diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index d0c5057a0499..c3caf7403784 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -22,7 +22,7 @@ let
   anyMatchingFiles = files: builtins.any anyMatchingFile files;
 
   attrsWithMaintainers = lib.pipe (changedattrs ++ removedattrs) [
-    (builtins.map (
+    (map (
       name:
       let
         # Some packages might be reported as changed on a different platform, but
@@ -46,7 +46,7 @@ let
   relevantFilenames =
     drv:
     (lib.lists.unique (
-      builtins.map (pos: lib.strings.removePrefix (toString ../..) pos.file) (
+      map (pos: lib.strings.removePrefix (toString ../..) pos.file) (
         builtins.filter (x: x != null) [
           ((drv.meta or { }).maintainersPosition or null)
           ((drv.meta or { }).teamsPosition or null)
@@ -73,7 +73,7 @@ let
       )
     ));
 
-  attrsWithFilenames = builtins.map (
+  attrsWithFilenames = map (
     pkg: pkg // { filenames = relevantFilenames pkg.package; }
   ) attrsWithMaintainers;
 
@@ -81,7 +81,7 @@ let
 
   listToPing = lib.concatMap (
     pkg:
-    builtins.map (maintainer: {
+    map (maintainer: {
       id = maintainer.githubId;
       inherit (maintainer) github;
       packageName = pkg.name;
@@ -92,7 +92,7 @@ let
   byMaintainer = lib.groupBy (ping: toString ping.${if byName then "github" else "id"}) listToPing;
 
   packagesPerMaintainer = lib.attrsets.mapAttrs (
-    maintainer: packages: builtins.map (pkg: pkg.packageName) packages
+    maintainer: packages: map (pkg: pkg.packageName) packages
   ) byMaintainer;
 in
 packagesPerMaintainer
diff --git a/ci/eval/compare/utils.nix b/ci/eval/compare/utils.nix
index 5dcb97e97535..65a558d8be60 100644
--- a/ci/eval/compare/utils.nix
+++ b/ci/eval/compare/utils.nix
@@ -66,7 +66,7 @@ rec {
   */
   convertToPackagePlatformAttrs =
     packagePlatformPaths:
-    builtins.filter (x: x != null) (builtins.map convertToPackagePlatformAttr packagePlatformPaths);
+    builtins.filter (x: x != null) (map convertToPackagePlatformAttr packagePlatformPaths);
 
   /*
     Converts a list of `packagePlatformPath`s directly to a list of (unique) package names
@@ -91,7 +91,7 @@ rec {
     let
       packagePlatformAttrs = convertToPackagePlatformAttrs (uniqueStrings packagePlatformPaths);
     in
-    uniqueStrings (builtins.map (p: p.name) packagePlatformAttrs);
+    uniqueStrings (map (p: p.name) packagePlatformAttrs);
 
   /*
     Group a list of `packagePlatformAttr`s by platforms
diff --git a/ci/eval/outpaths.nix b/ci/eval/outpaths.nix
index b4988e844e8e..6d003dafc3c9 100644
--- a/ci/eval/outpaths.nix
+++ b/ci/eval/outpaths.nix
@@ -95,7 +95,7 @@ let
 
 in
 tweak (
-  (builtins.removeAttrs nixpkgsJobs blacklist)
+  (removeAttrs nixpkgsJobs blacklist)
   // {
     nixosTests.simple = nixosJobs.tests.simple;
   }
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 20d979bf05e8..ec77a877925e 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -132,6 +132,8 @@
 
 - `stalwart-mail` since `0.13.0` "introduces a significant redesign of the MTA’s delivery and queueing subsystem". See [the upgrading announcement for the `0.13.0` release](https://github.com/stalwartlabs/stalwart/blob/89b561b5ca1c5a11f2a768b4a2cfef0f473b7a01/UPGRADING.md#upgrading-from-v012x-and-v011x-to-v013x).
 
+- `meilisearch_1_11` has been removed, as it is no longer supported.
+
 - Greetd and its original greeters (`tuigreet`, `gtkgreet`, `qtgreet`, `regreet`, `wlgreet`) were moved from `greetd` namespace to top level (`greetd.tuigreet` -> `tuigreet`, `greetd.greetd` -> `greetd`, etc). The original attrs are available for compatibility as passthrus of `greetd`, but will emit a warning. They will be removed in future releases.
 
 - The `archipelago-minecraft` package was removed, as upstream no longer provides support for the Minecraft APWorld.
diff --git a/flake.nix b/flake.nix
index 3d01030806fb..98861323e026 100644
--- a/flake.nix
+++ b/flake.nix
@@ -91,7 +91,7 @@
                   )
                 ];
               }
-              // builtins.removeAttrs args [ "modules" ]
+              // removeAttrs args [ "modules" ]
             );
         }
       );
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e22f136b52fd..0c25896509a2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14879,6 +14879,12 @@
     githubId = 918448;
     name = "Anthony Lodi";
   };
+  logger = {
+    name = "Ido Samuelson";
+    email = "ido.samuelson@gmail.com";
+    github = "i-am-logger";
+    githubId = 1440852;
+  };
   logo = {
     email = "logo4poop@protonmail.com";
     matrix = "@logo4poop:matrix.org";
@@ -17624,11 +17630,11 @@
     name = "Marko Poikonen";
   };
   mtpham99 = {
-    name = "Matthew Pham";
-    email = "mtpham.nixos@protonmail.com";
+    name = "Matthew T. Pham";
+    email = "pham.matthew+git@protonmail.com";
     github = "mtpham99";
     githubId = 72663763;
-    keys = [ { fingerprint = "DB3E A12D B291 594A 79C5 F6B3 10AB 6868 37F6 FA3F"; } ];
+    keys = [ { fingerprint = "9656 0514 5815 198E 4EC6  8FCB 7E21 7574 BF8B 385B"; } ];
   };
   mtreskin = {
     email = "zerthurd@gmail.com";
@@ -21620,12 +21626,6 @@
     githubId = 1973389;
     name = "Reuben D'Netto";
   };
-  realsnick = {
-    name = "Ido Samuelson";
-    email = "ido.samuelson@gmail.com";
-    github = "i-am-logger";
-    githubId = 1440852;
-  };
   rebmit = {
     name = "Lu Wang";
     email = "rebmit@rebmit.moe";
diff --git a/maintainers/scripts/convert-to-import-cargo-lock/default.nix b/maintainers/scripts/convert-to-import-cargo-lock/default.nix
index 954ab840a654..261cad34149f 100644
--- a/maintainers/scripts/convert-to-import-cargo-lock/default.nix
+++ b/maintainers/scripts/convert-to-import-cargo-lock/default.nix
@@ -8,7 +8,7 @@ rustPlatform.buildRustPackage {
     filter =
       name: type:
       let
-        name' = builtins.baseNameOf name;
+        name' = baseNameOf name;
       in
       name' != "default.nix" && name' != "target";
   };
diff --git a/maintainers/scripts/haskell/test-configurations.nix b/maintainers/scripts/haskell/test-configurations.nix
index 5e6353ea6bbe..49d2459c87fe 100644
--- a/maintainers/scripts/haskell/test-configurations.nix
+++ b/maintainers/scripts/haskell/test-configurations.nix
@@ -65,7 +65,7 @@ let
   inherit (pkgs) lib;
 
   # see usage explanation for the input format `files` allows
-  files' = builtins.map builtins.baseNameOf (if !builtins.isList files then [ files ] else files);
+  files' = map baseNameOf (if !builtins.isList files then [ files ] else files);
 
   packageSetsWithVersionedHead =
     pkgs.haskell.packages
@@ -99,7 +99,7 @@ let
       # match the major and minor version of the GHC the config is intended for, if any
       configVersion = lib.concatStrings (builtins.match "ghc-([0-9]+).([0-9]+).x" configName);
       # return all package sets under haskell.packages matching the version components
-      setsForVersion = builtins.map (name: packageSetsWithVersionedHead.${name}) (
+      setsForVersion = map (name: packageSetsWithVersionedHead.${name}) (
         builtins.filter (
           setName:
           lib.hasPrefix "ghc${configVersion}" setName && (skipBinaryGHCs -> !(lib.hasInfix "Binary" setName))
@@ -120,7 +120,7 @@ let
 
   # attribute set that has all the attributes of haskellPackages set to null
   availableHaskellPackages = builtins.listToAttrs (
-    builtins.map (attr: lib.nameValuePair attr null) (builtins.attrNames pkgs.haskellPackages)
+    map (attr: lib.nameValuePair attr null) (builtins.attrNames pkgs.haskellPackages)
   );
 
   # evaluate a configuration and only return the attributes changed by it,
@@ -155,7 +155,7 @@ let
             sets = setsForFile fileName;
             attrs = overriddenAttrs fileName;
           in
-          lib.concatMap (set: builtins.map (attr: set.${attr}) attrs) sets
+          lib.concatMap (set: map (attr: set.${attr}) attrs) sets
         ) files'
       );
 in
diff --git a/maintainers/scripts/rebuild-amount.sh b/maintainers/scripts/rebuild-amount.sh
index 0058e8c04ba0..1a5d3ac517ad 100755
--- a/maintainers/scripts/rebuild-amount.sh
+++ b/maintainers/scripts/rebuild-amount.sh
@@ -69,7 +69,7 @@ nixexpr() {
           ];
 
         in
-          tweak (builtins.removeAttrs hydraJobs blacklist)
+          tweak (removeAttrs hydraJobs blacklist)
 EONIX
 }
 
diff --git a/maintainers/scripts/update.nix b/maintainers/scripts/update.nix
index a45d2446f124..ca231c9e735a 100644
--- a/maintainers/scripts/update.nix
+++ b/maintainers/scripts/update.nix
@@ -120,7 +120,7 @@ let
     let
       maintainer =
         if !builtins.hasAttr maintainer' lib.maintainers then
-          builtins.throw "Maintainer with name `${maintainer'} does not exist in `maintainers/maintainer-list.nix`."
+          throw "Maintainer with name `${maintainer'} does not exist in `maintainers/maintainer-list.nix`."
         else
           builtins.getAttr maintainer' lib.maintainers;
     in
@@ -147,7 +147,7 @@ let
       pathContent = lib.attrByPath prefix null pkgs;
     in
     if pathContent == null then
-      builtins.throw "Attribute path `${path}` does not exist."
+      throw "Attribute path `${path}` does not exist."
     else
       packagesWithPath prefix (path: pkg: (get-script pkg != null)) pathContent;
 
@@ -158,9 +158,9 @@ let
       package = lib.attrByPath (lib.splitString "." path) null pkgs;
     in
     if package == null then
-      builtins.throw "Package with an attribute name `${path}` does not exist."
+      throw "Package with an attribute name `${path}` does not exist."
     else if get-script package == null then
-      builtins.throw "Package with an attribute name `${path}` does not have a `passthru.updateScript` attribute defined."
+      throw "Package with an attribute name `${path}` does not have a `passthru.updateScript` attribute defined."
     else
       {
         attrPath = path;
@@ -178,7 +178,7 @@ let
     else if path != null then
       packagesWithUpdateScript path pkgs
     else
-      builtins.throw "No arguments provided.\n\n${helpText}";
+      throw "No arguments provided.\n\n${helpText}";
 
   helpText = ''
     Please run:
@@ -242,7 +242,7 @@ let
       name = package.name;
       pname = lib.getName package;
       oldVersion = lib.getVersion package;
-      updateScript = map builtins.toString (lib.toList (updateScript.command or updateScript));
+      updateScript = map toString (lib.toList (updateScript.command or updateScript));
       supportedFeatures = updateScript.supportedFeatures or [ ];
       attrPath = updateScript.attrPath or attrPath;
     };
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 4063629f1d3a..bd4e2a4dfc6f 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -218,6 +218,8 @@
 
 - The `services.snapserver` module has been migrated to use the settings option and render a configuration file instead of passing every option over the command line.
 
+- The `services.meilisearch` module now always defaults to the latest version of meilisearch, as the previous `meilisearch_1_11` package was removed. This is only an issue if you were using the old version.
+
 - The `services.postgresql` module now sets up a systemd unit `postgresql.target`. Depending on `postgresql.target` guarantees that postgres is in read-write mode and initial/ensure scripts were executed. Depending on `postgresql.service` only guarantees a read-only connection.
 
 - The `services.mysql` module now restarts the database `on-abnormal`, which means that it now will be restarted in certain situations, it wasn't before. For example an OOM-kill.
diff --git a/nixos/modules/services/search/meilisearch.nix b/nixos/modules/services/search/meilisearch.nix
index fb5370a297b2..1c335d8591ed 100644
--- a/nixos/modules/services/search/meilisearch.nix
+++ b/nixos/modules/services/search/meilisearch.nix
@@ -182,21 +182,7 @@ in
       no_analytics = lib.mkDefault true;
     };
 
-    warnings = lib.optional (lib.versionOlder cfg.package.version "1.12") ''
-      Meilisearch 1.11 will be removed in NixOS 25.11. As it was the last
-      version not to support dumpless upgrades, you will have to manually
-      migrate your data before that. Instructions can be found at
-      https://www.meilisearch.com/docs/learn/update_and_migration/updating#using-a-dump
-      and afterwards, you can set `services.meilisearch.package = pkgs.meilisearch;`
-      to use the latest version.
-    '';
-
-    services.meilisearch.package = lib.mkDefault (
-      if lib.versionAtLeast config.system.stateVersion "25.05" then
-        pkgs.meilisearch
-      else
-        pkgs.meilisearch_1_11
-    );
+    services.meilisearch.package = lib.mkDefault pkgs.meilisearch;
 
     # used to restore dumps
     environment.systemPackages = [ cfg.package ];
diff --git a/pkgs/applications/audio/ardour/7.nix b/pkgs/applications/audio/ardour/7.nix
index 31f67dc36ce0..cfcd55ff5c05 100644
--- a/pkgs/applications/audio/ardour/7.nix
+++ b/pkgs/applications/audio/ardour/7.nix
@@ -108,8 +108,8 @@ stdenv.mkDerivation rec {
     sed 's|/usr/include/libintl.h|${glibc.dev}/include/libintl.h|' -i wscript
     patchShebangs ./tools/
     substituteInPlace libs/ardour/video_tools_paths.cc \
-      --replace 'ffmpeg_exe = X_("");' 'ffmpeg_exe = X_("${ffmpeg}/bin/ffmpeg");' \
-      --replace 'ffprobe_exe = X_("");' 'ffprobe_exe = X_("${ffmpeg}/bin/ffprobe");'
+      --replace-fail 'ffmpeg_exe = X_("")' "ffmpeg_exe = X_(\"${lib.getExe ffmpeg}\");" \
+      --replace-fail 'ffprobe_exe = X_("");' "ffprobe_exe = X_(\"${lib.getExe' ffmpeg "ffprobe"}\");"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
index fcfcd3b09b11..e25b30b30f70 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
     cp -r usr/share $out/share
     substitute usr/share/applications/com.bitwig.BitwigStudio.desktop \
       $out/share/applications/com.bitwig.BitwigStudio.desktop \
-      --replace /usr/bin/bitwig-studio $out/bin/bitwig-studio
+      --replace-fail "Exec=bitwig-studio" "Exec=$out/bin/bitwig-studio"
 
       runHook postInstall
   '';
diff --git a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
index 4883095334a6..1e510beaa20a 100644
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation rec {
 
     substitute usr/share/applications/com.bitwig.BitwigStudio.desktop \
       $out/share/applications/com.bitwig.BitwigStudio.desktop \
-      --replace /usr/bin/bitwig-studio $out/bin/bitwig-studio
+      --replace-fail "Exec=bitwig-studio" "Exec=$out/bin/bitwig-studio"
 
       runHook postInstall
   '';
diff --git a/pkgs/applications/audio/carla/default.nix b/pkgs/applications/audio/carla/default.nix
index c1ed83bc9bb4..779f3ba6815b 100644
--- a/pkgs/applications/audio/carla/default.nix
+++ b/pkgs/applications/audio/carla/default.nix
@@ -75,13 +75,13 @@ stdenv.mkDerivation (finalAttrs: {
     # --with-appname="$0" is evaluated with $0=.carla-wrapped instead of carla. Fix that.
     for file in $(grep -rl -- '--with-appname="$0"'); do
         filename="$(basename -- "$file")"
-        substituteInPlace "$file" --replace '--with-appname="$0"' "--with-appname=\"$filename\""
+        substituteInPlace "$file" --replace-fail '--with-appname="$0"' "--with-appname=\"$filename\""
     done
   ''
   + lib.optionalString withGtk2 ''
     # Will try to dlopen() libgtk-x11-2.0 at runtime when using the bridge.
     substituteInPlace source/bridges-ui/Makefile \
-        --replace '$(CXX) $(OBJS_GTK2)' '$(CXX) $(OBJS_GTK2) -lgtk-x11-2.0'
+        --replace-fail '$(CXX) $(OBJS_GTK2)' '$(CXX) $(OBJS_GTK2) -lgtk-x11-2.0'
   '';
 
   dontWrapQtApps = true;
diff --git a/pkgs/applications/audio/codecserver/default.nix b/pkgs/applications/audio/codecserver/default.nix
index 4c27c1f74cb0..f3f39ec81cf1 100644
--- a/pkgs/applications/audio/codecserver/default.nix
+++ b/pkgs/applications/audio/codecserver/default.nix
@@ -32,8 +32,8 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     substituteInPlace "$out"/lib/pkgconfig/codecserver.pc \
-      --replace '=''${prefix}//' '=/' \
-      --replace '=''${exec_prefix}//' '=/'
+      --replace-fail '=''${prefix}//' '=/' \
+      --replace-fail '=''${exec_prefix}//' '=/'
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/audio/miniaudicle/default.nix b/pkgs/applications/audio/miniaudicle/default.nix
index 117d5b3d3450..b7bdd19a4fcb 100644
--- a/pkgs/applications/audio/miniaudicle/default.nix
+++ b/pkgs/applications/audio/miniaudicle/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     echo '#define GIT_REVISION "${finalAttrs.version}-NixOS"' > git-rev.h
     substituteInPlace miniAudicle.pro \
-      --replace "/usr/local" $out
+      --replace-fail "/usr/local" $out
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/mopidy/iris.nix b/pkgs/applications/audio/mopidy/iris.nix
index 7165c58740a4..7b619f41ae8f 100644
--- a/pkgs/applications/audio/mopidy/iris.nix
+++ b/pkgs/applications/audio/mopidy/iris.nix
@@ -7,13 +7,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "mopidy-iris";
-  version = "3.69.3";
+  version = "3.70.0";
   pyproject = true;
 
   src = fetchPypi {
+    pname = "mopidy_iris";
     inherit version;
-    pname = "Mopidy-Iris";
-    hash = "sha256-PEAXnapiyxozijR053I7zQYRYLeDOV719L0QbO2r4r4=";
+    hash = "sha256-md/1blTTtjiAAb/jiLE2EfiSlIUwEga8U7OiuKa466k=";
   };
 
   build-system = [
diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
index 14519496f5f6..0cbc0ed2934b 100644
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchurl,
   fetchFromGitHub,
-  autoreconfHook,
   pkg-config,
   util-linux,
   hexdump,
@@ -23,29 +22,30 @@
   withGui,
   withWallet ? true,
   gnupg,
+  cmake,
   # Signatures from the following GPG public keys checked during verification of the source code.
   # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
   builderKeys ? [
     "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
-    "32FE1E61B1C711186CA378DEFD8981F1BC41ABB9" # oomahq.gpg
-    "CACC7CBB26B3D2EE8FC2F2BC0E37EBAB8574F005" # leo-haf.gpg
+    "55058E8947E136A64F9E8AD5C4512A878E4AC2BF" # nsvrn
+    "DAED928C727D3E613EC46635F5073C4F4882FFFC" # leo-haf.gpg
   ],
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
-  version = "28.1.knots20250305";
+  version = "29.1.knots20250903";
 
   src = fetchurl {
-    url = "https://bitcoinknots.org/files/28.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
+    url = "https://bitcoinknots.org/files/29.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
     # hash retrieved from signed SHA256SUMS
-    hash = "sha256-DKO3+43Tn/BTKQVrLrCkeMtzm8SfbaJD8rPlb6lDA8A=";
+    hash = "sha256-2DlJlGNrCOe8UouZ+TLdZ2OahU18AWL6K/KI1YA29QY=";
   };
 
   nativeBuildInputs = [
-    autoreconfHook
     pkg-config
     gnupg
+    cmake
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
@@ -76,18 +76,18 @@ stdenv.mkDerivation (finalAttrs: {
       publicKeys = fetchFromGitHub {
         owner = "bitcoinknots";
         repo = "guix.sigs";
-        rev = "b998306d462f39b6077518521700d7156fec76b8";
-        sha256 = "sha256-q4tumAfTr828AZNOa9ia7Y0PYoe6W47V/7SEApTzl3w=";
+        rev = "d441685d5179b91070fadbc764be3a41616f36df";
+        sha256 = "sha256-XO/E51yOFrRYrGnxsyH/ZPF4Yf192x+lT2FPdilkacA=";
       };
 
       checksums = fetchurl {
         url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS";
-        hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs=";
+        hash = "sha256-CH5p+u2XvIpWC/yv+UrP3JSq/dcAxq/eCZ+fPzqaI+Q=";
       };
 
       signatures = fetchurl {
         url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo=";
+        hash = "sha256-abCiaE3etiXfqC1nrmHMP77HO94L+ZZv4B2s08p1d2k=";
       };
 
       verifyBuilderKeys =
@@ -117,19 +117,18 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
   configureFlags = [
-    "--with-boost-libdir=${boost.out}/lib"
-    "--disable-bench"
+    (lib.cmakeBool "BUILD_BENCH" false)
   ]
   ++ lib.optionals (!finalAttrs.doCheck) [
-    "--disable-tests"
-    "--disable-gui-tests"
+    (lib.cmakeBool "BUILD_TESTS" false)
+    (lib.cmakeBool "BUILD_GUI_TESTS" false)
   ]
   ++ lib.optionals (!withWallet) [
-    "--disable-wallet"
+    (lib.cmakeBool "ENABLE_WALLET" false)
   ]
   ++ lib.optionals withGui [
-    "--with-gui=qt5"
-    "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
+    (lib.cmakeBool "BUILD_GUI" true)
+    (lib.cmakeFeature "WITH_QT_VERSION" "5")
   ];
 
   nativeCheckInputs = [ python3 ];
diff --git a/pkgs/applications/misc/fetchmail/default.nix b/pkgs/applications/misc/fetchmail/default.nix
index d5f5f33f6b18..a7ff3c629923 100644
--- a/pkgs/applications/misc/fetchmail/default.nix
+++ b/pkgs/applications/misc/fetchmail/default.nix
@@ -4,15 +4,16 @@
   fetchurl,
   openssl,
   python3,
+  pkg-config,
 }:
 
 stdenv.mkDerivation rec {
   pname = "fetchmail";
-  version = "6.5.1";
+  version = "6.5.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/fetchmail/fetchmail-${version}.tar.xz";
-    sha256 = "sha256-yj/blRQcJ3rKEJvnf01FtH4D7gEAQwWN2QvBgttRjUo=";
+    hash = "sha256-7BDg4OqkFzE1WTee3nbHRhR2bYOLOUcLZkdIY6ppDas=";
   };
 
   buildInputs = [
@@ -20,6 +21,8 @@ stdenv.mkDerivation rec {
     python3
   ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   configureFlags = [ "--with-ssl=${openssl.dev}" ];
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/fetchmail/v7.nix b/pkgs/applications/misc/fetchmail/v7.nix
index d9680b164b5d..5326aa73d380 100644
--- a/pkgs/applications/misc/fetchmail/v7.nix
+++ b/pkgs/applications/misc/fetchmail/v7.nix
@@ -1,32 +1,38 @@
 {
   lib,
   stdenv,
-  pkgs,
+  fetchFromGitLab,
+  openssl,
+  python3,
+  autoreconfHook,
+  pkg-config,
+  bison,
+  flex,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fetchmail";
-  version = "unstable-2022-05-26";
+  version = "7.0.0-alpha11";
 
-  src = pkgs.fetchFromGitLab {
+  src = fetchFromGitLab {
     owner = "fetchmail";
     repo = "fetchmail";
-    rev = "30b368fb8660d8fec08be1cdf2606c160b4bcb80";
+    tag = finalAttrs.version;
     hash = "sha256-83D2YlFCODK2YD+oLICdim2NtNkkJU67S3YLi8Q6ga8=";
   };
 
-  buildInputs = with pkgs; [
+  buildInputs = [
     openssl
     python3
   ];
-  nativeBuildInputs = with pkgs; [
+  nativeBuildInputs = [
     autoreconfHook
     pkg-config
     bison
     flex
   ];
 
-  configureFlags = [ "--with-ssl=${pkgs.openssl.dev}" ];
+  configureFlags = [ "--with-ssl=${openssl.dev}" ];
 
   postInstall = ''
     cp -a contrib/. $out/share/fetchmail-contrib
@@ -46,4 +52,4 @@ stdenv.mkDerivation {
     platforms = platforms.unix;
     license = licenses.gpl2Plus;
   };
-}
+})
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 246e88fafce5..81eda364f370 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -153,11 +153,11 @@
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-HlsJ85NXDykycTOCA+LbjeV5Jx4VWRDVFyKtx51n22Y=",
+    "hash": "sha256-gpIIj/nSMjhenXs2LbdJV5hdXoMKieueJ6o4xIG7HtA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v4.45.1",
+    "rev": "v4.47.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -480,13 +480,13 @@
     "vendorHash": "sha256-ZbU2z7qUHPR7vDSflesSjgK7x3LYXVe/gnVsy19q6Bs="
   },
   "fortios": {
-    "hash": "sha256-1HkVSoGt9PPPv8OH9F+acedVD0sbQ42msd6OWyegZFI=",
+    "hash": "sha256-dQMDGaYG3TDK5FBH8ODAsDcdScoDWWrk1vsWmL7sIPc=",
     "homepage": "https://registry.terraform.io/providers/fortinetdev/fortios",
     "owner": "fortinetdev",
     "repo": "terraform-provider-fortios",
-    "rev": "1.22.2",
+    "rev": "1.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1DXlugtN2G2HrKbIEJ3rJ9zRlbE8fEUdlt3gp0mRdso="
+    "vendorHash": "sha256-V+D/D+i1xbPp9IAfrAds2rNv5t/aXQxPwH9vY09DsMo="
   },
   "gandi": {
     "hash": "sha256-fsCtmwyxkXfOtiZG27VEb010jglK35yr4EynnUWlFog=",
@@ -660,13 +660,13 @@
     "vendorHash": null
   },
   "ibm": {
-    "hash": "sha256-sNhAq5htdk9cXVCHBfSdePy/On5JqMSoW/fbi2eiqVc=",
+    "hash": "sha256-gHHJiFLVmgx+689hzGVRQZB2wcATJ41bqpcWFDV7HyI=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.82.1",
+    "rev": "v1.83.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-AF93N5v9pzDOoCF3IF4SBprvNZZTR+KQKSN31an7l1g="
+    "vendorHash": "sha256-UL+1OcRKvyyCNL7czv+Zc/arkX3gy+AoqxlgZpmINhE="
   },
   "icinga2": {
     "hash": "sha256-Y/Oq0aTzP+oSKPhHiHY9Leal4HJJm7TNDpcdqkUsCmk=",
@@ -949,13 +949,13 @@
     "vendorHash": null
   },
   "okta": {
-    "hash": "sha256-sWiOGXeQxrUUlSM7TI4isUCdpiwwvosD+XVedM2pTSk=",
+    "hash": "sha256-O4zZ+D/+GTGf7Q7hHKlAcBg/0C7nCrhCV0St+LohedA=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v6.1.0",
+    "rev": "v6.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zfmQXMgKXCU8g1tpgV8BAXc5F8wBbJhtjO1trdQ4Jm4="
+    "vendorHash": "sha256-oE4nB0dFsiz82kj9QOr0vIjD3aBR+jxeAW5/ZWUxp44="
   },
   "oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -1174,13 +1174,13 @@
     "vendorHash": "sha256-at8i4gCFrJxE9fVIL5uI7iSFex0gLXu1SnlPKlZAmrY="
   },
   "scaleway": {
-    "hash": "sha256-FiC5FAag+ycf8Ti1iDXsJM5cb7xQUx8RLlv0gJ3+cNA=",
+    "hash": "sha256-KEQT0PScUTtTVgsinC9kZlNwAuSCHKXtswM6qDwApTo=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.60.0",
+    "rev": "v2.60.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-z8MzanM6u5CJSy7EFI583otoMzubkIrEuK1bldmV0u8="
+    "vendorHash": "sha256-rcidk22c7Pk3k8ZhJyBXo1y2KYRu1yzBVCVGA3GcGKM="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix
index 773aa38d0e53..ec5b5c4afb68 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprspace.nix
@@ -7,13 +7,13 @@
 
 mkHyprlandPlugin {
   pluginName = "hyprspace";
-  version = "0-unstable-2025-07-16";
+  version = "0-unstable-2025-09-28";
 
   src = fetchFromGitHub {
     owner = "KZDKM";
     repo = "hyprspace";
-    rev = "0a82e3724f929de8ad8fb04d2b7fa128493f24f7";
-    hash = "sha256-rTItuAWpzICMREF8Ww8cK4hYgNMRXJ4wjkN0akLlaWE=";
+    rev = "e54884da1d6a1af76af9d053887bf3750dd554fd";
+    hash = "sha256-QhcOFLJYC9CiSVPkci62ghMEAJChzl+L98To1pKvnRQ=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
index 241e77e17eb1..7e1ed6968617 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix
@@ -8,13 +8,13 @@
 }:
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hyprsplit";
-  version = "0.50.1";
+  version = "0.51.1";
 
   src = fetchFromGitHub {
     owner = "shezdy";
     repo = "hyprsplit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D0zfdUJXBRnNMmv/5qW+X4FJJ3/+t7yQmwJFkBuEgck=";
+    hash = "sha256-7cnfq7fXgJHkmHyvRwx8UsUdUwUEN4A1vUGgsSb4SmI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/arashi/package.nix b/pkgs/by-name/ar/arashi/package.nix
index cfa941014bdd..6f77e28d7101 100644
--- a/pkgs/by-name/ar/arashi/package.nix
+++ b/pkgs/by-name/ar/arashi/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arashi";
-  version = "25.09";
+  version = "25.10";
 
   src = fetchFromGitHub {
     owner = "0hStormy";
     repo = "Arashi";
     tag = finalAttrs.version;
-    hash = "sha256-qSr6wj+O6ieWxgKQxmUz7I3De9MOF5cq0I5DpD8+tug=";
+    hash = "sha256-NdsHnN3yd8i4g90BrFr6m1HGYr3WrFvULLXyY1MhOA8=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/bl/blackfire/package.nix b/pkgs/by-name/bl/blackfire/package.nix
index c2affaa67a31..0114bf9959f2 100644
--- a/pkgs/by-name/bl/blackfire/package.nix
+++ b/pkgs/by-name/bl/blackfire/package.nix
@@ -35,15 +35,15 @@ stdenv.mkDerivation rec {
       # Fix ExecStart path and replace deprecated directory creation method,
       # use dynamic user.
       substituteInPlace "$out/lib/systemd/system/blackfire-agent.service" \
-        --replace '/usr/' "$out/" \
-        --replace 'ExecStartPre=/bin/mkdir -p /var/run/blackfire' 'RuntimeDirectory=blackfire' \
-        --replace 'ExecStartPre=/bin/chown blackfire: /var/run/blackfire' "" \
-        --replace 'User=blackfire' 'DynamicUser=yes' \
-        --replace 'PermissionsStartOnly=true' ""
+        --replace-fail '/usr/' "$out/" \
+        --replace-fail 'ExecStartPre=/bin/mkdir -p /var/run/blackfire' 'RuntimeDirectory=blackfire' \
+        --replace-fail 'ExecStartPre=/bin/chown blackfire: /var/run/blackfire' "" \
+        --replace-fail 'User=blackfire' 'DynamicUser=yes' \
+        --replace-fail 'PermissionsStartOnly=true' ""
 
       # Modernize socket path.
       substituteInPlace "$out/etc/blackfire/agent" \
-        --replace '/var/run' '/run'
+        --replace-fail '/var/run' '/run'
     else
       mkdir $out
 
diff --git a/pkgs/by-name/bl/blast/package.nix b/pkgs/by-name/bl/blast/package.nix
index cbbc6ab194de..8c67b6e0b026 100644
--- a/pkgs/by-name/bl/blast/package.nix
+++ b/pkgs/by-name/bl/blast/package.nix
@@ -46,14 +46,14 @@ stdenv.mkDerivation rec {
         scripts/common/impl/report_duplicates.awk; do
 
         substituteInPlace $awks \
-              --replace /usr/bin/awk ${gawk}/bin/awk
+              --replace-fail "/usr/bin/awk" "${gawk}/bin/awk"
     done
 
     for mk in src/build-system/Makefile.meta.in \
         src/build-system/helpers/run_with_lock.c ; do
 
         substituteInPlace $mk \
-        --replace /bin/rm ${coreutils}/bin/rm
+        --replace-fail "/bin/rm" "${coreutils}/bin/rm"
     done
 
     for mk in src/build-system/Makefile.meta.gmake=no \
@@ -63,27 +63,27 @@ stdenv.mkDerivation rec {
         src/build-system/Makefile.rules_with_autodep.in; do
 
         substituteInPlace $mk \
-            --replace /bin/echo ${coreutils}/bin/echo
+            --replace-fail "/bin/echo" "${coreutils}/bin/echo"
     done
     for mk in src/build-system/Makefile.meta_p \
         src/build-system/Makefile.rules_with_autodep.in \
         src/build-system/Makefile.protobuf.in ; do
 
         substituteInPlace $mk \
-            --replace /bin/mv ${coreutils}/bin/mv
+            --replace-fail "/bin/mv" "${coreutils}/bin/mv"
     done
 
 
     substituteInPlace src/build-system/configure \
-        --replace /bin/pwd ${coreutils}/bin/pwd \
-        --replace /bin/ln ${coreutils}/bin/ln
+        --replace-fail "/bin/pwd" "${coreutils}/bin/pwd" \
+        --replace-fail "/bin/ln" "${coreutils}/bin/ln"
 
     substituteInPlace src/build-system/configure.ac \
-        --replace /bin/pwd ${coreutils}/bin/pwd \
-        --replace /bin/ln ${coreutils}/bin/ln
+        --replace-fail "/bin/pwd" "${coreutils}/bin/pwd" \
+        --replace-fail "/bin/ln" "${coreutils}/bin/ln"
 
     substituteInPlace src/build-system/Makefile.meta_l \
-        --replace /bin/date ${coreutils}/bin/date
+        --replace-fail "/bin/date" "${coreutils}/bin/date"
   '';
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     substituteInPlace $out/bin/get_species_taxids.sh \
-        --replace /bin/rm ${lib.getExe' coreutils "rm"}
+        --replace-fail "/bin/rm" "${coreutils}/bin/rm"
   '';
   patches = [ ./no_slash_bin.patch ];
 
diff --git a/pkgs/by-name/co/codebuff/package-lock.json b/pkgs/by-name/co/codebuff/package-lock.json
index 7b24701d8a6d..1aa38be0be8c 100644
--- a/pkgs/by-name/co/codebuff/package-lock.json
+++ b/pkgs/by-name/co/codebuff/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "codebuff": "^1.0.485"
+        "codebuff": "^1.0.496"
       }
     },
     "node_modules/chownr": {
@@ -18,9 +18,9 @@
       }
     },
     "node_modules/codebuff": {
-      "version": "1.0.485",
-      "resolved": "https://registry.npmjs.org/codebuff/-/codebuff-1.0.485.tgz",
-      "integrity": "sha512-RC+DPvi2radIVR5mQ+L53J6dg9RYR6mtmnAz6v3b3sUS6vlAX5r2huDFK5vjWh4pvphLyYzXxnc8nxjGLwqDVA==",
+      "version": "1.0.496",
+      "resolved": "https://registry.npmjs.org/codebuff/-/codebuff-1.0.496.tgz",
+      "integrity": "sha512-kFg8+kgZN7wReREMt89mXz5G78c5EZxiMtjjVb6bZD9JUIb8hYRg5AFPQ5RTFW4cMW21l7qO7HZy8Twvln8Nwg==",
       "cpu": [
         "x64",
         "arm64"
diff --git a/pkgs/by-name/co/codebuff/package.nix b/pkgs/by-name/co/codebuff/package.nix
index dd9662fcba01..015a2375d725 100644
--- a/pkgs/by-name/co/codebuff/package.nix
+++ b/pkgs/by-name/co/codebuff/package.nix
@@ -6,14 +6,14 @@
 
 buildNpmPackage rec {
   pname = "codebuff";
-  version = "1.0.485";
+  version = "1.0.496";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/codebuff/-/codebuff-${version}.tgz";
-    hash = "sha256-TeHIRz6FmpyAIVS58IgyJ0Y/Ob/crCFey4eTk3vDIHE=";
+    hash = "sha256-X/quHRF+DrGtbyDbthXENLXI9vKfjhp9WOn6FBgss4g=";
   };
 
-  npmDepsHash = "sha256-ZQdg464SXIwAhFgotIXO6xjpAdquOlKKPuejl6qS3xo=";
+  npmDepsHash = "sha256-ni7tCSyqXSyowVl1XzGkzoovaN3AawYvmW1cWdeHxgw=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/co/cosmic-ext-tweaks/package.nix b/pkgs/by-name/co/cosmic-ext-tweaks/package.nix
index c305b6a5e040..b2c2bfc71d1b 100644
--- a/pkgs/by-name/co/cosmic-ext-tweaks/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-tweaks/package.nix
@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cosmic-ext-tweaks";
-  version = "0.1.3";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "tweaks";
     tag = version;
-    hash = "sha256-SzD2TnPrCKsG3d+t1695GSC+HCqK88wlO42saGAZLS8=";
+    hash = "sha256-0P/KtfNUlS6E68aR3uLHJ2D4aMAdc05Svl6xSEG8XJA=";
   };
 
-  cargoHash = "sha256-LgrjrGusQ5HZJcAPsgV0hUgvcAZr8rlPyE3+z910+pI=";
+  cargoHash = "sha256-Zl7c/3q5J+9y1vRJdR77NJ6y62bV1bxaVMuiyxDbLX4=";
 
   nativeBuildInputs = [
     libcosmicAppHook
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index e32303ce5d03..5cc5a34e8202 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -34,14 +34,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.8.4";
+  version = "2025.9.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-L3CKfZGPEaMv9nmKX0S9qRXtZrfleQqgN3KHJjIEZew=";
+    hash = "sha256-9x4uf0gHCGYLq0gr0MoAp0sk9p82zdH41PaELph0fv0=";
   };
 
   patches = [
@@ -167,6 +167,14 @@ python.pkgs.buildPythonApplication rec {
 
   doInstallCheck = true;
 
+  disabledTests = [
+    # tries to import platformio, which is wrapped in an fhsenv
+    "test_clean_build"
+    "test_clean_build_empty_cache_dir"
+    # AssertionError: Expected 'run_external_command' to have been called once. Called 0 times.
+    "test_run_platformio_cli_sets_environment_variables"
+  ];
+
   versionCheckProgramArg = "--version";
 
   passthru = {
diff --git a/pkgs/by-name/fa/factorio/package.nix b/pkgs/by-name/fa/factorio/package.nix
index 378bba199366..b0d5072db3a8 100644
--- a/pkgs/by-name/fa/factorio/package.nix
+++ b/pkgs/by-name/fa/factorio/package.nix
@@ -150,7 +150,6 @@ let
                 else
                   ''
                     # Deliberately failing since username/token was not provided, so we can't fetch.
-                    # We can't use builtins.throw since we want the result to be used if the tar is in the store already.
                     exit 1
                   '';
               failureHook = ''
diff --git a/pkgs/by-name/fe/fetchit/package.nix b/pkgs/by-name/fe/fetchit/package.nix
index 752acf9cc877..44147910ae3f 100644
--- a/pkgs/by-name/fe/fetchit/package.nix
+++ b/pkgs/by-name/fe/fetchit/package.nix
@@ -8,15 +8,15 @@
   pkg-config,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "fetchit";
   version = "0.0.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "fetchit";
-    rev = "v${version}";
-    sha256 = "sha256-hxS/+/fbYOpMJ5VfvvG5l7wWKBUUR22rYn9X79DzUUk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hxS/+/fbYOpMJ5VfvvG5l7wWKBUUR22rYn9X79DzUUk=";
   };
 
   vendorHash = "sha256-SyPd8P9s8R2YbGEPqFeztF98W1QyGSBumtirSdpm8VI=";
@@ -66,7 +66,7 @@ buildGoModule rec {
     done
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Tool to manage the life cycle and configuration of Podman containers";
     mainProgram = "fetchit";
     longDescription = ''
@@ -79,9 +79,9 @@ buildGoModule rec {
       the containers running on the host.
     '';
     homepage = "https://fetchit.readthedocs.io";
-    changelog = "https://github.com/containers/fetchit/releases/tag/${src.rev}";
-    license = licenses.agpl3Plus;
+    changelog = "https://github.com/containers/fetchit/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ guylamar2006 ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index 64755caf4c1c..1e294851f6a1 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "14.17.0";
+  version = "14.18.0";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-qZMm3xW46XZG0l3ECKOSBb2vRwZrwLP2Cl3UXcH7OTY=";
+    hash = "sha256-1yTcMzyznr0b/ObVEECdJuBUi03aiTAwgcTdJ1QFcWY=";
   };
 
-  npmDepsHash = "sha256-3voUCvmBqi9Lfpol1lMDe4gTmF6TevLMmxBoDS03K0o=";
+  npmDepsHash = "sha256-VJquJ7mDBHeclgd/jsAPyRLEFOQp27tUXGAQJX3bXyQ=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/by-name/fx/fxload/package.nix b/pkgs/by-name/fx/fxload/package.nix
index ec4b890563ab..7065a161e835 100644
--- a/pkgs/by-name/fx/fxload/package.nix
+++ b/pkgs/by-name/fx/fxload/package.nix
@@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
     mainProgram = "fxload";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ realsnick ];
+    maintainers = with maintainers; [ logger ];
   };
 }
diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index f1f8615394d3..430ec212a9ca 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.80.0";
+  version = "2.81.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-3XrP3NuXYWT09Yfo3XJ6Z2SE5jkE+tvS9QrXiRy3ov8=";
+    hash = "sha256-uhmVIDTkMRFS1MZitjDjylrYWd/q9aGAZNiTjzmqwPw=";
   };
 
   vendorHash = "sha256-rVNKTr3b4zShPfkiEBx7LqVQY2eMrXo/s8iC5tyQZNo=";
diff --git a/pkgs/by-name/gi/github-mcp-server/package.nix b/pkgs/by-name/gi/github-mcp-server/package.nix
index a7ebe6bffa3e..d683c295dce8 100644
--- a/pkgs/by-name/gi/github-mcp-server/package.nix
+++ b/pkgs/by-name/gi/github-mcp-server/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "github-mcp-server";
-  version = "0.15.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "github-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D6oEnaHrGnFfuO6NXRYbJ665OlWcwHo+JLfCPrdDkE4=";
+    hash = "sha256-A9kl/XIo2WxckPxRItw6yswhqLENGkzky9EBWJXTetc=";
   };
 
-  vendorHash = "sha256-0QqgyjK3QID72aMI6l6ofXAUt94PYFqO8dWech7yaFw=";
+  vendorHash = "sha256-esd4Ly8cbN3z9fxC1j4wQqotV2ULqK3PDf1bEovewUY=";
 
   ldflags = [
     "-s"
@@ -41,6 +41,6 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/github/github-mcp-server";
     license = lib.licenses.mit;
     mainProgram = "github-mcp-server";
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ logger ];
   };
 })
diff --git a/pkgs/by-name/gi/github-mcp-server/update.sh b/pkgs/by-name/gi/github-mcp-server/update.sh
new file mode 100755
index 000000000000..7a21d6063f7b
--- /dev/null
+++ b/pkgs/by-name/gi/github-mcp-server/update.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts coreutils curl jq
+
+set -euo pipefail
+
+current_version="$(nix --extra-experimental-features nix-command eval -f . github-mcp-server.version --raw)"
+latest_version="$(curl -s -H "Accept: application/vnd.github.v3+json" \
+            ${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+            "https://api.github.com/repos/github/github-mcp-server/releases/latest" | jq -r ".tag_name")"
+latest_version="${latest_version#v}" # v0.17.1 -> 0.17.1
+
+if [[ "$latest_version" == "$current_version" ]]; then
+    echo "github-mcp-server is already up to date: $current_version"
+    exit 0
+fi
+
+echo "Updating github-mcp-server from $current_version to $latest_version"
+update-source-version github-mcp-server "$latest_version"
+
+echo "Updating Go modules hash..."
+$(nix-build -A github-mcp-server.goModules --no-out-link 2>/dev/null || true)
diff --git a/pkgs/by-name/gn/gnote/package.nix b/pkgs/by-name/gn/gnote/package.nix
index 676dfd47d15f..fe7eae9a508d 100644
--- a/pkgs/by-name/gn/gnote/package.nix
+++ b/pkgs/by-name/gn/gnote/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnote";
-  version = "48.1";
+  version = "48.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-5IUe5qW8L1wH0cb/TWm6BHHCTKp9ggS9KhCY3HGHvt8=";
+    hash = "sha256-PIFooZ3mWJ+56O4RmkRUISOUHB6XSK79NooCjmclx4E=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/gr/grimblast/package.nix b/pkgs/by-name/gr/grimblast/package.nix
index 8b67de42d3d2..4f2c9ea734b6 100644
--- a/pkgs/by-name/gr/grimblast/package.nix
+++ b/pkgs/by-name/gr/grimblast/package.nix
@@ -19,13 +19,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "grimblast";
-  version = "0.1-unstable-2025-09-22";
+  version = "0.1-unstable-2025-10-04";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "de79078fd59140067e53cd00ebdf17f96ce27846";
-    hash = "sha256-iRv5afKzuu6SkwztqMwZ33161CzBJsyeRHp0uviN9TI=";
+    rev = "32e1a75b65553daefb419f0906ce19e04815aa3a";
+    hash = "sha256-PzgQJydp+RlKvwDi807pXPlURdIAVqLppZDga3DwPqg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/gu/gui-for-clash/package.nix b/pkgs/by-name/gu/gui-for-clash/package.nix
index b0f709e86ed9..572f9208d6a9 100644
--- a/pkgs/by-name/gu/gui-for-clash/package.nix
+++ b/pkgs/by-name/gu/gui-for-clash/package.nix
@@ -16,13 +16,13 @@
 
 let
   pname = "gui-for-clash";
-  version = "1.9.10";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "GUI-for-Cores";
     repo = "GUI.for.Clash";
     tag = "v${version}";
-    hash = "sha256-odASuy0zaXf6vvd5CRVtuuVIX1EgEO7GsMgXWUR+fxk=";
+    hash = "sha256-kk6ZjG58gMIPd8f3Ib+1z7bie9X5kJvBq/CwioksbcU=";
   };
 
   metaCommon = {
@@ -50,7 +50,7 @@ let
         sourceRoot
         ;
       fetcherVersion = 2;
-      hash = "sha256-AuBUneWOR9oCuj811iCB3l5dlpeKhxt6KrF7KDs27a0=";
+      hash = "sha256-MvGLIB68itkCGsBIgAI6ak5xa5rFAJfoAwNuISPRw30=";
     };
 
     buildPhase = ''
@@ -86,7 +86,7 @@ buildGoModule {
       --subst-var out
   '';
 
-  vendorHash = "sha256-UArCB5U2bF5HXFDU1oCfm+SaURe6e9gyCx+UjtWI/ug=";
+  vendorHash = "sha256-6T9cFVzfRJnwnWjc61oSihifgnP81n3K+jlLHXGmA4I=";
 
   nativeBuildInputs = [
     autoPatchelfHook
diff --git a/pkgs/development/tools/profiling/heaptrack/default.nix b/pkgs/by-name/he/heaptrack/package.nix
similarity index 87%
rename from pkgs/development/tools/profiling/heaptrack/default.nix
rename to pkgs/by-name/he/heaptrack/package.nix
index e5f6e15696d0..a663250988f0 100644
--- a/pkgs/development/tools/profiling/heaptrack/default.nix
+++ b/pkgs/by-name/he/heaptrack/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitLab,
   cmake,
-  extra-cmake-modules,
   makeBinaryWrapper,
   zlib,
   boost,
@@ -11,14 +10,7 @@
   elfutils,
   sparsehash,
   zstd,
-  qtbase,
-  wrapQtAppsHook,
-  kio,
-  kitemmodels,
-  threadweaver,
-  kconfigwidgets,
-  kcoreaddons,
-  kdiagram,
+  kdePackages,
 }:
 
 stdenv.mkDerivation {
@@ -35,9 +27,9 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
-    extra-cmake-modules
+    kdePackages.extra-cmake-modules
     makeBinaryWrapper
-    wrapQtAppsHook
+    kdePackages.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -46,6 +38,8 @@ stdenv.mkDerivation {
     libunwind
     sparsehash
     zstd
+  ]
+  ++ (with kdePackages; [
     qtbase
     kio
     kitemmodels
@@ -53,7 +47,8 @@ stdenv.mkDerivation {
     kconfigwidgets
     kcoreaddons
     kdiagram
-  ]
+  ])
+
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     elfutils
   ];
diff --git a/pkgs/by-name/hy/hyprland-protocols/package.nix b/pkgs/by-name/hy/hyprland-protocols/package.nix
index 2188039d3776..fc3a02b1ae53 100644
--- a/pkgs/by-name/hy/hyprland-protocols/package.nix
+++ b/pkgs/by-name/hy/hyprland-protocols/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland-protocols";
-  version = "0.6.4";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprland-protocols";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yt8F7NhMFCFHUHy/lNjH/pjZyIDFNk52Q4tivQ31WFo=";
+    hash = "sha256-+KEVnKBe8wz+a6dTLq8YDcF3UrhQElwsYJaVaHXJtoI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hyprsunset/package.nix b/pkgs/by-name/hy/hyprsunset/package.nix
index 006ef474ff48..ad8280ba2bb0 100644
--- a/pkgs/by-name/hy/hyprsunset/package.nix
+++ b/pkgs/by-name/hy/hyprsunset/package.nix
@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprsunset";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprsunset";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eYLtZJayWWbKBC3u/gvDSqVyffuD+egryr7zPWRAeyY=";
+    hash = "sha256-Yk6nDzCXrOehX3At8qdZ0cLr1kPySqACsihMYuP6T8w=";
   };
 
   postPatch = ''
@@ -56,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux;
     teams = [ lib.teams.hyprland ];
+    maintainers = with lib.maintainers; [ logger ];
     mainProgram = "hyprsunset";
   };
 })
diff --git a/pkgs/by-name/is/isd/package.nix b/pkgs/by-name/is/isd/package.nix
index b35865645939..4ff00480569a 100644
--- a/pkgs/by-name/is/isd/package.nix
+++ b/pkgs/by-name/is/isd/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "isd";
-  version = "0.5.1";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "isd-project";
+    owner = "kainctl";
     repo = "isd";
     tag = "v${version}";
-    hash = "sha256-z9lyPSiuUAwu5bmZlcHj5SV3mHtP+GXtuEeJzOr1c9A=";
+    hash = "sha256-0RBalvqa2EM7FsgR4CamqkbKrD5QCrz9stk4ijqZi1Q=";
   };
 
   build-system = with python3Packages; [
@@ -51,8 +51,8 @@ python3Packages.buildPythonApplication rec {
       units, auto-refreshing previews, smart `sudo` handling, and a fully
       customizable interface for power-users and newcomers alike.
     '';
-    homepage = "https://github.com/isd-project/isd";
-    changelog = "https://github.com/isd-project/isd/releases/tag/v${version}";
+    homepage = "https://github.com/kainctl/isd";
+    changelog = "https://github.com/kainctl/isd/releases/tag/v${version}";
     license = lib.licenses.gpl3Only;
     mainProgram = "isd";
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/jp/jp-zip-codes/package.nix b/pkgs/by-name/jp/jp-zip-codes/package.nix
index 578b2f74b6ce..a5dfb23eded3 100644
--- a/pkgs/by-name/jp/jp-zip-codes/package.nix
+++ b/pkgs/by-name/jp/jp-zip-codes/package.nix
@@ -7,15 +7,15 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jp-zip-code";
-  version = "0-unstable-2025-09-01";
+  version = "0-unstable-2025-10-01";
 
   # This package uses a mirror as the source because the
   # original provider uses the same URL for updated content.
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jp-zip-codes";
-    rev = "87a760cee8a6b103d834197caca72c3392ccbcde";
-    hash = "sha256-7vOcScEk4fKIeUa+FGCnBczlAwUC00E7EKQq7wQ2bUI=";
+    rev = "9464f58fe654ada94f6f53e5338b5fb2b15e314a";
+    hash = "sha256-G+uCQPW2e/DEAvAx3TYvPt0Dl2rM77WUmuPJ17voxUE=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/filesystems/kdiskmark/default.nix b/pkgs/by-name/kd/kdiskmark/package.nix
similarity index 91%
rename from pkgs/tools/filesystems/kdiskmark/default.nix
rename to pkgs/by-name/kd/kdiskmark/package.nix
index c401567ed9b4..70aab77d7243 100644
--- a/pkgs/tools/filesystems/kdiskmark/default.nix
+++ b/pkgs/by-name/kd/kdiskmark/package.nix
@@ -1,14 +1,10 @@
 {
   stdenv,
   lib,
-  wrapQtAppsHook,
-  qtbase,
-  qttools,
   fio,
   cmake,
-  polkit-qt-1,
-  extra-cmake-modules,
   fetchFromGitHub,
+  kdePackages,
 }:
 stdenv.mkDerivation rec {
   pname = "kdiskmark";
@@ -22,13 +18,13 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with kdePackages; [
     cmake
     extra-cmake-modules
     wrapQtAppsHook
   ];
 
-  buildInputs = [
+  buildInputs = with kdePackages; [
     qtbase
     qttools
     polkit-qt-1
diff --git a/pkgs/applications/networking/ktailctl/default.nix b/pkgs/by-name/kt/ktailctl/package.nix
similarity index 83%
rename from pkgs/applications/networking/ktailctl/default.nix
rename to pkgs/by-name/kt/ktailctl/package.nix
index aa3c56234b22..26207bd9d4de 100644
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/by-name/kt/ktailctl/package.nix
@@ -1,28 +1,13 @@
 {
   buildGo124Module,
   cmake,
-  extra-cmake-modules,
   fetchFromGitHub,
   git,
   go_1_24,
-  kconfig,
-  kcoreaddons,
-  kdbusaddons,
-  kguiaddons,
-  ki18n,
-  kirigami,
-  kirigami-addons,
-  knotifications,
-  kwindowsystem,
   lib,
   nlohmann_json,
-  qqc2-desktop-style,
-  qtbase,
-  qtdeclarative,
-  qtsvg,
-  qtwayland,
   stdenv,
-  wrapQtAppsHook,
+  kdePackages,
 }:
 
 let
@@ -61,7 +46,7 @@ stdenv.mkDerivation {
     "-DKTAILCTL_FLATPAK_BUILD=ON"
   ];
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with kdePackages; [
     cmake
     extra-cmake-modules
     git
@@ -69,7 +54,7 @@ stdenv.mkDerivation {
     wrapQtAppsHook
   ];
 
-  buildInputs = [
+  buildInputs = with kdePackages; [
     kconfig
     kcoreaddons
     kdbusaddons
diff --git a/pkgs/by-name/ku/kubetail/package.nix b/pkgs/by-name/ku/kubetail/package.nix
index dd34d5042548..9c3d723e0f3d 100644
--- a/pkgs/by-name/ku/kubetail/package.nix
+++ b/pkgs/by-name/ku/kubetail/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kubetail";
-  version = "1.6.20";
+  version = "1.6.21";
 
   src = fetchFromGitHub {
     owner = "johanhaleby";
     repo = "kubetail";
     rev = version;
-    sha256 = "sha256-RbbZHKXRtbs42cCbw+xb8TLul6ebUeCiNclMFF39c3M=";
+    sha256 = "sha256-Uzr63TkveJqfZl4USo0MNdlcvofxDp+o+reZmJG5F78=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/le/lefthook/package.nix b/pkgs/by-name/le/lefthook/package.nix
index c10002352e91..2b0ea65a9890 100644
--- a/pkgs/by-name/le/lefthook/package.nix
+++ b/pkgs/by-name/le/lefthook/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "lefthook";
-  version = "1.13.0";
+  version = "1.13.4";
 in
 buildGoModule {
   inherit pname version;
@@ -17,10 +17,10 @@ buildGoModule {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-K7qTf5wTBhOZpYMfCs+G+EeAXClYw37H2L1tAfcVeAE=";
+    hash = "sha256-/ZZ+eFHKQoqOzUNpTZ1Ef2A0EQbgT+CWau/q9hhuTHU=";
   };
 
-  vendorHash = "sha256-n+5tIEI/s32w8oWws6loFrtc8CSb2d368uqKZRkVuJs=";
+  vendorHash = "sha256-HQ6xpHYAOkT48UvOIf0g49jp5dt/4zuwmy8r/9KAZUk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/li/libdrm/package.nix b/pkgs/by-name/li/libdrm/package.nix
index ccd9f305f564..4d8e32919968 100644
--- a/pkgs/by-name/li/libdrm/package.nix
+++ b/pkgs/by-name/li/libdrm/package.nix
@@ -9,7 +9,7 @@
   libpthreadstubs,
   withIntel ? lib.meta.availableOn stdenv.hostPlatform libpciaccess,
   libpciaccess,
-  withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light,
+  withValgrind ? lib.meta.availableOn stdenv.hostPlatform valgrind-light && !stdenv.cc.isClang,
   valgrind-light,
   gitUpdater,
 }:
diff --git a/pkgs/by-name/li/libusb1/package.nix b/pkgs/by-name/li/libusb1/package.nix
index a33be3c214a1..168c970b7bf2 100644
--- a/pkgs/by-name/li/libusb1/package.nix
+++ b/pkgs/by-name/li/libusb1/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [
       prusnak
-      realsnick
+      logger
     ];
   };
 }
diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
index aaebc4150064..3b2d6985a6cf 100644
--- a/pkgs/by-name/ma/mailpit/source.nix
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.27.8";
-  hash = "sha256-aGrwcwzNYXW2qJsS4j8nHsKt+fCgjQBpfp97hPMVw6Y=";
-  npmDepsHash = "sha256-+oCX8XM3+ZZkwasOkiQbh4nV2c0Iv2eoctt3u8huiKE=";
-  vendorHash = "sha256-zFYNl8V1Xkqgpyn1e1IL/LHs3eVelKzhAWEWtQHNxJ8=";
+  version = "1.27.9";
+  hash = "sha256-COPNi7AoHYyY8pfTSJYKxUG2Mh08czBjiD0VzLu0V6I=";
+  npmDepsHash = "sha256-QEjfCHqE8r41fgylNRY5Gk0tYQSYuFxHrHT6/7vtLxg=";
+  vendorHash = "sha256-Nmupbw8ouxsc7/CEAWz4Cj0cyEMP4WFPZ+P5ornf1AI=";
 }
diff --git a/pkgs/by-name/me/meilisearch/package.nix b/pkgs/by-name/me/meilisearch/package.nix
index 74646e91f6fb..fdedcfed7937 100644
--- a/pkgs/by-name/me/meilisearch/package.nix
+++ b/pkgs/by-name/me/meilisearch/package.nix
@@ -4,39 +4,22 @@
   fetchFromGitHub,
   nixosTests,
   nix-update-script,
-  version ? "1.22.1",
 }:
 
-let
-  # Version 1.11 is kept here as it was the last version not to support dumpless
-  # upgrades, meaning NixOS systems that have set up their data before 25.05
-  # would not be able to update to 1.12+ without manual data migration.
-  # We're planning to remove it towards NixOS 25.11. Make sure to update
-  # the meilisearch module accordingly and to remove the meilisearch_1_11
-  # attribute from all-packages.nix at that point too.
-  hashes = {
-    "1.22.1" = "sha256-RWHu77/GoSMzRU7KyKmu23DFwWn6RD3MUWUc5ICY1d8=";
-    "1.11.3" = "sha256-CVofke9tOGeDEhRHEt6EYwT52eeAYNqlEd9zPpmXQ2U=";
-  };
-  cargoHashes = {
-    "1.22.1" = "sha256-xKBYumdb1vJS+UQF3yD/p+7FvWRfBKbLjOFiT7DVJ+o=";
-    "1.11.3" = "sha256-cEJTokDJQuc9Le5+3ObMDNJmEhWEb+Qh0TV9xZkD9D8=";
-  };
-in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  inherit version;
+  version = "1.22.1";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meiliSearch";
-    tag = "v${version}";
-    hash = hashes.${version};
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RWHu77/GoSMzRU7KyKmu23DFwWn6RD3MUWUc5ICY1d8=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = cargoHashes.${version};
+  cargoHash = "sha256-xKBYumdb1vJS+UQF3yD/p+7FvWRfBKbLjOFiT7DVJ+o=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;
@@ -57,7 +40,7 @@ rustPlatform.buildRustPackage {
     description = "Powerful, fast, and an easy to use search engine";
     mainProgram = "meilisearch";
     homepage = "https://docs.meilisearch.com/";
-    changelog = "https://github.com/meilisearch/meilisearch/releases/tag/v${version}";
+    changelog = "https://github.com/meilisearch/meilisearch/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       happysalada
@@ -70,4 +53,4 @@ rustPlatform.buildRustPackage {
       "x86_64-darwin"
     ];
   };
-}
+})
diff --git a/pkgs/by-name/mi/miriway/package.nix b/pkgs/by-name/mi/miriway/package.nix
index e69baf2f50a3..88e592debefb 100644
--- a/pkgs/by-name/mi/miriway/package.nix
+++ b/pkgs/by-name/mi/miriway/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miriway";
-  version = "25.10";
+  version = "25.11";
 
   src = fetchFromGitHub {
     owner = "Miriway";
     repo = "Miriway";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VAYnIMspGKSeqg+9YG6WrmoeaNNg0uLE3Ht4jJZSLLk=";
+    hash = "sha256-tXxRKGP/MMXOD1QtOYj5E9IurLoUUu1JBg8+l5z0KCQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/mk/mkbrr/package.nix b/pkgs/by-name/mk/mkbrr/package.nix
index 0d0437ee932b..381951185f1f 100644
--- a/pkgs/by-name/mk/mkbrr/package.nix
+++ b/pkgs/by-name/mk/mkbrr/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mkbrr";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "mkbrr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7p/p5WAJpaIhvJRTXYWoTOyuqN41X187tAnkVY1XCMY=";
+    hash = "sha256-9BII74aH480UWjrPgoBn+ioXV3TRhtVmxyO+T+fljK4=";
   };
 
   vendorHash = "sha256-MEDzZd67iXPY/MioMd1FcTLY+8CdJN7+oC7qus63yJ8=";
diff --git a/pkgs/by-name/mo/monado/package.nix b/pkgs/by-name/mo/monado/package.nix
index 466e0de71535..34feeb6da8ea 100644
--- a/pkgs/by-name/mo/monado/package.nix
+++ b/pkgs/by-name/mo/monado/package.nix
@@ -41,7 +41,6 @@
   orc,
   pcre2,
   pkg-config,
-  protobuf_21,
   python3,
   SDL2,
   shaderc,
@@ -64,14 +63,7 @@
   serviceSupport ? true,
   tracingSupport ? false,
 }:
-let
-  # For some reason protobuf 32 causes a segfault during startup
-  # Pin to last (known) working version
-  # See https://github.com/NixOS/nixpkgs/issues/439075
-  opencv4' = opencv4.override {
-    protobuf = protobuf_21;
-  };
-in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "monado";
   version = "25.0.0";
@@ -133,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
     libXext
     libXrandr
     onnxruntime
-    opencv4'
+    opencv4
     openhmd
     openvr
     orc
diff --git a/pkgs/by-name/nd/ndi/package.nix b/pkgs/by-name/nd/ndi/package.nix
index 316a1583ee89..d04a95769779 100644
--- a/pkgs/by-name/nd/ndi/package.nix
+++ b/pkgs/by-name/nd/ndi/package.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
   dontStrip = true;
 
   passthru.tests = {
-    inherit (obs-studio-plugins) obs-ndi;
+    inherit (obs-studio-plugins) distroav;
   };
   passthru.updateScript = ./update.py;
 
diff --git a/pkgs/applications/misc/omegat.nix b/pkgs/by-name/om/omegat/package.nix
similarity index 100%
rename from pkgs/applications/misc/omegat.nix
rename to pkgs/by-name/om/omegat/package.nix
diff --git a/pkgs/by-name/pr/prometheus-nvidia-gpu-exporter/package.nix b/pkgs/by-name/pr/prometheus-nvidia-gpu-exporter/package.nix
index 0a0bf6c21fdc..f2662ae5133c 100644
--- a/pkgs/by-name/pr/prometheus-nvidia-gpu-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-nvidia-gpu-exporter/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "prometheus-nvidia-gpu-exporter";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "utkuozdemir";
     repo = "nvidia_gpu_exporter";
     rev = "v${version}";
-    hash = "sha256-d5/sWgfb4rGfHHeHOunHkm61F6o9L/z0MLh7iRABEYg=";
+    hash = "sha256-yaMyvI70BEn23heAkvJ8wU08CJp+wMzRnwt4py6sZhs=";
   };
 
-  vendorHash = "sha256-kzjaMLPZrjgdeNSLapp3t+b8Y++Q8Cqj1hkU+GVGm88=";
+  vendorHash = "sha256-A9CY14pdZLgm5eCWYlWmn3H7VPM4yxramv6pi2ER64I=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-scala/package.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-scala/package.nix
index 37c0cdf79c8a..e259137199a8 100644
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-scala/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-scala/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "pulumi-scala";
-  version = "0.3.2";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "VirtusLab";
     repo = "besom";
     tag = "v${version}";
-    hash = "sha256-ZOWC8S4OP2URfrzeegMmrJ9yC5xwCuC1cdEtBEsaCdk=";
+    hash = "sha256-iJLIwc8yVURz7YdL42hJBfvYNpaehJbPIAB51umsLEE=";
   };
 
   sourceRoot = "source/language-plugin/pulumi-language-scala";
diff --git a/pkgs/by-name/re/redis/package.nix b/pkgs/by-name/re/redis/package.nix
index abc1811cc8ee..48eccfc821eb 100644
--- a/pkgs/by-name/re/redis/package.nix
+++ b/pkgs/by-name/re/redis/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "8.0.3";
+  version = "8.2.2";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis";
     tag = finalAttrs.version;
-    hash = "sha256-e6pPsPz0huZyn14XO3uFUmJhBpMxhWLfyD0VBQXsJ1s=";
+    hash = "sha256-0TMUSNCrDEtOkojcmFFhmLQ0ghyLAn+OS4xl4Sbr76c=";
   };
 
   patches = lib.optional useSystemJemalloc (fetchpatch2 {
@@ -106,7 +106,9 @@ stdenv.mkDerivation (finalAttrs: {
       --tags -leaks \
       --skipunit integration/aof-multi-part \
       --skipunit integration/failover \
-      --skipunit integration/replication-rdbchannel
+      --skipunit integration/replication-rdbchannel \
+      --skiptest "Check MEMORY USAGE for embedded key strings with jemalloc"
+      # ^ breaks due to unexpected and varying address space sizes that jemalloc gets built with
 
     runHook postCheck
   '';
diff --git a/pkgs/development/libraries/java/rhino/deps.json b/pkgs/by-name/rh/rhino/deps.json
similarity index 100%
rename from pkgs/development/libraries/java/rhino/deps.json
rename to pkgs/by-name/rh/rhino/deps.json
diff --git a/pkgs/development/libraries/java/rhino/default.nix b/pkgs/by-name/rh/rhino/package.nix
similarity index 100%
rename from pkgs/development/libraries/java/rhino/default.nix
rename to pkgs/by-name/rh/rhino/package.nix
diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index 16861c468554..c6b69dc98503 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -159,6 +159,7 @@ rustPlatform.buildRustPackage {
   };
 
   meta = {
+    broken = true; # cargo fetcher leaves invalid Cargo.toml around, which breaks mozjs-sys build
     description = "Embeddable, independent, memory-safe, modular, parallel web rendering engine";
     homepage = "https://servo.org";
     license = lib.licenses.mpl20;
diff --git a/pkgs/by-name/si/simdjson/package.nix b/pkgs/by-name/si/simdjson/package.nix
index e1b62c5ae255..d4ee91794e25 100644
--- a/pkgs/by-name/si/simdjson/package.nix
+++ b/pkgs/by-name/si/simdjson/package.nix
@@ -5,36 +5,34 @@
   cmake,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "simdjson";
-  version = "4.0.6";
+  version = "4.0.7";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
-    rev = "v${version}";
-    sha256 = "sha256-e3W5p4MUv0sE7JazWFJ3mCqo2D/A3jVHhNedSOURMv8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8pmFtMpML7tTXbH1E3aIpSTQkNF8TFcIPOm2nwnKxkA=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    "-DSIMDJSON_DEVELOPER_MODE=OFF"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isStatic [
-    "-DBUILD_SHARED_LIBS=OFF"
+    (lib.cmakeBool "SIMDJSON_DEVELOPER_MODE" false)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
   ]
   ++ lib.optionals (with stdenv.hostPlatform; isPower && isBigEndian) [
     # Assume required CPU features are available, since otherwise we
     # just get a failed build.
-    "-DCMAKE_CXX_FLAGS=-mpower8-vector"
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-mpower8-vector")
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://simdjson.org/";
     description = "Parsing gigabytes of JSON per second";
-    license = licenses.asl20;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ chessai ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ chessai ];
   };
-}
+})
diff --git a/pkgs/applications/office/skrooge/default.nix b/pkgs/by-name/sk/skrooge/package.nix
similarity index 80%
rename from pkgs/applications/office/skrooge/default.nix
rename to pkgs/by-name/sk/skrooge/package.nix
index 884f2ff7bc77..6bd4487b1531 100644
--- a/pkgs/applications/office/skrooge/default.nix
+++ b/pkgs/by-name/sk/skrooge/package.nix
@@ -3,30 +3,12 @@
   lib,
   fetchurl,
   cmake,
-  extra-cmake-modules,
   pkg-config,
-  qtbase,
-  wrapQtAppsHook,
-  qtwebengine,
   grantlee,
-  kxmlgui,
-  kwallet,
-  kparts,
-  kdoctools,
-  kjobwidgets,
-  kiconthemes,
-  knewstuff,
   sqlcipher,
-  qca,
-  plasma-activities,
-  karchive,
-  kguiaddons,
-  knotifyconfig,
-  krunner,
-  ktexttemplate,
-  kwindowsystem,
   libofx,
   shared-mime-info,
+  kdePackages,
 }:
 
 stdenv.mkDerivation rec {
@@ -38,7 +20,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-HNui/SjCN9LWxUxHDae59n5qPIwYWHX1uFSlVnwBlL8=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with kdePackages; [
     cmake
     extra-cmake-modules
     kdoctools
@@ -47,7 +29,7 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
   ];
 
-  buildInputs = [
+  buildInputs = with kdePackages; [
     qtbase
     qtwebengine
     grantlee
diff --git a/pkgs/by-name/sp/sparkle/package.nix b/pkgs/by-name/sp/sparkle/package.nix
index 991b035763a6..693866b47cd0 100644
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sparkle";
-  version = "1.6.11";
+  version = "1.6.12";
 
   src =
     let
@@ -40,8 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/xishang0128/sparkle/releases/download/${finalAttrs.version}/sparkle-linux-${finalAttrs.version}-${arch}.deb";
       hash = selectSystem {
-        x86_64-linux = "sha256-AB+W0JC3NyT8oYHNShr6TtiUk8XBq+QW5yxhlSSL6DE=";
-        aarch64-linux = "sha256-uFVzO+ce3+QvZZT0xnppixLmWuy19fGP28+0vVBnZq0=";
+        x86_64-linux = "sha256-jExqA15faSvkjXMAvKMwDwsdBjijG3hOyf0j1J7jH/A=";
+        aarch64-linux = "sha256-1hZa5Dr+Fh9vc+066TNcvgH44Lgx5sebvMKSO+bh9B4=";
       };
     };
 
diff --git a/pkgs/by-name/sp/spectrwm/package.nix b/pkgs/by-name/sp/spectrwm/package.nix
index 88129f8bb349..97e930bf1fc0 100644
--- a/pkgs/by-name/sp/spectrwm/package.nix
+++ b/pkgs/by-name/sp/spectrwm/package.nix
@@ -11,17 +11,21 @@
   xcbutil,
   xcbutilkeysyms,
   xcbutilwm,
+  writeShellScript,
+  curl,
+  jq,
+  nix-update,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spectrwm";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "conformal";
     repo = "spectrwm";
     tag = "SPECTRWM_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-Dnn/iIrceiAVuMR8iMGcc7LqNhWC496eT5gNrYOInRU=";
+    hash = "sha256-wuBF+gCoqg5xIcb42rygS+lglghWqoNe0uAzyhe76eI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -40,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
+  passthru.updateScript = writeShellScript "update-spectrwm" ''
+    latestVersion=$(${lib.getExe curl} ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location https://api.github.com/repos/conformal/spectrwm/releases/latest | ${lib.getExe jq} --raw-output .tag_name | grep -oP '\d+' | paste -sd.)
+    ${lib.getExe nix-update} spectrwm --version=$latestVersion
+  '';
+
   meta = {
     description = "Tiling window manager";
     homepage = "https://github.com/conformal/spectrwm";
diff --git a/pkgs/by-name/sp/spice-vdagent/package.nix b/pkgs/by-name/sp/spice-vdagent/package.nix
index c8fc1a520f55..20d3503f23ab 100644
--- a/pkgs/by-name/sp/spice-vdagent/package.nix
+++ b/pkgs/by-name/sp/spice-vdagent/package.nix
@@ -17,10 +17,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "spice-vdagent";
-  version = "0.22.1";
+  version = "0.23.0";
   src = fetchurl {
     url = "https://www.spice-space.org/download/releases/${pname}-${version}.tar.bz2";
-    hash = "sha256-k7DRWspHYsx9N5sXmnEBFJ267WK3IRL/+ys+kLEWh6A=";
+    hash = "sha256-Y+D5vVWXxGOKz9bxDXojVPWZvZ31sx5EMnDKzwfhakA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/sx/sxhkd/package.nix b/pkgs/by-name/sx/sxhkd/package.nix
index f2093f835c13..531eca8d0018 100644
--- a/pkgs/by-name/sx/sxhkd/package.nix
+++ b/pkgs/by-name/sx/sxhkd/package.nix
@@ -8,28 +8,20 @@
   xcbutil,
   xcbutilkeysyms,
   xcbutilwm,
+  nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sxhkd";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "baskerville";
     repo = "sxhkd";
     rev = finalAttrs.version;
-    hash = "sha256-OelMqenk0tiWMLraekS/ggGf6IsXP7Sz7bv75NvnNvI=";
+    hash = "sha256-kbjbTzYL2dz/RpG+SgBYy+XS3W9PBEWkg6ocqAFG3VQ=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Fixes an issue with overlapping chords when using multiple keyboard layouts.
-      name = "sxhkd-mod5.patch";
-      url = "https://github.com/baskerville/sxhkd/pull/307/commits/35e64f1d7b54c97ccc02e84e278012dae9bc3941.patch";
-      hash = "sha256-bvXWEEITbHC/h0nXQx99SXjvkI/KO36XXNSa1O8KSY0=";
-    })
-  ];
-
   outputs = [
     "out"
     "doc"
@@ -51,6 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  passthru.tests = {
+    inherit (nixosTests) startx;
+  };
+
   meta = {
     description = "Simple X hotkey daemon";
     homepage = "https://github.com/baskerville/sxhkd";
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index 11672f311e36..8791ec8783c7 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.5.9";
+  version = "2.5.10";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-gbkTQFj2PJw381ISrdxm0BwzO+Zzkh4qDIU31KbWM1Q=";
+    hash = "sha256-AUvsH1ul+pkWQq2GKJTjsds7IPLQoDhWBcu4LN0HRg0=";
   };
 
-  npmDepsHash = "sha256-8YzWf62VAzZggbBSMUp2NlUVHN8SAzWVUEeVNPctvik=";
+  npmDepsHash = "sha256-zicJ9orYgnusTHrMX5rSrnsXA1ENjZZJKXvkqn8XLC4=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/te/television/package.nix b/pkgs/by-name/te/television/package.nix
index 09297ef0c35c..ee92352468e8 100644
--- a/pkgs/by-name/te/television/package.nix
+++ b/pkgs/by-name/te/television/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "television";
-  version = "0.13.4";
+  version = "0.13.5";
 
   src = fetchFromGitHub {
     owner = "alexpasmantier";
     repo = "television";
     tag = finalAttrs.version;
-    hash = "sha256-LImipNu1uK1jcxU18Cw3BayHig2AS37PMGOOO8cJoE4=";
+    hash = "sha256-IlFOYnZ9xPQaRheielKqAckyVlSVQMhnO4wCtVixlNQ=";
   };
 
-  cargoHash = "sha256-c/IYFf9gc3udzy5LPnyPPF0xuzT4vd2BGcLz0Xan2Do=";
+  cargoHash = "sha256-QKUspbC1bmSeZP0n/O5roEqQkrja+fVKLhAvgzqNS9E=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/tu/tuxtype/package.nix b/pkgs/by-name/tu/tuxtype/package.nix
index b16b77d8d6f7..b1edbe82bcce 100644
--- a/pkgs/by-name/tu/tuxtype/package.nix
+++ b/pkgs/by-name/tu/tuxtype/package.nix
@@ -32,14 +32,14 @@ stdenv.mkDerivation rec {
     patchShebangs data/themes/hungarian/scripts/sed-linux.sh
 
     substituteInPlace Makefile.am \
-      --replace "\$(MKDIR_P) -m 2755 " "\$(MKDIR_P) -m 755 " \
-      --replace "chown root:games \$(DESTDIR)\$(pkglocalstatedir)/words" " "
+      --replace-fail "\$(MKDIR_P) -m 2755 " "\$(MKDIR_P) -m 755 " \
+      --replace-fail "chown root:games \$(DESTDIR)\$(pkglocalstatedir)/words" " "
 
     # required until the following has been merged:
     # https://salsa.debian.org/tux4kids-pkg-team/tuxtype/merge_requests/1
     substituteInPlace configure.ac \
-      --replace 'CFLAGS="$CFLAGS $SDL_IMAGE"' 'CFLAGS="$CFLAGS $SDL_IMAGE_CFLAGS"' \
-      --replace 'PKG_CHECK_MODULES([SDL_ttf],' 'PKG_CHECK_MODULES([SDL_TTF],'
+      --replace-fail 'CFLAGS="$CFLAGS $SDL_IMAGE"' 'CFLAGS="$CFLAGS $SDL_IMAGE_CFLAGS"' \
+      --replace-fail 'PKG_CHECK_MODULES([SDL_ttf],' 'PKG_CHECK_MODULES([SDL_TTF],'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 756a1136ebaf..c1bbadbaa895 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -66,7 +66,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.6.3797.55";
+  version = "7.6.3797.58";
 
   suffix =
     {
@@ -79,8 +79,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-eznFA+ljcNCxUCtlXBxaV73Hnum4j6x7LWBV55fft2E=";
-        x86_64-linux = "sha256-lP3dQvSYGuMOEdvnulIr6D6CEXJ+2ciUSohMZFUjPys=";
+        aarch64-linux = "sha256-oTJJqyMiNY7IetW8Hoh42VKW0CJGXsk6nWTV9KdF9DE=";
+        x86_64-linux = "sha256-01uehYMyDSvCNPM73BOc8EPiyCk0OEUhbGMoyrLoGkg=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/wa/warp-terminal/package.nix b/pkgs/by-name/wa/warp-terminal/package.nix
index f8a2df07dd17..2b6f63153651 100644
--- a/pkgs/by-name/wa/warp-terminal/package.nix
+++ b/pkgs/by-name/wa/warp-terminal/package.nix
@@ -123,6 +123,7 @@ let
       imadnyc
       FlameFlag
       johnrtitor
+      logger
     ];
     platforms = platforms.darwin ++ [
       "x86_64-linux"
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index ca9fbc62b2f2..9446a4254825 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,14 +1,14 @@
 {
   "darwin": {
-    "hash": "sha256-5lSv9/RLHVu9rusUO2MEGDKCEjteNNOiOfhk9f35a78=",
-    "version": "0.2025.09.24.08.11.stable_01"
+    "hash": "sha256-H8XaO1HKN8L4yKuLd75mMIBm1TWe1guJPOkmg62YLKo=",
+    "version": "0.2025.10.01.08.12.stable_02"
   },
   "linux_x86_64": {
-    "hash": "sha256-Ho8xOs9hke5jiM0y4QVsaE9pUfbEc6rjbipxtGRp6Ec=",
-    "version": "0.2025.09.24.08.11.stable_01"
+    "hash": "sha256-19QnAg/ZQuPTEzkCaPb9FdBDnZ3tC06ppfoxr+O4q58=",
+    "version": "0.2025.10.01.08.12.stable_02"
   },
   "linux_aarch64": {
-    "hash": "sha256-rdCKoIf6CFltrkaCfGu1X644mhtPC9Z2u+w4msj6Jr4=",
-    "version": "0.2025.09.24.08.11.stable_01"
+    "hash": "sha256-aw+8SVk6Vp9vFKuf5YRZ4Y0mAn69oXhLffzztRAc9XM=",
+    "version": "0.2025.10.01.08.12.stable_02"
   }
 }
diff --git a/pkgs/data/themes/whitesur-kde/default.nix b/pkgs/by-name/wh/whitesur-kde/package.nix
similarity index 100%
rename from pkgs/data/themes/whitesur-kde/default.nix
rename to pkgs/by-name/wh/whitesur-kde/package.nix
diff --git a/pkgs/by-name/xd/xdp-tools/package.nix b/pkgs/by-name/xd/xdp-tools/package.nix
index 18f5a58c49b9..46a5e67fed96 100644
--- a/pkgs/by-name/xd/xdp-tools/package.nix
+++ b/pkgs/by-name/xd/xdp-tools/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "xdp-tools";
-  version = "1.5.6";
+  version = "1.5.7";
 
   src = fetchFromGitHub {
     owner = "xdp-project";
     repo = "xdp-tools";
     rev = "v${version}";
-    hash = "sha256-ztIatDNp0RXUpNsSoNWGj/kHNsCOlI6mqZvaQdlGbtQ=";
+    hash = "sha256-dJMGBFFfEpKO+5ku5Xsc95hGSmTenHGRjBTL7s1cv0c=";
   };
 
   outputs = [
diff --git a/pkgs/desktops/lomiri/data/lomiri-schemas/default.nix b/pkgs/desktops/lomiri/data/lomiri-schemas/default.nix
index 966bbe3df349..90f2cd1dd65a 100644
--- a/pkgs/desktops/lomiri/data/lomiri-schemas/default.nix
+++ b/pkgs/desktops/lomiri/data/lomiri-schemas/default.nix
@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "lomiri-schemas";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-schemas";
     tag = finalAttrs.version;
-    hash = "sha256-Xm21KM+IxKQwOlBsmGTgFq2bUJy/WTBBcf/2Cqkdlos=";
+    hash = "sha256-qdkKQpKIad7bEMaN6q79byVTipuvUFSdCZQKdMtOERo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
index fd296dd49790..410f85c6184b 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@@ -34,15 +34,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-greeter";
-  # To allow overriding last-session-type.
-  # nixpkgs-update: no auto update
-  version = "8.0.1-unstable-2025-09-14";
+  version = "8.1.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "greeter";
-    rev = "2461ad1be4a4d0e541879abe869cf8911f505215";
-    hash = "sha256-rDlaL2KCm0tz73cwHLgNAD7Ddbn1QFJVa+Syh5eTfWo=";
+    tag = version;
+    hash = "sha256-lOk5H1uuaf2Q+z+hRLyhtKAHq+3ibtBzWI7r87KpKgQ=";
   };
 
   patches = [
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 2c2b3b597991..e75fb0b193c0 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -87,6 +87,10 @@ let
       pythonOnBuildForTarget = pkgsBuildTarget.${pythonAttr};
       pythonOnHostForHost = pkgsHostHost.${pythonAttr};
       pythonOnTargetForTarget = pkgsTargetTarget.${pythonAttr} or { };
+      pythonABITags = [
+        "none"
+        "cp${sourceVersion.major}${sourceVersion.minor}"
+      ];
     }
     // {
       inherit ucsEncoding;
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 47c372fbd3b6..58a2a5c4e2e6 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -195,6 +195,12 @@ let
         pythonOnHostForHost
         pythonOnTargetForTarget
         ;
+
+      pythonABITags = [
+        "abi3"
+        "none"
+        "cp${sourceVersion.major}${sourceVersion.minor}${lib.optionalString (!enableGIL) "t"}"
+      ];
     };
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index eb8e76101c49..b3ef73804311 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -106,7 +106,6 @@ let
     "doInstallCheck"
     "pyproject"
     "format"
-    "outputs"
     "stdenv"
     "dependencies"
     "optional-dependencies"
@@ -204,10 +203,24 @@ let
   self = stdenv.mkDerivation (
     finalAttrs:
     let
+      getFinalPassthru =
+        let
+          pos = unsafeGetAttrPos "passthru" finalAttrs;
+        in
+        attrName:
+        finalAttrs.passthru.${attrName} or (throw (
+          ''
+            ${finalAttrs.name}: passthru.${attrName} missing after overrideAttrs overriding.
+          ''
+          + optionalString (pos != null) ''
+            Last overridden at ${pos.file}:${toString pos.line}
+          ''
+        ));
+
       format' =
-        assert (pyproject != null) -> (format == null);
-        if pyproject != null then
-          if pyproject then "pyproject" else "other"
+        assert (getFinalPassthru "pyproject" != null) -> (format == null);
+        if getFinalPassthru "pyproject" != null then
+          if getFinalPassthru "pyproject" then "pyproject" else "other"
         else if format != null then
           format
         else
@@ -262,11 +275,11 @@ let
         in
         attrName: inputs: map (checkDrv attrName) inputs;
 
-      isBootstrapInstallPackage = isBootstrapInstallPackage' (attrs.pname or null);
+      isBootstrapInstallPackage = isBootstrapInstallPackage' (finalAttrs.pname or null);
 
-      isBootstrapPackage = isBootstrapInstallPackage || isBootstrapPackage' (attrs.pname or null);
+      isBootstrapPackage = isBootstrapInstallPackage || isBootstrapPackage' (finalAttrs.pname or null);
 
-      isSetuptoolsDependency = isSetuptoolsDependency' (attrs.pname or null);
+      isSetuptoolsDependency = isSetuptoolsDependency' (finalAttrs.pname or null);
 
       name = namePrefix + attrs.name or "${finalAttrs.pname}-${finalAttrs.version}";
 
@@ -294,13 +307,15 @@ let
         #
         pythonCatchConflictsHook
       ]
-      ++ optionals (attrs ? pythonRelaxDeps || attrs ? pythonRemoveDeps) [
-        pythonRelaxDepsHook
-      ]
+      ++
+        optionals (finalAttrs.pythonRelaxDeps or [ ] != [ ] || finalAttrs.pythonRemoveDeps or [ ] != [ ])
+          [
+            pythonRelaxDepsHook
+          ]
       ++ optionals removeBinBytecode [
         pythonRemoveBinBytecodeHook
       ]
-      ++ optionals (hasSuffix "zip" (attrs.src.name or "")) [
+      ++ optionals (hasSuffix "zip" (finalAttrs.src.name or "")) [
         unzip
       ]
       ++ optionals (format' == "setuptools") [
@@ -355,13 +370,13 @@ let
         pythonOutputDistHook
       ]
       ++ nativeBuildInputs
-      ++ build-system;
+      ++ getFinalPassthru "build-system";
 
       buildInputs = validatePythonMatches "buildInputs" (buildInputs ++ pythonPath);
 
       propagatedBuildInputs = validatePythonMatches "propagatedBuildInputs" (
         propagatedBuildInputs
-        ++ dependencies
+        ++ getFinalPassthru "dependencies"
         ++ [
           # we propagate python even for packages transformed with 'toPythonApplication'
           # this pollutes the PATH but avoids rebuilds
@@ -396,20 +411,17 @@ let
       outputs = outputs ++ optional withDistOutput "dist";
 
       passthru = {
-        inherit disabled;
+        inherit
+          disabled
+          pyproject
+          build-system
+          dependencies
+          optional-dependencies
+          ;
       }
       // {
         updateScript = nix-update-script { };
       }
-      // optionalAttrs (dependencies != [ ]) {
-        inherit dependencies;
-      }
-      // optionalAttrs (optional-dependencies != { }) {
-        inherit optional-dependencies;
-      }
-      // optionalAttrs (build-system != [ ]) {
-        inherit build-system;
-      }
       // attrs.passthru or { };
 
       meta = {
diff --git a/pkgs/development/interpreters/python/passthrufun.nix b/pkgs/development/interpreters/python/passthrufun.nix
index be5d8a11add5..451292d198e9 100644
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@@ -23,6 +23,7 @@
   pythonOnHostForHost,
   pythonOnTargetForTarget,
   pythonAttr ? null,
+  pythonABITags ? [ "none" ],
   self, # is pythonOnHostForTarget
 }:
 let
@@ -141,6 +142,7 @@ rec {
   pythonOlder = lib.versionOlder pythonVersion;
   inherit hasDistutilsCxxPatch;
   inherit pythonOnBuildForHost;
+  inherit pythonABITags;
 
   tests = callPackage ./tests.nix {
     python = self;
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index aa6a58ca3184..c030a464e133 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -67,6 +67,11 @@ let
     pythonOnBuildForTarget = pkgsBuildTarget.${pythonAttr};
     pythonOnHostForHost = pkgsHostHost.${pythonAttr};
     pythonOnTargetForTarget = pkgsTargetTarget.${pythonAttr} or { };
+
+    pythonABITags = [
+      "none"
+      "pypy${lib.concatStrings (lib.take 2 (lib.splitString "." pythonVersion))}_pp${sourceVersion.major}${sourceVersion.minor}"
+    ];
   };
   pname = passthru.executable;
   version = with sourceVersion; "${major}.${minor}.${patch}";
diff --git a/pkgs/development/interpreters/python/pypy/prebuilt.nix b/pkgs/development/interpreters/python/pypy/prebuilt.nix
index 02c7b39ad754..ef0350d93818 100644
--- a/pkgs/development/interpreters/python/pypy/prebuilt.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt.nix
@@ -48,6 +48,11 @@ let
     pythonOnBuildForTarget = throw "${pname} does not support cross compilation";
     pythonOnHostForHost = throw "${pname} does not support cross compilation";
     pythonOnTargetForTarget = throw "${pname} does not support cross compilation";
+
+    pythonABITags = [
+      "none"
+      "pypy${lib.concatStrings (lib.take 2 (lib.splitString "." pythonVersion))}_pp${sourceVersion.major}${sourceVersion.minor}"
+    ];
   };
   pname = "${passthru.executable}_prebuilt";
   version = with sourceVersion; "${major}.${minor}.${patch}";
diff --git a/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix b/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
index 4419485b3db6..fc8fdf79208c 100644
--- a/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
+++ b/pkgs/development/interpreters/python/pypy/prebuilt_2_7.nix
@@ -48,6 +48,11 @@ let
     pythonOnBuildForTarget = throw "${pname} does not support cross compilation";
     pythonOnHostForHost = throw "${pname} does not support cross compilation";
     pythonOnTargetForTarget = throw "${pname} does not support cross compilation";
+
+    pythonABITags = [
+      "none"
+      "pypy${lib.concatStrings (lib.take 2 (lib.splitString "." pythonVersion))}_pp${sourceVersion.major}${sourceVersion.minor}"
+    ];
   };
   pname = "${passthru.executable}_prebuilt";
   version = with sourceVersion; "${major}.${minor}.${patch}";
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index 77f69c552756..258644febdbe 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -116,6 +116,7 @@ let
         ++ lib.optionals stdenv.hostPlatform.isDarwin [
           "reqwest" # tests hang on darwin
           "threadshare" # tests cannot bind to localhost on darwin
+          "uriplaylistbin" # thread reqwest-internal-sync-runtime attempred to create a NULL object (in test_cache)
           "webp" # not supported on darwin (upstream crate issue)
         ]
         ++ lib.optionals (!gst-plugins-base.glEnabled || !withGtkPlugins) [
diff --git a/pkgs/development/php-packages/relay/default.nix b/pkgs/development/php-packages/relay/default.nix
index fa2e7544a1ec..104d66bdf3df 100644
--- a/pkgs/development/php-packages/relay/default.nix
+++ b/pkgs/development/php-packages/relay/default.nix
@@ -15,36 +15,36 @@
 }:
 
 let
-  version = "0.11.1";
+  version = "0.12.0";
   hashes = {
     "aarch64-darwin" = {
       platform = "darwin-arm64";
       hash = {
-        "8.1" = "sha256-m7WWbrOwKH/IV4mCtmxzkNaBeKwUe89QlSMNxUAbq5A=";
-        "8.2" = "sha256-ytYYtxo43H8GTDOiLpBPtJmvoi4Q9rpJ2uY0AQWm2Dg=";
-        "8.3" = "12UvfJhJn3B70Q3xxfKfAzOH/fyC/ZftC4RMWGsEO88=";
-        "8.4" = "sha256-TszXByZtkJZ0uf1BFX2RJXQqfJFPzW1CokxRFnLBZpI=";
-        "8.5" = "WYJKnDuqsprgtev5g/LGcFbZTphEcCZb6/zanur4g8U=";
+        "8.1" = "sha256-AH8FzXjIPojCxTQqDChuZPUTDnVPeOeS5a0wNXjlyEk=";
+        "8.2" = "sha256-SdivilTHbr28fHaYxK7o1QIT+sWZGHQDjWC2EgtkBbM=";
+        "8.3" = "RUnmwI5q4jXHkiRuR/PwqnztEX/7y59DA/L7BelreVk=";
+        "8.4" = "sha256-y76rICDyrA/ogRxK+4C3JvJ4ch1fNLBrY01zMmcldnw=";
+        "8.5" = "W7BwODGEcRc6E7jpX1nojak7jDV5X+0tjgk32F82wvQ=";
       };
     };
     "aarch64-linux" = {
       platform = "debian-aarch64+libssl3";
       hash = {
-        "8.1" = "sha256-e8eeQhzMLoXo1UaqFkSYMOwnkiNo7Fp8mKjVJY3SJIY=";
-        "8.2" = "sha256-dYkX4zV3lOwveMrZHLs2a7P+T3AGMv3dZNVUujpzJ9Q=";
-        "8.3" = "sha256-hU9jgz6gCWDSeoqWMznmNipfcMk7Ju7leRdSYFTl+Go=";
-        "8.4" = "gsSNY8cxWHPCm3UZNyhk9qs+9BgnnFLjeFIiksOG2A4=";
-        "8.5" = "M0SRivsTn1wQVuOt4v8F+OynZBpUkUJLR/E59veyH+Y=";
+        "8.1" = "sha256-Zg1DdzJKfovGwA+cTR5hDQ1Or8oPRrtsyBu3Zt+/6yg=";
+        "8.2" = "sha256-tV7aoi9aiUrpOufmN4pQKi0Q0Ad6wrajq9SnaeZGlKg=";
+        "8.3" = "sha256-zJN+RSzFXjOB3Uajk1Adrphbz7NAbWMcuB88RRK7SlY=";
+        "8.4" = "qvXUg3GqqN3UUtDPQz1H2BiG/b8SomGLyIPR1NIkFUA=";
+        "8.5" = "GZZa4a+MfoQPlpIA6zOEnD4UdErh/9fLhMp20rOmGIE=";
       };
     };
     "x86_64-linux" = {
       platform = "debian-x86-64+libssl3";
       hash = {
-        "8.1" = "sha256-poEjqvCVvdWmO2pw7jon+nzK52itsBfRkxcIjpHEa0M=";
-        "8.2" = "sha256-0xKV0Ro5VDaLU45BFiVhwT/a7Y7jeL7DerTmVLB0glo=";
-        "8.3" = "sha256-LggNCDl9vYXNPhIZpgeZ4h3nzddBg7FgzzJmcD+1nIA=";
-        "8.4" = "FGgHJWqlLIPXs1UBXEfgTyL6EHuP5P4fnMjop8QVmzo=";
-        "8.5" = "C5YrgTyag2ug+8sQIt7KolhXv1y63D6aSABrwU1HlWs=";
+        "8.1" = "sha256-NTCRrTuiPDbKBauY+9nQm4oJn9TwHQvNfynSKk/bZ7w=";
+        "8.2" = "sha256-9GwMHf0GIErr0vZieCH5D5tvJiekpOdBo/u1P30L9lc=";
+        "8.3" = "sha256-180n5Naz6dQRCQCj7r0CJhRqfmEHjM7jgkmWRAvyFaY=";
+        "8.4" = "nGgvhtuita+rTtns+33xDDEaIXcd3aYiCAClizWtE1E=";
+        "8.5" = "wvxZ7jUrqXImzH1LEUmvxpxKL4NE0tAtu9M25P82d0w=";
       };
     };
   };
diff --git a/pkgs/development/python-modules/asana/default.nix b/pkgs/development/python-modules/asana/default.nix
index aac14b59eebc..ef97c2ec1142 100644
--- a/pkgs/development/python-modules/asana/default.nix
+++ b/pkgs/development/python-modules/asana/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "asana";
-  version = "5.2.1";
+  version = "5.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "asana";
     repo = "python-asana";
     tag = "v${version}";
-    hash = "sha256-4kvMOg8Iou9C+tVIzp+3tc7E2WfkHjrxaMa789ku930=";
+    hash = "sha256-5GgBFZuiQDQXvZECIqY+kXTrUzkuoD8pJGKIg4TD1fw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/drafthorse/default.nix b/pkgs/development/python-modules/drafthorse/default.nix
index 5578d42ad21b..2c352dc33503 100644
--- a/pkgs/development/python-modules/drafthorse/default.nix
+++ b/pkgs/development/python-modules/drafthorse/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "drafthorse";
-  version = "2025.1.1";
+  version = "2025.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "python-drafthorse";
     rev = version;
-    hash = "sha256-zKFKZIF50qAYzLhyCWMfrgaf9YRpk1MU81DAWaycXFI=";
+    hash = "sha256-z8w1n/rjrVpL+3MFoTaKCI7NZpchIg4H80rNlm0sFgQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fenics-ufl/default.nix b/pkgs/development/python-modules/fenics-ufl/default.nix
index 61da6b3924e7..10bed13a147a 100644
--- a/pkgs/development/python-modules/fenics-ufl/default.nix
+++ b/pkgs/development/python-modules/fenics-ufl/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "fenics-ufl";
-  version = "2025.1.0";
+  version = "2025.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fenics";
     repo = "ufl";
     tag = version;
-    hash = "sha256-4WKUtW6cLvgazyjp1vpDWZa54QeCbbP3LE1C3dv5QFc=";
+    hash = "sha256-REDjNiUM3bd166Pq92P9Yl4Ff9C9hFNjTWWO1FElHrU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fnv-hash-fast/default.nix b/pkgs/development/python-modules/fnv-hash-fast/default.nix
index 98ad5d699e0a..901e0bc65df7 100644
--- a/pkgs/development/python-modules/fnv-hash-fast/default.nix
+++ b/pkgs/development/python-modules/fnv-hash-fast/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "fnv-hash-fast";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "fnv-hash-fast";
     tag = "v${version}";
-    hash = "sha256-yhn39QEIZQqY/6W2rhUff45tQzap9N6OPiP/Z9oEz8U=";
+    hash = "sha256-1o/SwX9N+wBNVkihUuCYrJAEH28FxhKEhyOEK7tK1XE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/gliner/default.nix b/pkgs/development/python-modules/gliner/default.nix
index b63b96443117..743aa3d357d5 100644
--- a/pkgs/development/python-modules/gliner/default.nix
+++ b/pkgs/development/python-modules/gliner/default.nix
@@ -17,20 +17,23 @@
 
 buildPythonPackage rec {
   pname = "gliner";
-  version = "0.2.21";
+  version = "0.2.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "urchade";
     repo = "GLiNER";
-    tag = version;
-    hash = "sha256-v8Q/+et9yWeVSWt1K9Ahg3I4dz5/Ft+o1ueNOSaGEOU=";
+    tag = "v${version}";
+    hash = "sha256-UyqKn4cvrLUtSnfZoivgj7tw/mH/c8kmFwRQFrTIwhU=";
   };
 
   build-system = [
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "transformers"
+  ];
   dependencies = [
     huggingface-hub
     onnxruntime
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 2c8d9818f9bb..12e20e097e81 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -42,6 +42,13 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # The analytics tests often timeout under load on Darwin (e.g. on Hydra), so remove them
+    substituteInPlace testsuite/meson.build --replace-fail \
+      "['Test analytics', 'test_analytics.py', ['gst-plugins-bad/gst-libs/gst/analytics', 'gst-plugins-base/gst-libs/gst/video']]," \
+      ""
+  '';
+
   # Python 2.x is not supported.
   disabled = !isPy3k;
 
@@ -87,10 +94,10 @@ buildPythonPackage rec {
     updateScript = directoryListingUpdater { };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://gstreamer.freedesktop.org";
     description = "Python bindings for GStreamer";
-    license = licenses.lgpl2Plus;
+    license = lib.licenses.lgpl2Plus;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/jaxtyping/default.nix b/pkgs/development/python-modules/jaxtyping/default.nix
index 83d4ad031b7d..ef664dcbd8e9 100644
--- a/pkgs/development/python-modules/jaxtyping/default.nix
+++ b/pkgs/development/python-modules/jaxtyping/default.nix
@@ -23,14 +23,14 @@
 let
   self = buildPythonPackage rec {
     pname = "jaxtyping";
-    version = "0.3.2";
+    version = "0.3.3";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "google";
       repo = "jaxtyping";
       tag = "v${version}";
-      hash = "sha256-zRuTOt9PqFGDZbSGvkzxIWIi3z+vU0FmAEecPRcGy2w=";
+      hash = "sha256-92wvnlaGVppu8qNo8f7zw7be788hj8Mdi8KDfNQllwU=";
     };
 
     build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/mesa/default.nix b/pkgs/development/python-modules/mesa/default.nix
deleted file mode 100644
index c26bf68c8582..000000000000
--- a/pkgs/development/python-modules/mesa/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  isPy27,
-  cookiecutter,
-  networkx,
-  pandas,
-  tornado,
-  tqdm,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "mesa";
-  version = "3.2.0";
-  format = "setuptools";
-
-  # According to their docs, this library is for Python 3+.
-  disabled = isPy27;
-
-  src = fetchPypi {
-    pname = "mesa";
-    inherit version;
-    hash = "sha256-k4UjkUGL4qDgOhucQU7svRNZtM3ZqtO6NUxpl4NhQl0=";
-  };
-
-  propagatedBuildInputs = [
-    cookiecutter
-    networkx
-    pandas
-    tornado
-    tqdm
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  disabledTests = [
-    "test_examples"
-    "test_run"
-    "test_scaffold_creates_project_dir"
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/projectmesa/mesa";
-    description = "Agent-based modeling (or ABM) framework in Python";
-    license = licenses.asl20;
-    maintainers = [ maintainers.dpaetzel ];
-    broken = true; # missing dependencies
-  };
-}
diff --git a/pkgs/development/python-modules/objax/default.nix b/pkgs/development/python-modules/objax/default.nix
deleted file mode 100644
index 1909658fe20a..000000000000
--- a/pkgs/development/python-modules/objax/default.nix
+++ /dev/null
@@ -1,83 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  jax,
-  jaxlib,
-  keras,
-  numpy,
-  parameterized,
-  pillow,
-  pytestCheckHook,
-  pythonOlder,
-  scipy,
-  setuptools,
-  tensorboard,
-  tensorflow,
-}:
-
-buildPythonPackage rec {
-  pname = "objax";
-  version = "1.8.0";
-  pyproject = true;
-
-  disabled = pythonOlder "3.9";
-
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "objax";
-    tag = "v${version}";
-    hash = "sha256-WD+pmR8cEay4iziRXqF3sHUzCMBjmLJ3wZ3iYOD+hzk=";
-  };
-
-  patches = [
-    # Issue reported upstream: https://github.com/google/objax/issues/270
-    ./replace-deprecated-device_buffers.patch
-  ];
-
-  build-system = [ setuptools ];
-
-  # Avoid propagating the dependency on `jaxlib`, see
-  # https://github.com/NixOS/nixpkgs/issues/156767
-  buildInputs = [ jaxlib ];
-
-  dependencies = [
-    jax
-    numpy
-    parameterized
-    pillow
-    scipy
-    tensorboard
-  ];
-
-  pythonImportsCheck = [ "objax" ];
-
-  # This is necessary to ignore the presence of two protobufs version (tensorflow is bringing an
-  # older version).
-  catchConflicts = false;
-
-  nativeCheckInputs = [
-    keras
-    pytestCheckHook
-    tensorflow
-  ];
-
-  enabledTestPaths = [ "tests/*.py" ];
-
-  disabledTests = [
-    # Test requires internet access for prefetching some weights
-    "test_pretrained_keras_weight_0_ResNet50V2"
-    # ModuleNotFoundError: No module named 'tree'
-    "TestResNetV2Pretrained"
-  ];
-
-  meta = with lib; {
-    description = "Machine learning framework that provides an Object Oriented layer for JAX";
-    homepage = "https://github.com/google/objax";
-    changelog = "https://github.com/google/objax/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ndl ];
-    # Tests test_syncbn_{0,1,2}d and other tests from tests/parallel.py fail
-    broken = true;
-  };
-}
diff --git a/pkgs/development/python-modules/objax/replace-deprecated-device_buffers.patch b/pkgs/development/python-modules/objax/replace-deprecated-device_buffers.patch
deleted file mode 100644
index fc0fd50a90ce..000000000000
--- a/pkgs/development/python-modules/objax/replace-deprecated-device_buffers.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/objax/util/util.py b/objax/util/util.py
-index c31a356..344cf9a 100644
---- a/objax/util/util.py
-+++ b/objax/util/util.py
-@@ -117,7 +117,8 @@ def get_local_devices():
-     if _local_devices is None:
-         x = jn.zeros((jax.local_device_count(), 1), dtype=jn.float32)
-         sharded_x = map_to_device(x)
--        _local_devices = [b.device() for b in sharded_x.device_buffers]
-+        device_buffers = [buf.data for buf in sharded_x.addressable_shards]
-+        _local_devices = [list(b.devices())[0] for b in device_buffers]
-     return _local_devices
- 
- 
diff --git a/pkgs/development/python-modules/openaiauth/default.nix b/pkgs/development/python-modules/openaiauth/default.nix
index 834ca3ed258b..517d98eff06d 100644
--- a/pkgs/development/python-modules/openaiauth/default.nix
+++ b/pkgs/development/python-modules/openaiauth/default.nix
@@ -34,6 +34,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/acheong08/OpenAIAuth";
     changelog = "https://github.com/acheong08/OpenAIAuth/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ realsnick ];
+    maintainers = with maintainers; [ logger ];
   };
 }
diff --git a/pkgs/development/python-modules/pyezvizapi/default.nix b/pkgs/development/python-modules/pyezvizapi/default.nix
index 1d89aac84cca..ed98a9f5ccc1 100644
--- a/pkgs/development/python-modules/pyezvizapi/default.nix
+++ b/pkgs/development/python-modules/pyezvizapi/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyezvizapi";
-  version = "1.0.2.4";
+  version = "1.0.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "RenierM26";
     repo = "pyEzvizApi";
     tag = version;
-    hash = "sha256-kfaOP/VKY4ZzmipY9REXtbVSCOD6U+/eBhDntfGrsQA=";
+    hash = "sha256-z93a0/OeErszTmKgMDWBCIsyCLQMTcYVBEiPAW9rX3E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyglet/default.nix b/pkgs/development/python-modules/pyglet/default.nix
index 9948a21bdec6..ecf741205aea 100644
--- a/pkgs/development/python-modules/pyglet/default.nix
+++ b/pkgs/development/python-modules/pyglet/default.nix
@@ -18,7 +18,6 @@
   openal,
   libpulseaudio,
   harfbuzz,
-  mesa,
   apple-sdk,
 }:
 
diff --git a/pkgs/development/python-modules/pysunspec2/default.nix b/pkgs/development/python-modules/pysunspec2/default.nix
index 0e8f04916660..eae4daa43782 100644
--- a/pkgs/development/python-modules/pysunspec2/default.nix
+++ b/pkgs/development/python-modules/pysunspec2/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pysunspec2";
-  version = "1.3.2";
+  version = "1.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "sunspec";
     repo = "pysunspec2";
     tag = "v${version}";
-    hash = "sha256-a5dync6B0KA1Qus/3xfDzASirEh7yLuiUrQXB2jMVQw=";
+    hash = "sha256-mVx8Rt5GLyQ2ss0iJPi32Fhl9pD7hsXxW94p+8ri+w4=";
     fetchSubmodules = true;
   };
 
@@ -33,6 +33,11 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  pytestFlags = [
+    # This test relies on old pymodbus 2 version
+    "--ignore=sunspec2/tests/test_tls_client.py"
+  ];
+
   pythonImportsCheck = [ "sunspec2" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/qcs-sdk-python/default.nix b/pkgs/development/python-modules/qcs-sdk-python/default.nix
index bded61ec97cd..208ee5f1fa7b 100644
--- a/pkgs/development/python-modules/qcs-sdk-python/default.nix
+++ b/pkgs/development/python-modules/qcs-sdk-python/default.nix
@@ -1,8 +1,8 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  gitUpdater,
   opentelemetry-api,
   opentelemetry-sdk,
   pytest-asyncio,
@@ -11,25 +11,24 @@
   qcs-api-client-common,
   quil,
   rustPlatform,
-  libiconv,
   syrupy,
 }:
 
 buildPythonPackage rec {
   pname = "qcs-sdk-python";
-  version = "0.21.18";
+  version = "0.21.19";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rigetti";
     repo = "qcs-sdk-rust";
     tag = "python/v${version}";
-    hash = "sha256-uN9SQnQR5y4gyJeQI5H04hT1OL1ZQBwCdz8GkNMMTLY=";
+    hash = "sha256-116+DbsvLBNWjyeGcm3+zrmY9HKWONii2Me0XjEGACo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-PqQMG8RKF8Koz796AeoG/X9SeL1TruwOVPqwfKuq984=";
+    hash = "sha256-+F7PRBg73GFSeUCmt5NWa+gBhuZU5J7F5TGqRJKqwGc=";
   };
 
   buildAndTestSubdir = "crates/python";
@@ -48,10 +47,6 @@ buildPythonPackage rec {
     tracing-opentelemetry = [ opentelemetry-api ];
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libiconv
-  ];
-
   nativeCheckInputs = [
     opentelemetry-sdk
     pytest-asyncio
@@ -72,6 +67,10 @@ buildPythonPackage rec {
     "test_qvm_tracing"
   ];
 
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "python/v";
+  };
+
   meta = {
     changelog = "https://github.com/rigetti/qcs-sdk-rust/blob/${src.tag}/crates/python/CHANGELOG.md";
     description = "Python interface for the QCS Rust SDK";
diff --git a/pkgs/development/python-modules/spyder-kernels/default.nix b/pkgs/development/python-modules/spyder-kernels/default.nix
index 7973265d7960..6a0f1f5f95ce 100644
--- a/pkgs/development/python-modules/spyder-kernels/default.nix
+++ b/pkgs/development/python-modules/spyder-kernels/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage rec {
   pname = "spyder-kernels";
-  version = "3.1.0b1";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spyder-ide";
     repo = "spyder-kernels";
     tag = "v${version}";
-    hash = "sha256-bYpNWE6KHDD9CkDmTDIX3gZumLOhAyxITCGyWuSU2+o=";
+    hash = "sha256-FH4n1FsVN3D9WdDvxsrD6FBJiZl+ec/CJFOhs9IjUwI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/spyder/default.nix b/pkgs/development/python-modules/spyder/default.nix
index 355ccfb56a55..bf9ce323d734 100644
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@@ -37,6 +37,7 @@
   pyls-spyder,
   pyopengl,
   python-lsp-black,
+  python-lsp-ruff,
   python-lsp-server,
   pyuca,
   pyzmq,
@@ -58,12 +59,12 @@
 
 buildPythonPackage rec {
   pname = "spyder";
-  version = "6.1.0a2";
+  version = "6.1.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KbGfG9T3XkYXntIQx325mYb0Bh8c0idb+25awFlWD9s=";
+    hash = "sha256-UgDGJJuwNzB0VfAMgGM/UIhNarQ6da18XKE9JGJXRjY=";
   };
 
   patches = [ ./dont-clear-pythonpath.patch ];
@@ -106,6 +107,7 @@ buildPythonPackage rec {
     pyopengl
     pyqtwebengine
     python-lsp-black
+    python-lsp-ruff
     python-lsp-server
     pyuca
     pyzmq
diff --git a/pkgs/development/python-modules/spyder/dont-clear-pythonpath.patch b/pkgs/development/python-modules/spyder/dont-clear-pythonpath.patch
index 0d623c69ee34..a5e455e1f306 100644
--- a/pkgs/development/python-modules/spyder/dont-clear-pythonpath.patch
+++ b/pkgs/development/python-modules/spyder/dont-clear-pythonpath.patch
@@ -1,21 +1,20 @@
 diff --git a/spyder/app/start.py b/spyder/app/start.py
-index ad9f2b8d0..442b4fc46 100644
+index 3f225a164..10e6017b1 100644
 --- a/spyder/app/start.py
 +++ b/spyder/app/start.py
-@@ -6,16 +6,8 @@
- # (see spyder/__init__.py for details)
- # -----------------------------------------------------------------------------
+@@ -9,15 +9,6 @@
+ import os
+ import sys
  
 -# Remove PYTHONPATH paths from sys.path before other imports to protect against
 -# shadowed standard libraries.
- import os
- import sys
 -if os.environ.get('PYTHONPATH'):
 -    for path in os.environ['PYTHONPATH'].split(os.pathsep):
 -        try:
 -            sys.path.remove(path.rstrip(os.sep))
 -        except ValueError:
 -            pass
+-
+ # Remove PYTHONEXECUTABLE. See spyder-ide/spyder#24743
+ os.environ.pop("PYTHONEXECUTABLE", None)
  
- # Standard library imports
- import ctypes
diff --git a/pkgs/development/python-modules/templateflow/default.nix b/pkgs/development/python-modules/templateflow/default.nix
index 2680aa479548..9632f5fd338f 100644
--- a/pkgs/development/python-modules/templateflow/default.nix
+++ b/pkgs/development/python-modules/templateflow/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "templateflow";
-  version = "25.0.3";
+  version = "25.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "templateflow";
     repo = "python-client";
     tag = version;
-    hash = "sha256-5LGAuDaJzc2asM5EPOVuOxZwpV0LQNBhMhYKHJlXHmE=";
+    hash = "sha256-7N8JJAJwnmesQIoZttcphmUW5HLEi8Rxv70MGNjOO98=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch b/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
index f16982ece4a7..4314aff33fb9 100644
--- a/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
+++ b/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
@@ -1,12 +1,14 @@
 diff --git a/requirements/cpu.txt b/requirements/cpu.txt
-index d80354342..7434f32f0 100644
+index 2db6d87ee..37f816170 100644
 --- a/requirements/cpu.txt
 +++ b/requirements/cpu.txt
-@@ -21,7 +21,4 @@ torchvision; platform_machine != "ppc64le" and platform_machine != "s390x"
- torchvision==0.22.0; platform_machine == "ppc64le"
+@@ -21,9 +21,6 @@ torchvision; platform_machine != "ppc64le" and platform_machine != "s390x"
+ torchvision==0.23.0; platform_machine == "ppc64le"
  datasets # for benchmark scripts
  
 -# Intel Extension for PyTorch, only for x86_64 CPUs
 -intel-openmp==2024.2.1; platform_machine == "x86_64"
--intel_extension_for_pytorch==2.6.0; platform_machine == "x86_64" # torch>2.6.0+cpu has performance regression on x86 platform, see https://github.com/pytorch/pytorch/pull/151218
+-intel_extension_for_pytorch==2.8.0; platform_machine == "x86_64"
  triton==3.2.0; platform_machine == "x86_64" # Triton is required for torch 2.6+cpu, as it is imported in torch.compile.
+ 
+ # Use this to gather CPU info and optimize based on ARM Neoverse cores
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index e2c537d977e4..7e56b1796f59 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -3,7 +3,7 @@
   stdenv,
   python,
   buildPythonPackage,
-  pythonAtLeast,
+  pythonOlder,
   fetchFromGitHub,
   fetchpatch,
   symlinkJoin,
@@ -115,8 +115,8 @@ let
     src = fetchFromGitHub {
       owner = "vllm-project";
       repo = "FlashMLA";
-      rev = "0e43e774597682284358ff2c54530757b654b8d1";
-      hash = "sha256-wxL/jtq/lsLg1o+4392KNgfw5TYlW6lqEVbmR3Jl4/Q=";
+      rev = "5f65b85703c7ed75fda01e06495077caad207c3f";
+      hash = "sha256-DO9EFNSoAgyfRRc095v1UjT+Zdzk4cFY0+n28FVEwI0=";
     };
 
     dontConfigure = true;
@@ -135,15 +135,15 @@ let
   vllm-flash-attn' = lib.defaultTo (stdenv.mkDerivation {
     pname = "vllm-flash-attn";
     # https://github.com/vllm-project/flash-attention/blob/${src.rev}/vllm_flash_attn/__init__.py
-    version = "2.7.4.post1";
+    version = "2.7.2.post1";
 
     # grep for GIT_TAG in the following file
     # https://github.com/vllm-project/vllm/blob/v${version}/cmake/external_projects/vllm_flash_attn.cmake
     src = fetchFromGitHub {
       owner = "vllm-project";
       repo = "flash-attention";
-      rev = "57b4e68b9f9d94750b46de8f8dbd2bfcc86edd4f";
-      hash = "sha256-c7L7WZVVEnXMOTPBoSp7jhkl9d4TA4sj11QvOSWTDIE=";
+      rev = "ee4d25bd84e0cbc7e0b9b9685085fd5db2dcb62a";
+      hash = "sha256-2r0Habd/kBpvM4/aQFIYyj+uQAa3M9gjk3DcBZHFNfA=";
     };
 
     patches = [
@@ -179,7 +179,7 @@ let
 
   cpuSupport = !cudaSupport && !rocmSupport;
 
-  # https://github.com/pytorch/pytorch/blob/v2.7.1/torch/utils/cpp_extension.py#L2343-L2345
+  # https://github.com/pytorch/pytorch/blob/v2.8.0/torch/utils/cpp_extension.py#L2411-L2414
   supportedTorchCudaCapabilities =
     let
       real = [
@@ -204,8 +204,12 @@ let
         "10.0a"
         "10.1"
         "10.1a"
+        "10.3"
+        "10.3a"
         "12.0"
         "12.0a"
+        "12.1"
+        "12.1a"
       ];
       ptx = lists.map (x: "${x}+PTX") real;
     in
@@ -245,6 +249,7 @@ let
   mergedCudaLibraries = with cudaPackages; [
     cuda_cudart # cuda_runtime.h, -lcudart
     cuda_cccl
+    libcurand # curand_kernel.h
     libcusparse # cusparse.h
     libcusolver # cusolverDn.h
     cuda_nvtx
@@ -266,19 +271,16 @@ in
 
 buildPythonPackage rec {
   pname = "vllm";
-  version = "0.10.1.1";
+  version = "0.11.0";
   pyproject = true;
 
-  # https://github.com/vllm-project/vllm/issues/12083
-  disabled = pythonAtLeast "3.13";
-
   stdenv = torch.stdenv;
 
   src = fetchFromGitHub {
     owner = "vllm-project";
     repo = "vllm";
     tag = "v${version}";
-    hash = "sha256-lLNjBv5baER0AArX3IV4HWjDZ2jTGXyGIvnHupR8MGM=";
+    hash = "sha256-uYK/e9McEyrDTACMk5S0cGCjai9rf6HMR9dpPL7ISYc=";
   };
 
   patches = [
@@ -481,7 +483,12 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [
       happysalada
       lach
+      daniel-fahey
     ];
+    # Python 3.12 vLLM v0.10.2+CPU blake3 1.0.7 incompatibility
+    # discovered during https://github.com/NixOS/nixpkgs/pull/447722
+    # reported upstream in https://github.com/vllm-project/vllm/issues/26229
+    broken = (cpuSupport && pythonOlder "3.13");
     badPlatforms = [
       # CMake Error at cmake/cpu_extension.cmake:78 (find_isa):
       # find_isa Function invoked with incorrect arguments for function named:
diff --git a/pkgs/games/openttd/jgrpp.nix b/pkgs/games/openttd/jgrpp.nix
index 13fd738bd54f..4363e21b2eac 100644
--- a/pkgs/games/openttd/jgrpp.nix
+++ b/pkgs/games/openttd/jgrpp.nix
@@ -7,13 +7,13 @@
 
 openttd.overrideAttrs (oldAttrs: rec {
   pname = "openttd-jgrpp";
-  version = "0.66.0";
+  version = "0.66.1";
 
   src = fetchFromGitHub {
     owner = "JGRennison";
     repo = "OpenTTD-patches";
     rev = "jgrpp-${version}";
-    hash = "sha256-FMAEF7DiHP5HqGTOdwB9UGA/5Hbp1XIEVD98G7PR4AA=";
+    hash = "sha256-Bw5/fy3duMQDCDfAF6hGE7eQiNo0d9Ag/afG9zM+d30=";
   };
   patches = [ ];
 
diff --git a/pkgs/os-specific/linux/ch9344/default.nix b/pkgs/os-specific/linux/ch9344/default.nix
index 3a6d448b784f..29436d3a7f0a 100644
--- a/pkgs/os-specific/linux/ch9344/default.nix
+++ b/pkgs/os-specific/linux/ch9344/default.nix
@@ -3,6 +3,7 @@
   lib,
   fetchFromGitHub,
   kernel,
+  kernelModuleMakeFlags,
 }:
 
 stdenv.mkDerivation rec {
@@ -30,7 +31,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace "KERNELDIR :=" "KERNELDIR ?="
   '';
 
-  makeFlags = [
+  makeFlags = kernelModuleMakeFlags ++ [
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
diff --git a/pkgs/os-specific/linux/lenovo-legion/app.nix b/pkgs/os-specific/linux/lenovo-legion/app.nix
index 679a739e1c27..6c109d1150e9 100644
--- a/pkgs/os-specific/linux/lenovo-legion/app.nix
+++ b/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -58,7 +58,7 @@ python3.pkgs.buildPythonApplication rec {
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
       ulrikstrid
-      realsnick
+      logger
       chn
     ];
     mainProgram = "legion_gui";
diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index 1a84f5c0846e..6b5fa18531fe 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -215,6 +215,9 @@ stdenv.mkDerivation (finalAttrs: {
       "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
       "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     ]
+    ++ lib.optionals stdenv.cc.isClang [
+      "C_INCLUDE_PATH=${lib.getLib stdenv.cc.cc}/lib/clang/${lib.versions.major stdenv.cc.cc.version}/include"
+    ]
   );
 
   hardeningDisable = [
diff --git a/pkgs/os-specific/linux/nvidia-x11/open.nix b/pkgs/os-specific/linux/nvidia-x11/open.nix
index 88f146c526d3..bd5653f5c9c8 100644
--- a/pkgs/os-specific/linux/nvidia-x11/open.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/open.nix
@@ -26,18 +26,19 @@ stdenv.mkDerivation (
 
     nativeBuildInputs = kernel.moduleBuildDependencies;
 
-    makeFlags = kernelModuleMakeFlags ++ [
-      "IGNORE_PREEMPT_RT_PRESENCE=1"
-      "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-      "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-      "MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"
-      "DATE="
-      {
-        aarch64-linux = "TARGET_ARCH=aarch64";
-        x86_64-linux = "TARGET_ARCH=x86_64";
-      }
-      .${stdenv.hostPlatform.system}
-    ];
+    makeFlags =
+      kernelModuleMakeFlags
+      ++ [
+        "IGNORE_PREEMPT_RT_PRESENCE=1"
+        "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+        "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+        "MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"
+        "DATE="
+        "TARGET_ARCH=${stdenv.hostPlatform.parsed.cpu.name}"
+      ]
+      ++ lib.optionals stdenv.cc.isClang [
+        "C_INCLUDE_PATH=${lib.getLib stdenv.cc.cc}/lib/clang/${lib.versions.major stdenv.cc.cc.version}/include"
+      ];
 
     installTargets = [ "modules_install" ];
     enableParallelBuilding = true;
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
index e08c29ca4862..aee74477e45f 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "advanced-camera-card";
-  version = "7.17.0";
+  version = "7.18.1";
 
   src = fetchzip {
     url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip";
-    hash = "sha256-GwZU/vcucgg2zPsSXkgQlGzcOp/3gUCkGgGtspH0MgE=";
+    hash = "sha256-aUoXkoDhAEzKl6YbrSXPnItf0rAYNKa6/PA7mjVnXvo=";
   };
 
   # TODO: build from source once yarn berry support lands in nixpkgs
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index 9009dffd577d..a777fa228986 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -26,7 +26,6 @@ assert lib.assertMsg (
   boehmgc,
   boost,
   brotli,
-  busybox,
   busybox-sandbox-shell,
   bzip2,
   callPackage,
@@ -55,6 +54,7 @@ assert lib.assertMsg (
   nlohmann_json,
   ninja,
   openssl,
+  pkgsStatic,
   rustc,
   toml11,
   pegtl,
@@ -295,7 +295,7 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionals
       (stdenv.hostPlatform.isLinux && finalAttrs.doInstallCheck && lib.versionAtLeast version "2.94")
       [
-        (lib.mesonOption "build-test-shell" "${busybox}/bin")
+        (lib.mesonOption "build-test-shell" "${pkgsStatic.busybox}/bin")
       ];
 
   ninjaFlags = [ "-v" ];
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 823b45e67044..da35192c5e5a 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -57,7 +57,10 @@ let
           boehmgc =
             # TODO: Why is this called `boehmgc-nix_2_3`?
             let
-              boehmgc-nix_2_3 = boehmgc.override { enableLargeConfig = true; };
+              boehmgc-nix_2_3 = boehmgc.override {
+                enableLargeConfig = true;
+                initialMarkStackSize = 1048576;
+              };
             in
             # Since Lix 2.91 does not use boost coroutines, it does not need boehmgc patches either.
             if lib.versionOlder lix-args.version "2.91" then
@@ -214,14 +217,14 @@ lib.makeExtensible (
       attrName = "git";
 
       lix-args = rec {
-        version = "2.94.0-pre-20250912_${builtins.substring 0 12 src.rev}";
+        version = "2.94.0-pre-20251001_${builtins.substring 0 12 src.rev}";
 
         src = fetchFromGitea {
           domain = "git.lix.systems";
           owner = "lix-project";
           repo = "lix";
-          rev = "d90e4a65812c6d3dd90aed7e44941eba3215f876";
-          hash = "sha256-rbf0ptj4BTSwsitKQu3FuaiJwhNDePGBeBJovm5HLdQ=";
+          rev = "f1ef994f120a723839a6d837cc2b33914a30a4db";
+          hash = "sha256-Rmq98EchbKygPo+2g0nDsZ7QNMLe+loiMbflV5VKDzc=";
         };
 
         cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 446961e0fe1a..7d6c1298b940 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1691,6 +1691,7 @@ mapAliases {
   }; # Added 2025-02-20
   mcomix3 = mcomix; # Added 2022-06-05
   mdt = md-tui; # Added 2024-09-03
+  meilisearch_1_11 = throw "'meilisearch_1_11' has been removed, as it is no longer supported"; # Added 2025-10-03
   meme = throw "'meme' has been renamed to/replaced by 'meme-image-generator'"; # Converted to throw 2024-10-17
   memorymapping = throw "memorymapping has been removed, as it was only useful on old macOS versions that are no longer supported"; # Added 2024-10-05
   memorymappingHook = throw "memorymapping has been removed, as it was only useful on old macOS versions that are no longer supported"; # Added 2024-10-05
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a1eb9fc271fa..60bbeaf85af3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3076,8 +3076,6 @@ with pkgs;
     threadsafe = true;
   };
 
-  heaptrack = kdePackages.callPackage ../development/tools/profiling/heaptrack { };
-
   headscale = callPackage ../servers/headscale { };
 
   highlight = callPackage ../tools/text/highlight {
@@ -3222,8 +3220,6 @@ with pkgs;
 
   kaffeine = libsForQt5.callPackage ../applications/video/kaffeine { };
 
-  kdiskmark = kdePackages.callPackage ../tools/filesystems/kdiskmark { };
-
   keepkey-agent = with python3Packages; toPythonApplication keepkey-agent;
 
   keybase = callPackage ../tools/security/keybase { };
@@ -3371,8 +3367,6 @@ with pkgs;
 
   node2nix = nodePackages.node2nix;
 
-  ktailctl = kdePackages.callPackage ../applications/networking/ktailctl { };
-
   ldapdomaindump = with python3Packages; toPythonApplication ldapdomaindump;
 
   leanblueprint = with python3Packages; toPythonApplication leanblueprint;
@@ -8664,8 +8658,6 @@ with pkgs;
 
   reposilitePlugins = recurseIntoAttrs (callPackage ../by-name/re/reposilite/plugins.nix { });
 
-  rhino = callPackage ../development/libraries/java/rhino { };
-
   rocksdb_9_10 = rocksdb.overrideAttrs rec {
     pname = "rocksdb";
     version = "9.10.0";
@@ -10860,8 +10852,6 @@ with pkgs;
 
   tex-gyre-math = callPackages ../data/fonts/tex-gyre-math { };
 
-  whitesur-kde = kdePackages.callPackage ../data/themes/whitesur-kde { };
-
   xkeyboard_config = xkeyboard-config;
 
   xlsx2csv = with python3Packages; toPythonApplication xlsx2csv;
@@ -12262,8 +12252,6 @@ with pkgs;
   obs-studio-plugins = recurseIntoAttrs (callPackage ../applications/video/obs-studio/plugins { });
   wrapOBS = callPackage ../applications/video/obs-studio/wrapper.nix { };
 
-  omegat = callPackage ../applications/misc/omegat.nix { };
-
   openambit = qt5.callPackage ../applications/misc/openambit { };
 
   openbox-menu = callPackage ../applications/misc/openbox-menu {
@@ -12665,8 +12653,6 @@ with pkgs;
 
   super-slicer-latest = super-slicer.latest;
 
-  skrooge = kdePackages.callPackage ../applications/office/skrooge { };
-
   soci = callPackage ../development/libraries/soci { };
 
   socialscan = with python3.pkgs; toPythonApplication socialscan;
@@ -14593,8 +14579,6 @@ with pkgs;
 
   openlilylib-fonts = callPackage ../misc/lilypond/fonts.nix { };
 
-  meilisearch_1_11 = callPackage ../by-name/me/meilisearch/package.nix { version = "1.11.3"; };
-
   muse = libsForQt5.callPackage ../applications/audio/muse { };
 
   nixDependencies = recurseIntoAttrs (
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index fa787fbdbf32..625fd4f69af0 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -444,6 +444,7 @@ mapAliases ({
   mathlibtools = throw "mathlibtools has been removed because the upstream repository was archived in 2023"; # added 2025-07-09
   matrix-api-async = throw "matrix-api-async has been removed as it is an old wrapper and no longer in use"; # added 2025-01-01
   memory_profiler = memory-profiler; # added 2023-10-09
+  mesa = throw "python3Packages.mesa has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-03
   mir_eval = mir-eval; # added 2024-01-07
   mistune_0_8 = throw "mistune_0_8 was removed because it was outdated and insecure"; # added 2022-08-12
   mistune_2_0 = mistune; # added 2022-08-12
@@ -494,6 +495,7 @@ mapAliases ({
   ntlm-auth = throw "ntlm-auth has been removed, because it relies on the md4 implementation provided by openssl. Use pyspnego instead.";
   oauth = throw "oauth has been removed as it is unmaintained"; # added 2025-05-16
   oauth2 = throw "oauth2 has been removed as it is unmaintained"; # added 2025-05-16
+  objax = throw "objax has been removed because the upstream project was archived."; # Added 2025-10-04
   openai-triton = triton; # added 2024-07-18
   openai-triton-bin = triton-bin; # added 2024-07-18
   openai-triton-cuda = triton-cuda; # added 2024-07-18
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c7d8654856ec..ab99a47bc198 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9235,8 +9235,6 @@ self: super: with self; {
 
   meross-iot = callPackage ../development/python-modules/meross-iot { };
 
-  mesa = callPackage ../development/python-modules/mesa { };
-
   meshcat = callPackage ../development/python-modules/meshcat { };
 
   meshcore = callPackage ../development/python-modules/meshcore { };
@@ -9598,7 +9596,9 @@ self: super: with self; {
 
   moderngl = callPackage ../development/python-modules/moderngl { };
 
-  moderngl-window = callPackage ../development/python-modules/moderngl-window { };
+  moderngl-window = callPackage ../development/python-modules/moderngl-window {
+    inherit (pkgs) mesa;
+  };
 
   moehlenhoff-alpha2 = callPackage ../development/python-modules/moehlenhoff-alpha2 { };
 
@@ -10772,8 +10772,6 @@ self: super: with self; {
 
   obfsproxy = callPackage ../development/python-modules/obfsproxy { };
 
-  objax = callPackage ../development/python-modules/objax { };
-
   objexplore = callPackage ../development/python-modules/objexplore { };
 
   objgraph = callPackage ../development/python-modules/objgraph {
@@ -13677,7 +13675,9 @@ self: super: with self; {
 
   pyopencl = callPackage ../development/python-modules/pyopencl { };
 
-  pyopengl = callPackage ../development/python-modules/pyopengl { };
+  pyopengl = callPackage ../development/python-modules/pyopengl {
+    inherit (pkgs) mesa;
+  };
 
   pyopengl-accelerate = callPackage ../development/python-modules/pyopengl-accelerate { };
 
@@ -13882,7 +13882,9 @@ self: super: with self; {
 
   pyqt5-multimedia = self.pyqt5.override { withMultimedia = true; };
 
-  pyqt5-sip = callPackage ../development/python-modules/pyqt/sip.nix { };
+  pyqt5-sip = callPackage ../development/python-modules/pyqt/sip.nix {
+    inherit (pkgs) mesa;
+  };
 
   pyqt5-stubs = callPackage ../development/python-modules/pyqt5-stubs { };
 
@@ -13891,13 +13893,21 @@ self: super: with self; {
   # `propagatedBuildInputs` may cause collisions.
   pyqt5-webkit = self.pyqt5.override { withWebKit = true; };
 
-  pyqt6 = callPackage ../development/python-modules/pyqt/6.x.nix { };
+  pyqt6 = callPackage ../development/python-modules/pyqt/6.x.nix {
+    inherit (pkgs) mesa;
+  };
 
-  pyqt6-charts = callPackage ../development/python-modules/pyqt6-charts { };
+  pyqt6-charts = callPackage ../development/python-modules/pyqt6-charts {
+    inherit (pkgs) mesa;
+  };
 
-  pyqt6-sip = callPackage ../development/python-modules/pyqt/pyqt6-sip.nix { };
+  pyqt6-sip = callPackage ../development/python-modules/pyqt/pyqt6-sip.nix {
+    inherit (pkgs) mesa;
+  };
 
-  pyqt6-webengine = callPackage ../development/python-modules/pyqt6-webengine { };
+  pyqt6-webengine = callPackage ../development/python-modules/pyqt6-webengine {
+    inherit (pkgs) mesa;
+  };
 
   pyqtchart = pkgs.libsForQt5.callPackage ../development/python-modules/pyqtchart {
     inherit (self)
@@ -13929,7 +13939,9 @@ self: super: with self; {
 
   pyqtgraph = callPackage ../development/python-modules/pyqtgraph { };
 
-  pyqtwebengine = callPackage ../development/python-modules/pyqtwebengine { };
+  pyqtwebengine = callPackage ../development/python-modules/pyqtwebengine {
+    inherit (pkgs) mesa;
+  };
 
   pyquaternion = callPackage ../development/python-modules/pyquaternion { };
 
diff --git a/shell.nix b/shell.nix
index 6de2ff12daac..b239adde821b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -19,7 +19,7 @@ let
   inherit (import ./ci { inherit nixpkgs system; }) pkgs fmt;
 
   # For `nix-shell -A hello`
-  curPkgs = builtins.removeAttrs (import ./. { inherit system; }) [
+  curPkgs = removeAttrs (import ./. { inherit system; }) [
     # Although this is what anyone may expect from a `_type = "pkgs"`,
     # this file is intended to produce a shell in the first place,
     # and a `_type` tag could confuse some code.