diff --git a/lib/modules.nix b/lib/modules.nix
index a78bd1a92488..e545f9c9707d 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1147,6 +1147,9 @@ let
         instead of:
 
           baseType // { check = value: /* your check */; }
+
+        Alternatively, this message may also occur as false positive when mixing Nixpkgs
+        versions, if one Nixpkgs is between 83fed2e6..58696117 (Aug 28 - Oct 28 2025)
       '';
 
   # Merge definitions of a value of a given type.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3e2830daa83a..03079082278c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23255,6 +23255,12 @@
     github = "scd31";
     githubId = 57571338;
   };
+  SchahinRohani = {
+    email = "schahin@rouhanizadeh.de";
+    github = "SchahinRohani";
+    githubId = 24507823;
+    name = "Schahin Rouhanizadeh";
+  };
   schinmai-akamai = {
     email = "schinmai@akamai.com";
     github = "tchinmai7";
diff --git a/nixos/lib/make-multi-disk-zfs-image.nix b/nixos/lib/make-multi-disk-zfs-image.nix
index cbb2fdf7b6c5..55e54b3b2f0d 100644
--- a/nixos/lib/make-multi-disk-zfs-image.nix
+++ b/nixos/lib/make-multi-disk-zfs-image.nix
@@ -126,6 +126,7 @@ let
     with config.boot;
     [
       kernelPackages.kernel
+      (lib.getOutput "modules" kernelPackages.kernel)
       kernelPackages.${pkgs.zfs.kernelModuleAttribute}
     ]
   );
diff --git a/nixos/lib/make-single-disk-zfs-image.nix b/nixos/lib/make-single-disk-zfs-image.nix
index 74cbaaa7edfe..dbd68a768847 100644
--- a/nixos/lib/make-single-disk-zfs-image.nix
+++ b/nixos/lib/make-single-disk-zfs-image.nix
@@ -114,6 +114,7 @@ let
     with config.boot;
     [
       kernelPackages.kernel
+      (lib.getOutput "modules" kernelPackages.kernel)
       kernelPackages.${pkgs.zfs.kernelModuleAttribute}
     ]
   );
diff --git a/nixos/modules/virtualisation/google-compute-image.nix b/nixos/modules/virtualisation/google-compute-image.nix
index e1021c755aea..305758756a38 100644
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@@ -57,6 +57,12 @@ in
       '';
     };
 
+    virtualisation.googleComputeImage.buildMemSize = mkOption {
+      type = types.int;
+      default = 1024;
+      description = "Memory size (in MiB) for the temporary VM used to build the image.";
+    };
+
     virtualisation.googleComputeImage.contents = mkOption {
       type = with types; listOf attrs;
       default = [ ];
@@ -129,6 +135,7 @@ in
       inherit (cfg) contents;
       partitionTableType = if cfg.efi then "efi" else "legacy";
       inherit (config.virtualisation) diskSize;
+      memSize = cfg.buildMemSize;
       inherit config lib pkgs;
     };
 
diff --git a/nixos/tests/web-servers/h2o/basic.nix b/nixos/tests/web-servers/h2o/basic.nix
index 622bb96929bf..6c8c863475c0 100644
--- a/nixos/tests/web-servers/h2o/basic.nix
+++ b/nixos/tests/web-servers/h2o/basic.nix
@@ -8,11 +8,6 @@ let
     TLS = "acme.test";
   };
 
-  port = {
-    HTTP = 8080;
-    TLS = 8443;
-  };
-
   sawatdi_chao_lok = "สวัสดีชาวโลก";
 
   hello_world_txt = hostPkgs.writeTextFile {
@@ -41,16 +36,12 @@ in
 
   nodes = {
     server =
-      { pkgs, ... }:
+      { config, ... }:
       {
-        environment.systemPackages = [
-          pkgs.curl
-        ];
-
         services.h2o = {
           enable = true;
-          defaultHTTPListenPort = port.HTTP;
-          defaultTLSListenPort = port.TLS;
+          defaultHTTPListenPort = 8080;
+          defaultTLSListenPort = 8443;
           hosts = {
             "${domain.HTTP}" = {
               settings = {
@@ -107,52 +98,74 @@ in
 
         networking = {
           firewall = {
-            allowedTCPPorts = with port; [
-              HTTP
-              TLS
+            allowedTCPPorts = with config.services.h2o; [
+              defaultHTTPListenPort
+              defaultTLSListenPort
             ];
-            allowedUDPPorts = with port; [
-              TLS
+            allowedUDPPorts = with config.services.h2o; [
+              defaultTLSListenPort
             ];
           };
           extraHosts = ''
-            127.0.0.1 ${domain.HTTP}
-            127.0.0.1 ${domain.TLS}
+            ${config.networking.primaryIPAddress} ${domain.HTTP}
+            ${config.networking.primaryIPAddress} ${domain.TLS}
           '';
         };
       };
+
+    client =
+      { nodes, pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
+
+        security.pki.certificates = [
+          (builtins.readFile ../../common/acme/server/ca.cert.pem)
+        ];
+
+        networking.extraHosts = ''
+          ${nodes.server.networking.primaryIPAddress} ${domain.HTTP}
+          ${nodes.server.networking.primaryIPAddress} ${domain.TLS}
+        '';
+      };
   };
+
   testScript =
+    { nodes, ... }:
     let
-      portStrHTTP = builtins.toString port.HTTP;
-      portStrTLS = builtins.toString port.TLS;
+      inherit (nodes) server;
+      portStrHTTP = builtins.toString server.services.h2o.defaultHTTPListenPort;
+      portStrTLS = builtins.toString server.services.h2o.defaultTLSListenPort;
     in
     # python
     ''
+      start_all()
+
       server.wait_for_unit("h2o.service")
       server.wait_for_open_port(${portStrHTTP})
       server.wait_for_open_port(${portStrTLS})
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl --fail-with-body 'http://${domain.HTTP}:${portStrHTTP}/hello_world.txt'")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl --fail-with-body 'http://${domain.HTTP}:${portStrHTTP}/hello_world.txt'")
 
-      tls_hello_world_head = server.succeed("curl -v --head --compressed --http2 --tlsv1.3 --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'").lower()
+      tls_hello_world_head = client.succeed("curl -v --head --compressed --http2 --tlsv1.3 --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'").lower()
       assert "http/2 200" in tls_hello_world_head
       assert "server: h2o" in tls_hello_world_head
       assert "content-type: text/x-rst" in tls_hello_world_head
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl -v --http2 --tlsv1.3 --compressed --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl -v --http2 --tlsv1.3 --compressed --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'")
 
-      quic_hello_world_head = server.succeed("curl -v --head --compressed --http3-only --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'").lower()
+      quic_hello_world_head = client.succeed("curl -v --head --compressed --http3-only --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'").lower()
       assert "http/3 200" in quic_hello_world_head
       assert "server: h2o" in quic_hello_world_head
       assert "content-type: text/x-rst" in quic_hello_world_head
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl -v --http3-only --compressed --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl -v --http3-only --compressed --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'")
 
-      assert "redirected" in server.succeed("curl -v --head --fail-with-body 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'").lower()
+      assert "redirected" in client.succeed("curl -v --head --fail-with-body 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'").lower()
 
-      server.fail("curl --location --max-redirs 0 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'")
+      client.fail("curl --location --max-redirs 0 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'")
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl -v --location --fail-with-body 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl -v --location --fail-with-body 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'")
     '';
 }
diff --git a/nixos/tests/web-servers/h2o/mruby.nix b/nixos/tests/web-servers/h2o/mruby.nix
index b99a4c840b15..c9a4d95c056b 100644
--- a/nixos/tests/web-servers/h2o/mruby.nix
+++ b/nixos/tests/web-servers/h2o/mruby.nix
@@ -3,8 +3,6 @@
 let
   domain = "h2o.local";
 
-  port = 8080;
-
   sawatdi_chao_lok = "สวัสดีชาวโลก";
 in
 {
@@ -16,13 +14,13 @@ in
 
   nodes = {
     server =
-      { pkgs, ... }:
+      { pkgs, config, ... }:
       {
         services.h2o = {
           enable = true;
           package = pkgs.h2o.override { withMruby = true; };
           settings = {
-            listen = port;
+            listen = 8080;
             hosts = {
               "${domain}" = {
                 paths = {
@@ -43,23 +41,36 @@ in
           };
         };
 
-        networking.extraHosts = ''
-          127.0.0.1 ${domain}
-        '';
+        networking.firewall.allowedTCPPorts = [
+          config.services.h2o.settings.listen
+        ];
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
       };
   };
 
   testScript =
+    { nodes, ... }:
     let
-      portStr = builtins.toString port;
+      inherit (nodes) server;
+      portStr = builtins.toString server.services.h2o.settings.listen;
+      origin = "http://server:${portStr}";
     in
     # python
     ''
+      start_all()
+
       server.wait_for_unit("h2o.service")
       server.wait_for_open_port(${portStr})
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl --fail-with-body http://${domain}:${portStr}/hello_world")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl --fail-with-body ${origin}/hello_world")
 
-      assert "FILE_HANDLER" in server.succeed("curl --fail-with-body http://${domain}:${portStr}/file_handler")
+      assert "FILE_HANDLER" in client.succeed("curl --fail-with-body ${origin}/file_handler")
     '';
 }
diff --git a/nixos/tests/web-servers/h2o/tls-recommendations.nix b/nixos/tests/web-servers/h2o/tls-recommendations.nix
index a99725f19b10..0fca6dbbb1b9 100644
--- a/nixos/tests/web-servers/h2o/tls-recommendations.nix
+++ b/nixos/tests/web-servers/h2o/tls-recommendations.nix
@@ -2,7 +2,6 @@
 
 let
   domain = "acme.test";
-  port = 8443;
 
   hello_txt =
     name:
@@ -13,7 +12,12 @@ let
 
   mkH2OServer =
     recommendations:
-    { pkgs, lib, ... }:
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
     {
       services.h2o = {
         enable = true;
@@ -31,7 +35,8 @@ let
         hosts = {
           "${domain}" = {
             tls = {
-              inherit port recommendations;
+              inherit recommendations;
+              port = 8443;
               policy = "force";
               identity = [
                 {
@@ -59,7 +64,9 @@ let
       ];
 
       networking = {
-        firewall.allowedTCPPorts = [ port ];
+        firewall.allowedTCPPorts = [
+          config.services.h2o.hosts.${domain}.tls.port
+        ];
         extraHosts = "127.0.0.1 ${domain}";
       };
     };
@@ -71,6 +78,8 @@ in
     maintainers = with lib.maintainers; [ toastal ];
   };
 
+  # not using a `client` since it’s easiest to test with acme.test pointing at
+  # localhost for these machines
   nodes = {
     server_modern = mkH2OServer "modern";
     server_intermediate = mkH2OServer "intermediate";
@@ -78,43 +87,49 @@ in
   };
 
   testScript =
+    { nodes, ... }:
     let
-      portStr = builtins.toString port;
+      inherit (nodes) server_modern server_intermediate server_old;
+      modernPortStr = builtins.toString server_modern.services.h2o.hosts.${domain}.tls.port;
+      intermediatePortStr = builtins.toString server_intermediate.services.h2o.hosts.${domain}.tls.port;
+      oldPortStr = builtins.toString server_old.services.h2o.hosts.${domain}.tls.port;
     in
     # python
     ''
-      curl_basic = "curl -v --tlsv1.3 --http2 'https://${domain}:${portStr}/'"
-      curl_head = "curl -v --head 'https://${domain}:${portStr}/'"
-      curl_max_tls1_2 ="curl -v --tlsv1.0 --tls-max 1.2 'https://${domain}:${portStr}/'"
-      curl_max_tls1_2_intermediate_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' 'https://${domain}:${portStr}/'"
-      curl_max_tls1_2_old_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256' 'https://${domain}:${portStr}/'"
+      curl_basic = "curl -v --tlsv1.3 --http2 'https://${domain}:{port}/'"
+      curl_head = "curl -v --head 'https://${domain}:{port}/'"
+      curl_max_tls1_2 ="curl -v --tlsv1.0 --tls-max 1.2 'https://${domain}:{port}/'"
+      curl_max_tls1_2_intermediate_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' 'https://${domain}:{port}/'"
+      curl_max_tls1_2_old_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256' 'https://${domain}:{port}/'"
+
+      start_all()
 
       server_modern.wait_for_unit("h2o.service")
-      server_modern.wait_for_open_port(${portStr})
-      modern_response = server_modern.succeed(curl_basic)
+      server_modern.wait_for_open_port(${modernPortStr})
+      modern_response = server_modern.succeed(curl_basic.format(port="${modernPortStr}"))
       assert "Hello, modern!" in modern_response
-      modern_head = server_modern.succeed(curl_head)
+      modern_head = server_modern.succeed(curl_head.format(port="${modernPortStr}"))
       assert "strict-transport-security" in modern_head
-      server_modern.fail(curl_max_tls1_2)
+      server_modern.fail(curl_max_tls1_2.format(port="${modernPortStr}"))
 
       server_intermediate.wait_for_unit("h2o.service")
-      server_intermediate.wait_for_open_port(${portStr})
-      intermediate_response = server_intermediate.succeed(curl_basic)
+      server_intermediate.wait_for_open_port(${intermediatePortStr})
+      intermediate_response = server_intermediate.succeed(curl_basic.format(port="${intermediatePortStr}"))
       assert "Hello, intermediate!" in intermediate_response
-      intermediate_head = server_modern.succeed(curl_head)
+      intermediate_head = server_modern.succeed(curl_head.format(port="${intermediatePortStr}"))
       assert "strict-transport-security" in intermediate_head
-      server_intermediate.succeed(curl_max_tls1_2)
-      server_intermediate.succeed(curl_max_tls1_2_intermediate_cipher)
-      server_intermediate.fail(curl_max_tls1_2_old_cipher)
+      server_intermediate.succeed(curl_max_tls1_2.format(port="${intermediatePortStr}"))
+      server_intermediate.succeed(curl_max_tls1_2_intermediate_cipher.format(port="${intermediatePortStr}"))
+      server_intermediate.fail(curl_max_tls1_2_old_cipher.format(port="${intermediatePortStr}"))
 
       server_old.wait_for_unit("h2o.service")
-      server_old.wait_for_open_port(${portStr})
-      old_response = server_old.succeed(curl_basic)
+      server_old.wait_for_open_port(${oldPortStr})
+      old_response = server_old.succeed(curl_basic.format(port="${oldPortStr}"))
       assert "Hello, old!" in old_response
-      old_head = server_modern.succeed(curl_head)
+      old_head = server_modern.succeed(curl_head.format(port="${oldPortStr}"))
       assert "strict-transport-security" in old_head
-      server_old.succeed(curl_max_tls1_2)
-      server_old.succeed(curl_max_tls1_2_intermediate_cipher)
-      server_old.succeed(curl_max_tls1_2_old_cipher)
+      server_old.succeed(curl_max_tls1_2.format(port="${oldPortStr}"))
+      server_old.succeed(curl_max_tls1_2_intermediate_cipher.format(port="${oldPortStr}"))
+      server_old.succeed(curl_max_tls1_2_old_cipher.format(port="${oldPortStr}"))
     '';
 }
diff --git a/pkgs/by-name/as/asciinema_3/package.nix b/pkgs/by-name/as/asciinema_3/package.nix
index 140d97fbda02..2803cd784ab2 100644
--- a/pkgs/by-name/as/asciinema_3/package.nix
+++ b/pkgs/by-name/as/asciinema_3/package.nix
@@ -4,67 +4,60 @@
   installShellFiles,
   python3,
   rustPlatform,
-  testers,
+  versionCheckHook,
 }:
 
-let
-  self = rustPlatform.buildRustPackage {
-    pname = "asciinema";
-    version = "3.0.0";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "asciinema";
+  version = "3.0.1";
 
-    src = fetchFromGitHub {
-      name = "asciinema-source-${self.version}";
-      owner = "asciinema";
-      repo = "asciinema";
-      rev = "v${self.version}";
-      hash = "sha256-P92EZyg8f/mm66SmXAyPX9f4eMgOP6lyn3Uqhqh+D0I=";
-    };
-
-    cargoHash = "sha256-2DQqtCcvSO43+RcMN2/BGqvf+cp/WvzUY4dxVpNcbGU=";
-
-    env.ASCIINEMA_GEN_DIR = "gendir";
-
-    nativeCheckInputs = [ python3 ];
-    nativeBuildInputs = [ installShellFiles ];
-
-    postInstall = ''
-      installManPage gendir/man/*
-      installShellCompletion --cmd asciinema \
-        --bash gendir/completion/asciinema.bash \
-        --fish gendir/completion/asciinema.fish \
-        --zsh gendir/completion/_asciinema
-    '';
-
-    strictDeps = true;
-
-    passthru = {
-      tests.version = testers.testVersion {
-        package = self;
-        command = "asciinema --version";
-      };
-    };
-
-    meta = {
-      homepage = "https://asciinema.org/";
-      description = "Terminal session recorder and the best companion of asciinema.org";
-      longDescription = ''
-        asciinema is a suite of tools for recording, replaying, and sharing
-        terminal sessions. It is free and open-source software (FOSS), created
-        by Marcin Kulik.
-
-        Its typical use cases include creating tutorials, demonstrating
-        command-line tools, and sharing reproducible bug reports. It focuses on
-        simplicity and interoperability, which makes it a popular choice among
-        computer users working with the command-line, such as developers or
-        system administrators.
-      '';
-      license = with lib.licenses; [ gpl3Plus ];
-      mainProgram = "asciinema";
-      maintainers = with lib.maintainers; [
-        jiriks74
-        llakala
-      ];
-    };
+  src = fetchFromGitHub {
+    owner = "asciinema";
+    repo = "asciinema";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jWRq/LeDdCETiOMkWr9EIWztb14IYGCSo05QPw5HZZk=";
   };
-in
-self
+
+  cargoHash = "sha256-bGhShwH4BxE3O4/B8KSK1o7IXNDBmGuVt4kx5s8W/go=";
+
+  env.ASCIINEMA_GEN_DIR = "gendir";
+
+  strictDeps = true;
+
+  nativeCheckInputs = [ python3 ];
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage gendir/man/*
+    installShellCompletion --cmd asciinema \
+      --bash gendir/completion/asciinema.bash \
+      --fish gendir/completion/asciinema.fish \
+      --zsh gendir/completion/_asciinema
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    homepage = "https://asciinema.org/";
+    description = "Terminal session recorder and the best companion of asciinema.org";
+    longDescription = ''
+      asciinema is a suite of tools for recording, replaying, and sharing
+      terminal sessions. It is free and open-source software (FOSS), created
+      by Marcin Kulik.
+
+      Its typical use cases include creating tutorials, demonstrating
+      command-line tools, and sharing reproducible bug reports. It focuses on
+      simplicity and interoperability, which makes it a popular choice among
+      computer users working with the command-line, such as developers or
+      system administrators.
+    '';
+    license = with lib.licenses; [ gpl3Plus ];
+    mainProgram = "asciinema";
+    maintainers = with lib.maintainers; [
+      jiriks74
+      llakala
+    ];
+  };
+})
diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index 94c1cc3909fd..108bc700447c 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.39.7";
+  version = "0.39.9";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-D/fdy2oMwlXVMzoSCcYSz1fiazVCypvj4X3G6vBWBUw=";
+    hash = "sha256-OzDx1/U4uZuMGanTaDi1Bu3ueMaf83jJIqy+20+cX0g=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-AuVD3n+T9UNLw6+IuM9l2AoMb7eEFhr+ZlktYZQYI80=";
+  cargoHash = "sha256-YtukqwUvpAQf8Dxf0rhowylt8h1VhN9PcnF+QiB8WmA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/bi/biboumi/catch.patch b/pkgs/by-name/bi/biboumi/catch.patch
deleted file mode 100644
index bbd0a66909fe..000000000000
--- a/pkgs/by-name/bi/biboumi/catch.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -303,27 +303,6 @@
- endforeach()
- 
- #
--## Add a rule to download the catch unit test framework
--#
--include(ExternalProject)
--ExternalProject_Add(catch
--  GIT_REPOSITORY "https://lab.louiz.org/louiz/Catch.git"
--  PREFIX "external"
--  UPDATE_COMMAND ""
--  CONFIGURE_COMMAND ""
--  BUILD_COMMAND ""
--  INSTALL_COMMAND ""
--  )
--set_target_properties(catch PROPERTIES EXCLUDE_FROM_ALL TRUE)
--ExternalProject_Get_Property(catch SOURCE_DIR)
--if(NOT EXISTS ${CMAKE_SOURCE_DIR}/tests/catch.hpp)
--  target_include_directories(test_suite
--    PUBLIC "${SOURCE_DIR}/single_include/"
--    )
--  add_dependencies(test_suite catch)
--endif()
--
--#
- ## Add some custom rules to launch the tests
- #
- add_custom_target(check COMMAND "test_suite"
diff --git a/pkgs/by-name/bi/biboumi/package.nix b/pkgs/by-name/bi/biboumi/package.nix
index ebc9dfa625e3..ccf3d25dd507 100644
--- a/pkgs/by-name/bi/biboumi/package.nix
+++ b/pkgs/by-name/bi/biboumi/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitea,
-  fetchpatch,
   cmake,
   libuuid,
   expat,
@@ -25,38 +24,18 @@ assert lib.assertMsg (
   withPostgreSQL || withSQLite
 ) "At least one Biboumi database provider required";
 
-let
-  catch = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "poezio";
-    repo = "catch";
-    tag = "v2.2.1";
-    hash = "sha256-dGUnB/KPONqPno1aO5cOSiE5N4lUiTbMUcH0X6HUoCk=";
-  };
-
-  pname = "biboumi";
-  version = "9.0";
-in
 stdenv.mkDerivation {
-  inherit pname version;
+  pname = "biboumi";
+  version = "9.0-unstable-2025-10-27";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "poezio";
     repo = "biboumi";
-    tag = version;
-    hash = "sha256-yjh9WFuFjaoZLfXTfZajmdRO+3KZqJYBEd0HgqcC28A=";
+    rev = "61242c35bc825d58c9db4301b5696bc17428bf98";
+    hash = "sha256-BZTqu2Qvfqag9pwymlGrItLbOXQf3VMKQS2+3pxlJbE=";
   };
 
-  patches = [
-    ./catch.patch
-    (fetchpatch {
-      name = "update_botan_to_version_3.patch";
-      url = "https://codeberg.org/poezio/biboumi/commit/e4d32f939240ed726e9981e42c0dc251cd9879da.patch";
-      hash = "sha256-QUt2ZQtoouLHAeEUlJh+yfCYEmLboL/tk6O2TbHR67Q=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -87,7 +66,6 @@ stdenv.mkDerivation {
 
   preConfigure = ''
     substituteInPlace CMakeLists.txt --replace /etc/biboumi $out/etc/biboumi
-    cp ${catch}/single_include/catch.hpp tests/
   '';
 
   doCheck = true;
diff --git a/pkgs/by-name/bi/bikeshed/package.nix b/pkgs/by-name/bi/bikeshed/package.nix
index f7f48af594ea..bd5df8ca9e6b 100644
--- a/pkgs/by-name/bi/bikeshed/package.nix
+++ b/pkgs/by-name/bi/bikeshed/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bikeshed";
-  version = "5.3.4";
+  version = "5.4.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QcypdeFIzEt2cx8PWWWhnMMhnc2oEWZUOm8kge4KJQY=";
+    hash = "sha256-lI05x3IYiXyInjm/It8c3JwR1H1m6VVBuehjKiNEZzo=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ch/cherry-studio/package.nix b/pkgs/by-name/ch/cherry-studio/package.nix
index 5e8bc1f788c4..d9fcf2e7ff8e 100644
--- a/pkgs/by-name/ch/cherry-studio/package.nix
+++ b/pkgs/by-name/ch/cherry-studio/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cherry-studio";
-  version = "1.6.5";
+  version = "1.6.7";
 
   src = fetchFromGitHub {
     owner = "CherryHQ";
     repo = "cherry-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9oEMnGaloY3tFY/qpjTlYbO7n1ORIK49s3N9SGSMvHE=";
+    hash = "sha256-F5TlgWorsBJ4B6/j+3WbbVMirtqCrDq+TrWW257MMek=";
   };
 
   postPatch = ''
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-LstTTVKXVL6hIC5TiUKeBIcDFaRPdmEjO2LmvVXB7dQ=";
+    hash = "sha256-noZ3R4kxYw26z2qavaIb+iv7iFj5ID7O0V5fSVcAd48=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index 109016e70fb4..4f6a45b2b426 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -6,20 +6,23 @@
   testers,
   flyctl,
   installShellFiles,
+  git,
 }:
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.3.172";
+  version = "0.3.209";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-jKzlKOdE+SrCzY81ciI9sKN0iiFZMsKp04A+1TV1+i0=";
+    leaveDotGit = true;
+    hash = "sha256-D1MSlg6oFmdyiEaq10DUwzADzleilFIQ22oQd8LGfRk=";
   };
 
-  vendorHash = "sha256-D6b+dLoE4IdhsmnWILe7Thkggq3p0ur4C3BOz7Cuk98=";
+  proxyVendor = true;
+  vendorHash = "sha256-ezGA1LGwQVFMzV/Ogj26pooD06O7FNTXMrYWkv6AwWM=";
 
   subPackages = [ "." ];
 
@@ -31,11 +34,17 @@ buildGoModule rec {
   ];
   tags = [ "production" ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    git
+  ];
 
   patches = [ ./disable-auto-update.patch ];
 
   preBuild = ''
+    # Embed VCS Infos
+    export GOFLAGS="$GOFLAGS -buildvcs=true"
+
     GOOS= GOARCH= CGO_ENABLED=0 go generate ./...
   '';
 
@@ -78,6 +87,7 @@ buildGoModule rec {
       jsierles
       techknowlogick
       RaghavSood
+      SchahinRohani
     ];
     mainProgram = "flyctl";
   };
diff --git a/pkgs/by-name/ge/geminicommit/package.nix b/pkgs/by-name/ge/geminicommit/package.nix
index adca1bc69f2a..2a8c84288da2 100644
--- a/pkgs/by-name/ge/geminicommit/package.nix
+++ b/pkgs/by-name/ge/geminicommit/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "geminicommit";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "tfkhdyt";
     repo = "geminicommit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wUqu6/j9AyD/THblX0w+Wt43FK//WammB6c425pTwbc=";
+    hash = "sha256-PH9IYVlHZuXEzpRvT0luSZej1dFzUyxGzoQ+z79u5kU=";
   };
 
   vendorHash = "sha256-4aVUD16zhzWvgD90gttmoDRoKKb0dRgDdH1HMfgd3LU=";
@@ -29,8 +29,8 @@ buildGoModule (finalAttrs: {
       cmd = finalAttrs.meta.mainProgram;
       goDefaultCmd = finalAttrs.pname;
     in
-    # The official github released binary is renamed since v0.5.0,
-    # see: https://github.com/tfkhdyt/geminicommit/releases/tag/v0.5.0
+    # The official github released binary is renamed since v0.6.0,
+    # see: https://github.com/tfkhdyt/geminicommit/releases/tag/v0.6.0
     # Here we link the old name (which is also the `go build` default name)
     # for backward compatibility:
     ''
diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index a73f5a770eef..e168cd2e9e43 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2025-10-17";
+  version = "2.3.0-rolling-2025-11-08";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "562d7bd089173da03e71bc4c0824468751c5b411";
-    hash = "sha256-/P4S8ng1kQPPHNSNuqgLasu2c2Y9BD2Y9v0hlMiPCIM=";
+    rev = "607b732b668a06826709c0f72bd4fd680f2372bc";
+    hash = "sha256-JdtBedmz84LnlePKif3vnq5YbTAIumvzPcjlJ/Br5hQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index d3ba7e38295e..a77fed189b93 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-11-03";
+  version = "0-unstable-2025-11-10";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "aa6936bb637e46a49cf1292486200ba41dd4bcf7";
-    hash = "sha256-Y5950vzoyJ8+u4U6dlI/2VEbf3JQnIJsmRWWWcsgpRg=";
+    rev = "37a3d97f2873e0f68711117c34d04b7c7ead8f4e";
+    hash = "sha256-t2U/GLLXHa2+kJkwnFNRVc2fEJ/lUfyZXBE5iKzJdcs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hygg/package.nix b/pkgs/by-name/hy/hygg/package.nix
index ff1901af28cd..00f166181a7e 100644
--- a/pkgs/by-name/hy/hygg/package.nix
+++ b/pkgs/by-name/hy/hygg/package.nix
@@ -28,7 +28,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # e2e test fails since it cant find the input pdf file
     "--skip=tests::test_end_to_end"
     "--skip=test_epub_processing"
-  ];
+  ]
+  ## Skipping this test due to the high variability of its outcome
+  ## When the package was merged the test was passing but on hydra its not
+  ## Look at PR #448907
+  ++ (if pkgs.stdenv.isDarwin then [ "--skip=test_stdin_processing" ] else [ ]);
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/ig/igvm-tooling/package.nix b/pkgs/by-name/ig/igvm-tooling/package.nix
deleted file mode 100644
index 05629f538466..000000000000
--- a/pkgs/by-name/ig/igvm-tooling/package.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{
-  lib,
-  python3,
-  fetchFromGitHub,
-  fetchpatch,
-  which,
-  acpica-tools,
-  unstableGitUpdater,
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "igvm-tooling";
-  version = "1.5.0-unstable-2024-06-06";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "microsoft";
-    repo = "igvm-tooling";
-    rev = "53656ddde294bbafcae6349b5acfc5da9f7dbb92";
-    hash = "sha256-X9Gi+kTmc/ZcsgbHldEj9zPnOmd5puDD7/+J1s1CVws=";
-  };
-
-  patches = [
-    # drop unused libclang dependency
-    # remove once https://github.com/microsoft/igvm-tooling/pull/53 is merged
-    (fetchpatch {
-      name = "0001-setup.py-remove-unused-libclang-dependency.patch";
-      url = "https://github.com/microsoft/igvm-tooling/commit/7182e925de9b5e9f5c8c3a3ce6e3942a92506064.patch";
-      hash = "sha256-tcVxcuLxknyEdo2YjeHOqSG9xQna8US+YyvlcfX+Htw=";
-      stripLen = 1;
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace igvm/acpi.py \
-      --replace-fail 'os.path.join(os.path.dirname(__file__), "acpi", "acpi.zip")' "\"$out/share/igvm-tooling/acpi/acpi.zip\""
-  '';
-
-  sourceRoot = "${src.name}/src";
-
-  nativeBuildInputs = [ acpica-tools ];
-
-  propagatedBuildInputs =
-    (with python3.pkgs; [
-      setuptools
-      ecdsa
-      cstruct
-      pyelftools
-      pytest
-      cached-property
-      frozendict
-    ])
-    ++ [
-      acpica-tools
-      which
-    ];
-
-  postInstall = ''
-    mkdir -p $out/share/igvm-tooling/acpi/acpi-clh
-    cp -rT igvm/acpi/acpi-clh $out/share/igvm-tooling/acpi/acpi-clh
-    cp igvm/acpi/acpi.zip $out/share/igvm-tooling/acpi/acpi.zip
-    find $out/share/igvm-tooling/acpi -name "*.dsl" -exec iasl -f {} \;
-  '';
-
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "igvm-";
-  };
-
-  meta = {
-    description = "IGVM Image Generator";
-    homepage = "https://github.com/microsoft/igvm-tooling";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      malt3
-      katexochen
-    ];
-    changelog = "https://github.com/microsoft/igvm-tooling/releases/tag/igvm-${version}";
-    mainProgram = "igvmgen";
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index f0cac58901ec..e4c647cd4f98 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -39,13 +39,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "koboldcpp";
-  version = "1.101";
+  version = "1.101.1";
 
   src = fetchFromGitHub {
     owner = "LostRuins";
     repo = "koboldcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WwTl+u7FJ4E+x+jjwh0wmPM7fjsPxu7+TrEwKQQfyLA=";
+    hash = "sha256-gPbvzbbgm13HjXISPY5hpcCgUejQ5OHkmMu2zCwm/sQ=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeysAudio/package.nix
index a9874a5aab18..05c8af165a66 100644
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.80";
+  version = "11.82";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-Y1Zeuelx4fAWYm9dCETM47t80b4w2biTBrLujkgH1oA=";
+    hash = "sha256-M/ndWIga0FTqOQcekFRT4sQ3gpPsQKSdOVHmx8kiQZI=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index 69db57b6e89b..1d14a6d1b691 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-nVm5AmfKfoBDBIFt2g4PXc5Ff2kbrBGTThqdpslpYow=";
+    hash = "sha256-Uywbhz+dMX49fYOypybNLP8Jrvxo8gN/YAOcODcThM8=";
   };
 
-  vendorHash = "sha256-jprXaNd/S2fJcejSG5nH7rvg/yNmRRRgCOkJrUkiwmY=";
+  vendorHash = "sha256-GZWXiL8VJTx0EcwWKy4jryr1jzoT44tWO2U7TCjhhfU=";
 
   subPackages = ".";
 
diff --git a/pkgs/by-name/ni/nixbit/package.nix b/pkgs/by-name/ni/nixbit/package.nix
index 5c507514b6d7..7141ae86fabc 100644
--- a/pkgs/by-name/ni/nixbit/package.nix
+++ b/pkgs/by-name/ni/nixbit/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nixbit";
-  version = "0.1.5";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "pbek";
     repo = "nixbit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DpjLPvmn61rEn6ui8cFfqeZEPYGyCUVVP/V7mQw1l5Y=";
+    hash = "sha256-sMi3hQZCzHbWTgRdqwGy6srfkmmY11B0OIqJKp5/HB0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opensupaplex/darwin.patch b/pkgs/by-name/op/opensupaplex/darwin.patch
new file mode 100644
index 000000000000..7db9432f7302
--- /dev/null
+++ b/pkgs/by-name/op/opensupaplex/darwin.patch
@@ -0,0 +1,16 @@
+diff --git a/src/sdl_common/audio.c b/src/sdl_common/audio.c
+index 797c678..ebb9eda 100644
+--- a/src/sdl_common/audio.c
++++ b/src/sdl_common/audio.c
+@@ -25,11 +25,7 @@
+ 
+ #if HAVE_SDL2
+ #include <SDL2/SDL.h>
+-#if TARGET_OS_MAC
+-#include <SDL2_mixer/SDL_mixer.h>
+-#else
+ #include <SDL2/SDL_mixer.h>
+-#endif
+ #elif HAVE_SDL
+ #include <SDL/SDL.h>
+ #include <SDL/SDL_mixer.h>
diff --git a/pkgs/by-name/op/opensupaplex/package.nix b/pkgs/by-name/op/opensupaplex/package.nix
index b1cbe51469f0..cb95343bec73 100644
--- a/pkgs/by-name/op/opensupaplex/package.nix
+++ b/pkgs/by-name/op/opensupaplex/package.nix
@@ -9,6 +9,7 @@
   opensupaplex,
   SDL2,
   SDL2_mixer,
+  desktopToDarwinBundle,
 }:
 
 let
@@ -18,21 +19,30 @@ let
     sha256 = "sha256-nKeSBUGjSulbEP7xxc6smsfCRjyc/xsLykH0o3Rq5wo=";
   };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "opensupaplex";
   version = "7.1.2";
 
   src = fetchFromGitHub {
     owner = "sergiou87";
     repo = "open-supaplex";
-    rev = "v${version}";
-    sha256 = "sha256-hP8dJlLXE5J/oxPhRkrrBl1Y5e9MYbJKi8OApFM3+GU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hP8dJlLXE5J/oxPhRkrrBl1Y5e9MYbJKi8OApFM3+GU=";
   };
 
+  patches = [
+    ./reproducible-build.patch
+    ./darwin.patch
+  ];
+
   nativeBuildInputs = [
     SDL2 # For "sdl2-config"
     copyDesktopItems
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    desktopToDarwinBundle
   ];
+
   buildInputs = [ SDL2_mixer ];
 
   enableParallelBuilding = true;
@@ -66,30 +76,32 @@ stdenv.mkDerivation rec {
   passthru.tests.version = testers.testVersion {
     package = opensupaplex;
     command = "opensupaplex --help";
-    version = "v${version}";
+    version = "v${finalAttrs.version}";
   };
 
   desktopItems = [
     (makeDesktopItem {
       name = "opensupaplex";
-      exec = meta.mainProgram;
+      exec = finalAttrs.meta.mainProgram;
       icon = "open-supaplex";
       desktopName = "OpenSupaplex";
-      comment = meta.description;
+      comment = finalAttrs.meta.description;
       categories = [
-        "Application"
         "Game"
       ];
     })
   ];
 
+  # Strip only the main binary, not the data files which would corrupt them.
+  stripExclude = [ "lib/opensupaplex/*" ];
+
   meta = {
     description = "Decompilation of Supaplex in C and SDL";
     homepage = "https://github.com/sergiou87/open-supaplex";
-    changelog = "https://github.com/sergiou87/open-supaplex/blob/master/changelog/v${version}.txt";
+    changelog = "https://github.com/sergiou87/open-supaplex/blob/master/changelog/v${finalAttrs.version}.txt";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ matteopacini ];
-    platforms = lib.platforms.linux; # Many more are supported upstream, but only linux is tested.
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "opensupaplex";
   };
-}
+})
diff --git a/pkgs/by-name/op/opensupaplex/reproducible-build.patch b/pkgs/by-name/op/opensupaplex/reproducible-build.patch
new file mode 100644
index 000000000000..3c2a14917064
--- /dev/null
+++ b/pkgs/by-name/op/opensupaplex/reproducible-build.patch
@@ -0,0 +1,17 @@
+diff --git a/linux/Makefile b/linux/Makefile
+index 6041a89..588341c 100644
+--- a/linux/Makefile
++++ b/linux/Makefile
+@@ -5,6 +5,12 @@ LDFLAGS += -lSDL2_mixer -lvorbis -logg `sdl2-config --libs` -lm
+ 
+ CFLAGS += `sdl2-config --cflags` -DHAVE_SDL2
+ 
++UNAME_S := $(shell uname -s)
++ifeq ($(UNAME_S),Darwin)
++# Darwin-specific reproducible build flags
++LDFLAGS += -Wl,-no_uuid
++endif
++
+ opensupaplex: $(obj)
+ 	$(CC) -o $@ $^ $(LDFLAGS)
+ 
diff --git a/pkgs/by-name/po/postman/package.nix b/pkgs/by-name/po/postman/package.nix
index bc1241c7b0fc..eecbbad5fa98 100644
--- a/pkgs/by-name/po/postman/package.nix
+++ b/pkgs/by-name/po/postman/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "postman";
-  version = "11.67.0";
+  version = "11.70.2";
 
   src =
     let
@@ -27,10 +27,10 @@ let
       name = "postman-${version}.${if stdenvNoCC.hostPlatform.isLinux then "tar.gz" else "zip"}";
       url = "https://dl.pstmn.io/download/version/${version}/${system}";
       hash = selectSystem {
-        aarch64-darwin = "sha256-WDXYSHhwvNo4IifeuYOZmF7KX/5ZArPXtoBe30bmGIg=";
-        aarch64-linux = "sha256-7rtKBx5axftXEXmps1mUPIKPypFUVwhSGA/yJstVU2I=";
-        x86_64-darwin = "sha256-7cm9u0zdvEBfjId6Xp0i4X2E/dtAZ0HeI3y0guzyMp4=";
-        x86_64-linux = "sha256-xg9d1E3S6yR3BOMLb5OXmMfZj5e+GmW9p1FFMBj/5mI=";
+        aarch64-darwin = "sha256-IJrASCvoYvJMrPr5wrpveOy457iRgp+cqFEsCPUcegA=";
+        aarch64-linux = "sha256-Pig0ZVFb+CVxcbPIwnWVxypxalAmLVcNTegBaDBLjAE=";
+        x86_64-darwin = "sha256-gI4vww6XkUti5RMc8fr9769t+emVpo0u3OozlxQdar8=";
+        x86_64-linux = "sha256-T0O6Y3ElK7eJ7ekEx8BjGiYOM8S4S3t0skkZBYh9AQ4=";
       };
     };
 
diff --git a/pkgs/by-name/py/pyradio/package.nix b/pkgs/by-name/py/pyradio/package.nix
index f294c5138555..2c6592de1d24 100644
--- a/pkgs/by-name/py/pyradio/package.nix
+++ b/pkgs/by-name/py/pyradio/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.9.3.11.20";
+  version = "0.9.3.11.21";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     tag = version;
-    hash = "sha256-dcs9kwuS1/pNtBPhj6Z1VAHFJw/ajwzc2aTWGU/h4W0=";
+    hash = "sha256-elNApj+zslOd2BvXKxLPaCrUhLYBN38yqi6xgFAponI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/telepresence2/package.nix b/pkgs/by-name/te/telepresence2/package.nix
index 92529d59f4be..216fc379a228 100644
--- a/pkgs/by-name/te/telepresence2/package.nix
+++ b/pkgs/by-name/te/telepresence2/package.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.25.0";
+  version = "2.25.1";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-ke3Si55CVc3JJgzwcCXmeGiT1GQKF+8ocrNfiLtRRcA=";
+    hash = "sha256-Itj+tC5OclTXsRdJ6Rh4xQ1YwMSZTTdcRzpUQrmpC0M=";
   };
 
   propagatedBuildInputs = [
@@ -51,7 +51,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-R+7tw2nX2rM46ETOgcQuwMCRLU23ejtNOGA3Bt/+Guw=";
+  vendorHash = "sha256-iNvvFl05Q/6uXDSYyAijayXfvObmwh6aDR6XmFQkSHI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/to/toml-f/package.nix b/pkgs/by-name/to/toml-f/package.nix
index 9b82c4ce6f57..aef8af6711b4 100644
--- a/pkgs/by-name/to/toml-f/package.nix
+++ b/pkgs/by-name/to/toml-f/package.nix
@@ -20,13 +20,13 @@ assert (
 
 stdenv.mkDerivation rec {
   pname = "toml-f";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "toml-f";
     repo = "toml-f";
     rev = "v${version}";
-    hash = "sha256-+cac4rUNpd2w3yBdH1XoCKdJ9IgOHZioZg8AhzGY0FE=";
+    hash = "sha256-QRghnzsLGuQ5MHoVVTDg6ACtwVIkIRexNx/zrrQ0Icc=";
   };
 
   patches = [
diff --git a/pkgs/by-name/z3/z3/package.nix b/pkgs/by-name/z3/z3/package.nix
index 4d56cbb93755..0ca299fbd846 100644
--- a/pkgs/by-name/z3/z3/package.nix
+++ b/pkgs/by-name/z3/z3/package.nix
@@ -28,13 +28,13 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "z3";
-  version = "4.15.3";
+  version = "4.15.4";
 
   src = fetchFromGitHub {
     owner = "Z3Prover";
     repo = "z3";
     rev = "z3-${finalAttrs.version}";
-    hash = "sha256-Lw037Z0t0ySxkgMXkbjNW5CB4QQLRrrSEBsLJqiomZ4=";
+    hash = "sha256-eyF3ELv81xEgh9Km0Ehwos87e4VJ82cfsp53RCAtuTo=";
   };
 
   patches = lib.optionals useCmakeBuild [
diff --git a/pkgs/development/python-modules/aiomusiccast/default.nix b/pkgs/development/python-modules/aiomusiccast/default.nix
index 3ec1903f0228..5e6d1f494344 100644
--- a/pkgs/development/python-modules/aiomusiccast/default.nix
+++ b/pkgs/development/python-modules/aiomusiccast/default.nix
@@ -1,25 +1,21 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
-  poetry-core,
+  hatchling,
   aiohttp,
-  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "aiomusiccast";
-  version = "0.14.8";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.8";
+  version = "0.15.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vigonotion";
     repo = "aiomusiccast";
     tag = version;
-    hash = "sha256-V4xl2QY+pPEnJtx7dxSNj/aXqHvV9Z6uuWgbVHNyLjA=";
+    hash = "sha256-oFA8i/cdDqOQ9Fq0VWd8eiOg8F1+MNxWanNqoao5+pM=";
   };
 
   postPatch = ''
@@ -27,11 +23,10 @@ buildPythonPackage rec {
       --replace '"0.0.0"' '"${version}"'
   '';
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
-    setuptools
   ];
 
   # upstream has no tests
@@ -39,11 +34,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "aiomusiccast" ];
 
-  meta = with lib; {
+  meta = {
     description = "Companion library for musiccast devices intended for the Home Assistant integration";
     homepage = "https://github.com/vigonotion/aiomusiccast";
-    changelog = "https://github.com/vigonotion/aiomusiccast/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
+    changelog = "https://github.com/vigonotion/aiomusiccast/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/pygitguardian/default.nix b/pkgs/development/python-modules/pygitguardian/default.nix
index 2c5468f77363..ec4cd9420f14 100644
--- a/pkgs/development/python-modules/pygitguardian/default.nix
+++ b/pkgs/development/python-modules/pygitguardian/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pygitguardian";
-  version = "1.25.0";
+  version = "1.26.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "GitGuardian";
     repo = "py-gitguardian";
     tag = "v${version}";
-    hash = "sha256-XcmLaEnQ5cUTd71xvgvdS418RGOzpKydUDoSdVC/mgo=";
+    hash = "sha256-CwGmNyY4U1vt7CHuO4nS1TuUJWm6Ok8vIE3kRG/qles=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/games/dwarf-fortress/df.lock.json b/pkgs/games/dwarf-fortress/df.lock.json
index a31c7c48efde..edc7c2755a7a 100644
--- a/pkgs/games/dwarf-fortress/df.lock.json
+++ b/pkgs/games/dwarf-fortress/df.lock.json
@@ -1,28 +1,28 @@
 {
   "game": {
     "latest": {
-      "linux": "53.02",
+      "linux": "53.03",
       "darwin": "0.47.05"
     },
     "versions": {
-      "53.02": {
+      "53.03": {
         "df": {
-          "version": "53.02",
+          "version": "53.03",
           "urls": {
             "linux": {
-              "url": "https://www.bay12games.com/dwarves/df_53_02_linux.tar.bz2",
-              "outputHash": "sha256-SprD05MMynNCBr2oKnBYvimm+RmOoceEC2MF9IhCc5Q="
+              "url": "https://www.bay12games.com/dwarves/df_53_03_linux.tar.bz2",
+              "outputHash": "sha256-xvpgkUjZzAeayWEK6KFLHoikDZLwh3PnTmosqjlL3m8="
             }
           }
         },
         "hack": {
-          "version": "53.02-r1",
+          "version": "53.03-r1",
           "git": {
             "url": "https://github.com/DFHack/dfhack.git",
-            "revision": "53.02-r1",
-            "outputHash": "sha256-ybDaFYNVhNS1xJU/dD8KBzNu3ceetFbvX7xNp5DLzyU="
+            "revision": "53.03-r1",
+            "outputHash": "sha256-q0IWKUGfpFdA8VyXmmsZvx7v9S2kD7pI0fUr74sj4pU="
           },
-          "xmlRev": "99cb51ac849a17652dbb74efa757df5b5716a9ba"
+          "xmlRev": "145f317340ac9327854318c7ba758ee2af5e1928"
         }
       },
       "52.05": {
@@ -136,12 +136,12 @@
     }
   },
   "therapist": {
-    "version": "42.1.20",
-    "maxDfVersion": "52.05",
+    "version": "42.1.21",
+    "maxDfVersion": "53.02",
     "git": {
       "url": "https://github.com/Dwarf-Therapist/Dwarf-Therapist.git",
-      "revision": "v42.1.20",
-      "outputHash": "sha256-nKMQSDrxhqRRaCDUK7GbexFHdxeD/P9c2UDkiMdWsyU="
+      "revision": "v42.1.21",
+      "outputHash": "sha256-chdMle+HEKwALuef36RjKbijYk+zXcNBWQNsaZXs2us="
     }
   }
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c9d4f41ac77b..cbd60093aa75 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -717,6 +717,7 @@ mapAliases {
   hydra_unstable = throw "'hydra_unstable' has been renamed to/replaced by 'hydra'"; # Converted to throw 2025-10-27
   i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27
   ibm-sw-tpm2 = throw "ibm-sw-tpm2 has been removed, as it was broken"; # Added 2025-08-25
+  igvm-tooling = throw "'igvm-tooling' has been removed as it is poorly maintained upstream and a dependency has been marked insecure."; # Added 2025-09-03
   ikos = throw "ikos has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10
   imaginer = throw "'imaginer' has been removed due to lack of upstream maintenance"; # Added 2025-08-15
   immersed-vr = throw "'immersed-vr' has been renamed to/replaced by 'immersed'"; # Converted to throw 2025-10-27