diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fa6a21ddd96e..59aa56e0cf55 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10345,12 +10345,6 @@
     github = "hitsmaxft";
     githubId = 352727;
   };
-  hjones2199 = {
-    email = "hjones2199@gmail.com";
-    github = "hjones2199";
-    githubId = 5525217;
-    name = "Hunter Jones";
-  };
   hkjn = {
     email = "me@hkjn.me";
     name = "Henrik Jonsson";
@@ -18176,6 +18170,12 @@
     githubId = 15304894;
     keys = [ { fingerprint = "F729 2594 6F58 0B05 8FB3  F271 9C55 E636 426B 40A9"; } ];
   };
+  netbrain = {
+    email = "kim@heldig.org";
+    github = "netbrain";
+    githubId = 341643;
+    name = "Kim Eik";
+  };
   netcrns = {
     email = "jason.wing@gmx.de";
     github = "netcrns";
diff --git a/nixos/modules/services/backup/pgbackrest.nix b/nixos/modules/services/backup/pgbackrest.nix
index 381589bc742d..6e5880ba1f90 100644
--- a/nixos/modules/services/backup/pgbackrest.nix
+++ b/nixos/modules/services/backup/pgbackrest.nix
@@ -55,6 +55,9 @@ let
   fullConfig = {
     global = normalize (cfg.settings // flattenWithIndex cfg.repos "repo");
   }
+  // lib.mapAttrs' (
+    cmd: settings: lib.nameValuePair "global:${cmd}" (normalize settings)
+  ) cfg.commands
   // lib.mapAttrs (
     _: cfg': normalize (cfg'.settings // flattenWithIndex cfg'.instances "pg")
   ) cfg.stanzas;
@@ -95,7 +98,6 @@ in
   };
 
   # TODO: Add enableServer option and corresponding pgBackRest TLS server service.
-  # TODO: Allow command-specific options
   # TODO: Write wrapper around pgbackrest to turn --repo=<name> into --repo=<number>
   # The following two are dependent on improvements upstream:
   #   https://github.com/pgbackrest/pgbackrest/issues/2621
@@ -328,6 +330,55 @@ in
         }
       '';
     };
+
+    commands =
+      lib.genAttrs
+        [
+          # List of commands from https://pgbackrest.org/command.html:
+          "annotate"
+          "archive-get"
+          "archive-push"
+          "backup"
+          "check"
+          "expire"
+          "help"
+          "info"
+          "repo-get"
+          "repo-ls"
+          "restore"
+          "server"
+          "server-ping"
+          "stanza-create"
+          "stanza-delete"
+          "stanza-upgrade"
+          "start"
+          "stop"
+          "verify"
+          "version"
+        ]
+        (
+          command:
+          lib.mkOption {
+            type = lib.types.submodule {
+              freeformType = settingsType;
+
+              # The following options are not fully supported / tested, yet, but point to files with secrets.
+              # Users can already set those options, but we'll force non-store paths.
+              options.tls-server-cert-file = secretPathOption;
+              options.tls-server-key-file = secretPathOption;
+            };
+            default = { };
+            description = ''
+              Options for the '${command}' command.
+
+              An attribute set of options as described in:
+              <https://pgbackrest.org/configuration.html>
+
+              All globally available options, i.e. all except stanza options, can be used.
+              Repository options should be set via [`repos`](#opt-services.pgbackrest.repos) instead.
+            '';
+          }
+        );
   };
 
   config = lib.mkIf cfg.enable (
@@ -408,6 +459,9 @@ in
             user = "postgres";
           };
         };
+        # If PostgreSQL runs on the same machine, any restore will have to be done with that user.
+        # Keeping the lock file in a directory writeable by the postgres user prevents errors.
+        services.pgbackrest.commands.restore.lock-path = "/tmp/postgresql";
         services.postgresql.identMap = ''
           postgres pgbackrest postgres
         '';
diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
index 9702dfdbcb2c..46634c5df494 100644
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@@ -81,7 +81,7 @@ let
           # We output the config section in the upstream-mandated order.
           # Ordering is important due to forward-references not being allowed.
           # See definition of conf_export and 'const yp_item_t conf_schema'
-          # upstream for reference.  Last updated for 3.3.
+          # upstream for reference.  Last updated for 3.5.
           # When changing the set of sections, also update secAllow above.
           [ (sec_list_fa "id" nix_def "module") ]
           ++ map (sec_plain nix_def) [
@@ -102,6 +102,7 @@ let
             "acl"
             "submission"
             "policy"
+            "external"
           ]
 
           # Export module sections before the template section.
diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index 7c3fe93a5678..f9bdd9fe2a40 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -310,7 +310,8 @@ in
                         substitute ${cfg.ui.package}/share/applications/netbird.desktop \
                             "$out/share/applications/${mkBin "netbird"}.desktop" \
                           --replace-fail 'Name=Netbird' "Name=NetBird @ ${client.service.name}" \
-                          --replace-fail '${lib.getExe cfg.ui.package}' "$out/bin/${mkBin "netbird-ui"}"
+                          --replace-fail '${lib.getExe cfg.ui.package}' "$out/bin/${mkBin "netbird-ui"}" \
+                          --replace-fail 'Icon=netbird' "Icon=${cfg.ui.package}/share/pixmaps/netbird.png"
                       '')
                     ];
                   };
diff --git a/nixos/tests/podman/default.nix b/nixos/tests/podman/default.nix
index 164f769b1fb0..35bb0f3980e8 100644
--- a/nixos/tests/podman/default.nix
+++ b/nixos/tests/podman/default.nix
@@ -205,6 +205,7 @@ import ../make-test-python.nix (
           rootless.succeed(su_cmd(f"mkdir -p {dir}"))
           rootless.succeed(su_cmd(f"cp -f ${quadletContainerFile} {dir}/quadlet.container"))
           rootless.systemctl("daemon-reload", "alice")
+          rootless.systemctl("start network-online.target")
           rootless.systemctl("start quadlet", "alice")
           rootless.wait_until_succeeds(su_cmd("podman ps | grep quadlet"), timeout=20)
           rootless.systemctl("stop quadlet", "alice")
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index d86be7030cc2..3009afa26234 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1291,7 +1291,7 @@ let
         wait_for_file("/var/lib/postfix/queue/public/showq")
         wait_for_open_port(9154)
         wait_until_succeeds(
-            "curl -sSf http://localhost:9154/metrics | grep 'postfix_up{path=\"/var/lib/postfix/queue/public/showq\"} 1'"
+            "curl -sSf http://localhost:9154/metrics | grep 'postfix_up{path=\"unix:///var/lib/postfix/queue/public/showq\"} 1'"
         )
         succeed(
             "curl -sSf http://localhost:9154/metrics | grep 'postfix_smtpd_connects_total 0'"
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 79333fbc4410..607877c2cdea 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1985,8 +1985,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.40.1";
-          hash = "sha256-FFuYM15NGqpS2efijAXCvXhvV2A87lshquEDPdGT9qk=";
+          version = "6.44.1";
+          hash = "sha256-coYUIPe3hq3zaLnzOe51P+yY2iQxH9+ARr4f3J6ueTI=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index cad55acb80a7..78a5ba1d450a 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -101,8 +101,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "142.0";
-    sha512 = "9a871846fc395c69688310dbf4a4569b75d3b2952a34ba1f7dc9ef5a60a34bd740087b4abb2a1a4d522dfa9d6640f2f4fcc9972a2b72160d1ed3e0df71c2901c";
+    version = "143.0";
+    sha512 = "128fb1ed35561cceb847b09c881968b474c9fc2cf7bf027f20c2d5b03366116e058b471f98cad4606a720f65d99c60ed3b4301b9e57b5971001adb3e00a51cc5";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
@@ -115,8 +115,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.2.1esr";
-    sha512 = "fccef5b8d60cd1aace585f253f52587cb3ff9384bcca2e150d4b52c8106dcd19e4d911f0ac634c0adef2da5034169c81667a5634ee14a5f5fd7cf194f6b86576";
+    version = "140.3.0esr";
+    sha512 = "82a9c4aa250b01e0e4d53890b0337972e46504636831c1b6307b841c4c5aeec86482b2da3c1666c46e870a75f6cb54db9f759664688b382ad66efa647145d900";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";
diff --git a/pkgs/applications/science/astronomy/celestia/default.nix b/pkgs/applications/science/astronomy/celestia/default.nix
index 28e3ac87a3d0..67942ed248ad 100644
--- a/pkgs/applications/science/astronomy/celestia/default.nix
+++ b/pkgs/applications/science/astronomy/celestia/default.nix
@@ -71,7 +71,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/CelestiaProject/Celestia/releases/tag/${version}";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
-      hjones2199
       returntoreality
     ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/_8/_86Box/package.nix b/pkgs/by-name/_8/_86Box/package.nix
index 6b0421956a16..ba0c7f5e5871 100644
--- a/pkgs/by-name/_8/_86Box/package.nix
+++ b/pkgs/by-name/_8/_86Box/package.nix
@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "86Box";
-  version = "5.0";
+  version = "5.1";
 
   src = fetchFromGitHub {
     owner = "86Box";
     repo = "86Box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vuVaV87BHgqiEDyaRqiqqT1AuBuPSMHs0d+/mT4cEuk=";
+    hash = "sha256-EkKqDkVK0QpGC/1F5DDHzlD05/JVnMZ6rSLuT2OPoHo=";
   };
 
   patches = [ ./darwin.patch ];
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
       owner = "86Box";
       repo = "roms";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-bMCmDAdGTkO3BuU0EBC1svulZYP3tPqWBELbXwV0KO8=";
+      hash = "sha256-ek/TbQJfrYXmpAmYeL8uSehsKxh1oDil7ebW4oFr7Cs=";
     };
     updateScript = ./update.sh;
   };
diff --git a/pkgs/by-name/at/atlas/package.nix b/pkgs/by-name/at/atlas/package.nix
index d652c14adbe0..585ecefbd613 100644
--- a/pkgs/by-name/at/atlas/package.nix
+++ b/pkgs/by-name/at/atlas/package.nix
@@ -8,19 +8,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlas";
-  version = "0.36.1";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ApZbZuREKEUkxDNLzTB1ZK2aVDh/c9Tf7RGwURlkefQ=";
+    hash = "sha256-9OX2CmL9/5LzIbYHQKvC/wRCifGq9Ycycvr3uYck94Q=";
   };
 
   modRoot = "cmd/atlas";
 
   proxyVendor = true;
-  vendorHash = "sha256-G78KpERRAP4lVsy3ur2ejT6jA6K5T257FHLb7afC/7c=";
+  vendorHash = "sha256-wIDPTgfpWD0E9Afi5NHvL684k7YPjYkQIpHotNZeneY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/at/attic-client/package.nix b/pkgs/by-name/at/attic-client/package.nix
index 52bc567c5da4..19505c29fdf6 100644
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@@ -21,13 +21,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "attic";
-  version = "0-unstable-2025-08-28";
+  version = "0-unstable-2025-09-12";
 
   src = fetchFromGitHub {
     owner = "zhaofengli";
     repo = "attic";
-    rev = "2524dd1c007bc7a0a9e9c863a1b02de8d54b319b";
-    hash = "sha256-S4SJDmVTtbcXaJkYrMFkcA5SDrpfRHlBbzwp6IRRPAw=";
+    rev = "7c5d79ad62cda340cb8c80c99b921b7b7ffacf69";
+    hash = "sha256-q7q0pWT+wu5AUU1Qlbwq8Mqb+AzHKhaMCVUq/HNZfo8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cd/cddlib/package.nix b/pkgs/by-name/cd/cddlib/package.nix
index 9357a9edbb9a..53d55834927d 100644
--- a/pkgs/by-name/cd/cddlib/package.nix
+++ b/pkgs/by-name/cd/cddlib/package.nix
@@ -9,12 +9,12 @@
 
 stdenv.mkDerivation rec {
   pname = "cddlib";
-  version = "0.94m";
+  version = "0.94n";
   src = fetchFromGitHub {
     owner = "cddlib";
     repo = "cddlib";
     rev = version;
-    sha256 = "09s8323h5w9j6mpl1yc6lm770dkskfxd2ayyafkcjllmnncxzfa0";
+    sha256 = "sha256-j4gXrxsWWiJH5gZc2ZzfYGsBCMJ7G7SQ1xEgurRWZrQ=";
   };
   buildInputs = [ gmp ];
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cf/cfitsio/package.nix b/pkgs/by-name/cf/cfitsio/package.nix
index f32e8ca6cfc5..215a9989b37c 100644
--- a/pkgs/by-name/cf/cfitsio/package.nix
+++ b/pkgs/by-name/cf/cfitsio/package.nix
@@ -95,7 +95,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       returntoreality
       xbreak
-      hjones2199
     ];
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 1e1c00c11019..b550bf0482b3 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.367.0";
+  version = "1.373.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-JQf6pQChQQOjJmdoL6DvLxajLfbEZi50p5FeJny0/Ss=";
+    hash = "sha256-LomewSlAKI38rl7eYpfvBx9Mw9tfxXbrlPb/Ex7czZo=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index fdcfe931b81c..4885876f0ecc 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -152,13 +152,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish";
-  version = "4.0.6";
+  version = "4.0.8";
 
   src = fetchFromGitHub {
     owner = "fish-shell";
     repo = "fish-shell";
     tag = finalAttrs.version;
-    hash = "sha256-qkPKpZvTVDEV7A/xX2bYgTf+o24mswRDr5UBXOsV5jQ=";
+    hash = "sha256-bve82WLP/mZrGZNW9JZFCnFiEy1QNB9M8+r3OVh9E3w=";
   };
 
   env = {
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-myDme0aHEJPUDIcIN3j6i93oPrQ0Li4rIdepBp/C/R4=";
+    hash = "sha256-f1nxATT2iJiqQiYc6qHrUvRscupvZa8R41W4fvrgj08=";
   };
 
   patches = [
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 0ebc2e9a0c37..c607f35c2cdb 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -170,11 +170,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "140.0.7339.127";
+    version = "140.0.7339.185";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-ZA23AsqHHznRoegQlDvPRvUfgA7bPQp2HMETFuAsqA8=";
+      hash = "sha256-cPAbDVevr/vtBwLn+bcPmQHNfLrh+Ogw3rDKV5pwB2M=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -275,11 +275,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "140.0.7339.133";
+    version = "140.0.7339.186";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/fzn7lmun4oavjxo5gnqutqwcny_140.0.7339.133/GoogleChrome-140.0.7339.133.dmg";
-      hash = "sha256-nnmQOzN0U8ZMl9/3iF6eTfC8LjkfCfYa8B5kQs36rmA=";
+      url = "http://dl.google.com/release2/chrome/acyk4e3hewde2niid4gmhjus7t7q_140.0.7339.186/GoogleChrome-140.0.7339.186.dmg";
+      hash = "sha256-ygXHbTJ4z7knRzTQG9uEgas7360wHgV9vaYYm0iyGOg=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/hm/hm/package.nix b/pkgs/by-name/hm/hm/package.nix
new file mode 100644
index 000000000000..4b07d5281eae
--- /dev/null
+++ b/pkgs/by-name/hm/hm/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  fetchpatch,
+  gitUpdater,
+  cmake,
+  llvmPackages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hm";
+  version = "18.0";
+
+  src = fetchFromGitLab {
+    domain = "vcgit.hhi.fraunhofer.de";
+    owner = "jvet";
+    repo = "HM";
+    tag = "HM-${finalAttrs.version}";
+    hash = "sha256-zWBwrnCNKi2sIopdu2XQj/7IoTsJQzlcIFNNKM0glDQ=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "fix-building-on-arm.patch";
+      url = "https://vcgit.hhi.fraunhofer.de/jvet/HM/-/commit/fd37cd88f557478b591dc0b9157d027354d82e2f.patch";
+      hash = "sha256-xP54lBvDabc9Dy1UklH2BJH7fUGLTA4sf9WLt7WzoU8=";
+    })
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "HIGH_BITDEPTH" true)
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    llvmPackages.openmp
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      "-Wno-error=array-bounds"
+    ]
+    ++ lib.optionals stdenv.cc.isClang [
+      "-Wno-error=bitwise-instead-of-logical"
+      "-Wno-error=missing-braces"
+    ]
+  );
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm 755 -t $out/bin ../bin/umake/*/*/release/*
+
+    runHook postInstall
+  '';
+
+  strictDeps = true;
+
+  passthru = {
+    updateScript = gitUpdater { rev-prefix = "HM-"; };
+  };
+
+  meta = {
+    description = "Reference software for HEVC";
+    homepage = "https://vcgit.hhi.fraunhofer.de/jvet/HM";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ jopejoe1 ];
+  };
+})
diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index fba4e166463d..969b6aa87121 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.4.8";
+  version = "3.5.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "sha256-ZzCnPb/BLXnYAA/+ItNtBot0Z+dL7h6xIqxJNezqSfk=";
+    sha256 = "d52538bf7364c280999dec58c2a02a405dd922ef5794da1473ca7c3cf7f01277";
   };
 
   outputs = [
@@ -133,7 +133,7 @@ stdenv.mkDerivation rec {
     description = "Authoritative-only DNS server from .cz domain registry";
     homepage = "https://knot-dns.cz";
     changelog = "https://gitlab.nic.cz/knot/knot-dns/-/releases/v${version}";
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.vcunat ];
     mainProgram = "knotd";
diff --git a/pkgs/by-name/ks/kstars/package.nix b/pkgs/by-name/ks/kstars/package.nix
index 589c0ee5aa4e..92560f8ec3a3 100644
--- a/pkgs/by-name/ks/kstars/package.nix
+++ b/pkgs/by-name/ks/kstars/package.nix
@@ -89,7 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = platforms.linux;
     maintainers = with maintainers; [
       timput
-      hjones2199
       returntoreality
     ];
   };
diff --git a/pkgs/by-name/kv/kvazaar/package.nix b/pkgs/by-name/kv/kvazaar/package.nix
index dae5ad8d19cf..c6eb811852fc 100644
--- a/pkgs/by-name/kv/kvazaar/package.nix
+++ b/pkgs/by-name/kv/kvazaar/package.nix
@@ -5,6 +5,9 @@
   gitUpdater,
   testers,
   cmake,
+  libtool,
+  ffmpeg-headless,
+  hm,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -21,10 +24,19 @@ stdenv.mkDerivation (finalAttrs: {
   # https://github.com/ultravideo/kvazaar/pull/426
   postPatch = ''
     substituteInPlace CMakeLists.txt --replace-fail 'NOT LINUX' 'NOT LINUX AND NOT BSD'
+
+    substituteInPlace tests/util.sh --replace-fail '../libtool' '${lib.getExe libtool}'
+    substituteInPlace tests/util.sh --replace-fail 'TAppDecoderStatic' '${lib.getExe' hm "TAppDecoder"}'
+
+    chmod +x tests/util.sh
   '';
 
   nativeBuildInputs = [ cmake ];
 
+  nativeCheckInputs = [
+    ffmpeg-headless
+  ];
+
   outputs = [
     "out"
     "lib"
@@ -32,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
   passthru = {
     updateScript = gitUpdater { rev-prefix = "v"; };
     tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/by-name/li/libnova/package.nix b/pkgs/by-name/li/libnova/package.nix
index 6b9cab2464e7..4cd10c707fa9 100644
--- a/pkgs/by-name/li/libnova/package.nix
+++ b/pkgs/by-name/li/libnova/package.nix
@@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
     homepage = "http://libnova.sf.net";
     license = licenses.gpl2;
     maintainers = with maintainers; [
-      hjones2199
       returntoreality
     ];
     platforms = platforms.unix;
diff --git a/pkgs/by-name/li/librtprocess/package.nix b/pkgs/by-name/li/librtprocess/package.nix
index 109157f0743a..e727bc22ead9 100644
--- a/pkgs/by-name/li/librtprocess/package.nix
+++ b/pkgs/by-name/li/librtprocess/package.nix
@@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/CarVac/librtprocess";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [
-      hjones2199
       returntoreality
     ];
     platforms = platforms.unix;
diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index 8bc733f32051..6cca28c26479 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -21,14 +21,14 @@ rustPlatform.buildRustPackage rec {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.78.2";
+  version = "0.80.3";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${version}";
-    hash = "sha256-4buK92sJZj5yEwFyi55WonF+1LZ5PERZ9wJZdlFjPcg=";
+    hash = "sha256-8iJQ7MpsR0aaNHGUTFGIlLzKP+njsQK/XY/FyDpWu7c=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
   env.BORING_BSSL_PATH = "${boringssl-wrapper}";
   env.NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
 
-  cargoHash = "sha256-eDerNFw8jtM7qIVh3Y837Iu11yeEpAcxgFVqZJTylEc=";
+  cargoHash = "sha256-iKYkZ2iG825hTsB5vH110+uNRTsSocRXyXAVy3eTRJE=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ma/mautrix-signal/package.nix b/pkgs/by-name/ma/mautrix-signal/package.nix
index f9a10e41c272..80c211f82e5d 100644
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "0.8.6";
+  version = "0.8.7";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     tag = "v${version}";
-    hash = "sha256-62Z7Lasx0bzCAWLvHN7uCUqkMk6W80PR24mwfJU/n3Q=";
+    hash = "sha256-dzE6CncAja/6GoeYFuCcxRfd60ybNnCL9HzdMXyfh0k=";
   };
 
   buildInputs =
@@ -41,7 +41,7 @@ buildGoModule rec {
 
   CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];
 
-  vendorHash = "sha256-srvqflqleK2KIgesEZPNhSQh/IFmyTElJ7iUjBEmNq0=";
+  vendorHash = "sha256-BYTAXhm7hjNa2DN/dcd77zOiDUGb7FC6y3I8FxwQvMI=";
 
   doCheck = true;
   preCheck = ''
diff --git a/pkgs/by-name/mu/multipath-tools/package.nix b/pkgs/by-name/mu/multipath-tools/package.nix
index 79061fdd0a63..39d5fc289a3d 100644
--- a/pkgs/by-name/mu/multipath-tools/package.nix
+++ b/pkgs/by-name/mu/multipath-tools/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "multipath-tools";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "opensvc";
     repo = "multipath-tools";
     tag = finalAttrs.version;
-    hash = "sha256-H5DY15On3mFwUHQhmC9s2thm0TUUIZbXM/Ot2FPL41Y=";
+    hash = "sha256-Jeiy1bM7vuy2+r/0W1nAhgsncyV6QHdlV55aepAxHAg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix
index d5c7eac379da..3c5600532d96 100644
--- a/pkgs/by-name/ni/nix-update/package.nix
+++ b/pkgs/by-name/ni/nix-update/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nix-update";
-  version = "1.12.1";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nix-update";
     tag = version;
-    hash = "sha256-ygbAx4TV9NFjpttn+4ELT3Zfu/tiRyigO7R4WT/ntTw=";
+    hash = "sha256-+d4NexgDkpuiesuA6vOv2COD3bgWddIL1SjFxuDF1dA=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/os/osm2pgsql/package.nix b/pkgs/by-name/os/osm2pgsql/package.nix
index ff28e839e94a..333037b46906 100644
--- a/pkgs/by-name/os/osm2pgsql/package.nix
+++ b/pkgs/by-name/os/osm2pgsql/package.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "osm2pgsql";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "osm2pgsql-dev";
     repo = "osm2pgsql";
     rev = finalAttrs.version;
-    hash = "sha256-5rENMcYCfHUdb4QsyOnnGe/qCbdYLoXI15e7OqJXit4=";
+    hash = "sha256-ZKSyMNc+EHY4QBTLtUiWiTMEcmAAbrV1xqxmvNF96f8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pf/pfetch/package.nix b/pkgs/by-name/pf/pfetch/package.nix
index 2c7eec81dbf2..0e00b882c059 100644
--- a/pkgs/by-name/pf/pfetch/package.nix
+++ b/pkgs/by-name/pf/pfetch/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "pfetch";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "Un1q32";
     repo = "pfetch";
     tag = version;
-    hash = "sha256-q1UMkeg9E02NPWku85xrn2msWesjD2NtZbbjppOla7o=";
+    hash = "sha256-2rBuqqS4jzefueVploU5bs2ZytDvYv5jeSK5jOyz86Y=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/pg/pgbackrest/package.nix b/pkgs/by-name/pg/pgbackrest/package.nix
index 9128586315b5..122516cbefbd 100644
--- a/pkgs/by-name/pg/pgbackrest/package.nix
+++ b/pkgs/by-name/pg/pgbackrest/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pgbackrest";
-  version = "2.55.1";
+  version = "2.56.0";
 
   src = fetchFromGitHub {
     owner = "pgbackrest";
     repo = "pgbackrest";
     tag = "release/${finalAttrs.version}";
-    hash = "sha256-A1dTywcCHBu7Ml0Q9k//VVPFN1C3kmmMkq4ok9T4g94=";
+    hash = "sha256-GDHpeTz85cgKTbcuaTlwJ1SUNMedSylqKWdrgH8Zp8Q=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ph/phd2/package.nix b/pkgs/by-name/ph/phd2/package.nix
index e2779819db6f..3764f27f0d48 100644
--- a/pkgs/by-name/ph/phd2/package.nix
+++ b/pkgs/by-name/ph/phd2/package.nix
@@ -56,7 +56,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/OpenPHDGuiding/phd2/releases/tag/v${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
-      hjones2199
       returntoreality
     ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index 3975102d5255..985a1307aa98 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -34,6 +34,8 @@
   vfkit,
   versionCheckHook,
   writableTmpDirAsHomeHook,
+  coreutils,
+  runtimeShell,
 }:
 let
   # do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
@@ -158,6 +160,9 @@ buildGoModule rec {
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     RPATH=$(patchelf --print-rpath $out/bin/.podman-wrapped)
     patchelf --set-rpath "${lib.makeLibraryPath [ systemd ]}":$RPATH $out/bin/.podman-wrapped
+    substituteInPlace "$out/share/systemd/user/podman-user-wait-network-online.service" \
+      --replace-fail sleep '${coreutils}/bin/sleep' \
+      --replace-fail /bin/sh '${runtimeShell}'
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/si/siril/package.nix b/pkgs/by-name/si/siril/package.nix
index f4757be44259..afae29ab2724 100644
--- a/pkgs/by-name/si/siril/package.nix
+++ b/pkgs/by-name/si/siril/package.nix
@@ -104,7 +104,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     changelog = "https://gitlab.com/free-astro/siril/-/blob/HEAD/ChangeLog";
     maintainers = with lib.maintainers; [
-      hjones2199
       returntoreality
     ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/sl/slack/sources.nix b/pkgs/by-name/sl/slack/sources.nix
index 74b6d61ef559..7996e2a0de4f 100644
--- a/pkgs/by-name/sl/slack/sources.nix
+++ b/pkgs/by-name/sl/slack/sources.nix
@@ -1,26 +1,26 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-08-29
+# Last updated: 2025-09-18
 { fetchurl }:
 {
   aarch64-darwin = {
-    version = "4.45.69";
+    version = "4.46.96";
     src = fetchurl {
-      url = "https://downloads.slack-edge.com/desktop-releases/mac/arm64/4.45.69/Slack-4.45.69-macOS.dmg";
-      hash = "sha256-MaPwj0niehwNYiSl8GdzKSF1mezKtIFiAmZzBWbwq9A=";
+      url = "https://downloads.slack-edge.com/desktop-releases/mac/arm64/4.46.96/Slack-4.46.96-macOS.dmg";
+      hash = "sha256-ewoTBqoHaZ7cqZg11nXqw0HCIfbzdwfQENL6cJVLn/0=";
     };
   };
   x86_64-darwin = {
-    version = "4.45.69";
+    version = "4.46.96";
     src = fetchurl {
-      url = "https://downloads.slack-edge.com/desktop-releases/mac/x64/4.45.69/Slack-4.45.69-macOS.dmg";
-      hash = "sha256-iO5hGzYYmrHoTznw++AEhGjTKiTngzA9/ho+oFGXVeI=";
+      url = "https://downloads.slack-edge.com/desktop-releases/mac/x64/4.46.96/Slack-4.46.96-macOS.dmg";
+      hash = "sha256-Kp+hoWtWVFpM78a8sSJsfFDphnWO1RZhbysH4gotHOE=";
     };
   };
   x86_64-linux = {
-    version = "4.45.69";
+    version = "4.46.96";
     src = fetchurl {
-      url = "https://downloads.slack-edge.com/desktop-releases/linux/x64/4.45.69/slack-desktop-4.45.69-amd64.deb";
-      hash = "sha256-CwM8oEyRBkE5FSBO5rl4ygRuLtaRefVVZpAEHKxXKcw=";
+      url = "https://downloads.slack-edge.com/desktop-releases/linux/x64/4.46.96/slack-desktop-4.46.96-amd64.deb";
+      hash = "sha256-PDUoEx7+ZWG3+T/d+zEn39sPF9wYB0NbzlhKw6lXl9g=";
     };
   };
 }
diff --git a/pkgs/by-name/st/steel/package.nix b/pkgs/by-name/st/steel/package.nix
index 8f3c0e95489c..d7a60c7b828d 100644
--- a/pkgs/by-name/st/steel/package.nix
+++ b/pkgs/by-name/st/steel/package.nix
@@ -19,16 +19,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "steel";
-  version = "0-unstable-2025-09-06";
+  version = "0-unstable-2025-09-17";
 
   src = fetchFromGitHub {
     owner = "mattwparas";
     repo = "steel";
-    rev = "0ff387fce6fc4a02fad4cde594f7db09598ef73d";
-    hash = "sha256-1f+OhoTkdk+mW+PawrrqWYW5HpIpFZ3nO5IJP68/LzM=";
+    rev = "e387a1f2b69edfd213451a6541ece49365da96f0";
+    hash = "sha256-vwz7MfSo2b5beWvB8x333wgDGUB0ZEL3UK+DIfL2idQ=";
   };
 
-  cargoHash = "sha256-a7wene1oI2lhMUo8iguosXyk1G12bhrEdK7IJ/WgRq4=";
+  cargoHash = "sha256-MTSVnCXXDVox3CfFEATTYffbKxG8ETp3p1Hp1+Nguiw=";
 
   nativeBuildInputs = [
     curl
diff --git a/pkgs/by-name/st/stellarsolver/package.nix b/pkgs/by-name/st/stellarsolver/package.nix
index a473e30b18eb..e8732dc65a01 100644
--- a/pkgs/by-name/st/stellarsolver/package.nix
+++ b/pkgs/by-name/st/stellarsolver/package.nix
@@ -41,7 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Astrometric plate solving library";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [
-      hjones2199
       returntoreality
     ];
     platforms = platforms.unix;
diff --git a/pkgs/by-name/te/tektoncd-cli-pac/package.nix b/pkgs/by-name/te/tektoncd-cli-pac/package.nix
new file mode 100644
index 000000000000..d205e517dcc8
--- /dev/null
+++ b/pkgs/by-name/te/tektoncd-cli-pac/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  stdenv,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "tektoncd-cli-pac";
+  version = "0.37.0";
+
+  src = fetchFromGitHub {
+    owner = "openshift-pipelines";
+    repo = "pipelines-as-code";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ti8IDslgSPTITrzjVRio1zsV92u505ySr16GfRKxtp8=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/openshift-pipelines/pipelines-as-code/pkg/params/version.Version=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  subPackages = [ "cmd/tkn-pac" ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd tkn-pac \
+      --bash <($out/bin/tkn-pac completion bash) \
+      --fish <($out/bin/tkn-pac completion fish) \
+      --zsh <($out/bin/tkn-pac completion zsh)
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://pipelinesascode.com";
+    changelog = "https://github.com/openshift-pipelines/pipelines-as-code/releases/tag/v${finalAttrs.version}";
+    description = "CLI for interacting with Tekton Pipelines as Code";
+    longDescription = ''
+      tkn-pac CLI Plugin – Easily manage Pipelines-as-Code repositories.
+    '';
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      netbrain
+      vdemeester
+      chmouel
+    ];
+    mainProgram = "tkn-pac";
+  };
+})
diff --git a/pkgs/by-name/wc/wcslib/package.nix b/pkgs/by-name/wc/wcslib/package.nix
index cd9eb0750cd7..5907e7370a25 100644
--- a/pkgs/by-name/wc/wcslib/package.nix
+++ b/pkgs/by-name/wc/wcslib/package.nix
@@ -41,7 +41,6 @@ stdenv.mkDerivation rec {
       standard library for this purpose in astronomy.
     '';
     maintainers = with lib.maintainers; [
-      hjones2199
       returntoreality
     ];
     license = lib.licenses.lgpl3Plus;
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 1503ce1908b1..fcf4435ed1e9 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.203.5";
+  version = "0.204.1";
 
   outputs = [
     "out"
@@ -112,7 +112,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gx/N06atH9D1caAqaTzeLKBXmYlUpawopB9yzboi0tA=";
+    hash = "sha256-vIcMJ3tFKPtfNID1Tk4UAkVzScsUB05brcg+gLIYWoc=";
   };
 
   patches = [
@@ -143,7 +143,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         --replace-fail '$CARGO_ABOUT_VERSION' '${cargo-about.version}'
     '';
 
-  cargoHash = "sha256-gPiQ6izmEhhGI+XficgALlraOKvapd2iwrWpSeiqsZ8=";
+  cargoHash = "sha256-IJ2IHOSEUlnDm5VzaAirFuAn+JYDjJVZ3cE/WWKn0QE=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 8eef520049e2..3f108b896400 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -252,7 +252,6 @@ stdenv.mkDerivation {
     # will succeed, but packages depending on boost-context will fail with
     # a very cryptic error message.
     badPlatforms = [ lib.systems.inspect.patterns.isMips64n32 ];
-    maintainers = with maintainers; [ hjones2199 ];
     broken =
       enableNumpy && lib.versionOlder version "1.86" && lib.versionAtLeast python.pkgs.numpy.version "2";
   };
diff --git a/pkgs/development/libraries/science/astronomy/indilib/default.nix b/pkgs/development/libraries/science/astronomy/indilib/default.nix
index 7b23f4a00e6f..cbbddf3d33e4 100644
--- a/pkgs/development/libraries/science/astronomy/indilib/default.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/default.nix
@@ -87,7 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/indilib/indi/releases/tag/v${finalAttrs.version}";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [
-      hjones2199
       sheepforce
       returntoreality
     ];
diff --git a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
index bf7716531095..57a0371090f6 100644
--- a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
@@ -116,7 +116,6 @@ let
             changelog = "https://github.com/indilib/indi-3rdparty/releases/tag/v${version}";
             license = licenses.lgpl2Plus;
             maintainers = with maintainers; [
-              hjones2199
               sheepforce
               returntoreality
             ];
diff --git a/pkgs/development/python-modules/libknot/default.nix b/pkgs/development/python-modules/libknot/default.nix
index 86105bae42d9..c315fe05b90b 100644
--- a/pkgs/development/python-modules/libknot/default.nix
+++ b/pkgs/development/python-modules/libknot/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "libknot";
-  version = "3.4.8";
+  version = "3.5.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mQAHjHBI4mTm4X54kzFRg7cV42/AktRQyNd2gT+n0KU=";
+    hash = "sha256-8sWO70le3qmhNiU4xEEM3IOrrc20+WT2Y2UBSPBEFkk=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kernel/common-flags.nix b/pkgs/os-specific/linux/kernel/common-flags.nix
index 2fb92049195d..410a112825ee 100644
--- a/pkgs/os-specific/linux/kernel/common-flags.nix
+++ b/pkgs/os-specific/linux/kernel/common-flags.nix
@@ -26,9 +26,15 @@
   "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
 ]
 # Add the built in headers the kernel needs
-++ lib.optionals (stdenv.cc.isClang) [
-  "CFLAGS_MODULE=-I${lib.getLib stdenv.cc.cc}/lib/clang/${lib.versions.major stdenv.cc.cc.version}/include"
-  "CFLAGS_KERNEL=-I${lib.getLib stdenv.cc.cc}/lib/clang/${lib.versions.major stdenv.cc.cc.version}/include"
-]
+++ lib.optionals (stdenv.cc.isClang) (
+  let
+    clangLib = lib.getLib stdenv.cc.cc;
+    majorVer = lib.versions.major clangLib.version;
+  in
+  [
+    "CFLAGS_MODULE=-I${clangLib}/lib/clang/${majorVer}/include"
+    "CFLAGS_KERNEL=-I${clangLib}/lib/clang/${majorVer}/include"
+  ]
+)
 ++ (stdenv.hostPlatform.linux-kernel.makeFlags or [ ])
 ++ extraMakeFlags
diff --git a/pkgs/servers/monitoring/prometheus/knot-exporter.nix b/pkgs/servers/monitoring/prometheus/knot-exporter.nix
index 307dd99487df..308f1af399ff 100644
--- a/pkgs/servers/monitoring/prometheus/knot-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/knot-exporter.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "knot-exporter";
-  version = "3.4.8";
+  version = "3.5.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "knot_exporter";
     inherit version;
-    hash = "sha256-MmxjwHYFoUebrnqjU4XC6sZAbIqbrnFokzrSk8PBhcU=";
+    hash = "sha256-uFCIM+pZiJ6nvapEKjgHRrIuc5p5uq5q1ToD36e19zk=";
   };
 
   build-system = [
diff --git a/pkgs/servers/monitoring/prometheus/postfix-exporter.nix b/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
index 4c69dac2ac79..172c6a19f96e 100644
--- a/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/postfix-exporter.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "postfix_exporter";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "Hsn723";
     repo = "postfix_exporter";
     tag = "v${version}";
-    sha256 = "sha256-D6m0xWNkUMouubNjIaB/dHT1YIcDi/oJ6U+2lmKwBZM=";
+    sha256 = "sha256-0HgvkKdgfKcX74dJLOxSnp1xJuaOazusgDrCdhX/Lg4=";
   };
 
-  vendorHash = "sha256-kmZWQu26TBhEQo/SrPxhyeGo5yliCFUCTxIIkncCciw=";
+  vendorHash = "sha256-HsXVZ6fmaGU93CpA+t/VpIsEigkh09Uw8h7eSeaThk4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/servers/varnish/default.nix b/pkgs/servers/varnish/default.nix
index ad5e6b3db6ed..6bfdb9b912e1 100644
--- a/pkgs/servers/varnish/default.nix
+++ b/pkgs/servers/varnish/default.nix
@@ -109,8 +109,8 @@ in
 {
   # EOL (LTS) TBA
   varnish60 = common {
-    version = "6.0.15";
-    hash = "sha256-VV0G10Glo+svBju+3G8gmRMF3w4nz8oj6X1v/28q5qw=";
+    version = "6.0.16";
+    hash = "sha256-ZVJxDHp9LburwlJ1LCR5CKPRaSbNixiEch/l3ZP0QyQ=";
   };
   # EOL 2026-03-15
   varnish77 = common {