diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index ff4ec21f6173..63153c27fb6a 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -343,7 +343,7 @@
   add `vimPlugins.notmuch-vim` to your (Neo)vim configuration if you want the
   vim plugin.
 
-- `prisma` and `prisma-engines` have been updated to version 6.6.0, which
+- `prisma` and `prisma-engines` have been updated to version 6.7.0, which
   introduces several breaking changes. See the
   [Prisma ORM upgrade guide](https://www.prisma.io/docs/orm/more/upgrade-guides/upgrading-versions/upgrading-to-prisma-6)
   for more information.
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 4518a94b6745..fc6bf84415b8 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -1042,7 +1042,7 @@ rec {
 
     :::
   */
-  mapAttrs' = f: set: listToAttrs (map (attr: f attr set.${attr}) (attrNames set));
+  mapAttrs' = f: set: listToAttrs (mapAttrsToList f set);
 
   /**
     Call a function for each attribute in the given set and return
@@ -1076,7 +1076,7 @@ rec {
 
     :::
   */
-  mapAttrsToList = f: attrs: map (name: f name attrs.${name}) (attrNames attrs);
+  mapAttrsToList = f: attrs: attrValues (mapAttrs f attrs);
 
   /**
     Deconstruct an attrset to a list of name-value pairs as expected by [`builtins.listToAttrs`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-listToAttrs).
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d3a37551a273..55d3c017e5dd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1996,6 +1996,12 @@
     githubId = 628387;
     name = "Arian van Putten";
   };
+  arichtman = {
+    email = "ariel@richtman.au";
+    github = "arichtman";
+    githubId = 10679234;
+    name = "Ariel Richtman";
+  };
   arikgrahl = {
     email = "mail@arik-grahl.de";
     github = "arikgrahl";
@@ -2677,6 +2683,12 @@
     githubId = 31864305;
     name = "William Hai";
   };
+  baileylu = {
+    name = "Luke Bailey";
+    email = "baileylu@tcd.ie";
+    github = "baileyluTCD";
+    githubId = 156000062;
+  };
   baitinq = {
     email = "manuelpalenzuelamerino@gmail.com";
     name = "Baitinq";
@@ -18105,6 +18117,12 @@
     githubId = 49906709;
     name = "Dakota";
   };
+  ohheyrj = {
+    email = "richard+nix@ohheyrj.co.uk";
+    github = "ohheyrj";
+    name = "ohheyrj";
+    githubId = 5339261;
+  };
   oida = {
     email = "oida@posteo.de";
     github = "oida";
diff --git a/nixos/modules/services/networking/strongswan-swanctl/param-lib.nix b/nixos/modules/services/networking/strongswan-swanctl/param-lib.nix
index 1619cb6cf089..b8a46d5150bc 100644
--- a/nixos/modules/services/networking/strongswan-swanctl/param-lib.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/param-lib.nix
@@ -89,7 +89,7 @@ rec {
     in
     recurse [ ] set;
 
-  mapAttrs'' = f: set: foldl' (a: b: a // b) { } (map (attr: f attr set.${attr}) (attrNames set));
+  mapAttrs'' = f: set: foldl' (a: b: a // b) { } (mapAttrsToList f set);
 
   # Extract the options from the given set of parameters.
   paramsToOptions = ps: mapParamsRecursive (_path: name: param: { ${name} = param.option; }) ps;
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index 2cf3a4aa89ce..e15797765462 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -65,6 +65,7 @@ let
 
   iso =
     (import ../lib/eval-config.nix {
+      system = null;
       modules = [
         ../modules/installer/cd-dvd/installation-cd-minimal.nix
         ../modules/testing/test-instrumentation.nix
@@ -74,6 +75,7 @@ let
 
   sd =
     (import ../lib/eval-config.nix {
+      system = null;
       modules = [
         ../modules/installer/sd-card/sd-image-x86_64.nix
         ../modules/testing/test-instrumentation.nix
@@ -111,6 +113,7 @@ let
     let
       config =
         (import ../lib/eval-config.nix {
+          system = null;
           modules = [
             ../modules/installer/netboot/netboot.nix
             ../modules/testing/test-instrumentation.nix
diff --git a/nixos/tests/ec2.nix b/nixos/tests/ec2.nix
index 6040e9320d8f..b83d7e150207 100644
--- a/nixos/tests/ec2.nix
+++ b/nixos/tests/ec2.nix
@@ -12,6 +12,7 @@ with import common/ec2.nix { inherit makeTest pkgs; };
 let
   imageCfg =
     (import ../lib/eval-config.nix {
+      system = null;
       modules = [
         ../maintainers/scripts/ec2/amazon-image.nix
         ../modules/testing/test-instrumentation.nix
diff --git a/nixos/tests/image-contents.nix b/nixos/tests/image-contents.nix
index a13eb425efa9..bfa4f08adc40 100644
--- a/nixos/tests/image-contents.nix
+++ b/nixos/tests/image-contents.nix
@@ -14,6 +14,7 @@ with import common/ec2.nix { inherit makeTest pkgs; };
 let
   config =
     (import ../lib/eval-config.nix {
+      system = null;
       modules = [
         ../modules/testing/test-instrumentation.nix
         ../modules/profiles/qemu-guest.nix
diff --git a/nixos/tests/openstack-image.nix b/nixos/tests/openstack-image.nix
index e0b99be6e4dc..83c34fefef1f 100644
--- a/nixos/tests/openstack-image.nix
+++ b/nixos/tests/openstack-image.nix
@@ -12,6 +12,7 @@ with import common/ec2.nix { inherit makeTest pkgs; };
 let
   image =
     (import ../lib/eval-config.nix {
+      system = null;
       modules = [
         ../maintainers/scripts/openstack/openstack-image.nix
         ../modules/testing/test-instrumentation.nix
diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index 0e36e00e6b26..2e35d160f533 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -26,6 +26,7 @@ import ./make-test-python.nix (
 
     containerSystem =
       (import ../lib/eval-config.nix {
+        system = null;
         modules = [ container ];
       }).config.system.build.toplevel;
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 06f92e7ca10d..069972b55c15 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -11323,6 +11323,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  nvim-vtsls = buildVimPlugin {
+    pname = "nvim-vtsls";
+    version = "2025-04-27";
+    src = fetchFromGitHub {
+      owner = "yioneko";
+      repo = "nvim-vtsls";
+      rev = "60b493e641d3674c030c660cabe7a2a3f7a914be";
+      sha256 = "00qj7b70afpgxmb6ml4knjwdwcn29yk8mvsb575b6ww9zsxh34il";
+    };
+    meta.homepage = "https://github.com/yioneko/nvim-vtsls/";
+    meta.hydraPlatforms = [ ];
+  };
+
   nvim-whichkey-setup-lua = buildVimPlugin {
     pname = "nvim-whichkey-setup.lua";
     version = "2021-04-16";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index eed2ed3c52c8..80661c30f724 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -120,6 +120,8 @@
   websocat,
   # luau-lsp-nvim dependencies
   luau-lsp,
+  # nvim-vstsl dependencies
+  vtsls,
 }:
 self: super:
 let
@@ -2591,6 +2593,11 @@ in
     nvimSkipModules = "client.client";
   };
 
+  nvim-vtsls = super.nvim-vtsls.overrideAttrs {
+    runtimeDeps = [ vtsls ];
+    dependencies = [ self.nvim-lspconfig ];
+  };
+
   nvzone-menu = super.nvzone-menu.overrideAttrs {
     checkInputs = with self; [
       # Optional integrations
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index a023288461b2..65b55ee08c1b 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -869,6 +869,7 @@ https://github.com/joosepalviste/nvim-ts-context-commentstring/,,
 https://github.com/kevinhwang91/nvim-ufo/,HEAD,
 https://github.com/samjwill/nvim-unception/,HEAD,
 https://github.com/chrisgrieser/nvim-various-textobjs/,HEAD,
+https://github.com/yioneko/nvim-vtsls/,HEAD,
 https://github.com/AckslD/nvim-whichkey-setup.lua/,,
 https://github.com/s1n7ax/nvim-window-picker/,HEAD,
 https://github.com/roxma/nvim-yarp/,,
diff --git a/pkgs/applications/editors/vscode/extensions/budparr.language-hugo-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/budparr.language-hugo-vscode/default.nix
new file mode 100644
index 000000000000..b1fb184bc7d5
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/budparr.language-hugo-vscode/default.nix
@@ -0,0 +1,20 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "language-hugo-vscode";
+    publisher = "budparr";
+    version = "1.3.1";
+    hash = "sha256-9dp8/gLAb8OJnmsLVbOAKAYZ5whavPW2Ak+WhLqEbJk=";
+  };
+
+  meta = {
+    description = "Adds syntax highlighting and snippets to Hugo files in VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=budparr.language-hugo-vscode";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.ohheyrj ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3e6801d29efb..487c0c39e68e 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -824,6 +824,8 @@ let
         };
       };
 
+      budparr.language-hugo-vscode = callPackage ./budparr.language-hugo-vscode { };
+
       bungcip.better-toml = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "better-toml";
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 1b75ed42beab..f33b25035fea 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "17.11.1",
-  "repo_hash": "1sw1qw1fsxvdyzc48f03p89njklm3zn7fd090jjryr881fpcvgcd",
+  "version": "17.11.2",
+  "repo_hash": "1jaxqchqag6q0c4vmrpwnmflv72b2xpskba9b0m4y6w6sy7hqx7q",
   "yarn_hash": "0z06jaxqbg2wnq7yhpkba0cpxp4w4iy2cxla8nhc6kgx49xk179v",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v17.11.1-ee",
+  "rev": "v17.11.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "17.11.1",
-    "GITLAB_PAGES_VERSION": "17.11.1",
+    "GITALY_SERVER_VERSION": "17.11.2",
+    "GITLAB_PAGES_VERSION": "17.11.2",
     "GITLAB_SHELL_VERSION": "14.41.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.5.0",
-    "GITLAB_WORKHORSE_VERSION": "17.11.1"
+    "GITLAB_WORKHORSE_VERSION": "17.11.2"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 871ae6179b88..4aae178ec9c1 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "17.11.1";
+  version = "17.11.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
index 6274999381c3..6cf985973a9d 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@@ -168,7 +168,7 @@ gem 'grape-path-helpers', '~> 2.0.1', feature_category: :api
 gem 'rack-cors', '~> 2.0.1', require: 'rack/cors', feature_category: :shared
 
 # GraphQL API
-gem 'graphql', '2.4.11', path: 'vendor/gems/graphql', feature_category: :api
+gem 'graphql', '2.4.13', feature_category: :api
 gem 'graphql-docs', '~> 5.0.0', group: [:development, :test], feature_category: :api
 gem 'apollo_upload_server', '~> 2.1.6', feature_category: :api
 
@@ -729,7 +729,7 @@ gem 'cvss-suite', '~> 3.3.0', require: 'cvss_suite', feature_category: :software
 gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry
 
 # Remote Development
-gem 'devfile', '~> 0.4.0', feature_category: :workspaces
+gem 'devfile', '~> 0.4.3', feature_category: :workspaces
 
 # Apple plist parsing
 gem 'CFPropertyList', '~> 3.0.0', feature_category: :mobile_devops
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
index 2c630de53cd2..ca362ac5163c 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@@ -170,14 +170,6 @@ PATH
       google-protobuf (~> 3)
       grpc
 
-PATH
-  remote: vendor/gems/graphql
-  specs:
-    graphql (2.4.11)
-      base64
-      fiber-storage
-      logger
-
 PATH
   remote: vendor/gems/mail-smtp_pool
   specs:
@@ -519,7 +511,7 @@ GEM
       thor (>= 0.19, < 2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.4.0)
+    devfile (0.4.3)
     device_detector (1.0.0)
     devise (4.9.4)
       bcrypt (~> 3.0)
@@ -939,6 +931,10 @@ GEM
       grape
       rack
     graphlyte (1.0.0)
+    graphql (2.4.13)
+      base64
+      fiber-storage
+      logger
     graphql-docs (5.0.0)
       commonmarker (~> 0.23, >= 0.23.6)
       escape_utils (~> 1.2)
@@ -2053,7 +2049,7 @@ DEPENDENCIES
   declarative_policy (~> 1.1.0)
   deprecation_toolkit (~> 1.5.1)
   derailed_benchmarks
-  devfile (~> 0.4.0)
+  devfile (~> 0.4.3)
   device_detector
   devise (~> 4.9.3)
   devise-pbkdf2-encryptable (~> 0.0.0)!
@@ -2152,7 +2148,7 @@ DEPENDENCIES
   grape-swagger-entity (~> 0.5.5)
   grape_logging (~> 1.8, >= 1.8.4)
   graphlyte (~> 1.0.0)
-  graphql (= 2.4.11)!
+  graphql (= 2.4.13)
   graphql-docs (~> 5.0.0)
   grpc (= 1.63.0)
   gssapi (~> 1.3.1)
diff --git a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
index 3e7fa71bfc8d..ce146b975865 100644
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@@ -1623,10 +1623,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1yca2rd1xb9h3his5kpnawjgki2rpgslchrn44imhig9v8l7fnw8";
+      sha256 = "1zblvpxzb8qp17dn7sjnfqs6iw3yyzv2cwvnhzrzgxj8k0d0ddjs";
       type = "gem";
     };
-    version = "0.4.0";
+    version = "0.4.3";
   };
   device_detector = {
     groups = [ "default" ];
@@ -3843,10 +3843,11 @@ src: {
     ];
     platforms = [ ];
     source = {
-      path = "${src}/vendor/gems/graphql";
-      type = "path";
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17dayn5422rnbaqs33dnl8d9jw7acpn6cg88z2awk4scwblvc7gv";
+      type = "gem";
     };
-    version = "2.4.11";
+    version = "2.4.13";
   };
   graphql-docs = {
     dependencies = [
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 9079cff7bb1a..7491e567260c 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -1031,12 +1031,14 @@ rec {
       let
         keepAttrs = names: lib.filterAttrs (name: val: lib.elem name names);
         # enables tools like nix-update to determine what src attributes to replace
-        extraPassthru = keepAttrs [
-          "rev"
-          "tag"
-          "url"
-          "outputHash"
-        ] src;
+        extraPassthru = lib.optionalAttrs (lib.isAttrs src) (
+          keepAttrs [
+            "rev"
+            "tag"
+            "url"
+            "outputHash"
+          ] src
+        );
       in
       stdenvNoCC.mkDerivation (
         {
diff --git a/pkgs/by-name/br/brogue/fix-compilation.diff b/pkgs/by-name/br/brogue/fix-compilation.diff
new file mode 100644
index 000000000000..e68f6fcafcc1
--- /dev/null
+++ b/pkgs/by-name/br/brogue/fix-compilation.diff
@@ -0,0 +1,38 @@
+diff --git a/src/brogue/Architect.c b/src/brogue/Architect.c
+index abe5acf..b38291d 100755
+--- a/src/brogue/Architect.c
++++ b/src/brogue/Architect.c
+@@ -1676,7 +1676,7 @@ void addMachines() {
+     // Add the amulet holder if it's depth 26:
+     if (rogue.depthLevel == AMULET_LEVEL) {
+         for (failsafe = 50; failsafe; failsafe--) {
+-            if (buildAMachine(MT_AMULET_AREA, -1, -1, NULL, NULL, NULL, NULL)) {
++            if (buildAMachine(MT_AMULET_AREA, -1, -1, 0L, NULL, NULL, NULL)) {
+                 break;
+             }
+         }
+diff --git a/src/brogue/RogueMain.c b/src/brogue/RogueMain.c
+index 49b08b9..3666963 100755
+--- a/src/brogue/RogueMain.c
++++ b/src/brogue/RogueMain.c
+@@ -880,7 +880,7 @@ void startLevel(short oldLevelNumber, short stairDirection) {
+             getQualifyingPathLocNear(&loc[0], &loc[1],
+                                      player.xLoc, player.yLoc,
+                                      true,
+-                                     T_DIVIDES_LEVEL, NULL,
++                                     T_DIVIDES_LEVEL, 0L,
+                                      T_PATHING_BLOCKER, (HAS_MONSTER | HAS_ITEM | HAS_STAIRS | IS_IN_MACHINE),
+                                      false);
+         }
+diff --git a/src/platform/platformdependent.c b/src/platform/platformdependent.c
+index 635a738..e725513 100644
+--- a/src/platform/platformdependent.c
++++ b/src/platform/platformdependent.c
+@@ -21,6 +21,7 @@
+  *  along with Brogue.  If not, see <http://www.gnu.org/licenses/>.
+  */
+ 
++#include <ctype.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <time.h>
diff --git a/pkgs/by-name/br/brogue/package.nix b/pkgs/by-name/br/brogue/package.nix
index c450b7c0ab5f..f3891abbd5ef 100644
--- a/pkgs/by-name/br/brogue/package.nix
+++ b/pkgs/by-name/br/brogue/package.nix
@@ -14,9 +14,11 @@ stdenv.mkDerivation (finalAttrs: {
   version = "1.7.5";
 
   src = fetchurl {
-    url = "https://sites.google.com/site/broguegame/brogue-${finalAttrs.version}-linux-amd64.tbz2";
-    sha256 = "0i042zb3axjf0cpgpdh8hvfn66dbfizidyvw0iymjk2n760z2kx7";
+    url = "https://drive.google.com/uc?export=download&id=1ED_2nPubP-P0e_PHKYVzZF42M1Y9pUb4";
+    hash = "sha256-p0/xgTlWTFl9BHz7Fn90qxlj3YYItvsuA052NdYXBEQ=";
+    name = "brogue.tbz2";
   };
+
   patches = [
     # Pull upstream fix for -fno-common toolchains:
     #  https://github.com/tmewett/BrogueCE/pull/63
@@ -25,6 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/tmewett/BrogueCE/commit/2c7ed0c48d9efd06bf0a2589ba967c0a22a8fa87.patch";
       sha256 = "19lr2fa25dh79klm4f4kqyyqq7w5xmw9z0fvylkcckqvcv7dwhp3";
     })
+    # error: passing argument 4 of 'buildAMachine' makes integer from pointer without a cast []
+    ./fix-compilation.diff
   ];
 
   prePatch = ''
diff --git a/pkgs/by-name/ca/cargo-lambda/package.nix b/pkgs/by-name/ca/cargo-lambda/package.nix
index 6377cfbbae2c..ff0b0a820001 100644
--- a/pkgs/by-name/ca/cargo-lambda/package.nix
+++ b/pkgs/by-name/ca/cargo-lambda/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-lambda";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "cargo-lambda";
     repo = "cargo-lambda";
     tag = "v${version}";
-    hash = "sha256-v4QWHbgxzizB1Za2jRi0YxCCqnympHGzOioNFk0DED4=";
+    hash = "sha256-iYfm7/XbLThtEo+zSW8sn7T6XEhzyiVKy6/cisshc+Y=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-MTI+ESP0DLGjNoVZjMCpD2IXxkP7IXpB3AlSTpUf3rM=";
+  cargoHash = "sha256-mCD3Szbl5BXknTWJhm2xlcIV0aKczsEi8yRDA4erTYc=";
 
   nativeCheckInputs = [ cacert ];
 
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 2d337c911b99..1c3313ba1f6d 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -2,12 +2,15 @@
   lib,
   buildNpmPackage,
   fetchzip,
+  nodejs_20,
 }:
 
 buildNpmPackage rec {
   pname = "claude-code";
   version = "0.2.101";
 
+  nodejs = nodejs_20;
+
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
     hash = "sha256-rz5SNDj0amXZ32pCuCSHkG08fhi9j8H7JKOl4RYFIrM=";
diff --git a/pkgs/by-name/es/esdm/package.nix b/pkgs/by-name/es/esdm/package.nix
index 176bdf1a07fc..47ec9b4ff7a3 100644
--- a/pkgs/by-name/es/esdm/package.nix
+++ b/pkgs/by-name/es/esdm/package.nix
@@ -23,13 +23,13 @@
   drngChaCha20 ? false, # set the default drng callback
   ais2031 ? false, # set the seeding strategy to be compliant with AIS 20/31
   sp80090c ? false, # set compliance with NIST SP800-90C
-  cryptoBackend ? "botan", # set backend for hash and drbg operations
+  cryptoBackend ? "builtin", # set backend for hash and drbg operations
   linuxDevFiles ? true, # enable linux /dev/random and /dev/urandom support
   linuxGetRandom ? true, # enable linux getrandom support
   hashSha512 ? false, # set the conditioning hash: SHA2-512
   hashSha3_512 ? true, # set the conditioning hash: SHA3-512
-  openSSLRandProvider ? true, # build ESDM provider for OpenSSL 3.x
-  botanRng ? true, # build ESDM class for Botan 3.x
+  openSSLRandProvider ? false, # build ESDM provider for OpenSSL 3.x
+  botanRng ? false, # build ESDM class for Botan 3.x
 
   # client-related options (handle with care, consult source code and meson options)
   # leave as is if in doubt
@@ -56,10 +56,7 @@
 
 assert drngHashDrbg != drngChaCha20;
 assert hashSha512 != hashSha3_512;
-assert
-  cryptoBackend == "openssl"
-  || cryptoBackend == "botan"
-  || cryptoBackend == "builtin" "Unsupported ESDM crypto backend";
+assert cryptoBackend == "openssl" || cryptoBackend == "botan" || cryptoBackend == "builtin";
 
 stdenv.mkDerivation rec {
   pname = "esdm";
diff --git a/pkgs/by-name/fa/faudio/package.nix b/pkgs/by-name/fa/faudio/package.nix
index 64b8c69ca56e..4bc13c6f2c03 100644
--- a/pkgs/by-name/fa/faudio/package.nix
+++ b/pkgs/by-name/fa/faudio/package.nix
@@ -3,32 +3,32 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  SDL2,
+  sdl3,
 }:
 
 #TODO: tests
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "faudio";
-  version = "25.02";
+  version = "25.04";
 
   src = fetchFromGitHub {
     owner = "FNA-XNA";
     repo = "FAudio";
-    rev = version;
-    sha256 = "sha256-nPU225LLQYN0D1LUsp9XGm2bCcB5WLpD3TcGDiWCe0c=";
+    tag = finalAttrs.version;
+    hash = "sha256-nYpolFizEWCSI/YENViMKDu7ExpFpPivH5RnS7PMfkA=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ SDL2 ];
+  buildInputs = [ sdl3 ];
 
-  meta = with lib; {
+  meta = {
     description = "XAudio reimplementation focusing to develop a fully accurate DirectX audio library";
     homepage = "https://github.com/FNA-XNA/FAudio";
-    changelog = "https://github.com/FNA-XNA/FAudio/releases/tag/${version}";
-    license = licenses.zlib;
-    platforms = platforms.unix;
-    maintainers = [ maintainers.marius851000 ];
+    changelog = "https://github.com/FNA-XNA/FAudio/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.zlib;
+    platforms = lib.platforms.unix;
+    maintainers = [ lib.maintainers.marius851000 ];
   };
-}
+})
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index 7878f424330e..e90970e10460 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -52,6 +52,7 @@
   modemmanager,
   pango,
   polkit,
+  readline,
   sqlite,
   tpm2-tss,
   valgrind,
@@ -130,7 +131,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "2.0.8";
+  version = "2.0.9";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -148,7 +149,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     tag = finalAttrs.version;
-    hash = "sha256-8IFopG/EY/UAB3JSyBJsGmlwGiMufn7rfkeJ9iYfCGU=";
+    hash = "sha256-Izh6PHMgUsOeez9uWSLoA2GhvawYQlEZo480vovxn38=";
   };
 
   patches = [
@@ -237,6 +238,7 @@ stdenv.mkDerivation (finalAttrs: {
       pango
       polkit
       protobufc
+      readline
       sqlite
       tpm2-tss
       valgrind
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 86f34db40aa4..af7a4f5e75d7 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "17.11.1";
+  version = "17.11.2";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-8PDCHAZrFs+4G4K0wAgE0AsOp4hlL+5uGb7qVJjuzqg=";
+      hash = "sha256-Ihw3Mezfz9H19oGM7X9B50aUbyh1JjDOmVU5ZNoiWug=";
     };
 
     vendorHash = "sha256-ExqgxukFKXq/Z//hGSoDevfpJiNbVHhind63os1/3Fk=";
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 2c34e952b6d6..11c92b5580c0 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule rec {
   pname = "gitlab-container-registry";
-  version = "4.20.0";
+  version = "4.21.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-irMMOjORJY8yVSNBkh7HDYDJv05RDz19f0KAjnF8EWA=";
+    hash = "sha256-EUJRXN/xOxNG6pIvsZ/MvVU7arSphOWdpJK0Qo8JcTY=";
   };
 
-  vendorHash = "sha256-3j58QVLgwjUGX0QzruAbfRNyFmcAD5EApQ3+f212IDU=";
+  vendorHash = "sha256-rAY0lG1ELGO8f6SciEr7F3LL8+fTzlXvUrn4p00v0TI=";
 
   checkFlags =
     let
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 76d4eb64578b..26f78662ec1a 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "17.11.1";
+  version = "17.11.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-rXIHRIFbgK7VLgZ7DjR+kmP6WnYCROSbxzx12KUjXLE=";
+    hash = "sha256-tnswEoocMZXBrS+5toV8IOVs8HcNrTG320ebQqB3XiQ=";
   };
 
   vendorHash = "sha256-jCuLRXr7WHGxbXVg2JB1vp9WiNaLgsIJ6GJSS4QrlwY=";
diff --git a/pkgs/by-name/gr/graphhopper/package.nix b/pkgs/by-name/gr/graphhopper/package.nix
new file mode 100644
index 000000000000..95d3e7e3b4ff
--- /dev/null
+++ b/pkgs/by-name/gr/graphhopper/package.nix
@@ -0,0 +1,152 @@
+{
+  fetchFromGitHub,
+  fetchurl,
+  lib,
+  stdenv,
+  testers,
+
+  jre,
+  makeWrapper,
+  maven,
+  ...
+}:
+let
+  version = builtins.fromTOML (builtins.readFile ./version.toml);
+
+  src = fetchFromGitHub {
+    owner = "graphhopper";
+    repo = "graphhopper";
+    tag = version.patch;
+    hash = version.hash.src;
+  };
+
+  # Patch graphhopper to remove the npm download
+  patches = [ ./remove-npm-dependency.patch ];
+
+  # Graphhopper also relies on a maps bundle downloaded from npm
+  # By default it installs nodejs and npm during the build,
+  # But we patch that out so we much fetch it ourselves
+  mapsBundle = fetchurl {
+    name = "@graphhopper/graphhopper-maps-bundle-${version.mapsBundle}";
+    url = "https://registry.npmjs.org/@graphhopper/graphhopper-maps-bundle/-/graphhopper-maps-bundle-${version.mapsBundle}.tgz";
+    hash = version.hash.mapsBundle;
+  };
+
+  # We cannot use `buildMavenPackage` as we need to load in the
+  # mapsBundle before doing anything
+  mvnDeps = stdenv.mkDerivation {
+    name = "graphhopper-dependencies";
+
+    inherit src patches;
+
+    buildInputs = [ maven ];
+
+    buildPhase = ''
+      # Fetching deps with mvn dependency:go-offline does not quite catch everything, so we use this plugin instead
+      mvn de.qaware.maven:go-offline-maven-plugin:resolve-dependencies \
+        -Dmaven.repo.local=$out/.m2 \
+        -Dmaven.wagon.rto=5000
+    '';
+
+    installPhase = ''
+      # keep only *.{pom,jar,sha1,nbm} and delete all ephemeral files with lastModified timestamps inside
+      find $out -type f \( \
+        -name \*.lastUpdated \
+        -o -name resolver-status.properties \
+        -o -name _remote.repositories \) \
+        -delete
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = version.hash.mvnDeps;
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "graphhopper";
+
+  inherit src patches;
+
+  version = version.patch;
+
+  buildInputs = [
+    makeWrapper
+    maven
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    mkdir -p ./web-bundle/target/
+    ln -s ${mapsBundle} ./web-bundle/target/graphhopper-graphhopper-maps-bundle-${version.mapsBundle}.tgz
+
+    runHook postConfigure
+  '';
+
+  # Build and skip tests because downloading of
+  # test deps seems to not work with the go-offline plugin
+  buildPhase = ''
+    runHook preBuild
+
+    mvn package --offline \
+      -Dmaven.repo.local=${mvnDeps}/.m2 \
+      -DskipTests
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    ln -s ${mvnDeps}/.m2 $out/lib
+
+    # Grapphopper versions are seemingly compiled under the major release name,
+    # not the patch name, which is the version we want for our package
+    cp ./web/target/graphhopper-web-${version.major}-SNAPSHOT.jar $out/bin/graphhopper-web-${version.major}-SNAPSHOT.jar
+
+    makeWrapper ${jre}/bin/java $out/bin/graphhopper \
+      --add-flags "-jar $out/bin/graphhopper-web-${version.major}-SNAPSHOT.jar" \
+      --chdir $out
+
+    runHook postInstall
+  '';
+
+  fixupPhase = ''
+    runHook preFixup
+
+    # keep only *.{pom,jar,sha1,nbm} and delete all ephemeral files with lastModified timestamps inside
+    find $out -type f \( \
+      -name \*.lastUpdated \
+      -o -name resolver-status.properties \
+      -o -name _remote.repositories \) \
+      -delete
+
+    runHook postFixup
+  '';
+
+  meta = {
+    description = "Fast and memory-efficient routing engine for OpenStreetMap";
+    homepage = "https://www.graphhopper.com/";
+    changelog = "https://github.com/graphhopper/graphhopper/releases/tag/${version.patch}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ baileylu ];
+    teams = [ lib.teams.geospatial ];
+    platforms = lib.platforms.all;
+    mainProgram = "graphhopper";
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode
+    ];
+  };
+
+  passthru = {
+    updateScript = ./update.nu;
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      # `graphhopper --version` does not work as the source does not specify `Implementation-Version`
+      command = "graphhopper --help";
+      version = "graphhopper-web-${version.major}-SNAPSHOT.jar";
+    };
+  };
+})
diff --git a/pkgs/by-name/gr/graphhopper/remove-npm-dependency.patch b/pkgs/by-name/gr/graphhopper/remove-npm-dependency.patch
new file mode 100644
index 000000000000..5970af9db017
--- /dev/null
+++ b/pkgs/by-name/gr/graphhopper/remove-npm-dependency.patch
@@ -0,0 +1,55 @@
+From ad687709cfca51603264ff565f296cfb5dceb15a Mon Sep 17 00:00:00 2001
+From: Luke Bailey <baileylu@tcd.ie>
+Date: Wed, 19 Mar 2025 22:25:44 +0000
+Subject: [PATCH] Swap out frontend maven plugin which downloads npm
+ for fetching it through nix instead
+
+---
+ web-bundle/pom.xml | 31 -------------------------------
+ 1 file changed, 31 deletions(-)
+
+diff --git a/web-bundle/pom.xml b/web-bundle/pom.xml
+index 9a4d83b62..1d995cbaf 100644
+--- a/web-bundle/pom.xml
++++ b/web-bundle/pom.xml
+@@ -129,37 +129,6 @@
+ 
+     <build>
+         <plugins>
+-            <plugin>
+-                <groupId>com.github.eirslett</groupId>
+-                <artifactId>frontend-maven-plugin</artifactId>
+-                <version>1.12.1</version>
+-                <executions>
+-                    <execution>
+-                        <id>install node and npm</id>
+-                        <goals>
+-                            <goal>install-node-and-npm</goal>
+-                        </goals>
+-                        <configuration>
+-                            <nodeVersion>v20.14.0</nodeVersion>
+-                            <npmVersion>10.7.0</npmVersion>
+-                        </configuration>
+-                    </execution>
+-                    <execution>
+-                        <id>download graphhopper maps</id>
+-                        <phase>generate-resources</phase>
+-                        <goals>
+-                            <goal>npm</goal>
+-                        </goals>
+-                        <configuration>
+-                            <!--suppress UnresolvedMavenProperty (IntelliJ shows an error otherwise...)-->
+-                            <arguments>
+-                                pack --pack-destination=${basedir}/target
+-                                @graphhopper/graphhopper-maps-bundle@${graphhopper-maps.version}
+-                            </arguments>
+-                        </configuration>
+-                    </execution>
+-                </executions>
+-            </plugin>
+             <plugin>
+                 <artifactId>maven-antrun-plugin</artifactId>
+                 <executions>
+-- 
+2.48.1
+
diff --git a/pkgs/by-name/gr/graphhopper/update.nu b/pkgs/by-name/gr/graphhopper/update.nu
new file mode 100755
index 000000000000..80a27b5106ed
--- /dev/null
+++ b/pkgs/by-name/gr/graphhopper/update.nu
@@ -0,0 +1,102 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i nu -p nushell nix-prefetch-github common-updater-scripts
+
+use std/log
+
+let version_info = "./pkgs/by-name/gr/graphhopper/version.toml"
+
+let current_version = open $version_info
+
+let latest_tag = list-git-tags --url=https://github.com/graphhopper/graphhopper
+    | lines
+    | sort --natural
+    | where ($it =~ '^[\d.]+$')
+    | last
+
+if $current_version.patch == $latest_tag {
+    log debug "Current graphhopper version matched latest version of graphhopper, no update is needed, exiting..."
+    exit 0
+}
+
+let major = $latest_tag
+    | str replace -ar '(\d+)\.\d+' '$1.0'
+
+log debug $"Fetching source for graphhopper patch ($latest_tag) on version ($major)"
+let source = nix-prefetch-github graphhopper graphhopper --rev $latest_tag
+    | from json
+
+log debug $"Reading maps bundle version for ($latest_tag)"
+let web_bundle_pom = http get $"https://api.github.com/repos/graphhopper/graphhopper/contents/web-bundle/pom.xml?ref=($latest_tag)"
+    | $in.content
+    | base64 --decode
+    | into string
+    | from xml
+
+let maps_bundle_properties = $web_bundle_pom.content
+    | where ($it.tag =~ "properties")
+    | first
+
+let maps_bundle_version = $maps_bundle_properties.content
+    | where ($it.tag =~ "graphhopper-maps.version")
+    | first
+    | $in.content
+    | first
+    | $in.content
+
+log debug $"Fetching maps bundle ($maps_bundle_version)"
+let maps_bundle_hash = nix-prefetch-url $"https://registry.npmjs.org/@graphhopper/graphhopper-maps-bundle/-/graphhopper-maps-bundle-($maps_bundle_version).tgz"
+    | nix-hash --type sha256 --to-base64 $in
+    | ["sha256-", $in]
+    | str join
+
+log debug $"Writing to ($version_info) without mvnDeps hash..."
+
+{
+    major: $major,
+    patch: $latest_tag,
+    mapsBundle: $maps_bundle_version,
+
+    hash: {
+        src: $source.hash
+        mapsBundle: $maps_bundle_hash
+        mvnDeps: "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+    }
+}
+    | to toml
+    | save $version_info -f
+
+log debug "Calculating mvnDeps hash..."
+let graphhopper_build_logs = nix-build -A graphhopper o+e>| cat
+
+let mvn_hash_lines = $graphhopper_build_logs
+    | lines
+    | find "got:"
+
+if ($mvn_hash_lines | length) == 0 {
+    log error $"Could not find any maven hash in the graphhopper build logs - maybe a different error occurred: \n$($graphhopper_build_logs)"
+    exit 1
+}
+
+log debug $"Found relevant hash lines: ($mvn_hash_lines)"
+let mvn_hash = $mvn_hash_lines
+    | first
+    | ansi strip
+    | str replace 'got:' ''
+    | str trim
+
+log debug $"Writing to ($version_info) with mvnDeps hash ($mvn_hash).."
+{
+    major: $major,
+    patch: $latest_tag,
+    mapsBundle: $maps_bundle_version,
+
+    hash: {
+        src: $source.hash
+        mapsBundle: $maps_bundle_hash
+        mvnDeps: $mvn_hash
+    }
+}
+    | to toml
+    | save $version_info -f
+
+log debug $"Successfully updated graphhopper package!"
diff --git a/pkgs/by-name/gr/graphhopper/version.toml b/pkgs/by-name/gr/graphhopper/version.toml
new file mode 100644
index 000000000000..3bd74b1906c9
--- /dev/null
+++ b/pkgs/by-name/gr/graphhopper/version.toml
@@ -0,0 +1,8 @@
+major = "10.0"
+patch = "10.2"
+mapsBundle = "0.0.0-4718098d1db1798841a4d12f1727e8e8f7eab202"
+
+[hash]
+src = "sha256-E6G9JR1lrXhNJ4YgMM0n0RsQcMZQM2QldGc74f5FALo="
+mapsBundle = "sha256-jZTNJfmMWJQHpJ8um3yTBx/KtIfdr0EwKJ9kSFalWJQ="
+mvnDeps = "sha256-KidbIBnW//IiKPFy3plFWOED8gP/ZCg4buwMgzttaY8="
diff --git a/pkgs/by-name/hf/hfst/package.nix b/pkgs/by-name/hf/hfst/package.nix
index 47c17f0cf0be..14fc07ed8aae 100644
--- a/pkgs/by-name/hf/hfst/package.nix
+++ b/pkgs/by-name/hf/hfst/package.nix
@@ -11,17 +11,18 @@
   swig,
   pkg-config,
   zlib,
+  openfst,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hfst";
-  version = "3.16.0";
+  version = "3.16.2";
 
   src = fetchFromGitHub {
     owner = "hfst";
     repo = "hfst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2ST0s08Pcp+hTn7rUTgPE1QkH6PPWtiuFezXV3QW0kU=";
+    hash = "sha256-Vp9rSQYNK991fCoEcW7tpVxCOemW2RFt0LujLGHFGVQ=";
   };
 
   nativeBuildInputs = [
@@ -37,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
     icu
     zlib
+    openfst
   ];
 
   configureFlags = [
diff --git a/pkgs/by-name/ju/jujutsu/package.nix b/pkgs/by-name/ju/jujutsu/package.nix
index 97b9eb729fc8..6a46439566f6 100644
--- a/pkgs/by-name/ju/jujutsu/package.nix
+++ b/pkgs/by-name/ju/jujutsu/package.nix
@@ -18,18 +18,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jujutsu";
-  version = "0.28.2";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "jj-vcs";
     repo = "jj";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EAD40ZZr6VK4w9OuYzx2YcVgOODopF7IWN7GVjTlblE=";
+    hash = "sha256-jyhjKppwK+emwLEXtOJKU0f4mPdLzDrQabnHhpyUzmw=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-WOzzBhZLV4kfsmTGreg1m+sPcDjznB4Kh8ONVNZkp5A=";
+  cargoHash = "sha256-1bb7YWXExS62s83rprHa0byUBJUCdw6JDYkQ3VZcje8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ku/kubectl-kcl/package.nix b/pkgs/by-name/ku/kubectl-kcl/package.nix
new file mode 100644
index 000000000000..e40f848e88dd
--- /dev/null
+++ b/pkgs/by-name/ku/kubectl-kcl/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "kubectl-kcl";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "kcl-lang";
+    repo = "kubectl-kcl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yuNQSO1xQCb5H55mOUTVrojeWWkDOmAGJIzUs6qCWO4=";
+  };
+
+  vendorHash = "sha256-GD4C4jlxVMpJ/bhpQ3VDkBMBBQkXyhMMga+WhVdvI/I=";
+
+  ldflags = [
+    "-X kcl-lang.io/kubectl-kcl/cmd.Version=${finalAttrs.version}"
+  ];
+
+  versionCheckProgramArg = [ "version" ];
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Work with Kubernetes manifests using the KCL programming language";
+    mainProgram = "kubectl-kcl";
+    homepage = "https://github.com/kcl-lang/kubectl-kcl";
+    changelog = "https://github.com/kcl-lang/kubectl-kcl/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.arichtman ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libepoxy/package.nix b/pkgs/by-name/li/libepoxy/package.nix
index 1a99df8bdf55..236b97dd0511 100644
--- a/pkgs/by-name/li/libepoxy/package.nix
+++ b/pkgs/by-name/li/libepoxy/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  buildInputs =
+  propagatedBuildInputs =
     lib.optionals (x11Support && !stdenv.hostPlatform.isDarwin) [
       libGL
     ]
diff --git a/pkgs/by-name/od/odin/package.nix b/pkgs/by-name/od/odin/package.nix
index 8eb1e0db73d4..6fea6313b0f2 100644
--- a/pkgs/by-name/od/odin/package.nix
+++ b/pkgs/by-name/od/odin/package.nix
@@ -24,9 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     ./darwin-remove-impure-links.patch
   ];
-
   postPatch = ''
-    patchShebangs ./build_odin.sh
+    patchShebangs --build build_odin.sh
   '';
 
   LLVM_CONFIG = lib.getExe' llvmPackages.llvm.dev "llvm-config";
diff --git a/pkgs/by-name/op/openrsync/package.nix b/pkgs/by-name/op/openrsync/package.nix
index 639ffeec28ab..bd7df3bcd42b 100644
--- a/pkgs/by-name/op/openrsync/package.nix
+++ b/pkgs/by-name/op/openrsync/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation {
   pname = "openrsync";
-  version = "unstable-2022-05-08";
+  version = "unstable-2025-01-27";
 
   src = fetchFromGitHub {
     owner = "kristapsdz";
     repo = "openrsync";
-    rev = "f50d0f8204ea18306a0c29c6ae850292ea826995";
-    hash = "sha256-4tygoCQGIM0wqLfdWp55/oOPhD3lPUuTd9/LXQAASXU=";
+    rev = "a257c0f495af2b5ee6b41efc6724850a445f87ed";
+    hash = "sha256-pc1lo8d5FY8/1K2qUWzSlrSnA7jnRg4FQRyHqC8I38k=";
   };
 
   # Uses oconfigure
diff --git a/pkgs/by-name/pd/pdftricks/package.nix b/pkgs/by-name/pd/pdftricks/package.nix
new file mode 100644
index 000000000000..4ad66a2ff843
--- /dev/null
+++ b/pkgs/by-name/pd/pdftricks/package.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  pkg-config,
+  vala,
+  gtk3,
+  wrapGAppsHook3,
+  pantheon,
+  ninja,
+  ghostscript,
+  makeWrapper,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pdftricks";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "muriloventuroso";
+    repo = "pdftricks";
+    tag = finalAttrs.version;
+    hash = "sha256-l4Xg4Uk520qoaEo8UxdLE8MfpVkRj/bpGBzL5HwdDUo=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    vala
+    wrapGAppsHook3
+    ninja
+    makeWrapper
+  ];
+
+  buildInputs = [
+    gtk3
+    pantheon.granite
+    ghostscript
+  ];
+
+  preFixup = ''
+    wrapProgram $out/bin/com.github.muriloventuroso.pdftricks \
+      --prefix PATH : ${lib.makeBinPath [ ghostscript ]} \
+      ''${gappsWrapperArgs[@]}
+  '';
+
+  dontWrapGApps = true;
+
+  postPatch = ''
+    # Remove positional arguments that cause errors
+    substituteInPlace data/meson.build \
+      --replace-fail "'desktop'," "" \
+      --replace-fail "'appdata'," ""
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple, efficient application for small manipulations in PDF files using Ghostscript";
+    homepage = "https://github.com/muriloventuroso/pdftricks";
+    changelog = "https://github.com/muriloventuroso/pdftricks/releases";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ theobori ];
+    platforms = lib.platforms.linux;
+    mainProgram = "com.github.muriloventuroso.pdftricks";
+  };
+})
diff --git a/pkgs/by-name/pr/prisma-engines/package.nix b/pkgs/by-name/pr/prisma-engines/package.nix
index 407e53dc3ae2..86518ccecf5c 100644
--- a/pkgs/by-name/pr/prisma-engines/package.nix
+++ b/pkgs/by-name/pr/prisma-engines/package.nix
@@ -13,17 +13,17 @@
 # function correctly.
 rustPlatform.buildRustPackage rec {
   pname = "prisma-engines";
-  version = "6.6.0";
+  version = "6.7.0";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma-engines";
     rev = version;
-    hash = "sha256-moonBNNGWECGPvhyyeHKKAQRXj5lNP0k99JB+1POMUE=";
+    hash = "sha256-Ty8BqWjZluU6a5xhSAVb2VoTVY91UUj6zoVXMKeLO4o=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-BiSo3BgVxiPAfSIPUv0SqH+XgU1Vh4wws0set4cLzDU=";
+  cargoHash = "sha256-HjDoWa/JE6izUd+hmWVI1Yy3cTBlMcvD9ANsvqAoHBI=";
 
   # Use system openssl.
   OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/pr/prisma/package.nix b/pkgs/by-name/pr/prisma/package.nix
index c8870307f989..d82d9a8fa5ff 100644
--- a/pkgs/by-name/pr/prisma/package.nix
+++ b/pkgs/by-name/pr/prisma/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prisma";
-  version = "6.6.0";
+  version = "6.7.0";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma";
     rev = finalAttrs.version;
-    hash = "sha256-AywqYcXzTWaedfHEH2LIaJUv80KFvd7sdADkivLRf5Y=";
+    hash = "sha256-ts7HvQbbBFzLRr7uamo95rDnJuDHsAu2CE/pKkJwcX4=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Uc4/iePIaHHXBrl66oRwXS9YDbQ5kTpKXa6q9EztbsA=";
+    hash = "sha256-dhEpn0oaqZqeiRMfcSiaqhud/RsKd6Wm5RR5iyQp1I8=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 6f244f6d5040..6887c106486c 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -17,11 +17,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.4.4";
+  version = "25.5.3";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9xRituPXmGQ1fFHp4JvXkQ9Rvoj535UP53G6vDMl1L4=";
+    hash = "sha256-853xxUgRMtnL+frLCmzzGL44xstDwnrEMhYBFpL5hmQ=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/re/redpanda-client/package.nix b/pkgs/by-name/re/redpanda-client/package.nix
index 336f3ef38062..ab01aa553b88 100644
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "25.1.2";
+  version = "25.1.3";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-eivXJrfMf7+EAJr+wpOs9dtC8oiyOGy6AY1DNiNVWWA=";
+    sha256 = "sha256-fdEbZISejvk+3VVLxQd3zpeaXEUg6eR+MUtI+jcgg5g=";
   };
 in
 buildGoModule rec {
diff --git a/pkgs/by-name/su/sudo-rs/package.nix b/pkgs/by-name/su/sudo-rs/package.nix
index b5c24a9a156b..ed9ec2611308 100644
--- a/pkgs/by-name/su/sudo-rs/package.nix
+++ b/pkgs/by-name/su/sudo-rs/package.nix
@@ -8,20 +8,21 @@
   pam,
   pandoc,
   rustPlatform,
+  tzdata,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sudo-rs";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "trifectatechfoundation";
     repo = "sudo-rs";
-    rev = "v${version}";
-    hash = "sha256-apvMcn/1dV9uujyoHikiOxregwWtAFPvrZvYjd3XQwM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vZv3IVSW6N0puoWJBYQPmNntgHPt9SPV07TEuWN/bHw=";
   };
   useFetchCargoVendor = true;
-  cargoHash = "sha256-EAfNg7hUsynFZ+EcUqeD9o44BakBYIMgxRXc4vcl8HY=";
+  cargoHash = "sha256-/CbU2ds2VQ2IXx7GKxRO3vePzLXJXabA1FcyIGPsngw=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -33,8 +34,11 @@ rustPlatform.buildRustPackage rec {
   # Don't attempt to generate the docs in a (pan)Docker container
   postPatch = ''
     substituteInPlace util/generate-docs.sh \
-      --replace "/usr/bin/env bash" ${lib.getExe bash} \
-      --replace util/pandoc.sh pandoc
+      --replace-fail "/usr/bin/env bash" ${lib.getExe bash} \
+      --replace-fail util/pandoc.sh pandoc
+
+    substituteInPlace build.rs \
+      --replace-fail "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
   '';
 
   postInstall = ''
@@ -75,16 +79,19 @@ rustPlatform.buildRustPackage rec {
     tests = nixosTests.sudo-rs;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Memory safe implementation of sudo and su";
     homepage = "https://github.com/trifectatechfoundation/sudo-rs";
-    changelog = "${meta.homepage}/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [
+    changelog = "${finalAttrs.meta.homepage}/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [
       asl20
       mit
     ];
-    maintainers = with maintainers; [ nicoo ];
+    maintainers = with lib.maintainers; [
+      nicoo
+      rvdp
+    ];
     mainProgram = "sudo";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ta/tailwindcss_4/package.nix b/pkgs/by-name/ta/tailwindcss_4/package.nix
index b1d9a336de53..7f783458862c 100644
--- a/pkgs/by-name/ta/tailwindcss_4/package.nix
+++ b/pkgs/by-name/ta/tailwindcss_4/package.nix
@@ -7,7 +7,7 @@
   makeWrapper,
 }:
 let
-  version = "4.1.4";
+  version = "4.1.5";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "tailwindcss has not been packaged for ${system} yet.";
 
@@ -22,10 +22,10 @@ let
 
   hash =
     {
-      aarch64-darwin = "sha256-x7piRWxtlEF3XJDKbwo9+AD4LO3k6SOJ+TRTbejPUuk=";
-      aarch64-linux = "sha256-oUU371GpnBpVw3ZLc7gWgdhP91GXrXZvmmYo1hDPJ08=";
-      x86_64-darwin = "sha256-zQ4adIfAuRip9LLSLTGHUhgeiRi4Z1cLQJCC9pR1zYg=";
-      x86_64-linux = "sha256-D6i7uL7KckL2RVvwG7410wg4ePYwjsSkzsMK7Ra8pG0=";
+      aarch64-darwin = "sha256-j9ogIXTCFNcg6v5J7bra+u18udASidJEYtktLCYDeH4=";
+      aarch64-linux = "sha256-lVXGQUYXwVzIIGeexlQEr5JQfnt3GP0DXSbfBVVh3sk=";
+      x86_64-darwin = "sha256-W7BvnlCSuLx9r0mcdrDOx1GgP+xS4BEdI1wTHNnFyQU=";
+      x86_64-linux = "sha256-nSWKd4bCL4VyrqIO01hI+MvvHQYnfk5rl62FYf/CHgc=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/te/texturepacker/package.nix b/pkgs/by-name/te/texturepacker/package.nix
index d588dc53ddad..61dc23ea5ee6 100644
--- a/pkgs/by-name/te/texturepacker/package.nix
+++ b/pkgs/by-name/te/texturepacker/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "texturepacker";
-  version = "7.6.2";
+  version = "7.6.3";
 
   src = fetchurl {
     url = "https://www.codeandweb.com/download/texturepacker/${finalAttrs.version}/TexturePacker-${finalAttrs.version}.deb";
-    hash = "sha256-CJtUWxjleojjK+LljDbdhSH2FNQfVGMkif/XDRW1Y/k=";
+    hash = "sha256-A1YNy6Y5EdOnV0dY0VN/k7nX26L/uaHqDHmdC5N1Otk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/vifm/package.nix b/pkgs/by-name/vi/vifm/package.nix
index 96bd1f616588..cc76b1097b16 100644
--- a/pkgs/by-name/vi/vifm/package.nix
+++ b/pkgs/by-name/vi/vifm/package.nix
@@ -23,11 +23,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = if isFullPackage then "vifm-full" else "vifm";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchurl {
     url = "https://github.com/vifm/vifm/releases/download/v${version}/vifm-${version}.tar.bz2";
-    hash = "sha256-AfGeEU4p9IHSD6prNaQriDo/SHMk3bL3EHzhwQLEpJY=";
+    hash = "sha256-zRsF0lQ832gp1gsjvCJcb94T0+98EAj4IbkgmDfx4rA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index 063db429efef..f3a0ca6da426 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -148,6 +148,8 @@ python.pkgs.buildPythonApplication rec {
     ++ drf-spectacular.optional-dependencies.sidecar
     ++ drf-standardized-errors.optional-dependencies.openapi;
 
+  pythonRelaxDeps = [ "django-otp-webauthn" ];
+
   optional-dependencies = {
     postgres = with python.pkgs; [ psycopg ];
   };
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index d9889276ff42..f8176221facc 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.7.2",
-    "vscodeVersion": "1.98.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/619323b3cdd4a88a75f3b5fa39dba02c3b9e14a9/Windsurf-darwin-arm64-1.7.2.zip",
-    "sha256": "827998228b949d79bd98d79b9d801b194814df50ded3be01f12bd412a8528edb"
+    "version": "1.8.2",
+    "vscodeVersion": "1.99.1",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/eccc45da0d0c40e57275e0cce7db644c7b1278d8/Windsurf-darwin-arm64-1.8.2.zip",
+    "sha256": "d1d353f6f78b570500546a1a1ee140d195df7497ce3eb946fb159afd0cc34a67"
   },
   "x86_64-darwin": {
-    "version": "1.7.2",
-    "vscodeVersion": "1.98.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/619323b3cdd4a88a75f3b5fa39dba02c3b9e14a9/Windsurf-darwin-x64-1.7.2.zip",
-    "sha256": "1e85088af6888dd0c708e055b6dcc6eb702caf7f5690462462e5eca4304ad665"
+    "version": "1.8.2",
+    "vscodeVersion": "1.99.1",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/eccc45da0d0c40e57275e0cce7db644c7b1278d8/Windsurf-darwin-x64-1.8.2.zip",
+    "sha256": "920ea85cdb98755eeadabf69fa2ed56baf24df7273aa28a1ad7b33f2d4acb862"
   },
   "x86_64-linux": {
-    "version": "1.7.2",
-    "vscodeVersion": "1.98.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/619323b3cdd4a88a75f3b5fa39dba02c3b9e14a9/Windsurf-linux-x64-1.7.2.tar.gz",
-    "sha256": "8d08dbaa44e841f13ff2d76ed125a39547efba93d62e174db8f8bc3d50ef72d6"
+    "version": "1.8.2",
+    "vscodeVersion": "1.99.1",
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/eccc45da0d0c40e57275e0cce7db644c7b1278d8/Windsurf-linux-x64-1.8.2.tar.gz",
+    "sha256": "677793a06575428d95e1ad73a0063580f116c9467c100ca0b218b6a89262ba2b"
   }
 }
diff --git a/pkgs/by-name/xp/xpra/package.nix b/pkgs/by-name/xp/xpra/package.nix
index 3f2ab18d5fc4..3d10311d40c4 100644
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -89,7 +89,7 @@ let
 in
 buildPythonApplication rec {
   pname = "xpra";
-  version = "6.2.5";
+  version = "6.3";
 
   stdenv = if withNvenc then cudaPackages.backendStdenv else args.stdenv;
 
@@ -97,7 +97,7 @@ buildPythonApplication rec {
     owner = "Xpra-org";
     repo = "xpra";
     tag = "v${version}";
-    hash = "sha256-XY8NZhWCRLjpgq0dOClzftvMR7g/X64b+OYyjOGC/lM=";
+    hash = "sha256-m0GafyzblXwLBBn/eoSmcsLz1r4nzFIQzCOXVXvQB8Q=";
   };
 
   patches = [
diff --git a/pkgs/by-name/yy/yyjson/package.nix b/pkgs/by-name/yy/yyjson/package.nix
index 6799d3adf5fe..29f7f98415e3 100644
--- a/pkgs/by-name/yy/yyjson/package.nix
+++ b/pkgs/by-name/yy/yyjson/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yyjson";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "ibireme";
     repo = "yyjson";
     rev = finalAttrs.version;
-    hash = "sha256-mp9Oz08qTyhj3P6F1d81SX96vamUY/JWpD2DTYR+v04=";
+    hash = "sha256-4vdoWoVW+NbC46tFxjdTtjVW77aYGRWENgWZHzUoUQ4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix b/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
index 1b89d3f46d6f..08ef482ed783 100644
--- a/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "deepin-system-monitor";
-  version = "6.5.0";
+  version = "6.5.4";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-UOF0/RBceuRX6AtI1p5qqHhbRDAhA7i0+seOrkAFFgI=";
+    hash = "sha256-xLlWQaoKC+/jgDD9sBikh5Z1QqDuCFcMulo0vqxJM7k=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/botan/default.nix b/pkgs/development/libraries/botan/default.nix
index a5b22730df73..3a380d01e3b1 100644
--- a/pkgs/development/libraries/botan/default.nix
+++ b/pkgs/development/libraries/botan/default.nix
@@ -7,9 +7,23 @@
   bzip2,
   zlib,
   jitterentropy,
+  darwin,
+  esdm,
+  tpm2-tss,
   static ? stdenv.hostPlatform.isStatic, # generates static libraries *only*
+
+  # build ESDM RNG plugin
+  with_esdm ? false,
+  # useful, but have to disable tests for now, as /dev/tpmrm0 is not accessible
+  with_tpm2 ? false,
+  # only allow BSI approved algorithms, FFI and SHAKE for XMSS
+  with_bsi_policy ? false,
+  # only allow NIST approved algorithms
+  with_fips140_policy ? false,
 }:
 
+assert (!with_bsi_policy && !with_fips140_policy) || (with_bsi_policy != with_fips140_policy);
+
 let
   common =
     {
@@ -50,9 +64,14 @@ let
           bzip2
           zlib
         ]
-
+        ++ lib.optionals (stdenv.hostPlatform.isLinux && with_tpm2) [
+          tpm2-tss
+        ]
         ++ lib.optionals (lib.versionAtLeast version "3.6.0") [
           jitterentropy
+        ]
+        ++ lib.optionals (lib.versionAtLeast version "3.7.0" && with_esdm) [
+          esdm
         ];
 
       buildTargets =
@@ -77,8 +96,22 @@ let
         ++ lib.optionals stdenv.cc.isClang [
           "--cc=clang"
         ]
+        ++ lib.optionals (stdenv.hostPlatform.isLinux && with_tpm2) [
+          "--with-tpm2"
+        ]
         ++ lib.optionals (lib.versionAtLeast version "3.6.0") [
           "--enable-modules=jitter_rng"
+        ]
+        ++ lib.optionals (lib.versionAtLeast version "3.7.0" && with_esdm) [
+          "--enable-modules=esdm_rng"
+        ]
+        ++ lib.optionals (lib.versionAtLeast version "3.8.0" && with_bsi_policy) [
+          "--module-policy=bsi"
+          "--enable-module=ffi"
+          "--enable-module=shake"
+        ]
+        ++ lib.optionals (lib.versionAtLeast version "3.8.0" && with_fips140_policy) [
+          "--module-policy=fips140"
         ];
 
       configurePhase = ''
@@ -115,8 +148,8 @@ let
 in
 {
   botan3 = common {
-    version = "3.6.1";
-    hash = "sha256-fLhXXYjSMsdxdHadf54ku0REQWBYWYbuvWbnScuakIk=";
+    version = "3.8.1";
+    hash = "sha256-sDloHUuGGi9YU3Rti6gG9VPiOGntctie2/o8Pb+hfmg=";
   };
 
   botan2 = common {
diff --git a/pkgs/development/python-modules/dbt-common/default.nix b/pkgs/development/python-modules/dbt-common/default.nix
index 334c2bd37b55..6164495bd4e7 100644
--- a/pkgs/development/python-modules/dbt-common/default.nix
+++ b/pkgs/development/python-modules/dbt-common/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
 
   # build-system
   hatchling,
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-common";
-  version = "1.22.0";
+  version = "1.23.0-unstable-2025-04-21";
   pyproject = true;
 
-  # No tags on GitHub
-  src = fetchPypi {
-    pname = "dbt_common";
-    inherit version;
-    hash = "sha256-6cdTMVCCB6SNEUsQtzKUBnKuJgwfttl7o2+zBp8Fu5g=";
+  src = fetchFromGitHub {
+    owner = "dbt-labs";
+    repo = pname;
+    rev = "03e09c01f20573975e8e17776a4b7c9088b3f212"; # They don't tag releases
+    hash = "sha256-KqnwlFZZRYuWRflMzjrqCPBnzY9q/pPhceM2DGqz5bw=";
   };
 
   build-system = [ hatchling ];
@@ -46,6 +46,7 @@ buildPythonPackage rec {
     # 0.6.x -> 0.7.2 doesn't seem too risky at a glance
     # https://pypi.org/project/isodate/0.7.2/
     "isodate"
+    "protobuf"
   ];
 
   dependencies = [
@@ -70,15 +71,10 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # Assertion errors (TODO: Notify upstream)
-    "test_create_print_json"
-    "test_events"
-    "test_extra_dict_on_event"
+    # flaky test: https://github.com/dbt-labs/dbt-common/issues/280
+    "TestFindMatching"
   ];
 
-  # No tests in the pypi archive
-  doCheck = false;
-
   pythonImportsCheck = [ "dbt_common" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/depyf/default.nix b/pkgs/development/python-modules/depyf/default.nix
index a47cc7fd78a9..3408fee712ec 100644
--- a/pkgs/development/python-modules/depyf/default.nix
+++ b/pkgs/development/python-modules/depyf/default.nix
@@ -1,20 +1,33 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   astor,
   dill,
   filelock,
+
+  # tests
   pytestCheckHook,
+  torch,
+  pythonAtLeast,
 }:
 
 buildPythonPackage rec {
   pname = "depyf";
-  version = "0.18.0";
+  version = "0.19.0";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-uZ8MODvpSa5F1dYG/kRMcfN1tVpXuNayDnhWZw1SEw0=";
+  src = fetchFromGitHub {
+    owner = "thuml";
+    repo = "depyf";
+    tag = "v${version}";
+    hash = "sha256-AGM5Pm0hhqOX9CY7dFijZLqhWmY7xnmKWakh4MUtOMs=";
   };
 
   # don't try to read git commit
@@ -23,19 +36,51 @@ buildPythonPackage rec {
       --replace-fail 'commit_id = get_git_commit_id()' 'commit_id = None'
   '';
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     astor
     dill
     filelock
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    torch
+  ];
+
+  disabledTestPaths =
+    [
+      #     if self.quitting: raise BdbQuit
+      # E   bdb.BdbQuit
+      "tests/test_pytorch/test_pytorch.py"
+    ]
+    ++ lib.optionals (pythonAtLeast "3.13") [
+
+      # depyf.decompiler.DecompilationError: DecompilationError: Failed to decompile instruction ...
+      # NotImplementedError: Unsupported instruction: LOAD_FAST_LOAD_FAST
+      "tests/test_code_owner.py"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # E   torch._dynamo.exc.BackendCompilerFailed: backend='inductor' raised:
+      # E   CppCompileError: C++ compile error
+      "tests/test_pytorch/test_export.py"
+      "tests/test_pytorch/test_logging.py"
+      "tests/test_pytorch/test_simple_graph.py"
+    ];
+
+  # All remaining tests fail with:
+  # ValueError: invalid literal for int() with base 10: 'L1'
+  doCheck = !(pythonAtLeast "3.13");
 
   pythonImportsCheck = [ "depyf" ];
 
-  meta = with lib; {
+  meta = {
     description = "Decompile python functions, from bytecode to source code";
     homepage = "https://github.com/thuml/depyf";
-    license = licenses.mit;
+    changelog = "https://github.com/thuml/depyf/releases/tag/v${version}";
+    license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/development/python-modules/django-otp-webauthn/default.nix b/pkgs/development/python-modules/django-otp-webauthn/default.nix
index 9c9769c34630..1b0ec670036e 100644
--- a/pkgs/development/python-modules/django-otp-webauthn/default.nix
+++ b/pkgs/development/python-modules/django-otp-webauthn/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "django-otp-webauthn";
-  version = "0.5.0";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "django_otp_webauthn";
-    hash = "sha256-dtyP+0z7J9so2+ESjKv4VlaMD5DFGVn3ZHYRzpy33yQ=";
+    hash = "sha256-Exyao6i63S7czGAcZMULrNcnxjRNw21ufNFaxj9kkFs=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/google-genai/default.nix b/pkgs/development/python-modules/google-genai/default.nix
index 4ecfc191ce48..2d9495d19560 100644
--- a/pkgs/development/python-modules/google-genai/default.nix
+++ b/pkgs/development/python-modules/google-genai/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-genai";
-  version = "1.12.1";
+  version = "1.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-genai";
     tag = "v${version}";
-    hash = "sha256-+m5VwGErIAlXlbATTUMYU5oGSvqFSyRE6UqIByIv87U=";
+    hash = "sha256-KuQj6kVJGvks17kR3+opo2vslSvneFt/EfxREt/7hqQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index 6029e7f188f4..f69770c7dfac 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -31,26 +31,27 @@ buildPythonPackage rec {
       # Theses lines are patching the name of dynamic libraries
       # so pyopengl can find them at runtime.
       substituteInPlace OpenGL/platform/glx.py \
-        --replace '"OpenGL",' '"${pkgs.libGL}/lib/libOpenGL${ext}",' \
-        --replace '"GL",' '"${pkgs.libGL}/lib/libGL${ext}",' \
-        --replace '"GLU",' '"${pkgs.libGLU}/lib/libGLU${ext}",' \
-        --replace '"GLX",' '"${pkgs.libglvnd}/lib/libGLX${ext}",' \
-        --replace '"glut",' '"${pkgs.libglut}/lib/libglut${ext}",' \
-        --replace '"GLESv1_CM",' '"${pkgs.libGL}/lib/libGLESv1_CM${ext}",' \
-        --replace '"GLESv2",' '"${pkgs.libGL}/lib/libGLESv2${ext}",' \
-        --replace '"gle",' '"${pkgs.gle}/lib/libgle${ext}",' \
-        --replace "'EGL'" "'${pkgs.libGL}/lib/libEGL${ext}'"
+        --replace-fail "'OpenGL'"  '"${pkgs.libGL}/lib/libOpenGL${ext}"' \
+        --replace-fail '"GL",' '"${pkgs.libGL}/lib/libGL${ext}",' \
+        --replace-fail "'GL'"  '"${pkgs.libGL}/lib/libGL${ext}"' \
+        --replace-fail '"GLU",' '"${pkgs.libGLU}/lib/libGLU${ext}",' \
+        --replace-fail "'GLX'" '"${pkgs.libglvnd}/lib/libGLX${ext}"' \
+        --replace-fail '"glut",' '"${pkgs.libglut}/lib/libglut${ext}",' \
+        --replace-fail '"GLESv1_CM",' '"${pkgs.libGL}/lib/libGLESv1_CM${ext}",' \
+        --replace-fail '"GLESv2",' '"${pkgs.libGL}/lib/libGLESv2${ext}",' \
+        --replace-fail '"gle",' '"${pkgs.gle}/lib/libgle${ext}",' \
+        --replace-fail "'EGL'" "'${pkgs.libGL}/lib/libEGL${ext}'"
       substituteInPlace OpenGL/platform/egl.py \
-        --replace "('OpenGL','GL')" "('${pkgs.libGL}/lib/libOpenGL${ext}', '${pkgs.libGL}/lib/libGL${ext}')" \
-        --replace "'GLU'," "'${pkgs.libGLU}/lib/libGLU${ext}'," \
-        --replace "'glut'," "'${pkgs.libglut}/lib/libglut${ext}'," \
-        --replace "'GLESv1_CM'," "'${pkgs.libGL}/lib/libGLESv1_CM${ext}'," \
-        --replace "'GLESv2'," "'${pkgs.libGL}/lib/libGLESv2${ext}'," \
-        --replace "'gle'," '"${pkgs.gle}/lib/libgle${ext}",' \
-        --replace "'EGL'," "'${pkgs.libGL}/lib/libEGL${ext}',"
+        --replace-fail "('OpenGL','GL')" "('${pkgs.libGL}/lib/libOpenGL${ext}', '${pkgs.libGL}/lib/libGL${ext}')" \
+        --replace-fail "'GLU'," "'${pkgs.libGLU}/lib/libGLU${ext}'," \
+        --replace-fail "'glut'," "'${pkgs.libglut}/lib/libglut${ext}'," \
+        --replace-fail "'GLESv1_CM'," "'${pkgs.libGL}/lib/libGLESv1_CM${ext}'," \
+        --replace-fail "'GLESv2'," "'${pkgs.libGL}/lib/libGLESv2${ext}'," \
+        --replace-fail "'gle'," '"${pkgs.gle}/lib/libgle${ext}",' \
+        --replace-fail "'EGL'," "'${pkgs.libGL}/lib/libEGL${ext}',"
       substituteInPlace OpenGL/platform/darwin.py \
-        --replace "'OpenGL'," "'${pkgs.libGL}/lib/libGL${ext}'," \
-        --replace "'GLUT'," "'${pkgs.libglut}/lib/libglut${ext}',"
+        --replace-fail "'OpenGL'," "'${pkgs.libGL}/lib/libGL${ext}'," \
+        --replace-fail "'GLUT'," "'${pkgs.libglut}/lib/libglut${ext}',"
     ''
     + ''
       # https://github.com/NixOS/nixpkgs/issues/76822
@@ -61,7 +62,7 @@ buildPythonPackage rec {
       # The following patch put back the "name" (i.e. the path) in the
       # list of possible files.
       substituteInPlace OpenGL/platform/ctypesloader.py \
-        --replace "filenames_to_try = [base_name]" "filenames_to_try = [name]"
+        --replace-fail "filenames_to_try = [base_name]" "filenames_to_try = [name]"
     '';
 
   # Need to fix test runner
@@ -71,7 +72,14 @@ buildPythonPackage rec {
   doCheck = false; # does not affect pythonImportsCheck
 
   # OpenGL looks for libraries during import, making this a somewhat decent test of the flaky patching above.
-  pythonImportsCheck = "OpenGL";
+  pythonImportsCheck =
+    [
+      "OpenGL"
+      "OpenGL.GL"
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      "OpenGL.GLX"
+    ];
 
   meta = with lib; {
     homepage = "https://mcfletch.github.io/pyopengl/";
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 8b07a121c76d..0e90279f86bc 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -64,7 +64,7 @@
 
 let
   pname = "ray";
-  version = "2.45.0";
+  version = "2.46.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -85,28 +85,28 @@ buildPythonPackage rec {
       # Results are in ./ray-hashes.nix
       hashes = {
         x86_64-linux = {
-          cp310 = "sha256-lI4RoSR/ewtFopEIuhz+36vYDx89t6Xe2laYITWI2Os=";
-          cp311 = "sha256-0/jYyAf4mUZePOSPrU5R+EZxiG1zHj86SU87pQ7QlFg=";
-          cp312 = "sha256-SC1F8vhn++yBRZXOmf5Vjp/xJDJ6YaSGpJdeanwiSn4=";
-          cp313 = "sha256-UXR2/63UrxNcpd2K8BVBfABizLtEqGZ0Cilj3X/Q0vA=";
+          cp310 = "sha256-wShQYIxXyK/ZYTqfdX13ZjxQ1L1Od7ovGBQlBSUgwBo=";
+          cp311 = "sha256-1N3tw/TUjfVkvO57ExyYyfiY/vCldIP0ujNfR/lRpi8=";
+          cp312 = "sha256-XOwe3ak/YY/9IwH4HVOYA38D+psWgl5+TYoArnqaQ4E=";
+          cp313 = "sha256-paKMCjEdLDIh3PcpxAiYpt+CRmu1ryHoG+BFPgmFat8=";
         };
         aarch64-linux = {
-          cp310 = "sha256-yJ9P/Y5GI7bGkBQuVYE8EoaklBF1xi4QVoAbwTmtfqc=";
-          cp311 = "sha256-r7uFydBa87JQlgLhO1rbCyCXmqerF3pxC0HwYENbt8I=";
-          cp312 = "sha256-EVghAqF1dZGnU3bElH25gZ1fq3ZePtMHyITtZ2HbhkY=";
-          cp313 = "sha256-a6WMvcCvLPRM5JGEu9qpiGtVnK1LpIIaAuhAIO2Ij9c=";
+          cp310 = "sha256-OWuRKk2/ZJZuL9/Kn6y8r+V7eSykhCrFrhdQf9vf6J8=";
+          cp311 = "sha256-gcjOi3ujPLYH7Hj16yVVRw4wRrsxdzLYKC6BibtYzL0=";
+          cp312 = "sha256-AGy+Go/cN2ZBFKohh3MQDuiROZeF4lbCAuSJWNLawWc=";
+          cp313 = "sha256-gI2uzh8SvYkkucY4Kg+Y2m9caIbPsnHtjYlAeolBPNU=";
         };
         x86_64-darwin = {
-          cp310 = "sha256-Ov5ZRYkGFkG2uH1abRgfcD2I647ewp9rMVRJ+zK1jTo=";
-          cp311 = "sha256-QMjBRr7DcQxRHdA4DqfJMLQ0h8D5yMeLWDsOiQN0Uo8=";
-          cp312 = "sha256-08MxE/QZa5I9eJX9y/a2gKFkLdEhRE6XRAHDUNp6yAk=";
-          cp313 = "sha256-+g36O5YGeZ0lEmKudK+oYVLamDUcpCnUAmusV1mUNWk=";
+          cp310 = "sha256-cZJEuE33lQLl8JSX8lZhjZTXjWb7ryKUIgCKBWjToP8=";
+          cp311 = "sha256-lCulHeb5zX+y7RdhgYGvSM5rlRd0PTI12EbsMileynY=";
+          cp312 = "sha256-0fN+rSkpljcURyb4CcLg/5WN2cDnWTDvYUFW1qCjpX8=";
+          cp313 = "sha256-svwsQ+oKN1IRk8Ye+aJ7b8qNurEWpYpS/UQ0TNc+Hs4=";
         };
         aarch64-darwin = {
-          cp310 = "sha256-ZebFvzyesazpuQ4+oEzHP388pP1Tq9IEjAp++kV9Lpg=";
-          cp311 = "sha256-XcO17Yq29peNqnvX+CaMPkBC+seBHotmH3T4INeyYg8=";
-          cp312 = "sha256-7u/x2kgDpdIyGivLX8FuINjxBFQ+jd9PMNGs9voi+sI=";
-          cp313 = "sha256-08fzQLCNSCbERfaAJLtx5Chh9AVrBvUN9JoJV2E81yk=";
+          cp310 = "sha256-Q3ioaRnmZDI4oQlPcRuH+o3BoYuZjUGQ9pqzPGSiKow=";
+          cp311 = "sha256-r4Tz7QhUu23igZLKngo7+h6zTWnxGK5jSFIhmIlkgMg=";
+          cp312 = "sha256-t6BkrP7ufwZ32ePyXa75xZWTVZ+up2S0Sj4sUzHV2DI=";
+          cp313 = "sha256-QpbdjAF0JWoE7ktUq+ATtoAqRfuF+3z9sTdSMZZdbU0=";
         };
       };
     in
diff --git a/pkgs/development/python-modules/spacy/default.nix b/pkgs/development/python-modules/spacy/default.nix
index b961fe45942e..8389430e1e24 100644
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -144,7 +144,5 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = [ ];
     mainProgram = "spacy";
-    # Cython.Compiler.Errors.CompileError: spacy/ml/parser_model.pyx
-    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/thinc/default.nix b/pkgs/development/python-modules/thinc/default.nix
index 4816698ed0bb..b577d4cbf2b2 100644
--- a/pkgs/development/python-modules/thinc/default.nix
+++ b/pkgs/development/python-modules/thinc/default.nix
@@ -6,7 +6,7 @@
   catalogue,
   confection,
   cymem,
-  cython_0,
+  cython,
   fetchPypi,
   hypothesis,
   mock,
@@ -22,23 +22,18 @@
 
 buildPythonPackage rec {
   pname = "thinc";
-  version = "9.1.1";
+  version = "8.3.6";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IfrimG13d6bwULkEbcnqsRhS8cmpl9zJAy8+zCJ4Sko=";
+    hash = "sha256-SZg/m33cQ0OpUyaUqRGN0hbXpgBSCiGEmkO2wmjsbK0=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml setup.cfg \
-      --replace-fail "blis>=1.0.0,<1.1.0" blis
-  '';
-
   build-system = [
     blis
     cymem
-    cython_0
+    cython
     murmurhash
     numpy
     preshed
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 0c14e61f4b87..187f2884d97d 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -427,5 +427,11 @@ buildPythonPackage rec {
       happysalada
       lach
     ];
+    badPlatforms = [
+      # CMake Error at cmake/cpu_extension.cmake:78 (find_isa):
+      # find_isa Function invoked with incorrect arguments for function named:
+      # find_isa
+      "x86_64-darwin"
+    ];
   };
 }
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 57cbc175d201..739fe39394cb 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -26,6 +26,7 @@ let
     isAttrs
     isString
     mapAttrs
+    filterAttrs
     ;
 
   inherit (lib.lists)
@@ -593,11 +594,12 @@ let
         )
       ] ++ optional (hasOutput "man") "man";
     }
-    // {
-      # CI scripts look at these to determine pings.
+    // (filterAttrs (_: v: v != null) {
+      # CI scripts look at these to determine pings. Note that we should filter nulls out of this,
+      # or nix-env complains: https://github.com/NixOS/nix/blob/2.18.8/src/nix-env/nix-env.cc#L963
       maintainersPosition = builtins.unsafeGetAttrPos "maintainers" (attrs.meta or { });
       teamsPosition = builtins.unsafeGetAttrPos "teams" (attrs.meta or { });
-    }
+    })
     // attrs.meta or { }
     # Fill `meta.position` to identify the source location of the package.
     // optionalAttrs (pos != null) {