655690eb1e91fc216f2866
+    # https://github.com/bmc/daemonize/pull/39
+    ./include-write-prototype.patch
+  ];
+
   meta = {
     description = "Runs a command as a Unix daemon";
     homepage = "http://software.clapper.org/daemonize/";
diff --git a/pkgs/by-name/dm/dmlive/package.nix b/pkgs/by-name/dm/dmlive/package.nix
index 928260641c6e..a301ddd61701 100644
--- a/pkgs/by-name/dm/dmlive/package.nix
+++ b/pkgs/by-name/dm/dmlive/package.nix
@@ -7,8 +7,7 @@
   makeWrapper,
   openssl,
   mpv,
-  ffmpeg_6,
-  nodejs,
+  ffmpeg,
 }:
 
 let
@@ -20,16 +19,16 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "dmlive";
-  version = "5.6.0-unstable-2025-06-21";
+  version = "5.7.0-unstable-2026-01-02";
 
   src = fetchFromGitHub {
     owner = "THMonster";
     repo = "dmlive";
-    rev = "485eae06737530360c0e6f6415c62791767d595b"; # no tag
-    hash = "sha256-0JjPZPtAtbxdh0HDycWHEonZggBcoqv5SJUnhKzXNIk=";
+    rev = "47b06e57fc0fa9cf888f7c054f776a73d65e77ce"; # no tag
+    hash = "sha256-Q1QOJZ6VW65MG0wzJAgW9p4mF6a48qYRdDaeQyDTbk8=";
   };
 
-  cargoHash = "sha256-B1v9m4Nn5wXMbNBlh7+A8zBejJ0tHdqvSXVpRz+wC5g=";
+  cargoHash = "sha256-hRJ81Opxh3tHHZAVTXzQKTmv+psbeGW1KHyoRBfnnWI=";
 
   nativeBuildInputs = [
     pkg-config
@@ -44,8 +43,7 @@ rustPlatform.buildRustPackage {
     wrapProgram "$out/bin/dmlive" --suffix PATH : "${
       lib.makeBinPath [
         mpv
-        ffmpeg_6
-        nodejs
+        ffmpeg
       ]
     }"
     install -Dm644 ${desktop} $out/share/applications/dmlive-mime.desktop
@@ -58,6 +56,9 @@ rustPlatform.buildRustPackage {
     homepage = "https://github.com/THMonster/dmlive";
     license = lib.licenses.mit;
     mainProgram = "dmlive";
-    maintainers = with lib.maintainers; [ nickcao ];
+    maintainers = with lib.maintainers; [
+      nickcao
+      rebmit
+    ];
   };
 }
diff --git a/pkgs/by-name/fo/forge-mtg/package.nix b/pkgs/by-name/fo/forge-mtg/package.nix
index 21d78fc19f0a..87e50d99a892 100644
--- a/pkgs/by-name/fo/forge-mtg/package.nix
+++ b/pkgs/by-name/fo/forge-mtg/package.nix
@@ -16,13 +16,13 @@
 }:
 
 let
-  version = "2.0.07";
+  version = "2.0.08";
 
   src = fetchFromGitHub {
     owner = "Card-Forge";
     repo = "forge";
     rev = "forge-${version}";
-    hash = "sha256-hPE++/wcK0jkhM4LYt09HZPL6tUVajHaKxXxBYhBw2g=";
+    hash = "sha256-BiBvHpEgvDp0u8g87LAt4/1FTc9t8FRAtSvPEedndEg=";
   };
 
   # launch4j downloads and runs a native binary during the package phase.
@@ -33,7 +33,7 @@ maven.buildMavenPackage {
   pname = "forge-mtg";
   inherit version src patches;
 
-  mvnHash = "sha256-nAhULH7DGO0gkIyHwVmhvyO2lqmBpFWkfiCgtuK9T3A=";
+  mvnHash = "sha256-pa6OMCN1j1l4Kb0oiRQ8ocLLNMeV3ujOeXNpWcODArA=";
 
   doCheck = false; # Needs a running Xorg
 
diff --git a/pkgs/by-name/gi/git-statuses/package.nix b/pkgs/by-name/gi/git-statuses/package.nix
index 530328726196..0949092ea41f 100644
--- a/pkgs/by-name/gi/git-statuses/package.nix
+++ b/pkgs/by-name/gi/git-statuses/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "git-statuses";
-  version = "0.6.2";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "bircni";
     repo = "git-statuses";
     tag = finalAttrs.version;
-    hash = "sha256-ZjlLpPFd+T3NIK2lrzaCfNI7308n3wOco+scGJhxFNI=";
+    hash = "sha256-R0PQIgZ6dXzXmBacNMV9Xc4zwkViKBvEtW1BP/X5Res=";
   };
 
-  cargoHash = "sha256-30WX9dCvrjvPUhn2oIn6unAWEkTB8U2mCEXmixYVIkk=";
+  cargoHash = "sha256-WU8fRtmoYHsvEw2DhDhLX50PzynDJJt3pTpnFvH3G4g=";
 
   # Needed to get openssl-sys to use pkg-config.
   env.OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index 6476d005edfe..c4a4bd7e8334 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -51,6 +51,9 @@
   deterministic-host-uname, # trick Makefile into targeting the host platform when cross-compiling
   doInstallCheck ? !stdenv.hostPlatform.isDarwin, # extremely slow on darwin
   tests,
+  rustSupport ? false,
+  cargo,
+  rustc,
 }:
 
 assert osxkeychainSupport -> stdenv.hostPlatform.isDarwin;
@@ -186,6 +189,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withLibsecret [
     glib
     libsecret
+  ]
+  ++ lib.optionals rustSupport [
+    cargo
+    rustc
   ];
 
   # required to support pthread_cancel()
@@ -234,7 +241,9 @@ stdenv.mkDerivation (finalAttrs: {
   # acceptable version.
   #
   # See https://github.com/Homebrew/homebrew-core/commit/dfa3ccf1e7d3901e371b5140b935839ba9d8b706
-  ++ lib.optional stdenv.hostPlatform.isDarwin "TKFRAMEWORK=/nonexistent";
+  ++ lib.optional stdenv.hostPlatform.isDarwin "TKFRAMEWORK=/nonexistent"
+  # Starting with future Git version 3.0.0, rust will be mandatory. For now, it's optional.
+  ++ lib.optional rustSupport "WITH_RUST=YesPlease";
 
   disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     stdenv.shellPackage
@@ -349,7 +358,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Also put git-http-backend into $PATH, so that we can use smart
     # HTTP(s) transports for pushing
-    ln -s $out/libexec/git-core/git-http-backend $out/bin/git-http-backend
+    ln -s $out/libexec/git-core/git-http-backend${stdenv.hostPlatform.extensions.executable} $out/bin/git-http-backend
     ln -s $out/share/git/contrib/git-jump/git-jump $out/bin/git-jump
   ''
   + lib.optionalString perlSupport ''
diff --git a/pkgs/by-name/ha/hatchet/package.nix b/pkgs/by-name/ha/hatchet/package.nix
index 281bb09bdb71..bfc75f53be96 100644
--- a/pkgs/by-name/ha/hatchet/package.nix
+++ b/pkgs/by-name/ha/hatchet/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "hatchet";
-  version = "0.7.2";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "simagix";
     repo = "hatchet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-L7n5qR6Ijs5wC4ITq6at8EznkiKEceUJgYJyeSoWFWY=";
+    hash = "sha256-KoDiioIimktbA3SWHbLM+WAKdEb60cmkuqLw5WNgVRI=";
   };
 
-  vendorHash = "sha256-5YzrxSB/3tKxE1ObAnx1lbIc+Zlufc6wIJuDQqCcRKc=";
+  vendorHash = "sha256-qZH6+zXcyHg7+KkQjtsZWHpIr0n22R4gH9uzGuFU5CY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/he/hello/package.nix b/pkgs/by-name/he/hello/package.nix
index bbcce772a3aa..a789c0a75583 100644
--- a/pkgs/by-name/he/hello/package.nix
+++ b/pkgs/by-name/he/hello/package.nix
@@ -25,6 +25,12 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_LDFLAGS = "-liconv";
   };
 
+  # lib/string.h:754:20: error: expected declaration specifiers or '...' before numeric constant
+  # The embedded gnulib is currently broken on cygwin when fortify is enabled.
+  # This can be removed when gnulib is updated with the fix:
+  # https://gitweb.git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commitdiff_plain;h=c44fe03b72687c9e913727724c29bdb49c1f86e3
+  hardeningDisable = lib.optional stdenv.hostPlatform.isCygwin "fortify";
+
   doCheck = true;
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/hy/hyprtoolkit/package.nix b/pkgs/by-name/hy/hyprtoolkit/package.nix
index f1baacb1999d..bf97ca524c9e 100644
--- a/pkgs/by-name/hy/hyprtoolkit/package.nix
+++ b/pkgs/by-name/hy/hyprtoolkit/package.nix
@@ -25,13 +25,13 @@
 
 gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprtoolkit";
-  version = "0.4.1";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprtoolkit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IAGHOvvuCnJ6zWB3efxboJ/HUfSaXJ6pzrMwOMS2lJY=";
+    hash = "sha256-qxWKwg99yIV72E+xAUz82+TD3X3+VPgnGHBX6mOLp9Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index b55fa6fdb5ed..ab08cdd99396 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -33,7 +33,7 @@
   pango,
   perl,
   pixman,
-  vips,
+  vips_8_17, # thumbnail generation fails with vips 8.18
   buildPackages,
 }:
 let
@@ -109,7 +109,7 @@ let
 
   # Without this thumbnail generation for raw photos fails with
   #     Error: Input file has corrupt header: tiff2vips: samples_per_pixel not a whole number of bytes
-  vips' = vips.overrideAttrs (prev: {
+  vips' = vips_8_17.overrideAttrs (prev: {
     mesonFlags = prev.mesonFlags ++ [ "-Dtiff=disabled" ];
   });
 in
diff --git a/pkgs/by-name/ka/karing/package.nix b/pkgs/by-name/ka/karing/package.nix
index 442bb3f6dbd7..fc9d0e8624bd 100644
--- a/pkgs/by-name/ka/karing/package.nix
+++ b/pkgs/by-name/ka/karing/package.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "karing";
-  version = "1.2.5.881";
+  version = "1.2.10.1306";
 
   src = fetchurl {
     url = "https://github.com/KaringX/karing/releases/download/v${finalAttrs.version}/karing_${finalAttrs.version}_linux_amd64.deb";
-    hash = "sha256-gkuKdOq07C7xd8xNoXWlcqaZ7xe9VmjU8e43Hg1yN7w=";
+    hash = "sha256-1mlXSe12M5ngRV+zmCzQ1r8K0DVAehWrDqL4673lgJ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mc/mcabber/add-missing-arguments-to-function-prototypes.patch b/pkgs/by-name/mc/mcabber/add-missing-arguments-to-function-prototypes.patch
new file mode 100644
index 000000000000..d39e4a807d9b
--- /dev/null
+++ b/pkgs/by-name/mc/mcabber/add-missing-arguments-to-function-prototypes.patch
@@ -0,0 +1,44 @@
+GCC 15 uses C23 by default which is stricter about function prototypes.
+
+diff -r -U3 mcabber-1.1.2.orig/mcabber/screen.c mcabber-1.1.2/mcabber/screen.c
+--- mcabber-1.1.2.orig/mcabber/screen.c	2026-01-02 22:48:11.169262178 +0100
++++ mcabber-1.1.2/mcabber/screen.c	2026-01-02 22:51:01.428023634 +0100
+@@ -90,7 +90,7 @@
+                            const gchar *message, gpointer user_data);
+ 
+ #ifdef XEP0085
+-static gboolean scr_chatstates_timeout();
++static gboolean scr_chatstates_timeout(gpointer user_data);
+ #endif
+ 
+ #if defined(WITH_ENCHANT) || defined(WITH_ASPELL)
+@@ -2485,7 +2485,7 @@
+ }
+ 
+ #ifdef XEP0085
+-static gboolean scr_chatstates_timeout(void)
++static gboolean scr_chatstates_timeout(gpointer user_data)
+ {
+   time_t now;
+   time(&now);
+diff -r -U3 mcabber-1.1.2.orig/mcabber/xmpp.c mcabber-1.1.2/mcabber/xmpp.c
+--- mcabber-1.1.2.orig/mcabber/xmpp.c	2026-01-02 22:48:11.166975512 +0100
++++ mcabber-1.1.2/mcabber/xmpp.c	2026-01-02 22:52:30.355029495 +0100
+@@ -50,7 +50,7 @@
+ static guint AutoConnection;
+ 
+ inline void update_last_use(void);
+-inline gboolean xmpp_reconnect();
++inline gboolean xmpp_reconnect(gpointer user_data);
+ 
+ enum imstatus mystatus = offline;
+ static enum imstatus mywantedstatus = available;
+@@ -781,7 +781,7 @@
+     scr_LogPrint(LPRINT_LOGNORM, "Authentication failed");
+ }
+ 
+-gboolean xmpp_reconnect()
++gboolean xmpp_reconnect(gpointer user_data)
+ {
+   if (!lconnection)
+     xmpp_connect();
diff --git a/pkgs/by-name/mc/mcabber/package.nix b/pkgs/by-name/mc/mcabber/package.nix
index 72b0e5ca2a8b..3d33be3e2deb 100644
--- a/pkgs/by-name/mc/mcabber/package.nix
+++ b/pkgs/by-name/mc/mcabber/package.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
       sha256 = "01bc23z0mva9l9jv587sq2r9w3diachgkmb9ad99hlzgj02fmq4v";
       stripLen = 1;
     })
+    ./add-missing-arguments-to-function-prototypes.patch
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/mc/mcp-proxy/package.nix b/pkgs/by-name/mc/mcp-proxy/package.nix
index cea0fd0bd6fe..a48184148402 100644
--- a/pkgs/by-name/mc/mcp-proxy/package.nix
+++ b/pkgs/by-name/mc/mcp-proxy/package.nix
@@ -5,13 +5,13 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "mcp-proxy";
-  version = "0.8.2";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "sparfenyuk";
     repo = "mcp-proxy";
     tag = "v${version}";
-    hash = "sha256-3hNpUOWbyOUjLcvfcMzj4+xHyUl7k1ZSy8muWHvSEvM=";
+    hash = "sha256-Hig+ZDFdToiYGOjb/rpqxnu8MaLmQLgSh5WYcgJGA1I=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/pa/pasystray/package.nix b/pkgs/by-name/pa/pasystray/package.nix
index 26e344a7d3f5..68c9d59176b1 100644
--- a/pkgs/by-name/pa/pasystray/package.nix
+++ b/pkgs/by-name/pa/pasystray/package.nix
@@ -39,6 +39,12 @@ stdenv.mkDerivation rec {
       url = "https://sources.debian.org/data/main/p/pasystray/0.8.1-1/debian/patches/0002-Require-X11-backend.patch";
       sha256 = "sha256-6njC3vqBPWFS1xAsa1katQ4C0KJdVkHAP1MCPiZ6ELM=";
     })
+    # Fix build with GCC 15
+    # https://github.com/christophgysin/pasystray/pull/183.patch
+    (fetchpatch {
+      url = "https://github.com/christophgysin/pasystray/commit/9883809c7956471cf085ae90af4a9831c1234417.patch";
+      hash = "sha256-BQ10LddqE3XwUeRklZE3S3+KOjJ9BtfddaFswgUqZ5g=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 91aa344f3510..70a8c9a86f9f 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -266,18 +266,6 @@ python.pkgs.buildPythonApplication rec {
   disabledTests = [
     # unreliable around day changes
     "test_order_create_invoice"
-
-    # outdated translation files
-    # https://github.com/pretix/pretix/commit/c4db2a48b6ac81763fa67475d8182aee41c31376
-    "test_different_dates_spanish"
-    "test_same_day_spanish"
-    "test_same_month_spanish"
-    "test_same_year_spanish"
-
-    # broken with fakeredis>=2.27.0
-    "test_waitinglist_cache_separation"
-    "test_waitinglist_item_active"
-    "test_waitinglist_variation_active"
   ];
 
   preCheck = ''
diff --git a/pkgs/by-name/sk/skia-aseprite/package.nix b/pkgs/by-name/sk/skia-aseprite/package.nix
index e901343a2941..cb56f0a9475b 100644
--- a/pkgs/by-name/sk/skia-aseprite/package.nix
+++ b/pkgs/by-name/sk/skia-aseprite/package.nix
@@ -42,8 +42,6 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   # Using substituteInPlace because no clean upstream backport for GCC 15 exists for this version of Skia, newer versions fix this with large refactorings.
   postPatch = ''
-    substituteInPlace include/private/SkSLProgramKind.h \
-      --replace-fail "#include <cinttypes>" "#include <cinttypes>
     #include <cstdint>"
     substituteInPlace src/sksl/transform/SkSLTransform.h \
       --replace-fail "#include <vector>" "#include <vector>
diff --git a/pkgs/by-name/sp/spearspray/package.nix b/pkgs/by-name/sp/spearspray/package.nix
index 6ed536a4af2f..413bb6ee28d0 100644
--- a/pkgs/by-name/sp/spearspray/package.nix
+++ b/pkgs/by-name/sp/spearspray/package.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "spearspray";
-  version = "2.0.0-unstable-2025-08-25";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/st/streamcontroller/package.nix b/pkgs/by-name/st/streamcontroller/package.nix
index b8137979170c..fba6d917c05d 100644
--- a/pkgs/by-name/st/streamcontroller/package.nix
+++ b/pkgs/by-name/st/streamcontroller/package.nix
@@ -18,19 +18,19 @@
 }:
 let
   # We have to hardcode revision because upstream often create multiple releases for the same version number.
-  # This is the commit hash that maps to 1.5.0-beta.8 released on 2025-03-12
-  rev = "de11d84afac7873044568606a8468c78d57aceda";
+  # This is the commit hash that maps to 1.5.0-beta.12 released on 2025-10-11
+  rev = "73b7632ff2977d05763acd56e53bdc7a37d30c0c";
 in
 stdenv.mkDerivation {
   pname = "streamcontroller";
 
-  version = "1.5.0-beta.8";
+  version = "1.5.0-beta.12";
 
   src = fetchFromGitHub {
     repo = "StreamController";
     owner = "StreamController";
     inherit rev;
-    hash = "sha256-pE92/oX9iZYCIhwDkPkjPq/cDUQLUGs+Ou5rjFEIBpo=";
+    hash = "sha256-6H0FPkvjKSfso1+E0JwseOnubDXwYys0RVBbyaGCXw0=";
   };
 
   # The installation method documented upstream
@@ -167,6 +167,7 @@ stdenv.mkDerivation {
     pyro5
     pyspellchecker
     python-dateutil
+    python-wayland-extra
     pyudev
     pyusb
     pyyaml
@@ -182,7 +183,7 @@ stdenv.mkDerivation {
     smmap
     speedtest-cli
     streamcontroller-plugin-tools
-    streamdeck
+    streamcontroller-streamdeck
     textual
     tinycss2
     tqdm
diff --git a/pkgs/by-name/th/theharvester/package.nix b/pkgs/by-name/th/theharvester/package.nix
index 6e10752f66dc..2e1a5ae71fb5 100644
--- a/pkgs/by-name/th/theharvester/package.nix
+++ b/pkgs/by-name/th/theharvester/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "theharvester";
-  version = "4.9.0";
+  version = "4.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "laramies";
     repo = "theharvester";
     tag = version;
-    hash = "sha256-2PiwfLqpVa29//DJJRM/zw2xFHI4cp1WE4VKsJ/zEro=";
+    hash = "sha256-ZD5nFjhunD6miBBgCp7r82l/zIbLjHSj1jghXGav8hI=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/tu/tuisky/package.nix b/pkgs/by-name/tu/tuisky/package.nix
index 4aaeee7869f8..b581098371ed 100644
--- a/pkgs/by-name/tu/tuisky/package.nix
+++ b/pkgs/by-name/tu/tuisky/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tuisky";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "sugyan";
     repo = "tuisky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7SkY2n5nfqGDxbaSYmWwwmksA8eNY9SjRLLfCUP3qtc=";
+    hash = "sha256-isS3MDyQ3iv5fYAw/i9V905J+2QnMFx2bebA853fBd4=";
   };
 
-  cargoHash = "sha256-rkIc/dRvuuOUq2v3bHLAL//DmiEBbBAhTxR0MHxAL/U=";
+  cargoHash = "sha256-coBP2uItI/PJv4Bt3ILDo4ruyqejGwWjaDw5DmxseXw=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/un/units/package.nix b/pkgs/by-name/un/units/package.nix
index 6cdc6a276af6..9a7531653479 100644
--- a/pkgs/by-name/un/units/package.nix
+++ b/pkgs/by-name/un/units/package.nix
@@ -37,11 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
     pythonEnv
   ];
 
-  prePatch = lib.optionalString enableCurrenciesUpdater ''
-    substituteInPlace units_cur \
-      --replace "#!/usr/bin/env python" ${pythonEnv}/bin/python
-  '';
-
   postInstall = lib.optionalString enableCurrenciesUpdater ''
     cp units_cur ${placeholder "out"}/bin/
   '';
diff --git a/pkgs/by-name/vc/vcmi/package.nix b/pkgs/by-name/vc/vcmi/package.nix
index 666aab9dd202..fa20ebcdd320 100644
--- a/pkgs/by-name/vc/vcmi/package.nix
+++ b/pkgs/by-name/vc/vcmi/package.nix
@@ -27,14 +27,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcmi";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-wwPlsXJd34OYfLdCkCl6PdboEo+9/ZPQWgmSxn88W+k=";
+    hash = "sha256-3XZQyq6urCTI/A6tCSHgzPgOvzH8ckXvDRamWvVgeVY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/vips_8_17/package.nix b/pkgs/by-name/vi/vips_8_17/package.nix
new file mode 100644
index 000000000000..85b20e7222be
--- /dev/null
+++ b/pkgs/by-name/vi/vips_8_17/package.nix
@@ -0,0 +1,177 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  # Native build inputs
+  docbook-xsl-nons,
+  gi-docgen,
+  gobject-introspection,
+  meson,
+  ninja,
+  pkg-config,
+  buildPackages,
+
+  # Build inputs
+  expat,
+  glib,
+  libxml2,
+  python3,
+
+  # Optional dependencies
+  cfitsio,
+  cgif,
+  fftw,
+  imagemagick,
+  lcms2,
+  libarchive,
+  libexif,
+  libheif,
+  libhwy,
+  libimagequant,
+  libjpeg,
+  libjxl,
+  librsvg,
+  libpng,
+  libtiff,
+  libwebp,
+  matio,
+  openexr,
+  openjpeg,
+  openslide,
+  pango,
+  poppler,
+  withIntrospection ?
+    lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+    && stdenv.hostPlatform.emulatorAvailable buildPackages,
+
+  # passthru
+  testers,
+  nix-update-script,
+
+  # meta
+  immich,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vips";
+  version = "8.17.3";
+
+  outputs = [
+    "bin"
+    "out"
+    "man"
+    "dev"
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isFreeBSD) [ "devdoc" ];
+
+  src = fetchFromGitHub {
+    owner = "libvips";
+    repo = "libvips";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yxjfkb2R3JPHbz0vCG4hkW9Davoc9MUPHL9Cqc+Ik0Y=";
+    # Remove unicode file names which leads to different checksums on HFS+
+    # vs. other filesystems because of unicode normalisation.
+    postFetch = ''
+      rm -r $out/test/test-suite/images/
+    '';
+  };
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  nativeBuildInputs = [
+    docbook-xsl-nons
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isFreeBSD) [
+    gi-docgen
+  ];
+
+  buildInputs = [
+    glib
+    libxml2
+    expat
+    (python3.withPackages (p: [ p.pycairo ]))
+
+    # Optional dependencies
+    cfitsio
+    cgif
+    fftw
+    imagemagick
+    lcms2
+    libarchive
+    libexif
+    libheif
+    libhwy
+    libimagequant
+    libjpeg
+    libjxl
+    librsvg
+    libpng
+    libtiff
+    libwebp
+    matio
+    openexr
+    openjpeg
+    openslide
+    pango
+    poppler
+  ];
+
+  # Required by .pc file
+  propagatedBuildInputs = [
+    glib
+  ];
+
+  mesonFlags = [
+    (lib.mesonEnable "pdfium" false)
+    (lib.mesonEnable "nifti" false)
+    (lib.mesonEnable "spng" false) # we want to use libpng
+    (lib.mesonEnable "introspection" withIntrospection)
+  ]
+  ++ lib.optional (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isFreeBSD) (
+    lib.mesonBool "docs" true
+  )
+  ++ lib.optional (imagemagick == null) (lib.mesonEnable "magick" false);
+
+  postFixup = ''
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
+  passthru = {
+    tests = {
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+      };
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "vips --version";
+      };
+    };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "^v([0-9.]+)$"
+      ];
+    };
+  };
+
+  meta = {
+    changelog = "https://github.com/libvips/libvips/blob/${finalAttrs.src.rev}/ChangeLog";
+    homepage = "https://www.libvips.org/";
+    description = "Image processing system for large images";
+    license = lib.licenses.lgpl2Plus;
+    inherit (immich.meta) maintainers;
+    pkgConfigModules = [
+      "vips"
+      "vips-cpp"
+    ];
+    platforms = lib.platforms.unix;
+    mainProgram = "vips";
+  };
+})
diff --git a/pkgs/by-name/wt/wtfis/package.nix b/pkgs/by-name/wt/wtfis/package.nix
index c7424f416ad3..e5b87fc0b245 100644
--- a/pkgs/by-name/wt/wtfis/package.nix
+++ b/pkgs/by-name/wt/wtfis/package.nix
@@ -6,12 +6,12 @@
 
 let
   pname = "wtfis";
-  version = "0.13.0";
+  version = "0.14.0";
   src = fetchFromGitHub {
     owner = "pirxthepilot";
     repo = "wtfis";
     tag = "v${version}";
-    hash = "sha256-YEuj4WgRhAXMbYVcSy5eLH8284EGn3dtP2UEjXCA720=";
+    hash = "sha256-XFitQY30hK3byVevqndSAkG08ztwY1BIpJEYhY3PzTs=";
   };
 in
 python3.pkgs.buildPythonApplication {
diff --git a/pkgs/development/python-modules/aardwolf/default.nix b/pkgs/development/python-modules/aardwolf/default.nix
index 13dcd2b84f8d..1ab694dc7652 100644
--- a/pkgs/development/python-modules/aardwolf/default.nix
+++ b/pkgs/development/python-modules/aardwolf/default.nix
@@ -33,10 +33,18 @@ buildPythonPackage rec {
     hash = "sha256-8QXPvfVeT3qadxTvt/LQX3XM5tGj6SpfOhP/9xcZHW4=";
   };
 
+  patches = [ ./update-pyo3.patch ];
+
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
+    inherit
+      pname
+      version
+      src
+      patches
+      ;
     sourceRoot = "${src.name}/aardwolf/utils/rlers";
-    hash = "sha256-+2hENnrG35eRgQwtCCJUux9mYEkzD2astLgOqWHrH/M=";
+    hash = "sha256-n28jzS2+zbXsdR7rT0PBvcqNacuFMJKUug0mBYc4eFE=";
+    patchFlags = [ "-p4" ]; # strip i/aardwolf/utils/rlers/ prefix
   };
 
   cargoRoot = "aardwolf/utils/rlers";
diff --git a/pkgs/development/python-modules/aardwolf/update-pyo3.patch b/pkgs/development/python-modules/aardwolf/update-pyo3.patch
new file mode 100644
index 000000000000..777879277050
--- /dev/null
+++ b/pkgs/development/python-modules/aardwolf/update-pyo3.patch
@@ -0,0 +1,111 @@
+diff --git i/aardwolf/utils/rlers/Cargo.lock w/aardwolf/utils/rlers/Cargo.lock
+index c287687..2fbd4a1 100644
+--- i/aardwolf/utils/rlers/Cargo.lock
++++ w/aardwolf/utils/rlers/Cargo.lock
+@@ -1,6 +1,6 @@
+ # This file is automatically @generated by Cargo.
+ # It is not intended for manual editing.
+-version = 3
++version = 4
+ 
+ [[package]]
+ name = "autocfg"
+@@ -14,12 +14,6 @@ version = "1.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+ 
+-[[package]]
+-name = "cfg-if"
+-version = "1.0.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+-
+ [[package]]
+ name = "heck"
+ version = "0.5.0"
+@@ -70,11 +64,10 @@ dependencies = [
+ 
+ [[package]]
+ name = "pyo3"
+-version = "0.23.5"
++version = "0.27.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7778bffd85cf38175ac1f545509665d0b9b92a198ca7941f131f85f7a4f9a872"
++checksum = "ab53c047fcd1a1d2a8820fe84f05d6be69e9526be40cb03b73f86b6b03e6d87d"
+ dependencies = [
+- "cfg-if",
+  "indoc",
+  "libc",
+  "memoffset",
+@@ -88,19 +81,18 @@ dependencies = [
+ 
+ [[package]]
+ name = "pyo3-build-config"
+-version = "0.23.5"
++version = "0.27.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "94f6cbe86ef3bf18998d9df6e0f3fc1050a8c5efa409bf712e661a4366e010fb"
++checksum = "b455933107de8642b4487ed26d912c2d899dec6114884214a0b3bb3be9261ea6"
+ dependencies = [
+- "once_cell",
+  "target-lexicon",
+ ]
+ 
+ [[package]]
+ name = "pyo3-ffi"
+-version = "0.23.5"
++version = "0.27.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e9f1b4c431c0bb1c8fb0a338709859eed0d030ff6daa34368d3b152a63dfdd8d"
++checksum = "1c85c9cbfaddf651b1221594209aed57e9e5cff63c4d11d1feead529b872a089"
+ dependencies = [
+  "libc",
+  "pyo3-build-config",
+@@ -108,9 +100,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pyo3-macros"
+-version = "0.23.5"
++version = "0.27.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fbc2201328f63c4710f68abdf653c89d8dbc2858b88c5d88b0ff38a75288a9da"
++checksum = "0a5b10c9bf9888125d917fb4d2ca2d25c8df94c7ab5a52e13313a07e050a3b02"
+ dependencies = [
+  "proc-macro2",
+  "pyo3-macros-backend",
+@@ -120,9 +112,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "pyo3-macros-backend"
+-version = "0.23.5"
++version = "0.27.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "fca6726ad0f3da9c9de093d6f116a93c1a38e417ed73bf138472cf4064f72028"
++checksum = "03b51720d314836e53327f5871d4c0cfb4fb37cc2c4a11cc71907a86342c40f9"
+ dependencies = [
+  "heck",
+  "proc-macro2",
+@@ -161,9 +153,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "target-lexicon"
+-version = "0.12.16"
++version = "0.13.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
++checksum = "b1dd07eb858a2067e2f3c7155d54e929265c264e6f37efe3ee7a8d1b5a1dd0ba"
+ 
+ [[package]]
+ name = "unicode-ident"
+diff --git i/aardwolf/utils/rlers/Cargo.toml w/aardwolf/utils/rlers/Cargo.toml
+index d09de36..7f8ca8a 100644
+--- i/aardwolf/utils/rlers/Cargo.toml
++++ w/aardwolf/utils/rlers/Cargo.toml
+@@ -17,5 +17,5 @@ crate-type = ["cdylib"]
+ path = "src/rle.rs"
+ 
+ [dependencies]
+-pyo3 = { version = "0.23.5", features = ["abi3"] }
++pyo3 = { version = "0.27.2", features = ["abi3"] }
+ byteorder = "1.4.3"
+\ No newline at end of file
diff --git a/pkgs/development/python-modules/aiogram/default.nix b/pkgs/development/python-modules/aiogram/default.nix
index 09db1d9520aa..df75ddcf2b0b 100644
--- a/pkgs/development/python-modules/aiogram/default.nix
+++ b/pkgs/development/python-modules/aiogram/default.nix
@@ -76,6 +76,11 @@ buildPythonPackage rec {
   ]
   ++ lib.concatAttrValues optional-dependencies;
 
+  pytestFlags = [
+    # DeprecationWarning: 'asyncio.get_event_loop_policy' is deprecated and slate...
+    "-Wignore::DeprecationWarning"
+  ];
+
   pythonImportsCheck = [ "aiogram" ];
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/development/python-modules/argh/default.nix b/pkgs/development/python-modules/argh/default.nix
index 6107e43d8542..7d371abee976 100644
--- a/pkgs/development/python-modules/argh/default.nix
+++ b/pkgs/development/python-modules/argh/default.nix
@@ -18,6 +18,14 @@ buildPythonPackage rec {
     hash = "sha256-8wAj2L4Uyl7msbPuq4KRUde72kZK4H3E3VNHkZxYkvk=";
   };
 
+  patches = [
+    # python3.14 introduced a breaking change which caused a test to fail. A
+    # fix has been commited upstream in a pull request by the author, but has
+    # since been kept unmerged
+    # https://github.com/neithere/argh/pull/240
+    ./pr240-699568ad-06-01-2025-test_integration.patch
+  ];
+
   nativeBuildInputs = [ flit-core ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/argh/pr240-699568ad-06-01-2025-test_integration.patch b/pkgs/development/python-modules/argh/pr240-699568ad-06-01-2025-test_integration.patch
new file mode 100644
index 000000000000..6b0b7a6c56a6
--- /dev/null
+++ b/pkgs/development/python-modules/argh/pr240-699568ad-06-01-2025-test_integration.patch
@@ -0,0 +1,57 @@
+diff --git a/tests/test_integration.py b/tests/test_integration.py
+index 8839265..6fc8a17 100644
+--- a/tests/test_integration.py
++++ b/tests/test_integration.py
+@@ -17,7 +17,7 @@
+ from argh.utils import unindent
+ 
+ from .base import CmdResult as R
+-from .base import DebugArghParser, get_usage_string, run
++from .base import DebugArghParser, run
+ 
+ if sys.version_info < (3, 10):
+     HELP_OPTIONS_LABEL = "optional arguments"
+@@ -796,11 +796,17 @@ def func():
+     parser = DebugArghParser()
+     parser.set_default_command(func)
+ 
+-    assert unindent(func.__doc__) in parser.format_help()
++    docstring = func.__doc__
++    assert docstring
++    assert unindent(docstring) in parser.format_help()
+ 
+ 
+ def test_prog(capsys: pytest.CaptureFixture[str]):
+-    "Program name propagates from sys.argv[0]"
++    """
++    Program name propagates to the usage string.
++    It's not just sys.argv[0], the logic is a bit more complicated in argparse,
++    so we just reuse whatever it has produced.
++    """
+ 
+     def cmd(*, foo=1):
+         return foo
+@@ -808,10 +814,12 @@ def cmd(*, foo=1):
+     parser = DebugArghParser()
+     parser.add_commands([cmd])
+ 
+-    usage = get_usage_string()
++    usage = f"usage: {parser.prog} [-h]"
+ 
+-    assert run(parser, "-h", exit=True) == 0
++    exit_code = run(parser, "-h", exit=True)
+     captured = capsys.readouterr()
++
++    assert exit_code == 0
+     assert captured.out.startswith(usage)
+ 
+ 
+@@ -822,8 +830,6 @@ def cmd(*, foo=1):
+     parser = DebugArghParser()
+     parser.set_default_command(cmd)
+ 
+-    get_usage_string("[-f FOO]")
+-
+     assert run(parser, "--foo 1") == R(out="1\n", err="")
+     assert run(parser, "--bar 1", exit=True) == "unrecognized arguments: --bar 1"
+     assert run(parser, "--bar 1", exit=False, kwargs={"skip_unknown_args": True}) == R(
diff --git a/pkgs/development/python-modules/asyauth/default.nix b/pkgs/development/python-modules/asyauth/default.nix
index 6df5b6ee134b..1bf1fc0db692 100644
--- a/pkgs/development/python-modules/asyauth/default.nix
+++ b/pkgs/development/python-modules/asyauth/default.nix
@@ -5,21 +5,18 @@
   buildPythonPackage,
   fetchPypi,
   minikerberos,
-  pythonOlder,
   setuptools,
   unicrypto,
 }:
 
 buildPythonPackage rec {
   pname = "asyauth";
-  version = "0.0.22";
+  version = "0.0.23";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+qaDQDLTzkS/ZgYCv8gpc8DeRoBqdodis+uTEoF1nws=";
+    hash = "sha256-NvA4TdsrYloQMzNjyv4ZDW6cntF/0Hs+KIdkGjzGJvA=";
   };
 
   build-system = [ setuptools ];
@@ -40,7 +37,7 @@ buildPythonPackage rec {
     description = "Unified authentication library";
     homepage = "https://github.com/skelsec/asyauth";
     changelog = "https://github.com/skelsec/asyauth/releases/tag/${version}";
-    license = with lib.licenses; [ mit ];
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/asysocks/default.nix b/pkgs/development/python-modules/asysocks/default.nix
index 14d034063b15..a735a23082d1 100644
--- a/pkgs/development/python-modules/asysocks/default.nix
+++ b/pkgs/development/python-modules/asysocks/default.nix
@@ -5,20 +5,17 @@
   cryptography,
   fetchPypi,
   h11,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "asysocks";
-  version = "0.2.17";
+  version = "0.2.18";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-r6F7Sel8D3noBQE8fDYQ5k9NzIFOmUWT+1CGrWVCWTw=";
+    hash = "sha256-zGGW6CyK3Is84jId3fY1UAx2AxbaS3zKMhtTLLs9/fU=";
   };
 
   build-system = [ setuptools ];
@@ -38,7 +35,7 @@ buildPythonPackage rec {
     description = "Python Socks4/5 client and server library";
     homepage = "https://github.com/skelsec/asysocks";
     changelog = "https://github.com/skelsec/asysocks/releases/tag/${version}";
-    license = with lib.licenses; [ mit ];
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/atom/default.nix b/pkgs/development/python-modules/atom/default.nix
index a07c00361ea6..2915803a4f0a 100644
--- a/pkgs/development/python-modules/atom/default.nix
+++ b/pkgs/development/python-modules/atom/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "atom";
-  version = "0.11.0";
+  version = "0.12.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "nucleic";
     repo = "atom";
     tag = version;
-    hash = "sha256-3Xk4CM8Cnkc0lIdjJUYs/6UTqqpPALrUa3DpKD40og8=";
+    hash = "sha256-XFJujJrxubtdCLTr1oaM7h0LNS1Ep08f8+1tRzARBqs=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/duckdb-engine/default.nix b/pkgs/development/python-modules/duckdb-engine/default.nix
index dce30d2ab443..46f5917acefc 100644
--- a/pkgs/development/python-modules/duckdb-engine/default.nix
+++ b/pkgs/development/python-modules/duckdb-engine/default.nix
@@ -81,6 +81,14 @@ buildPythonPackage rec {
     "test_get_foreign_keys"
     "test_get_check_constraints"
     "test_get_unique_constraints"
+    # https://github.com/Mause/duckdb_engine/issues/1379
+    "test_reflect"
+    "test_get_multi_columns"
+    "test_table_reflect"
+    "test_comment_support"
+    "test_361"
+    "test_reflection"
+    "test_fetch_arrow"
   ];
 
   pythonImportsCheck = [ "duckdb_engine" ];
diff --git a/pkgs/development/python-modules/elementpath/default.nix b/pkgs/development/python-modules/elementpath/default.nix
index 662b56357a8a..375f5bf54d01 100644
--- a/pkgs/development/python-modules/elementpath/default.nix
+++ b/pkgs/development/python-modules/elementpath/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "elementpath";
-  version = "5.0.4";
+  version = "5.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "elementpath";
     tag = "v${version}";
-    hash = "sha256-puScPtX46KQ5tSpsZMtuyiCz1cRY43STeJD4P3rkoFY=";
+    hash = "sha256-3eVxGBvYkTLHTD5uDE2rB09v0mzj1DkuZb8N1ZFj4qs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/extract-msg/default.nix b/pkgs/development/python-modules/extract-msg/default.nix
index 89f5e3ed885b..171ee9acbd11 100644
--- a/pkgs/development/python-modules/extract-msg/default.nix
+++ b/pkgs/development/python-modules/extract-msg/default.nix
@@ -7,7 +7,6 @@
   fetchFromGitHub,
   olefile,
   pytestCheckHook,
-  pythonOlder,
   red-black-tree-mod,
   rtfde,
   setuptools,
@@ -19,8 +18,6 @@ buildPythonPackage rec {
   version = "0.55.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "TeamMsgExtractor";
     repo = "msg-extractor";
@@ -29,13 +26,12 @@ buildPythonPackage rec {
   };
 
   pythonRelaxDeps = [
+    "beautifulsoup4"
     "olefile"
     "red-black-tree-mod"
   ];
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     beautifulsoup4
diff --git a/pkgs/development/python-modules/fava-portfolio-returns/default.nix b/pkgs/development/python-modules/fava-portfolio-returns/default.nix
new file mode 100644
index 000000000000..b539d281c094
--- /dev/null
+++ b/pkgs/development/python-modules/fava-portfolio-returns/default.nix
@@ -0,0 +1,97 @@
+{
+  lib,
+  buildPythonPackage,
+  buildNpmPackage,
+  fetchFromGitHub,
+  stdenv,
+  fava,
+  hatch-vcs,
+  hatchling,
+  numpy,
+  pandas,
+  protobuf,
+  pytestCheckHook,
+  scipy,
+}:
+let
+  pname = "fava-portfolio-returns";
+  version = "2.3.0";
+  src = fetchFromGitHub {
+    owner = "andreasgerstmayr";
+    repo = "fava-portfolio-returns";
+    rev = "v${version}";
+    hash = "sha256-NM+0gcgSztcgzYj0nCe9DOK90lrzE0TOzH30WvTKsUA=";
+  };
+
+  frontend = buildNpmPackage (finalAttrs: {
+    pname = "${pname}-frontend";
+    inherit version;
+
+    src = "${src}/frontend";
+
+    npmDepsHash = "sha256-MDoZC5IAR9puWMLBhLb5HRoagBPyNiyJ+0879ljCNUo=";
+
+    postPatch = ''
+      substituteInPlace package.json \
+        --replace-fail '"name": "fava-portfolio-returns",' '"name": "fava-portfolio-returns", "version": "${finalAttrs.version}",'
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp ../src/fava_portfolio_returns/FavaPortfolioReturns.js $out/
+
+      runHook postInstall
+    '';
+  });
+in
+buildPythonPackage {
+  inherit pname version src;
+  pyproject = true;
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  dependencies = [
+    fava
+    numpy
+    pandas
+    protobuf
+    scipy
+  ];
+
+  preInstall = ''
+    cp ${frontend}/FavaPortfolioReturns.js src/fava_portfolio_returns/
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "fava_portfolio_returns" ];
+
+  # Stay in the root of the repository, so that relative paths to example files
+  # loaded by tests stay correct.
+  # Remove `src` to avoid `PYTHONPATH` issues related to `pytestCheckHook` ([1])
+  # [1]: https://github.com/NixOS/nixpkgs/issues/255262
+  preCheck = ''
+    rm -rf src
+  '';
+
+  pytestFlags = [
+    "${placeholder "out"}"
+  ];
+
+  passthru = {
+    inherit frontend;
+  };
+
+  meta = {
+    description = "Show portfolio returns in Fava";
+    homepage = "https://github.com/andreasgerstmayr/fava-portfolio-returns";
+    changelog = "https://github.com/andreasgerstmayr/fava-portfolio-returns/blob/main/CHANGELOG.md";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ ambroisie ];
+  };
+}
diff --git a/pkgs/development/python-modules/hyperpyyaml/default.nix b/pkgs/development/python-modules/hyperpyyaml/default.nix
index c09d10e7dc7c..68c77bf378d7 100644
--- a/pkgs/development/python-modules/hyperpyyaml/default.nix
+++ b/pkgs/development/python-modules/hyperpyyaml/default.nix
@@ -2,24 +2,35 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   pyyaml,
   ruamel-yaml,
+
+  # tests
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "hyperpyyaml";
-  version = "1.2.2";
-  format = "setuptools";
+  version = "1.2.3";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "speechbrain";
     repo = "hyperpyyaml";
     tag = "v${version}";
-    hash = "sha256-eA4/wXmqlqomfRbJNi7dkBRoxneCbCbURSPvASF2sgA=";
+    hash = "sha256-/7OrIR61zQYl2+RjiOOlaqUGWBieon5fe8sgmEvKowo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     pyyaml
     ruamel-yaml
   ];
@@ -31,7 +42,7 @@ buildPythonPackage rec {
   meta = {
     description = "Extensions to YAML syntax for better python interaction";
     homepage = "https://github.com/speechbrain/HyperPyYAML";
-    changelog = "https://github.com/speechbrain/HyperPyYAML/releases/tag/v${version}";
+    changelog = "https://github.com/speechbrain/HyperPyYAML/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 5d1c3c920efc..44b063adb43c 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202601011";
+  version = "0.1.202601021";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-tDGY7d8rmD4vKyoFmDAYppuF56aHcb5Ry3nMxOv6PRs=";
+    hash = "sha256-rZzsiaoFoeTL5tv0nPSw8f6p/M4IIh7jJvny1W/wwM4=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/mcp/default.nix b/pkgs/development/python-modules/mcp/default.nix
index 1a0519f1e2ed..9df48a47c598 100644
--- a/pkgs/development/python-modules/mcp/default.nix
+++ b/pkgs/development/python-modules/mcp/default.nix
@@ -52,15 +52,10 @@ buildPythonPackage rec {
     hash = "sha256-fSQCvKaNMeCzguM2tcTJJlAeZQmzSJmbfEK35D8pQcs=";
   };
 
+  # time.sleep(0.1) feels a bit optimistic and it has been flaky whilst
+  # testing this on macOS under load.
   postPatch = lib.optionalString stdenv.buildPlatform.isDarwin ''
-    # time.sleep(0.1) feels a bit optimistic and it has been flaky whilst
-    # testing this on macOS under load.
-    substituteInPlace \
-      "tests/client/test_stdio.py" \
-      "tests/server/fastmcp/test_integration.py" \
-      "tests/shared/test_ws.py" \
-      "tests/shared/test_sse.py" \
-      "tests/shared/test_streamable_http.py" \
+    substituteInPlace tests/client/test_stdio.py \
       --replace-fail "time.sleep(0.1)" "time.sleep(1)"
   '';
 
diff --git a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
index c27136f94caf..2a74ff7b87fa 100644
--- a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
@@ -11,22 +11,19 @@
   pytest-asyncio,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   gitUpdater,
 }:
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-authentication-azure";
-  version = "1.9.7";
+  version = "1.9.8";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-authentication-azure-v${version}";
-    hash = "sha256-ovmGka0YxhjPQYodHAMpcrqLMpXEqSTeky3n/rC7Ohs=";
+    hash = "sha256-05/I06p3zBc/Kb7H8dMEbUxFr0dOXSSBuIyEGZ4twhA=";
   };
 
   sourceRoot = "${src.name}/packages/authentication/azure/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix
index e13a9b9f1fed..885d3b268bab 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix
@@ -8,22 +8,19 @@
   pendulum,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   gitUpdater,
 }:
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-form";
-  version = "1.9.7";
+  version = "1.9.8";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-form-v${version}";
-    hash = "sha256-ovmGka0YxhjPQYodHAMpcrqLMpXEqSTeky3n/rC7Ohs=";
+    hash = "sha256-05/I06p3zBc/Kb7H8dMEbUxFr0dOXSSBuIyEGZ4twhA=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/form/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
index bdc41127c2b2..cebb9937e102 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
@@ -8,22 +8,19 @@
   pytest-asyncio,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   gitUpdater,
 }:
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-json";
-  version = "1.9.7";
+  version = "1.9.8";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-json-v${version}";
-    hash = "sha256-ovmGka0YxhjPQYodHAMpcrqLMpXEqSTeky3n/rC7Ohs=";
+    hash = "sha256-05/I06p3zBc/Kb7H8dMEbUxFr0dOXSSBuIyEGZ4twhA=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/json/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
index b5bf69efad3b..405c3529c5b6 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
@@ -8,22 +8,19 @@
   pytest-asyncio,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   gitUpdater,
 }:
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-multipart";
-  version = "1.9.7";
+  version = "1.9.8";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-multipart-v${version}";
-    hash = "sha256-ovmGka0YxhjPQYodHAMpcrqLMpXEqSTeky3n/rC7Ohs=";
+    hash = "sha256-05/I06p3zBc/Kb7H8dMEbUxFr0dOXSSBuIyEGZ4twhA=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/multipart/";
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
index 5fcf7d460dc9..1363980d0474 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
@@ -8,22 +8,19 @@
   pytest-mock,
   pytestCheckHook,
   python-dateutil,
-  pythonOlder,
   gitUpdater,
 }:
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-text";
-  version = "1.9.7";
+  version = "1.9.8";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-text-v${version}";
-    hash = "sha256-ovmGka0YxhjPQYodHAMpcrqLMpXEqSTeky3n/rC7Ohs=";
+    hash = "sha256-05/I06p3zBc/Kb7H8dMEbUxFr0dOXSSBuIyEGZ4twhA=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/text/";
diff --git a/pkgs/development/python-modules/minikerberos/default.nix b/pkgs/development/python-modules/minikerberos/default.nix
index a500a9cf0414..dde2d9a3193d 100644
--- a/pkgs/development/python-modules/minikerberos/default.nix
+++ b/pkgs/development/python-modules/minikerberos/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "minikerberos";
-  version = "0.4.7";
+  version = "0.4.9";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lzA9Gv3eqeOxjq/YxIvpMs2Y5QYiiJHyaCmBaH12zAk=";
+    hash = "sha256-CVqYChl2rf9Iw94fc9de/ps52nIU3HyJGiNjJAcWqec=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 4c6926f87101..fff97993a3e4 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -10,22 +10,19 @@
   pyhumps,
   pytest-asyncio,
   pytestCheckHook,
-  pythonOlder,
   warrant-lite,
 }:
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.19.1";
+  version = "1.19.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     tag = "v${version}";
-    hash = "sha256-HRcjk8/5WdTMtpgf9ZOc8KIyrZvBre7PpvwM5P6R4As=";
+    hash = "sha256-h7PGtcpBcYGlqdi4grbz7KG65zZO3x8Hf/J7n271sDs=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pypykatz/default.nix b/pkgs/development/python-modules/pypykatz/default.nix
index 82eb2d1de893..9208133376f0 100644
--- a/pkgs/development/python-modules/pypykatz/default.nix
+++ b/pkgs/development/python-modules/pypykatz/default.nix
@@ -8,23 +8,23 @@
   minidump,
   minikerberos,
   msldap,
-  pythonOlder,
+  setuptools,
   winsspi,
 }:
 
 buildPythonPackage rec {
   pname = "pypykatz";
-  version = "0.6.11";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  version = "0.6.13";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yNw/o0Q97Hb8SNmAPX6/KfT1/YrQRoJZJ2XQhw9wRRg=";
+    hash = "sha256-+T1E/Dk4OcXa8vBhspuB/8V23TORsXXetZpylW25SJM=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     aesedb
     aiosmb
     aiowinreg
@@ -41,10 +41,10 @@ buildPythonPackage rec {
 
   meta = {
     description = "Mimikatz implementation in Python";
-    mainProgram = "pypykatz";
     homepage = "https://github.com/skelsec/pypykatz";
     changelog = "https://github.com/skelsec/pypykatz/releases/tag/${version}";
-    license = with lib.licenses; [ mit ];
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "pypykatz";
   };
 }
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index 923b148212f9..38e8c53c0d93 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # build-system
   setuptools,
@@ -34,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.36.1";
+  version = "2.36.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -44,18 +43,9 @@ buildPythonPackage rec {
     postFetch = ''
       sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pytensor/_version.py
     '';
-    hash = "sha256-rXLtrkuwmEe5+64Aao490VqD96LJ37/mxekWOzWRMlw=";
+    hash = "sha256-v6C3LL7ws+K7STqmd4j7/jNnMnnAmEUHzTHKv4446LU=";
   };
 
-  patches = [
-    # https://github.com/pymc-devs/pytensor/pull/1805
-    (fetchpatch {
-      name = "fix-test-tri-nonconcrete-jax-compatibility.patch";
-      url = "https://github.com/pymc-devs/pytensor/commit/86310f074267e24d1b3b99ecf3d9cc0b593b170d.patch";
-      hash = "sha256-KRywJLixmdDJ1GGYsd5Twjiwgce0ZFxUidhTgM6Obmg=";
-    })
-  ];
-
   build-system = [
     setuptools
     cython
diff --git a/pkgs/development/python-modules/python-wayland-extra/default.nix b/pkgs/development/python-modules/python-wayland-extra/default.nix
new file mode 100644
index 000000000000..2a91e2729ab6
--- /dev/null
+++ b/pkgs/development/python-modules/python-wayland-extra/default.nix
@@ -0,0 +1,48 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  lib,
+  hatchling,
+  black,
+  lxml,
+  pytest,
+  requests,
+  ruff,
+}:
+
+buildPythonPackage rec {
+  pname = "python-wayland-extra";
+  version = "0.7.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "python_wayland_extra";
+    hash = "sha256-HSBOCWP3o/BHmg3LO+LU+GpYkEYSqdljjYcEPdOnxZk=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "black", "lxml", "requests", "pytest", "ruff"' ""
+  '';
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    lxml
+    requests
+  ];
+
+  # requires working wayland display
+  doCheck = false;
+
+  pythonImportsCheck = [ "wayland" ];
+
+  meta = {
+    description = "Implementation of the Wayland protocol with no external dependencies";
+    homepage = "https://github.com/dennisrijsdijk/python-wayland-extra";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sifmelcara ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/pyvlx/default.nix b/pkgs/development/python-modules/pyvlx/default.nix
index 22bbb1197689..1dcc98be36bc 100644
--- a/pkgs/development/python-modules/pyvlx/default.nix
+++ b/pkgs/development/python-modules/pyvlx/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   pytestCheckHook,
-  pythonOlder,
   pyyaml,
   setuptools,
   typing-extensions,
@@ -12,16 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pyvlx";
-  version = "0.2.26";
+  version = "0.2.27";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "Julius2342";
     repo = "pyvlx";
     tag = version;
-    hash = "sha256-JwgElt0FFSGs3v+04AKPwTTpxvn8YzihJeD/+llbSMI=";
+    hash = "sha256-FOchtl3HDByHIBRh0MXYnQYh6opzkcHOOYaINmMPu7w=";
   };
 
   build-system = [ setuptools ];
@@ -43,7 +40,7 @@ buildPythonPackage rec {
       devices, e.g. Velux Windows.
     '';
     homepage = "https://github.com/Julius2342/pyvlx";
-    changelog = "https://github.com/Julius2342/pyvlx/releases/tag/${version}";
+    changelog = "https://github.com/Julius2342/pyvlx/releases/tag/${src.tag}";
     license = lib.licenses.lgpl2Only;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 55ccae653e5d..a37aea0a6971 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.9.12";
+  version = "1.10";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Cz83zLjGqvDjwVFmMi4AHB8JYbxgHkQnKHXVwyxEp1c=";
+    hash = "sha256-ed3j0gUKvpy5AtUICD5H+FLCYZLzPepiB1vF6VEL7E0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/streamcontroller-streamdeck/default.nix b/pkgs/development/python-modules/streamcontroller-streamdeck/default.nix
new file mode 100644
index 000000000000..413ec089a865
--- /dev/null
+++ b/pkgs/development/python-modules/streamcontroller-streamdeck/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchPypi,
+  replaceVars,
+  pkgs,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "streamcontroller-streamdeck";
+  version = "0.1.5";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "streamcontroller_streamdeck";
+    hash = "sha256-JSDCg9PLDqxM1KdoCEnYzJip71re6rdS/mLn6fsGn9E=";
+  };
+
+  patches = [
+    # substitute libusb path
+    (replaceVars ./hardcode-libusb.patch {
+      libusb = "${pkgs.hidapi}/lib/libhidapi-libusb${stdenv.hostPlatform.extensions.sharedLibrary}";
+    })
+  ];
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "StreamDeck" ];
+  doCheck = false;
+
+  meta = with lib; {
+    # This is a fork of abcminiuser/python-elgato-streamdeck targeted at StreamController.
+    description = "Python library to control the Elgato Stream Deck";
+    homepage = "https://github.com/StreamController/streamcontroller-python-elgato-streamdeck";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      majiir
+      sifmelcara
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/streamcontroller-streamdeck/hardcode-libusb.patch b/pkgs/development/python-modules/streamcontroller-streamdeck/hardcode-libusb.patch
new file mode 100644
index 000000000000..6ef87025655f
--- /dev/null
+++ b/pkgs/development/python-modules/streamcontroller-streamdeck/hardcode-libusb.patch
@@ -0,0 +1,13 @@
+diff --git a/src/StreamDeck/Transport/LibUSBHIDAPI.py b/src/StreamDeck/Transport/LibUSBHIDAPI.py
+index edf53a1..2d38af3 100644
+--- a/src/StreamDeck/Transport/LibUSBHIDAPI.py
++++ b/src/StreamDeck/Transport/LibUSBHIDAPI.py
+@@ -155,7 +155,7 @@ class LibUSBHIDAPI(Transport):
+ 
+             search_library_names = {
+                 "Windows": ["hidapi.dll", "libhidapi-0.dll", "./hidapi.dll"],
+-                "Linux": ["libhidapi-libusb.so", "libhidapi-libusb.so.0"],
++                "Linux": ["@libusb@"],
+                 "Darwin": ["libhidapi.dylib"],
+                 "FreeBSD": ["libhidapi.so"],
+             }
diff --git a/pkgs/development/tools/build-managers/gnumake/default.nix b/pkgs/development/tools/build-managers/gnumake/default.nix
index 7d77b2ef0613..6c02cf3a21bf 100644
--- a/pkgs/development/tools/build-managers/gnumake/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   autoreconfHook,
+  gettext,
   guileSupport ? false,
   guile,
   texinfo,
@@ -46,9 +47,17 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!inBootstrap) [ texinfo ];
 
-  buildInputs = lib.optionals guileEnabled [ guile ];
+  buildInputs =
+    lib.optionals guileEnabled [ guile ]
+    # gettext gets pulled in via autoreconfHook because strictDeps is not set,
+    # and is linked against. Without this, it doesn't end up in HOST_PATH.
+    # TODO: enable strictDeps, and either make this dependency explicit, or remove it
+    ++ lib.optional stdenv.isCygwin gettext;
 
-  configureFlags = lib.optional guileEnabled "--with-guile";
+  configureFlags =
+    lib.optional guileEnabled "--with-guile"
+    # fnmatch.c:124:14: error: conflicting types for 'getenv'; have 'char *(void)'
+    ++ lib.optional stdenv.hostPlatform.isCygwin "CFLAGS=-std=gnu17";
 
   outputs = [
     "out"
diff --git a/pkgs/games/minecraft-servers/versions.json b/pkgs/games/minecraft-servers/versions.json
index 62fb430f46ab..b9efdc695553 100644
--- a/pkgs/games/minecraft-servers/versions.json
+++ b/pkgs/games/minecraft-servers/versions.json
@@ -1,8 +1,8 @@
 {
   "1.21": {
-    "sha1": "95495a7f485eedd84ce928cef5e223b757d2f764",
-    "url": "https://piston-data.mojang.com/v1/objects/95495a7f485eedd84ce928cef5e223b757d2f764/server.jar",
-    "version": "1.21.10",
+    "sha1": "64bb6d763bed0a9f1d632ec347938594144943ed",
+    "url": "https://piston-data.mojang.com/v1/objects/64bb6d763bed0a9f1d632ec347938594144943ed/server.jar",
+    "version": "1.21.11",
     "javaVersion": 21
   },
   "1.20": {
diff --git a/pkgs/servers/home-assistant/custom-components/dreo/package.nix b/pkgs/servers/home-assistant/custom-components/dreo/package.nix
index 75ff30704d2c..f87f1e76f1a5 100644
--- a/pkgs/servers/home-assistant/custom-components/dreo/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/dreo/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent rec {
   owner = "JeffSteinbok";
   domain = "dreo";
-  version = "1.5.3";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-dreo";
     tag = "v${version}";
-    hash = "sha256-hUHgf04RY7RQ4KzwSoFL9MT8a80+g3VGWbgisGDzRYA=";
+    hash = "sha256-zVE3vAJb72TDDUK6kpTeIGD/0FHeJxprXW8aijqgG1g=";
   };
 
   dependencies = [ websockets ];
diff --git a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
index 736df6d7eec8..592a4a59bd11 100644
--- a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
@@ -14,13 +14,13 @@
 buildHomeAssistantComponent rec {
   owner = "marcolivierarsenault";
   domain = "moonraker";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "marcolivierarsenault";
     repo = "moonraker-home-assistant";
     tag = version;
-    hash = "sha256-T/7A5LmDmqaThTa1TnDbXwA0qeipIk750+k1Kt7tFeY=";
+    hash = "sha256-jTL6hdS3jcIWivo+3qnIq3tTdLQ7AhxHERdZ41CGbR8=";
   };
 
   dependencies = [
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 64d02ed4ff68..86d3727cd94f 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -73,7 +73,23 @@ lib.warnIf (withDocs != null)
     + ''
       -DNON_INTERACTIVE_LOGIN_SHELLS
       -DSSH_SOURCE_BASHRC
-    '';
+    ''
+    # Bash's configure script assumes that CC and CC_FOR_BUILD have the
+    # same default -std=... flags. But at this moment, for FreeBSD, we
+    # have CC_FOR_BUILD that defaults to c23, and a CC that default to
+    # something older, perhaps c17. This breaks the build because of
+    # bash's faulty assumptions.
+    #
+    # To fix, we simply force the standard to be the higher for CC to
+    # match CC_FOR_BUILD.
+    #
+    # Once FreeBSD is built with a newer version of Clang, this hack
+    # should be removed.
+    +
+      lib.optionalString (stdenv.hostPlatform.isFreeBSD && stdenv.hostPlatform != stdenv.buildPlatform)
+        ''
+          -std=c23
+        '';
 
     patchFlags = [ "-p0" ];
 
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 6af7ab4e1203..41d22d5bef22 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -135,11 +135,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     perl
     xz.bin
-  ]
-  ++ optionals stdenv.hostPlatform.isCygwin [
-    # due to patch
-    autoreconfHook
-    texinfo
   ];
 
   buildInputs =
@@ -209,7 +204,8 @@ stdenv.mkDerivation rec {
     ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0"
     # gnulib does not consider Clang-specific warnings to be bugs:
     # https://lists.gnu.org/r/bug-gnulib/2025-06/msg00325.html
-    ++ optional stdenv.cc.isClang "-Wno-error=format-security"
+    # TODO: find out why these are happening on cygwin, which is gcc
+    ++ optional (stdenv.cc.isClang || stdenv.hostPlatform.isCygwin) "-Wno-error=format-security"
   );
 
   # Works around a bug with 8.26:
diff --git a/pkgs/tools/misc/moreutils/default.nix b/pkgs/tools/misc/moreutils/default.nix
index 8ff9aa80d4ea..a239fee834e8 100644
--- a/pkgs/tools/misc/moreutils/default.nix
+++ b/pkgs/tools/misc/moreutils/default.nix
@@ -6,8 +6,8 @@
   libxslt,
   docbook-xsl,
   docbook_xml_dtd_44,
-  perlPackages,
   makeWrapper,
+  parallel, # for its priority
   perl, # for pod2man
   cctools,
   gitUpdater,
@@ -64,5 +64,9 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.all;
     license = lib.licenses.gpl2Plus;
+
+    # If somebody explicitly installs GNU parallel, they probably want
+    # its parallel executable instead of moreutils'.
+    priority = (parallel.meta.priority or lib.meta.defaultPriority) + 1;
   };
 }
diff --git a/pkgs/tools/networking/iperf/3.nix b/pkgs/tools/networking/iperf/3.nix
index 1c5381d24a7d..0037aadc6971 100644
--- a/pkgs/tools/networking/iperf/3.nix
+++ b/pkgs/tools/networking/iperf/3.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iperf";
-  version = "3.19.1";
+  version = "3.20";
 
   src = fetchurl {
     url = "https://downloads.es.net/pub/iperf/iperf-${version}.tar.gz";
-    hash = "sha256-3GP4nsWB6pn4tVjY6zUQneBjgwENtaGQbCCKViugwnA=";
+    hash = "sha256-OsxXLR7MpOCyA1nHvwEy3cgNmC7+7iDIb2cmqaYJQ4g=";
   };
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isLinux [ lksctp-tools ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 89fff22e1e56..fcb0a5310058 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5328,6 +5328,8 @@ self: super: with self; {
 
   fava-investor = callPackage ../development/python-modules/fava-investor { };
 
+  fava-portfolio-returns = callPackage ../development/python-modules/fava-portfolio-returns { };
+
   favicon = callPackage ../development/python-modules/favicon { };
 
   fe25519 = callPackage ../development/python-modules/fe25519 { };
@@ -15593,6 +15595,8 @@ self: super: with self; {
 
   python-watcherclient = callPackage ../development/python-modules/python-watcherclient { };
 
+  python-wayland-extra = callPackage ../development/python-modules/python-wayland-extra { };
+
   python-whois = callPackage ../development/python-modules/python-whois { };
 
   python-wink = callPackage ../development/python-modules/python-wink { };
@@ -18210,6 +18214,10 @@ self: super: with self; {
     callPackage ../development/python-modules/streamcontroller-plugin-tools
       { };
 
+  streamcontroller-streamdeck =
+    callPackage ../development/python-modules/streamcontroller-streamdeck
+      { };
+
   streamdeck = callPackage ../development/python-modules/streamdeck { };
 
   streaming-form-data = callPackage ../development/python-modules/streaming-form-data { };