diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 0c8548d05deb..aee4258f7bb7 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   backport:
     name: Backport Pull Request
-    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
+    if: vars.NIXPKGS_CI_APP_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
     runs-on: ubuntu-24.04-arm
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
diff --git a/.github/workflows/check-cherry-picks.yml b/.github/workflows/check-cherry-picks.yml
index f74c83cb6ddf..70dfdfba1e5f 100644
--- a/.github/workflows/check-cherry-picks.yml
+++ b/.github/workflows/check-cherry-picks.yml
@@ -1,6 +1,9 @@
 name: "Check cherry-picks"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-cherry-picks.yml
   pull_request_target:
     branches:
       - 'release-**'
@@ -13,7 +16,6 @@ jobs:
   check:
     name: cherry-pick-check
     runs-on: ubuntu-24.04-arm
-    if: github.repository_owner == 'NixOS'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
diff --git a/.github/workflows/check-format.yml b/.github/workflows/check-format.yml
index caa6db054e15..01312cd8f170 100644
--- a/.github/workflows/check-format.yml
+++ b/.github/workflows/check-format.yml
@@ -1,6 +1,9 @@
 name: Check that files are formatted
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-format.yml
   pull_request_target:
     types: [opened, synchronize, reopened, edited]
 
diff --git a/.github/workflows/check-shell.yml b/.github/workflows/check-shell.yml
index c8ecf553f107..c26bea7761bc 100644
--- a/.github/workflows/check-shell.yml
+++ b/.github/workflows/check-shell.yml
@@ -1,6 +1,9 @@
 name: "Check shell"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-shell.yml
   pull_request_target:
     paths:
       - 'shell.nix'
diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml
index 3c0e49afb5c7..28b0ef43d5ac 100644
--- a/.github/workflows/codeowners-v2.yml
+++ b/.github/workflows/codeowners-v2.yml
@@ -23,6 +23,9 @@
 name: Codeowners v2
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/codeowners-v2.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
@@ -64,6 +67,7 @@ jobs:
         run: nix-build base/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_RO_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -77,6 +81,7 @@ jobs:
           path: pr
 
       - name: Validate codeowners
+        if: steps.app-token.outputs.token
         run: result/bin/codeowners-validator
         env:
           OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
@@ -99,6 +104,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -111,6 +117,7 @@ jobs:
         run: nix-build ci -A requestReviews
 
       - name: Request reviews
+        if: steps.app-token.outputs.token
         run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/eval-aliases.yml b/.github/workflows/eval-aliases.yml
index 8dfb298c6da8..7f9b658081f1 100644
--- a/.github/workflows/eval-aliases.yml
+++ b/.github/workflows/eval-aliases.yml
@@ -1,6 +1,9 @@
 name: Eval aliases
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/eval-aliases.yml
   pull_request_target:
 
 permissions: {}
@@ -26,7 +29,7 @@ jobs:
           extra_nix_config: sandbox = true
 
       - name: Ensure flake outputs on all systems still evaluate
-        run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs
+        run: nix flake check --all-systems --no-build ./nixpkgs
 
       - name: Query nixpkgs with aliases enabled to check for basic syntax errors
         run: |
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 55f58bf9cbac..ce9378e62320 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -1,6 +1,9 @@
 name: Eval
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/eval.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened]
   push:
@@ -175,6 +178,7 @@ jobs:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -205,6 +209,7 @@ jobs:
         run: nix-build base/ci -A requestReviews
 
       - name: Labelling pull request
+        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
         run: |
           # Get all currently set rebuild labels
           gh api \
@@ -239,7 +244,7 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' }}
+        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
         run: |
           description=$(jq -r '
           "Package: added " + (.attrdiff.added | length | tostring) +
@@ -259,6 +264,7 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Requesting maintainer reviews
+        if: ${{ steps.app-token.outputs.token && github.repository_owner == 'NixOS' }}
         run: |
           # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
           # There appears to be no API to request reviews based on GitHub IDs
diff --git a/.github/workflows/get-merge-commit.yml b/.github/workflows/get-merge-commit.yml
index d39e2ad3acfc..edbda3e040eb 100644
--- a/.github/workflows/get-merge-commit.yml
+++ b/.github/workflows/get-merge-commit.yml
@@ -1,6 +1,9 @@
 name: Get merge commit
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/get-merge-commit.yml
   workflow_call:
     outputs:
       mergedSha:
@@ -38,7 +41,7 @@ jobs:
             push)
               echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
               ;;
-            pull_request_target)
+            pull_request*)
               if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
                 echo -e "Checking the commits:\n$commits"
                 echo "$commits" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/lib-tests.yml b/.github/workflows/lib-tests.yml
index 0643f980381b..d55a109aa9f5 100644
--- a/.github/workflows/lib-tests.yml
+++ b/.github/workflows/lib-tests.yml
@@ -1,6 +1,9 @@
 name: "Building Nixpkgs lib-tests"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/lib-tests.yml
   pull_request_target:
     paths:
       - 'lib/**'
diff --git a/.github/workflows/manual-nixos-v2.yml b/.github/workflows/manual-nixos-v2.yml
index fd0f91e2e0c7..a8eadf63057e 100644
--- a/.github/workflows/manual-nixos-v2.yml
+++ b/.github/workflows/manual-nixos-v2.yml
@@ -1,6 +1,9 @@
 name: "Build NixOS manual v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/manual-nixos-v2.yml
   pull_request_target:
     branches:
       - master
@@ -38,7 +41,6 @@ jobs:
           extra_nix_config: sandbox = true
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
diff --git a/.github/workflows/manual-nixpkgs-v2.yml b/.github/workflows/manual-nixpkgs-v2.yml
index f899ad409d50..f9a5f8aa30b1 100644
--- a/.github/workflows/manual-nixpkgs-v2.yml
+++ b/.github/workflows/manual-nixpkgs-v2.yml
@@ -1,6 +1,9 @@
 name: "Build Nixpkgs manual v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/manual-nixpkgs-v2.yml
   pull_request_target:
     branches:
       - master
@@ -25,7 +28,6 @@ jobs:
           extra_nix_config: sandbox = true
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        if: github.repository_owner == 'NixOS'
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
diff --git a/.github/workflows/nix-parse-v2.yml b/.github/workflows/nix-parse-v2.yml
index aec48b0ac768..4b670331308e 100644
--- a/.github/workflows/nix-parse-v2.yml
+++ b/.github/workflows/nix-parse-v2.yml
@@ -1,6 +1,9 @@
 name: "Check whether nix files are parseable v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/nix-parse-v2.yml
   pull_request_target:
 
 permissions: {}
diff --git a/.github/workflows/nixpkgs-vet.yml b/.github/workflows/nixpkgs-vet.yml
index 80d6ba0b9aba..b9f9fd2c56f6 100644
--- a/.github/workflows/nixpkgs-vet.yml
+++ b/.github/workflows/nixpkgs-vet.yml
@@ -6,6 +6,9 @@
 name: Vet nixpkgs
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/nixpkgs-vet.yml
   pull_request_target:
     # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
     # Instead it causes an `edited` event, so we need to add it explicitly here.
diff --git a/.github/workflows/no-channel.yml b/.github/workflows/no-channel.yml
index c5eae3c94e7d..ee305a12d61b 100644
--- a/.github/workflows/no-channel.yml
+++ b/.github/workflows/no-channel.yml
@@ -1,6 +1,9 @@
 name: "No channel PR"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/no-channel.yml
   pull_request_target:
     # Re-run should be triggered when the base branch is updated, instead of silently failing
     types: [opened, synchronize, reopened, edited]
diff --git a/ci/pinned-nixpkgs.json b/ci/pinned-nixpkgs.json
index c5c558dc61bc..f5efff109e8c 100644
--- a/ci/pinned-nixpkgs.json
+++ b/ci/pinned-nixpkgs.json
@@ -1,4 +1,4 @@
 {
-  "rev": "573c650e8a14b2faa0041645ab18aed7e60f0c9a",
-  "sha256": "0qg99zj0gb0pc6sjlkmwhk1c1xz14qxmk6gamgfmcxpsfdp5vn72"
+  "rev": "eaeed9530c76ce5f1d2d8232e08bec5e26f18ec1",
+  "sha256": "132nimgi1g88fbhddk4b8b1qk68jly494x2mnphyk3xa1d2wy9q7"
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8caf926ee848..8a45f107cee1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1859,6 +1859,12 @@
     name = "Austin Lund";
     keys = [ { fingerprint = "7083 E268 4BFD 845F 2B84  9E74 B695 8918 ED23 32CE"; } ];
   };
+  appleboblin = {
+    email = "github@appleboblin.com";
+    github = "appleboblin";
+    githubId = 16847957;
+    name = "Po-Hui Lin";
+  };
   applejag = {
     email = "applejag.luminance905@passmail.com";
     github = "applejag";
diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index 891bfeb30449..b95142bc83b5 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -160,7 +160,7 @@ in
       # Generated with `uuidgen`. Random but fixed to improve reproducibility.
       default = "0867da16-f251-457d-a9e8-c31f9a3c220b";
       description = ''
-          A UUID to use as a seed. You can set this to `null` to explicitly
+        A UUID to use as a seed. You can set this to `null` to explicitly
         randomize the partition UUIDs.
       '';
     };
@@ -169,7 +169,7 @@ in
       type = lib.types.bool;
       default = false;
       description = ''
-          Enables generation of split artifacts from partitions. If enabled, for
+        Enables generation of split artifacts from partitions. If enabled, for
         each partition with SplitName= set, a separate output file containing
         just the contents of that partition is generated.
       '';
@@ -180,7 +180,7 @@ in
       default = 512;
       example = lib.literalExpression "4096";
       description = ''
-          The sector size of the disk image produced by systemd-repart. This
+        The sector size of the disk image produced by systemd-repart. This
         value must be a power of 2 between 512 and 4096.
       '';
     };
@@ -199,7 +199,7 @@ in
       type = with lib.types; attrsOf (submodule partitionOptions);
       default = { };
       example = lib.literalExpression ''
-          {
+        {
           "10-esp" = {
             contents = {
               "/EFI/BOOT/BOOTX64.EFI".source =
@@ -221,7 +221,7 @@ in
         };
       '';
       description = ''
-          Specify partitions as a set of the names of the partitions with their
+        Specify partitions as a set of the names of the partitions with their
         configuration as the key.
       '';
     };
@@ -230,12 +230,12 @@ in
       type = with lib.types; attrsOf (listOf str);
       default = { };
       example = lib.literalExpression ''
-          {
+        {
           vfat = [ "-S 512" "-c" ];
         }
       '';
       description = ''
-          Specify extra options for created file systems. The specified options
+        Specify extra options for created file systems. The specified options
         are converted to individual environment variables of the format
         `SYSTEMD_REPART_MKFS_OPTIONS_<FSTYPE>`.
 
diff --git a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
index 3bbd3e4765e9..a921783dc303 100644
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-04-24";
+  version = "0-unstable-2025-05-09";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "d3b7313d232156a1f60ce31749fe68e498ad3bf4";
-    hash = "sha256-rU2HA0ap8O02qJHHksKigjAeRgnkV6F6z5JIusWlDZM=";
+    rev = "7c30b5266a37cee67612b7cab1a714be16f3be4e";
+    hash = "sha256-VVswTqlUqW79P9LhEV7epEGT6JknejZnArb3f+qFE40=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/emulators/libretro/cores/gambatte.nix b/pkgs/applications/emulators/libretro/cores/gambatte.nix
index ef8295c2866f..57f1183b4014 100644
--- a/pkgs/applications/emulators/libretro/cores/gambatte.nix
+++ b/pkgs/applications/emulators/libretro/cores/gambatte.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2025-04-18";
+  version = "0-unstable-2025-05-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "b285b0823ac867371e72c54d5275a554c7be312c";
-    hash = "sha256-/PFSMcx+iBpiMHSqAhGVjbXDkMk9En0UZPChPROaLck=";
+    rev = "a85fe7c20933dbe4680d783d32639a71a85783cb";
+    hash = "sha256-YwQQkRshDDQi9CzqNnhKkj7+A0fkvcEZEg6PySaFDRI=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index 579048decdb6..0db8ba1d4996 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -37,14 +37,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mame";
-  version = "0.276";
+  version = "0.277";
   srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
     rev = "mame${srcVersion}";
-    hash = "sha256-HrEQmeCTwNXcEWcpXfLkBNnZdcZag4nB6ZN+8KKf5AE=";
+    hash = "sha256-mGKTZ8/gvGQv9oXK4pgbJk580GAAXUS16hRQu4uHhdA=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/go/goperf/package.nix b/pkgs/by-name/go/goperf/package.nix
index c5f97eafa6dc..7caaff06ea86 100644
--- a/pkgs/by-name/go/goperf/package.nix
+++ b/pkgs/by-name/go/goperf/package.nix
@@ -9,15 +9,15 @@
 
 buildGoModule rec {
   pname = "goperf";
-  version = "0-unstable-2025-04-07";
+  version = "0-unstable-2025-05-05";
 
   src = fetchgit {
     url = "https://go.googlesource.com/perf";
-    rev = "71ba5bc8ccce8a755de82e9bad6ca4e4d7b590d2";
-    hash = "sha256-xY9Z502YUUePqoocBWWPxD/TLFQtYq3TLyj3Izp8n9A=";
+    rev = "a54a20dddd9743f7ac60d2d506e561eaeafd4831";
+    hash = "sha256-+d8s9kEzBJ/21U2x8ZuiGdQrspFIJEmrjxmzNahC/V0=";
   };
 
-  vendorHash = "sha256-BYfn9ip8QCS+spYR51eS6SysYlZtBZf7GhuFZVh3Kb8=";
+  vendorHash = "sha256-nqK6xMKYe4uMXvcqopTAV66qklWUq1TzsP8V67TGJJU=";
 
   passthru.updateScript = writeShellScript "update-goperf" ''
     export UPDATE_NIX_ATTR_PATH=goperf
diff --git a/pkgs/by-name/ha/haguichi/package.nix b/pkgs/by-name/ha/haguichi/package.nix
index 122b85a98ba9..0575fa7bf918 100644
--- a/pkgs/by-name/ha/haguichi/package.nix
+++ b/pkgs/by-name/ha/haguichi/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "haguichi";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "ztefn";
     repo = "haguichi";
     tag = finalAttrs.version;
-    hash = "sha256-hSQsKG86QUzv/dfqz2amSXyAaA1ZAk9dTvel9KVgeFs=";
+    hash = "sha256-IEcBCiPU9NPrAbTCnONraeVb/Nlq/u4fsEZX+Vd1DiY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/mo/mold/package.nix b/pkgs/by-name/mo/mold/package.nix
index b0d5644f6107..07161835189e 100644
--- a/pkgs/by-name/mo/mold/package.nix
+++ b/pkgs/by-name/mo/mold/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mold";
-  version = "2.39.0";
+  version = "2.39.1";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DT8xU1JN3zeJe7o7YQFrnpyN0LtcsclUsIX5jFeVYvA=";
+    hash = "sha256-uC6oakFfF0tpSiBeps5IO41Khk7VyCMSZhVh2Gmwlyc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/nezha/package.nix b/pkgs/by-name/ne/nezha/package.nix
index cd1a3ec815d3..48509c03fdef 100644
--- a/pkgs/by-name/ne/nezha/package.nix
+++ b/pkgs/by-name/ne/nezha/package.nix
@@ -14,7 +14,7 @@
 
 let
   pname = "nezha";
-  version = "1.12.0";
+  version = "1.12.4";
 
   frontendName = lib.removePrefix "nezha-theme-";
 
@@ -58,7 +58,7 @@ buildGo124Module {
     owner = "nezhahq";
     repo = "nezha";
     tag = "v${version}";
-    hash = "sha256-ajjAsoR+1HRHfIjyqlJFHtn1nzDAdbP5TzKOqnHlAXw=";
+    hash = "sha256-f9zP9koWjP8PPtQhbYx56J1mW8+xKuZCfxgOLw6XGc0=";
   };
 
   proxyVendor = true;
@@ -97,7 +97,7 @@ buildGo124Module {
     GOROOT=''${GOROOT-$(go env GOROOT)} swag init --pd -d . -g ./cmd/dashboard/main.go -o ./cmd/dashboard/docs --parseGoList=false
   '';
 
-  vendorHash = "sha256-8pOeMUiBEUbB7D3MnlpOTdanktR8XdXm3YB53XMCDWQ=";
+  vendorHash = "sha256-Pj5HfrwIuWt3Uwt2Y9Tz96B2kL7Svq5rzU1hKf/RZ4s=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/no/nomacs/package.nix b/pkgs/by-name/no/nomacs/package.nix
index 91ce841ac804..9de9d0d728ae 100644
--- a/pkgs/by-name/no/nomacs/package.nix
+++ b/pkgs/by-name/no/nomacs/package.nix
@@ -18,8 +18,8 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nomacs";
-  version = "3.19.1";
-  hash = "sha256-NRwZ/ShJaLCMFv7QdfRoJY5zQFo18cAVWGRpS3ap3Rw=";
+  version = "3.21.1";
+  hash = "sha256-RRa19vj7iTtGzdssdtHVOsDzS4X+p1HeiZKy8EIWxq8=";
 
   src = fetchFromGitHub {
     owner = "nomacs";
@@ -32,8 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
   plugins = fetchFromGitHub {
     owner = "novomesk";
     repo = "nomacs-plugins";
-    rev = "40d0f7089b7f108077dac5dede52e8a303b243b3";
-    hash = "sha256-7+JMmHaTvWjVTkLwXGtQHnoaC/3vK7haCzNvVIZ9F/g=";
+    rev = "20101da282f13d3184ece873388e1c234a79b5e7";
+    hash = "sha256-gcRc4KoWJQ5BirhLuk+c+5HwBeyQtlJ3iyX492DXeVk=";
   };
 
   outputs =
diff --git a/pkgs/by-name/py/pyradio/package.nix b/pkgs/by-name/py/pyradio/package.nix
index 7c17ff8fc57a..715a16584f8e 100644
--- a/pkgs/by-name/py/pyradio/package.nix
+++ b/pkgs/by-name/py/pyradio/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.9.3.11.9";
+  version = "0.9.3.11.11";
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     tag = version;
-    hash = "sha256-paDiD47ERcVNQ1iVEKY2xBItFhyedacAAElT0slBYWk=";
+    hash = "sha256-yVXq9wHuPO87SRxJdFtYeQWFzeX6IwhKdMchhuzo0ms=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qu/quick-sasl/package.nix b/pkgs/by-name/qu/quick-sasl/package.nix
new file mode 100644
index 000000000000..8c778e617d56
--- /dev/null
+++ b/pkgs/by-name/qu/quick-sasl/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  pkg-config,
+  cmake,
+  arpa2cm,
+  arpa2common,
+  quickmem,
+  cyrus_sasl,
+  quickder,
+  libkrb5,
+  libev,
+  e2fsprogs,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "quick-sasl";
+  version = "0.13.2";
+
+  src = fetchFromGitLab {
+    owner = "arpa2";
+    repo = "quick-sasl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-kMKZRromm/hb9PZwvWAzmJorSqTB8xMIbWASfSjajiQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    libkrb5
+  ];
+
+  buildInputs = [
+    arpa2cm
+    arpa2common
+    quickmem
+    cyrus_sasl
+    quickder
+    libev
+    e2fsprogs
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Gentle wrapper around any SASL implementation";
+    homepage = "https://gitlab.com/arpa2/Quick-SASL";
+    changelog = "https://gitlab.com/arpa2/Quick-SASL/-/blob/v${finalAttrs.version}/CHANGES";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.linux;
+    teams = with lib.teams; [ ngi ];
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "qsasl-server";
+  };
+})
diff --git a/pkgs/by-name/re/retroarch-bare/package.nix b/pkgs/by-name/re/retroarch-bare/package.nix
index c18549926298..149abd2f592c 100644
--- a/pkgs/by-name/re/retroarch-bare/package.nix
+++ b/pkgs/by-name/re/retroarch-bare/package.nix
@@ -58,12 +58,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "retroarch-bare";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "RetroArch";
-    hash = "sha256-ER90i0BlHC8SXfz6DzoIPCP1G8n4NNyJcRE88YY0gXk=";
+    hash = "sha256-OewUmnYpRByOgTi42G2reoaSuwxyPGHwP0+Uts/pg54=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/by-name/ri/rime-wanxiang/package.nix b/pkgs/by-name/ri/rime-wanxiang/package.nix
new file mode 100644
index 000000000000..0606b8f4306f
--- /dev/null
+++ b/pkgs/by-name/ri/rime-wanxiang/package.nix
@@ -0,0 +1,91 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  librime,
+  rime-data,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "rime-wanxiang";
+  version = "6.7.8";
+
+  src = fetchFromGitHub {
+    owner = "amzxyz";
+    repo = "rime_wanxiang";
+    tag = "v" + finalAttrs.version;
+    hash = "sha256-U5aM8LMBh0ncGPIllhioJCS1/5SncWYg8e+C5tXDST0=";
+  };
+
+  nativeBuildInputs = [
+    librime
+  ];
+
+  buildInputs = [
+    rime-data
+  ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    for s in *.schema.yaml; do
+        rime_deployer --compile "$s" . ${rime-data}/share/rime-data ./build
+    done
+
+    rm build/*.txt
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    dst=$out/share/rime-data
+    mkdir -p $dst
+
+    rm -r .github custom LICENSE squirrel.yaml weasel.yaml *.md *.trime.yaml
+    mv default.yaml wanxiang_suggested_default.yaml
+
+    cp -pr -t $dst *
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Feature-rich pinyin schema for Rime, basic edition";
+    longDescription = ''
+      万象拼音基础版 is a basic quanpin and shuangpin input schema for Rime based on
+      [万象 dictionaries and grammar models](https://github.com/amzxyz/RIME-LMDG),
+      supporting traditional shuangpin as well as tonal schemata such as 自然龙 and
+      龙码.
+
+      The schema requires to work the grammar model `wanxiang-lts-zh-hans.gram`.
+      However, this file is
+      [released](https://github.com/amzxyz/RIME-LMDG/releases/tag/LTS) by
+      carelessly overriding the old versions
+      (see the [discussion](https://github.com/amzxyz/RIME-LMDG/issues/22)). So
+      we can't pack it into Nixpkgs, which demands reproducibility. You have to
+      download it yourself and place it in the user directory of Rime.
+
+      The upstream `default.yaml` is included as
+      `wanxiang_suggested_default.yaml`. To enable it, please modify your
+      `default.custom.yaml` as such:
+
+      ```yaml
+      patch:
+        __include: wanxiang_suggested_default:/
+      ```
+    '';
+    homepage = "https://github.com/amzxyz/rime_wanxiang";
+    downloadPage = "https://github.com/amzxyz/rime_wanxiang/releases";
+    changelog = "https://github.com/amzxyz/rime_wanxiang/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.cc-by-40;
+    maintainers = with lib.maintainers; [ rc-zb ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/se/sendme/package.nix b/pkgs/by-name/se/sendme/package.nix
index 6e3fac4be48a..335b8c0219d1 100644
--- a/pkgs/by-name/se/sendme/package.nix
+++ b/pkgs/by-name/se/sendme/package.nix
@@ -18,6 +18,15 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-1VVpjeGU6/+apTHv7klo7FkAQ3AVjiziQRNI7yFbvh0=";
 
+  __darwinAllowLocalNetworking = true;
+
+  # On Darwin, sendme invokes CoreFoundation APIs that read ICU data from the
+  # system. Ensure these paths are accessible in the sandbox to avoid segfaults
+  # during checkPhase.
+  sandboxProfile = ''
+    (allow file-read* (subpath "/usr/share/icu"))
+  '';
+
   meta = with lib; {
     description = "Tool to send files and directories, based on iroh";
     homepage = "https://iroh.computer/sendme";
diff --git a/pkgs/by-name/su/suitesparse-graphblas/package.nix b/pkgs/by-name/su/suitesparse-graphblas/package.nix
index e5069b3b8989..780aae1eecf8 100644
--- a/pkgs/by-name/su/suitesparse-graphblas/package.nix
+++ b/pkgs/by-name/su/suitesparse-graphblas/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "suitesparse-graphblas";
-  version = "10.0.3";
+  version = "10.0.5";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     owner = "DrTimothyAldenDavis";
     repo = "GraphBLAS";
     rev = "v${version}";
-    hash = "sha256-/ieCvfHAU86rSW7hIDzY0IK6DqZeZ2u7vrDWV7rOUaI=";
+    hash = "sha256-BesARhxqfi4GsgdYsJd5b1+TYme891PezhSouDfZXBo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix
index b96d80f91f81..ba11fde28911 100644
--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.34.2";
+  version = "1.34.3";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +18,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-M11yqIPVVHmyZf2qcoVxY00P/Pr3ch0uyJn2evofDmI=";
+    hash = "sha256-uG2u1WY63vp2jZPQl1Hfv6wvl4CYm9qkIhhi5qV6oz4=";
   };
 
-  vendorHash = "sha256-ldEIZFtoLJetSij614mvOos/kVQTakn2Fj0CNMEdEWE=";
+  vendorHash = "sha256-WOnFFUmXCjdaSbykXLya0TNOqgnYL33qUq5fAho17TE=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/by-name/tw/twingate/package.nix b/pkgs/by-name/tw/twingate/package.nix
index 02003ad40937..60756975e8e4 100644
--- a/pkgs/by-name/tw/twingate/package.nix
+++ b/pkgs/by-name/tw/twingate/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "twingate";
-  version = "2025.72.142645";
+  version = "2025.114.149850";
 
   src = fetchurl {
     url = "https://binaries.twingate.com/client/linux/DEB/x86_64/${version}/twingate-amd64.deb";
-    hash = "sha256-8NIaPj6q2wPq908ZQt4Dihb0ffcc/pccrQD6lonsehc=";
+    hash = "sha256-rsV05HuGPrY6sNWP8JRaniwaj8Bn2V2Dk7yXX7gibFs=";
   };
 
   buildInputs = [
diff --git a/pkgs/desktops/lomiri/applications/lomiri-camera-app/default.nix b/pkgs/desktops/lomiri/applications/lomiri-camera-app/default.nix
index ebe122ff62be..6497a0571c2f 100644
--- a/pkgs/desktops/lomiri/applications/lomiri-camera-app/default.nix
+++ b/pkgs/desktops/lomiri/applications/lomiri-camera-app/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-camera-app";
-  version = "4.0.7";
+  version = "4.0.8";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/apps/lomiri-camera-app";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x0hxOGPIxzQdwzb8f4wvllAW1hJ5lyR4qYvyX96RMoA=";
+    hash = "sha256-4Tkiv0f+1uZKkeyE60G/ThThMyNp+l8q6d4tiKipM3A=";
   };
 
   # We don't want absolute paths in desktop files
diff --git a/pkgs/development/python-modules/backtesting/default.nix b/pkgs/development/python-modules/backtesting/default.nix
new file mode 100644
index 000000000000..162f88ef377e
--- /dev/null
+++ b/pkgs/development/python-modules/backtesting/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  setuptools-scm,
+  setuptools-git,
+  numpy,
+  pandas,
+  bokeh,
+}:
+
+buildPythonPackage rec {
+  pname = "backtesting";
+  version = "0.6.3";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-xryzvjKT+FRbF4pnniHvkRA98jrZVoCyYOmjYU93Ta4=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    setuptools-git
+  ];
+
+  dependencies = [
+    numpy
+    pandas
+    bokeh
+  ];
+
+  # No tests
+  doCheck = false;
+
+  meta = {
+    description = "Backtest trading strategies in Python";
+    homepage = "https://kernc.github.io/backtesting.py/";
+    changelog = "https://github.com/kernc/backtesting.py/blob/${version}/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ appleboblin ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysunspec2/default.nix b/pkgs/development/python-modules/pysunspec2/default.nix
new file mode 100644
index 000000000000..e3d321895db6
--- /dev/null
+++ b/pkgs/development/python-modules/pysunspec2/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  pythonOlder,
+  fetchFromGitHub,
+  buildPythonPackage,
+  pytestCheckHook,
+  setuptools,
+  pyserial,
+  openpyxl,
+}:
+
+buildPythonPackage rec {
+  pname = "pysunspec2";
+  version = "1.2.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "sunspec";
+    repo = "pysunspec2";
+    tag = "v${version}";
+    hash = "sha256-N3Daa1l2uzRbj2GpgdulzNhqxtRLvxZuEHxlKMsAdso=";
+    fetchSubmodules = true;
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    openpyxl
+    pyserial
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "sunspec2" ];
+
+  meta = with lib; {
+    description = "Python library for interfacing with SunSpec devices";
+    homepage = "https://github.com/sunspec/pysunspec2";
+    changelog = "https://github.com/sunspec/pysunspec2/releases/tag/${src.tag}";
+    license = licenses.asl20;
+    maintainers = [ lib.maintainers.cheriimoya ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ab494e753d68..d9e9065775d6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1602,6 +1602,8 @@ self: super: with self; {
 
   backports-tarfile = callPackage ../development/python-modules/backports-tarfile { };
 
+  backtesting = callPackage ../development/python-modules/backtesting { };
+
   bacpypes = callPackage ../development/python-modules/bacpypes { };
 
   bagit = callPackage ../development/python-modules/bagit { };
@@ -13570,6 +13572,8 @@ self: super: with self; {
 
   pysuezv2 = callPackage ../development/python-modules/pysuezv2 { };
 
+  pysunspec2 = callPackage ../development/python-modules/pysunspec2 { };
+
   pysvg-py3 = callPackage ../development/python-modules/pysvg-py3 { };
 
   pysvn = callPackage ../development/python-modules/pysvn {