diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index bc1cfb5a3cfb..488eb0ea9201 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -22,18 +22,27 @@ let
 
   anyMatchingFiles = files: builtins.any anyMatchingFile files;
 
-  attrsWithMaintainers = builtins.map (
-    name:
-    let
-      package = lib.getAttrFromPath (lib.splitString "." name) pkgs;
-    in
-    {
-      inherit name package;
-      # TODO: Refactor this so we can ping entire teams instead of the individual members.
-      # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
-      maintainers = package.meta.maintainers or [ ];
-    }
-  ) (changedattrs ++ removedattrs);
+  attrsWithMaintainers = lib.pipe (changedattrs ++ removedattrs) [
+    (builtins.map (
+      name:
+      let
+        # Some packages might be reported as changed on a different platform, but
+        # not even have an attribute on the platform the maintainers are requested on.
+        # Fallback to `null` for these to filter them out below.
+        package = lib.attrByPath (lib.splitString "." name) null pkgs;
+      in
+      {
+        inherit name package;
+        # TODO: Refactor this so we can ping entire teams instead of the individual members.
+        # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
+        maintainers = package.meta.maintainers or [ ];
+      }
+    ))
+    # No need to match up packages without maintainers with their files.
+    # This also filters out attributes where `packge = null`, which is the
+    # case for libintl, for example.
+    (builtins.filter (pkg: pkg.maintainers != [ ]))
+  ];
 
   relevantFilenames =
     drv:
diff --git a/doc/languages-frameworks/vim.section.md b/doc/languages-frameworks/vim.section.md
index 0000860095e7..d884b5f23a7c 100644
--- a/doc/languages-frameworks/vim.section.md
+++ b/doc/languages-frameworks/vim.section.md
@@ -186,12 +186,17 @@ Alternatively, set the number of processes to a lower count to avoid rate-limiti
 nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater --proc 1'
 ```
 
-If you want to update only certain plugins, you can specify them after the `update` command. Note that you must use the same plugin names as the `pkgs/applications/editors/vim/plugins/vim-plugin-names` file.
+To update only specific plugins, list them after the `update` command:
 
 ```sh
-nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater update "nvim-treesitter" "LazyVim"'
+nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater update "nvim-treesitter" "mini.nvim" "mini-nvim"'
 ```
 
+The updater script accepts plugin arguments in different formats:
+
+- `"mini.nvim"` := The GitHub repository name, the raw plugin name, or the alias defined in `vim-plugin-names`.
+- `"mini-nvim"` := The normalized plugin name, which matches the attribute name generated in `generated.nix`
+
 ## How to maintain an out-of-tree overlay of vim plugins? {#vim-out-of-tree-overlays}
 
 You can use the updater script to generate basic packages out of a custom vim
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 4727bdd8e785..da007f063797 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -68,6 +68,8 @@
 
 - [Newt](https://github.com/fosrl/newt), a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. Available as [services.newt](options.html#opt-services.newt.enable).
 
+- [IfState](https://ifstate.net), manage host interface settings in a declarative manner. Available as [networking.ifstate](options.html#opt-networking.ifstate.enable) and [boot.initrd.network.ifstate](options.html#opt-boot.initrd.network.ifstate.enable).
+
 - [qBittorrent](https://www.qbittorrent.org/), is a bittorrent client programmed in C++ / Qt that uses libtorrent by Arvid Norberg. Available as [services.qbittorrent](#opt-services.qbittorrent.enable).
 
 - [Speedify](https://speedify.com/), a proprietary VPN which allows combining multiple internet connections (Wi-Fi, 4G, 5G, Ethernet, Starlink, Satellite, and more) to improve the stability, speed, and security of online experiences. Available as [services.speedify](#opt-services.speedify.enable).
@@ -82,6 +84,8 @@
 
 - [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).
 
+- [angrr](https://github.com/linyinfeng/angrr), a service that automatically cleans up old auto GC roots. Available as [services.angrr](#opt-services.angrr.enable).
+
 - [Sharkey](https://joinsharkey.org), a Sharkish microblogging platform. Available as [services.sharkey](#opt-services.sharkey.enable).
 
 - [fw-fanctrl](https://github.com/TamtamHero/fw-fanctrl), a simple systemd service to better control Framework Laptop's fan(s). Available as [hardware.fw-fanctrl](#opt-hardware.fw-fanctrl.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 50679a014efc..ebc7a65058b3 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -788,6 +788,7 @@
   ./services/misc/airsonic.nix
   ./services/misc/amazon-ssm-agent.nix
   ./services/misc/ananicy.nix
+  ./services/misc/angrr.nix
   ./services/misc/anki-sync-server.nix
   ./services/misc/apache-kafka.nix
   ./services/misc/atuin.nix
@@ -1185,6 +1186,7 @@
   ./services/networking/i2pd.nix
   ./services/networking/icecream/daemon.nix
   ./services/networking/icecream/scheduler.nix
+  ./services/networking/ifstate.nix
   ./services/networking/imaginary.nix
   ./services/networking/inadyn.nix
   ./services/networking/inspircd.nix
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 1c8e65a352f2..dc1900f52c1e 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -868,6 +868,10 @@ in
             "amshan"
             "benqprojector"
           ];
+          componentsUsingInputDevices = [
+            # Components that require access to input devices (/dev/input/*)
+            "keyboard_remote"
+          ];
         in
         {
           ExecStart = escapeSystemdExecArgs (
@@ -898,13 +902,15 @@ in
           # Hardening
           AmbientCapabilities = capabilities;
           CapabilityBoundingSet = capabilities;
-          DeviceAllow = (
+          DeviceAllow =
             optionals (any useComponent componentsUsingSerialDevices) [
               "char-ttyACM rw"
               "char-ttyAMA rw"
               "char-ttyUSB rw"
             ]
-          );
+            ++ optionals (any useComponent componentsUsingInputDevices) [
+              "char-input rw"
+            ];
           DevicePolicy = "closed";
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
@@ -946,9 +952,13 @@ in
           RestrictNamespaces = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
-          SupplementaryGroups = optionals (any useComponent componentsUsingSerialDevices) [
-            "dialout"
-          ];
+          SupplementaryGroups =
+            optionals (any useComponent componentsUsingSerialDevices) [
+              "dialout"
+            ]
+            ++ optionals (any useComponent componentsUsingInputDevices) [
+              "input"
+            ];
           SystemCallArchitectures = "native";
           SystemCallFilter = [
             "@system-service"
diff --git a/nixos/modules/services/misc/angrr.nix b/nixos/modules/services/misc/angrr.nix
new file mode 100644
index 000000000000..dbecc7e76fbb
--- /dev/null
+++ b/nixos/modules/services/misc/angrr.nix
@@ -0,0 +1,128 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.angrr;
+in
+{
+  meta.maintainers = pkgs.angrr.meta.maintainers;
+  options = {
+    services.angrr = {
+      enable = lib.mkEnableOption "angrr";
+      package = lib.mkPackageOption pkgs "angrr" { };
+      period = lib.mkOption {
+        type = lib.types.str;
+        default = "7d";
+        example = "2weeks";
+        description = ''
+          The retention period of auto GC roots.
+        '';
+      };
+      removeRoot = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to pass the `--remove-root` option to angrr.
+        '';
+      };
+      ownedOnly = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Control the `--remove-root=<true|false>` option of angrr.
+        '';
+        apply = b: if b then "true" else "false";
+      };
+      logLevel = lib.mkOption {
+        type =
+          with lib.types;
+          enum [
+            "off"
+            "error"
+            "warn"
+            "info"
+            "debug"
+            "trace"
+          ];
+        default = "info";
+        description = ''
+          Set the log level of angrr.
+        '';
+      };
+      extraArgs = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [ ];
+        description = ''
+          Extra command-line arguments pass to angrr.
+        '';
+      };
+      enableNixGcIntegration = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to enable nix-gc.service integration
+        '';
+      };
+      timer = {
+        enable = lib.mkEnableOption "angrr timer";
+        dates = lib.mkOption {
+          type = lib.types.str;
+          default = "03:00";
+          description = ''
+            How often or when the retention policy is performed.
+          '';
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        assertions = [
+          {
+            assertion = cfg.enableNixGcIntegration -> config.nix.gc.automatic;
+            message = "angrr nix-gc.service integration requires `nix.gc.automatic = true`";
+          }
+        ];
+        services.angrr.enableNixGcIntegration = lib.mkDefault config.nix.gc.automatic;
+      }
+
+      {
+        systemd.services.angrr = {
+          description = "Auto Nix GC Roots Retention";
+          script = ''
+            ${lib.getExe cfg.package} run \
+              --log-level "${cfg.logLevel}" \
+              --period "${cfg.period}" \
+              ${lib.optionalString cfg.removeRoot "--remove-root"} \
+              --owned-only="${cfg.ownedOnly}" \
+              --no-prompt ${lib.escapeShellArgs cfg.extraArgs}
+          '';
+          serviceConfig = {
+            Type = "oneshot";
+          };
+        };
+      }
+
+      (lib.mkIf cfg.timer.enable {
+        systemd.timers.angrr = {
+          timerConfig = {
+            OnCalendar = cfg.timer.dates;
+          };
+          wantedBy = [ "timers.target" ];
+        };
+      })
+
+      (lib.mkIf cfg.enableNixGcIntegration {
+        systemd.services.angrr = {
+          wantedBy = [ "nix-gc.service" ];
+          before = [ "nix-gc.service" ];
+        };
+      })
+    ]
+  );
+}
diff --git a/nixos/modules/services/misc/radicle.nix b/nixos/modules/services/misc/radicle.nix
index a4b18d60fcbc..37b59003fdd4 100644
--- a/nixos/modules/services/misc/radicle.nix
+++ b/nixos/modules/services/misc/radicle.nix
@@ -227,6 +227,16 @@ in
           default = 8080;
           description = "The port on which `radicle-httpd` listens.";
         };
+        aliases = lib.mkOption {
+          type = lib.types.attrsOf lib.types.str;
+          description = "Alias and RID pairs to shorten git clone commands for repositories.";
+          default = { };
+          example = lib.literalExpression ''
+            {
+              heartwood = "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5";
+            }
+          '';
+        };
         nginx = lib.mkOption {
           # Type of a single virtual host, or null.
           type = lib.types.nullOr (
@@ -342,7 +352,20 @@ in
                 description = "Radicle HTTP gateway to radicle-node";
                 documentation = [ "man:radicle-httpd(1)" ];
                 serviceConfig = {
-                  ExecStart = "${lib.getExe' cfg.httpd.package "radicle-httpd"} --listen ${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort} ${lib.escapeShellArgs cfg.httpd.extraArgs}";
+                  ExecStart = lib.escapeShellArgs (
+                    [
+                      (lib.getExe' cfg.httpd.package "radicle-httpd")
+                      "--listen=${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort}"
+                    ]
+                    ++ lib.flatten (
+                      lib.mapAttrsToList (alias: rid: [
+                        "--alias"
+                        alias
+                        rid
+                      ]) cfg.httpd.aliases
+                    )
+                    ++ cfg.httpd.extraArgs
+                  );
                   Restart = lib.mkDefault "on-failure";
                   RestartSec = "10";
                   SocketBindAllow = [ "tcp:${toString cfg.httpd.listenPort}" ];
diff --git a/nixos/modules/services/networking/ifstate.nix b/nixos/modules/services/networking/ifstate.nix
new file mode 100644
index 000000000000..f382f28efbe9
--- /dev/null
+++ b/nixos/modules/services/networking/ifstate.nix
@@ -0,0 +1,311 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.networking.ifstate;
+  initrdCfg = config.boot.initrd.network.ifstate;
+  settingsFormat = {
+    # override generator in order to:
+    # - use yq and not remarshal because it matches yaml datatype handling with IfState
+    # - validate json schema
+    generate =
+      name: value: package:
+      pkgs.runCommand name
+        {
+          nativeBuildInputs = with pkgs; [
+            yq
+            check-jsonschema
+          ];
+          value = builtins.toJSON value;
+          passAsFile = [ "value" ];
+        }
+        ''
+          yq --yaml-output . $valuePath > $out
+          check-jsonschema --schemafile "${cfg.package.passthru.jsonschema}" "$out"
+          sed -i $'s|\'!include |!include \'|' $out
+        '';
+
+    inherit (pkgs.formats.yaml { }) type;
+  };
+  initrdInterfaceTypes = builtins.map (interface: interface.link.kind) (
+    builtins.attrValues initrdCfg.settings.interfaces
+  );
+  # IfState interface kind to kernel modules mapping
+  interfaceKernelModules = {
+    "ifb" = [ "ifb" ];
+    "ip6tnl" = [ "ip6tnl" ];
+    "ipoib" = [ "ib_ipoib" ];
+    "ipvlan" = [ "ipvlan" ];
+    "macvlan" = [ "macvlan" ];
+    "macvtap" = [ "macvtap" ];
+    "team" = [ "team" ];
+    "tun" = [ "tun" ];
+    "vrf" = [ "vrf" ];
+    "vti" = [ "ip_vti" ];
+    "vti6" = [ "ip6_vti" ];
+    "bond" = [ "bonding" ];
+    "bridge" = [ "bridge" ];
+    # "physical" = ...;
+    "dsa" = [ "dsa_core" ];
+    "dummy" = [ "dummy" ];
+    "veth" = [ "veth" ];
+    "vxcan" = [ "vxcan" ];
+    "vlan" = [ "8021q" ];
+    "vxlan" = [ "vxlan" ];
+    "ipip" = [ "ipip" ];
+    "sit" = [ "sit" ];
+    "gre" = [ "ip_gre" ];
+    "gretap" = [ "ip_gre" ];
+    "ip6gre" = [ "ip6_gre" ];
+    "ip6gretap" = [ "ip6_gre" ];
+    "geneve" = [ "geneve" ];
+    "wireguard" = [ "wireguard" ];
+    "xfrm" = [ "xfrm_interface" ];
+  };
+in
+{
+  meta.maintainers = with lib.maintainers; [ marcel ];
+
+  options = {
+    networking.ifstate = {
+      enable = lib.mkEnableOption "networking using IfState";
+
+      package = lib.mkPackageOption pkgs "ifstate" { };
+
+      settings = lib.mkOption {
+        inherit (settingsFormat) type;
+        default = { };
+        description = "Content of IfState's configuration file. See <https://ifstate.net/2.0/schema/> for details.";
+      };
+    };
+
+    boot.initrd.network.ifstate = {
+      enable = lib.mkEnableOption "initrd networking using IfState";
+
+      allowIfstateToDrasticlyIncreaseInitrdSize = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "IfState in initrd drastically increases the size of initrd, your boot partition may be too small and/or you may have significantly fewer generations. By setting this option, you acknowledge this fact and keep it in mind when reporting issues.";
+      };
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = cfg.package.override {
+          withConfigValidation = false;
+          withWireguard = false;
+        };
+        defaultText = lib.literalExpression "pkgs.ifstate.override { withConfigValidation = false; withWireguard = false; }";
+        description = "The initrd IfState package to use.";
+      };
+
+      settings = lib.mkOption {
+        inherit (settingsFormat) type;
+        default = { };
+        description = "Content of IfState's initrd configuration file. See <https://ifstate.net/2.0/schema/> for details.";
+      };
+
+      cleanupSettings = lib.mkOption {
+        inherit (settingsFormat) type;
+        default = {
+          # required by json schema
+          interfaces = { };
+          # https://codeberg.org/liske/ifstate/issues/118
+          namespaces = { };
+        };
+        description = "Content of IfState's initrd cleanup configuration file. See <https://ifstate.net/2.0/schema/> for details. This configuration gets applied before systemd switches to stage two. The goas is to deconfigurate the whole network in order to prevent access to services, before the firewall is configured. The stage two IfState configuration will start after the firewall is configured.";
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = !config.networking.networkmanager.enable;
+          message = "IfState and NetworkManager cannot be used at the same time, as both configure the network in a conflicting manner.";
+        }
+        {
+          assertion = !config.networking.useDHCP;
+          message = "IfState and networking.useDHCP cannot be used at the same time, as both configure the network. Please look into IfState hooks to integrate DHCP: https://codeberg.org/liske/ifstate/issues/111";
+        }
+      ];
+
+      networking.useDHCP = lib.mkDefault false;
+
+      # sane defaults to not let IfState work against the kernel
+      boot.extraModprobeConfig = ''
+        options bonding max_bonds=0
+        options dummy numdummies=0
+        options ifb numifbs=0
+      '';
+
+      environment = {
+        # ifstatecli command should be available to use user, there are other useful subcommands like check or show
+        systemPackages = [ cfg.package ];
+        # match the default value of the --config flag of IfState
+        etc."ifstate/ifstate.yaml".source = settingsFormat.generate "ifstate.yaml" cfg.settings cfg.package;
+      };
+
+      systemd.services.ifstate = {
+        description = "IfState";
+
+        wantedBy = [
+          "multi-user.target"
+        ];
+        after = [
+          "systemd-udevd.service"
+          "network-pre.target"
+          "systemd-sysusers.service"
+          "systemd-sysctl.service"
+        ];
+        before = [
+          "network.target"
+          "multi-user.target"
+          "shutdown.target"
+          "initrd-switch-root.target"
+        ];
+        conflicts = [
+          "shutdown.target"
+          "initrd-switch-root.target"
+        ];
+        wants = [
+          "network.target"
+        ];
+
+        # mount is always available on nixos, avoid adding additional store paths to the closure
+        path = [ "/run/wrappers" ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe cfg.package} --config ${
+            config.environment.etc."ifstate/ifstate.yaml".source
+          } apply";
+          # because oneshot services do not have a timeout by default
+          TimeoutStartSec = "2min";
+        };
+      };
+    })
+    (lib.mkIf initrdCfg.enable {
+      assertions = [
+        {
+          assertion =
+            initrdCfg.package.passthru.features.withWireguard
+            || !(builtins.any (kind: kind == "wireguard") initrdInterfaceTypes);
+          message = "IfState initrd package is configured without the `wireguard` feature, but wireguard interfaces are configured. Please see the `boot.initrd.network.ifstate.package` option.";
+        }
+        {
+          assertion = initrdCfg.allowIfstateToDrasticlyIncreaseInitrdSize;
+          message = "IfState in initrd drastically increases the size of initrd, your boot partition may be too small and/or you may have significantly fewer generations. By setting boot.initrd.network.initrd.allowIfstateToDrasticlyIncreaseInitrdSize to true, you acknowledge this fact and keep it in mind when reporting issues.";
+        }
+        {
+          assertion = cfg.enable;
+          message = "If IfState is used in initrd, it should also be used for the stage 2 system (networking.ifstate), as initrd IfState does not clean up the network stack like it was before after execution.";
+        }
+        {
+          assertion = config.boot.initrd.systemd.enable;
+          message = "IfState only supports systemd stage one. See `boot.initrd.systemd.enable` option.";
+        }
+      ];
+
+      environment.etc = {
+        "ifstate/ifstate.initrd.yaml".source =
+          settingsFormat.generate "ifstate.initrd.yaml" initrdCfg.settings
+            initrdCfg.package;
+        "ifstate/ifstate.initrd-cleanup.yaml".source =
+          settingsFormat.generate "ifstate.initrd-cleanup.yaml" initrdCfg.cleanupSettings
+            initrdCfg.package;
+      };
+
+      boot.initrd = {
+        network.udhcpc.enable = lib.mkDefault false;
+
+        # automatic configuration of kernel modules of virtual interface types
+        availableKernelModules =
+          let
+            enableModule =
+              type:
+              if builtins.hasAttr type interfaceKernelModules then interfaceKernelModules."${type}" else [ ];
+          in
+          lib.flatten (builtins.map enableModule initrdInterfaceTypes);
+
+        systemd = {
+          storePaths = [
+            (pkgs.runCommand "ifstate-closure"
+              {
+                info = pkgs.closureInfo {
+                  rootPaths = [
+                    initrdCfg.package
+                    # copy whole config closure, because it can reference other files using !include
+                    config.environment.etc."ifstate/ifstate.initrd.yaml".source
+                    config.environment.etc."ifstate/ifstate.initrd-cleanup.yaml".source
+                  ];
+                };
+              }
+              ''
+                mkdir $out
+                cat "$info"/store-paths | while read path; do
+                  ln -s "$path" "$out/$(basename "$path")"
+                done
+              ''
+            )
+          ];
+
+          services.ifstate-initrd = {
+            description = "IfState initrd";
+
+            wantedBy = [
+              "initrd.target"
+            ];
+            after = [
+              "systemd-udevd.service"
+              "network-pre.target"
+              "systemd-sysusers.service"
+              "systemd-sysctl.service"
+            ];
+            before = [
+              "network.target"
+              "multi-user.target"
+              "shutdown.target"
+              "initrd-switch-root.target"
+            ];
+            conflicts = [
+              "shutdown.target"
+              "initrd-switch-root.target"
+            ];
+            wants = [
+              "network.target"
+            ];
+
+            # mount is always available on nixos, avoid adding additional store paths to the closure
+            # https://github.com/NixOS/nixpkgs/blob/2b8e2457ebe576ebf41ddfa8452b5b07a8d493ad/nixos/modules/system/boot/systemd/initrd.nix#L550-L551
+            path = [
+              config.boot.initrd.systemd.package.util-linux
+            ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              # Otherwise systemd starts ifstate again, after the encryption password was entered by the user
+              # and we are able to implement the cleanup using ExecStop rather than a separate unit.
+              RemainAfterExit = true;
+              # When using network namespaces pyroute2 expects this directory to exists.
+              # @liske is currently investigating whether this should be considered a bug in pyroute2.
+              ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} /var/run";
+              ExecStart = "${lib.getExe initrdCfg.package} --config ${
+                config.environment.etc."ifstate/ifstate.initrd.yaml".source
+              } apply";
+              ExecStop = "${lib.getExe initrdCfg.package} --config ${
+                config.environment.etc."ifstate/ifstate.initrd-cleanup.yaml".source
+              } apply";
+              # because oneshot services do not have a timeout by default
+              TimeoutStartSec = "2min";
+            };
+          };
+        };
+      };
+    })
+  ];
+}
diff --git a/nixos/modules/services/web-apps/glitchtip.nix b/nixos/modules/services/web-apps/glitchtip.nix
index 0ade0025062e..6a74cda886a1 100644
--- a/nixos/modules/services/web-apps/glitchtip.nix
+++ b/nixos/modules/services/web-apps/glitchtip.nix
@@ -58,6 +58,12 @@ in
         default = 8000;
       };
 
+      stateDir = lib.mkOption {
+        type = lib.types.path;
+        description = "State directory of glitchtip.";
+        default = "/var/lib/glitchtip";
+      };
+
       settings = lib.mkOption {
         description = ''
           Configuration of GlitchTip. See <https://glitchtip.com/documentation/install#configuration> for more information.
@@ -189,6 +195,7 @@ in
           StateDirectory = "glitchtip";
           EnvironmentFile = cfg.environmentFiles;
           WorkingDirectory = "${pkg}/lib/glitchtip";
+          BindPaths = [ "${cfg.stateDir}/uploads:${pkg}/lib/glitchtip/uploads" ];
 
           # hardening
           AmbientCapabilities = "";
@@ -220,6 +227,7 @@ in
             "@system-service"
             "~@privileged"
             "~@resources"
+            "@chown"
           ];
           UMask = "0077";
         };
@@ -271,7 +279,6 @@ in
 
     users.users = lib.mkIf (cfg.user == "glitchtip") {
       glitchtip = {
-        home = "/var/lib/glitchtip";
         group = cfg.group;
         extraGroups = lib.optionals cfg.redis.createLocally [ "redis-glitchtip" ];
         isSystemUser = true;
@@ -280,6 +287,8 @@ in
 
     users.groups = lib.mkIf (cfg.group == "glitchtip") { glitchtip = { }; };
 
+    systemd.tmpfiles.settings.glitchtip."${cfg.stateDir}/uploads".d = { inherit (cfg) user group; };
+
     environment.systemPackages =
       let
         glitchtip-manage = pkgs.writeShellScriptBin "glitchtip-manage" ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 3c6f89dcb2ae..526f5a7edce8 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -210,6 +210,7 @@ in
   amd-sev = runTest ./amd-sev.nix;
   android-translation-layer = runTest ./android-translation-layer.nix;
   angie-api = runTest ./angie-api.nix;
+  angrr = runTest ./angrr.nix;
   anki-sync-server = runTest ./anki-sync-server.nix;
   anubis = runTest ./anubis.nix;
   anuko-time-tracker = runTest ./anuko-time-tracker.nix;
@@ -735,6 +736,7 @@ in
   i3wm = runTest ./i3wm.nix;
   icingaweb2 = runTest ./icingaweb2.nix;
   ifm = runTest ./ifm.nix;
+  ifstate = import ./ifstate { inherit runTest; };
   iftop = runTest ./iftop.nix;
   immich = runTest ./web-apps/immich.nix;
   immich-vectorchord-migration = runTest ./web-apps/immich-vectorchord-migration.nix;
@@ -1035,7 +1037,10 @@ in
   nix-config = runTest ./nix-config.nix;
   nix-ld = runTest ./nix-ld.nix;
   nix-misc = handleTest ./nix/misc.nix { };
-  nix-upgrade = handleTest ./nix/upgrade.nix { inherit (pkgs) nixVersions; };
+  nix-upgrade = handleTest ./nix/upgrade.nix {
+    inherit (pkgs) nixVersions;
+    inherit system;
+  };
   nix-required-mounts = runTest ./nix-required-mounts;
   nix-serve = runTest ./nix-serve.nix;
   nix-serve-ssh = runTest ./nix-serve-ssh.nix;
diff --git a/nixos/tests/angrr.nix b/nixos/tests/angrr.nix
new file mode 100644
index 000000000000..7e57e071390a
--- /dev/null
+++ b/nixos/tests/angrr.nix
@@ -0,0 +1,63 @@
+{ ... }:
+{
+  name = "angrr";
+  nodes = {
+    machine = {
+      services.angrr = {
+        enable = true;
+        period = "7d";
+      };
+      # `angrr.service` integrates to `nix-gc.service` by default
+      nix.gc.automatic = true;
+
+      # Create a normal nix user for test
+      users.users.normal.isNormalUser = true;
+      # For `nix build /run/current-system --out-link`,
+      # `nix-build` does not support this use case.
+      nix.settings.experimental-features = [ "nix-command" ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("default.target")
+
+    machine.systemctl("stop nix-gc.timer")
+
+    # Creates some auto gc roots
+    # Use /run/current-system so that we do not need to build anything new
+    machine.succeed("nix build /run/current-system --out-link /tmp/root-auto-gc-root-1")
+    machine.succeed("nix build /run/current-system --out-link /tmp/root-auto-gc-root-2")
+    machine.succeed("su normal --command 'nix build /run/current-system --out-link /tmp/user-auto-gc-root-1'")
+    machine.succeed("su normal --command 'nix build /run/current-system --out-link /tmp/user-auto-gc-root-2'")
+
+    machine.systemctl("start nix-gc.service")
+    # Not auto gc root will be removed
+    machine.succeed("readlink /tmp/root-auto-gc-root-1")
+    machine.succeed("readlink /tmp/root-auto-gc-root-2")
+    machine.succeed("readlink /tmp/user-auto-gc-root-1")
+    machine.succeed("readlink /tmp/user-auto-gc-root-2")
+
+    # Change time to 8 days after (greater than 7d)
+    machine.succeed("date -s '8 days'")
+
+    # Touch GC roots `-2`
+    machine.succeed("touch /tmp/root-auto-gc-root-2 --no-dereference")
+    machine.succeed("touch /tmp/user-auto-gc-root-2 --no-dereference")
+
+    machine.systemctl("start nix-gc.service")
+    # Only GC roots `-1` are removed
+    machine.succeed("test ! -f /tmp/root-auto-gc-root-1")
+    machine.succeed("readlink  /tmp/root-auto-gc-root-2")
+    machine.succeed("test ! -f /tmp/user-auto-gc-root-1")
+    machine.succeed("readlink  /tmp/user-auto-gc-root-2")
+
+    # Change time again
+    machine.succeed("date -s '8 days'")
+    machine.systemctl("start nix-gc.service")
+    # All auto GC roots are removed
+    machine.succeed("test ! -f /tmp/root-auto-gc-root-2")
+    machine.succeed("test ! -f /tmp/user-auto-gc-root-2")
+  '';
+}
diff --git a/nixos/tests/glitchtip.nix b/nixos/tests/glitchtip.nix
index 408ac5fc81a3..21b3a0197c48 100644
--- a/nixos/tests/glitchtip.nix
+++ b/nixos/tests/glitchtip.nix
@@ -42,62 +42,73 @@ in
     ];
   };
 
-  testScript = ''
-    import json
-    import re
-    import time
+  testScript =
+    { nodes, ... }: # python
+    ''
+      import json
+      import re
+      import time
 
-    machine.wait_for_unit("glitchtip.service")
-    machine.wait_for_unit("glitchtip-worker.service")
-    machine.wait_for_open_port(8000)
+      machine.wait_for_unit("glitchtip.service")
+      machine.wait_for_unit("glitchtip-worker.service")
+      machine.wait_for_open_port(8000)
 
-    origin_url = "${domain}"
-    cookie_jar_path = "/tmp/cookies.txt"
-    curl = f"curl -b {cookie_jar_path} -c {cookie_jar_path} -fS -H 'Origin: {origin_url}'"
+      origin_url = "${domain}"
+      cookie_jar_path = "/tmp/cookies.txt"
+      curl = f"curl -b {cookie_jar_path} -c {cookie_jar_path} -fS -H 'Origin: {origin_url}'"
 
-    # create superuser account
-    machine.succeed("DJANGO_SUPERUSER_PASSWORD=password glitchtip-manage createsuperuser --no-input --email=admin@example.com")
+      # create superuser account
+      machine.succeed("DJANGO_SUPERUSER_PASSWORD=password glitchtip-manage createsuperuser --no-input --email=admin@example.com")
 
-    # login
-    machine.fail(f"{curl} -s {origin_url}/_allauth/browser/v1/auth/session")  # get the csrf token, returns a 401
-    csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
-    machine.succeed(f"{curl} {origin_url}/_allauth/browser/v1/auth/login -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"email\": \"admin@example.com\", \"password\": \"password\"}}'")
+      # login
+      machine.fail(f"{curl} -s {origin_url}/_allauth/browser/v1/auth/session")  # get the csrf token, returns a 401
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      machine.succeed(f"{curl} {origin_url}/_allauth/browser/v1/auth/login -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"email\": \"admin@example.com\", \"password\": \"password\"}}'")
 
-    resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/users/me/"))
-    assert resp["email"] == "admin@example.com"
-    assert resp["isSuperuser"] is True
+      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/users/me/"))
+      assert resp["email"] == "admin@example.com"
+      assert resp["isSuperuser"] is True
 
-    # create organization
-    csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
-    machine.succeed(f"{curl} {origin_url}/api/0/organizations/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"name\": \"main\"}}'")
+      # create organization
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      machine.succeed(f"{curl} {origin_url}/api/0/organizations/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"name\": \"main\"}}'")
 
-    resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/organizations/"))
-    assert len(resp) == 1
-    assert resp[0]["name"] == "main"
-    assert resp[0]["slug"] == "main"
+      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/organizations/"))
+      assert len(resp) == 1
+      assert resp[0]["name"] == "main"
+      assert resp[0]["slug"] == "main"
 
-    # create team
-    csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
-    machine.succeed(f"{curl} {origin_url}/api/0/organizations/main/teams/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"slug\": \"test\"}}'")
+      # create team
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      machine.succeed(f"{curl} {origin_url}/api/0/organizations/main/teams/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"slug\": \"test\"}}'")
 
-    # create project
-    csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
-    machine.succeed(f"{curl} {origin_url}/api/0/teams/main/test/projects/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"name\": \"test\"}}'")
+      # create project
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      machine.succeed(f"{curl} {origin_url}/api/0/teams/main/test/projects/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"name\": \"test\"}}'")
 
-    # fetch dsn
-    resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/projects/main/test/keys/"))
-    assert len(resp) == 1
-    assert re.match(r"^http://[\da-f]+@glitchtip\.local:8000/\d+$", dsn := resp[0]["dsn"]["public"])
+      # fetch dsn
+      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/projects/main/test/keys/"))
+      assert len(resp) == 1
+      assert re.match(r"^http://[\da-f]+@glitchtip\.local:8000/\d+$", dsn := resp[0]["dsn"]["public"])
 
-    # send event
-    machine.succeed(f"SENTRY_DSN={dsn} sentry-cli send-event -m 'hello world'")
+      # send event
+      machine.succeed(f"SENTRY_DSN={dsn} sentry-cli send-event -m 'hello world'")
 
-    for _ in range(20):
-      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/organizations/main/issues/?query=is:unresolved"))
-      if len(resp) != 0: break
-      time.sleep(1)
-    assert len(resp) == 1
-    assert resp[0]["title"] == "hello world"
-    assert int(resp[0]["count"]) == 1
-  '';
+      for _ in range(20):
+        resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/organizations/main/issues/?query=is:unresolved"))
+        if len(resp) != 0: break
+        time.sleep(1)
+      assert len(resp) == 1
+      assert resp[0]["title"] == "hello world"
+      assert int(resp[0]["count"]) == 1
+
+      # create api token
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/api-tokens/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"label\":\"token\",\"scopes\":[\"project:write\"]}}'"))
+      token = resp["token"]
+
+      # upload sourcemaps
+      machine.succeed(f"sentry-cli --url {origin_url} --auth-token {token} sourcemaps upload --org main --project test ${nodes.machine.services.glitchtip.package.frontend}/*.map")
+      assert machine.succeed("ls /var/lib/glitchtip/uploads/file_blobs/").strip()
+    '';
 }
diff --git a/nixos/tests/ifstate/default.nix b/nixos/tests/ifstate/default.nix
new file mode 100644
index 000000000000..db6985f15064
--- /dev/null
+++ b/nixos/tests/ifstate/default.nix
@@ -0,0 +1,10 @@
+{ runTest }:
+
+{
+  initrd = runTest ./initrd.nix;
+  initrd-partial-broken-config = runTest ./initrd-partial-broken-config.nix;
+  initrd-wireguard = runTest ./initrd-wireguard.nix;
+  partial-broken-config = runTest ./partial-broken-config.nix;
+  ping = runTest ./ping.nix;
+  wireguard = runTest ./wireguard.nix;
+}
diff --git a/nixos/tests/ifstate/initrd-partial-broken-config.nix b/nixos/tests/ifstate/initrd-partial-broken-config.nix
new file mode 100644
index 000000000000..2acd9226dde9
--- /dev/null
+++ b/nixos/tests/ifstate/initrd-partial-broken-config.nix
@@ -0,0 +1,79 @@
+let
+  mkIfStateConfig = id: {
+    enable = true;
+    settings.interfaces.eth1 = {
+      addresses = [ "2001:0db8::${builtins.toString id}/64" ];
+      link = {
+        state = "up";
+        kind = "physical";
+      };
+    };
+  };
+in
+{
+  name = "ifstate-initrd-partial-broken-config";
+
+  nodes = {
+    server =
+      { lib, ... }:
+      {
+        imports = [ ../../modules/profiles/minimal.nix ];
+
+        virtualisation.interfaces.eth1.vlan = 1;
+
+        # Initrd IfState enforces stage 2 ifstate using assertion.
+        networking.ifstate = {
+          enable = true;
+          settings.interfaces = { };
+        };
+
+        boot.initrd = {
+          network = {
+            enable = true;
+            ifstate = lib.mkMerge [
+              (mkIfStateConfig 1)
+              {
+                allowIfstateToDrasticlyIncreaseInitrdSize = true;
+
+                # non-existent interface; ifstate should apply eth1 and do not distrupt the boot process
+                settings.interfaces.eth2 = {
+                  addresses = [ "2001:0db8:b::dead:beef/64" ];
+                  link = {
+                    state = "up";
+                    kind = "physical";
+                  };
+                };
+              }
+            ];
+          };
+          systemd = {
+            enable = true;
+            network.enable = false;
+            services.boot-blocker = {
+              before = [ "initrd.target" ];
+              wantedBy = [ "initrd.target" ];
+              script = "sleep infinity";
+              serviceConfig.Type = "oneshot";
+            };
+          };
+        };
+      };
+
+    client = {
+      imports = [ ../../modules/profiles/minimal.nix ];
+
+      virtualisation.interfaces.eth1.vlan = 1;
+
+      networking.ifstate = mkIfStateConfig 2;
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+      client.wait_for_unit("network.target")
+
+      # try to ping the server from the client
+      client.wait_until_succeeds("ping -c 1 2001:0db8::1")
+    '';
+}
diff --git a/nixos/tests/ifstate/initrd-wireguard.nix b/nixos/tests/ifstate/initrd-wireguard.nix
new file mode 100644
index 000000000000..7fe99a5a2646
--- /dev/null
+++ b/nixos/tests/ifstate/initrd-wireguard.nix
@@ -0,0 +1,121 @@
+let
+  mkNodeIfStateConfig =
+    {
+      pkgs,
+      id,
+      wgPriv,
+      wgPeerPubKey,
+      wgPeerId,
+    }:
+    {
+      enable = true;
+      settings = {
+        namespaces.outside.interfaces.eth1 = {
+          addresses = [ "2001:0db8:a::${builtins.toString id}/64" ];
+          link = {
+            state = "up";
+            kind = "physical";
+          };
+        };
+        interfaces = {
+          wg0 = {
+            addresses = [ "2001:0db8:b::${builtins.toString id}/64" ];
+            link = {
+              state = "up";
+              kind = "wireguard";
+              bind_netns = "outside";
+            };
+            wireguard = {
+              private_key = "!include ${pkgs.writeText "wg_priv.key" wgPriv}";
+              listen_port = 51820;
+              peers."${wgPeerPubKey}" = {
+                endpoint = "[2001:0db8:a::${builtins.toString wgPeerId}]:51820";
+                allowedips = [ "::/0" ];
+              };
+            };
+          };
+        };
+        routing.routes = [
+          {
+            to = "2001:0db8:b::/64";
+            dev = "wg0";
+          }
+        ];
+      };
+    };
+in
+{
+  name = "ifstate-initrd-wireguard";
+
+  nodes = {
+    foo =
+      { pkgs, ... }:
+      {
+        imports = [ ../../modules/profiles/minimal.nix ];
+
+        virtualisation.interfaces.eth1.vlan = 1;
+
+        # Initrd IfState enforces stage 2 ifstate using assertion.
+        networking.ifstate = {
+          enable = true;
+          settings.interfaces = { };
+        };
+
+        boot.initrd = {
+          network = {
+            enable = true;
+            ifstate =
+              mkNodeIfStateConfig {
+                inherit pkgs;
+                id = 1;
+                wgPriv = "6KmLyTyrN9OZIOCkdpiAwoVoeSiwvyI+mtn1wooKSEU=";
+                wgPeerPubKey = "olFuE7u5pVwSeWLFtrXSvD8+aCDBiKNKCLjLb/dgXiA=";
+                wgPeerId = 2;
+              }
+              // {
+                package = pkgs.ifstate.override {
+                  withConfigValidation = false;
+                };
+                allowIfstateToDrasticlyIncreaseInitrdSize = true;
+              };
+          };
+          systemd = {
+            enable = true;
+            network.enable = false;
+            services.boot-blocker = {
+              before = [ "initrd.target" ];
+              wantedBy = [ "initrd.target" ];
+              script = "sleep infinity";
+              serviceConfig.Type = "oneshot";
+            };
+          };
+        };
+      };
+
+    bar =
+      { pkgs, ... }:
+      {
+        imports = [ ../../modules/profiles/minimal.nix ];
+
+        virtualisation.interfaces.eth1.vlan = 1;
+
+        networking = {
+          ifstate = mkNodeIfStateConfig {
+            inherit pkgs;
+            id = 2;
+            wgPriv = "QN89cvFD0C8z1MSpUaJa1YBXt2MaIQegVkEYROi71Fg=";
+            wgPeerPubKey = "5qeKbAGc7wh9Xg0MoMXqXCSmp9TawmtI1bVk/vp3Cn4=";
+            wgPeerId = 1;
+          };
+        };
+      };
+  };
+  testScript = # python
+    ''
+      start_all()
+
+      bar.wait_for_unit("default.target")
+
+      bar.wait_until_succeeds("ping -c 1 2001:0db8:b::1")
+    '';
+}
diff --git a/nixos/tests/ifstate/initrd.nix b/nixos/tests/ifstate/initrd.nix
new file mode 100644
index 000000000000..01ed9a513ccd
--- /dev/null
+++ b/nixos/tests/ifstate/initrd.nix
@@ -0,0 +1,65 @@
+let
+  mkIfStateConfig = id: {
+    enable = true;
+    settings.interfaces.eth1 = {
+      addresses = [ "2001:0db8::${builtins.toString id}/64" ];
+      link = {
+        state = "up";
+        kind = "physical";
+      };
+    };
+  };
+in
+{
+  name = "ifstate-initrd";
+
+  nodes = {
+    server = {
+      imports = [ ../../modules/profiles/minimal.nix ];
+
+      virtualisation.interfaces.eth1.vlan = 1;
+
+      # Initrd IfState enforces stage 2 ifstate using assertion.
+      networking.ifstate = {
+        enable = true;
+        settings.interfaces = { };
+      };
+
+      boot.initrd = {
+        network = {
+          enable = true;
+          ifstate = mkIfStateConfig 1 // {
+            allowIfstateToDrasticlyIncreaseInitrdSize = true;
+          };
+        };
+        systemd = {
+          enable = true;
+          network.enable = false;
+          services.boot-blocker = {
+            before = [ "initrd.target" ];
+            wantedBy = [ "initrd.target" ];
+            script = "sleep infinity";
+            serviceConfig.Type = "oneshot";
+          };
+        };
+      };
+    };
+
+    client = {
+      imports = [ ../../modules/profiles/minimal.nix ];
+
+      virtualisation.interfaces.eth1.vlan = 1;
+
+      networking.ifstate = mkIfStateConfig 2;
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+      client.wait_for_unit("network.target")
+
+      # try to ping the server from the client
+      client.wait_until_succeeds("ping -c 1 2001:0db8::1")
+    '';
+}
diff --git a/nixos/tests/ifstate/partial-broken-config.nix b/nixos/tests/ifstate/partial-broken-config.nix
new file mode 100644
index 000000000000..fe9c8edbe270
--- /dev/null
+++ b/nixos/tests/ifstate/partial-broken-config.nix
@@ -0,0 +1,39 @@
+{
+  name = "ifstate-partial-broken-config";
+
+  nodes.machine = {
+    imports = [ ../../modules/profiles/minimal.nix ];
+
+    virtualisation.interfaces.eth1.vlan = 1;
+
+    networking.ifstate = {
+      enable = true;
+      settings.interfaces = {
+        eth1 = {
+          addresses = [ "2001:0db8:a::1/64" ];
+          link = {
+            state = "up";
+            kind = "physical";
+          };
+        };
+        # non-existent interface; ifstate should apply eth1 and do not distrupt the boot process
+        eth2 = {
+          addresses = [ "2001:0db8:b::1/64" ];
+          link = {
+            state = "up";
+            kind = "physical";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+
+      machine.wait_for_unit("default.target")
+
+      machine.wait_until_succeeds("ping -c 1 2001:0db8:a::1")
+    '';
+}
diff --git a/nixos/tests/ifstate/ping.nix b/nixos/tests/ifstate/ping.nix
new file mode 100644
index 000000000000..92dab9becf9c
--- /dev/null
+++ b/nixos/tests/ifstate/ping.nix
@@ -0,0 +1,38 @@
+let
+  mkNode = id: {
+    imports = [ ../../modules/profiles/minimal.nix ];
+
+    virtualisation.interfaces.eth1.vlan = 1;
+
+    networking.ifstate = {
+      enable = true;
+      settings.interfaces.eth1 = {
+        addresses = [ "2001:0db8::${builtins.toString id}/64" ];
+        link = {
+          state = "up";
+          kind = "physical";
+        };
+      };
+    };
+  };
+in
+
+{
+  name = "ifstate-ping";
+
+  nodes = {
+    foo = mkNode 1;
+    bar = mkNode 2;
+  };
+
+  testScript = # python
+    ''
+      start_all()
+
+      foo.wait_for_unit("default.target")
+      bar.wait_for_unit("default.target")
+
+      foo.wait_until_succeeds("ping -c 1 2001:0db8::2")
+      bar.wait_until_succeeds("ping -c 1 2001:0db8::1")
+    '';
+}
diff --git a/nixos/tests/ifstate/wireguard.nix b/nixos/tests/ifstate/wireguard.nix
new file mode 100644
index 000000000000..3c822c346330
--- /dev/null
+++ b/nixos/tests/ifstate/wireguard.nix
@@ -0,0 +1,88 @@
+let
+  mkNode =
+    {
+      id,
+      wgPriv,
+      wgPeerPubKey,
+      wgPeerId,
+    }:
+    (
+      { pkgs, ... }:
+      {
+        imports = [ ../../modules/profiles/minimal.nix ];
+
+        virtualisation.interfaces.eth1.vlan = 1;
+
+        networking = {
+          firewall.interfaces.eth1.allowedUDPPorts = [ 51820 ];
+
+          ifstate = {
+            enable = true;
+            settings = {
+              namespaces.outside.interfaces.eth1 = {
+                addresses = [ "2001:0db8:a::${builtins.toString id}/64" ];
+                link = {
+                  state = "up";
+                  kind = "physical";
+                };
+              };
+              interfaces = {
+                wg0 = {
+                  addresses = [ "2001:0db8:b::${builtins.toString id}/64" ];
+                  link = {
+                    state = "up";
+                    kind = "wireguard";
+                    bind_netns = "outside";
+                  };
+                  wireguard = {
+                    private_key = "!include ${pkgs.writeText "wg_priv.key" wgPriv}";
+                    listen_port = 51820;
+                    peers."${wgPeerPubKey}" = {
+                      endpoint = "[2001:0db8:a::${builtins.toString wgPeerId}]:51820";
+                      allowedips = [ "::/0" ];
+                    };
+                  };
+                };
+              };
+              routing.routes = [
+                {
+                  to = "2001:0db8:b::/64";
+                  dev = "wg0";
+                }
+              ];
+            };
+          };
+        };
+      }
+    );
+in
+
+{
+  name = "ifstate-wireguard";
+
+  nodes = {
+    foo = mkNode {
+      id = 1;
+      wgPriv = "6KmLyTyrN9OZIOCkdpiAwoVoeSiwvyI+mtn1wooKSEU=";
+      wgPeerPubKey = "olFuE7u5pVwSeWLFtrXSvD8+aCDBiKNKCLjLb/dgXiA=";
+      wgPeerId = 2;
+    };
+    bar = mkNode {
+      id = 2;
+      wgPriv = "QN89cvFD0C8z1MSpUaJa1YBXt2MaIQegVkEYROi71Fg=";
+      wgPeerPubKey = "5qeKbAGc7wh9Xg0MoMXqXCSmp9TawmtI1bVk/vp3Cn4=";
+      wgPeerId = 1;
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+
+      foo.wait_for_unit("default.target")
+      bar.wait_for_unit("default.target")
+
+      foo.wait_until_succeeds("ping -c 1 2001:0db8:b::2")
+      bar.wait_until_succeeds("ping -c 1 2001:0db8:b::1")
+    '';
+}
diff --git a/nixos/tests/nix/upgrade.nix b/nixos/tests/nix/upgrade.nix
index e4cd0cb09b8f..a014313aa53a 100644
--- a/nixos/tests/nix/upgrade.nix
+++ b/nixos/tests/nix/upgrade.nix
@@ -1,10 +1,15 @@
-{ pkgs, nixVersions, ... }:
+{
+  pkgs,
+  nixVersions,
+  system,
+  ...
+}:
 let
   lib = pkgs.lib;
 
   fallback-paths-external = pkgs.writeTextDir "fallback-paths.nix" ''
     {
-      ${pkgs.system} = "${nixVersions.latest}";
+      ${system} = "${nixVersions.latest}";
     }'';
 
   nixos-module = builtins.toFile "nixos-module.nix" ''
@@ -71,7 +76,7 @@ pkgs.testers.nixosTest {
         if not match: raise Exception("Couldn't find new version in output: " + result)
 
     with subtest("nix-build-with-mismatch-daemon"):
-        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test\"; system = \"${pkgs.system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
+        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test\"; system = \"${system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
 
 
     with subtest("remove-new-nix"):
@@ -94,7 +99,7 @@ pkgs.testers.nixosTest {
         if not match: raise Exception("Couldn't find new version in output: " + result)
 
     with subtest("nix-build-with-new-daemon"):
-        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test-new\"; system = \"${pkgs.system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
+        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test-new\"; system = \"${system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
 
     with subtest("nix-collect-garbage-with-old-nix"):
         machine.succeed("${nixVersions.stable}/bin/nix-collect-garbage")
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index a6b3d06c1468..574ea3a44cc9 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -638,6 +638,9 @@ assertNoAdditions {
       # Requires setup call
       "codecompanion.actions.static"
       "codecompanion.actions.init"
+      # Address in use error from fzf-lua on darwin
+      # https://github.com/NixOS/nixpkgs/issues/431458
+      "codecompanion.providers.actions.fzf_lua"
       # Test
       "minimal"
     ];
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3a5014d9a677..edd4a0c0a733 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -318,8 +318,8 @@ let
         mktplcRef = {
           name = "vscode-apollo";
           publisher = "apollographql";
-          version = "2.6.2";
-          hash = "sha256-jS+YPE+D0Q3bw8BCMFseL4xdiW5f6LV7JosgMG3Huo8=";
+          version = "2.6.3";
+          hash = "sha256-1F0iy5GhpuCqTrP/atoOyD0SWNOwa1sKXH14kN4FXNE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/apollographql.vscode-apollo/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/ndonfris.fish-lsp/default.nix b/pkgs/applications/editors/vscode/extensions/ndonfris.fish-lsp/default.nix
index 17ca7123df15..03578ad17b86 100644
--- a/pkgs/applications/editors/vscode/extensions/ndonfris.fish-lsp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ndonfris.fish-lsp/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ndonfris";
     name = "fish-lsp";
-    version = "0.1.11";
-    hash = "sha256-I3ikOGK++GL51BGZBPWAIGvWBOAw5himdQvANlPog0s=";
+    version = "0.1.13";
+    hash = "sha256-jPBcSQHuSvvWfc4KdtTkUJkx/fGYiAANFjABe4DzopQ=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 90004f491e17..2533b149deec 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -153,11 +153,11 @@
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-gwodjIFYg6BTIz3ORzWD6tUn2QXwXMN1KC5mMvxyjdE=",
+    "hash": "sha256-rCWT9QmQnobfyqHtb1r/2XIgZEd4eA71eg6ffFQQZOU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v4.40.0",
+    "rev": "v4.42.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 68dd83330c9f..d94406646268 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "virt-manager";
-  version = "5.0.0";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KtB2VspkA/vFu7I8y6M8WfAoZglxmCeb4Z3OzdsGuvk=";
+    hash = "sha256-nMWLDo2pfWcqsVuEk0JbzLZ1a0lViTohsZ8gEXGhBuI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ac/act/package.nix b/pkgs/by-name/ac/act/package.nix
index 040c4def2caa..2919515f7859 100644
--- a/pkgs/by-name/ac/act/package.nix
+++ b/pkgs/by-name/ac/act/package.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "0.2.80";
+  version = "0.2.81";
 in
 buildGoModule {
   pname = "act";
@@ -18,7 +18,7 @@ buildGoModule {
     owner = "nektos";
     repo = "act";
     tag = "v${version}";
-    hash = "sha256-DGhZb83q1uC+5xvRTzWUXXKZjnaCP9y/CEu2EaL47I0=";
+    hash = "sha256-5HTdvJiX8F6SA2mzlcmzBlx8oiJ72j9Nfg64b6Ob8NQ=";
   };
 
   vendorHash = "sha256-v17TglIf+N3GfzHhutNX+nZeqVFheh/cXcCN1VgffT0=";
diff --git a/pkgs/by-name/an/angrr/package.nix b/pkgs/by-name/an/angrr/package.nix
new file mode 100644
index 000000000000..6a2f32ca4df3
--- /dev/null
+++ b/pkgs/by-name/an/angrr/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  nixosTests,
+  testers,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "angrr";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "linyinfeng";
+    repo = "angrr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SL4UBDoD0pvpCKokQvKLAcS9cQJaFiA+IjswFARswdM=";
+  };
+
+  cargoHash = "sha256-lo9JpsHkvyrEqFnIiGlU2o4rREeQeqWpe9WMwisvw+4=";
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = ''
+    installShellCompletion --cmd angrr \
+      --bash <($out/bin/angrr completion bash) \
+      --fish <($out/bin/angrr completion fish) \
+      --zsh  <($out/bin/angrr completion zsh)
+  '';
+
+  passthru = {
+    tests = {
+      module = nixosTests.angrr;
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Tool for auto Nix GC roots retention";
+    homepage = "https://github.com/linyinfeng/angrr";
+    license = [ lib.licenses.mit ];
+    maintainers = with lib.maintainers; [ yinfeng ];
+    platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "angrr";
+  };
+})
diff --git a/pkgs/by-name/ba/bakelite/package.nix b/pkgs/by-name/ba/bakelite/package.nix
index ab9e57dcd74b..252f4b36a2da 100644
--- a/pkgs/by-name/ba/bakelite/package.nix
+++ b/pkgs/by-name/ba/bakelite/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "bakelite";
-  version = "0.4.2-unstable-2023-05-30";
+  version = "0.4.2-unstable-2024-08-02";
 
   src = fetchFromGitHub {
     owner = "richfelker";
     repo = "bakelite";
-    rev = "65d69e88e0972d1493ebbd9bf9d1bfde36272636";
-    hash = "sha256-OjBw9aYD2h7BWYgQzZp03hGCyQcRgmm2AjrcT/QrQAo=";
+    rev = "bc79a16b4414702c579143154d94a86666e99b78";
+    hash = "sha256-rRJrtCcgfbqC/4qQiTVeUUcPqoJlNfitYRqIO58AmpA=";
   };
 
   hardeningEnable = [ "pie" ];
diff --git a/pkgs/by-name/ba/bant/package.nix b/pkgs/by-name/ba/bant/package.nix
index 32b31e217a9a..bee8f31291fe 100644
--- a/pkgs/by-name/ba/bant/package.nix
+++ b/pkgs/by-name/ba/bant/package.nix
@@ -20,13 +20,13 @@ let
 in
 buildBazelPackage rec {
   pname = "bant";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "hzeller";
     repo = "bant";
     rev = "v${version}";
-    hash = "sha256-xiTi4GrCeoI8hIEgYMAdzUPvJzYvXrvbo6MBq9my5Cw=";
+    hash = "sha256-wrzOszkqWDEylMDZYgtAqB837uWevWCwkhBhv9LGj4Y=";
   };
 
   bazelFlags = [
diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index d96737d7955a..c221957f8f3e 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -57,12 +57,18 @@ stdenv.mkDerivation (finalAttrs: {
   # * opt-keep-going-indirect: not yet known
   # * varmod-localtime: musl doesn't support TZDIR and this test relies on
   #   impure, implicit paths
-  env.BROKEN_TESTS = builtins.concatStringsSep " " [
-    "directive-export"
-    "directive-export-gmake"
-    "opt-keep-going-indirect"
-    "varmod-localtime"
-  ];
+  # * interrupt-compat (fails on x86_64-linux building for i686-linux)
+  env.BROKEN_TESTS = lib.concatStringsSep " " (
+    [
+      "directive-export"
+      "directive-export-gmake"
+      "opt-keep-going-indirect"
+      "varmod-localtime"
+    ]
+    ++ lib.optionals stdenv.targetPlatform.is32bit [
+      "interrupt-compat"
+    ]
+  );
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/bs/bs-manager/package.nix b/pkgs/by-name/bs/bs-manager/package.nix
index 1c5974b429f8..7c8f1c9dc52e 100644
--- a/pkgs/by-name/bs/bs-manager/package.nix
+++ b/pkgs/by-name/bs/bs-manager/package.nix
@@ -19,20 +19,15 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "bs-manager";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "Zagrios";
     repo = "bs-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-thqz6sFmov5py7mUBYUC6ANBgjnNFC1hfLEsaxJVYu8=";
+    hash = "sha256-YitQjhnadQrpdBOV2CUedRNm/RW7/rpXtS9PJTa9kUU=";
   };
 
-  patches = [
-    # https://github.com/Zagrios/bs-manager/pull/870
-    ./use-steam-run-for-wine.patch
-  ];
-
   postPatch = ''
     # don't search for resources in electron's resource directory, but our own
     substituteInPlace src/main/services/utils.service.ts \
@@ -43,13 +38,13 @@ buildNpmPackage (finalAttrs: {
     ln -s ${finalAttrs.passthru.depotdownloader}/bin/DepotDownloader assets/scripts/DepotDownloader
   '';
 
-  npmDepsHash = "sha256-VsCbz7ImDnJ0tonVhA4lOPA0w//tqF4hLhrReLUqYI8=";
+  npmDepsHash = "sha256-3NMqYD7S4wYjwYuGJOmq2/C82qtG1mImsR4crjFLe30=";
 
   extraNpmDeps = fetchNpmDeps {
     name = "bs-manager-${finalAttrs.version}-extra-npm-deps";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/release/app";
-    hash = "sha256-JqDsv9kvYnbJdNwXN1EbppSrFVqr2cSnVhV2+8uw54g=";
+    hash = "sha256-UWsxty1kfxMr5fybtykrN2G+yiQ9dw/bbMwfcVLJgp4=";
   };
 
   makeCacheWritable = true;
diff --git a/pkgs/by-name/bs/bs-manager/use-steam-run-for-wine.patch b/pkgs/by-name/bs/bs-manager/use-steam-run-for-wine.patch
deleted file mode 100644
index 1335a20877b7..000000000000
--- a/pkgs/by-name/bs/bs-manager/use-steam-run-for-wine.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff --git a/src/main/services/linux.service.ts b/src/main/services/linux.service.ts
-index 7f92bed..5f12896 100644
---- a/src/main/services/linux.service.ts
-+++ b/src/main/services/linux.service.ts
-@@ -129,12 +129,7 @@ export class LinuxService {
-         return fs.pathExistsSync(protonPath) && fs.pathExistsSync(winePath);
-     }
- 
--    public async getWinePath(): Promise<string> {
--        if (await this.isNixOS()) {
--            // Use system wine for nixos
--            return "wine";
--        }
--
-+    public getWinePath(): string {
-         if (!this.staticConfig.has("proton-folder")) {
-             throw new Error("proton-folder variable not set");
-         }
-diff --git a/src/main/services/mods/bs-mods-manager.service.ts b/src/main/services/mods/bs-mods-manager.service.ts
-index c842fda..60cc190 100644
---- a/src/main/services/mods/bs-mods-manager.service.ts
-+++ b/src/main/services/mods/bs-mods-manager.service.ts
-@@ -162,12 +162,15 @@ export class BsModsManagerService {
-         let winePath: string = "";
-         if (process.platform === "linux") {
-             const { error: winePathError, result: winePathResult } =
--                await tryit(async () => this.linuxService.getWinePath());
-+                tryit(() => this.linuxService.getWinePath());
-             if (winePathError) {
-                 log.error(winePathError);
-                 return false;
-             }
--            winePath = `"${winePathResult}"`;
-+
-+            winePath = await this.linuxService.isNixOS()
-+                ? `steam-run "${winePathResult}"`
-+                : `"${winePathResult}"`;
- 
-             const winePrefix = this.linuxService.getWinePrefixPath();
-             if (!winePrefix) {
diff --git a/pkgs/by-name/ca/cargo-deb/package.nix b/pkgs/by-name/ca/cargo-deb/package.nix
index 31c440a254ac..84a589941577 100644
--- a/pkgs/by-name/ca/cargo-deb/package.nix
+++ b/pkgs/by-name/ca/cargo-deb/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
-  version = "3.5.1";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "kornelski";
     repo = "cargo-deb";
     rev = "v${version}";
-    hash = "sha256-lTxMaYb7+cLQB+L8OJ8Q6HwD37Bw3kzRVLtovAJxpe0=";
+    hash = "sha256-/mPsmg2UUwjLKg0GjEGvg6qMswyBgwjP+HpldF3Wm/k=";
   };
 
-  cargoHash = "sha256-QidnhKXGcR4I+FULRrt+jTQNp+DE9SVW8wlH5Ypknqg=";
+  cargoHash = "sha256-HWA/CCDQNMKt2lHcPTByeg2z4TisafeN7Zgo/A+NOrE=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/ca/cargo-geiger/package.nix b/pkgs/by-name/ca/cargo-geiger/package.nix
index 692aa2380836..6fbcd284d5fb 100644
--- a/pkgs/by-name/ca/cargo-geiger/package.nix
+++ b/pkgs/by-name/ca/cargo-geiger/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-geiger";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "geiger-rs";
     repo = "cargo-geiger";
     tag = "cargo-geiger-${version}";
-    hash = "sha256-OW/LOZUCGOIl7jeWnzt4SXTo3gplJx/wbC21S1TdZx0=";
+    hash = "sha256-dZ71WbTKsR6g5UhWuJNfNAAqNNxbTgwL5fsgkm50BaM=";
   };
 
-  cargoHash = "sha256-aDgpEfX0QRkQD6c4ant6uSN18WLHVnZISRr7lyu9IzA=";
+  cargoHash = "sha256-GgCmUNOwvyTB82Y/ddgJIAb1SpO4mRPjECqCagJ8GmE=";
 
   buildInputs = [
     openssl
diff --git a/pkgs/by-name/ca/cargo-sort/package.nix b/pkgs/by-name/ca/cargo-sort/package.nix
index d48b92a64316..3f2fcea8443d 100644
--- a/pkgs/by-name/ca/cargo-sort/package.nix
+++ b/pkgs/by-name/ca/cargo-sort/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-sort";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "devinr528";
     repo = "cargo-sort";
     rev = "v${version}";
-    sha256 = "sha256-OFDEM/qYIaWsjHKZhf/kmJo7drY+649gpe4VSE18sXc=";
+    sha256 = "sha256-mdvaRTcs2zVXKX8LrqHFrWTdnFZpAfQuWjYmeWgdGVI=";
   };
 
-  cargoHash = "sha256-nQ1g0rBWx7yHQO9U/J0/XI76quEAvpCyhZDcTJKYYXo=";
+  cargoHash = "sha256-FoFzBf24mNDTRBfFyTEr9Q7sJjUhs0X/XWRGEoierQ4=";
 
   meta = {
     description = "Tool to check that your Cargo.toml dependencies are sorted alphabetically";
diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix
index 6552bcbf6155..b4acfaaca20e 100644
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.68.0";
+  version = "11.69.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-CmFWfXyMQJ6/wLjSQiwh3Yu1RPlopNesEbp8moj5wG8=";
+    hash = "sha256-Iq44LRKPQq5TWfkoXbqOxUquMdImNU8Jz4ojvmCI310=";
   };
 
   subPackages = [ "apps/cnquery" ];
diff --git a/pkgs/by-name/co/codecrafters-cli/package.nix b/pkgs/by-name/co/codecrafters-cli/package.nix
index 79c283a1c540..a338fd3858cd 100644
--- a/pkgs/by-name/co/codecrafters-cli/package.nix
+++ b/pkgs/by-name/co/codecrafters-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "codecrafters-cli";
-  version = "36";
+  version = "37";
 
   src = fetchFromGitHub {
     owner = "codecrafters-io";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-YgQPDc5BUIoEd44NLpRluxCKooW99qvcSTrFPm6qJKM=";
+    hash = "sha256-MxeWShst5QZPXImXnCEGYSVzqB4HNygewrQxpwmfafk=";
     # A shortened git commit hash is part of the version output, and is
     # needed at build time. Use the `.git` directory to retrieve the
     # commit SHA, and remove the directory afterwards since it is not needed
diff --git a/pkgs/by-name/cp/cpp-jwt/package.nix b/pkgs/by-name/cp/cpp-jwt/package.nix
index 05dc6730104f..09f78320572f 100644
--- a/pkgs/by-name/cp/cpp-jwt/package.nix
+++ b/pkgs/by-name/cp/cpp-jwt/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-jwt";
-  version = "1.5";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "arun11299";
     repo = "cpp-jwt";
     rev = "v${version}";
-    sha256 = "sha256-l1FevNhGX7vouKmGh/ypCcmZQLMpHJ4JFUp5dnNMEwg=";
+    sha256 = "sha256-TyLYTk7vlpNmYJxaH9zhGwFvv1BEcShTDr7JYfgu6f0=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/gh/gh-f/package.nix b/pkgs/by-name/gh/gh-f/package.nix
index f51c5ac88ede..ddc78892b432 100644
--- a/pkgs/by-name/gh/gh-f/package.nix
+++ b/pkgs/by-name/gh/gh-f/package.nix
@@ -15,13 +15,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gh-f";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "gennaro-tedesco";
     repo = "gh-f";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kldhK5ChwHRv7joD9uyCAk1Gdc8+2IyubAB04j8/LPA=";
+    hash = "sha256-rMGyiXniW3M4JnsWufXcsU8mL8KlrIRGGgbQT6utnuc=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/gh/gh-s/package.nix b/pkgs/by-name/gh/gh-s/package.nix
index fb5d0cc431d8..859fd5c09782 100644
--- a/pkgs/by-name/gh/gh-s/package.nix
+++ b/pkgs/by-name/gh/gh-s/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gh-s";
-  version = "0.0.11";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "gennaro-tedesco";
     repo = "gh-s";
     rev = "v${version}";
-    hash = "sha256-I1r3FW+qWKRFukeXot009CbH/JbYeCjvoRKrvsyjDJE=";
+    hash = "sha256-+jAJicvk6N2PfOTBR5H9nP3xTiBq4oYfNLvxN4sKvh4=";
   };
 
   vendorHash = "sha256-5UJAgsPND6WrOZZ5PUZNdwd7/0NPdhD1SaZJzZ+2VvM=";
diff --git a/pkgs/by-name/gl/glooctl/package.nix b/pkgs/by-name/gl/glooctl/package.nix
index ea2a57801471..a6d12e9dba5e 100644
--- a/pkgs/by-name/gl/glooctl/package.nix
+++ b/pkgs/by-name/gl/glooctl/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.19.4";
+  version = "1.19.6";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-6esnWLO0+6Tst8eplemgs1Z2Ibk+D3ipFHxcBWF3/6w=";
+    hash = "sha256-jH/QnRGeuYv7e7QNGLvVhLwvX5kHtqArOUPYdXcKURw=";
   };
 
-  vendorHash = "sha256-n42H8c4KqgEannLpEdpKSz7J4UZ+lpVhDAE7ZuBKdCU=";
+  vendorHash = "sha256-OJeWijGwxuBd0Qsscy7wjTkzglUZg+jHuPX1s1ayZVI=";
 
   subPackages = [ "projects/gloo/cli/cmd" ];
 
diff --git a/pkgs/by-name/go/goose-cli/package.nix b/pkgs/by-name/go/goose-cli/package.nix
index a34da7e22f16..cee070520bed 100644
--- a/pkgs/by-name/go/goose-cli/package.nix
+++ b/pkgs/by-name/go/goose-cli/package.nix
@@ -27,16 +27,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "goose-cli";
-  version = "1.4.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "goose";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xXQFhGwI5aZfRzJ17WXcpOHnaE1MW2S6uje8qSC3NU4=";
+    hash = "sha256-ZfS0U7PpGWWuqGKd7IjRaavqZSySx93F9S1d7r2wMkE=";
   };
 
-  cargoHash = "sha256-b8u226CSW/85HoVuDYGc0cbCA61ZOsrngenZKMgY4us=";
+  cargoHash = "sha256-uYgYzP75QkN1VksYL3KeNMNy7wb0TgCP8HPN1QrfZoo=";
 
   nativeBuildInputs = [
     pkg-config
@@ -58,20 +58,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   __darwinAllowLocalNetworking = true;
 
   checkFlags = [
-    # need dbus-daemon
+    # need dbus-daemon for keychain access
     "--skip=config::base::tests::test_multiple_secrets"
     "--skip=config::base::tests::test_secret_management"
     "--skip=config::base::tests::test_concurrent_extension_writes"
+    "--skip=config::signup_tetrate::tests::test_configure_tetrate"
     # Observer should be Some with both init project keys set
     "--skip=tracing::langfuse_layer::tests::test_create_langfuse_observer"
     "--skip=providers::gcpauth::tests::test_token_refresh_race_condition"
-    # Lazy instance has previously been poisoned
-    "--skip=jetbrains::tests::test_capabilities"
-    "--skip=jetbrains::tests::test_router_creation"
-    "--skip=logging::tests::test_log_file_name::with_session_name_and_error_capture"
-    "--skip=logging::tests::test_log_file_name::with_session_name_without_error_capture"
-    "--skip=logging::tests::test_log_file_name::without_session_name"
-    "--skip=developer::tests::test_text_editor_str_replace"
     # need API keys
     "--skip=providers::factory::tests::test_create_lead_worker_provider"
     "--skip=providers::factory::tests::test_create_regular_provider_without_lead_config"
@@ -87,15 +81,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=transport::streamable_http::tests::test_handle_outgoing_message_session_id_handling"
     "--skip=transport::streamable_http::tests::test_handle_outgoing_message_session_not_found"
     "--skip=transport::streamable_http::tests::test_handle_outgoing_message_successful_request"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     "--skip=context_mgmt::auto_compact::tests::test_auto_compact_respects_config"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    "--skip=providers::gcpauth::tests::test_load_from_metadata_server"
-    "--skip=providers::oauth::tests::test_get_workspace_endpoints"
-    "--skip=tracing::langfuse_layer::tests::test_batch_manager_spawn_sender"
-    "--skip=tracing::langfuse_layer::tests::test_batch_send_partial_failure"
-    "--skip=tracing::langfuse_layer::tests::test_batch_send_success"
-    "--skip=logging::tests::test_log_file_name_session_without_error_capture"
+    "--skip=logging::tests::test_log_file_name_no_session"
     "--skip=recipes::extract_from_cli::tests::test_extract_recipe_info_from_cli_basic"
     "--skip=recipes::extract_from_cli::tests::test_extract_recipe_info_from_cli_with_additional_sub_recipes"
     "--skip=recipes::recipe::tests::load_recipe::test_load_recipe_success"
diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index 4f32bc681ef0..92ab4fb32a3b 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.6.15";
+  version = "3.6.16";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/release-${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-F+QixbA6zEA1qW3yb8MhJNurU8/2jZAEbfQU9cJ7zT4=";
+    hash = "sha256-C3a8pjMllkmTpChucFBunW8uixnnvqrXg06BhLAg6Y8=";
   };
 
   icon = fetchurl {
diff --git a/pkgs/by-name/if/ifstate/package.nix b/pkgs/by-name/if/ifstate/package.nix
new file mode 100644
index 000000000000..4d92b86701d4
--- /dev/null
+++ b/pkgs/by-name/if/ifstate/package.nix
@@ -0,0 +1,87 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitea,
+  iproute2,
+  libbpf,
+  nixosTests,
+  withBpf ? false,
+  withConfigValidation ? true,
+  withShellColor ? false,
+  withWireguard ? true,
+}:
+
+let
+  self = python3Packages.buildPythonApplication rec {
+    pname = "ifstate";
+    version = "2.0.0";
+    pyproject = true;
+
+    src = fetchFromGitea {
+      domain = "codeberg.org";
+      owner = "liske";
+      repo = "ifstate";
+      tag = version;
+      hash = "sha256-YxLyiTVLN4nxc2ppqGGnYCGudbdPLSLV8EwDURtpO0U=";
+    };
+
+    postPatch = ''
+      substituteInPlace libifstate/routing/__init__.py \
+        --replace-fail '/usr/share/iproute2' '${iproute2}/share/iproute2'
+    ''
+    + lib.optionalString withBpf ''
+      substituteInPlace libifstate/bpf/ctypes.py \
+        --replace-fail 'libbpf.so.1' '${libbpf}/lib/libbpf.so.1'
+    '';
+
+    build-system = with python3Packages; [
+      setuptools
+    ];
+
+    dependencies =
+      with python3Packages;
+      [
+        pyroute2
+        pyyaml
+        setproctitle
+      ]
+      ++ lib.optional withConfigValidation jsonschema
+      ++ lib.optional withShellColor pygments
+      ++ lib.optional withWireguard wgnlpy;
+
+    pythonRemoveDeps = lib.optional (!withConfigValidation) "jsonschema";
+
+    # has no unit tests
+    doCheck = false;
+
+    pythonImportsCheck = [
+      "libifstate"
+      "ifstate"
+    ];
+
+    passthru = {
+      tests = nixosTests.ifstate;
+      features = {
+        inherit
+          withBpf
+          withConfigValidation
+          withShellColor
+          withWireguard
+          ;
+      };
+      # needed for access in schema validaten in module
+      jsonschema = "${self}/${python3Packages.python.sitePackages}/libifstate/schema/2/ifstate.conf.schema.json";
+    };
+
+    meta = {
+      description = "Manage host interface settings in a declarative manner";
+      homepage = "https://ifstate.net";
+      changelog = "https://codeberg.org/liske/ifstate/src/tag/${src.tag}/CHANGELOG.md";
+      platforms = lib.platforms.linux;
+      license = lib.licenses.gpl3Plus;
+      maintainers = with lib.maintainers; [ marcel ];
+      mainProgram = "ifstatecli";
+    };
+  };
+in
+self
diff --git a/pkgs/by-name/io/iosevka/package.nix b/pkgs/by-name/io/iosevka/package.nix
index ad3ede680110..d2ff55523ff0 100644
--- a/pkgs/by-name/io/iosevka/package.nix
+++ b/pkgs/by-name/io/iosevka/package.nix
@@ -56,16 +56,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "33.2.8";
+  version = "33.2.9";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-rHkIvfS20A0cvFBcLfFLAvcVVF5BgbtMdDxMvwH0B+I=";
+    hash = "sha256-EC3daY7R2AhqrE62dp6sT5BspyZkLccuC5PnBibeRaI=";
   };
 
-  npmDepsHash = "sha256-PYzNg5gduwtwc99GyatXnmHCh9mpAulz43Ehdle0rAM=";
+  npmDepsHash = "sha256-ekODYQ1GjGytlcX4VGIfyl5kPEWW/9VL/He0BBtWeK0=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/by-name/jo/josm/package.nix b/pkgs/by-name/jo/josm/package.nix
index c8e0cb1a4089..aec05a600f8b 100644
--- a/pkgs/by-name/jo/josm/package.nix
+++ b/pkgs/by-name/jo/josm/package.nix
@@ -11,20 +11,20 @@
 }:
 let
   pname = "josm";
-  version = "19423";
+  version = "19439";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-s8aMV31NsDFE5XLP523PH3RNvq78eTAa+UvmjyY5a+E=";
+      hash = "sha256-EuboKKNpApYlh9b78oB5AbtOM38oMe3NEa4fovA78Uk=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java21.zip";
-      hash = "sha256-8eps1eTUn9FHHYwECH/742PV7wnnRO08dlZmaxd1aZU=";
+      hash = "sha256-b38Xd0qx0ceNtJ5UIWDJkGOvaHSB/46onPbd6LJ6siY=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
       rev = version;
-      hash = "sha256-4mK+IdVRDhINJqzOovw7YPNiJmFxTCIfYVNMXKSdBv0=";
+      hash = "sha256-9YTSX4chUxijtJ7a1pLE2kYo9hdOB/8vnnfFqMeXKbE=";
     };
   };
 
diff --git a/pkgs/by-name/jo/josm/update.sh b/pkgs/by-name/jo/josm/update.sh
index b41781434c91..9f40ee0cca20 100755
--- a/pkgs/by-name/jo/josm/update.sh
+++ b/pkgs/by-name/jo/josm/update.sh
@@ -11,7 +11,7 @@ version="$(curl https://josm.openstreetmap.de/apt/pool/universe/j/josm/ |
   sort -n |
   tail -n1)"
 
-pkgHash="$(nurl -H https://github.com/JOSM/josm "$version-tested")"
+pkgHash="$(nurl -f fetchsvn -H https://josm.openstreetmap.de/svn/trunk/native/linux/tested "$version")"
 
 update-source-version josm "$version" --source-key=srcs.jar
 update-source-version josm "$version" --ignore-same-version --source-key=srcs.macosx
diff --git a/pkgs/by-name/jr/jreleaser-cli/package.nix b/pkgs/by-name/jr/jreleaser-cli/package.nix
index 36f3d38811a7..10e4d907a51c 100644
--- a/pkgs/by-name/jr/jreleaser-cli/package.nix
+++ b/pkgs/by-name/jr/jreleaser-cli/package.nix
@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "jreleaser-cli";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchurl {
     url = "https://github.com/jreleaser/jreleaser/releases/download/v${version}/jreleaser-tool-provider-${version}.jar";
-    hash = "sha256-tUliZBRHAXgv+FR5z298IAG3egTTqwhRYt8r96gdtdM=";
+    hash = "sha256-47MpBFUEHx2yVk05Gd9CyVrHYHRK7NtcGosBJJbdhD0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ka/katana/package.nix b/pkgs/by-name/ka/katana/package.nix
index 93147c620e66..124a4cf74c50 100644
--- a/pkgs/by-name/ka/katana/package.nix
+++ b/pkgs/by-name/ka/katana/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "katana";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "katana";
     tag = "v${version}";
-    hash = "sha256-ldTK8Y6//goFhalF4BaLtbMkwoKJd1NDzUR9pLDRBD8=";
+    hash = "sha256-q7uOtfxSS6cLZKjnObLAzn+JpC2myEkoTd2TINBhYcU=";
   };
 
-  vendorHash = "sha256-st7gj4hynuY1dDUEhA4xbiOnxH3jV5T2RK+PhB46Lpk=";
+  vendorHash = "sha256-9RoL6gpAJXO2/0UCmpRnh8roZw/txNgb/H0kVTKVxWs=";
 
   subPackages = [ "cmd/katana" ];
 
diff --git a/pkgs/by-name/ki/kind/package.nix b/pkgs/by-name/ki/kind/package.nix
index b5cc225021dd..233937b0cbc9 100644
--- a/pkgs/by-name/ki/kind/package.nix
+++ b/pkgs/by-name/ki/kind/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "kind";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "kubernetes-sigs";
     repo = "kind";
-    hash = "sha256-Dv4I50LQcr8fOaCCdaKkz+pHIG05UBQAdDs7gGngm4Y=";
+    hash = "sha256-TssyKO5v3xqSDjS3DYIlO7iOx/zzS3E9O88V9R7S5Ac=";
   };
 
   patches = [
@@ -24,7 +24,7 @@ buildGoModule rec {
     ./kernel-module-path.patch
   ];
 
-  vendorHash = "sha256-QFDQkl1QuIc0fUK0raVxmPT7AF6fsKlQ4F0dzOM9fcw=";
+  vendorHash = "sha256-tRpylYpEGF6XqtBl7ESYlXKEEAt+Jws4x4VlUVW8SNI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/kr/krelay/package.nix b/pkgs/by-name/kr/krelay/package.nix
index aa307041b81a..fc0e45e92e14 100644
--- a/pkgs/by-name/kr/krelay/package.nix
+++ b/pkgs/by-name/kr/krelay/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "krelay";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "knight42";
     repo = "krelay";
     rev = "v${version}";
-    hash = "sha256-TonkGh4j+xLGgSpspCedg6c2NpIZIzp5pv8VtWFssPk=";
+    hash = "sha256-v7yX5wDf3d07TiWe+9iTkGhc8LqfU1hUkxuf5ZBVcYE=";
   };
 
-  vendorHash = "sha256-Qz3q/503A5QmsgEaDqChxS2tcUEJGmeT6YE6R3LBbcY=";
+  vendorHash = "sha256-9bOU9Zqqb4tdQCIB3UkTdAcD4cn6+7C35gOCywv1/Os=";
 
   subPackages = [ "cmd/client" ];
 
diff --git a/pkgs/by-name/ku/kubedb-cli/package.nix b/pkgs/by-name/ku/kubedb-cli/package.nix
index 12edd1d8df8f..43a4a543ed98 100644
--- a/pkgs/by-name/ku/kubedb-cli/package.nix
+++ b/pkgs/by-name/ku/kubedb-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kubedb-cli";
-  version = "0.57.0";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "kubedb";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-U2VdWer9jOW+GmzndyXt9nD7HlUIvljROeS/gL3ZJAc=";
+    hash = "sha256-DfvYWA2D+TuIz5nQnzFHatR9yl8nos7byMz7uK+q7w0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ku/kubernetes-polaris/package.nix b/pkgs/by-name/ku/kubernetes-polaris/package.nix
index 6d8af6913857..ff0a588bdeb5 100644
--- a/pkgs/by-name/ku/kubernetes-polaris/package.nix
+++ b/pkgs/by-name/ku/kubernetes-polaris/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "kubernetes-polaris";
-  version = "10.1.0";
+  version = "10.1.1";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "polaris";
     rev = version;
-    sha256 = "sha256-/YK9Xz/zYksFCde9uoTXrVbaOQ3V7EoSaoWnrSR9Oq8=";
+    sha256 = "sha256-1viEKPU+V+VqFDnrtjSTvNLtgE3TB1ijKv1YOz6AAUo=";
   };
 
   vendorHash = "sha256-4eznwhNf3anhs+GlZGrHJWAproej0dO2NbzfhJeReNY=";
diff --git a/pkgs/by-name/la/lavacli/package.nix b/pkgs/by-name/la/lavacli/package.nix
index abfc4cfc2175..b6b22eaf2700 100644
--- a/pkgs/by-name/la/lavacli/package.nix
+++ b/pkgs/by-name/la/lavacli/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "lavacli";
-  version = "2.2.0";
+  version = "2.4";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "lava";
     repo = "lavacli";
     tag = "v${version}";
-    hash = "sha256-Pfsf2a5y3rpoTGY3PmNdq9ojSjBVBfawz/LTQmIQ2vU=";
+    hash = "sha256-KNq+UNOC3N+p0HOed2Mdh9EIXLQccH+aepdfJ59Z2oM=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/by-name/li/libvgm/package.nix b/pkgs/by-name/li/libvgm/package.nix
index 4d4bb3c0797e..6c39efabcb72 100644
--- a/pkgs/by-name/li/libvgm/package.nix
+++ b/pkgs/by-name/li/libvgm/package.nix
@@ -38,13 +38,13 @@ assert enableTools -> enableAudio && enableEmulation && enableLibplayer;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libvgm";
-  version = "0-unstable-2025-07-14";
+  version = "0-unstable-2025-08-31";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "7cad78367fa35c3f7b3ae16a296d31063cd3a7e4";
-    hash = "sha256-8Hnr9VeVkrvRe1mwCUBGhSwYYYXxbby+aQU+KBrSyRM=";
+    rev = "e9f2b023e8918b56be0d2e634b3f5aab2a589ffe";
+    hash = "sha256-jnjIWB+1IndV7XljG4lUJ93zP9Emlxlx+EWH4xdtLGE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 0109e5283c86..b4cacfafe898 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "9.6.1";
+  version = "9.6.5";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
-    url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/GAeZx2ShtC+VoqNO/SB8H4kLLgdLAc/RAGVxF6Imbc=";
+    url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
+    hash = "sha256-d3teFW6eSKG+VIWbuOs5a9f0cxv2Fssepkcjfle7Ems=";
   };
 
   enableParallelBuilding = true;
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://limine-bootloader.org/";
-    changelog = "https://raw.githubusercontent.com/limine-bootloader/limine/refs/tags/v${finalAttrs.version}/ChangeLog";
+    changelog = "https://codeberg.org/Limine/Limine/raw/tag/v${finalAttrs.version}/ChangeLog";
     description = "Limine Bootloader";
     mainProgram = "limine";
     # The platforms on that the Limine binary and helper tools can run, not
@@ -95,11 +95,11 @@ stdenv.mkDerivation (finalAttrs: {
     license = with lib.licenses; [
       asl20 # cc-runtime
       bsd0 # freestanding-headers, freestanding-toolchain
-      bsd2 # limine, flanterm, libfdt, nyu-efi
-      bsd2Patent # nyu-efi
-      bsd3 # nyu-efi
-      bsdAxisNoDisclaimerUnmodified # nyu-efi
-      mit # nyu-efi, stb_image
+      bsd2 # limine, flanterm, libfdt, PicoEFI
+      bsd2Patent # PicoEFI
+      bsd3 # PicoEFI
+      bsdAxisNoDisclaimerUnmodified # PicoEFI
+      mit # PicoEFI, stb_image
       zlib # tinf
     ];
     maintainers = with lib.maintainers; [
diff --git a/pkgs/servers/mail/mailpit/default.nix b/pkgs/by-name/ma/mailpit/package.nix
similarity index 92%
rename from pkgs/servers/mail/mailpit/default.nix
rename to pkgs/by-name/ma/mailpit/package.nix
index 473df8ed243a..90559dfa6957 100644
--- a/pkgs/servers/mail/mailpit/default.nix
+++ b/pkgs/by-name/ma/mailpit/package.nix
@@ -5,6 +5,7 @@
   nodejs,
   python3,
   libtool,
+  cctools,
   npmHooks,
   fetchFromGitHub,
   fetchNpmDeps,
@@ -28,6 +29,8 @@ let
     hash = source.hash;
   };
 
+  libtool' = if stdenv.hostPlatform.isDarwin then cctools else libtool;
+
   # Separate derivation, because if we mix this in buildGoModule, the separate
   # go-modules build inherits specific attributes and fails. Getting that to
   # work is hackier than just splitting the build.
@@ -43,7 +46,7 @@ let
     nativeBuildInputs = [
       nodejs
       python3
-      libtool
+      libtool'
       npmHooks.npmConfigHook
     ];
 
@@ -78,7 +81,7 @@ buildGoModule {
     inherit (nixosTests) mailpit;
     version = testers.testVersion {
       package = mailpit;
-      command = "mailpit version";
+      command = "mailpit version --no-release-check";
     };
   };
 
diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
new file mode 100644
index 000000000000..ead74889f8a1
--- /dev/null
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -0,0 +1,6 @@
+{
+  version = "1.27.7";
+  hash = "sha256-VMfts0tfvW2IeEwSXSjlYLe9vQbZdZ9MrLIa9QUJYr4=";
+  npmDepsHash = "sha256-XRg3dnB3M0KwXV4qP//z11434WsLAxSGjqAb92bHawk=";
+  vendorHash = "sha256-tMxhHxc3SmxKo358W3Fr15RPaE3iJ1ETQRWpN0AVmE4=";
+}
diff --git a/pkgs/servers/mail/mailpit/update.sh b/pkgs/by-name/ma/mailpit/update.sh
similarity index 100%
rename from pkgs/servers/mail/mailpit/update.sh
rename to pkgs/by-name/ma/mailpit/update.sh
diff --git a/pkgs/by-name/me/memray/package.nix b/pkgs/by-name/me/memray/package.nix
index e149eca1f70c..bae7b8412c1c 100644
--- a/pkgs/by-name/me/memray/package.nix
+++ b/pkgs/by-name/me/memray/package.nix
@@ -20,6 +20,14 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-bShFMuDJlvBA3rQJRwXlsgRk4q+gdFQjOpDzOrp4/8k=";
   };
 
+  # AttributeError: 'Label' object has no attribute 'renderable'.
+  # In textual==0.6.0, the `renderable` property was renamed to `content`
+  # https://github.com/Textualize/textual/pull/6041
+  postPatch = ''
+    substituteInPlace tests/unit/test_tui_reporter.py \
+      --replace-fail ".renderable" ".content"
+  '';
+
   build-system = with python3Packages; [
     distutils
     setuptools
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 2361333a8112..ff626a5f2357 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -162,11 +162,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "139.0.3405.111";
+  version = "139.0.3405.125";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-1hsvzvaVCDSWGEpqMjsrz7V9Ra+PtoZ//lSXSlmS3FI=";
+    hash = "sha256-MqJPlFoPiTIReXRhLJGR+nbOVwWcpiHTMr5s+M6KXqE=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index 56fa25d308aa..9c95572eac35 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation (
   in
   {
     pname = "neovim-unwrapped";
-    version = "0.11.3";
+    version = "0.11.4";
 
     __structuredAttrs = true;
 
@@ -103,7 +103,7 @@ stdenv.mkDerivation (
       owner = "neovim";
       repo = "neovim";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-B/An+SiRWC3Ea0T/sEk8aNBS1Ab9OENx/l4Z3nn8xE4=";
+      hash = "sha256-IpMHxIDpldg4FXiXPEY2E51DfO/Z5XieKdtesLna9Xw=";
     };
 
     patches = [
diff --git a/pkgs/by-name/ne/neovim-unwrapped/treesitter-parsers.nix b/pkgs/by-name/ne/neovim-unwrapped/treesitter-parsers.nix
index c73bc5085e78..410f73652cfb 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/treesitter-parsers.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/treesitter-parsers.nix
@@ -2,27 +2,27 @@
 
 {
   c.src = fetchurl {
-    url = "https://github.com/tree-sitter/tree-sitter-c/archive/v0.23.4.tar.gz";
-    hash = "sha256:b66c5043e26d84e5f17a059af71b157bcf202221069ed220aa1696d7d1d28a7a";
+    url = "https://github.com/tree-sitter/tree-sitter-c/archive/v0.24.1.tar.gz";
+    hash = "sha256:25dd4bb3dec770769a407e0fc803f424ce02c494a56ce95fedc525316dcf9b48";
   };
   lua.src = fetchurl {
-    url = "https://github.com/tree-sitter-grammars/tree-sitter-lua/archive/v0.3.0.tar.gz";
-    hash = "sha256:a34cc70abfd8d2d4b0fabf01403ea05f848e1a4bc37d8a4bfea7164657b35d31";
+    url = "https://github.com/tree-sitter-grammars/tree-sitter-lua/archive/v0.4.0.tar.gz";
+    hash = "sha256:b0977aced4a63bb75f26725787e047b8f5f4a092712c840ea7070765d4049559";
   };
   vim.src = fetchurl {
-    url = "https://github.com/tree-sitter-grammars/tree-sitter-vim/archive/v0.5.0.tar.gz";
-    hash = "sha256:90019d12d2da0751c027124f27f5335babf069a050457adaed53693b5e9cf10a";
+    url = "https://github.com/tree-sitter-grammars/tree-sitter-vim/archive/v0.7.0.tar.gz";
+    hash = "sha256:44eabc31127c4feacda19f2a05a5788272128ff561ce01093a8b7a53aadcc7b2";
   };
   vimdoc.src = fetchurl {
-    url = "https://github.com/neovim/tree-sitter-vimdoc/archive/v3.0.1.tar.gz";
-    hash = "sha256:76b65e5bee9ff78eb21256619b1995aac4d80f252c19e1c710a4839481ded09e";
+    url = "https://github.com/neovim/tree-sitter-vimdoc/archive/v4.0.0.tar.gz";
+    hash = "sha256:8096794c0f090b2d74b7bff94548ac1be3285b929ec74f839bd9b3ff4f4c6a0b";
   };
   query.src = fetchurl {
-    url = "https://github.com/tree-sitter-grammars/tree-sitter-query/archive/v0.5.1.tar.gz";
-    hash = "sha256:fe8c712880a529d454347cd4c58336ac2db22243bae5055bdb5844fb3ea56192";
+    url = "https://github.com/tree-sitter-grammars/tree-sitter-query/archive/v0.6.2.tar.gz";
+    hash = "sha256:90682e128d048fbf2a2a17edca947db71e326fa0b3dba4136e041e096538b4eb";
   };
   markdown.src = fetchurl {
-    url = "https://github.com/tree-sitter-grammars/tree-sitter-markdown/archive/v0.4.1.tar.gz";
-    hash = "sha256:e0fdb2dca1eb3063940122e1475c9c2b069062a638c95939e374c5427eddee9f";
+    url = "https://github.com/tree-sitter-grammars/tree-sitter-markdown/archive/v0.5.0.tar.gz";
+    hash = "sha256:14c2c948ccf0e9b606eec39b09286c59dddf28307849f71b7ce2b1d1ef06937e";
   };
 }
diff --git a/pkgs/by-name/no/novelwriter/package.nix b/pkgs/by-name/no/novelwriter/package.nix
index 7ee3481f4fce..110cd23445d3 100644
--- a/pkgs/by-name/no/novelwriter/package.nix
+++ b/pkgs/by-name/no/novelwriter/package.nix
@@ -28,6 +28,7 @@ python3.pkgs.buildPythonApplication {
   dependencies = with python3.pkgs; [
     pyqt6
     pyenchant
+    qt6.qtsvg
   ];
 
   # See setup/debian/install
diff --git a/pkgs/by-name/nv/nvidia-mig-parted/package.nix b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
index e38258d5cd95..0701e1fa2206 100644
--- a/pkgs/by-name/nv/nvidia-mig-parted/package.nix
+++ b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nvidia-mig-parted";
-  version = "0.12.1";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "mig-parted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mNzwD8DaWJ0L1y2q/3UhKf0zjKRp3+XwhtFF+Stl/A0=";
+    hash = "sha256-B4vSNG3+qbUqCvEmBz+VUgrnvhNvCR74uvo4uo+bD/Q=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/om/omnissa-horizon-client/package.nix b/pkgs/by-name/om/omnissa-horizon-client/package.nix
index 5521d5bebcec..5bcb44ce125a 100644
--- a/pkgs/by-name/om/omnissa-horizon-client/package.nix
+++ b/pkgs/by-name/om/omnissa-horizon-client/package.nix
@@ -12,7 +12,7 @@
   configText ? "",
 }:
 let
-  version = "2503";
+  version = "2506";
 
   sysArch =
     if stdenv.hostPlatform.system == "x86_64-linux" then
@@ -39,8 +39,8 @@ let
     pname = "omnissa-horizon-files";
     inherit version;
     src = fetchurl {
-      url = "https://download3.omnissa.com/software/CART26FQ1_LIN_2503_TARBALL/Omnissa-Horizon-Client-Linux-2503-8.15.0-14256322247.tar.gz";
-      sha256 = "c7df084d717dc70ce53eadfbe5a9d0daa06931b640702a8355705fbd93e16bb4";
+      url = "https://download3.omnissa.com/software/CART26FQ2_LIN_2506_TARBALL/Omnissa-Horizon-Client-Linux-2506-8.16.0-16536624989.tar.gz";
+      sha256 = "5515e79188e2605ced5a95c3a3829865b567be5d7a8de00a57455f7b5b2ae392";
     };
     nativeBuildInputs = [ makeWrapper ];
     installPhase = ''
diff --git a/pkgs/by-name/op/openvpn3/package.nix b/pkgs/by-name/op/openvpn3/package.nix
index 0b4598642abc..6eb179c1612f 100644
--- a/pkgs/by-name/op/openvpn3/package.nix
+++ b/pkgs/by-name/op/openvpn3/package.nix
@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Should be fixed in v26: https://codeberg.org/OpenVPN/openvpn3-linux/issues/70
+    ./v25-latest-linux-fix.patch
+  ];
+
   postPatch = ''
     echo '#define OPENVPN_VERSION "3.git:unknown:unknown"
     #define PACKAGE_GUIVERSION "v${builtins.replaceStrings [ "_" ] [ ":" ] version}"
diff --git a/pkgs/by-name/op/openvpn3/v25-latest-linux-fix.patch b/pkgs/by-name/op/openvpn3/v25-latest-linux-fix.patch
new file mode 100644
index 000000000000..65577548730f
--- /dev/null
+++ b/pkgs/by-name/op/openvpn3/v25-latest-linux-fix.patch
@@ -0,0 +1,27 @@
+diff --git a/openvpn3-core/openvpn/dco/ovpn_dco_linux.h b/openvpn3-core/openvpn/dco/ovpn_dco_linux.h
+index 238f71f7a..5b7fe8d8c 100644
+--- a/openvpn3-core/openvpn/dco/ovpn_dco_linux.h
++++ b/openvpn3-core/openvpn/dco/ovpn_dco_linux.h
+@@ -239,22 +239,6 @@ enum ovpn_netlink_packet_attrs {
+ 	OVPN_PACKET_ATTR_MAX = __OVPN_PACKET_ATTR_AFTER_LAST - 1,
+ };
+ 
+-enum ovpn_ifla_attrs {
+-	IFLA_OVPN_UNSPEC = 0,
+-	IFLA_OVPN_MODE,
+-
+-	__IFLA_OVPN_AFTER_LAST,
+-	IFLA_OVPN_MAX = __IFLA_OVPN_AFTER_LAST - 1,
+-};
+-
+-enum ovpn_mode {
+-	__OVPN_MODE_FIRST = 0,
+-	OVPN_MODE_P2P = __OVPN_MODE_FIRST,
+-	OVPN_MODE_MP,
+-
+-	__OVPN_MODE_AFTER_LAST,
+-};
+-
+ /// \endcond
+ 
+ #endif /* _UAPI_LINUX_OVPN_DCO_H_ */
diff --git a/pkgs/by-name/pr/protolint/package.nix b/pkgs/by-name/pr/protolint/package.nix
index 85c9ec9fe51f..a63522616cd2 100644
--- a/pkgs/by-name/pr/protolint/package.nix
+++ b/pkgs/by-name/pr/protolint/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "protolint";
-  version = "0.56.1";
+  version = "0.56.4";
 
   src = fetchFromGitHub {
     owner = "yoheimuta";
     repo = "protolint";
     rev = "v${version}";
-    hash = "sha256-fz7hypg07okEg0Z4XiA5NGh6I8oLFO4coJscTvxLWFw=";
+    hash = "sha256-2R+TW8z3XgjavK19PGy9hMpN8WOSeWbb/vcSWbbBmJc=";
   };
 
   vendorHash = "sha256-RS0t7n6pLYVKHluQtXsMjYL1SvN7IZFdKmkxOI8wFoE=";
diff --git a/pkgs/by-name/py/pyenv/package.nix b/pkgs/by-name/py/pyenv/package.nix
index b787b43033eb..cc93ec3ab7c6 100644
--- a/pkgs/by-name/py/pyenv/package.nix
+++ b/pkgs/by-name/py/pyenv/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pyenv";
-  version = "2.6.6";
+  version = "2.6.7";
 
   src = fetchFromGitHub {
     owner = "pyenv";
     repo = "pyenv";
     tag = "v${version}";
-    hash = "sha256-wJZB3pchbH0kxbMRqGAq7moOT5yMB/dzCa+pEFC82BE=";
+    hash = "sha256-Rm4czJoUu36frPvBPvjWo0x0NKEkAHCL07iffsC741o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qq/qq/package.nix b/pkgs/by-name/qq/qq/package.nix
index 1ca56f038925..f5933b5ae267 100644
--- a/pkgs/by-name/qq/qq/package.nix
+++ b/pkgs/by-name/qq/qq/package.nix
@@ -138,7 +138,7 @@ else
             libuuid
           ]
         }" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
         --add-flags ${lib.escapeShellArg commandLineArgs} \
         "''${gappsWrapperArgs[@]}"
 
diff --git a/pkgs/by-name/re/rectangle/package.nix b/pkgs/by-name/re/rectangle/package.nix
index 241cb1f80432..7a887487a706 100644
--- a/pkgs/by-name/re/rectangle/package.nix
+++ b/pkgs/by-name/re/rectangle/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rectangle";
-  version = "0.89";
+  version = "0.90";
 
   src = fetchurl {
     url = "https://github.com/rxhanson/Rectangle/releases/download/v${finalAttrs.version}/Rectangle${finalAttrs.version}.dmg";
-    hash = "sha256-eI3C+nDJhxKwbCLRKepoGmbyWKGCxEuMSK3D0sZbDU0=";
+    hash = "sha256-SC479DxtFkonvWqYSB47b4Mjb7VSnWoNTHcfThYNxt4=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/re/rexi/package.nix b/pkgs/by-name/re/rexi/package.nix
index b8feee0ad67b..5d51a4c9bea8 100644
--- a/pkgs/by-name/re/rexi/package.nix
+++ b/pkgs/by-name/re/rexi/package.nix
@@ -16,6 +16,14 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-tag2/QTM6tDCU3qr4e1GqRYAZgpvEgtA+FtR4P7WdiU=";
   };
 
+  # AttributeError: 'Static' object has no attribute 'renderable'.
+  # In textual==0.6.0, the `renderable` property was renamed to `content`
+  # https://github.com/Textualize/textual/pull/6041
+  postPatch = ''
+    substituteInPlace tests/test_ui.py \
+      --replace-fail ".renderable" ".content"
+  '';
+
   build-system = with python3Packages; [
     poetry-core
   ];
diff --git a/pkgs/by-name/si/sieve-editor-gui/package.nix b/pkgs/by-name/si/sieve-editor-gui/package.nix
index 6b74bde75e0f..0ae4fdf4b224 100644
--- a/pkgs/by-name/si/sieve-editor-gui/package.nix
+++ b/pkgs/by-name/si/sieve-editor-gui/package.nix
@@ -1,42 +1,75 @@
 {
   lib,
+  stdenv,
   buildNpmPackage,
   fetchFromGitHub,
   electron,
-  nodejs_20,
-  nodePackages,
   makeDesktopItem,
   copyDesktopItems,
+  runCommand,
+  zip,
 }:
+
+let
+  electronArch = if stdenv.hostPlatform.isAarch64 then "arm64" else "x64";
+  electronZip =
+    runCommand "electronZip"
+      {
+        nativeBuildInputs = [ zip ];
+      }
+      ''
+        mkdir $out
+
+        cp -r ${electron.dist} electron-dist
+        chmod -R u+w electron-dist
+
+        cd electron-dist
+        zip -0Xqr $out/electron-v${electron.version}-darwin-${electronArch}.zip .
+      '';
+in
+
 buildNpmPackage {
   pname = "sieve-editor-gui";
-  version = "0.6.1-unstable-2024-01-06";
-  nodejs = nodejs_20;
+  version = "0.6.1-unstable-2025-03-12";
 
   src = fetchFromGitHub {
     owner = "thsmi";
     repo = "sieve";
-    rev = "5879679ed8d16a34af760ee56bfec16a1a322b4e";
-    hash = "sha256-wl6dwKoGan+DrpXk2p1fD/QN/C2qT4h/g3N73gF8sOI=";
+    rev = "4bcefba15314177521a45a833e53969b50f4351e";
+    hash = "sha256-jR3+YaVQ+Yd2Xm40SzQNvwWMPe0mJ6bhT96hlUz3/qU=";
   };
 
-  npmDepsHash = "sha256-a2I9csxFZJekG1uCOHqdRaLLi5v/BLTz4SU+uBd855A=";
+  npmDepsHash = "sha256-w2i7XsTx3hlsh/JbvShaxvDyFGcBpL66lMy7KL2tnzM=";
 
-  nativeBuildInputs = [
-    electron
-    copyDesktopItems
-    nodePackages.gulp
-  ];
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ copyDesktopItems ];
 
-  dontNpmBuild = true;
-
-  buildPhase = ''
-    gulp -LLLL app:package
-  '';
+  npmBuildScript = "gulp";
+  npmBuildFlags = [ "app:package" ];
 
   installPhase = ''
     runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
     mv build/ $out
+
+    install -D $out/electron/resources/libs/icons/linux.png $out/share/icons/hicolor/64x64/apps/sieve.png
+
+    makeWrapper ${lib.getExe electron} $out/bin/sieve-editor-gui \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --add-flags $out/electron/resources/main_esm.js
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    npx electron-packager ./build/electron/resources \
+      --electron-zip-dir ${electronZip} \
+      --electron-version ${electron.version} \
+      --icon src/common/icons/mac.icns
+
+    mkdir -p $out/Applications
+    cp -r sieve-darwin-*/sieve.app $out/Applications/
+
+    makeWrapper $out/Applications/sieve.app/Contents/MacOS/Sieve $out/bin/sieve-editor-gui
+  ''
+  + ''
     runHook postInstall
   '';
 
@@ -49,22 +82,24 @@ buildNpmPackage {
       name = "sieve-editor-gui";
       exec = "sieve-editor-gui";
       desktopName = "Sieve Editor";
-      icon = "sieve-editor-gui";
-      categories = [ "Utility" ];
+      icon = "sieve";
+      categories = [
+        "Utility"
+        "Email"
+      ];
+      comment = "Tool to Manage Sieve Message Filters";
     })
   ];
 
-  postInstall = ''
-    makeWrapper ${lib.getExe electron} $out/bin/sieve-editor-gui \
-      --add-flags $out/electron/resources/main_esm.js
-  '';
-
   meta = {
     description = "Activate, edit, delete and add Sieve scripts with a convenient interface";
     homepage = "https://github.com/thsmi/sieve";
     license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ Silver-Golden ];
-    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      Silver-Golden
+      fugi
+    ];
     mainProgram = "sieve-editor-gui";
+    inherit (electron.meta) platforms;
   };
 }
diff --git a/pkgs/by-name/sp/spacer/package.nix b/pkgs/by-name/sp/spacer/package.nix
index 16b5af06e42a..0aff7424ff30 100644
--- a/pkgs/by-name/sp/spacer/package.nix
+++ b/pkgs/by-name/sp/spacer/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spacer";
-  version = "0.4.5";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "samwho";
     repo = "spacer";
     rev = "v${version}";
-    hash = "sha256-GG9v6N7bJN7kYEQRqRIDgPPT0gGJ6LSSr8NWBDKsajo=";
+    hash = "sha256-OryVQmecb8BgnEKeSvAQha+uiv+aZd2Q41T9tZTcWaI=";
   };
 
-  cargoHash = "sha256-sWE0nFFVAUcCgW6R3BWBdSqn1QMRI8tKnuxX4gpRdvA=";
+  cargoHash = "sha256-sFsERAvR99BZm7SmaL/5cmCrwVZIKGRiFYcBtSryFaw=";
 
   meta = with lib; {
     description = "CLI tool to insert spacers when command output stops";
diff --git a/pkgs/by-name/su/surelog/package.nix b/pkgs/by-name/su/surelog/package.nix
index f7c9cb8d8e92..8c468f40e21b 100644
--- a/pkgs/by-name/su/surelog/package.nix
+++ b/pkgs/by-name/su/surelog/package.nix
@@ -17,14 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "surelog";
-  version = "1.84-unstable-2024-12-06";
+  version = "1.86";
 
   src = fetchFromGitHub {
     owner = "chipsalliance";
     repo = "surelog";
-    # Once we're back on a stable tag, use "v$(finalAttrs.version}" below.
-    rev = "298a9cddc672cce7f25ec352f9f8f36f5b23aa4e";
-    hash = "sha256-Qv4dosj2dwakNCcvu483ZMuw+LlYs4fhZTULszERLSI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EEhaYimyzOgQB7dxbbTfsa7APC6SlFkz9ah9BLcKDq4=";
     fetchSubmodules = false; # we use all dependencies from nix
   };
 
diff --git a/pkgs/by-name/uh/uhdm/package.nix b/pkgs/by-name/uh/uhdm/package.nix
index ea59cedf155c..2622dff4d309 100644
--- a/pkgs/by-name/uh/uhdm/package.nix
+++ b/pkgs/by-name/uh/uhdm/package.nix
@@ -9,16 +9,15 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "UHDM";
-  # When updating this package, also consider updating science/logic/surelog
-  version = "1.84-unstable-2024-11-12";
+  pname = "uhdm";
+  # When updating this package, also consider updating surelog
+  version = "1.86";
 
   src = fetchFromGitHub {
     owner = "chipsalliance";
     repo = "UHDM";
-    # After we're back on a stable tag, use v${finalAttrs.version}
-    rev = "7d90dd0e68759775d0c86885d991925096b5b496";
-    hash = "sha256-msdtBAlOXwYJd0HhWmVo8oMJ6h8OUmy0ILxV1MV52PE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-f7QJJEP/jL69DdMJOL5WQdDZU+kBnnLi2eX37AoaXls=";
     fetchSubmodules = false; # we use all dependencies from nix
   };
 
@@ -38,7 +37,14 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   doCheck = true;
-  checkPhase = "make test";
+
+  checkPhase = ''
+    runHook preCheck
+
+    make test
+
+    runHook postCheck
+  '';
 
   meta = {
     description = "Universal Hardware Data Model";
diff --git a/pkgs/by-name/uu/uuu/package.nix b/pkgs/by-name/uu/uuu/package.nix
index 314c60697970..6f35510cf963 100644
--- a/pkgs/by-name/uu/uuu/package.nix
+++ b/pkgs/by-name/uu/uuu/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uuu";
-  version = "1.5.222";
+  version = "1.5.233";
 
   src = fetchFromGitHub {
     owner = "nxp-imx";
     repo = "mfgtools";
     rev = "uuu_${finalAttrs.version}";
-    hash = "sha256-n5CgsArkj67vR6WaUaTUYno1pFffXRxjlC7kU8N/oEM=";
+    hash = "sha256-x3C9bEE99XOIpnPjVV7Je5mfdhwN0nTkiuBxrwWZ7CI=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/va/vale-ls/package.nix b/pkgs/by-name/va/vale-ls/package.nix
index 32a253d64af2..675e1e16c3fd 100644
--- a/pkgs/by-name/va/vale-ls/package.nix
+++ b/pkgs/by-name/va/vale-ls/package.nix
@@ -9,15 +9,15 @@
   vale,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vale-ls";
-  version = "0.3.8";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "errata-ai";
     repo = "vale-ls";
-    tag = "v${version}";
-    hash = "sha256-+2peLqj3/ny0hDwJVKEp2XS68VO50IvpCB2fvZoEdJo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lRRKRQTxgXF4E+XghJ5AOp+mtWtiCT13EcsPVydn4Uo=";
   };
 
   nativeBuildInputs = [
@@ -49,14 +49,14 @@ rustPlatform.buildRustPackage rec {
       --suffix PATH : ${lib.makeBinPath [ vale ]}
   '';
 
-  meta = with lib; {
+  meta = {
     description = "LSP implementation for the Vale command-line tool";
     homepage = "https://github.com/errata-ai/vale-ls";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     mainProgram = "vale-ls";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       foo-dogsquared
       jansol
     ];
   };
-}
+})
diff --git a/pkgs/by-name/va/vault-bin/package.nix b/pkgs/by-name/va/vault-bin/package.nix
index 7649792581a7..0c12e09eb137 100644
--- a/pkgs/by-name/va/vault-bin/package.nix
+++ b/pkgs/by-name/va/vault-bin/package.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.20.2";
+  version = "1.20.3";
 
   src =
     let
@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-Ea+GaukEEd02SzZYe+bzu8EWNPc5XxUVs3qZkF2ry6s=";
-        aarch64-linux = "sha256-Q1n57tUIaPdg++fr2NREv0hsApJdRqyfs/qEHiyst7Y=";
-        i686-linux = "sha256-8V/2Dm6F799fBhuPyUrdu6e7KDmr6SYxU74wRXCRobs=";
-        x86_64-darwin = "sha256-Yuaon05IXauU61xOqAh97DtlKhIQ05qt+Str5JXleHE=";
-        aarch64-darwin = "sha256-wTTEIeoKDNDenhMzwXtldjsz13jvrDY4eOuPFjSyE4Q=";
+        x86_64-linux = "sha256-3IE0WJ3JmzeUwC6OcorebHOD858SKiBR2Rv6KhKewXU=";
+        aarch64-linux = "sha256-DsqOf3yeOz3SI+CCvS2KcCJ6k18o4H+LI1Z39i9ezb0=";
+        i686-linux = "sha256-ONrB+Gwm0dMAK8lvCg5ljC2KApkugA8zX9HcmV0QzFM=";
+        x86_64-darwin = "sha256-cbxdyuLhc8+Ux2ZOX1zncsP2KGqWruuno/Yzct/cyII=";
+        aarch64-darwin = "sha256-zWuI+KFNyqoxnEKI25N4igXnXjoz+AXMU1WgGDKyfog=";
       };
     in
     fetchzip {
diff --git a/pkgs/by-name/va/vault/package.nix b/pkgs/by-name/va/vault/package.nix
index b1d2740deb1b..9d7aa9158597 100644
--- a/pkgs/by-name/va/vault/package.nix
+++ b/pkgs/by-name/va/vault/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.20.2";
+  version = "1.20.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    hash = "sha256-QkBSHkXP67khJa/Ju7yx97ibOU3BcBt6tOHnS0rYvZM=";
+    hash = "sha256-q7Uz8gq092JU1v6sEQvraV6wxgBEGGnZFCBEw2f9GMw=";
   };
 
-  vendorHash = "sha256-O7T7DO3RCQVBBDvFSLAgoD8tJRMJpb4/3ch7OYk4bIk=";
+  vendorHash = "sha256-504WH4KaL1ecsuwXlELKhpbHHK67IcaI+I4DvEQerwA=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/wa/wasmi/package.nix b/pkgs/by-name/wa/wasmi/package.nix
index c02d3a5269cf..6b5af58b3689 100644
--- a/pkgs/by-name/wa/wasmi/package.nix
+++ b/pkgs/by-name/wa/wasmi/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmi";
-  version = "0.51.0";
+  version = "0.51.1";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "wasmi";
     tag = "v${version}";
-    hash = "sha256-mPArNkPrTW3RikLlQNkAjIUEfRot2nRaqceNopGmZDo=";
+    hash = "sha256-Y9wHrx5UcUzJOJoMq9oPgblrpRjLe9nX79FZxL2cIgY=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-7L2XQ4E+1wyNMu2IEgqvKuY84k7kQ07m/dXbyDYN/VU=";
+  cargoHash = "sha256-tlvk+UAUMGToWaRbpsvI8eqsYrnoV/pvn+pWvbOv/18=";
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/by-name/wi/wipefreespace/package.nix b/pkgs/by-name/wi/wipefreespace/package.nix
index 111453bc5765..36680cb33354 100644
--- a/pkgs/by-name/wi/wipefreespace/package.nix
+++ b/pkgs/by-name/wi/wipefreespace/package.nix
@@ -1,55 +1,48 @@
 {
-  stdenv,
   lib,
-  fetchurl,
-  e2fsprogs,
-  ntfs3g,
-  xfsprogs,
-  reiser4progs,
-  libaal,
-  jfsutils,
-  libuuid,
+  stdenv,
+  fetchFromGitHub,
+  gettext,
   texinfo,
+  xfsprogs,
+  e2fsprogs,
+  libcap,
+  ntfs3g,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wipefreespace";
-  version = "2.6";
+  version = "3.0";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/project/wipefreespace/wipefreespace/${version}/wipefreespace-${version}.tar.gz";
-    hash = "sha256-Pt6MDQ9wSJbL4tW/qckTpFsvE9FdXIkp/QmnYSlWR/M=";
+  src = fetchFromGitHub {
+    owner = "bogdro";
+    repo = "wipefreespace";
+    tag = finalAttrs.version;
+    hash = "sha256-zWjMCWQNPPly8xJ7jQraGHi4OLuNrnpNVQC2CRyHUlw=";
   };
 
   nativeBuildInputs = [
+    gettext
     texinfo
+    xfsprogs
   ];
 
   # missed: Reiser3 FAT12/16/32 MinixFS HFS+ OCFS
   buildInputs = [
     e2fsprogs
+    libcap
     ntfs3g
     xfsprogs
-    reiser4progs
-    libaal
-    jfsutils
-    libuuid
   ];
 
   strictDeps = true;
 
-  preConfigure = ''
-    export PATH=$PATH:${xfsprogs}/bin
-    export CFLAGS=-I${jfsutils}/include
-    export LDFLAGS="-L${jfsutils}/lib -L${reiser4progs}/lib"
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "Program which will securely wipe the free space";
     homepage = "https://wipefreespace.sourceforge.io";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ catap ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ kyehn ];
     mainProgram = "wipefreespace";
   };
-}
+})
diff --git a/pkgs/by-name/zg/zgrab2/fix-go-version-error.patch b/pkgs/by-name/zg/zgrab2/fix-go-version-error.patch
deleted file mode 100644
index 797bd542be80..000000000000
--- a/pkgs/by-name/zg/zgrab2/fix-go-version-error.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff --git a/go.mod b/go.mod
-index 888f10e..5463ef5 100644
---- a/go.mod
-+++ b/go.mod
-@@ -1,25 +1,33 @@
- module github.com/zmap/zgrab2
-
--go 1.12
-+go 1.17
-
- require (
--	github.com/cespare/xxhash/v2 v2.2.0 // indirect
--	github.com/go-kit/kit v0.10.0 // indirect
--	github.com/golang/protobuf v1.5.3 // indirect
- 	github.com/hdm/jarm-go v0.0.7
- 	github.com/prometheus/client_golang v1.14.0
--	github.com/prometheus/common v0.42.0 // indirect
--	github.com/prometheus/procfs v0.9.0 // indirect
- 	github.com/sirupsen/logrus v1.9.0
--	github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect
- 	github.com/zmap/zcrypto v0.0.0-20230310154051-c8b263fd8300
- 	github.com/zmap/zflags v1.4.0-beta.1.0.20200204220219-9d95409821b6
- 	golang.org/x/crypto v0.7.0
- 	golang.org/x/net v0.8.0
- 	golang.org/x/sys v0.6.0
- 	golang.org/x/text v0.8.0
--	google.golang.org/protobuf v1.30.0 // indirect
- 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
- 	gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22
- 	gopkg.in/yaml.v2 v2.4.0
- )
-+
-+require (
-+	github.com/beorn7/perks v1.0.1 // indirect
-+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-+	github.com/golang/protobuf v1.5.3 // indirect
-+	github.com/kr/pretty v0.2.1 // indirect
-+	github.com/kr/text v0.1.0 // indirect
-+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-+	github.com/prometheus/client_model v0.3.0 // indirect
-+	github.com/prometheus/common v0.42.0 // indirect
-+	github.com/prometheus/procfs v0.9.0 // indirect
-+	github.com/weppos/publicsuffix-go v0.30.0 // indirect
-+	github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect
-+	google.golang.org/protobuf v1.30.0 // indirect
-+)
diff --git a/pkgs/by-name/zg/zgrab2/package.nix b/pkgs/by-name/zg/zgrab2/package.nix
index c0c510ec5f14..2138dd499696 100644
--- a/pkgs/by-name/zg/zgrab2/package.nix
+++ b/pkgs/by-name/zg/zgrab2/package.nix
@@ -4,41 +4,34 @@
   fetchFromGitHub,
 }:
 
-buildGoModule {
+buildGoModule (finalAttrs: {
   pname = "zgrab2";
-  version = "unstable-2023-03-23";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = "zgrab2";
-    rev = "911c86f13080ceae98f8d63d1ae0e85c4a8f7f61";
-    hash = "sha256-VOWkBM/SziY3jiIaYYWq+LRzG4vKitiscqdIDfRUkYY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9YDrWtSFFzFMN/pp0Kaknie4NMduOb/ZNrP+7MIMT+0=";
   };
 
-  vendorHash = "sha256-Q3FCqvh4vn64QXqcePhVWTyIHJarI6I4YonH3X/7RhI=";
-
-  patches = [
-    # Without this, we get error messages like:
-    # vendor/golang.org/x/sys/unix/syscall.go:83:16: unsafe.Slice requires go1.17 or later (-lang was set to go1.16; check go.mod)
-    # The patch was generated by changing "go 1.12" to "go 1.17" and executing `go mod tidy -compat=1.17`.
-    ./fix-go-version-error.patch
-  ];
+  vendorHash = "sha256-8oidWUtSMMm/QMzrTkH07eyyBhCeZ9SUOO1+h1evbac=";
 
   subPackages = [
     "cmd/zgrab2"
   ];
 
-  meta = with lib; {
-    description = "Web application scanner";
+  meta = {
+    description = "Fast Application Layer Scanner";
     mainProgram = "zgrab2";
     homepage = "https://github.com/zmap/zgrab2";
-    license = with licenses; [
+    license = with lib.licenses; [
       asl20
       isc
     ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       fab
       juliusrickert
     ];
   };
-}
+})
diff --git a/pkgs/development/compilers/dart/package-source-builders/audiotags/Cargo-1.4.1.lock b/pkgs/development/compilers/dart/package-source-builders/audiotags/Cargo-1.4.1.lock
deleted file mode 100644
index dcc5b78fdfa3..000000000000
--- a/pkgs/development/compilers/dart/package-source-builders/audiotags/Cargo-1.4.1.lock
+++ /dev/null
@@ -1,629 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "addr2line"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
-
-[[package]]
-name = "allo-isolate"
-version = "0.1.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f67642eb6773fb42a95dd3b348c305ee18dee6642274c6b412d67e985e3befc"
-dependencies = [
- "anyhow",
- "atomic",
- "backtrace",
- "chrono",
-]
-
-[[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.94"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7"
-
-[[package]]
-name = "atomic"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c59bdb34bc650a32731b31bd8f0829cc15d24a708ee31559e0bb34f2bc320cba"
-
-[[package]]
-name = "audiotags"
-version = "1.4.1"
-dependencies = [
- "anyhow",
- "flutter_rust_bridge",
- "lofty",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
-
-[[package]]
-name = "backtrace"
-version = "0.3.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets",
-]
-
-[[package]]
-name = "bitflags"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
-
-[[package]]
-name = "build-target"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "832133bbabbbaa9fbdba793456a2827627a7d2b8fb96032fa1e7666d7895832b"
-
-[[package]]
-name = "bumpalo"
-version = "3.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
-
-[[package]]
-name = "bytemuck"
-version = "1.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b37c88a63ffd85d15b406896cc343916d7cf57838a847b3a6f2ca5d39a5695a"
-
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
-[[package]]
-name = "cc"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f34d93e62b03caf570cccc334cbc6c2fceca82f39211051345108adcba3eebdc"
-dependencies = [
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "chrono"
-version = "0.4.38"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
-dependencies = [
- "android-tzdata",
- "iana-time-zone",
- "js-sys",
- "num-traits",
- "wasm-bindgen",
- "windows-targets",
-]
-
-[[package]]
-name = "console_error_panic_hook"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a06aeb73f470f66dcdbf7223caeebb85984942f22f1adb2a088cf9668146bbbc"
-dependencies = [
- "cfg-if",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "crc32fast"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "dart-sys"
-version = "4.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57967e4b200d767d091b961d6ab42cc7d0cc14fe9e052e75d0d3cf9eb732d895"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "data-encoding"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
-
-[[package]]
-name = "flate2"
-version = "1.0.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
-[[package]]
-name = "flutter_rust_bridge"
-version = "1.82.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5b3f423054f2fbc74e3dcef394ef3fd7a4f8309265a6b9a6ccf9c0fb07bb14b"
-dependencies = [
- "allo-isolate",
- "anyhow",
- "backtrace",
- "build-target",
- "bytemuck",
- "cc",
- "chrono",
- "console_error_panic_hook",
- "dart-sys",
- "flutter_rust_bridge_macros",
- "js-sys",
- "lazy_static",
- "libc",
- "log",
- "parking_lot",
- "threadpool",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "flutter_rust_bridge_macros"
-version = "1.82.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7fe743d921bedf4578b9472346d03a9643a01cd565ca7df7961baebad534ba5"
-
-[[package]]
-name = "gimli"
-version = "0.31.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.61"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "wasm-bindgen",
- "windows-core",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "js-sys"
-version = "0.3.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a865e038f7f6ed956f788f0d7d60c541fff74c7bd74272c5d4cf15c63743e705"
-dependencies = [
- "once_cell",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-
-[[package]]
-name = "libc"
-version = "0.2.167"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09d6582e104315a817dff97f75133544b2e094ee22447d2acf4a74e189ba06fc"
-
-[[package]]
-name = "lock_api"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "lofty"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f75066eb1d25a7047fb2667edb410ae2592439ed81546f95c28b0a1c7d7d3818"
-dependencies = [
- "byteorder",
- "data-encoding",
- "flate2",
- "lofty_attr",
- "log",
- "ogg_pager",
- "paste",
-]
-
-[[package]]
-name = "lofty_attr"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "764b60e1ddd07e5665a6a17636a95cd7d8f3b86c73503a69c32979d05f72f3cf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "log"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
-
-[[package]]
-name = "memchr"
-version = "2.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
-
-[[package]]
-name = "miniz_oxide"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
-dependencies = [
- "adler2",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
-name = "object"
-version = "0.36.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "ogg_pager"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87b0bef808533c5890ab77279538212efdbbbd9aa4ef1ccdfcfbf77a42f7e6fa"
-dependencies = [
- "byteorder",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
-
-[[package]]
-name = "parking_lot"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-targets",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "rustc-demangle"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "smallvec"
-version = "1.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
-
-[[package]]
-name = "syn"
-version = "2.0.90"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "threadpool"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
-dependencies = [
- "num_cpus",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d15e63b4482863c109d70a7b8706c1e364eb6ea449b201a76c5b89cedcec2d5c"
-dependencies = [
- "cfg-if",
- "once_cell",
- "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d36ef12e3aaca16ddd3f67922bc63e48e953f126de60bd33ccc0101ef9998cd"
-dependencies = [
- "bumpalo",
- "log",
- "once_cell",
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705440e08b42d3e4b36de7d66c944be628d579796b8090bfa3471478a2260051"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98c9ae5a76e46f4deecd0f0255cc223cfa18dc9b261213b8aa0c7b36f61b3f1d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-backend",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ee99da9c5ba11bd675621338ef6fa52296b76b83305e9b6e5c77d4c286d6d49"
-
-[[package]]
-name = "web-sys"
-version = "0.3.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a98bc3c33f0fe7e59ad7cd041b89034fa82a7c2d4365ca538dda6cdaf513863c"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
diff --git a/pkgs/development/compilers/dart/package-source-builders/audiotags/default.nix b/pkgs/development/compilers/dart/package-source-builders/audiotags/default.nix
deleted file mode 100644
index afe240f484aa..000000000000
--- a/pkgs/development/compilers/dart/package-source-builders/audiotags/default.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  stdenv,
-  lib,
-  rustPlatform,
-}:
-
-{ version, src, ... }:
-
-let
-  rustDep = rustPlatform.buildRustPackage rec {
-    pname = "audiotags-rs";
-    inherit version src;
-
-    postPatch = ''
-      cp --no-preserve=mode ${cargoLock.lockFile} Cargo.lock
-    '';
-
-    sourceRoot = "${src.name}/rust";
-
-    cargoLock.lockFile =
-      rec {
-        _1_4_2 = _1_4_1;
-        _1_4_1 = ./Cargo-1.4.1.lock;
-      }
-      .${"_" + (lib.replaceStrings [ "." ] [ "_" ] version)} or (throw ''
-        Unsupported version of pub 'audiotags': '${version}'
-        Please add Cargo.lock here. If the Cargo.lock
-        is the same with existing versions, add an alias here.
-      '');
-
-    doCheck = false; # test failed
-
-    passthru.libraryPath = "lib/libaudiotags.so";
-  };
-in
-stdenv.mkDerivation {
-  pname = "audiotags";
-  inherit version src;
-  inherit (src) passthru;
-
-  postPatch = ''
-    sed -i -e '/if(NOT EXISTS/,/endif()/d' -e '/if(NOT EXISTS/,/endif()/d' ./linux/CMakeLists.txt
-    sed -i 's|.*libaudiotags.so.*|${rustDep}/${rustDep.passthru.libraryPath}|' ./linux/CMakeLists.txt
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-
-    runHook postInstall
-  '';
-}
diff --git a/pkgs/development/compilers/dart/package-source-builders/default.nix b/pkgs/development/compilers/dart/package-source-builders/default.nix
index 3f19d1a21062..c19832506b78 100644
--- a/pkgs/development/compilers/dart/package-source-builders/default.nix
+++ b/pkgs/development/compilers/dart/package-source-builders/default.nix
@@ -1,17 +1,14 @@
 { callPackage }:
 
 {
-  audiotags = callPackage ./audiotags { };
   file_picker = callPackage ./file_picker { };
   flutter_discord_rpc = callPackage ./flutter_discord_rpc { };
   flutter_secure_storage_linux = callPackage ./flutter-secure-storage-linux { };
   flutter_vodozemac = callPackage ./flutter_vodozemac { };
   flutter_volume_controller = callPackage ./flutter_volume_controller { };
-  fvp = callPackage ./fvp { };
   handy_window = callPackage ./handy-window { };
   matrix = callPackage ./matrix { };
   media_kit_libs_linux = callPackage ./media_kit_libs_linux { };
-  metadata_god = callPackage ./metadata_god { };
   olm = callPackage ./olm { };
   objectbox_flutter_libs = callPackage ./objectbox_flutter_libs { };
   pdfrx = callPackage ./pdfrx { };
diff --git a/pkgs/development/compilers/dart/package-source-builders/fvp/default.nix b/pkgs/development/compilers/dart/package-source-builders/fvp/default.nix
deleted file mode 100644
index 4c5c13d12f11..000000000000
--- a/pkgs/development/compilers/dart/package-source-builders/fvp/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  stdenv,
-  mdk-sdk,
-}:
-
-{ version, src, ... }:
-
-stdenv.mkDerivation rec {
-  pname = "fvp";
-  inherit version src;
-  inherit (src) passthru;
-
-  postPatch = ''
-    sed -i 's|.*libc++.so.1.*|${mdk-sdk}/lib/libc++.so.1|' ./linux/CMakeLists.txt
-    substituteInPlace ./linux/CMakeLists.txt \
-      --replace-fail "fvp_setup_deps()" "include(${mdk-sdk}/lib/cmake/FindMDK.cmake)"
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-
-    runHook postInstall
-  '';
-}
diff --git a/pkgs/development/compilers/dart/package-source-builders/metadata_god/default.nix b/pkgs/development/compilers/dart/package-source-builders/metadata_god/default.nix
deleted file mode 100644
index 0fed9828b5f8..000000000000
--- a/pkgs/development/compilers/dart/package-source-builders/metadata_god/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchzip,
-  replaceVars,
-}:
-
-{ version, src, ... }:
-
-let
-  inherit (stdenv.hostPlatform) system;
-  selectSystem =
-    attrs: attrs.${system} or (throw "metadata_god: ${stdenv.hostPlatform.system} is not supported");
-  suffix = selectSystem {
-    x86_64-linux = "linux-x64";
-    aarch64-linux = "linux-arm64";
-  };
-  metadata_god = fetchzip {
-    url = "https://github.com/KRTirtho/frb_plugins/releases/download/metadata_god-v0.5.3/linux.tar.gz";
-    hash = "sha256-ZR/q1dF8w4Yab6dRRiS5ZCChVnoecFUrtGiHXGlll9A=";
-    stripRoot = false;
-  };
-in
-stdenv.mkDerivation {
-  pname = "metadata_god";
-  inherit version src;
-  inherit (src) passthru;
-
-  patches = [
-    (replaceVars ./metadata_god.patch {
-      output_lib = "${metadata_god}/${suffix}/libmetadata_god.so";
-    })
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-
-    runHook postInstall
-  '';
-
-  meta.sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-}
diff --git a/pkgs/development/compilers/dart/package-source-builders/metadata_god/metadata_god.patch b/pkgs/development/compilers/dart/package-source-builders/metadata_god/metadata_god.patch
deleted file mode 100644
index 230be8693e5b..000000000000
--- a/pkgs/development/compilers/dart/package-source-builders/metadata_god/metadata_god.patch
+++ /dev/null
@@ -1,33 +0,0 @@
---- old/linux/CMakeLists.txt	2024-11-30 12:48:42.346266052 +0000
-+++ new/linux/CMakeLists.txt	2024-11-30 12:50:45.495928529 +0000
-@@ -9,29 +9,10 @@
- set(PROJECT_NAME "metadata_god")
- project(${PROJECT_NAME} LANGUAGES CXX)
- 
--# Download the binaries if they are not already present.
--set(LibRoot "${CMAKE_CURRENT_SOURCE_DIR}/${LibraryVersion}")
--set(ArchivePath "${LibRoot}.tar.gz")
--if(NOT EXISTS ${ArchivePath})
--  file(DOWNLOAD
--    "https://github.com/KRTirtho/metadata_god/releases/download/${LibraryVersion}/other.tar.gz"
--    ${ArchivePath}
--    TLS_VERIFY ON
--  )
--endif()
--
--# Extract the binaries, overriding any already present.
--file(REMOVE_RECURSE ${LibRoot})
--file(MAKE_DIRECTORY ${LibRoot})
--execute_process(
--  COMMAND ${CMAKE_COMMAND} -E tar xzf ${ArchivePath}
--  WORKING_DIRECTORY ${LibRoot}
--)
--
- # List of absolute paths to libraries that should be bundled with the plugin.
- # This list could contain prebuilt libraries, or libraries created by an
- # external build triggered from this build file.
- set(metadata_god_bundled_libraries
--  "${LibRoot}/${FLUTTER_TARGET_PLATFORM}/libmetadata_god.so"
-+  @output_lib@
-   PARENT_SCOPE
- )
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index de99df185d52..ab515f712110 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -33,9 +33,9 @@ let
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.0-rc3".officialRelease.sha256 = "sha256-quZuqDIm8OrkDJqu7vJKUP8MF1xCuQNFwW9SnKMFoS8=";
     "22.0.0-git".gitRelease = {
-      rev = "b121cdfe197f7d684723b432c766820ab172a7a8";
-      rev-version = "22.0.0-unstable-2025-08-24";
-      sha256 = "sha256-SHR+xoaGlGMp1eqwDyDxdQjjjgbG3UNsDq+wrp2y1Y8=";
+      rev = "0b42e117c829c6e127ef4b1bd82807ba01853128";
+      rev-version = "22.0.0-unstable-2025-08-31";
+      sha256 = "sha256-rClCPbTYqw0ZO9dJqJn3bqtuu9yxwcEfJs3vAW2xjAc=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/libraries/qtpbfimageplugin/default.nix b/pkgs/development/libraries/qtpbfimageplugin/default.nix
index d69a009f30e4..324dbded0267 100644
--- a/pkgs/development/libraries/qtpbfimageplugin/default.nix
+++ b/pkgs/development/libraries/qtpbfimageplugin/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtpbfimageplugin";
-  version = "4.5";
+  version = "4.7";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "QtPBFImagePlugin";
     tag = version;
-    hash = "sha256-uhlm2ELRsWwm2V87ANKT9LdhUdlbfu1I8K98npryq2I=";
+    hash = "sha256-XcHfzBMLCP5ScGz1COpl+kYXzEZATYqvhDfKVS7ona4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ase/default.nix b/pkgs/development/python-modules/ase/default.nix
index 979cebb0d666..142a1691e235 100644
--- a/pkgs/development/python-modules/ase/default.nix
+++ b/pkgs/development/python-modules/ase/default.nix
@@ -3,8 +3,6 @@
   stdenv,
   fetchFromGitLab,
   buildPythonPackage,
-  isPy27,
-  fetchPypi,
   pythonAtLeast,
 
   # build-system
@@ -29,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "ase";
-  version = "3.25.0-unstable-2025-06-24";
+  version = "3.26.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "ase";
     repo = "ase";
-    rev = "4e22dabfbe7ae2329e50260ca1b6f08a83527ac3";
-    hash = "sha256-ehMyVtPxfTxT8T418VyLGnUEyYip4LPTTaGL0va7qgM=";
+    tag = version;
+    hash = "sha256-1738NQPgOqSr2PZu1T2b9bL0V+ZzGk2jcWBhLF21VQs=";
   };
 
   build-system = [ setuptools ];
@@ -79,7 +77,8 @@ buildPythonPackage rec {
 
   meta = {
     description = "Atomic Simulation Environment";
-    homepage = "https://wiki.fysik.dtu.dk/ase/";
+    homepage = "https://ase-lib.org/";
+    changelog = "https://ase-lib.org/releasenotes.html";
     license = lib.licenses.lgpl21Plus;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/atproto/default.nix b/pkgs/development/python-modules/atproto/default.nix
index 21f11272df1b..f5f812458bc3 100644
--- a/pkgs/development/python-modules/atproto/default.nix
+++ b/pkgs/development/python-modules/atproto/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "atproto";
-  version = "0.0.61";
+  version = "0.0.62";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "MarshalX";
     repo = "atproto";
     tag = "v${version}";
-    hash = "sha256-90u/ew5j6kRU8Mow/dXTUXpv2FbEFpKRPGoaWQ7gvSA=";
+    hash = "sha256-T1Jdg62fSV+5qC486Agsuk6qrDhGSNHq75uvOyvOwpA=";
   };
 
   POETRY_DYNAMIC_VERSIONING_BYPASS = version;
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 0a95cb4817a1..7609aaf09d93 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.40.20";
+  version = "1.40.21";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-Wv2WCM7csPgJOcL+i8J3vAi8V0OlrtdiaMozyc7G9X0=";
+    hash = "sha256-7zb2XH/ob/vJPBQY+okEgDzjvP/DyTLD0a4zqdAvoc0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 4fbae283d8cb..cd38dad91fb6 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.38.46";
+  version = "1.40.21";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-oE5pdmq4uuM4kRwYl0kviNBc1InNdfBubrTxNfnajHs=";
+    hash = "sha256-Gld35OTwM17X0xhbDypVwfxeoeYP4mTN6lGhccOwsBE=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/braintree/default.nix b/pkgs/development/python-modules/braintree/default.nix
index 8d77e6a9953c..259e835ab7f7 100644
--- a/pkgs/development/python-modules/braintree/default.nix
+++ b/pkgs/development/python-modules/braintree/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "braintree";
-  version = "4.29.0";
+  version = "4.38.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "braintree";
     repo = "braintree_python";
     rev = version;
-    hash = "sha256-5MF8W2zUVvNiOnmszgJkMDmeYLZ6ppFHqmH6dmlCzQY=";
+    hash = "sha256-cAzqHMkEWaLXHbPUnkyFF5UD43rPk6txRSB2n9NJLTE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/chirpstack-api/default.nix b/pkgs/development/python-modules/chirpstack-api/default.nix
index 1d8cd789b3e1..6bb2751a9c5b 100644
--- a/pkgs/development/python-modules/chirpstack-api/default.nix
+++ b/pkgs/development/python-modules/chirpstack-api/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "chirpstack-api";
-  version = "3.12.4";
+  version = "3.12.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "brocaar";
     repo = "chirpstack-api";
     rev = "v${version}";
-    hash = "sha256-69encHMk0eXE2Av87ysKvxoiXog5o68qCUlOx/lgHFU=";
+    hash = "sha256-TDwvUNnGAbt10lLg6U7q+JMg7uu8TLySYqNyt/uk8UY=";
   };
 
   sourceRoot = "${src.name}/python/src";
diff --git a/pkgs/development/python-modules/django-currentuser/default.nix b/pkgs/development/python-modules/django-currentuser/default.nix
index d8fa83aaa89b..d64d8093ba0e 100644
--- a/pkgs/development/python-modules/django-currentuser/default.nix
+++ b/pkgs/development/python-modules/django-currentuser/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "django-currentuser";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "zsoldosp";
     repo = "django-currentuser";
     tag = "v${version}";
-    hash = "sha256-buWYVl/nGxzoaDgA6Ds2R/AhGTYpi9JxxO0ER8Vuly4=";
+    hash = "sha256-pfgsVsWM/aehZZAQzjL1fdsqWlfnquOniu76UoLPREI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-otp/default.nix b/pkgs/development/python-modules/django-otp/default.nix
index dbcdff2dd04d..907e3180d0f0 100644
--- a/pkgs/development/python-modules/django-otp/default.nix
+++ b/pkgs/development/python-modules/django-otp/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-otp";
-  version = "1.6.0";
+  version = "1.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-otp";
     repo = "django-otp";
     tag = "v${version}";
-    hash = "sha256-kK7aU2W89557vrzJF6XtmItIZlOsxibciyMlbRDT93c=";
+    hash = "sha256-//i2KSsrkofcNE2JUlIG9zPCe/cIzBo/zmueC4I5g7I=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/dscribe/default.nix b/pkgs/development/python-modules/dscribe/default.nix
index 658b5dd45044..51d7a9498506 100644
--- a/pkgs/development/python-modules/dscribe/default.nix
+++ b/pkgs/development/python-modules/dscribe/default.nix
@@ -79,6 +79,17 @@ buildPythonPackage rec {
     "test_examples"
   ];
 
+  # Broken due to use of missing _get_constraints attr in ase >= 3.26.0
+  # https://github.com/SINGROUP/dscribe/issues/160
+  disabledTestPaths = [
+    "tests/test_examples.py::test_examples"
+    "tests/test_general.py::test_atoms_to_system"
+    "tests/test_lmbtr.py"
+    "tests/test_mbtr.py"
+    "tests/test_sinematrix.py"
+    "tests/test_valle_oganov.py"
+  ];
+
   meta = {
     description = "Machine learning descriptors for atomistic systems";
     homepage = "https://github.com/SINGROUP/dscribe";
diff --git a/pkgs/development/python-modules/jianpu-ly/default.nix b/pkgs/development/python-modules/jianpu-ly/default.nix
index 5d2ce747b8a6..53efb8deb78c 100644
--- a/pkgs/development/python-modules/jianpu-ly/default.nix
+++ b/pkgs/development/python-modules/jianpu-ly/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "jianpu-ly";
-  version = "1.860";
+  version = "1.862";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "jianpu_ly";
-    hash = "sha256-lUsQMNYQVuZ0Ob007hrSigGLWuyFehLEdm112V3PLXI=";
+    hash = "sha256-lrJVepMtdeHti+zmHiTP578aVedWj9N+s74xif1U9UM=";
   };
 
   dependencies = [ lilypond ];
diff --git a/pkgs/development/python-modules/lm-format-enforcer/default.nix b/pkgs/development/python-modules/lm-format-enforcer/default.nix
index 2086dcc17e90..339c062244c7 100644
--- a/pkgs/development/python-modules/lm-format-enforcer/default.nix
+++ b/pkgs/development/python-modules/lm-format-enforcer/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "lm-format-enforcer";
-  version = "0.10.12";
+  version = "0.11.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "noamgat";
     repo = "lm-format-enforcer";
     tag = "v${version}";
-    hash = "sha256-7QNJtuRIuHHSXmiyO+6TDxswsbLET2ucXjhz0j7xTvQ=";
+    hash = "sha256-aUZo7Nlk5A9SRyQFFGhy3LAJO29ygRFwNC4WbRuXvYE=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
index ac686c4f7018..b35b48626644 100644
--- a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-mermaid2-plugin";
-  version = "1.2.1";
+  version = "1.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "fralau";
     repo = "mkdocs-mermaid2-plugin";
     tag = "v${version}";
-    hash = "sha256-LKPjhCPozz/+UV2658qWOIjpMt6w+UDBXsg1fqyg48M=";
+    hash = "sha256-4WuE9fO4o0uN48W2Rwd4gKa6pK9bqyrcGjFLEkfJ0E4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index da0382599f6c..2cf6fab1e8ac 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -446,8 +446,8 @@ rec {
       "sha256-jtkx0kbI7SB74U5uWyGdVhKMlsy/T82lz3P89k8LMPA=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.40.20"
-      "sha256-6TBiPxpWzoFP8cKp/p/EpJCpi5gr3aIwJ29S7WkPwio=";
+    buildMypyBoto3Package "ec2" "1.40.21"
+      "sha256-Qyut3NPzxS/3A0ntPzzTmPQyldtKetrBdV0Rx6KJGjY=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.40.20"
@@ -1433,6 +1433,6 @@ rec {
       "sha256-1Nm+3yAqMg/qtpdxae2etPehfszBq454U/U/1ClPeGg=";
 
   mypy-boto3-xray =
-    buildMypyBoto3Package "xray" "1.40.20"
-      "sha256-aVMF1bPs5T/MWpb3ZVhDvrdVmAQIoOr7T+EIs980m+c=";
+    buildMypyBoto3Package "xray" "1.40.21"
+      "sha256-vYgKyQDj823W9FAZST7H3hxCAdqeUM2TRSaDTLMObqs=";
 }
diff --git a/pkgs/development/python-modules/pbxproj/default.nix b/pkgs/development/python-modules/pbxproj/default.nix
index 729149ad1260..74906b1414c7 100644
--- a/pkgs/development/python-modules/pbxproj/default.nix
+++ b/pkgs/development/python-modules/pbxproj/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pbxproj";
-  version = "4.2.1";
+  version = "4.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kronenthaler";
     repo = "mod-pbxproj";
     tag = version;
-    hash = "sha256-srtS6ggVnpffEa57LL2OzfC2mVd9uLxUL6LzxqPVLdo=";
+    hash = "sha256-A7kYjlMr0PDZHdZLhs7Mn2Ihx0XKQUbVaRgWcMoWM7E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/plexapi/default.nix b/pkgs/development/python-modules/plexapi/default.nix
index ca6f20418c2f..479357fa3f15 100644
--- a/pkgs/development/python-modules/plexapi/default.nix
+++ b/pkgs/development/python-modules/plexapi/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "plexapi";
-  version = "4.17.0";
+  version = "4.17.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "pkkid";
     repo = "python-plexapi";
     tag = version;
-    hash = "sha256-/CYWoEHmev5e5ZmlaBms1zclRwzvugAuG2JXzK9MeZA=";
+    hash = "sha256-INnZ8aklr6mvawEy2XgI8mA9UD+S2KpQTsbHAZuYii0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pykdtree/default.nix b/pkgs/development/python-modules/pykdtree/default.nix
index 1e311b580ebf..8577a695af11 100644
--- a/pkgs/development/python-modules/pykdtree/default.nix
+++ b/pkgs/development/python-modules/pykdtree/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "pykdtree";
-  version = "1.4.2";
+  version = "1.4.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vSuWehalUQ76hz7lLZWdDYITicx0m7UWc65oMW7rZfU=";
+    hash = "sha256-2Rh5MP+4yCLFJZW2SUi0c0ZpTuKknicCQgtY90PXhvU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-ctags3/default.nix b/pkgs/development/python-modules/python-ctags3/default.nix
index 6cd18c5b97f0..3f00bbcd783a 100644
--- a/pkgs/development/python-modules/python-ctags3/default.nix
+++ b/pkgs/development/python-modules/python-ctags3/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "python-ctags3";
-  version = "1.5.0";
+  version = "1.6.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "universal-ctags";
     repo = "python-ctags3";
     rev = version;
-    hash = "sha256-XVsZckNVJ1H5q8FzqoVd1UWRw0zOygvRtb7arX9dwGE=";
+    hash = "sha256-x+kyCB05VtOPlenkK5vOTjxXR24d436JpGvSd07PIbA=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/python-youtube/default.nix b/pkgs/development/python-modules/python-youtube/default.nix
index 0a335053af47..52e10747b98b 100644
--- a/pkgs/development/python-modules/python-youtube/default.nix
+++ b/pkgs/development/python-modules/python-youtube/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "python-youtube";
-  version = "0.9.7";
+  version = "0.9.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sns-sdks";
     repo = "python-youtube";
     tag = "v${version}";
-    hash = "sha256-dK0le/7/hpavrHbk4DaXoIxPHUUJuWuxHIWMZKC4eSM=";
+    hash = "sha256-8Ozfga6gPLzPG770hluAgxIYI2TEX5uAe6BeMzIp+z4=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pywikibot/default.nix b/pkgs/development/python-modules/pywikibot/default.nix
index 9375756f4eb2..5e64f1aea635 100644
--- a/pkgs/development/python-modules/pywikibot/default.nix
+++ b/pkgs/development/python-modules/pywikibot/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pywikibot";
-  version = "10.3.0";
+  version = "10.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QXgv++Vr2HYzoAAwk2eVg/EnKqX9EFUJo6OBHvlYbjQ=";
+    hash = "sha256-3mBcGhUeKggdOdhYUa4bwthIpHBdCRi10T+onHhavtk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/qreactor/default.nix b/pkgs/development/python-modules/qreactor/default.nix
index cd644587e33e..edb9b90a941d 100644
--- a/pkgs/development/python-modules/qreactor/default.nix
+++ b/pkgs/development/python-modules/qreactor/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage {
   pname = "qreactor-unstable";
-  version = "2018-09-29";
+  version = "0.6.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/rfc3161-client/default.nix b/pkgs/development/python-modules/rfc3161-client/default.nix
index c856873549d5..d1929086a19f 100644
--- a/pkgs/development/python-modules/rfc3161-client/default.nix
+++ b/pkgs/development/python-modules/rfc3161-client/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "rfc3161-client";
-  version = "1.0.3";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = "rfc3161-client";
     tag = "v${version}";
-    hash = "sha256-1TdJGaiDS+ktmry0c294likWj8bbwaNkcUM7Q2f1YPU=";
+    hash = "sha256-/+vKpd7wLFa7BgczzI27fLykxq5q4q1PC3QpoAO2E7M=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/python-modules/sparsezoo/default.nix b/pkgs/development/python-modules/sparsezoo/default.nix
deleted file mode 100644
index 47333d8710fe..000000000000
--- a/pkgs/development/python-modules/sparsezoo/default.nix
+++ /dev/null
@@ -1,121 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-
-  # build-system
-  setuptools,
-
-  # dependencies
-  click,
-  geocoder,
-  numpy,
-  onnx,
-  pandas,
-  protobuf,
-  py-machineid,
-  pydantic,
-  pyyaml,
-  requests,
-  tqdm,
-
-  # checks
-  matplotlib,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "sparsezoo";
-  version = "1.9.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "neuralmagic";
-    repo = "sparsezoo";
-    tag = "v${version}";
-    hash = "sha256-eMP/whm06QX5x/RBoYsYwuKxFnpFmqlgh2uDsI3Vaog=";
-  };
-
-  build-system = [ setuptools ];
-
-  pythonRelaxDeps = [
-    "numpy"
-    "onnx"
-  ];
-
-  dependencies = [
-    click
-    geocoder
-    numpy
-    onnx
-    pandas
-    protobuf
-    py-machineid
-    pydantic
-    pyyaml
-    requests
-    tqdm
-  ];
-
-  pythonImportsCheck = [ "sparsezoo" ];
-
-  nativeCheckInputs = [
-    matplotlib
-    pytestCheckHook
-  ];
-
-  disabledTests = [
-    # Require network access
-    "test_analysis"
-    "test_custom_default"
-    "test_draw_operation_chart"
-    "test_draw_parameter_chart"
-    "test_draw_parameter_operation_combined_chart"
-    "test_draw_sparsity_by_layer_chart"
-    "test_extract_node_id"
-    "test_fail_default_on_empty"
-    "test_folder_structure"
-    "test_from_model_analysis"
-    "test_generate_outputs"
-    "test_get_layer_and_op_counts"
-    "test_get_node_bias"
-    "test_get_node_bias_name"
-    "test_get_node_four_block_sparsity"
-    "test_get_node_num_four_block_zeros_and_size"
-    "test_get_node_num_zeros_and_size"
-    "test_get_node_sparsity"
-    "test_get_node_weight_and_shape"
-    "test_get_node_weight_name"
-    "test_get_ops_dict"
-    "test_get_zero_point"
-    "test_graphql_api_response"
-    "test_is_four_block_sparse_layer"
-    "test_is_parameterized_prunable_layer"
-    "test_is_quantized_layer"
-    "test_is_sparse_layer"
-    "test_latency_extractor"
-    "test_load_files_from_stub"
-    "test_model_from_stub"
-    "test_model_gz_extraction_from_local_files"
-    "test_model_gz_extraction_from_stub"
-    "test_recipe_getters"
-    "test_search_models"
-    "test_setup_model_from_objects"
-    "test_setup_model_from_paths"
-    "test_validate"
-  ];
-
-  disabledTestPaths = [
-    # Require network access
-    "tests/sparsezoo/analyze/test_model_analysis_creation.py"
-    "tests/sparsezoo/deployment_package/utils/test_utils.py"
-  ];
-
-  meta = {
-    description = "Neural network model repository for highly sparse and sparse-quantized models with matching sparsification recipes";
-    homepage = "https://github.com/neuralmagic/sparsezoo";
-    changelog = "https://github.com/neuralmagic/sparsezoo/releases/tag/${src.tag}";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ GaetanLepage ];
-  };
-}
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 0cdffbb73cd0..6f7102714e27 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1452";
+  version = "3.0.1453";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-MNzrMy6j1lPtLGx9PIc1I4xPn1s9Nx9WnFC5UYg2/Ds=";
+    hash = "sha256-KjnRpoRiZ1+BrBW4JANcRWTdMzl0Vds5p4x1hJBWh7s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/textual/default.nix b/pkgs/development/python-modules/textual/default.nix
index a21583c5c4c2..3fc8df094993 100644
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "textual";
-  version = "5.3.0";
+  version = "6.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Textualize";
     repo = "textual";
     tag = "v${version}";
-    hash = "sha256-J7Sb4nv9wOl1JnR6Ky4XS9HZHABKtNKPB3uYfC/UGO4=";
+    hash = "sha256-VpZeK0/SATL+XFDkPQgWwUIsJ4Kgqg0PQ4VzNYp4nPU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/wgnlpy/default.nix b/pkgs/development/python-modules/wgnlpy/default.nix
index b1eed14963bf..2865888d2800 100644
--- a/pkgs/development/python-modules/wgnlpy/default.nix
+++ b/pkgs/development/python-modules/wgnlpy/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   setuptools,
   cryptography,
   pyroute2,
@@ -19,6 +20,16 @@ buildPythonPackage rec {
     hash = "sha256-5XAfBiKx4SqouA57PxmaCb0ea7mT2VeUI1tgnQE/ZwQ=";
   };
 
+  patches = [
+    # see https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/83019
+    # Required for ifstate
+    # Upstream Issue/PR: https://github.com/ArgosyLabs/wgnlpy/pull/5
+    (fetchpatch {
+      url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/1f78a31dc3e8d7ffd4ff4b8c32fabc3ad0265ae2/community/py3-wgnlpy/0001-fix-exception-when-WGPEER_A_LAST_HANDSHAKE_TIME-is-N.patch";
+      hash = "sha256-MO5MMDXnaCPdakMlxCkiCBCDCiTFdG3V66l+AKb95X4=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/os-specific/linux/drbd/driver.nix b/pkgs/os-specific/linux/drbd/driver.nix
index c2e81f7864c8..dadfeb107d0d 100644
--- a/pkgs/os-specific/linux/drbd/driver.nix
+++ b/pkgs/os-specific/linux/drbd/driver.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drbd";
-  version = "9.2.12";
+  version = "9.2.14";
 
   src = fetchurl {
     url = "https://pkg.linbit.com//downloads/drbd/9/drbd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-amdcyPTynGTaaZh558Q3KnGuGyyLJKnsY+NBCO26Jq0=";
+    hash = "sha256-x8onWPTyBnKt17xofivVlU+42nq1XtCo9i14kSOSd98=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -57,5 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
       DRBD is a software-based, shared-nothing, replicated storage solution
       mirroring the content of block devices (hard disks, partitions, logical volumes, and so on) between hosts.
     '';
+    broken = kernel.kernelAtLeast "6.16"; # several build errors with 6.16.x kernel versions
   };
 })
diff --git a/pkgs/servers/home-assistant/custom-components/frigate/package.nix b/pkgs/servers/home-assistant/custom-components/frigate/package.nix
index eb9c379f5d06..7f701a6aee4b 100644
--- a/pkgs/servers/home-assistant/custom-components/frigate/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/frigate/package.nix
@@ -18,13 +18,13 @@
 buildHomeAssistantComponent rec {
   owner = "blakeblackshear";
   domain = "frigate";
-  version = "5.9.3";
+  version = "5.9.4";
 
   src = fetchFromGitHub {
     owner = "blakeblackshear";
     repo = "frigate-hass-integration";
     tag = "v${version}";
-    hash = "sha256-kbhDZbyNVct0GDhIr7mKyeVIkyV+Gc/gzbKnnv1FcQg=";
+    hash = "sha256-LzrIvHJMB6mFAEfKoMIs0wL+xbEjoBIx48pSEcCHmg4=";
   };
 
   dependencies = [ hass-web-proxy-lib ];
diff --git a/pkgs/servers/mail/mailpit/source.nix b/pkgs/servers/mail/mailpit/source.nix
deleted file mode 100644
index e5093231e455..000000000000
--- a/pkgs/servers/mail/mailpit/source.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  version = "1.26.0";
-  hash = "sha256-nhtPK4QuifX/1cwGcrOrTLy8KQCa6+qPSyYsjIUCafs=";
-  npmDepsHash = "sha256-B3vBbEnAIQXDHxZpTROkH7ojBaf6+2kKFQm7d9g5liQ=";
-  vendorHash = "sha256-EuAfLKIk96gtqCwKqeoGpnzR6OgxrWVMda9VQFM5DRg=";
-}
diff --git a/pkgs/servers/sql/postgresql/ext/pg_csv.nix b/pkgs/servers/sql/postgresql/ext/pg_csv.nix
new file mode 100644
index 000000000000..89629c97b2f9
--- /dev/null
+++ b/pkgs/servers/sql/postgresql/ext/pg_csv.nix
@@ -0,0 +1,27 @@
+{
+  fetchFromGitHub,
+  lib,
+  postgresql,
+  postgresqlBuildExtension,
+}:
+
+postgresqlBuildExtension (finalAttrs: {
+  pname = "pg_csv";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "PostgREST";
+    repo = "pg_csv";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Sw9eMpzz+suotJQ2KHgT0dQAF8OGFojJIhOC8tZ750o=";
+  };
+
+  meta = {
+    description = "Flexible CSV processing for Postgres";
+    homepage = "https://github.com/PostgREST/pg_csv";
+    changelog = "https://github.com/PostgREST/pg_csv/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ steve-chavez ];
+    platforms = postgresql.meta.platforms;
+    license = lib.licenses.mit;
+  };
+})
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 5ab965e908d0..0ce59e8467bb 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -164,6 +164,20 @@ lib.makeExtensible (
 
       nix_2_30 = addTests "nix_2_30" self.nixComponents_2_30.nix-everything;
 
+      nixComponents_2_31 = nixDependencies.callPackage ./modular/packages.nix rec {
+        version = "2.31.0";
+        inherit (self.nix_2_30.meta) maintainers teams;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_31";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          tag = version;
+          hash = "sha256-5JYyijH2q/uQCDIZCCyQEBsZ0VPNP2SS1wgZ4+qeIWM=";
+        };
+      };
+
+      nix_2_31 = addTests "nix_2_31" self.nixComponents_2_31.nix-everything;
+
       nixComponents_git = nixDependencies.callPackage ./modular/packages.nix rec {
         version = "2.31pre20250712_${lib.substring 0 8 src.rev}";
         inherit maintainers teams;
diff --git a/pkgs/tools/package-management/nix/dependencies.nix b/pkgs/tools/package-management/nix/dependencies.nix
index a00078939ab7..82f844f82887 100644
--- a/pkgs/tools/package-management/nix/dependencies.nix
+++ b/pkgs/tools/package-management/nix/dependencies.nix
@@ -8,7 +8,20 @@ regular@{
 
 {
   scopeFunction = scope: {
-    boehmgc = regular.boehmgc.override { enableLargeConfig = true; };
+    boehmgc =
+      (regular.boehmgc.override {
+        enableLargeConfig = true;
+      }).overrideAttrs
+        (attrs: {
+          # Increase the initial mark stack size to avoid stack
+          # overflows, since these inhibit parallel marking (see
+          # GC_mark_some()). To check whether the mark stack is too
+          # small, run Nix with GC_PRINT_STATS=1 and look for messages
+          # such as `Mark stack overflow`, `No room to copy back mark
+          # stack`, and `Grew mark stack to ... frames`.
+          NIX_CFLAGS_COMPILE = "-DINITIAL_MARK_STACK_SIZE=1048576";
+        });
+
     aws-sdk-cpp =
       (regular.aws-sdk-cpp.override {
         apis = [
diff --git a/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
index 132e4c1da99b..87407e9579d0 100644
--- a/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
@@ -3,6 +3,7 @@
   buildPackages,
   stdenv,
   mkMesonExecutable,
+  writableTmpDirAsHomeHook,
 
   nix-fetchers,
   nix-fetchers-c,
@@ -47,18 +48,13 @@ mkMesonExecutable (finalAttrs: {
         runCommand "${finalAttrs.pname}-run"
           {
             meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
           }
-          (
-            lib.optionalString stdenv.hostPlatform.isWindows ''
-              export HOME="$PWD/home-dir"
-              mkdir -p "$HOME"
-            ''
-            + ''
-              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
-              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-              touch $out
-            ''
-          );
+          ''
+            export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+            ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+            touch $out
+          '';
     };
   };
 
diff --git a/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix
index 93429e53812b..ed1b51bda304 100644
--- a/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix
@@ -3,6 +3,7 @@
   buildPackages,
   stdenv,
   mkMesonExecutable,
+  writableTmpDirAsHomeHook,
 
   nix-flake,
   nix-flake-c,
@@ -41,19 +42,14 @@ mkMesonExecutable (finalAttrs: {
         runCommand "${finalAttrs.pname}-run"
           {
             meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
           }
-          (
-            lib.optionalString stdenv.hostPlatform.isWindows ''
-              export HOME="$PWD/home-dir"
-              mkdir -p "$HOME"
-            ''
-            + ''
-              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
-              export NIX_CONFIG="extra-experimental-features = flakes"
-              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-              touch $out
-            ''
-          );
+          (''
+            export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+            export NIX_CONFIG="extra-experimental-features = flakes"
+            ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+            touch $out
+          '');
     };
   };
 
diff --git a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
index be9a51a784d2..47e3128ec1a2 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
@@ -3,6 +3,7 @@
   buildPackages,
   stdenv,
   mkMesonExecutable,
+  writableTmpDirAsHomeHook,
 
   nix-store,
   nix-store-c,
@@ -41,6 +42,10 @@ mkMesonExecutable (finalAttrs: {
   mesonFlags = [
   ];
 
+  excludedTestPatterns = lib.optionals (lib.versionOlder finalAttrs.version "2.31") [
+    "nix_api_util_context.nix_store_real_path_binary_cache"
+  ];
+
   passthru = {
     tests = {
       run =
@@ -58,18 +63,15 @@ mkMesonExecutable (finalAttrs: {
         runCommand "${finalAttrs.pname}-run"
           {
             meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
           }
-          (
-            lib.optionalString stdenv.hostPlatform.isWindows ''
-              export HOME="$PWD/home-dir"
-              mkdir -p "$HOME"
-            ''
-            + ''
-              export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
-              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-              touch $out
-            ''
-          );
+          (''
+            export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
+            export NIX_REMOTE=$HOME/store
+            ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage} \
+              --gtest_filter=-${lib.concatStringsSep ":" finalAttrs.excludedTestPatterns}
+            touch $out
+          '');
     };
   };
 
diff --git a/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix b/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
index 1642cfbd3e65..a2eefc98390e 100644
--- a/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGhidraExtension (finalAttrs: {
   pname = "findcrypt";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "antoniovazquezblanco";
     repo = "GhidraFindcrypt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3QLIXxUSDGhO4lrH5ib0iWnqXB2dbOqduUMbM1gFW14=";
+    hash = "sha256-KP6Wx2U8O/37yEAcV3abKg/uWraHJJOIfb7kvcfejHA=";
   };
 
   meta = {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cad46f0b65f4..146abbcd8b0a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3574,9 +3574,6 @@ with pkgs;
     };
   };
   mailnagWithPlugins = mailnag.withPlugins (builtins.attrValues mailnag.availablePlugins);
-  mailpit = callPackage ../servers/mail/mailpit {
-    libtool = if stdenv.hostPlatform.isDarwin then cctools else libtool;
-  };
 
   man = man-db;
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 496ad4d5c560..074304ed4eaf 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -768,6 +768,7 @@ mapAliases ({
   spacy_models = spacy-models; # added 2024-04-21
   SPARQLWrapper = sparqlwrapper;
   spark_parser = spark-parser; # added 2024-01-07
+  sparsezoo = throw "sparsezoo has been removed since it is abandonned"; # added 2025-09-01
   sphinx-jquery = sphinxcontrib-jquery; # added 2023-02-24
   sphinx_pypi_upload = throw "sphinx_pypi_upload has been removed since it is abandoned."; # added 2023-10-11
   sphinx_rtd_theme = sphinx-rtd-theme; # added 2022-08-03
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bfc1caadaab6..da806ed6a494 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17062,8 +17062,6 @@ self: super: with self; {
 
   sparse = callPackage ../development/python-modules/sparse { };
 
-  sparsezoo = callPackage ../development/python-modules/sparsezoo { };
-
   spatial-image = callPackage ../development/python-modules/spatial-image { };
 
   spatialmath-python = callPackage ../development/python-modules/spatialmath-python { };