diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c0c8affb983b..9f0e212cddfb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22688,6 +22688,12 @@
     keys = [ { fingerprint = "7DCA 5615 8AB2 621F 2F32  9FF4 1C7C E491 479F A273"; } ];
     name = "Rahul Butani";
   };
+  rrvsh = {
+    email = "rafiq@rrv.sh";
+    github = "rrvsh";
+    githubId = 20300874;
+    name = "Mohammad Rafiq";
+  };
   rseichter = {
     email = "nixos.org@seichter.de";
     github = "rseichter";
@@ -23975,7 +23981,7 @@
   };
   shikanime = {
     name = "William Phetsinorath";
-    email = "deva.shikanime@protonmail.com";
+    email = "william.phetsinorath@shikanime.studio";
     github = "shikanime";
     githubId = 22115108;
   };
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 4d5f7c6a9db7..9f8cd65c86fc 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -18,6 +18,8 @@
 
 - [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as `services.immichframe`.
 
+- [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
+
 - [udp-over-tcp](https://github.com/mullvad/udp-over-tcp), a tunnel for proxying UDP traffic over a TCP stream. Available as `services.udp-over-tcp`.
 
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2df1045248b5..2bfca447e011 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1655,6 +1655,7 @@
   ./services/web-apps/lasuite-docs.nix
   ./services/web-apps/lasuite-meet.nix
   ./services/web-apps/lemmy.nix
+  ./services/web-apps/librechat.nix
   ./services/web-apps/librespeed.nix
   ./services/web-apps/libretranslate.nix
   ./services/web-apps/limesurvey.nix
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 668f68b4b66f..80f70173bb35 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -913,11 +913,12 @@ in
         ]
         ++ lib.optional (useSendmail && config.services.postfix.enable) "/var/lib/postfix/queue/maildrop";
         UMask = "0027";
-        # Capabilities
-        CapabilityBoundingSet = "";
-        # Security
-        NoNewPrivileges = !useSendmail;
+        # one mid size deployments, Gitea already gets killed when doing DB migrations
+        TimeoutStartSec = "3m";
+
         # Sandboxing
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = !useSendmail;
         ProtectSystem = "strict";
         ProtectHome = true;
         PrivateTmp = true;
diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index 60c4e1cfd3f7..e54d9c19f745 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -20,6 +20,8 @@ in
   options.services.n8n = {
     enable = lib.mkEnableOption "n8n server";
 
+    package = lib.mkPackageOption pkgs "n8n" { };
+
     openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -89,7 +91,7 @@ in
       };
       serviceConfig = {
         Type = "simple";
-        ExecStart = "${pkgs.n8n}/bin/n8n";
+        ExecStart = lib.getExe cfg.package;
         Restart = "on-failure";
         StateDirectory = "n8n";
 
diff --git a/nixos/modules/services/web-apps/librechat.nix b/nixos/modules/services/web-apps/librechat.nix
new file mode 100644
index 000000000000..a1cfd2e67559
--- /dev/null
+++ b/nixos/modules/services/web-apps/librechat.nix
@@ -0,0 +1,259 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.librechat;
+  format = pkgs.formats.yaml { };
+  configFile = format.generate "librechat.yaml" cfg.settings;
+  exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
+  exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars);
+  getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials;
+in
+{
+  options.services.librechat = {
+    enable = lib.mkEnableOption "the LibreChat server";
+
+    package = lib.mkPackageOption pkgs "librechat" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to open the port in the firewall.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/librechat";
+      example = "/persist/librechat";
+      description = "Absolute path for where the LibreChat server will use as its data directory to store logs, user uploads, and generated images.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "librechat";
+      example = "alice";
+      description = "The user to run the service as.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "librechat";
+      example = "users";
+      description = "The group to run the service as.";
+    };
+
+    credentials = lib.mkOption {
+      type = lib.types.attrsOf lib.types.path;
+      default = { };
+      example = {
+        CREDS_KEY = "/run/secrets/creds_key";
+      };
+      description = ''
+        Environment variables which are loaded from the contents of files at a file paths, mainly used for secrets.
+        See [LibreChat environment variables](https://www.librechat.ai/docs/configuration/dotenv).
+        Alternatively you can use `services.librechat.credentialsFile` to define all the variables in a single file.
+      '';
+    };
+
+    env = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType =
+          with lib.types;
+          attrsOf (oneOf [
+            str
+            path
+            (coercedTo int toString str)
+            (coercedTo float toString str)
+            (coercedTo port toString str)
+            (coercedTo bool (x: if x then "true" else "false") str)
+          ]);
+        options = {
+          CONFIG_PATH = lib.mkOption {
+            default = configFile;
+            internal = true;
+            readOnly = true;
+          };
+          PORT = lib.mkOption {
+            type = with lib.types; coercedTo port toString str;
+            default = 3080;
+            example = 2309;
+            description = "The value that will be passed to the PORT environment variable, telling LibreChat what to listen on.";
+          };
+        };
+      };
+      example = {
+        ALLOW_REGISTRATION = true;
+        HOST = "0.0.0.0";
+        PORT = 2309;
+        CONSOLE_JSON_STRING_LENGTH = 255;
+      };
+      description = ''
+        Environment variables that will be set for the service.
+        See [LibreChat environment variables](https://www.librechat.ai/docs/configuration/dotenv).
+      '';
+    };
+
+    credentialsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      description = ''
+        Path to a file that contains environment variables.
+        See [LibreChat environment variables](https://www.librechat.ai/docs/configuration/dotenv).
+
+        Example content of the file:
+        ```
+        CREDS_KEY=6d6deb03cdfb27ea454f6b9ddd42494bdce4af25d50d8aee454ddce583690cc5
+        ```
+
+        Alternatively you can use `services.librechat.credentials` to define the value of each variable in a separate file.
+      '';
+      default = "/dev/null";
+      example = "/run/secrets/librechat";
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+      example = {
+        version = "1.0.8";
+        cache = true;
+        interface = {
+          privacyPolicy = {
+            externalUrl = "https://librechat.ai/privacy-policy";
+            openNewTab = true;
+          };
+        };
+        endpoints = {
+          custom = [
+            {
+              name = "OpenRouter";
+              apiKey = "\${OPENROUTER_KEY}";
+              baseURL = "https://openrouter.ai/api/v1";
+              models = {
+                default = [ "meta-llama/llama-3-70b-instruct" ];
+                fetch = true;
+              };
+              titleConvo = true;
+              titleModule = "meta-llama/llama-3-70b-instruct";
+              dropParams = [ "stop" ];
+              modelDisplayLabel = "OpenRouter";
+            }
+          ];
+        };
+      };
+      description = ''
+        A free-form attribute set that will be written to librechat.yaml.
+        See the [LibreChat configuration options](https://www.librechat.ai/docs/configuration/librechat_yaml).
+        You can use environment variables by wrapping them in $\{}. Take care to escape the \$ character.
+      '';
+    };
+
+    enableLocalDB = lib.mkEnableOption "a local mongodb instance";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.env ? MONGO_URI || cfg.credentials ? MONGO_URI;
+        message = "MongoDB is not configured, either set `services.librechat.enableLocalDB = true` or provide your own MongoDB instance by setting `services.librechat.env.MONGO_URI` or `services.credentials.MONGO_URI`.";
+      }
+      {
+        assertion =
+          cfg.credentialsFile != "/dev/null"
+          || (
+            (cfg.env ? CREDS_KEY || cfg.credentials ? CREDS_KEY)
+            && (cfg.env ? CREDS_IV || cfg.credentials ? CREDS_IV)
+            && (cfg.env ? JWT_SECRET || cfg.credentials ? JWT_SECRET)
+            && (cfg.env ? JWT_REFRESH_SECRET || cfg.credentials ? JWT_REFRESH_SECRET)
+          );
+        message = ''
+          CREDS_KEY, CREDS_IV, JWT_SECRET, and JWT_REFRESH_SECRET must be defined in `services.librechat.credentials` and point to locations of files on the host or in a file that `services.credentialsFile` is pointing to.
+          Alternatively it can be defined in `services.librechat.env` with literal values but they will be saved within the world-readable nix store.;
+          You can use https://www.librechat.ai/toolkit/creds_generator to generate these.
+        '';
+      }
+    ];
+
+    networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
+
+    systemd.tmpfiles.settings."10-librechat"."${cfg.dataDir}".d = {
+      mode = "0755";
+      inherit (cfg) user group;
+    };
+
+    systemd.services.librechat = {
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "tmpfiles.target"
+      ]
+      ++ lib.optional cfg.enableLocalDB "mongodb.service";
+      description = "Open-source app for all your AI conversations, fully customizable and compatible with any AI provider";
+      environment = cfg.env;
+      script = # sh
+        ''
+          ${exportAllCredentials cfg.credentials}
+          cd ${cfg.dataDir}
+          ${lib.getExe cfg.package}
+        '';
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = builtins.baseNameOf cfg.dataDir;
+        WorkingDirectory = cfg.dataDir;
+        LoadCredential = getLoadCredentialList;
+        EnvironmentFile = cfg.credentialsFile;
+        Restart = "on-failure";
+        RestartSec = 10;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0077";
+      };
+    };
+
+    users.users.librechat = lib.mkIf (cfg.user == "librechat") {
+      name = "librechat";
+      isSystemUser = true;
+      group = "librechat";
+      description = "LibreChat server user";
+    };
+
+    users.groups.librechat = lib.mkIf (cfg.user == "librechat") { };
+
+    services.librechat.env.MONGO_URI = lib.mkIf cfg.enableLocalDB "mongodb://localhost:27017";
+    services.mongodb.enable = lib.mkIf cfg.enableLocalDB true;
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+    niklaskorz
+    rrvsh
+  ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 3b28c61fee03..e4f0b3f121f9 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -857,6 +857,7 @@ in
   lemurs-xorg = runTest ./lemurs/lemurs-xorg.nix;
   lemurs-xorg-script = runTest ./lemurs/lemurs-xorg-script.nix;
   libinput = runTest ./libinput.nix;
+  librechat = runTest ./librechat.nix;
   librenms = runTest ./librenms.nix;
   libresprite = runTest ./libresprite.nix;
   libreswan = runTest ./libreswan.nix;
diff --git a/nixos/tests/librechat.nix b/nixos/tests/librechat.nix
new file mode 100644
index 000000000000..e737c139844f
--- /dev/null
+++ b/nixos/tests/librechat.nix
@@ -0,0 +1,50 @@
+# Run this test with NIXPKGS_ALLOW_UNFREE=1
+{ lib, ... }:
+{
+  name = "librechat";
+
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+    niklaskorz
+    rrvsh
+  ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    let
+      # !!! Don't do this with real keys. The /nix store is world-readable!
+      credsKeyFile = pkgs.writeText "librechat-creds-key" "6d6deb03cdfb27ea454f6b9ddd42494bdce4af25d50d8aee454ddce583690cc5";
+      credsIvFile = pkgs.writeText "librechat-creds-iv" "7c09a571f65ac793611685cc9ab1dbe7";
+      jwtSecret = pkgs.writeText "librechat-jwt-secret" "29c4dc7f7de15306accf5eddb4cb8a70eb233d9fba4301f8f47f14c8c047ac81";
+      jwtRefreshSecret = pkgs.writeText "librechat-jwt-refresh-secret" "f2c1685561f2f570b3e7955df267b5c602ee099f14dc5caa0dacc320580ea180";
+    in
+    {
+      services.librechat = {
+        enable = true;
+        env = {
+          ALLOW_REGISTRATION = true;
+        };
+        credentials = {
+          # The following were randomly generated with https://www.librechat.ai/toolkit/creds_generator
+          CREDS_KEY = credsKeyFile;
+          CREDS_IV = credsIvFile;
+          JWT_SECRET = jwtSecret;
+          JWT_REFRESH_SECRET = jwtRefreshSecret;
+        };
+        enableLocalDB = true;
+      };
+    };
+
+  testScript = ''
+    machine.start()
+
+    machine.succeed("grep -qF 'ALLOW_REGISTRATION=true' /etc/systemd/system/librechat.service")
+
+    machine.wait_for_unit("librechat.service")
+    machine.wait_for_open_port(3080)
+
+    machine.succeed("curl --fail http://localhost:3080/")
+
+    machine.shutdown()
+  '';
+}
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index ddedc5667137..9092d3f26603 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -561,13 +561,13 @@
     "vendorHash": "sha256-xIagZvWtlNpz5SQfxbA7r9ojAeS3CW2pwV337ObKOwU="
   },
   "hashicorp_google": {
-    "hash": "sha256-d9rFR5ND72GIqwjusfKgzUozSJY/Dg+yL3AoPxIVExI=",
+    "hash": "sha256-gjhIhDhGils0tveTam00vX3MIXi2HSOHdLUX59R9US8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.12.0",
+    "rev": "v7.13.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-bpyTtuK3kcntk9hzCU2d+RZ0K0jfFtUlEZezyZHvFW8="
+    "vendorHash": "sha256-4Nx3iDeuXfzC6DOAr2fSdnaMt5txLR0EEhmLnWryX4g="
   },
   "hashicorp_google-beta": {
     "hash": "sha256-ZcSd232jOol7fVsPFHaKq1+0Mzg/FwiTF1zoM5nJUxE=",
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index 534bbbacae86..284c39c69cb4 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -28,6 +28,8 @@
   libngspice,
   withScripting ? true,
   python3,
+  withJava ? false,
+  jre,
   addons ? [ ],
   debug ? false,
   sanitizeAddress ? false,
@@ -204,6 +206,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ] ++ optionals withScripting [ python.pkgs.wrapPython ];
 
+  buildInputs = optionals withJava [ jre ];
+
   # KICAD7_TEMPLATE_DIR only works with a single path (it does not handle : separated paths)
   # but it's used to find both the templates and the symbol/footprint library tables
   # https://gitlab.com/kicad/code/kicad/-/issues/14792
@@ -285,6 +289,7 @@ stdenv.mkDerivation rec {
         tool:
         "makeWrapper ${base}/${bin}/${tool} $out/bin/${tool} $makeWrapperArgs"
         + optionalString withScripting " --set PYTHONPATH \"$program_PYTHONPATH\""
+        + optionalString withJava " --set JAVA_HOME \"${jre}\""
       ) tools)
 
       # link in the CLI utils
diff --git a/pkgs/by-name/cr/crc/package.nix b/pkgs/by-name/cr/crc/package.nix
index d25e7a0da434..7227629645d0 100644
--- a/pkgs/by-name/cr/crc/package.nix
+++ b/pkgs/by-name/cr/crc/package.nix
@@ -8,16 +8,16 @@
 }:
 
 let
-  openShiftVersion = "4.20.1";
-  okdVersion = "4.20.0-okd-scos.7";
+  openShiftVersion = "4.20.5";
+  okdVersion = "4.20.0-okd-scos.11";
   microshiftVersion = "4.20.0";
   writeKey = "$(MODULEPATH)/pkg/crc/segment.WriteKey=cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
-  gitCommit = "cb4c9175d15c1fae26734da75806f8d436b6799a";
-  gitHash = "sha256-QdsknUcc9ugpwiyJerxUuf70vtLMXhc3Pz+f2+sPceI=";
+  gitCommit = "ae41f68e34a463bfb6a72dc06c51f2b809c99724";
+  gitHash = "sha256-O8O3O+RoBieOdsAqLAomZ2lPIHEta6j2yhNOfXwtrVA=";
 in
 buildGoModule (finalAttrs: {
   pname = "crc";
-  version = "2.56.0";
+  version = "2.57.0";
 
   src = fetchFromGitHub {
     owner = "crc-org";
diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 708ee6f12bbb..e06c6b78197a 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "ghostfolio";
-  version = "2.221.0";
+  version = "2.222.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = version;
-    hash = "sha256-hcFzcaa8SpwecyPeDbKE2/hnANUFP4EiUzJCs5Ybkyc=";
+    hash = "sha256-pMkmjGRdJjkEDMf9k7QqYIwkUX9LaeovQYG2i+vmOtE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-fzY/gf65u5iQe/J+7p46lSp4uAEZ21nr+L0OB9GyWxk=";
+  npmDepsHash = "sha256-7Xf3Yn4fC+Jjc/UFu+cg9cVwiYK/VMasZwPOIJu771o=";
 
   nativeBuildInputs = [
     prisma
diff --git a/pkgs/by-name/gh/ghstack/package.nix b/pkgs/by-name/gh/ghstack/package.nix
index 179b74c1d7a8..4b35fb78c404 100644
--- a/pkgs/by-name/gh/ghstack/package.nix
+++ b/pkgs/by-name/gh/ghstack/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 
-python3.pkgs.buildPythonApplication {
+python3.pkgs.buildPythonApplication rec {
   pname = "ghstack";
   version = "0.12.0";
   pyproject = true;
@@ -12,11 +12,16 @@ python3.pkgs.buildPythonApplication {
   src = fetchFromGitHub {
     owner = "ezyang";
     repo = "ghstack";
-    rev = "fa7e7023d798aad6b115b88c5ad67ce88a4fc2a6";
-    hash = "sha256-Ywwjeupa8eE/vkrbl5SIbvQs53xaLnq9ieWRFwzmuuc=";
+    tag = version;
+    hash = "sha256-pLKwDezkwGrqYgP4WnIl5nAam6bMNO6BK+xbxhp7Aq8=";
   };
 
-  build-system = [ python3.pkgs.poetry-core ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'requires = ["uv_build>=0.6,<0.7"]' 'requires = ["uv_build>=0.6"]'
+  '';
+
+  build-system = [ python3.pkgs.uv-build ];
 
   dependencies = with python3.pkgs; [
     aiohttp
@@ -27,13 +32,16 @@ python3.pkgs.buildPythonApplication {
     typing-extensions
   ];
 
-  pythonImportsCheck = [ "ghstack" ];
+  pythonImportsCheck = [ "ghstack.cli" ];
 
   meta = {
     description = "Submit stacked diffs to GitHub on the command line";
     homepage = "https://github.com/ezyang/ghstack";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ munksgaard ];
+    maintainers = with lib.maintainers; [
+      munksgaard
+      shikanime
+    ];
     mainProgram = "ghstack";
   };
 }
diff --git a/pkgs/by-name/ho/hol/package.nix b/pkgs/by-name/ho/hol/package.nix
index 89c4d875c904..f4b01ffc6bf9 100644
--- a/pkgs/by-name/ho/hol/package.nix
+++ b/pkgs/by-name/ho/hol/package.nix
@@ -77,7 +77,6 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
     description = "Interactive theorem prover based on Higher-Order Logic";
     longDescription = ''
       HOL4 is the latest version of the HOL interactive proof
diff --git a/pkgs/by-name/ko/kokkos/package.nix b/pkgs/by-name/ko/kokkos/package.nix
index 8bcd4e6b6881..38cf6a307d74 100644
--- a/pkgs/by-name/ko/kokkos/package.nix
+++ b/pkgs/by-name/ko/kokkos/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kokkos";
-  version = "4.7.01";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "kokkos";
     repo = "kokkos";
     rev = finalAttrs.version;
-    hash = "sha256-l5vSYaUtavQLjBSbKHGK2/JtgKzO2KD5+mcPPnWKNkI=";
+    hash = "sha256-l8KE8lW0P5loOMfi6OAB4iMOA8z3JxYaiB07Smp6HSo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
index 9cfd59498482..b40a48c5f2bd 100644
--- a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
@@ -13,20 +13,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-collaboration-server";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
+    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-ZMeLHpwM0yZvYmA/HSuWbcdqxOH707NNzXppEzV2wEw=";
+    hash = "sha256-3yRKWIOPBRrOxBWUW3C5xFjb2dcA6c3cMOD8PZWjHNA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lasuite-docs-frontend/package.nix b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
index 8f3542f7d722..c58deafdcac1 100644
--- a/pkgs/by-name/la/lasuite-docs-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
@@ -12,20 +12,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-frontend";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
+    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-ZMeLHpwM0yZvYmA/HSuWbcdqxOH707NNzXppEzV2wEw=";
+    hash = "sha256-3yRKWIOPBRrOxBWUW3C5xFjb2dcA6c3cMOD8PZWjHNA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lasuite-docs/package.nix b/pkgs/by-name/la/lasuite-docs/package.nix
index 865fb2419bb5..d78fd1a44b7d 100644
--- a/pkgs/by-name/la/lasuite-docs/package.nix
+++ b/pkgs/by-name/la/lasuite-docs/package.nix
@@ -4,7 +4,6 @@
   python3,
   fetchFromGitHub,
   nixosTests,
-  fetchPypi,
   fetchYarnDeps,
   nodejs,
   yarnBuildHook,
@@ -15,23 +14,15 @@ let
     self = python3;
     packageOverrides = self: super: {
       django = super.django_5_2;
-      django-csp = super.django-csp.overridePythonAttrs rec {
-        version = "4.0";
-        src = fetchPypi {
-          inherit version;
-          pname = "django_csp";
-          hash = "sha256-snAQu3Ausgo9rTKReN8rYaK4LTOLcPvcE8OjvShxKDM=";
-        };
-      };
     };
   };
 
-  version = "4.0.0";
+  version = "4.1.0";
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-rhbS6NYk8sZmtrNpKJrm24vOwAJGEDVS9fpFWuyvPGA=";
+    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
   };
 
   mail-templates = stdenv.mkDerivation {
@@ -71,46 +62,51 @@ python.pkgs.buildPythonApplication rec {
 
   build-system = with python.pkgs; [ setuptools ];
 
-  dependencies = with python.pkgs; [
-    beautifulsoup4
-    boto3
-    celery
-    django
-    django-configurations
-    django-cors-headers
-    django-countries
-    django-csp
-    django-extensions
-    django-filter
-    django-lasuite
-    django-parler
-    django-redis
-    django-storages
-    django-timezone-field
-    django-treebeard
-    djangorestframework
-    drf-spectacular
-    drf-spectacular-sidecar
-    dockerflow
-    easy-thumbnails
-    factory-boy
-    gunicorn
-    jsonschema
-    lxml
-    markdown
-    mozilla-django-oidc
-    nested-multipart-parser
-    openai
-    psycopg
-    pycrdt
-    pyjwt
-    pyopenssl
-    python-magic
-    redis
-    requests
-    sentry-sdk
-    whitenoise
-  ];
+  dependencies =
+    with python.pkgs;
+    [
+      beautifulsoup4
+      boto3
+      celery
+      django
+      django-configurations
+      django-cors-headers
+      django-countries
+      django-csp
+      django-extensions
+      django-filter
+      django-lasuite
+      django-parler
+      django-redis
+      django-storages
+      django-timezone-field
+      django-treebeard
+      djangorestframework
+      drf-spectacular
+      drf-spectacular-sidecar
+      dockerflow
+      easy-thumbnails
+      factory-boy
+      gunicorn
+      jsonschema
+      lxml
+      markdown
+      mozilla-django-oidc
+      nested-multipart-parser
+      openai
+      psycopg
+      pycrdt
+      pyjwt
+      pyopenssl
+      python-magic
+      redis
+      requests
+      sentry-sdk
+      whitenoise
+    ]
+    ++ celery.optional-dependencies.redis
+    ++ django-lasuite.optional-dependencies.all
+    ++ django-storages.optional-dependencies.s3;
 
   pythonRelaxDeps = true;
 
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index cd0cab878064..020f75f210f0 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -32,44 +32,49 @@ python.pkgs.buildPythonApplication rec {
 
   build-system = with python.pkgs; [ setuptools ];
 
-  dependencies = with python.pkgs; [
-    aiohttp
-    boto3
-    brevo-python
-    brotli
-    celery
-    django
-    django-configurations
-    django-cors-headers
-    django-countries
-    django-extensions
-    django-lasuite
-    django-parler
-    django-redis
-    django-storages
-    django-timezone-field
-    djangorestframework
-    dockerflow
-    drf-spectacular
-    drf-spectacular-sidecar
-    easy-thumbnails
-    factory-boy
-    gunicorn
-    jsonschema
-    june-analytics-python
-    livekit-api
-    markdown
-    mozilla-django-oidc
-    nested-multipart-parser
-    psycopg
-    pyjwt
-    pyopenssl
-    python-frontmatter
-    redis
-    requests
-    sentry-sdk
-    whitenoise
-  ];
+  dependencies =
+    with python.pkgs;
+    [
+      aiohttp
+      boto3
+      brevo-python
+      brotli
+      celery
+      django
+      django-configurations
+      django-cors-headers
+      django-countries
+      django-extensions
+      django-lasuite
+      django-parler
+      django-redis
+      django-storages
+      django-timezone-field
+      djangorestframework
+      dockerflow
+      drf-spectacular
+      drf-spectacular-sidecar
+      easy-thumbnails
+      factory-boy
+      gunicorn
+      jsonschema
+      june-analytics-python
+      livekit-api
+      markdown
+      mozilla-django-oidc
+      nested-multipart-parser
+      psycopg
+      pyjwt
+      pyopenssl
+      python-frontmatter
+      redis
+      requests
+      sentry-sdk
+      whitenoise
+    ]
+    ++ celery.optional-dependencies.redis
+    ++ django-lasuite.optional-dependencies.all
+    ++ django-storages.optional-dependencies.s3;
 
   pythonRelaxDeps = true;
 
diff --git a/pkgs/by-name/li/libnats-c/package.nix b/pkgs/by-name/li/libnats-c/package.nix
index b071dd050ac5..4fc6f8938002 100644
--- a/pkgs/by-name/li/libnats-c/package.nix
+++ b/pkgs/by-name/li/libnats-c/package.nix
@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
       --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
   '';
 
+  postFixup = ''
+    substituteInPlace $dev/lib/cmake/cnats/cnats-config.cmake \
+      --replace-fail "_IMPORT_PREFIX \"$out\"" "_IMPORT_PREFIX \"$dev\""
+  '';
+
   meta = {
     description = "C API for the NATS messaging system";
     homepage = "https://github.com/nats-io/nats.c";
diff --git a/pkgs/by-name/li/librechat/package.nix b/pkgs/by-name/li/librechat/package.nix
index 1bdedae56441..bde68f2fa1db 100644
--- a/pkgs/by-name/li/librechat/package.nix
+++ b/pkgs/by-name/li/librechat/package.nix
@@ -7,6 +7,7 @@
   node-gyp,
   vips,
   nix-update-script,
+  nixosTests,
 }:
 
 buildNpmPackage rec {
@@ -84,6 +85,9 @@ buildNpmPackage rec {
         "^v(\\d+\\.\\d+\\.\\d+)$"
       ];
     };
+    tests = {
+      inherit (nixosTests) librechat;
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/ll/lldap/package.nix b/pkgs/by-name/ll/lldap/package.nix
index 74779b5afc8b..eb1130240e25 100644
--- a/pkgs/by-name/ll/lldap/package.nix
+++ b/pkgs/by-name/ll/lldap/package.nix
@@ -2,7 +2,6 @@
   binaryen,
   fetchFromGitHub,
   lib,
-  lldap,
   makeWrapper,
   nixosTests,
   rustPlatform,
@@ -15,57 +14,51 @@
   curl,
   staticAssetsHash ? "sha256-xVbHD9s3ofbtHCDvjYwmsWXDEJ9z9vRxQDRR6pW6rt8=",
 }:
-
-let
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "lldap";
   version = "0.6.2";
 
-  commonDerivationAttrs = {
-    pname = "lldap";
-    inherit version;
-
-    src = fetchFromGitHub {
-      owner = "lldap";
-      repo = "lldap";
-      rev = "v${version}";
-      hash = "sha256-UBQWOrHika8X24tYdFfY8ETPh9zvI7/HV5j4aK8Uq+Y=";
-    };
-
-    cargoHash = "sha256-SO7+HiiXNB/KF3fjzSMeiTPjRQq/unEfsnplx4kZv9c=";
+  src = fetchFromGitHub {
+    owner = "lldap";
+    repo = "lldap";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-UBQWOrHika8X24tYdFfY8ETPh9zvI7/HV5j4aK8Uq+Y=";
   };
 
-  staticAssets =
-    src:
-    runCommand "${commonDerivationAttrs.pname}-static-assets"
-      {
-        outputHash = staticAssetsHash;
-        outputHashAlgo = "sha256";
-        outputHashMode = "recursive";
+  cargoHash = "sha256-SO7+HiiXNB/KF3fjzSMeiTPjRQq/unEfsnplx4kZv9c=";
+  ## workaround for overrideAttrs on buildRustPackage
+  ## see https://discourse.nixos.org/t/is-it-possible-to-override-cargosha256-in-buildrustpackage/4393/3
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    name = "${finalAttrs.pname}-cargo-deps";
+    inherit (finalAttrs) src patches;
+    hash = finalAttrs.cargoHash;
+  };
 
-        inherit src;
+  cargoBuildFlags = [
+    "-p"
+    "lldap"
+    "-p"
+    "lldap_migration_tool"
+    "-p"
+    "lldap_set_password"
+  ];
 
-        nativeBuildInputs = [
-          curl
-        ];
+  nativeBuildInputs = [ makeWrapper ];
+  postInstall = ''
+    wrapProgram $out/bin/lldap \
+      --set LLDAP_ASSETS_PATH ${finalAttrs.finalPackage.frontend}
+  '';
 
-        env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-      }
-      ''
-        mkdir $out
-        mkdir $out/fonts
-        for file in $(cat ${src}/app/static/libraries.txt); do
-          curl $file --location --remote-name --output-dir $out
-        done
-        for file in $(cat ${src}/app/static/fonts/fonts.txt); do
-          curl $file --location --remote-name --output-dir $out/fonts
-        done
-      '';
-
-  frontend = rustPlatform.buildRustPackage (
-    finalAttrs:
-    commonDerivationAttrs
-    // {
-      pname = commonDerivationAttrs.pname + "-frontend";
+  passthru = {
 
+    frontend = rustPlatform.buildRustPackage {
+      inherit (finalAttrs)
+        version
+        src
+        cargoDeps
+        patches
+        ;
+      pname = finalAttrs.pname + "-frontend";
       nativeBuildInputs = [
         wasm-pack
         wasm-bindgen-cli_0_2_100
@@ -74,70 +67,62 @@ let
         rustc
         rustc.llvmPackages.lld
       ];
-
       buildPhase = ''
         runHook preBuild
-
         HOME=`pwd` ./app/build.sh
-
         runHook postBuild
       '';
-
       installPhase = ''
         runHook preInstall
-
         mkdir -p $out
         cp -R app/{pkg,static} $out/
         cp app/index_local.html $out/index.html
-        cp -R ${staticAssets finalAttrs.src}/* $out/static
+        cp -R ${finalAttrs.finalPackage.staticAssets}/* $out/static
         rm $out/static/libraries.txt $out/static/fonts/fonts.txt
-
         runHook postInstall
       '';
-
       doCheck = false;
-    }
-  );
+    };
 
-in
-rustPlatform.buildRustPackage (
-  finalAttrs:
-  commonDerivationAttrs
-  // {
-    cargoBuildFlags = [
-      "-p"
-      "lldap"
-      "-p"
-      "lldap_migration_tool"
-      "-p"
-      "lldap_set_password"
+    staticAssets =
+      runCommand "${finalAttrs.pname}-static-assets"
+        {
+          outputHash = staticAssetsHash;
+          outputHashAlgo = "sha256";
+          outputHashMode = "recursive";
+          inherit (finalAttrs) src;
+          nativeBuildInputs = [
+            curl
+          ];
+          env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+        }
+        ''
+          mkdir $out
+          mkdir $out/fonts
+          for file in $(cat $src/app/static/libraries.txt); do
+            curl $file --location --remote-name --output-dir $out
+          done
+          for file in $(cat $src/app/static/fonts/fonts.txt); do
+            curl $file --location --remote-name --output-dir $out/fonts
+          done
+        '';
+
+    tests = {
+      inherit (nixosTests) lldap;
+    };
+
+  };
+
+  meta = {
+    description = "Lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication";
+    homepage = "https://github.com/lldap/lldap";
+    changelog = "https://github.com/lldap/lldap/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      bendlas
+      ibizaman
     ];
-
-    nativeBuildInputs = [ makeWrapper ];
-    postInstall = ''
-      wrapProgram $out/bin/lldap \
-        --set LLDAP_ASSETS_PATH ${finalAttrs.finalPackage.frontend}
-    '';
-
-    passthru = {
-      inherit frontend;
-      tests = {
-        inherit (nixosTests) lldap;
-      };
-    };
-
-    meta = {
-      description = "Lightweight authentication server that provides an opinionated, simplified LDAP interface for authentication";
-      homepage = "https://github.com/lldap/lldap";
-      changelog = "https://github.com/lldap/lldap/blob/v${lldap.version}/CHANGELOG.md";
-      license = lib.licenses.gpl3Only;
-      platforms = lib.platforms.linux;
-      maintainers = with lib.maintainers; [
-        bendlas
-        ibizaman
-      ];
-      mainProgram = "lldap";
-    };
-  }
-
-)
+    mainProgram = "lldap";
+  };
+})
diff --git a/pkgs/tools/text/mecab/base.nix b/pkgs/by-name/me/mecab/base.nix
similarity index 57%
rename from pkgs/tools/text/mecab/base.nix
rename to pkgs/by-name/me/mecab/base.nix
index ea572104238c..e4270d04ceb6 100644
--- a/pkgs/tools/text/mecab/base.nix
+++ b/pkgs/by-name/me/mecab/base.nix
@@ -1,12 +1,14 @@
-{ fetchurl, libiconv }:
+{ fetchFromGitHub, libiconv }:
 
 finalAttrs: {
   version = "0.996";
 
-  src = fetchurl {
-    url = "https://drive.google.com/uc?export=download&id=0B4y35FiV1wh7cENtOXlicTFaRUE";
-    name = "mecab-${finalAttrs.version}.tar.gz";
-    hash = "sha256-4HMyV4MTW3LmZhRceBu0j62lg9UiT7JJD7bBQDumnFk=";
+  src = fetchFromGitHub {
+    owner = "taku910";
+    repo = "mecab";
+    rev = "5a7db65493a0b57d5fc31734e65300320aaf94c8";
+    hash = "sha256-elB0Zr8DDkw3IZvvqVG+OBspZxFLPnvUSM9SRSILYWs=";
+    rootDir = "mecab";
   };
 
   buildInputs = [ libiconv ];
diff --git a/pkgs/tools/text/mecab/ipadic.nix b/pkgs/by-name/me/mecab/ipadic.nix
similarity index 65%
rename from pkgs/tools/text/mecab/ipadic.nix
rename to pkgs/by-name/me/mecab/ipadic.nix
index 9f49e5f1b5e4..b3ecb078de31 100644
--- a/pkgs/tools/text/mecab/ipadic.nix
+++ b/pkgs/by-name/me/mecab/ipadic.nix
@@ -1,19 +1,24 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  mecab-nodic,
+  fetchFromGitHub,
   buildPackages,
+  callPackage,
 }:
 
+let
+  mecab-nodic = callPackage ./nodic.nix { };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mecab-ipadic";
   version = "2.7.0-20070801";
 
-  src = fetchurl {
-    url = "https://drive.google.com/uc?export=download&id=0B4y35FiV1wh7MWVlSDBCSXZMTXM";
-    name = "mecab-ipadic-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ti9SfYgcUEV2uu2cbvZWFVRlixdc5q4AlqYDB+SeNSM=";
+  src = fetchFromGitHub {
+    owner = "taku910";
+    repo = "mecab";
+    rev = "2fd29256c6d5e1b10211cac838069ee9ede8c77a";
+    hash = "sha256-FKRm4bIBhmE4gafg9JeMnpjXbAu4c7l7XIJVbnsRVi8=";
+    rootDir = "mecab-ipadic";
   };
 
   buildInputs = [ mecab-nodic ];
diff --git a/pkgs/tools/text/mecab/nodic.nix b/pkgs/by-name/me/mecab/nodic.nix
similarity index 62%
rename from pkgs/tools/text/mecab/nodic.nix
rename to pkgs/by-name/me/mecab/nodic.nix
index 7dff23c6869a..905536d8270a 100644
--- a/pkgs/tools/text/mecab/nodic.nix
+++ b/pkgs/by-name/me/mecab/nodic.nix
@@ -1,11 +1,11 @@
 {
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   libiconv,
 }:
 
 let
-  mecab-base = import ./base.nix { inherit fetchurl libiconv; };
+  mecab-base = import ./base.nix { inherit fetchFromGitHub libiconv; };
 in
 stdenv.mkDerivation (
   finalAttrs:
diff --git a/pkgs/tools/text/mecab/default.nix b/pkgs/by-name/me/mecab/package.nix
similarity index 79%
rename from pkgs/tools/text/mecab/default.nix
rename to pkgs/by-name/me/mecab/package.nix
index 9cbf246aa615..271e73be5426 100644
--- a/pkgs/tools/text/mecab/default.nix
+++ b/pkgs/by-name/me/mecab/package.nix
@@ -1,13 +1,14 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  mecab-ipadic,
   libiconv,
+  callPackage,
+  fetchFromGitHub,
 }:
 
 let
-  mecab-base = import ./base.nix { inherit fetchurl libiconv; };
+  mecab-base = import ./base.nix { inherit fetchFromGitHub libiconv; };
+  mecab-ipadic = callPackage ./ipadic.nix { };
 in
 stdenv.mkDerivation (
   finalAttrs:
diff --git a/pkgs/by-name/mo/moor/package.nix b/pkgs/by-name/mo/moor/package.nix
index f1c3d04efa91..61acea869d88 100644
--- a/pkgs/by-name/mo/moor/package.nix
+++ b/pkgs/by-name/mo/moor/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HOnm991rMuAed4t8Z10HN17w89p1WVUjSGGc/w9UUlg=";
+    hash = "sha256-oyxDVhP2pzHqaDyGrKPNRGzvMH3Bwdi6tYYCjo+CweQ=";
   };
 
   vendorHash = "sha256-l1XeVZ4FyQDu2sKo4/SieBbwUicq3gNE3D/0m6fcGt8=";
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index 4cbd26a18035..410f2ed33554 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -21,13 +21,17 @@
   libglvnd,
   systemd,
   patchelf,
-  nix-update-script,
   undmg,
   makeWrapper,
 }:
 let
   pname = "nextcloud-talk-desktop";
-  version = "2.0.4";
+  version = "2.0.4"; # Ensure both hashes (Linux and Darwin) are updated!
+
+  hashes = {
+    linux = "sha256-Nky3ws1UV0F4qjbBog53BjXkZ/ttTER/32NlB2ONJaE=";
+    darwin = "sha256-N/v1842rheqrjG4pAwrSDYNWhQDgWinTiZPusD1dvaM=";
+  };
 
   # Only x86_64-linux is supported with Darwin support being universal
   sources = {
@@ -35,15 +39,20 @@ let
     # See https://github.com/nextcloud/talk-desktop?tab=readme-ov-file#%EF%B8%8F-prerequisites
     linux = fetchzip {
       url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${version}/Nextcloud.Talk-linux-x64.zip";
-      hash = "sha256-Nky3ws1UV0F4qjbBog53BjXkZ/ttTER/32NlB2ONJaE=";
+      hash = hashes.linux;
       stripRoot = false;
     };
     darwin = fetchurl {
       url = "https://github.com/nextcloud-releases/talk-desktop/releases/download/v${version}/Nextcloud.Talk-macos-universal.dmg";
-      hash = "sha256-FgiUb2MNEqmbK4BphHQ7M2IeN7Vg1NQ9FR9UO4AfvNs=";
+      hash = hashes.darwin;
     };
   };
 
+  passthru = {
+    inherit hashes; # needed by updateScript
+    updateScript = ./update.py;
+  };
+
   meta = {
     description = "Nextcloud Talk Desktop Client";
     homepage = "https://github.com/nextcloud/talk-desktop";
@@ -55,7 +64,7 @@ let
   };
 
   linux = stdenv.mkDerivation (finalAttrs: {
-    inherit pname version;
+    inherit pname version passthru;
 
     src = sources.linux;
 
@@ -127,19 +136,17 @@ let
     '';
 
     postFixup = ''
-      patchelf --add-needed libGL.so.1 --add-needed libEGL.so.1 \
+      ${lib.getExe patchelf} --add-needed libGL.so.1 --add-needed libEGL.so.1 \
         "$out/opt/Nextcloud Talk-linux-x64/Nextcloud Talk"
     '';
 
-    passthru.updateScript = nix-update-script { };
-
     meta = meta // {
       platforms = lib.intersectLists lib.platforms.linux lib.platforms.x86_64;
     };
   });
 
   darwin = stdenv.mkDerivation (finalAttrs: {
-    inherit pname version;
+    inherit pname version passthru;
 
     src = sources.darwin;
 
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/update.py b/pkgs/by-name/ne/nextcloud-talk-desktop/update.py
new file mode 100755
index 000000000000..21027bfc551d
--- /dev/null
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/update.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p python3 bash nix-update jq
+
+import subprocess
+from os.path import join, dirname
+
+# This will set the version correctly,
+# and will also set the hash for x86_64-linux.
+subprocess.run(["nix-update", "nextcloud-talk-desktop"])
+
+# Now get the hash for Darwin.
+# (It's the same for both Darwin platforms, and we don't support aarch64-linux).
+newVer = subprocess.run(
+  ["nix-instantiate", "--eval", "--raw", "-A", "nextcloud-talk-desktop.version"], capture_output=True, encoding="locale"
+).stdout
+
+darwinUrl = (
+  f"https://github.com/nextcloud-releases/talk-desktop/releases/download/v{newVer}/Nextcloud.Talk-macos-universal.dmg"
+)
+
+oldDarwinHash = subprocess.run(
+  ["nix-instantiate", "--eval", "--raw", "-A", f"nextcloud-talk-desktop.passthru.hashes.darwin"],
+  capture_output=True,
+  encoding="locale",
+).stdout
+
+newDarwinHash = subprocess.run(
+  ["bash", "-c", f"nix store prefetch-file {darwinUrl} --json | jq -r '.hash'"],
+  capture_output=True,
+  encoding="locale",
+).stdout.strip()  # Has a newline
+
+with open(join(dirname(__file__), "package.nix"), "r") as f:
+  txt = f.read()
+
+txt = txt.replace(oldDarwinHash, newDarwinHash)
+
+with open(join(dirname(__file__), "package.nix"), "w") as f:
+  f.write(txt)
diff --git a/pkgs/by-name/ov/ovn/0001-build-Fix-race-condition-when-installing-ovn-detrace.patch b/pkgs/by-name/ov/ovn/0001-build-Fix-race-condition-when-installing-ovn-detrace.patch
deleted file mode 100644
index 6bd2a7c96190..000000000000
--- a/pkgs/by-name/ov/ovn/0001-build-Fix-race-condition-when-installing-ovn-detrace.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From a94104a0c419a5049712f7372690dab10f54ab2f Mon Sep 17 00:00:00 2001
-From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-Date: Sun, 12 Oct 2025 18:46:14 -0400
-Subject: [PATCH ovn] build: Fix race condition when installing ovn-detrace.
-
-When running parallel make install (-j), ovn-detrace-install could
-trigger before ovn_detrace.py is installed. In this case, `ln` will
-fail.
-
-When it happens, make fails with:
-
-```
-ln: failed to create symbolic link '[...]/bin/ovn-detrace': No such file or directory
-make[2]: *** [Makefile:3852: ovn-detrace-install] Error 1
-```
-
-Automake install-*-local targets are not guaranteed any order. In
-contrast, install-*-hook does [1]. This patch switches the make target
-to use the latter.
-
-[1] https://www.gnu.org/software/automake/manual/html_node/Extending-Installation.html
-
-Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
----
- Makefile.am           | 2 ++
- utilities/automake.mk | 2 +-
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 6119ef510..060d3189d 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -128,6 +128,7 @@ dist_scripts_SCRIPTS =
- dist_scripts_DATA =
- EXTRA_PROGRAMS =
- INSTALL_DATA_LOCAL =
-+INSTALL_DATA_HOOK =
- UNINSTALL_LOCAL =
- man_MANS =
- MAN_FRAGMENTS =
-@@ -487,6 +488,7 @@ dist-hook: $(DIST_HOOKS)
- all-local: $(ALL_LOCAL)
- clean-local: $(CLEAN_LOCAL)
- install-data-local: $(INSTALL_DATA_LOCAL)
-+install-data-hook: $(INSTALL_DATA_HOOK)
- uninstall-local: $(UNINSTALL_LOCAL)
- .PHONY: $(DIST_HOOKS) $(CLEAN_LOCAL) $(INSTALL_DATA_LOCAL) $(UNINSTALL_LOCAL)
- 
-diff --git a/utilities/automake.mk b/utilities/automake.mk
-index 1de33614f..ec955f6bf 100644
---- a/utilities/automake.mk
-+++ b/utilities/automake.mk
-@@ -106,7 +106,7 @@ utilities_ovn_appctl_SOURCES = utilities/ovn-appctl.c
- utilities_ovn_appctl_LDADD = lib/libovn.la $(OVSDB_LIBDIR)/libovsdb.la $(OVS_LIBDIR)/libopenvswitch.la
- 
- # ovn-detrace
--INSTALL_DATA_LOCAL += ovn-detrace-install
-+INSTALL_DATA_HOOK += ovn-detrace-install
- ovn-detrace-install:
- 	ln -sf ovn_detrace.py $(DESTDIR)$(bindir)/ovn-detrace
- 
--- 
-2.51.0
-
diff --git a/pkgs/by-name/ov/ovn/0001-tests-Ignore-AT_CHECK-stderr-for-grep-.-grep-q.patch b/pkgs/by-name/ov/ovn/0001-tests-Ignore-AT_CHECK-stderr-for-grep-.-grep-q.patch
new file mode 100644
index 000000000000..fe6606e5ef11
--- /dev/null
+++ b/pkgs/by-name/ov/ovn/0001-tests-Ignore-AT_CHECK-stderr-for-grep-.-grep-q.patch
@@ -0,0 +1,246 @@
+From cbb90f0c9f4b684d1934380288553cc22f95babe Mon Sep 17 00:00:00 2001
+From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+Date: Fri, 12 Dec 2025 21:40:50 -0500
+Subject: [PATCH ovn] tests: Ignore AT_CHECK stderr for `grep ... | grep -q`.
+
+When `grep -q` is used in a pipeline, it will exit on a first match and
+not wait for its upstream pipeline component to complete. The upstream
+command may keep producing stdout. If the upstream command attempts to
+write to its stdout after `grep -q` exited, it will receive SIGPIPE. In
+this scenario, the upstream command may print an error to stderr.
+
+Specifically, `grep` may write: `grep: write error: Broken pipe`.
+
+Since AT_CHECK with implicit stderr argument expects empty stderr,
+running AT_CHECK on a pipeline that chains multiple `grep` calls, with
+the last component being `grep -q`, may result in a spurious test
+failure, depending on the order of `close` calls on stdin and stdout of
+the pipeline component commands.
+
+When `grep -q` is used and we expect it to return 0, we usually don't
+care if its upstream command produces more output (either stdout or
+stderr). As long as there's a match, `grep -q` - and the AT_CHECK check
+- should succeed.
+
+This patch updates all AT_CHECK calls that:
+
+- use a pipeline with multiple `grep` components;
+- with the last pipeline component being `grep -q`;
+- expect a match (making `grep -q` exit early).
+
+These calls are updated to explicitly `[ignore]` stderr from the
+pipeline.
+
+Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+---
+ tests/ovn-controller.at  | 14 +++++++-------
+ tests/ovn-northd.at      | 28 ++++++++++++++--------------
+ tests/system-ovn-kmod.at |  6 +++---
+ 3 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at
+index 0ba1357b2..d7cc06d00 100644
+--- a/tests/ovn-controller.at
++++ b/tests/ovn-controller.at
+@@ -862,7 +862,7 @@ check ovn-nbctl meter-add event-elb drop 100 pktps 10
+ check ovn-nbctl --wait=hv copp-add copp0 event-elb event-elb
+ check ovn-nbctl --wait=hv ls-copp-add copp0 ls1
+ 
+-AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.0f | grep -q meter_id=1])
++AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.0f | grep -q meter_id=1], [0], [], [ignore])
+ 
+ check ovn-nbctl copp-del copp0
+ AT_CHECK([ovn-nbctl copp-list copp0], [0], [dnl
+@@ -875,13 +875,13 @@ check ovn-nbctl --wait=hv copp-add copp1 reject acl-meter
+ check ovn-nbctl ls-copp-add copp1 ls1
+ check ovn-nbctl --wait=hv acl-add ls1 from-lport 1002 'inport == "lsp1" && ip && udp' reject
+ 
+-AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.16 | grep -q meter_id=1])
++AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.16 | grep -q meter_id=1], [0], [], [ignore])
+ 
+ # arp metering
+ check ovn-nbctl meter-add arp-meter drop 200 pktps 0
+ check ovn-nbctl --wait=hv copp-add copp2 arp-resolve arp-meter
+ check ovn-nbctl --wait=hv lr-copp-add copp2 lr1
+-AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.00 | grep -q meter_id=2])
++AT_CHECK([as hv1 ovs-ofctl dump-flows br-int | grep controller | grep userdata=00.00.00.00 | grep -q meter_id=2], [0], [], [ignore])
+ 
+ OVN_CLEANUP([hv1])
+ AT_CLEANUP
+@@ -2099,7 +2099,7 @@ check ovn-nbctl --wait=hv sync
+ check ovn-nbctl remove address_set as1 addresses 10.0.0.1/32
+ check ovn-nbctl --wait=hv sync
+ 
+-AT_CHECK([grep "already references desired flow" hv1/ovn-controller.log | grep -q "nw_src=10.0.0.1"])
++AT_CHECK([grep "already references desired flow" hv1/ovn-controller.log | grep -q "nw_src=10.0.0.1"], [0], [], [ignore])
+ 
+ # Same for duplicate IPv6 addresses.
+ check ovn-nbctl add address_set as2 addresses '["::01"]'
+@@ -2107,7 +2107,7 @@ check ovn-nbctl --wait=hv sync
+ check ovn-nbctl remove address_set as2 addresses '["::01"]'
+ check ovn-nbctl --wait=hv sync
+ 
+-AT_CHECK([grep "already references desired flow" hv1/ovn-controller.log | grep -q "ipv6_src=::1"])
++AT_CHECK([grep "already references desired flow" hv1/ovn-controller.log | grep -q "ipv6_src=::1"], [0], [], [ignore])
+ 
+ OVN_CLEANUP([hv1
+ /already references desired flow/d
+@@ -2471,8 +2471,8 @@ AT_CHECK([ovn-nbctl --wait=hv sync])
+ # Check if ovn-controller is still alive
+ AT_CHECK([ps $pid], [0], [ignore])
+ # Check if we got warnings for invalid
+-AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q invalid1])
+-AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q invalid2])
++AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q invalid1], [0], [], [ignore])
++AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q invalid2], [0], [], [ignore])
+ AT_CHECK([grep "Parsing of ovn-chassis-mac-mappings failed" hv1/ovn-controller.log | grep -q br1], [1])
+ 
+ OVN_CLEANUP([hv1
+diff --git a/tests/ovn-northd.at b/tests/ovn-northd.at
+index d425cfb7a..5b1a8b6f8 100644
+--- a/tests/ovn-northd.at
++++ b/tests/ovn-northd.at
+@@ -4151,7 +4151,7 @@ check as northd ovn-appctl -t ovn-northd inc-engine/clear-stats
+ 
+ check ovn-nbctl --bfd=$uuid lr-route-add r0 100.0.0.0/8 192.168.1.2
+ wait_column down bfd status logical_port=r0-sw1
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.1.2 | grep -q bfd],[0])
++AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.1.2 | grep -q bfd], [0], [], [ignore])
+ 
+ check_engine_stats northd recompute nocompute
+ check_engine_stats bfd recompute nocompute
+@@ -4163,11 +4163,11 @@ check as northd ovn-appctl -t ovn-northd inc-engine/clear-stats
+ 
+ check ovn-nbctl --bfd lr-route-add r0 200.0.0.0/8 192.168.2.2
+ wait_column down bfd status logical_port=r0-sw2
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.2.2 | grep -q bfd],[0])
++AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.2.2 | grep -q bfd], [0], [], [ignore])
+ 
+ check ovn-nbctl --bfd lr-route-add r0 240.0.0.0/8 192.168.5.2 r0-sw5
+ wait_column down bfd status logical_port=r0-sw5
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.5.2 | grep -q bfd],[0])
++AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.5.2 | grep -q bfd], [0], [], [ignore])
+ 
+ check_engine_stats northd recompute nocompute
+ check_engine_stats bfd recompute nocompute
+@@ -4179,7 +4179,7 @@ check as northd ovn-appctl -t ovn-northd inc-engine/clear-stats
+ 
+ check ovn-nbctl --bfd --policy=src-ip lr-route-add r0 192.168.6.1/32 192.168.10.10 r0-sw6
+ wait_column down bfd status logical_port=r0-sw6
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.6.1 | grep -q bfd],[0])
++AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.6.1 | grep -q bfd], [0], [], [ignore])
+ 
+ check_engine_stats northd recompute nocompute
+ check_engine_stats bfd recompute nocompute
+@@ -4191,7 +4191,7 @@ check as northd ovn-appctl -t ovn-northd inc-engine/clear-stats
+ 
+ check ovn-nbctl --bfd --policy=src-ip lr-route-add r0 192.168.7.1/32 192.168.10.10 r0-sw7
+ wait_column down bfd status logical_port=r0-sw7
+-AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.7.1 | grep -q bfd],[0])
++AT_CHECK([ovn-nbctl lr-route-list r0 | grep 192.168.7.1 | grep -q bfd], [0], [], [ignore])
+ 
+ route_uuid=$(fetch_column nb:logical_router_static_route _uuid ip_prefix="100.0.0.0/8")
+ check ovn-nbctl clear logical_router_static_route $route_uuid bfd
+@@ -4266,7 +4266,7 @@ AT_CHECK([ovn-nbctl copp-list copp0], [0], [dnl
+ event-elb: meter0
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep trigger_event -A 2 | grep -q meter0])
++AT_CHECK([ovn-sbctl list logical_flow | grep trigger_event -A 2 | grep -q meter0], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv meter-add meter1 drop 300 pktps 10
+ AT_CHECK([ovn-nbctl meter-list |grep meter1 -A 1], [0], [dnl
+@@ -4284,7 +4284,7 @@ AT_CHECK([ovn-nbctl copp-list copp1], [0], [dnl
+ arp: meter1
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep arp -A 2 | grep -q meter1])
++AT_CHECK([ovn-sbctl list logical_flow | grep arp -A 2 | grep -q meter1], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv copp-del copp1 arp
+ AT_CHECK([ovn-nbctl copp-list copp1], [0], [dnl
+@@ -4298,7 +4298,7 @@ AT_CHECK([ovn-nbctl copp-list copp2], [0], [dnl
+ icmp4-error: meter2
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep icmp4 -A 2 | grep -q meter2])
++AT_CHECK([ovn-sbctl list logical_flow | grep icmp4 -A 2 | grep -q meter2], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv copp-del copp2 icmp4-error
+ AT_CHECK([ovn-nbctl copp-list copp2], [0], [dnl
+@@ -4310,7 +4310,7 @@ AT_CHECK([ovn-nbctl copp-list copp3], [0], [dnl
+ icmp6-error: meter2
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep icmp6 -A 2 | grep -q meter2])
++AT_CHECK([ovn-sbctl list logical_flow | grep icmp6 -A 2 | grep -q meter2], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv copp-del copp3 icmp6-error
+ AT_CHECK([ovn-nbctl copp-list copp3], [0], [dnl
+@@ -4322,7 +4322,7 @@ AT_CHECK([ovn-nbctl copp-list copp4], [0], [dnl
+ tcp-reset: meter2
+ ])
+ 
+-AT_CHECK([ovn-sbctl list logical_flow | grep tcp -A 2 | grep -q meter2])
++AT_CHECK([ovn-sbctl list logical_flow | grep tcp -A 2 | grep -q meter2], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=hv copp-del copp4 tcp-reset
+ AT_CHECK([ovn-nbctl copp-list copp4], [0], [dnl
+@@ -4351,7 +4351,7 @@ check ovn-nbctl --wait=hv lr-copp-add copp7 r0
+ AT_CHECK([ovn-nbctl copp-list copp7], [0], [dnl
+ bfd: meter0
+ ])
+-AT_CHECK([ovn-sbctl list logical_flow | grep bfd -A 2 | grep -q meter0])
++AT_CHECK([ovn-sbctl list logical_flow | grep bfd -A 2 | grep -q meter0],[0],[],[ignore])
+ 
+ check ovn-nbctl --wait=hv set Logical_Switch sw1 \
+     other_config:mcast_querier="false" \
+@@ -4361,7 +4361,7 @@ check ovn-nbctl --wait=hv ls-copp-add copp8 sw1
+ AT_CHECK([ovn-nbctl copp-list copp8], [0], [dnl
+ igmp: meter1
+ ])
+-AT_CHECK([ovn-sbctl list logical_flow | grep igmp -A 2 | grep -q meter1])
++AT_CHECK([ovn-sbctl list logical_flow | grep igmp -A 2 | grep -q meter1],[0],[],[ignore])
+ 
+ check ovn-nbctl copp-del copp8
+ AT_CHECK([ovn-nbctl copp-list copp8], [0], [dnl
+@@ -7901,7 +7901,7 @@ AT_CHECK([ovn-sbctl lflow-list S1 | grep ls_in_l2_lkup | grep -q 'match=(eth.mca
+ check ovn-nbctl --wait=sb set Logical_Switch S1 \
+     other_config:broadcast-arps-to-all-routers=false
+ 
+-AT_CHECK([ovn-sbctl lflow-list S1 | grep ls_in_l2_lkup | grep -q 'match=(eth.mcast && (arp.op == 1 || nd_ns)), action=(outport = "_MC_flood_l2"; output;)'], [0])
++AT_CHECK([ovn-sbctl lflow-list S1 | grep ls_in_l2_lkup | grep -q 'match=(eth.mcast && (arp.op == 1 || nd_ns)), action=(outport = "_MC_flood_l2"; output;)'], [0], [], [ignore])
+ 
+ check ovn-nbctl --wait=sb set Logical_Switch S1 \
+     other_config:broadcast-arps-to-all-routers=true
+@@ -17201,7 +17201,7 @@ check ovn-nbctl --wait=sb sync
+ 
+ ovn-sbctl dump-flows lr0 > lrflows
+ AT_CAPTURE_FILE([lrflows])
+-AT_CHECK([! ovn_strip_lflows < lrflows | grep priority=105 | grep -q "flags.force_snat_for_lb == 1"])
++AT_CHECK([! ovn_strip_lflows < lrflows | grep priority=105 | grep -q "flags.force_snat_for_lb == 1"], [0], [], [ignore])
+ 
+ check ovn-nbctl lrp-del lrp0 -- lrp-add lr0 lrp0 02:00:00:00:00:01 4242::4242/64
+ check ovn-nbctl --wait=sb sync
+diff --git a/tests/system-ovn-kmod.at b/tests/system-ovn-kmod.at
+index 4e264cca8..53fc45734 100644
+--- a/tests/system-ovn-kmod.at
++++ b/tests/system-ovn-kmod.at
+@@ -1641,11 +1641,11 @@ check_flow_assured() {
+     echo Check if a conntrack entry exists for src=$src_ip, dst=$dst_ip, zone=$zone
+ 
+     if test -n "$src_ip" && test -n "$dst_ip"; then
+-        AT_CHECK([grep -F "$src_ip" conntrack_file | grep -F "$dst_ip" | grep "zone=$zone" | grep -q "ASSURED"])
++        AT_CHECK([grep -F "$src_ip" conntrack_file | grep -F "$dst_ip" | grep "zone=$zone" | grep -q "ASSURED"], [0], [], [ignore])
+     elif test -n "$src_ip"; then
+-        AT_CHECK([grep -F "$src_ip" conntrack_file | grep "zone=$zone" | grep -q "ASSURED"])
++        AT_CHECK([grep -F "$src_ip" conntrack_file | grep "zone=$zone" | grep -q "ASSURED"], [0], [], [ignore])
+     else
+-        AT_CHECK([grep -F "$dst_ip" conntrack_file | grep "zone=$zone" | grep -q "ASSURED"])
++        AT_CHECK([grep -F "$dst_ip" conntrack_file | grep "zone=$zone" | grep -q "ASSURED"], [0], [], [ignore])
+     fi
+ }
+ 
+-- 
+2.51.2
+
diff --git a/pkgs/by-name/ov/ovn/package.nix b/pkgs/by-name/ov/ovn/package.nix
index 404fe20bc9b5..f708616fbd66 100644
--- a/pkgs/by-name/ov/ovn/package.nix
+++ b/pkgs/by-name/ov/ovn/package.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ovn";
-  version = "25.09.0";
+  version = "25.09.1";
 
   src = fetchFromGitHub {
     owner = "ovn-org";
     repo = "ovn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DNaf3vWb6tlzViMEI02+3st/0AiMVAomSaiGplcjkIc=";
+    hash = "sha256-utNMWYMjm511+mkHC/Fe6wJ11vk1HAi0dHlk9JwBYl0=";
     fetchSubmodules = true;
   };
 
@@ -45,19 +45,26 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   patches = [
-    # Fix test failure with musl libc.
-    (fetchpatch {
-      url = "https://github.com/ovn-org/ovn/commit/d0b187905c45ce039163d18cc82869918946a41c.patch";
-      hash = "sha256-mTpNpH1ZSSMLtpZmy6jKjGDu84jL0ECr+HVh1PQzaVA=";
-    })
-    # Fix sandbox test failure.
-    (fetchpatch {
-      url = "https://github.com/ovn-org/ovn/commit/b396babaa54ea0c8d943bbfef751dbdbf288c7af.patch";
-      hash = "sha256-RjWxT3EYKjGhtvCq3bAhKN9PrPTkSR72xPkQQ4SPWWU=";
-    })
     # Fix build failure due to make install race condition.
-    # Posted at: https://patchwork.ozlabs.org/project/ovn/patch/20251012225908.37855-1-ihar.hrachyshka@gmail.com/
-    ./0001-build-Fix-race-condition-when-installing-ovn-detrace.patch
+    (fetchpatch {
+      url = "https://github.com/ovn-org/ovn/commit/d7c46f5d1f9b804ebc7b20b0edad4e11469a41da.patch";
+      hash = "sha256-P3XNZ2YXSa9s3DdlKX9C243bMovDbIsmapdrXaQS7go=";
+    })
+
+    # Disable scapy tests that were not marked with HAVE_SCAPY requirement -
+    # they hang indefinitely if scapy is not installed.
+    (fetchpatch {
+      url = "https://github.com/ovn-org/ovn/commit/df99035f88e43a3b80f4c58dc530fd3f45766c54.patch";
+      hash = "sha256-l+t1zZ3FEmcRa+G2qfDVaVTBRsFOPd6iceqDmRT+d7k=";
+    })
+    (fetchpatch {
+      url = "https://github.com/ovn-org/ovn/commit/f353dbd03cd7a3c06b1b728321749e5e276aafc0.patch";
+      hash = "sha256-hXH2/tFFtVfrOFQZxmbS7grQeQnTejESU8w10E484PE=";
+    })
+
+    # Fix test failures due to spurious Broken pipe on AT_CHECK stderr.
+    # Posted: https://patchwork.ozlabs.org/project/ovn/patch/20251213030322.91112-1-ihar.hrachyshka@gmail.com/
+    ./0001-tests-Ignore-AT_CHECK-stderr-for-grep-.-grep-q.patch
   ];
 
   nativeBuildInputs = [
@@ -147,6 +154,18 @@ stdenv.mkDerivation (finalAttrs: {
     touch $OVS_RESOLV_CONF
   '';
 
+  checkPhase = ''
+    runHook preCheck
+
+    if ! make check; then
+      echo "Some tests failed. Collecting logs for analysis..."
+      find tests/testsuite.dir -type f -exec echo "==== Contents of {} ====" \; -exec cat {} \;
+      exit 1
+    fi
+
+    runHook postCheck
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/ow/ownserver/package.nix b/pkgs/by-name/ow/ownserver/package.nix
new file mode 100644
index 000000000000..712076924a4a
--- /dev/null
+++ b/pkgs/by-name/ow/ownserver/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ownserver";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "Kumassy";
+    repo = "ownserver";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bseDssSMerBlzlCvL3rD3X6ku5qDRYvI1wxq2W7As5k=";
+  };
+
+  cargoHash = "sha256-SJm66CDrg6ZpIeKx27AnZAVs/Z25E/KmHYuZ9G4UwHQ=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Expose your local game server to the Internet";
+    homepage = "https://github.com/Kumassy/ownserver";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jaredmontoya ];
+    mainProgram = "ownserver";
+  };
+})
diff --git a/pkgs/by-name/po/ponyc/package.nix b/pkgs/by-name/po/ponyc/package.nix
index 38df1c5e43ba..49c19e648e6a 100644
--- a/pkgs/by-name/po/ponyc/package.nix
+++ b/pkgs/by-name/po/ponyc/package.nix
@@ -164,7 +164,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Pony is an Object-oriented, actor-model, capabilities-secure, high performance programming language";
-    homepage = "https://www.ponylang.org";
+    homepage = "https://www.ponylang.io";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [
       kamilchm
diff --git a/pkgs/by-name/sc/scanservjs/package.nix b/pkgs/by-name/sc/scanservjs/package.nix
index 5b80e075398d..b63f7b214770 100644
--- a/pkgs/by-name/sc/scanservjs/package.nix
+++ b/pkgs/by-name/sc/scanservjs/package.nix
@@ -2,85 +2,31 @@
   lib,
   fetchFromGitHub,
   buildNpmPackage,
-  fetchNpmDeps,
   nodejs_20,
-  replaceVars,
 }:
 
-let
-  # Build fails on node 22, presumably because of esm.
-  # https://github.com/NixOS/nixpkgs/issues/371649
-  nodejs = nodejs_20;
-  version = "2.27.1";
+buildNpmPackage (finalAttrs: {
+  pname = "scanservjs";
+  version = "3.0.4";
+
   src = fetchFromGitHub {
     owner = "sbs20";
     repo = "scanservjs";
-    # rev = "v${version}";
-    # 2.27.1 doesn't have a tag
-    rev = "b15adc6f97fb152fd9819371bb1a9b8118baf55b";
-    hash = "sha256-ne9fEF/eurWPXzmJQzBn5jiy+JgxMWiCXsOdmu2fj6E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qCJyQO/hSDF4NOupV7sepwvpNyjSElnqT71LJuIKe+A=";
   };
 
-  depsHashes = {
-    server = "sha256-M8t+TrE+ntZaI9X7hEel94bz34DPtW32n0KKMSoCfIs=";
-    client = "sha256-C31WBYE8ba0t4mfKFAuYWrCZtSdN7tQIYmCflDRKuBM=";
-  };
+  npmDepsHash = "sha256-HIWT09G8gqSFt9CIjsjJaDRnj2GO0G6JOGeI0p4/1vw=";
 
-  serverDepsForClient = fetchNpmDeps {
-    inherit src nodejs;
-    sourceRoot = "${src.name}/packages/server";
-    name = "scanservjs";
-    hash = depsHashes.server or lib.fakeHash;
-  };
-
-  # static client files
-  client = buildNpmPackage {
-    pname = "scanservjs-client";
-    inherit version src nodejs;
-
-    sourceRoot = "${src.name}/packages/client";
-    npmDepsHash = depsHashes.client or lib.fakeHash;
-
-    preBuild = ''
-      cd ../server
-      chmod +w package-lock.json . /build/source/
-      npmDeps=${serverDepsForClient} npmConfigHook
-      cd ../client
-    '';
-
-    env.NODE_OPTIONS = "--openssl-legacy-provider";
-
-    dontNpmInstall = true;
-    installPhase = ''
-      mv /build/source/dist/client $out
-    '';
-  };
-
-in
-buildNpmPackage {
-  pname = "scanservjs";
-  inherit version src nodejs;
-
-  sourceRoot = "${src.name}/packages/server";
-  npmDepsHash = depsHashes.server or lib.fakeHash;
-
-  # can't use "patches" since they change the server deps' hash for building the client
-  # (I don't want to maintain one more hash)
-  preBuild = ''
-    chmod +w /build/source
-    patch -p3 <${
-      replaceVars ./decouple-from-source-tree.patch {
-        inherit client;
-      }
-    }
-    substituteInPlace src/api.js --replace 'NIX_OUT_PLACEHOLDER' "$out"
-  '';
+  # Build fails on node 22, presumably because of esm.
+  # https://github.com/NixOS/nixpkgs/issues/371649
+  nodejs = nodejs_20;
 
   postInstall = ''
-    mkdir -p $out/bin
-    makeWrapper ${lib.getExe nodejs} $out/bin/scanservjs \
+    mkdir $out/bin
+    makeWrapper ${lib.getExe finalAttrs.nodejs} $out/bin/scanservjs \
       --set NODE_ENV production \
-      --add-flags "'$out/lib/node_modules/scanservjs-api/src/server.js'"
+      --add-flags "'$out/lib/node_modules/scanservjs/app-server/src/server.js'"
   '';
 
   meta = {
@@ -92,4 +38,4 @@ buildNpmPackage {
     maintainers = with lib.maintainers; [ chayleaf ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/sn/sniproxy/package.nix b/pkgs/by-name/sn/sniproxy/package.nix
index 1c0b2462dbf1..2c3c06e6ee19 100644
--- a/pkgs/by-name/sn/sniproxy/package.nix
+++ b/pkgs/by-name/sn/sniproxy/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchurl,
   autoreconfHook,
   gettext,
   libev,
@@ -11,28 +10,18 @@
   udns,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sniproxy";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "dlundquist";
     repo = "sniproxy";
-    rev = version;
-    sha256 = "sha256-htM9CrzaGnn1dnsWQ+0V6N65Og7rsFob3BlSc4UGfFU=";
+    tag = finalAttrs.version;
+    hash = "sha256-TUXwixnBFdegYRzeXlLVno2M3gVXyCw5Jdfb9ulOROs=";
   };
 
-  patches = [
-    ./gettext-0.25.patch
-    (fetchurl {
-      name = "compat-pcre2.patch";
-      # Using Arch Linux patch because the following upstream patches do not apply cleanly:
-      # https://github.com/dlundquist/sniproxy/commit/62e621f050f79eb78598b1296a089ef88a19ea91
-      # https://github.com/dlundquist/sniproxy/commit/7fdd86c054a21f7ac62343010de20f28645b14d2
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/sniproxy/-/raw/3272f9f0d406c51122f90708bfcc7b4ba0eb38c9/sniproxy-0.6.1-pcre2.patch?inline=false";
-      hash = "sha256-v6qdBAWXit0Zg43OsgzCTb4cSPm7gsEXVd7W8LvBgMk=";
-    })
-  ];
+  patches = [ ./gettext-0.25.patch ];
 
   nativeBuildInputs = [
     autoreconfHook
@@ -56,5 +45,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     mainProgram = "sniproxy";
   };
-
-}
+})
diff --git a/pkgs/by-name/st/steamcmd/package.nix b/pkgs/by-name/st/steamcmd/package.nix
index 25bcd8353f3d..2b64fbd0c596 100644
--- a/pkgs/by-name/st/steamcmd/package.nix
+++ b/pkgs/by-name/st/steamcmd/package.nix
@@ -3,19 +3,33 @@
   stdenv,
   fetchurl,
   steam-run,
-  bash,
   coreutils,
-  steamRoot ? "~/.local/share/Steam",
+  steamRoot ? "$HOME/.local/share/Steam",
 }:
-
+let
+  srcs =
+    let
+      url =
+        platform:
+        "https://web.archive.org/web/20240521141411/https://steamcdn-a.akamaihd.net/client/installer/steamcmd_${platform}.tar.gz";
+    in
+    {
+      x86_64-darwin = fetchurl {
+        url = url "osx";
+        hash = "sha256-jswXyJiOWsrcx45jHEhJD3YVDy36ps+Ne0tnsJe9dTs=";
+      };
+      x86_64-linux = fetchurl {
+        url = url "linux";
+        hash = "sha256-zr8ARr/QjPRdprwJSuR6o56/QVXl7eQTc7V5uPEHHnw=";
+      };
+    };
+in
 stdenv.mkDerivation {
   pname = "steamcmd";
   version = "20180104"; # According to steamcmd_linux.tar.gz mtime
 
-  src = fetchurl {
-    url = "https://web.archive.org/web/20240521141411/https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz";
-    hash = "sha256-zr8ARr/QjPRdprwJSuR6o56/QVXl7eQTc7V5uPEHHnw=";
-  };
+  src =
+    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   # The source tarball does not have a single top-level directory.
   preUnpack = ''
@@ -24,24 +38,18 @@ stdenv.mkDerivation {
     sourceRoot=.
   '';
 
-  buildInputs = [
-    bash
-    steam-run
-  ];
-
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/share/steamcmd/linux32
-    install -Dm755 steamcmd.sh $out/share/steamcmd/steamcmd.sh
-    install -Dm755 linux32/* $out/share/steamcmd/linux32
+    mkdir -p $out/share/steamcmd
+    find . -type f -exec install -Dm 755 "{}" "$out/share/steamcmd/{}" \;
 
     mkdir -p $out/bin
     substitute ${./steamcmd.sh} $out/bin/steamcmd \
       --subst-var out \
       --subst-var-by coreutils ${coreutils} \
-      --subst-var-by steamRoot "${steamRoot}" \
-      --subst-var-by steamRun ${steam-run}
+      --subst-var-by steamRoot '${steamRoot}' \
+      --subst-var-by steamRun ${if stdenv.hostPlatform.isLinux then (lib.getExe steam-run) else "exec"}
     chmod 0755 $out/bin/steamcmd
   '';
 
@@ -49,7 +57,10 @@ stdenv.mkDerivation {
     homepage = "https://developer.valvesoftware.com/wiki/SteamCMD";
     description = "Steam command-line tools";
     mainProgram = "steamcmd";
-    platforms = lib.platforms.linux;
+    platforms = [
+      "x86_64-linux"
+      "x86_64-darwin"
+    ];
     license = lib.licenses.unfreeRedistributable;
     maintainers = with lib.maintainers; [ tadfisher ];
   };
diff --git a/pkgs/by-name/st/steamcmd/steamcmd.sh b/pkgs/by-name/st/steamcmd/steamcmd.sh
old mode 100644
new mode 100755
index 588badb41a1a..d689a152f3cd
--- a/pkgs/by-name/st/steamcmd/steamcmd.sh
+++ b/pkgs/by-name/st/steamcmd/steamcmd.sh
@@ -20,8 +20,8 @@ fi
 if [ ! -e "$STEAMROOT/steamcmd.sh" ]; then
   mkdir -p "$STEAMROOT/linux32"
   # steamcmd.sh will replace these on first use
-  cp @out@/share/steamcmd/steamcmd.sh "$STEAMROOT/."
-  cp @out@/share/steamcmd/linux32/* "$STEAMROOT/linux32/."
+  cd @out@/share/steamcmd
+  find . -type f -exec install -Dm 755 "{}" "$STEAMROOT/{}" \;
 fi
 
-@steamRun@/bin/steam-run "$STEAMROOT/steamcmd.sh" "$@"
+@steamRun@ "$STEAMROOT/steamcmd.sh" "$@"
diff --git a/pkgs/by-name/tr/tribler/package.nix b/pkgs/by-name/tr/tribler/package.nix
index 17cd26773c38..73dacfd98fb8 100644
--- a/pkgs/by-name/tr/tribler/package.nix
+++ b/pkgs/by-name/tr/tribler/package.nix
@@ -115,7 +115,7 @@ python3.pkgs.buildPythonApplication {
   '';
 
   postInstall = ''
-    ln -s ${tribler-webui} $out/lib/python*/site-packages/tribler/ui
+    ln -s ${tribler-webui} $out/${python312.sitePackages}/tribler/ui
   '';
 
   preFixup = ''
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index 58c13b7a6617..18789b43ec93 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.12.39",
-    "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/10ebfa84f4e8b018ef2459063f0293b8e9ac01da/Windsurf-darwin-arm64-1.12.39.zip",
-    "sha256": "1f1af7d5dcaf1314f86a8082dcc28406bca86b92a29048ef296107cdea72a74e"
+    "version": "1.12.43",
+    "vscodeVersion": "1.106.0",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/8b6a7c68fb76075b29a085605ef19c1d660a258e/Windsurf-darwin-arm64-1.12.43.zip",
+    "sha256": "17c080308b63ee72ba70655082f0a9e586755cc6616038b72d2b362450bc7cad"
   },
   "x86_64-darwin": {
-    "version": "1.12.39",
-    "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/10ebfa84f4e8b018ef2459063f0293b8e9ac01da/Windsurf-darwin-x64-1.12.39.zip",
-    "sha256": "f422f2148be8e1d824abcd5ed18c86838d5edbb7f91244dcc51e142e9b5ac743"
+    "version": "1.12.43",
+    "vscodeVersion": "1.106.0",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/8b6a7c68fb76075b29a085605ef19c1d660a258e/Windsurf-darwin-x64-1.12.43.zip",
+    "sha256": "87d53b2dc977975a7876eaac3fe2306520e40ffb1e022dd11585ffedc68721c8"
   },
   "x86_64-linux": {
-    "version": "1.12.39",
-    "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/10ebfa84f4e8b018ef2459063f0293b8e9ac01da/Windsurf-linux-x64-1.12.39.tar.gz",
-    "sha256": "ce36ec8697ca7c9768678b99b9b8b364d33a044afed242931fea14f544581c68"
+    "version": "1.12.43",
+    "vscodeVersion": "1.106.0",
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/8b6a7c68fb76075b29a085605ef19c1d660a258e/Windsurf-linux-x64-1.12.43.tar.gz",
+    "sha256": "c7f3c83561e40c63b36eff39bcfe8591250e735da3ecc2b29c277b8e04856825"
   }
 }
diff --git a/pkgs/by-name/ze/zenn-cli/package.nix b/pkgs/by-name/ze/zenn-cli/package.nix
index 5fd35e6cc3d5..d01bf284ec02 100644
--- a/pkgs/by-name/ze/zenn-cli/package.nix
+++ b/pkgs/by-name/ze/zenn-cli/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "zenn-dev";
     repo = "zenn-editor";
     tag = finalAttrs.version;
-    hash = "sha256-H46wFDSxG5Fg9HuJOLulBXoXR+osf4gJEa+ZMUMWT5Q=";
+    hash = "sha256-wItKDLAJHIyxUUaLIFM+sNYWtXKWC4P6GkCKn2Wh2JA=";
   };
 
   nativeBuildInputs = [
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       ;
     fetcherVersion = 1;
-    hash = "sha256-QEOGL/FK0Vq8opPu7NeTTrk/rwWlMgisx+A7edMN9fw=";
+    hash = "sha256-WXsS5/J08n/dWV5MbyX4vK7j1mfiUoLdzwmzyqoX3FA=";
   };
 
   preBuild = ''
diff --git a/pkgs/desktops/lomiri/applications/morph-browser/default.nix b/pkgs/desktops/lomiri/applications/morph-browser/default.nix
index 1135684de28f..e9be5b8ce1dd 100644
--- a/pkgs/desktops/lomiri/applications/morph-browser/default.nix
+++ b/pkgs/desktops/lomiri/applications/morph-browser/default.nix
@@ -5,8 +5,10 @@
   gitUpdater,
   nixosTests,
   cmake,
+  ctestCheckHook,
   gettext,
   libapparmor,
+  libpsl,
   lomiri-action-api,
   lomiri-content-hub,
   lomiri-ui-extras,
@@ -29,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "morph-browser";
-  version = "1.1.2";
+  version = "1.99.1";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/morph-browser";
     tag = finalAttrs.version;
-    hash = "sha256-CW+8HEGxeDDfqbBtNHDKTvsZkbu0tCmD6OEDW07KG2k=";
+    hash = "sha256-RCyauz7qBNzq7Aqr22NBSAgVSBsFpXpNb+aVo73CBQU=";
   };
 
   outputs = [
@@ -44,7 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
-    substituteInPlace src/{Morph,Ubuntu}/CMakeLists.txt \
+    substituteInPlace src/Morph/CMakeLists.txt \
+      --replace-fail '/usr/lib/''${CMAKE_LIBRARY_ARCHITECTURE}/qt''${QT_VERSION_MAJOR}/qml' "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
+
+    substituteInPlace src/Ubuntu/CMakeLists.txt \
       --replace-fail '/usr/lib/''${CMAKE_LIBRARY_ARCHITECTURE}/qt5/qml' "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
 
     substituteInPlace src/app/webbrowser/morph-browser.desktop.in.in \
@@ -52,11 +57,12 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'X-Lomiri-Splash-Image=@CMAKE_INSTALL_FULL_DATADIR@/morph-browser/morph-browser-splash.svg' 'X-Lomiri-Splash-Image=lomiri-app-launch/splash/morph-browser.svg'
 
     substituteInPlace doc/CMakeLists.txt \
-      --replace-fail 'COMMAND ''${QDOC_EXECUTABLE} -qt5' 'COMMAND ''${QDOC_EXECUTABLE}'
+      --replace-fail 'COMMAND ''${QDOC_BIN} -qt5' 'COMMAND ''${QDOC_BIN}'
   ''
-  + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
+  # Being worked on upstream and temporarily disabled, but they still mostly work fine right now
+  + lib.optionalString (finalAttrs.finalPackage.doCheck) ''
     substituteInPlace CMakeLists.txt \
-      --replace-fail 'add_subdirectory(tests)' ""
+      --replace-fail '#add_subdirectory(tests)' 'add_subdirectory(tests)'
   '';
 
   strictDeps = true;
@@ -71,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libapparmor
+    libpsl
     qtbase
     qtdeclarative
     qtwebengine
@@ -86,27 +93,30 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeCheckInputs = [
+    ctestCheckHook
     mesa.llvmpipeHook # ShapeMaterial needs an OpenGL context: https://gitlab.com/ubports/development/core/lomiri-ui-toolkit/-/issues/35
     xvfb-run
   ];
 
   cmakeFlags = [
-    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (
-      lib.concatStringsSep ";" [
-        # Exclude tests
-        "-E"
-        (lib.strings.escapeShellArg "(${
-          lib.concatStringsSep "|" [
-            # Don't care about linter failures
-            "^flake8"
-          ]
-        })")
-      ]
-    ))
+    (lib.cmakeBool "CLICK_MODE" false)
+    (lib.cmakeBool "ENABLE_QT6" (lib.strings.versionAtLeast qtbase.version "6"))
+    (lib.cmakeBool "WERROR" true)
   ];
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
+  disabledTests = [
+    # Don't care about linter failures
+    "flake8"
+
+    # Temporarily broken while upstream is working on porting to Qt6
+    "tst_QmlTests"
+
+    # Flaky
+    "tst_HistoryModelTests"
+  ];
+
   preCheck = ''
     export HOME=$TMPDIR
     export QT_PLUGIN_PATH=${listToQtVar qtbase.qtPluginPrefix [ qtbase ]}
@@ -129,6 +139,17 @@ stdenv.mkDerivation (finalAttrs: {
 
     ln -s $out/share/{morph-browser,icons/hicolor/scalable/apps}/morph-browser.svg
     ln -s $out/share/{morph-browser/morph-browser-splash.svg,lomiri-app-launch/splash/morph-browser.svg}
+  ''
+  # This got broken when QML files got duplicated & split into Qt version-specific subdirs in source tree
+  # Symlinks get installed as-is, and they currently point relatively to the versioned subdirs
+  + ''
+    for link in $(find $out/${qtbase.qtQmlPrefix}/Ubuntu -type l); do
+      ln -vfs "$(readlink "$link" | sed -e 's|/qml-qt5||g')" "$link"
+    done
+  ''
+  # Link target for this one just doesn't get installed ever it seems, yeet it
+  + ''
+    rm -v $out/${qtbase.qtQmlPrefix}/Ubuntu/Web/handle@27.png
   '';
 
   passthru = {
diff --git a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
index 4866d7aee8db..0bb6f449605a 100644
--- a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-ui-toolkit";
-  version = "1.3.5110";
+  version = "1.3.5901";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-ui-toolkit";
     rev = finalAttrs.version;
-    hash = "sha256-j2Fowwj+ArdfJacqBSWksPk+wXRoTpL/Jrgme2tUSC8=";
+    hash = "sha256-adKCk8iYExKHTkWtzh6cF4AlIsbMoKg1SE7udhLo+ss=";
   };
 
   outputs = [
@@ -178,6 +178,8 @@ stdenv.mkDerivation (finalAttrs: {
     export QT_PLUGIN_PATH=${qtPluginPaths}
     export XDG_DATA_DIRS=${suru-icon-theme}/share
 
+    export UITK_BUILD_ROOT=$PWD
+
     tests/xvfb.sh make check ''${enableParallelChecking:+-j''${NIX_BUILD_CORES}}
 
     runHook postCheck
diff --git a/pkgs/development/python-modules/django-lasuite/default.nix b/pkgs/development/python-modules/django-lasuite/default.nix
index 753eceb4ce50..e571f8b42ac2 100644
--- a/pkgs/development/python-modules/django-lasuite/default.nix
+++ b/pkgs/development/python-modules/django-lasuite/default.nix
@@ -15,20 +15,21 @@
   pytest-django,
   responses,
   celery,
+  freezegun,
   pytestCheckHook,
   nixosTests,
 }:
 
 buildPythonPackage rec {
   pname = "django-lasuite";
-  version = "0.0.18";
+  version = "0.0.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "django-lasuite";
     tag = "v${version}";
-    hash = "sha256-kXRaoVOyabGPCnO8uyWHbpE0zOIYZkHcqmWNSz0BHZY=";
+    hash = "sha256-T9FLxgWePifYIiD2Ivbfir2dlpUvZl2jj8y86VbxVDk=";
   };
 
   build-system = [ hatchling ];
@@ -44,15 +45,22 @@ buildPythonPackage rec {
     requests-toolbelt
   ];
 
+  optional-dependencies = lib.fix (self: {
+    all = with self; configuration ++ malware_detection;
+    configuration = [ django-configurations ];
+    malware_detection = [ celery ];
+  });
+
   pythonRelaxDeps = true;
 
   nativeCheckInputs = [
-    celery
+    factory-boy
+    freezegun
     pytestCheckHook
     pytest-django
-    factory-boy
     responses
-  ];
+  ]
+  ++ lib.concatAttrValues optional-dependencies;
 
   preCheck = ''
     export PYTHONPATH=tests:$PYTHONPATH
diff --git a/pkgs/development/python-modules/optimum-onnx/default.nix b/pkgs/development/python-modules/optimum-onnx/default.nix
new file mode 100644
index 000000000000..f596ed96e0c2
--- /dev/null
+++ b/pkgs/development/python-modules/optimum-onnx/default.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  onnx,
+  optimum,
+  transformers,
+
+  # optional-dependencies
+  onnxruntime,
+  # onnxruntime-gpu, unpackaged
+  ruff,
+}:
+
+buildPythonPackage rec {
+  pname = "optimum-onnx";
+  version = "0.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "huggingface";
+    repo = "optimum-onnx";
+    tag = "v${version}";
+    hash = "sha256-wT3yqS64LMuq76Yxs6V6nHfD8vgSfPoJm3hbW7E2zpk=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "transformers"
+  ];
+  dependencies = [
+    onnx
+    optimum
+    transformers
+  ];
+
+  optional-dependencies = {
+    onnxruntime = [
+      onnxruntime
+    ];
+    # onnxruntime-gpu = [ onnxruntime-gpu ];
+    quality = [
+      ruff
+    ];
+  };
+
+  pythonImportsCheck = [ "optimum.onnxruntime" ];
+
+  # Almost all tests need internet access
+  doCheck = false;
+
+  meta = {
+    description = "Export your model to ONNX and run inference with ONNX Runtime";
+    homepage = "https://github.com/huggingface/optimum-onnx";
+    changelog = "https://github.com/huggingface/optimum-onnx/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/sentence-transformers/default.nix b/pkgs/development/python-modules/sentence-transformers/default.nix
index dde406954171..15d7b590b131 100644
--- a/pkgs/development/python-modules/sentence-transformers/default.nix
+++ b/pkgs/development/python-modules/sentence-transformers/default.nix
@@ -8,11 +8,7 @@
   setuptools,
 
   # dependencies
-  accelerate,
-  datasets,
   huggingface-hub,
-  optimum,
-  pillow,
   scikit-learn,
   scipy,
   torch,
@@ -20,6 +16,15 @@
   transformers,
   typing-extensions,
 
+  # optional-dependencies
+  # image
+  pillow,
+  # train
+  accelerate,
+  datasets,
+  # onnx
+  optimum-onnx,
+
   # tests
   pytestCheckHook,
   pytest-cov-stub,
@@ -27,21 +32,20 @@
 
 buildPythonPackage rec {
   pname = "sentence-transformers";
-  version = "5.1.2";
+  version = "5.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "sentence-transformers";
     tag = "v${version}";
-    hash = "sha256-FNJ4mWBcgy3J8ZJtHt+uBgNmvMnqphj+sLMmBvgdB1k=";
+    hash = "sha256-WD5uTfAbDYYeSXlgznSs4XyN1fAILxILmmSHmLosmV4=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     huggingface-hub
-    pillow
     scikit-learn
     scipy
     torch
@@ -51,12 +55,15 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
+    image = [
+      pillow
+    ];
     train = [
       accelerate
       datasets
     ];
-    onnx = [ optimum ] ++ optimum.optional-dependencies.onnxruntime;
-    # onnx-gpu = [ optimum ] ++ optimum.optional-dependencies.onnxruntime-gpu;
+    onnx = [ optimum-onnx ] ++ optimum-onnx.optional-dependencies.onnxruntime;
+    # onnx-gpu = [ optimum-onnx ] ++ optimum-onnx.optional-dependencies.onnxruntime-gpu;
     # openvino = [ optimum-intel ] ++ optimum-intel.optional-dependencies.openvino;
   };
 
diff --git a/pkgs/servers/mastodon/default.nix b/pkgs/servers/mastodon/default.nix
index ff7ae2e1495f..e192d55d6b40 100644
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@@ -66,6 +66,9 @@ stdenv.mkDerivation rec {
 
       bundle exec rails assets:precompile
 
+      # Install packages for streaming server while remove others
+      rm -rf node_modules/*
+      yarn workspaces focus --production @mastodon/streaming
       rm -rf node_modules/.cache
 
       # Remove workspace "package" as it contains broken symlinks
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index a12975f71115..ff479dcb0adb 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1222,80 +1222,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videoglide = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-glide";
-      version = "1.2.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-glide-1.2.2.tar.bz2";
-        sha256 = "1vaav6kx4n00q4fawgqnjmbdkppl0dir2dkrj4ad372mxrvl9c4y";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videoglint = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      libpciaccess,
-      xorgproto,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-glint";
-      version = "1.2.9";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-glint-1.2.9.tar.bz2";
-        sha256 = "1lkpspvrvrp9s539bhfdjfh4andaqyk63l6zjn8m3km95smk6a45";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        libpciaccess
-        xorgproto
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videoi128 = callPackage (
     {
@@ -1520,42 +1446,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videonewport = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-newport";
-      version = "0.2.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-newport-0.2.4.tar.bz2";
-        sha256 = "1yafmp23jrfdmc094i6a4dsizapsc9v0pl65cpc8w1kvn7343k4i";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videonouveau = callPackage (
     {
@@ -2146,44 +2036,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videotga = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgproto,
-      libpciaccess,
-      xorgserver,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-tga";
-      version = "1.2.2";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-tga-1.2.2.tar.bz2";
-        sha256 = "0cb161lvdgi6qnf1sfz722qn38q7kgakcvj7b45ba3i0020828r0";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgproto
-        libpciaccess
-        xorgserver
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xf86videotrident = callPackage (
     {
@@ -2418,42 +2270,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  xf86videowsfb = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      xorgserver,
-      xorgproto,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "xf86-video-wsfb";
-      version = "0.4.0";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2";
-        sha256 = "0hr8397wpd0by1hc47fqqrnaw3qdqd8aqgwgzv38w5k3l3jy6p4p";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [
-        xorgserver
-        xorgproto
-      ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xfd = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 1950039c10d5..efbb79066892 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -221,55 +221,33 @@ self: super:
   xf86inputvoid = brokenOnDarwin super.xf86inputvoid; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86inputvoid.x86_64-darwin
   xf86videodummy = brokenOnDarwin super.xf86videodummy; # never worked: https://hydra.nixos.org/job/nixpkgs/trunk/xorg.xf86videodummy.x86_64-darwin
 
-  # Obsolete drivers that don't compile anymore.
   xf86videoark = super.xf86videoark.overrideAttrs (attrs: {
     meta = attrs.meta // {
-      broken = true;
+      badPlatforms = lib.platforms.aarch64;
     };
   });
+
   xf86videogeode = super.xf86videogeode.overrideAttrs (attrs: {
     meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videoglide = super.xf86videoglide.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
+      badPlatforms = lib.platforms.aarch64;
     };
   });
+
   xf86videoi128 = super.xf86videoi128.overrideAttrs (attrs: {
     meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videonewport = super.xf86videonewport.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
+      badPlatforms = lib.platforms.aarch64;
     };
   });
+
   xf86videos3virge = super.xf86videos3virge.overrideAttrs (attrs: {
     meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videotga = super.xf86videotga.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
+      badPlatforms = lib.platforms.aarch64;
     };
   });
+
   xf86videov4l = super.xf86videov4l.overrideAttrs (attrs: {
     meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videovoodoo = super.xf86videovoodoo.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
-    };
-  });
-  xf86videowsfb = super.xf86videowsfb.overrideAttrs (attrs: {
-    meta = attrs.meta // {
-      broken = true;
+      platforms = lib.platforms.linux;
     };
   });
 
@@ -291,15 +269,6 @@ self: super:
     NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
   });
 
-  xf86videoglint = super.xf86videoglint.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ];
-    buildInputs = attrs.buildInputs ++ [ xorg.utilmacros ];
-    # https://gitlab.freedesktop.org/xorg/driver/xf86-video-glint/-/issues/1
-    meta = attrs.meta // {
-      broken = true;
-    };
-  });
-
   xf86videosuncg6 = super.xf86videosuncg6.overrideAttrs (attrs: {
     meta = attrs.meta // {
       broken = isDarwin;
@@ -754,4 +723,12 @@ self: super:
 # deprecate some packages
 // lib.optionalAttrs config.allowAliases {
   fontbitstreamspeedo = throw "Bitstream Speedo is an obsolete font format that hasn't been supported by Xorg since 2005"; # added 2025-09-24
+  xf86videoglide = throw "The Xorg Glide video driver has been archived upstream due to being obsolete"; # added 2025-12-13
+  xf86videoglint = throw ''
+    The Xorg GLINT/Permedia video driver has been broken since xorg 21.
+    see https://gitlab.freedesktop.org/xorg/driver/xf86-video-glint/-/issues/1
+  ''; # added 2025-12-13
+  xf86videonewport = throw "The Xorg Newport video driver is broken and hasn't had a release since 2012"; # added 2025-12-13
+  xf86videotga = throw "The Xorg TGA (aka DEC 21030) video driver is broken and hasn't had a release since 2012"; # added 2025-12-13
+  xf86videowsfb = throw "The Xorg BSD wsdisplay framebuffer video driver is broken and hasn't had a release since 2012"; # added 2025-12-13
 }
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index a20e50ffdc12..4d61ba966659 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -31,14 +31,11 @@ mirror://xorg/individual/driver/xf86-video-cirrus-1.6.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-dummy-0.4.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-fbdev-0.5.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-geode-2.18.1.tar.xz
-mirror://xorg/individual/driver/xf86-video-glide-1.2.2.tar.bz2
-mirror://xorg/individual/driver/xf86-video-glint-1.2.9.tar.bz2
 mirror://xorg/individual/driver/xf86-video-i128-1.4.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-i740-1.4.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-intel-2.99.917.tar.bz2
 mirror://xorg/individual/driver/xf86-video-mga-2.1.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-neomagic-1.3.1.tar.xz
-mirror://xorg/individual/driver/xf86-video-newport-0.2.4.tar.bz2
 https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/-/archive/3ee7cbca8f9144a3bb5be7f71ce70558f548d268/xf86-video-nouveau-3ee7cbca8f9144a3bb5be7f71ce70558f548d268.tar.bz2
 mirror://xorg/individual/driver/xf86-video-nv-2.1.23.tar.xz
 mirror://xorg/individual/driver/xf86-video-omap-0.4.5.tar.bz2
@@ -54,13 +51,11 @@ mirror://xorg/individual/driver/xf86-video-suncg6-1.1.3.tar.xz
 mirror://xorg/individual/driver/xf86-video-sunffb-1.2.3.tar.xz
 mirror://xorg/individual/driver/xf86-video-sunleo-1.2.3.tar.xz
 mirror://xorg/individual/driver/xf86-video-tdfx-1.5.0.tar.bz2
-mirror://xorg/individual/driver/xf86-video-tga-1.2.2.tar.bz2
 mirror://xorg/individual/driver/xf86-video-trident-1.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-v4l-0.3.0.tar.bz2
 mirror://xorg/individual/driver/xf86-video-vboxvideo-1.0.1.tar.xz
 mirror://xorg/individual/driver/xf86-video-vesa-2.6.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-vmware-13.4.0.tar.xz
 mirror://xorg/individual/driver/xf86-video-voodoo-1.2.6.tar.xz
-mirror://xorg/individual/driver/xf86-video-wsfb-0.4.0.tar.bz2
 mirror://xorg/individual/lib/libXTrap-1.0.1.tar.bz2
 mirror://xorg/individual/xserver/xorg-server-21.1.20.tar.xz
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 8ae991cb5366..62aa85f9b7aa 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -860,12 +860,23 @@ let
       # for a fixed-output derivation, the corresponding inputDerivation should
       # *not* be fixed-output. To achieve this we simply delete the attributes that
       # would make it fixed-output.
-      deleteFixedOutputRelatedAttrs = lib.flip removeAttrs [
+      fixedOutputRelatedAttrs = [
         "outputHashAlgo"
         "outputHash"
         "outputHashMode"
       ];
 
+      # inputDerivation produces the inputs; not the outputs, so any
+      # restrictions on what used to be the outputs don't serve a purpose
+      # anymore.
+      outputCheckAttrs = [
+        "allowedReferences"
+        "allowedRequisites"
+        "disallowedReferences"
+        "disallowedRequisites"
+        "outputChecks"
+      ];
+
     in
 
     extendDerivation validity.handled (
@@ -876,10 +887,10 @@ let
         # needed to enter a nix-shell with
         #   nix-build shell.nix -A inputDerivation
         inputDerivation = derivation (
-          deleteFixedOutputRelatedAttrs derivationArg
+          removeAttrs derivationArg (fixedOutputRelatedAttrs ++ outputCheckAttrs)
           // {
             # Add a name in case the original drv didn't have one
-            name = derivationArg.name or "inputDerivation";
+            name = "inputDerivation" + lib.optionalString (derivationArg ? name) "-${derivationArg.name}";
             # This always only has one output
             outputs = [ "out" ];
 
@@ -911,25 +922,6 @@ let
               ''
             ];
           }
-          // (
-            let
-              sharedOutputChecks = {
-                # inputDerivation produces the inputs; not the outputs, so any
-                # restrictions on what used to be the outputs don't serve a purpose
-                # anymore.
-                allowedReferences = null;
-                allowedRequisites = null;
-                disallowedReferences = [ ];
-                disallowedRequisites = [ ];
-              };
-            in
-            if __structuredAttrs then
-              {
-                outputChecks.out = sharedOutputChecks;
-              }
-            else
-              sharedOutputChecks
-          )
         );
 
         inherit passthru overrideAttrs;
diff --git a/pkgs/test/stdenv/default.nix b/pkgs/test/stdenv/default.nix
index 3032b5d13b2b..c11f93df0f5b 100644
--- a/pkgs/test/stdenv/default.nix
+++ b/pkgs/test/stdenv/default.nix
@@ -216,6 +216,22 @@ let
         touch $out
       '';
     };
+
+  testInputDerivationDep = stdenv.mkDerivation {
+    name = "test-input-derivation-dependency";
+    buildCommand = "touch $out";
+  };
+  testInputDerivation =
+    attrs:
+    (stdenv.mkDerivation (
+      attrs
+      // {
+        buildInputs = [ testInputDerivationDep ];
+      }
+    )).inputDerivation
+    // {
+      meta = { };
+    };
 in
 
 {
@@ -356,6 +372,55 @@ in
         touch $out
       '';
 
+  test-inputDerivation-structured = testInputDerivation {
+    name = "test-inDrv-structured";
+    __structuredAttrs = true;
+  };
+
+  test-inputDerivation-allowedReferences = testInputDerivation {
+    name = "test-inDrv-allowedReferences";
+    allowedReferences = [ ];
+  };
+
+  test-inputDerivation-disallowedReferences = testInputDerivation {
+    name = "test-inDrv-disallowedReferences";
+    disallowedReferences = [ "${testInputDerivationDep}" ];
+  };
+
+  test-inputDerivation-allowedRequisites = testInputDerivation {
+    name = "test-inDrv-allowedRequisites";
+    allowedRequisites = [ ];
+  };
+
+  test-inputDerivation-disallowedRequisites = testInputDerivation {
+    name = "test-inDrv-disallowedRequisites";
+    disallowedRequisites = [ "${testInputDerivationDep}" ];
+  };
+
+  test-inputDerivation-structured-allowedReferences = testInputDerivation {
+    name = "test-inDrv-structured-allowedReferences";
+    __structuredAttrs = true;
+    outputChecks.out.allowedReferences = [ ];
+  };
+
+  test-inputDerivation-structured-disallowedReferences = testInputDerivation {
+    name = "test-inDrv-structured-disallowedReferences";
+    __structuredAttrs = true;
+    outputChecks.out.disallowedReferences = [ "${testInputDerivationDep}" ];
+  };
+
+  test-inputDerivation-structured-allowedRequisites = testInputDerivation {
+    name = "test-inDrv-structured-allowedRequisites";
+    __structuredAttrs = true;
+    outputChecks.out.allowedRequisites = [ ];
+  };
+
+  test-inputDerivation-structured-disallowedRequisites = testInputDerivation {
+    name = "test-inDrv-structured-disallowedRequisites";
+    __structuredAttrs = true;
+    outputChecks.out.disallowedRequisites = [ "${testInputDerivationDep}" ];
+  };
+
   test-prepend-append-to-var = testPrependAndAppendToVar {
     name = "test-prepend-append-to-var";
     stdenv' = bootStdenv;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b44a41637980..09c334697fe8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3330,16 +3330,6 @@ with pkgs;
 
   marimo = with python3Packages; toPythonApplication marimo;
 
-  mecab =
-    let
-      mecab-nodic = callPackage ../tools/text/mecab/nodic.nix { };
-    in
-    callPackage ../tools/text/mecab {
-      mecab-ipadic = callPackage ../tools/text/mecab/ipadic.nix {
-        inherit mecab-nodic;
-      };
-    };
-
   mbutil = python310Packages.callPackage ../applications/misc/mbutil { };
 
   mcstatus = with python3Packages; toPythonApplication mcstatus;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 605d475eae08..31fa5a190bf3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11438,6 +11438,8 @@ self: super: with self; {
 
   optimum = callPackage ../development/python-modules/optimum { };
 
+  optimum-onnx = callPackage ../development/python-modules/optimum-onnx { };
+
   optree = callPackage ../development/python-modules/optree { };
 
   optuna = callPackage ../development/python-modules/optuna { };