diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2867ce402dc6..c709550db2fd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3486,6 +3486,11 @@
     githubId = 50839;
     name = "Brian Jones";
   };
+  bokicoder = {
+    github = "bokicoder";
+    githubId = 193465580;
+    name = "bokicoder";
+  };
   boldikoller = {
     email = "boldi.koller@wtss.eu";
     github = "boldikoller";
@@ -5669,6 +5674,12 @@
     githubId = 4971975;
     name = "Janne Heß";
   };
+  dashietm = {
+    email = "fabio.lenherr@gmail.com";
+    github = "DashieTM";
+    githubId = 72016555;
+    name = "Fabio Lenherr";
+  };
   dasisdormax = {
     email = "dasisdormax@mailbox.org";
     github = "dasisdormax";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 50cd00ea43c3..0094ba222251 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -515,6 +515,8 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
 
+- The [Starship](https://starship.rs) module now automatically loads the starship prompt when using [`xonsh`](https://xon.sh).
+
 - [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.
 
 - There is a new set of NixOS test tools for testing virtual Wi-Fi networks in many different topologies. See the {option}`services.vwifi` module, {option}`services.kismet` NixOS test, and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-nixos-test-wifi) for documentation and examples.
diff --git a/nixos/lib/make-disk-image.nix b/nixos/lib/make-disk-image.nix
index 015d7e4dbe53..b63c64f0188b 100644
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@@ -39,6 +39,14 @@
 
   This partition layout is unsuitable for UEFI.
 
+  #### `legacy+boot`
+
+  The image is partitioned using MBR and:
+  - creates a FAT32 BOOT partition from 1MiB to specified `bootSize` parameter (256MiB by default), set it bootable ;
+  - creates a primary ext4 partition starting after the boot partition and extending to the full disk image
+
+  This partition layout is unsuitable for UEFI.
+
   #### `legacy+gpt`
 
   This partition table type uses GPT and:
@@ -106,7 +114,7 @@
   additionalSpace ? "512M",
 
   # size of the boot partition, is only used if partitionTableType is
-  # either "efi" or "hybrid"
+  # either "efi", "hybrid", or "legacy+boot"
   # This will be undersized slightly, as this is actually the offset of
   # the end of the partition. Generally it will be 1MiB smaller.
   bootSize ? "256M",
@@ -197,6 +205,7 @@
 assert (
   lib.assertOneOf "partitionTableType" partitionTableType [
     "legacy"
+    "legacy+boot"
     "legacy+gpt"
     "efi"
     "efixbootldr"
@@ -260,6 +269,7 @@ let
     {
       # switch-case
       legacy = "1";
+      "legacy+boot" = "2";
       "legacy+gpt" = "2";
       efi = "2";
       efixbootldr = "3";
@@ -276,6 +286,14 @@ let
           mkpart primary ext4 1MiB 100% \
           print
       '';
+      "legacy+boot" = ''
+        parted --script $diskImage -- \
+          mklabel msdos \
+          mkpart primary fat32 1MiB $bootSizeMiB \
+          set 1 boot on \
+          mkpart primary ext4 $bootSizeMiB 100% \
+          print
+      '';
       "legacy+gpt" = ''
         parted --script $diskImage -- \
           mklabel gpt \
@@ -540,6 +558,12 @@ let
                 # Add the 1MiB aligned reserved space (includes MBR)
                 reservedSpace=$(( mebibyte ))
               ''
+            else if partitionTableType == "legacy+boot" then
+              ''
+                # The explanation from the above "efi" case applies here too,
+                # but gptSpace is not needed without a GPT.
+                reservedSpace=$(( bootSize ))
+              ''
             else
               ''
                 reservedSpace=0
@@ -694,6 +718,11 @@ let
 
           ${lib.optionalString touchEFIVars "mount -t efivarfs efivarfs /sys/firmware/efi/efivars"}
         ''}
+        ${lib.optionalString (partitionTableType == "legacy+boot") ''
+          mkdir -p /mnt/boot
+          mkfs.vfat -n BOOT /dev/vda1
+          mount /dev/vda1 /mnt/boot
+        ''}
 
         # Install a configuration.nix
         mkdir -p /mnt/etc/nixos
@@ -702,19 +731,28 @@ let
         ''}
 
         ${lib.optionalString installBootLoader ''
-            # In this throwaway resource, we only have /dev/vda, but the actual VM may refer to another disk for bootloader, e.g. /dev/vdb
-            # Use this option to create a symlink from vda to any arbitrary device you want.
-            ${lib.optionalString (config.boot.loader.grub.enable) (
-              lib.concatMapStringsSep " " (
-                device:
-                lib.optionalString (device != "/dev/vda") ''
-                  mkdir -p "$(dirname ${device})"
-                  ln -s /dev/vda ${device}
-                ''
-              ) config.boot.loader.grub.devices
-            )}
+          # In this throwaway resource, we only have /dev/vda, but the actual VM may refer to another disk for bootloader, e.g. /dev/vdb
+          # Use this option to create a symlink from vda to any arbitrary device you want.
+          ${lib.optionalString (config.boot.loader.grub.enable) (
+            lib.concatMapStringsSep " " (
+              device:
+              lib.optionalString (device != "/dev/vda") ''
+                mkdir -p "$(dirname ${device})"
+                ln -s /dev/vda ${device}
+              ''
+            ) config.boot.loader.grub.devices
+          )}
+          ${
+            let
+              limine = config.boot.loader.limine;
+            in
+            lib.optionalString (limine.enable && limine.biosSupport && limine.biosDevice != "/dev/vda") ''
+              mkdir -p "$(dirname ${limine.biosDevice})"
+              ln -s /dev/vda ${limine.biosDevice}
+            ''
+          }
 
-            # Set up core system link, bootloader (sd-boot, GRUB, uboot, etc.), etc.
+          # Set up core system link, bootloader (sd-boot, GRUB, uboot, etc.), etc.
 
           # NOTE: systemd-boot-builder.py calls nix-env --list-generations which
           # clobbers $HOME/.nix-defexpr/channels/nixos This would cause a  folder
diff --git a/nixos/modules/programs/starship.nix b/nixos/modules/programs/starship.nix
index 044054c5452f..e606f776ab81 100644
--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@@ -158,6 +158,18 @@ in
         eval "$(${cfg.package}/bin/starship init zsh)"
       fi
     '';
+
+    # use `config` instead of `${initOption}` because `programs.xonsh` doesn't have `shellInit` or `promptInit`
+    programs.xonsh.config = ''
+      if $TERM != "dumb":
+        # don't set STARSHIP_CONFIG automatically if there's a user-specified
+        # config file.  starship appears to use a hardcoded config location
+        # rather than one inside an XDG folder:
+        # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
+        if not `$HOME/.config/starship.toml`:
+          $STARSHIP_CONFIG = ('${settingsFile}')
+        execx($(${cfg.package}/bin/starship init xonsh))
+    '';
   };
 
   meta.maintainers = pkgs.starship.meta.maintainers;
diff --git a/nixos/modules/services/misc/servarr/prowlarr.nix b/nixos/modules/services/misc/servarr/prowlarr.nix
index b8d93bd6e8a4..9682df2b161f 100644
--- a/nixos/modules/services/misc/servarr/prowlarr.nix
+++ b/nixos/modules/services/misc/servarr/prowlarr.nix
@@ -7,6 +7,7 @@
 let
   cfg = config.services.prowlarr;
   servarr = import ./settings-options.nix { inherit lib pkgs; };
+  isCustomDataDir = cfg.dataDir != "/var/lib/prowlarr";
 in
 {
   options = {
@@ -16,7 +17,12 @@ in
       dataDir = lib.mkOption {
         type = lib.types.str;
         default = "/var/lib/prowlarr";
-        description = "The directory where Prowlarr stores its data files.";
+        description = ''
+          The directory where Prowlarr stores its data files.
+
+          Note: A bind mount will be used to mount the directory at the expected location
+          if a different value than `/var/lib/prowlarr` is used.
+        '';
       };
 
       package = lib.mkPackageOption pkgs "prowlarr" { };
@@ -30,22 +36,6 @@ in
       settings = servarr.mkServarrSettingsOptions "prowlarr" 9696;
 
       environmentFiles = servarr.mkServarrEnvironmentFiles "prowlarr";
-
-      user = lib.mkOption {
-        type = lib.types.str;
-        default = "prowlarr";
-        description = ''
-          User account under which Prowlarr runs.
-        '';
-      };
-
-      group = lib.mkOption {
-        type = lib.types.str;
-        default = "prowlarr";
-        description = ''
-          Group under which Prowlarr runs.
-        '';
-      };
     };
   };
 
@@ -55,38 +45,36 @@ in
         description = "Prowlarr";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        environment = servarr.mkServarrSettingsEnvVars "PROWLARR" cfg.settings;
+        environment = servarr.mkServarrSettingsEnvVars "PROWLARR" cfg.settings // {
+          HOME = "/var/empty";
+        };
 
         serviceConfig = {
           Type = "simple";
-          User = cfg.user;
-          Group = cfg.group;
+          DynamicUser = true;
+          StateDirectory = "prowlarr";
           EnvironmentFile = cfg.environmentFiles;
-          ExecStart = "${lib.getExe cfg.package} -nobrowser -data='${cfg.dataDir}'";
+          ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
           Restart = "on-failure";
         };
       };
 
-      tmpfiles.settings."10-prowlarr".${cfg.dataDir}.d = {
-        inherit (cfg) user group;
+      tmpfiles.settings."10-prowlarr".${cfg.dataDir}.d = lib.mkIf isCustomDataDir {
+        user = "root";
+        group = "root";
         mode = "0700";
       };
+
+      mounts = lib.optional isCustomDataDir {
+        what = cfg.dataDir;
+        where = "/var/lib/private/prowlarr";
+        options = "bind";
+        wantedBy = [ "local-fs.target" ];
+      };
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.settings.server.port ];
     };
-
-    users.users = lib.mkIf (cfg.user == "prowlarr") {
-      prowlarr = {
-        isSystemUser = true;
-        group = cfg.group;
-        home = cfg.dataDir;
-      };
-    };
-
-    users.groups = lib.mkIf (cfg.group == "prowlarr") {
-      prowlarr = { };
-    };
   };
 }
diff --git a/nixos/modules/services/networking/anubis.nix b/nixos/modules/services/networking/anubis.nix
index 2d63fa4ecc59..d44619446b7c 100644
--- a/nixos/modules/services/networking/anubis.nix
+++ b/nixos/modules/services/networking/anubis.nix
@@ -299,7 +299,8 @@ in
           ];
           SystemCallArchitectures = "native";
           MemoryDenyWriteExecute = true;
-
+          AmbientCapabilities = "";
+          PrivateMounts = true;
           PrivateUsers = true;
           PrivateTmp = true;
           PrivateDevices = true;
@@ -313,6 +314,7 @@ in
           ProtectSystem = "strict";
           ProtectControlGroups = "strict";
           LockPersonality = true;
+          RemoveIPC = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           RestrictNamespaces = true;
diff --git a/nixos/modules/system/boot/clevis.nix b/nixos/modules/system/boot/clevis.nix
index cd174d363547..881a6452d9c9 100644
--- a/nixos/modules/system/boot/clevis.nix
+++ b/nixos/modules/system/boot/clevis.nix
@@ -81,7 +81,7 @@ in
       extraUtilsCommands = lib.mkIf (!systemd.enable) ''
         copy_bin_and_libs ${pkgs.jose}/bin/jose
         copy_bin_and_libs ${pkgs.curl}/bin/curl
-        copy_bin_and_libs ${pkgs.bash}/bin/bash
+        copy_bin_and_libs ${pkgs.bashNonInteractive}/bin/bash
 
         copy_bin_and_libs ${pkgs.tpm2-tools}/bin/.tpm2-wrapped
         mv $out/bin/{.tpm2-wrapped,tpm2}
@@ -95,7 +95,7 @@ in
         done
 
         for BIN in $out/bin/clevis{,-decrypt{,-null,-tang,-tpm2}}; do
-          sed -i $BIN -e 's,${pkgs.bash},,' -e 's,${pkgs.coreutils},,'
+          sed -i $BIN -e 's,${pkgs.bashNonInteractive},,' -e 's,${pkgs.coreutils},,'
         done
 
         sed -i $out/bin/clevis-decrypt-tpm2 -e 's,tpm2_,tpm2 ,'
diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index c775d65d4057..d46f8c914859 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -412,27 +412,42 @@ def main():
                 efi_disk = find_disk_device(efi_partition)
 
                 efibootmgr_output = subprocess.check_output([efibootmgr], stderr=subprocess.STDOUT, universal_newlines=True)
-                create_flag = '-c'
+
                 # Check the output of `efibootmgr` to find if limine is already installed and present in the boot record
-                if matches := re.findall(r'Boot[0-9a-fA-F]{4}\*? Limine', efibootmgr_output):
-                    create_flag = '-C' # if present, keep the same boot order
+                limine_boot_entry = None
+                if matches := re.findall(r'Boot([0-9a-fA-F]{4})\*? Limine', efibootmgr_output):
+                    limine_boot_entry = matches[0]
 
-                efibootmgr_output = subprocess.check_output([
-                    efibootmgr,
-                    create_flag,
-                    '-d', efi_disk,
-                    '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
-                    '-l', f'\\efi\\limine\\{boot_file}',
-                    '-L', 'Limine',
-                ], stderr=subprocess.STDOUT, universal_newlines=True)
+                # If there's already a Limine entry, replace it
+                if limine_boot_entry:
+                    boot_order = re.findall(r'BootOrder: ((?:[0-9a-fA-F]{4},?)*)', efibootmgr_output)[0]
+
+                    efibootmgr_output = subprocess.check_output([
+                        efibootmgr,
+                        '-b', limine_boot_entry,
+                        '-B',
+                    ], stderr=subprocess.STDOUT, universal_newlines=True)
+
+                    efibootmgr_output = subprocess.check_output([
+                        efibootmgr,
+                        '-c',
+                        '-b', limine_boot_entry,
+                        '-d', efi_disk,
+                        '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
+                        '-l', f'\\efi\\limine\\{boot_file}',
+                        '-L', 'Limine',
+                        '-o', boot_order,
+                    ], stderr=subprocess.STDOUT, universal_newlines=True)
+                else:
+                    efibootmgr_output = subprocess.check_output([
+                        efibootmgr,
+                        '-c',
+                        '-d', efi_disk,
+                        '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
+                        '-l', f'\\efi\\limine\\{boot_file}',
+                        '-L', 'Limine',
+                    ], stderr=subprocess.STDOUT, universal_newlines=True)
 
-                for line in efibootmgr_output.split('\n'):
-                    if matches := re.findall(r'Boot([0-9a-fA-F]{4}) has same label Limine', line):
-                        subprocess.run(
-                            [efibootmgr, '-b', matches[0], '-B'],
-                            stdout=subprocess.DEVNULL,
-                            stderr=subprocess.DEVNULL,
-                        )
     if config('biosSupport'):
         if cpu_family != 'x86':
             raise Exception(f'Unsupported CPU family for BIOS install: {cpu_family}')
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 4772cedb4beb..02f653922c34 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -62,8 +62,20 @@ let
     };
 
   selectPartitionTableLayout =
-    { useEFIBoot, useDefaultFilesystems }:
-    if useDefaultFilesystems then if useEFIBoot then "efi" else "legacy" else "none";
+    {
+      useEFIBoot,
+      useDefaultFilesystems,
+      useBIOSBoot,
+    }:
+    if useDefaultFilesystems then
+      if useEFIBoot then
+        "efi"
+      else if useBIOSBoot then
+        "legacy+boot"
+      else
+        "legacy"
+    else
+      "none";
 
   driveCmdline =
     idx:
@@ -337,7 +349,9 @@ let
     format = "qcow2";
     onlyNixStore = false;
     label = rootFilesystemLabel;
-    partitionTableType = selectPartitionTableLayout { inherit (cfg) useDefaultFilesystems useEFIBoot; };
+    partitionTableType = selectPartitionTableLayout {
+      inherit (cfg) useBIOSBoot useDefaultFilesystems useEFIBoot;
+    };
     installBootLoader = cfg.installBootLoader;
     touchEFIVars = cfg.useEFIBoot;
     diskSize = "auto";
@@ -431,8 +445,17 @@ in
 
     virtualisation.bootPartition = mkOption {
       type = types.nullOr types.path;
-      default = if cfg.useEFIBoot then "/dev/disk/by-label/${espFilesystemLabel}" else null;
-      defaultText = literalExpression ''if cfg.useEFIBoot then "/dev/disk/by-label/${espFilesystemLabel}" else null'';
+      default =
+        if cfg.useEFIBoot then
+          "/dev/disk/by-label/${espFilesystemLabel}"
+        else if cfg.useBIOSBoot then
+          "/dev/disk/by-label/BOOT"
+        else
+          null;
+      defaultText = literalExpression ''
+        if cfg.useEFIBoot then "/dev/disk/by-label/${espFilesystemLabel}"
+        else if cfg.useBIOSBoot then "/dev/disk/by-label/BOOT"
+        else null'';
       example = "/dev/disk/by-label/esp";
       description = ''
         The path (inside the VM) to the device containing the EFI System Partition (ESP).
@@ -929,6 +952,14 @@ in
       '';
     };
 
+    virtualisation.useBIOSBoot = mkEnableOption null // {
+      description = ''
+        If enabled for legacy MBR VMs, the VM image will have a separate boot
+        partition mounted at /boot.
+        useBIOSBoot is ignored if useEFIBoot == true.
+      '';
+    };
+
     virtualisation.useEFIBoot = mkOption {
       type = types.bool;
       default = false;
@@ -1128,6 +1159,9 @@ in
       `useBootLoader` useless. You might want to disable one of those options.
     '';
 
+    # Install Limine on the bootloader device
+    boot.loader.limine.biosDevice = cfg.bootLoaderDevice;
+
     # In UEFI boot, we use a EFI-only partition table layout, thus GRUB will fail when trying to install
     # legacy and UEFI. In order to avoid this, we have to put "nodev" to force UEFI-only installs.
     # Otherwise, we set the proper bootloader device for this.
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5dda007c5982..c01da895fbbc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1126,7 +1126,7 @@ in
   prosody = handleTest ./xmpp/prosody.nix { };
   prosody-mysql = handleTest ./xmpp/prosody-mysql.nix { };
   proxy = handleTest ./proxy.nix { };
-  prowlarr = handleTest ./prowlarr.nix { };
+  prowlarr = runTest ./prowlarr.nix;
   pt2-clone = handleTest ./pt2-clone.nix { };
   pykms = handleTest ./pykms.nix { };
   public-inbox = handleTest ./public-inbox.nix { };
diff --git a/nixos/tests/limine/bios.nix b/nixos/tests/limine/bios.nix
new file mode 100644
index 000000000000..5d367934b660
--- /dev/null
+++ b/nixos/tests/limine/bios.nix
@@ -0,0 +1,28 @@
+{ lib, ... }:
+{
+  name = "bios";
+  meta.maintainers = with lib.maintainers; [
+    lzcunt
+    phip1611
+    programmerlexi
+  ];
+  meta.platforms = [
+    "i686-linux"
+    "x86_64-linux"
+  ];
+  nodes.machine =
+    { ... }:
+    {
+      virtualisation.useBootLoader = true;
+      virtualisation.useBIOSBoot = true;
+      boot.loader.limine.enable = true;
+      boot.loader.limine.efiSupport = false;
+      boot.loader.timeout = 0;
+    };
+
+  testScript = ''
+    machine.start()
+    with subtest('Machine boots correctly'):
+      machine.wait_for_unit('multi-user.target')
+  '';
+}
diff --git a/nixos/tests/limine/default.nix b/nixos/tests/limine/default.nix
index dad761b1f882..6923fb4de62b 100644
--- a/nixos/tests/limine/default.nix
+++ b/nixos/tests/limine/default.nix
@@ -3,6 +3,7 @@
   ...
 }:
 {
+  bios = runTest ./bios.nix;
   checksum = runTest ./checksum.nix;
   secureBoot = runTest ./secure-boot.nix;
   specialisations = runTest ./specialisations.nix;
diff --git a/nixos/tests/mealie.nix b/nixos/tests/mealie.nix
index 21e96dea4114..e296d5180ecd 100644
--- a/nixos/tests/mealie.nix
+++ b/nixos/tests/mealie.nix
@@ -36,8 +36,8 @@ import ./make-test-python.nix (
         node.succeed("curl --fail http://localhost:9001")
 
       test_mealie(sqlite)
-      simple.send_monitor_command("quit")
-      simple.wait_for_shutdown()
+      sqlite.send_monitor_command("quit")
+      sqlite.wait_for_shutdown()
       test_mealie(postgres)
     '';
   }
diff --git a/nixos/tests/prowlarr.nix b/nixos/tests/prowlarr.nix
index 859ce58b3b1b..c03475df0423 100644
--- a/nixos/tests/prowlarr.nix
+++ b/nixos/tests/prowlarr.nix
@@ -1,22 +1,40 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, config, ... }:
 
-  {
-    name = "prowlarr";
-    meta.maintainers = with lib.maintainers; [ ];
+{
+  name = "prowlarr";
+  meta.maintainers = with lib.maintainers; [ ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.prowlarr.enable = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.prowlarr.enable = true;
+      specialisation.customDataDir = {
+        inheritParentConfig = true;
+        configuration.services.prowlarr.dataDir = "/srv/prowlarr";
       };
+    };
 
-    testScript = ''
+  testScript = ''
+    def verify_prowlarr_works():
       machine.wait_for_unit("prowlarr.service")
       machine.wait_for_open_port(9696)
       response = machine.succeed("curl --fail http://localhost:9696/")
       assert '<title>Prowlarr</title>' in response, "Login page didn't load successfully"
       machine.succeed("[ -d /var/lib/prowlarr ]")
-    '';
-  }
-)
+
+    with subtest("Prowlarr starts and responds to requests"):
+      verify_prowlarr_works()
+
+    with subtest("Prowlarr data directory migration works"):
+      machine.systemctl("stop prowlarr.service")
+      machine.succeed("mkdir -p /tmp/prowlarr-migration")
+      machine.succeed("mv /var/lib/prowlarr/* /tmp/prowlarr-migration")
+      machine.succeed("${config.nodes.machine.system.build.toplevel}/specialisation/customDataDir/bin/switch-to-configuration test")
+      machine.wait_for_unit("var-lib-private-prowlarr.mount")
+      machine.succeed("mv /tmp/prowlarr-migration/* /var/lib/prowlarr")
+      machine.systemctl("restart prowlarr.service")
+      # Check that we're using a bind mount when using a non-default dataDir
+      machine.succeed("findmnt /var/lib/private/prowlarr | grep /srv/prowlarr")
+      verify_prowlarr_works()
+  '';
+}
diff --git a/pkgs/applications/emulators/libretro/cores/citra.nix b/pkgs/applications/emulators/libretro/cores/citra.nix
index febf6e8413c6..45356270486a 100644
--- a/pkgs/applications/emulators/libretro/cores/citra.nix
+++ b/pkgs/applications/emulators/libretro/cores/citra.nix
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "citra";
-  version = "0-unstable-2025-05-07";
+  version = "0-unstable-2025-05-17";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "citra";
-    rev = "b1f9fe0c3d4d6c4e133a710bc172d9adcb40c706";
-    hash = "sha256-EI8N+tjA6UsEq7sKIZ/zxeugW/oyCF+cPKX2HTjVqNI=";
+    rev = "8e634afee9e870620b40efedaef77478cd1f3c99";
+    hash = "sha256-pf0fgamSg2OHxvft36+Y4wPF9hjyZOQXEtMWs0dkNRM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1a134ed23c0e..1e832248c2f1 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1110,6 +1110,15 @@
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-KezwDRmQQj0MnmsVlrX1OhNG6oMgw8fCxX5VFGdUynw="
   },
+  "routeros": {
+    "hash": "sha256-/tTd8EzA1/Js7S3eGg3L9AY9dyoIA3lFSU6VlT6p4us=",
+    "homepage": "https://registry.terraform.io/providers/terraform-routeros/routeros",
+    "owner": "terraform-routeros",
+    "repo": "terraform-provider-routeros",
+    "rev": "v1.85.0",
+    "spdx": "MPL-2.0",
+    "vendorHash": "sha256-DDmJ/mEOd94E7DqLKjT6Y4XkpVdXyKeAaE/Wj6M3vuw="
+  },
   "rundeck": {
     "hash": "sha256-cf+0qXpgxIsc/JbB7+u3MpmWFwUmpsinp1uARRhuBw0=",
     "homepage": "https://registry.terraform.io/providers/rundeck/rundeck",
diff --git a/pkgs/by-name/ba/bashunit/package.nix b/pkgs/by-name/ba/bashunit/package.nix
index d458858dfdd0..b601f9000c1d 100644
--- a/pkgs/by-name/ba/bashunit/package.nix
+++ b/pkgs/by-name/ba/bashunit/package.nix
@@ -12,19 +12,20 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bashunit";
-  version = "0.19.0";
+  version = "0.19.1";
+
   src = fetchFromGitHub {
     owner = "TypedDevs";
     repo = "bashunit";
     tag = finalAttrs.version;
-    hash = "sha256-EoCCqESzmCW12AuAqA3qh2VcE8gyUPIGJEoCcZhMA/Y=";
+    hash = "sha256-LoPtWf4Vo7hodWa0WJmqYDW7p7xJDrRZ5/qwUy/rB3U=";
     forceFetchGit = true; # needed to include the tests directory for the check phase
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
   postConfigure = ''
-    patchShebangs src tests build.sh bashunit
+    patchShebangs tests build.sh bashunit
     substituteInPlace Makefile \
       --replace-fail "SHELL=/bin/bash" "SHELL=${lib.getExe bash}"
   '';
@@ -41,9 +42,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  # some tests are currently broken on linux and it is not easy to disable them
-  # reenable them after https://github.com/TypedDevs/bashunit/pull/397 has been merged
-  doCheck = false;
+  doCheck = true;
   nativeCheckInputs = [ which ];
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 320bb49a8443..035b36b59263 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.2"
+        "@anthropic-ai/claude-code": "^1.0.3"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.2.tgz",
-      "integrity": "sha512-6p7RMXEcVfymsJ7v0GyMfA3gcD2AbFVSb9b1Py4tbxM2ensjyaSx3wVQW2QiFk+9mhoRkYc0ETVnJ1x/G0LW7g==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.3.tgz",
+      "integrity": "sha512-a4aBhcXGG7k4YtyF2aYVKt08h48BG+F12RA/G3K1vb6unl9CAvWDP/A7xudtCOzxFKxLwxctrn74pHEdpmHSPw==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "bin": {
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 53519341a4c2..456488949cad 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.2";
+  version = "1.0.3";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-mQv2o9uaOZiZSdkNmLiqJs66fe9fiHfEmrXQZwmME34=";
+    hash = "sha256-LjDxVv6KSTuRZhCHztvf81E5DQbkqs8cbrnbbGkCeQU=";
   };
 
-  npmDepsHash = "sha256-Diii1tBBzYlB4svlphtu1VAOoijoq9WudxtJFSXXbbE=";
+  npmDepsHash = "sha256-muMukVEj6uXkupSoyp41FihsLth0ENgfzBlD5CwlE2w=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index 2e37479f805f..118866891f9b 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -49,26 +49,26 @@
 }:
 let
   pname = "cursor";
-  version = "0.49.6";
+  version = "0.50.5";
 
   inherit (stdenvNoCC) hostPlatform;
 
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/0781e811de386a0c5bcb07ceb259df8ff8246a52/linux/x64/Cursor-0.49.6-x86_64.AppImage";
-      hash = "sha256-WH4/Zw0VJmRGyRzMlkThkhZ4fGysMKBUSIPCTsyGS4w=";
+      url = "https://downloads.cursor.com/production/96e5b01ca25f8fbd4c4c10bc69b15f6228c80771/linux/x64/Cursor-0.50.5-x86_64.AppImage";
+      hash = "sha256-DUWIgQYD3Wj6hF7NBb00OGRynKmXcFldWFUA6W8CZeM=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/0781e811de386a0c5bcb07ceb259df8ff8246a52/linux/arm64/Cursor-0.49.6-aarch64.AppImage";
-      hash = "sha256-cpNoff6mDRkT2RicaDlxzqVP9BNe6UEGgJVHr1xMiv0=";
+      url = "https://downloads.cursor.com/production/96e5b01ca25f8fbd4c4c10bc69b15f6228c80771/linux/arm64/Cursor-0.50.5-aarch64.AppImage";
+      hash = "sha256-51zTYg4A+4ZUbGZ6/Qp3d5aL8IafewGOUYbXWGG8ILY=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/0781e811de386a0c5bcb07ceb259df8ff8246a52/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-fAaLY9YTIuNThFl5OsIMHavy2xwDgYooL4xTSp4Cwzw=";
+      url = "https://downloads.cursor.com/production/96e5b01ca25f8fbd4c4c10bc69b15f6228c80771/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-C2+z3WXi3Ma3PzlU8BrcuJFGMx8YosNdxuSqR5tJdBE=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/0781e811de386a0c5bcb07ceb259df8ff8246a52/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-DNN2+gfs9u0tZmh75J258d2TL6ErIYludMgPJZcgfb8=";
+      url = "https://downloads.cursor.com/production/96e5b01ca25f8fbd4c4c10bc69b15f6228c80771/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-Gz+aYDaDMDx46R7HA8u5vZwkXx9q//uu4hNyyRmrq9s=";
     };
   };
 
@@ -191,6 +191,7 @@ stdenvNoCC.mkDerivation {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [
       aspauldingcode
+      prince213
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "cursor";
diff --git a/pkgs/by-name/co/code-cursor/update.sh b/pkgs/by-name/co/code-cursor/update.sh
index e0ee1c274321..20e7abf12025 100755
--- a/pkgs/by-name/co/code-cursor/update.sh
+++ b/pkgs/by-name/co/code-cursor/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl yq coreutils common-updater-scripts
+#!nix-shell -i bash -p curl jq coreutils common-updater-scripts
 set -eu -o pipefail
 
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; code-cursor.version or (lib.getVersion code-cursor)" | tr -d '"')
diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index c0c8d6d97acc..109b6ac2ec76 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -10,26 +10,7 @@
 }:
 
 let
-  attrsToPlugins =
-    attrs:
-    builtins.map (
-      {
-        name,
-        repo,
-        version,
-      }:
-      "${name}:${repo}"
-    ) attrs;
-  attrsToSources =
-    attrs:
-    builtins.map (
-      {
-        name,
-        repo,
-        version,
-      }:
-      "${repo}@${version}"
-    ) attrs;
+  attrsToSources = attrs: builtins.map ({ repo, version, ... }: "${repo}@${version}") attrs;
 in
 buildGoModule rec {
   pname = "coredns";
@@ -53,7 +34,47 @@ buildGoModule rec {
 
   # Override the go-modules fetcher derivation to fetch plugins
   modBuildPhase = ''
-    for plugin in ${builtins.toString (attrsToPlugins externalPlugins)}; do echo $plugin >> plugin.cfg; done
+    cp plugin.cfg plugin.cfg.orig
+    ${
+      (lib.concatMapStringsSep "\n" (
+        plugin:
+        let
+          position = plugin.position or "end-of-file";
+          formatPlugin = { name, repo, ... }: "${name}:${repo}";
+        in
+        if position == "end-of-file" then
+          "echo '${formatPlugin plugin}' >> plugin.cfg"
+        else if position == "start-of-file" then
+          "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
+        else if lib.hasAttrByPath [ "before" ] position then
+          ''
+            if ! grep -q '^${position.before}:' plugin.cfg; then
+              echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
+              exit 1
+            fi
+            sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
+          ''
+        else if lib.hasAttrByPath [ "after" ] position then
+          ''
+            if ! grep -q '^${position.after}:' plugin.cfg; then
+              echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
+              exit 1
+            fi
+            sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
+          ''
+        else
+          throw ''
+            Unsupported position value in externalPlugin:
+              ${builtins.toJSON plugin}.
+            Valid values for position attr are:
+              - position = "end-of-file" (the default)
+              - position = "start-of-file"
+              - position.before = "{other plugin}"
+              - position.after = "{other plugin}"
+          ''
+      ) externalPlugins)
+    }
+    diff -u plugin.cfg.orig plugin.cfg || true
     for src in ${builtins.toString (attrsToSources externalPlugins)}; do go get $src; done
     GOOS= GOARCH= go generate
     go mod vendor
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index f56dc18dcdbf..ee7ec2c69559 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -17,7 +17,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "25.0.4";
+  version = "25.0.5";
 
   src =
     let
@@ -30,10 +30,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-ALtJIld7gT4pj+jGRkwMloq6B/ZBOMYZxws9N7xNNZg=";
-        aarch64-linux = "sha256-Ka+jEI6y1BRqV83yDvu1yDzJfpUIxKKD+zehVHcNQ/o=";
-        x86_64-darwin = "sha256-P8f0NlMjh/46RChQy8JIm71msqX023K2QaFEic2Br9M=";
-        aarch64-darwin = "sha256-a9H9M1j6iPcrVcfDxCZHeZj6e55QH3XochXaL2OStlI=";
+        x86_64-linux = "sha256-8JkvI6OZGP1Ot2TEP2n4hj3s9As7holT+thVf0BvOMQ=";
+        aarch64-linux = "sha256-cZQFEbogSxuIaS/z/tFQcvs08J0Omi21zLqb0eFQNw0=";
+        x86_64-darwin = "sha256-LueOQZIKB/r6gtlj0+xwoJXMRTFvbSY+RTwAB74KiYo=";
+        aarch64-darwin = "sha256-L6bOyvhlsT4sXL1QDhlJtb8DFfDVw21ixyRenOVdCxU=";
       };
     in
     fetchurl {
diff --git a/pkgs/by-name/fa/fancontrol-gui/package.nix b/pkgs/by-name/fa/fancontrol-gui/package.nix
new file mode 100644
index 000000000000..300a29826289
--- /dev/null
+++ b/pkgs/by-name/fa/fancontrol-gui/package.nix
@@ -0,0 +1,62 @@
+{
+  cmake,
+  extra-cmake-modules,
+  fancontrol-gui,
+  fetchFromGitHub,
+  lib,
+  libgcc,
+  libsForQt5,
+  nix-update-script,
+  stdenv,
+  testers,
+}:
+stdenv.mkDerivation rec {
+  pname = "fancontrol-gui";
+  version = "0.8";
+
+  src = fetchFromGitHub {
+    owner = "Maldela";
+    repo = "fancontrol-gui";
+    tag = "v${version}";
+    hash = "sha256-hJaU8SL0b6GmTONGSIzUzzbex6KxHf2Np0bCX8YSSVM=";
+  };
+
+  buildInputs = with libsForQt5; [
+    libgcc
+    kcmutils
+    kdeclarative
+    kio
+    plasma-framework
+    qt5.qtdeclarative
+    qt5.qtquickcontrols
+    qt5.qtquickcontrols2
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    libsForQt5.wrapQtAppsHook
+  ];
+
+  patches = [
+    ./version.patch
+  ];
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = fancontrol-gui;
+      command = "env QT_QPA_PLATFORM=minimal ${lib.getExe fancontrol-gui} --version";
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "GUI for fancontrol with QT and KDE framework 5";
+    homepage = "https://github.com/Maldela/fancontrol-gui";
+    changelog = "https://github.com/Maldela/fancontrol-gui/releases/tag/v${version}";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "fancontrol_gui";
+    maintainers = with lib.maintainers; [ dashietm ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/fa/fancontrol-gui/version.patch b/pkgs/by-name/fa/fancontrol-gui/version.patch
new file mode 100644
index 000000000000..9b0ea0943b8f
--- /dev/null
+++ b/pkgs/by-name/fa/fancontrol-gui/version.patch
@@ -0,0 +1,13 @@
+diff --git a/fancontrol-gui/src/main.cpp b/fancontrol-gui/src/main.cpp
+index 9f33fa0..ae0deb6 100644
+--- a/fancontrol-gui/src/main.cpp
++++ b/fancontrol-gui/src/main.cpp
+@@ -81,7 +81,7 @@ int main(int argc, char *argv[])
+ 
+     auto about = KAboutData(QStringLiteral("org.kde.fancontrol.gui"),
+                             i18n("Fancontrol-GUI"),
+-                            QStringLiteral("0.7"),
++                            QStringLiteral("0.8"),
+                             i18n("Graphical user interface for fancontrol"),
+                             KAboutLicense::KAboutLicense::GPL_V2,
+                             QStringLiteral("Copyright (C) 2015 Malte Veerman"),
diff --git a/pkgs/by-name/gr/graphite-cli/package-lock.json b/pkgs/by-name/gr/graphite-cli/package-lock.json
index 4ea132ec68e6..99209616e9bc 100644
--- a/pkgs/by-name/gr/graphite-cli/package-lock.json
+++ b/pkgs/by-name/gr/graphite-cli/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.6.1",
+      "version": "1.6.2",
       "hasInstallScript": true,
       "license": "None",
       "dependencies": {
@@ -21,9 +21,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
-      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
+      "version": "7.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
+      "integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
diff --git a/pkgs/by-name/gr/graphite-cli/package.nix b/pkgs/by-name/gr/graphite-cli/package.nix
index 8c9e09ba7938..f68a6994ebb0 100644
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@@ -8,14 +8,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-r7tChs0vsg60LXFf9WZjthqMxXGgohNL4ojdjXNZcCo=";
+    hash = "sha256-k8zZyzLXQkII87QXjoXYlcQPj09PcMCuNy2NFPT2tHY=";
   };
 
-  npmDepsHash = "sha256-DoK3GaGIwei9kumvAwfgaIY9iw+Z6ysFzUm5dMVV2W4=";
+  npmDepsHash = "sha256-HSiitFpXcIWkE/t0LtuDH9Z4fDgyFWc0/gdIsuvVq9I=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/gu/guile-mqtt/package.nix b/pkgs/by-name/gu/guile-mqtt/package.nix
index f447f32590c4..fa6c41c46aa8 100644
--- a/pkgs/by-name/gu/guile-mqtt/package.nix
+++ b/pkgs/by-name/gu/guile-mqtt/package.nix
@@ -9,12 +9,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "guile-mqtt";
-  version = "0.2.1";
+  version = "1.0.0";
 
   # building from git repo requires nyacc>=2.01.3
   src = fetchurl {
     url = "https://github.com/mdjurfeldt/guile-mqtt/releases/download/v${finalAttrs.version}/guile-mqtt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-+qfrUw8yIY8iObEVLbg6bOfiQNR5Lkw2n9oHMr3JQ5k=";
+    hash = "sha256-6+U3FHewbdI8l7r4pVCrd0DNKPy4BHHy2m/hcQ7ByBQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/im/imager/numpy-header.patch b/pkgs/by-name/im/imager/numpy-header.patch
new file mode 100644
index 000000000000..6424c5a54f59
--- /dev/null
+++ b/pkgs/by-name/im/imager/numpy-header.patch
@@ -0,0 +1,26 @@
+diff --git a/admin/gildas-env.sh b/admin/gildas-env.sh
+index acb06f9..b25ecd5 100644
+--- a/admin/gildas-env.sh
++++ b/admin/gildas-env.sh
+@@ -441,7 +441,7 @@ EOF
+ 		    # Now search for Numpy
+ 		    if python -c "import numpy" > /dev/null 2>&1; then
+ 			NUMPY_PRESENT=yes
+-			NUMPY_INC_DIR=`python -c "import numpy; print(numpy.__path__[0] + '/core/include')"`
++			NUMPY_INC_DIR=`python -c "import numpy; print(numpy.get_include())"`
+ 			if [ -e "$NUMPY_INC_DIR/numpy/arrayobject.h" ]; then
+ 			    NUMPY_INC_PRESENT=yes
+ 			else
+diff --git a/utilities/etc/setup.py.src b/utilities/etc/setup.py.src
+index 9a4da86..110a0d1 100644
+--- a/utilities/etc/setup.py.src
++++ b/utilities/etc/setup.py.src
+@@ -75,7 +75,7 @@ mod_extras = mod_extras.split()
+ 
+ if (os.environ.get('NUMPY_PRESENT') == "yes"):
+    import numpy
+-   mod_inc_dirs.append(numpy.__path__[0] + '/core/include')
++   mod_inc_dirs.append(numpy.get_include())
+ else:
+    raise Exception("Numpy python package should be present. Aborting.")
+ 
diff --git a/pkgs/by-name/im/imager/package.nix b/pkgs/by-name/im/imager/package.nix
index b3f393b7571c..d21c94272127 100644
--- a/pkgs/by-name/im/imager/package.nix
+++ b/pkgs/by-name/im/imager/package.nix
@@ -59,6 +59,9 @@ stdenv.mkDerivation (finalAttrs: {
     ./clang.patch
     # Replace hardcoded cpp with GAG_CPP (see below).
     ./cpp-darwin.patch
+    # Fix the numpy header detection with numpy > 2.0.0
+    # Patch submitted upstream, it will be included in the next release.
+    ./numpy-header.patch
   ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
diff --git a/pkgs/by-name/ka/kanboard/package.nix b/pkgs/by-name/ka/kanboard/package.nix
index b6514c79a2bf..9d3b860433e1 100644
--- a/pkgs/by-name/ka/kanboard/package.nix
+++ b/pkgs/by-name/ka/kanboard/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kanboard";
-  version = "1.2.44";
+  version = "1.2.45";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0vMHNB0wEyjp8oNWh1PZ2oT/Lpk/eiXrDNA5Dzv8xqI=";
+    hash = "sha256-MGQ+FJcdRx4VZppLnoB9lCC1eIoetbToyvBsWRBRSu4=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index 1e2ba69c807e..ec43cd01494a 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.16.4",
-    "hash": "sha256-1ERKook2z8fKHOkAi43fU0amBgQaxYewFYCQGjFcF3o="
+    "version": "5.16.9",
+    "hash": "sha256-D6ea+fDffOxAPf9+dCOjbr9+meXdOEUN+1BAicO2xhc="
   },
   "beta": {
-    "version": "5.16.4",
-    "hash": "sha256-1ERKook2z8fKHOkAi43fU0amBgQaxYewFYCQGjFcF3o="
+    "version": "5.16.9",
+    "hash": "sha256-D6ea+fDffOxAPf9+dCOjbr9+meXdOEUN+1BAicO2xhc="
   }
 }
diff --git a/pkgs/by-name/nb/nb/package.nix b/pkgs/by-name/nb/nb/package.nix
index 0645cdeb9298..1784ea6e499f 100644
--- a/pkgs/by-name/nb/nb/package.nix
+++ b/pkgs/by-name/nb/nb/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nb";
-  version = "7.18.1";
+  version = "7.19.1";
 
   src = fetchFromGitHub {
     owner = "xwmx";
     repo = "nb";
     rev = version;
-    hash = "sha256-SKn4/Nqmvv8kRQkooGrvTuVrj70rastVg4j7U3cXdYg=";
+    hash = "sha256-vryc1sfjIE2ZaZ4Z/KG1Zij81tIwImUMjk2ZZvzpDF4=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/ni/niriswitcher/package.nix b/pkgs/by-name/ni/niriswitcher/package.nix
new file mode 100644
index 000000000000..c40357fbae9b
--- /dev/null
+++ b/pkgs/by-name/ni/niriswitcher/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  wrapGAppsHook4,
+  gobject-introspection,
+  gtk4-layer-shell,
+  libadwaita,
+}:
+
+python3Packages.buildPythonPackage rec {
+  pname = "niriswitcher";
+  version = "0.5.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "isaksamsten";
+    repo = "niriswitcher";
+    tag = version;
+    hash = "sha256-jXnob/CJ3wrqYhbFRu7TnnnCrsKaDazD3t9lZoJVhdQ=";
+  };
+
+  build-system = [ python3Packages.hatchling ];
+
+  nativeBuildInputs = [
+    wrapGAppsHook4
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    gtk4-layer-shell
+    libadwaita
+  ];
+
+  dependencies = [ python3Packages.pygobject3 ];
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      ''${gappsWrapperArgs[@]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gtk4-layer-shell ]}
+    )
+  '';
+
+  meta = {
+    description = "Application switcher for niri";
+    homepage = "https://github.com/isaksamsten/niriswitcher";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ bokicoder ];
+    mainProgram = "niriswitcher";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/nv/nvitop/package.nix b/pkgs/by-name/nv/nvitop/package.nix
index 9436ba6386b7..a8b075749be3 100644
--- a/pkgs/by-name/nv/nvitop/package.nix
+++ b/pkgs/by-name/nv/nvitop/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nvitop";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "XuehaiPan";
     repo = "nvitop";
     tag = "v${version}";
-    hash = "sha256-1WL1S6jUbCLtuAe223AAmCcOcLZ0rStE04uCd0L9gVw=";
+    hash = "sha256-FQbY9j6eJtupBiYTSCEJHAAlpDltb6U5hgWet42AKho=";
   };
 
   pythonRelaxDeps = [ "nvidia-ml-py" ];
diff --git a/pkgs/by-name/oh/oha/package.nix b/pkgs/by-name/oh/oha/package.nix
index 20cadb0eff29..e0443aa161ab 100644
--- a/pkgs/by-name/oh/oha/package.nix
+++ b/pkgs/by-name/oh/oha/package.nix
@@ -5,6 +5,7 @@
   stdenv,
   pkg-config,
   openssl,
+  rust-jemalloc-sys,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,6 +28,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     openssl
+    rust-jemalloc-sys
   ];
 
   # tests don't work inside the sandbox
diff --git a/pkgs/by-name/on/oneDNN/package.nix b/pkgs/by-name/on/oneDNN/package.nix
index e3855a3a57b5..56cfcf83ba64 100644
--- a/pkgs/by-name/on/oneDNN/package.nix
+++ b/pkgs/by-name/on/oneDNN/package.nix
@@ -11,13 +11,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation (finalAttrs: {
   pname = "oneDNN";
-  version = "3.7.3";
+  version = "3.8";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wOS/VBcP8VyuBAdXVNkTDtYizTQe00ZocW5p0PMqbr4=";
+    hash = "sha256-GGfrP3QOPOlqWroG4MQ0az5q5Y4Ii9fNblk5WnMBsuI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/po/pocketbase/package.nix b/pkgs/by-name/po/pocketbase/package.nix
index e0f27d1620a0..62e002705757 100644
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.28.1";
+  version = "0.28.2";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-tx9dx4ZFmdllG/pMoI8mmPSvMg7fBk6+lXSxkW5jlDM=";
+    hash = "sha256-R8sXa3Cs7GFRAs8/+wAoWteFYBUVsgVA+eJDKACb0k8=";
   };
 
-  vendorHash = "sha256-DN3rCuRBFVeRfiXrwxeHemqOZgXb7OswwzcEqHbi4lo=";
+  vendorHash = "sha256-bTXxhHibKiu+btHhnktTpNycMJSzGekRJ+w9b1IwAQs=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/by-name/po/pocl/package.nix b/pkgs/by-name/po/pocl/package.nix
index 4075762f19e5..671b6592bb2f 100644
--- a/pkgs/by-name/po/pocl/package.nix
+++ b/pkgs/by-name/po/pocl/package.nix
@@ -41,13 +41,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pocl";
-  version = "6.0-unstable-2025-01-02";
+  version = "7.0";
 
   src = fetchFromGitHub {
     owner = "pocl";
     repo = "pocl";
-    rev = "acf4ea163b7346d20b3023d41c1141f094acc755";
-    hash = "sha256-d/BD8YkdMYtu6yFlGNXrsz7PVIrzBvvYLU1JRv7ZJmc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pyolM0SR6xiwhad7K0mX9I/PKbIa8Ltin0CYoA1U/qo=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/ps/ps2patchelf/deps.json b/pkgs/by-name/ps/ps2patchelf/deps.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/pkgs/by-name/ps/ps2patchelf/deps.json
@@ -0,0 +1 @@
+[]
diff --git a/pkgs/by-name/ps/ps2patchelf/package.nix b/pkgs/by-name/ps/ps2patchelf/package.nix
new file mode 100644
index 000000000000..409592dc5353
--- /dev/null
+++ b/pkgs/by-name/ps/ps2patchelf/package.nix
@@ -0,0 +1,40 @@
+{
+  fetchFromGitHub,
+  buildDotnetModule,
+  dotnetCorePackages,
+  lib,
+}:
+
+buildDotnetModule rec {
+  version = "1.0.0";
+  pname = "PS2PatchElf";
+
+  src = fetchFromGitHub {
+    owner = "CaptainSwag101";
+    repo = "PS2PatchElf";
+    tag = "v${version}";
+    hash = "sha256-iQL3tT71UOEFIYBdf9BNLUM4++Fm9qEhr77NkMCZdrU=";
+  };
+
+  patches = [
+    ./patches/target_net8.0.patch
+    ./patches/fix_arg_check.patch
+  ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+
+  dotnetFlags = [ "-p:TargetFramework=net8.0" ];
+
+  nugetDeps = ./deps.json;
+
+  projectFile = "PS2PatchElf/PS2PatchElf.csproj";
+
+  meta = {
+    homepage = "https://github.com/CaptainSwag101/PS2PatchElf/";
+    description = "Very basic tool for converting PCSX2 .pnach cheats to game executable patches";
+    maintainers = [ lib.maintainers.gigahawk ];
+    mainProgram = "PS2PatchElf";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/by-name/ps/ps2patchelf/patches/fix_arg_check.patch b/pkgs/by-name/ps/ps2patchelf/patches/fix_arg_check.patch
new file mode 100644
index 000000000000..5e846eabe43c
--- /dev/null
+++ b/pkgs/by-name/ps/ps2patchelf/patches/fix_arg_check.patch
@@ -0,0 +1,14 @@
+diff --git a/PS2PatchElf/Program.cs b/PS2PatchElf/Program.cs
+index 8c0f1b4..78f4042 100644
+--- a/PS2PatchElf/Program.cs
++++ b/PS2PatchElf/Program.cs
+@@ -9,7 +9,7 @@ namespace PS2PatchElf
+     {
+         static void Main(string[] args)
+         {
+-            if (args.Length is not 2 or 3)
++            if (args.Length != 2 && args.Length != 3)
+             {
+                 Console.WriteLine("Improper number of arguments specified.\nPlease pass an input ELF/SLUS, a PNACH file, and optionally the patched ELF/SLUS's output path, in that order!");
+                 return;
+
diff --git a/pkgs/by-name/ps/ps2patchelf/patches/target_net8.0.patch b/pkgs/by-name/ps/ps2patchelf/patches/target_net8.0.patch
new file mode 100644
index 000000000000..420dfe7502c0
--- /dev/null
+++ b/pkgs/by-name/ps/ps2patchelf/patches/target_net8.0.patch
@@ -0,0 +1,26 @@
+diff --git a/PS2PatchElf/PS2PatchElf.csproj b/PS2PatchElf/PS2PatchElf.csproj
+index 3bfd30f..bb0c835 100644
+--- a/PS2PatchElf/PS2PatchElf.csproj
++++ b/PS2PatchElf/PS2PatchElf.csproj
+@@ -2,7 +2,7 @@
+
+   <PropertyGroup>
+     <OutputType>Exe</OutputType>
+-    <TargetFramework>net6.0</TargetFramework>
++    <TargetFramework>net8.0</TargetFramework>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+
+diff --git a/PS2PatchLib/PS2PatchLib.csproj b/PS2PatchLib/PS2PatchLib.csproj
+index 4de8048..8d2b232 100644
+--- a/PS2PatchLib/PS2PatchLib.csproj
++++ b/PS2PatchLib/PS2PatchLib.csproj
+@@ -1,7 +1,7 @@
+ <Project Sdk="Microsoft.NET.Sdk">
+
+   <PropertyGroup>
+-    <TargetFramework>net6.0</TargetFramework>
++    <TargetFramework>net8.0</TargetFramework>
+     <Nullable>enable</Nullable>
+   </PropertyGroup>
+
diff --git a/pkgs/by-name/ra/radicale/package.nix b/pkgs/by-name/ra/radicale/package.nix
index 836ba75cf4dc..5d3b72dd129a 100644
--- a/pkgs/by-name/ra/radicale/package.nix
+++ b/pkgs/by-name/ra/radicale/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "radicale";
-  version = "3.5.3";
+  version = "3.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "Radicale";
     tag = "v${version}";
-    hash = "sha256-+oAVgLXDyexvMCAf7hIhFOT+RELn4zeTpgE8YVGlCyw=";
+    hash = "sha256-45YLZyjQabv92izrMS1euyPhn6AATY0p+p5/GXuQxnM=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/by-name/re/reth/package.nix b/pkgs/by-name/re/reth/package.nix
index d2c039e2b338..159e4ff84917 100644
--- a/pkgs/by-name/re/reth/package.nix
+++ b/pkgs/by-name/re/reth/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reth";
-  version = "1.3.12";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "paradigmxyz";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-59XUrMaXMiqSELQX8i7eK4Eo8YfGjPVZHT6q+rxoSPs=";
+    hash = "sha256-pl0eQU7BjkSg8ECxeB13oNMO9CNIwLyOOHiWWC4CWhY=";
   };
 
-  cargoHash = "sha256-FHQ+iPcjxwcY7uoZMXlm/lRoVA5E5wRg7qFgJe+VSEc=";
+  cargoHash = "sha256-85mtKJWhDguOeNJhsqJyb99xVVF1H7D/2lWRmXF3LSg=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/sv/svg-text-to-path/package.nix b/pkgs/by-name/sv/svg-text-to-path/package.nix
new file mode 100644
index 000000000000..3955b0cccdf8
--- /dev/null
+++ b/pkgs/by-name/sv/svg-text-to-path/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "svg-text-to-path";
+  version = "2.0.4";
+
+  src = fetchFromGitHub {
+    owner = "paulzi";
+    repo = "svg-text-to-path";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1LW4jYRawP+BM1UtFJiTdcWVnFsEtRdVMlpZgbpZZ8Q=";
+  };
+
+  npmDepsHash = "sha256-HBV002dwyWwb9dBBpQY4FFZ/U0lfrXNEmNz4Aa0gRKw=";
+  npmPackFlags = [ "--ignore-scripts" ];
+  dontNpmBuild = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Convert svg nodes to vector font-free elements";
+    homepage = "https://github.com/paulzi/svg-text-to-path";
+    maintainers = with lib.maintainers; [ ulysseszhan ];
+    license = lib.licenses.mit;
+    mainProgram = "svg-text-to-path";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/sy/syft/package.nix b/pkgs/by-name/sy/syft/package.nix
index ed7a4db2d4de..33715336dd4c 100644
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "1.24.0";
+  version = "1.26.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     tag = "v${version}";
-    hash = "sha256-7Fav9tTcPFpAQnKMXOeD9Ho5rADDwGvLD3f9VzV82NU=";
+    hash = "sha256-xWQxxrKHBr6GizXbCiMhc7IFlVY7xo1kvyB3RsFFDsQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
   # hash mismatch with darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-+7tqC6I8zFbGVHFulIbeLBdy3br2ifrEEXM5hZZe3/8=";
+  vendorHash = "sha256-mK46xzwQ+Qjey0IrAuYdrt2Mz8rA4RdhrT2ayAK3TTw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
index 2d0407937acf..d4bd67400d81 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
@@ -68,28 +68,15 @@ self: super: {
   # Needs Cabal 3.0.x.
   jailbreak-cabal = super.jailbreak-cabal.overrideScope (cself: _: { Cabal = cself.Cabal_3_2_1_0; });
 
-  # https://github.com/tibbe/unordered-containers/issues/214
-  unordered-containers = dontCheck super.unordered-containers;
-
   # Test suite does not compile.
   data-clist = doJailbreak super.data-clist; # won't cope with QuickCheck 2.12.x
   dates = doJailbreak super.dates; # base >=4.9 && <4.12
-  Diff = dontCheck super.Diff;
-  equivalence = dontCheck super.equivalence; # test suite doesn't compile https://github.com/pa-ba/equivalence/issues/5
   HaTeX = doJailbreak super.HaTeX; # containers >=0.4 && <0.6 is too tight; https://github.com/Daniel-Diaz/HaTeX/issues/126
   hpc-coveralls = doJailbreak super.hpc-coveralls; # https://github.com/guillaume-nargeot/hpc-coveralls/issues/82
   http-api-data = doJailbreak super.http-api-data;
-  persistent-sqlite = dontCheck super.persistent-sqlite;
-  unicode-transforms = dontCheck super.unicode-transforms;
   wl-pprint-extras = doJailbreak super.wl-pprint-extras; # containers >=0.4 && <0.6 is too tight; https://github.com/ekmett/wl-pprint-extras/issues/17
-  RSA = dontCheck super.RSA; # https://github.com/GaloisInc/RSA/issues/14
-  github = dontCheck super.github; # hspec upper bound exceeded; https://github.com/phadej/github/pull/341
-  binary-orphans = dontCheck super.binary-orphans; # tasty upper bound exceeded; https://github.com/phadej/binary-orphans/commit/8ce857226595dd520236ff4c51fa1a45d8387b33
   rebase = doJailbreak super.rebase; # time ==1.9.* is too low
 
-  # https://github.com/jgm/skylighting/issues/55
-  skylighting-core = dontCheck super.skylighting-core;
-
   # cabal2nix needs the latest version of Cabal, and the one
   # hackage-db uses must match, so take the latest
   cabal2nix = super.cabal2nix.overrideScope (self: super: { Cabal = self.Cabal_3_2_1_0; });
@@ -106,14 +93,5 @@ self: super: {
   # This became a core library in ghc 8.10., so we don’t have an "exception" attribute anymore.
   exceptions = self.exceptions_0_10_9;
 
-  # vector 0.12.2 indroduced doctest checks that don’t work on older compilers
-  vector = dontCheck super.vector;
-
-  # https://github.com/haskellari/time-compat/issues/23
-  time-compat = dontCheck super.time-compat;
-
   mime-string = disableOptimization super.mime-string;
-
-  # https://github.com/fpco/inline-c/issues/127 (recommend to upgrade to Nixpkgs GHC >=9.0)
-  inline-c-cpp = (if isDarwin then dontCheck else x: x) super.inline-c-cpp;
 }
diff --git a/pkgs/development/libraries/librdf/redland.nix b/pkgs/development/libraries/librdf/redland.nix
index 3391a8cf6ee6..2640330fb188 100644
--- a/pkgs/development/libraries/librdf/redland.nix
+++ b/pkgs/development/libraries/librdf/redland.nix
@@ -7,7 +7,6 @@
   libxslt,
   perl,
   curl,
-  pcre,
   libxml2,
   librdf_rasqal,
   gmp,
@@ -40,7 +39,6 @@ stdenv.mkDerivation rec {
       openssl
       libxslt
       curl
-      pcre
       libxml2
       gmp
     ]
diff --git a/pkgs/development/php-packages/excimer/default.nix b/pkgs/development/php-packages/excimer/default.nix
index ff695b0d5eb5..06a8538faa6c 100644
--- a/pkgs/development/php-packages/excimer/default.nix
+++ b/pkgs/development/php-packages/excimer/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "1.2.3";
+  version = "1.2.5";
 in
 buildPecl {
   inherit version;
@@ -15,7 +15,7 @@ buildPecl {
     owner = "wikimedia";
     repo = "mediawiki-php-excimer";
     tag = version;
-    hash = "sha256-p1tnrrSiTtoin/QSQFeeiX0Di1wFD8CMTdLazOfjWKU=";
+    hash = "sha256-xFnyqofazXtPfwp/4xNYwrPEW9vWzz5akXjCOiyP4nw=";
   };
 
   meta = {
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index 12112552c2a3..380346dc3d70 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpstan";
-  version = "2.1.15";
+  version = "2.1.17";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan-src";
     tag = finalAttrs.version;
-    hash = "sha256-1MHEN7/OL35xBLkwW7j2CxkjGb4EUkV1Zc8Nvn4xqNI=";
+    hash = "sha256-F4K+9tmnonUdk7VtXVo0tYf4RgoNjzGmIteWkzMOkYE=";
   };
 
-  vendorHash = "sha256-7PAO+8hkeNQH9lM77NvRX2/56PlIgWCwJ700b4erM2Y=";
+  vendorHash = "sha256-q83Gb2oujougRQVmeTOtdnVtP4IRghPUpo1kzbSlhiQ=";
   composerStrictValidation = false;
 
   doInstallCheck = true;
diff --git a/pkgs/development/python-modules/django-celery-beat/default.nix b/pkgs/development/python-modules/django-celery-beat/default.nix
index e4bed5b213f3..2b80ed336234 100644
--- a/pkgs/development/python-modules/django-celery-beat/default.nix
+++ b/pkgs/development/python-modules/django-celery-beat/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "django-celery-beat";
-  version = "2.8.0";
+  version = "2.8.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "celery";
     repo = "django-celery-beat";
     tag = "v${version}";
-    hash = "sha256-PWTWFcmjeY0T6dmLzMDN3gqgJaYx1kWy1VJKlWxY+io=";
+    hash = "sha256-pakOpch5r2ug0UDSqEU34qr4Tz1/mkuFiHW+IOUuGcc=";
   };
 
   pythonRelaxDeps = [ "django" ];
diff --git a/pkgs/development/python-modules/djangocms-alias/default.nix b/pkgs/development/python-modules/djangocms-alias/default.nix
index 6d76e0805895..4fef532d870d 100644
--- a/pkgs/development/python-modules/djangocms-alias/default.nix
+++ b/pkgs/development/python-modules/djangocms-alias/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "djangocms-alias";
-  version = "2.0.2";
+  version = "2.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "django-cms";
     repo = "djangocms-alias";
     tag = version;
-    hash = "sha256-yAH3eBeQhTBAHp0Zof1RIa7yYffC9V2zkS7E7mKecbA=";
+    hash = "sha256-q5iNTnoPto7jgxF/46I0oA8NYFBbDafsRUFmKMFoQM4=";
   };
 
   build-system = [ setuptools ];
@@ -59,7 +59,7 @@ buildPythonPackage rec {
   meta = {
     description = "Lean enterprise content management powered by Django";
     homepage = "https://django-cms.org";
-    changelog = "https://github.com/django-cms/django-cms/releases/tag/${version}";
+    changelog = "https://github.com/django-cms/django-cms/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.onny ];
   };
diff --git a/pkgs/development/python-modules/itables/default.nix b/pkgs/development/python-modules/itables/default.nix
new file mode 100644
index 000000000000..39e6c1292f15
--- /dev/null
+++ b/pkgs/development/python-modules/itables/default.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  python,
+
+  # build-system
+  dash,
+  hatchling,
+  hatch-jupyter-builder,
+  pyyaml,
+  setuptools,
+
+  # nativeBuildInputs
+  nodejs,
+
+  # dependencies
+  ipython,
+  numpy,
+  pandas,
+}:
+
+buildPythonPackage rec {
+  pname = "itables";
+  version = "2.4.0";
+
+  # itables has 4 different node packages, each with their own
+  # package-lock.json, and partially depending on each other.
+  # Our fetchNpmDeps tooling in nixpkgs doesn't support this yet, so we fetch
+  # the source tarball from pypi, wich includes the javascript bundle already.
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-S5HASUVfqTny+Vu15MYSSrEffCaJuL7UhDOc3eudVWI=";
+  };
+
+  pyproject = true;
+
+  build-system = [
+    dash
+    hatchling
+    hatch-jupyter-builder
+    pyyaml
+    setuptools
+  ];
+
+  nativeBuildInputs = [
+    nodejs
+  ];
+
+  dependencies = [
+    ipython
+    numpy
+    pandas
+  ];
+
+  # no tests in pypi tarball
+  doCheck = false;
+
+  # don't run the hooks, as they try to invoke npm on packages/,
+  env.HATCH_BUILD_NO_HOOKS = true;
+
+  # The pyproject.toml shipped with the sources doesn't install anything,
+  # as the paths in the pypi tarball are not the same as in the repo checkout.
+  # We exclude itables_for_dash here, as it's missing the .dist-info dir
+  # plumbing to be discoverable, and should be its own package anyways.
+  postInstall = ''
+    cp -R itables $out/${python.sitePackages}
+  '';
+
+  pythonImportsCheck = [ "itables" ];
+
+  meta = {
+    description = "Pandas and Polar DataFrames as interactive DataTables";
+    homepage = "https://github.com/mwouts/itables";
+    changelog = "https://github.com/mwouts/itables/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ flokli ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index be8e1f24826a..0fefe2c61c32 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.31.1";
+  version = "2.31.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     postFetch = ''
       sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pytensor/_version.py
     '';
-    hash = "sha256-R/qHLAqNbFqoi2MQeptlVE148cInVOpN5n/wGr1AB9M=";
+    hash = "sha256-dFqJm9/77Nelh//1FjLauPAAQSogDa2fd1JJjlVFWsY=";
   };
 
   build-system = [
diff --git a/pkgs/development/tools/analysis/clazy/default.nix b/pkgs/development/tools/analysis/clazy/default.nix
index 6b355d4493b0..cf1997015ec4 100644
--- a/pkgs/development/tools/analysis/clazy/default.nix
+++ b/pkgs/development/tools/analysis/clazy/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clazy";
-  version = "1.13";
+  version = "1.14";
 
   src = fetchFromGitHub {
     owner = "KDE";
     repo = "clazy";
     tag = finalAttrs.version;
-    hash = "sha256-cNckRQ3+9HjJ1xYIDkosEP7K66+G0J3K9wt4OWLokLs=";
+    hash = "sha256-t1j/MrKD8ocmhbFtWz6BJUbPSCSWjlRmuYnsPhHWgAM=";
   };
 
   buildInputs = [
diff --git a/pkgs/servers/hasura/cli.nix b/pkgs/servers/hasura/cli.nix
index 0584e872f310..1b9591db4775 100644
--- a/pkgs/servers/hasura/cli.nix
+++ b/pkgs/servers/hasura/cli.nix
@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "hasura";
-  version = "2.3.1";
+  version = "2.48.1";
 
   src = fetchFromGitHub {
     owner = "hasura";
     repo = "graphql-engine";
     rev = "v${version}";
-    sha256 = "1r19qw2wxzmngb6sjpin3dk6i5r491brcb0ir4g8kw9d0ic90hpy";
+    sha256 = "sha256-Bj9gaQc7zCy4M8apXdVJhEDClB2n75rzBiVq+PmNP4k=";
   };
   modRoot = "./cli";
 
   subPackages = [ "cmd/hasura" ];
 
-  vendorHash = "sha256-S6xyevC/7dpn2Ana5mkROwIOvtQVPThoNEVKkXQmUGY=";
+  vendorHash = "sha256-riPCH7H1arKP2se2H52R69fL+DyKXK1i/ne5apoS/5w=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix b/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
index 535e57b526ca..62b2cf19103a 100644
--- a/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
+++ b/pkgs/servers/web-apps/wordpress/packages/thirdparty.nix
@@ -6,13 +6,18 @@
 {
   plugins.civicrm = stdenv.mkDerivation rec {
     pname = "civicrm";
-    version = "5.56.0";
+    version = "6.2.0";
     src = fetchzip {
       inherit version;
       name = pname;
-      url = "https://storage.googleapis.com/${pname}/${pname}-stable/${version}/${pname}-${version}-wordpress.zip";
-      hash = "sha256-XsNFxVL0LF+OHlsqjjTV41x9ERLwMDq9BnKKP3Px2aI=";
+      url = "https://download.civicrm.org/${pname}-${version}-wordpress.zip";
+      hash = "sha256-Bx1rixRbqJsiMrIIkzTGeqLIc5raiNoUVTsoxZ6q9uU=";
     };
+    installPhase = ''
+      runHook preInstall
+      cp -r ./ -T $out
+      runHook postInstall
+    '';
     meta.license = lib.licenses.agpl3Only;
   };
   themes = {
diff --git a/pkgs/tools/package-management/nix/common-meson.nix b/pkgs/tools/package-management/nix/common-meson.nix
index 8775feab540f..1e2bb73aef41 100644
--- a/pkgs/tools/package-management/nix/common-meson.nix
+++ b/pkgs/tools/package-management/nix/common-meson.nix
@@ -274,6 +274,10 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.lgpl21Plus;
     inherit maintainers teams;
     platforms = platforms.unix;
+    # Gets stuck in functional-tests in cross-trunk jobset and doesn't timeout
+    # https://hydra.nixos.org/build/298175022
+    # probably https://github.com/NixOS/nix/issues/13042
+    broken = stdenv.hostPlatform.system == "i686-linux" && stdenv.buildPlatform != stdenv.hostPlatform;
     outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
     mainProgram = "nix";
   };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 97119f7d3416..0deb086166fe 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -468,7 +468,7 @@ with self;
         artistic1
         gpl1Plus
       ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.AlienLibGumbo.x86_64-darwin
+      broken = stdenv.hostPlatform.isLinux; # Fails with: cannot find ./.libs/libgumbo.so
     };
   };
 
@@ -979,7 +979,7 @@ with self;
         artistic1
         gpl1Plus
       ];
-      broken = true; # DB.c:(.text+0x153): undefined reference to `Perl_init_debugger'
+      broken = stdenv.hostPlatform.isLinux; # DB.c: undefined reference to `Perl_init_debugger'
     };
   };
 
@@ -8273,14 +8273,13 @@ with self;
       TestRequires
     ];
     meta = {
-      description = "Grep-like program for searching source code";
+      description = "MessagePack serialization format";
       homepage = "https://github.com/msgpack/msgpack-perl";
       license = with lib.licenses; [
         artistic1
         gpl1Plus
       ];
       maintainers = [ maintainers.sgo ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.DataMessagePack.x86_64-darwin
     };
   };
 
@@ -8655,7 +8654,6 @@ with self;
         artistic1
         gpl1Plus
       ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.DataUtil.x86_64-darwin
     };
   };
 
@@ -9897,7 +9895,6 @@ with self;
         artistic1
         gpl1Only
       ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.DBDsybase.x86_64-darwin
     };
   };
 
@@ -13563,7 +13560,6 @@ with self;
         artistic1
         gpl1Plus
       ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.FileLibMagic.x86_64-darwin
     };
   };
 
@@ -15809,7 +15805,6 @@ with self;
         artistic1
         gpl1Plus
       ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.HTMLEscape.x86_64-darwin
     };
   };
 
@@ -21025,7 +21020,6 @@ with self;
       description = "Fast XS implementation of MaxMind DB reader";
       homepage = "https://metacpan.org/release/MaxMind-DB-Reader-XS";
       license = with lib.licenses; [ artistic2 ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.MaxMindDBReaderXS.x86_64-darwin
     };
   };
 
@@ -21063,7 +21057,6 @@ with self;
         artistic1
         gpl1Plus
       ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.MaxMindDBWriter.x86_64-darwin
     };
   };
 
@@ -32361,7 +32354,6 @@ with self;
         gpl2Plus
         artistic1
       ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.SysVirt.x86_64-darwin
     };
   };
 
@@ -35836,7 +35828,6 @@ with self;
         artistic1
         gpl1Plus
       ]; # taken from el6
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.TextIconv.x86_64-darwin
     };
   };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dabc058c5f53..3e9e11f6e6a8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6983,6 +6983,8 @@ self: super: with self; {
 
   israel-rail-api = callPackage ../development/python-modules/israel-rail-api { };
 
+  itables = callPackage ../development/python-modules/itables { };
+
   itanium-demangler = callPackage ../development/python-modules/itanium-demangler { };
 
   item-synchronizer = callPackage ../development/python-modules/item-synchronizer { };