diff --git a/nixos/modules/services/web-apps/selfoss.nix b/nixos/modules/services/web-apps/selfoss.nix
index c3dceb859fea..f4aa61a4c910 100644
--- a/nixos/modules/services/web-apps/selfoss.nix
+++ b/nixos/modules/services/web-apps/selfoss.nix
@@ -148,7 +148,11 @@ in
         ls | grep -v data | while read line; do rm -rf $line; done || true
 
         # Create the files
-        cp -r "${pkgs.selfoss}/"* "${dataDir}"
+        cp -r \
+          "${pkgs.selfoss}/.htaccess" \
+          "${pkgs.selfoss}/.nginx.conf" \
+          "${pkgs.selfoss}/"* \
+          "${dataDir}"
         ln -sf "${selfoss-config}" "${dataDir}/config.ini"
         chown -R "${cfg.user}" "${dataDir}"
         chmod -R 755 "${dataDir}"
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index a1d983b96293..e577027973d4 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -13968,12 +13968,12 @@ final: prev: {
 
   snacks-nvim = buildVimPlugin {
     pname = "snacks.nvim";
-    version = "2025-10-20";
+    version = "2025-10-21";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "snacks.nvim";
-      rev = "a54477b0acfb7c7cf7e55edc2619ffcd23b2f357";
-      sha256 = "1zpgybhdf74rbwqpycyb88qydcs36yy551ij8si3f0108ag04s88";
+      rev = "d293b21fe1a603dfb4757feb82ab3e67b78589f2";
+      sha256 = "1qfjcx1d55b7lqikkhr326gs74h9lq9pdpadpd33wdjrbjgv0a09";
     };
     meta.homepage = "https://github.com/folke/snacks.nvim/";
     meta.hydraPlatforms = [ ];
diff --git a/pkgs/applications/editors/vscode/extensions/continue.continue/default.nix b/pkgs/applications/editors/vscode/extensions/continue.continue/default.nix
index 88121258de9b..dd00d0294258 100644
--- a/pkgs/applications/editors/vscode/extensions/continue.continue/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/continue.continue/default.nix
@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-zcP+oV7+xpXN5ZSvxw03XborEp2i9+3r1Hbv6sFq2rM=";
+          hash = "sha256-NuJK5BjEsGeNQ2lBOHc5zPVzblwaS51hMUiYNtpQVlw=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-/nP0e3IHZtmsgTzNlJk9WOtg3jm6kpVGBaC5RMIvaII=";
+          hash = "sha256-6+X7h6AHmCwTmH0gOoB9Mb8yEsmmyJEQ58sSVrqSTeA=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-WhIMbgMJE4FK83qmjCPobwNIzcGVU56jOw5v2Q4oIhU=";
+          hash = "sha256-mvYWAEKoQODGgZ4CaJ5xlGnwEBatMU2oecSM2hVmRog=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-gThzjcah7MWBKVkViDWJ5Z0epxy+9aWFpcFt4KI9zzQ=";
+          hash = "sha256-5EsFUBJie2zNtlwJYIcFndkNPDDsZlUAggLwF1QESug=";
         };
       };
     in
     {
       name = "continue";
       publisher = "Continue";
-      version = "1.2.9";
+      version = "1.2.10";
     }
     // sources.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 42e5683b4e64..9cfd6d964706 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.32.8";
-    hash = "sha256-IwWAk8Awi6JNDQbJ7XX2wiFVsEYKzIBHqynig5W5Dtg=";
+    version = "3.33.1";
+    hash = "sha256-DSLRfzAL4jqj32XZOmGGSb/BBGEfzJ9fbkiSLLpaYM4=";
   };
 
   meta = {
diff --git a/pkgs/applications/misc/rofi-emoji/default.nix b/pkgs/applications/misc/rofi-emoji/default.nix
deleted file mode 100644
index 520781f67cfc..000000000000
--- a/pkgs/applications/misc/rofi-emoji/default.nix
+++ /dev/null
@@ -1,93 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  makeWrapper,
-
-  autoreconfHook,
-  pkg-config,
-
-  waylandSupport ? true,
-  x11Support ? true,
-
-  cairo,
-  glib,
-  libnotify,
-  rofi-unwrapped,
-  wl-clipboard,
-  xclip,
-  xdotool,
-  wtype,
-}:
-
-import ./versions.nix (
-  {
-    version,
-    hash,
-    patches,
-  }:
-  stdenv.mkDerivation rec {
-    pname = "rofi-emoji";
-    inherit version;
-
-    src = fetchFromGitHub {
-      owner = "Mange";
-      repo = "rofi-emoji";
-      rev = "v${version}";
-      inherit hash;
-    };
-
-    inherit patches;
-
-    postPatch = ''
-      patchShebangs clipboard-adapter.sh
-    '';
-
-    postFixup = ''
-      chmod +x $out/share/rofi-emoji/clipboard-adapter.sh
-      wrapProgram $out/share/rofi-emoji/clipboard-adapter.sh \
-       --prefix PATH ":" ${
-         lib.makeBinPath (
-           [ libnotify ]
-           ++ lib.optionals waylandSupport [
-             wl-clipboard
-             wtype
-           ]
-           ++ lib.optionals x11Support [
-             xclip
-             xdotool
-           ]
-         )
-       }
-    '';
-
-    nativeBuildInputs = [
-      autoreconfHook
-      pkg-config
-      makeWrapper
-    ];
-
-    buildInputs = [
-      cairo
-      glib
-      libnotify
-      rofi-unwrapped
-    ]
-    ++ lib.optionals waylandSupport [
-      wl-clipboard
-      wtype
-    ]
-    ++ lib.optionals x11Support [ xclip ];
-
-    meta = with lib; {
-      description = "Emoji selector plugin for Rofi";
-      homepage = "https://github.com/Mange/rofi-emoji";
-      license = licenses.mit;
-      maintainers = with maintainers; [
-        cole-h
-        Mange
-      ];
-      platforms = platforms.linux;
-    };
-  }
-)
diff --git a/pkgs/applications/misc/rofi-emoji/versions.nix b/pkgs/applications/misc/rofi-emoji/versions.nix
deleted file mode 100644
index 20b79d584634..000000000000
--- a/pkgs/applications/misc/rofi-emoji/versions.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-generic: {
-  v4 = generic {
-    version = "4.0.0";
-    hash = "sha256-864Mohxfc3EchBKtSNifxy8g8T8YBUQ/H7+8Ti6TiFo=";
-    patches = [
-      # Look for plugin-related files in $out/lib/rofi
-      ./0001-Patch-plugindir-to-output.patch
-    ];
-  };
-  v3 = generic {
-    version = "3.4.1";
-    hash = "sha256-ZHhgYytPB14zj2MS8kChRD+LTqXzHRrz7YIikuQD6i0=";
-    patches = [
-      # Look for plugin-related files in $out/lib/rofi
-      ./0001-Patch-plugindir-to-output.patch
-    ];
-  };
-}
diff --git a/pkgs/applications/misc/rofi-rbw/default.nix b/pkgs/applications/misc/rofi-rbw/default.nix
deleted file mode 100644
index 13f9e91244e5..000000000000
--- a/pkgs/applications/misc/rofi-rbw/default.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{
-  lib,
-  buildPythonApplication,
-  fetchFromGitHub,
-  configargparse,
-  hatchling,
-  rbw,
-
-  waylandSupport ? false,
-  wl-clipboard,
-  wtype,
-
-  x11Support ? false,
-  xclip,
-  xdotool,
-}:
-
-buildPythonApplication rec {
-  pname = "rofi-rbw";
-  version = "1.5.1";
-  format = "pyproject";
-
-  src = fetchFromGitHub {
-    owner = "fdw";
-    repo = "rofi-rbw";
-    tag = version;
-    hash = "sha256-Qdbz3UjWMCuJUzR6UMt/apt+OjMAr2U7uMtv9wxEZKE=";
-  };
-
-  nativeBuildInputs = [
-    hatchling
-  ];
-
-  buildInputs = [
-    rbw
-  ]
-  ++ lib.optionals waylandSupport [
-    wl-clipboard
-    wtype
-  ]
-  ++ lib.optionals x11Support [
-    xclip
-    xdotool
-  ];
-
-  propagatedBuildInputs = [ configargparse ];
-
-  pythonImportsCheck = [ "rofi_rbw" ];
-
-  wrapper_paths = [
-    rbw
-  ]
-  ++ lib.optionals waylandSupport [
-    wl-clipboard
-    wtype
-  ]
-  ++ lib.optionals x11Support [
-    xclip
-    xdotool
-  ];
-
-  wrapper_flags =
-    lib.optionalString waylandSupport "--typer wtype --clipboarder wl-copy"
-    + lib.optionalString x11Support "--typer xdotool --clipboarder xclip";
-
-  preFixup = ''
-    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath wrapper_paths} --add-flags "${wrapper_flags}")
-  '';
-
-  meta = with lib; {
-    description = "Rofi frontend for Bitwarden";
-    homepage = "https://github.com/fdw/rofi-rbw";
-    license = licenses.mit;
-    maintainers = with maintainers; [
-      equirosa
-      dit7ya
-    ];
-    platforms = platforms.linux;
-    mainProgram = "rofi-rbw";
-  };
-}
diff --git a/pkgs/applications/networking/cluster/hadoop/default.nix b/pkgs/applications/networking/cluster/hadoop/default.nix
index dc3759d31ea4..b771864c5b65 100644
--- a/pkgs/applications/networking/cluster/hadoop/default.nix
+++ b/pkgs/applications/networking/cluster/hadoop/default.nix
@@ -144,6 +144,8 @@ let
 
       passthru = { inherit tests; };
 
+      # The recursiveUpdate below breaks default meta.position, so manually override it.
+      pos = __curPos;
       meta =
         with lib;
         recursiveUpdate {
diff --git a/pkgs/by-name/al/aliyun-cli/package.nix b/pkgs/by-name/al/aliyun-cli/package.nix
index 66e76b71e122..00212eda320d 100644
--- a/pkgs/by-name/al/aliyun-cli/package.nix
+++ b/pkgs/by-name/al/aliyun-cli/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.307";
+  version = "3.0.308";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-36IGN0salTpMWJDA/UKFQiyob/r5WLZFC9krTXVTxuA=";
+    hash = "sha256-W6ooP9Ua7GtaD9ROBc0AbJdFHMUU6OYwT2JZulvn5+Q=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-WbMyxOSCWtlngqQHtKfkWq9bYlXUmvijGwt3zM9JoNY=";
+  vendorHash = "sha256-lmlCPBEqopmoNjkihVOh8zKSKsS4HmaDQ+QAEJ/pEvA=";
 
   subPackages = [ "main" ];
 
diff --git a/pkgs/by-name/ar/argocd/package.nix b/pkgs/by-name/ar/argocd/package.nix
index 0dd904c7cd23..a5569cc2e9d2 100644
--- a/pkgs/by-name/ar/argocd/package.nix
+++ b/pkgs/by-name/ar/argocd/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "3.1.8";
+  version = "3.1.9";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-xySxnRw8MvMi4BJ/h8+4Lhf2ontC05hAliMG2e3xnQg=";
+    hash = "sha256-l8MlEVfw8BoHS/ZCtxzi7M0xMMOvotXYnconB+3x/1k=";
   };
 
   ui = stdenv.mkDerivation {
diff --git a/pkgs/by-name/au/auth0-cli/package.nix b/pkgs/by-name/au/auth0-cli/package.nix
index f2d34eb7490d..86840cb136c5 100644
--- a/pkgs/by-name/au/auth0-cli/package.nix
+++ b/pkgs/by-name/au/auth0-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "auth0-cli";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     tag = "v${version}";
-    hash = "sha256-HII1qRJ4or5gncSVUA41DmkC8EQ9w6fdmMM15JTUFsw=";
+    hash = "sha256-y+vNIXwSNVWwR6uSyLqsk366Y558sZxK4RYG/Cres/4=";
   };
 
-  vendorHash = "sha256-g/vpUbtWFKyoPObpd9yOdsbzD/8d0SjAUZzL7A92bio=";
+  vendorHash = "sha256-eqeicg4ZWd/oOjaULXKjI5t8+4lSl5HFG3fOaeF5zB4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index ab0839301615..cb38c191c8a7 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.83.118";
+  version = "1.83.120";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-daHMBEGYJBLYu2HP2oY1wYLhVC61DNT6EFlK/PBzqcw=";
+      hash = "sha256-DQX+HKNLakI6G7K53SmcmtmA+h7ZmvkcjUgd/k3C/cc=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-KjcRXDxXAkhgAXgALzCN828+ovp2HURKL+VWT2DIMVI=";
+      hash = "sha256-E1IKc6ftBO88WVXa0RgjAFhtckBNm/hTQgxzMzK17PY=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-EnCEuLqYdV3gSwvcT19FUtRbPm79TdjUzL39sKpPTd8=";
+      hash = "sha256-aMyTGhxnExd1kaoHHTZu7UU42/WSOkB9PAyc8M0B/xU=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-brj0EvOwX0i82ndPHBS9mqfliq/YnXyxGeiz4nA1qNw=";
+      hash = "sha256-lTxFrmQzWWegmlyBc71fL81iTPqVLB3r8q2gqvrlM3o=";
     };
   };
 
diff --git a/pkgs/by-name/bu/bun/package.nix b/pkgs/by-name/bu/bun/package.nix
index 971ef0f69307..9311c7f83886 100644
--- a/pkgs/by-name/bu/bun/package.nix
+++ b/pkgs/by-name/bu/bun/package.nix
@@ -17,7 +17,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.3.0";
+  version = "1.3.1";
   pname = "bun";
 
   src =
@@ -87,19 +87,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-hYSOP5ZIHvyr51pQD9O5S5u5VoaretCjiSl2x74VA2o=";
+        hash = "sha256-ronylWETMwdRWqPdpdXv3R6dJod+yFtPGAABNDGqmO0=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-aLfc2Go159XhVrN+TO9LSrbWs3/SF5VwwOgV8TiQ/r0=";
+        hash = "sha256-ZWZqGEOeiR5XUbZmED/lkahRnxG2bsS9hlTFUV1P/4o=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-RWGVArQmNX03XFnxhgbqTKLC1ZQoyG9EKZUKHP7oahU=";
+        hash = "sha256-pILjoY8BpW13NvpuQXjbNdoeVr3cgjJa10jhXKAdigs=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-YMOdkri9CQYnUkyYswEvDAjciQJM/ap8nJjLX9Q1k3Y=";
+        hash = "sha256-QAgkyCv8wIVDZbytoRz1PXOE7LHiw9oOLAosalJ9Vik=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index 28652699dad5..56642f9be070 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -38,27 +38,31 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "8.12.0";
+  version = "8.13.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZY7FXpJCWJ3495SPW3Px/oNt5CkffMzmCb8Qt12dluw=";
+    hash = "sha256-31CFoVkXXks1NdePNOvFklfJFT36kmLL4vsgDnTaXyQ=";
   };
 
-  patches = [
-    #  allow for plugin update check, but no calibre version check
-    (fetchpatch {
-      name = "0001-only-plugin-update.patch";
-      url = "https://raw.githubusercontent.com/debian-calibre/calibre/debian/${finalAttrs.version}+ds-1/debian/patches/0001-only-plugin-update.patch";
-      hash = "sha256-mHZkUoVcoVi9XBOSvM5jyvpOTCcM91g9+Pa/lY6L5p8=";
-    })
-    (fetchpatch {
-      name = "0007-Hardening-Qt-code.patch";
-      url = "https://raw.githubusercontent.com/debian-calibre/calibre/debian/${finalAttrs.version}+ds-1/debian/patches/hardening/0007-Hardening-Qt-code.patch";
-      hash = "sha256-V/ZUTH0l4QSfM0dHrgLGdJjF/CCQ0S/fnCP/ZKD563U=";
-    })
-  ]
-  ++ lib.optional (!unrarSupport) ./dont_build_unrar_plugin.patch;
+  patches =
+    let
+      debian-source = "ds+_0.10.5-1";
+    in
+    [
+      #  allow for plugin update check, but no calibre version check
+      (fetchpatch {
+        name = "0001-only-plugin-update.patch";
+        url = "https://github.com/debian-calibre/calibre/raw/refs/tags/debian/${finalAttrs.version}+${debian-source}/debian/patches/0001-only-plugin-update.patch";
+        hash = "sha256-mHZkUoVcoVi9XBOSvM5jyvpOTCcM91g9+Pa/lY6L5p8=";
+      })
+      (fetchpatch {
+        name = "0007-Hardening-Qt-code.patch";
+        url = "https://github.com/debian-calibre/calibre/raw/refs/tags/debian/${finalAttrs.version}+${debian-source}/debian/patches/hardening/0007-Hardening-Qt-code.patch";
+        hash = "sha256-lKp/omNicSBiQUIK+6OOc8ysM6LImn5GxWhpXr4iX+U=";
+      })
+    ]
+    ++ lib.optional (!unrarSupport) ./dont_build_unrar_plugin.patch;
 
   prePatch = ''
     sed -i "s@\[tool.sip.project\]@[tool.sip.project]\nsip-include-dirs = [\"${python3Packages.pyqt6}/${python3Packages.python.sitePackages}/PyQt6/bindings\"]@g" \
diff --git a/pkgs/by-name/ca/capypdf/package.nix b/pkgs/by-name/ca/capypdf/package.nix
index c63246a73824..51f3a492ae3a 100644
--- a/pkgs/by-name/ca/capypdf/package.nix
+++ b/pkgs/by-name/ca/capypdf/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "capypdf";
-  version = "0.17.0";
+  version = "0.18.0";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "jpakkane";
     repo = "capypdf";
     rev = finalAttrs.version;
-    hash = "sha256-hdutgZhJwUi+wwtYt3+hSiyBImchUtbpVd0RCPWEr0Q=";
+    hash = "sha256-FivwBSpaIpkdKPYk7FuwpcBCYq59XH7SouA47rmGSaQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cf/cfitsio/package.nix b/pkgs/by-name/cf/cfitsio/package.nix
index 7d97bb020849..e26469e27af1 100644
--- a/pkgs/by-name/cf/cfitsio/package.nix
+++ b/pkgs/by-name/cf/cfitsio/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   gitUpdater,
   cmake,
   bzip2,
@@ -12,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cfitsio";
-  version = "4.6.2";
+  version = "4.6.3";
 
   src = fetchFromGitHub {
     owner = "HEASARC";
-    repo = finalAttrs.pname;
-    tag = "${finalAttrs.pname}-${finalAttrs.version}";
-    hash = "sha256-WLsX23hNhaITjCvMEV7NUEvyDfQiObSJt1qFC12z7wY=";
+    repo = "cfitsio";
+    tag = "cfitsio-${finalAttrs.version}";
+    hash = "sha256-nKxX3YNRJZpmcP8/0O2pMsYjcH6vzAWMpqaHYO+HoUo=";
   };
 
   outputs = [
@@ -30,12 +29,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./cfitsio-pc-cmake.patch
-
-    (fetchpatch {
-      name = "cfitsio-fix-cmake-4.patch";
-      url = "https://github.com/HEASARC/cfitsio/commit/101e0880fca41e2223df7eec56d9e84e90b9ed56.patch";
-      hash = "sha256-rufuqOBfE7ItTYwsGdu9G4BXSz4vZd52XmJi09kqrCM=";
-    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/chow-kick/package.nix b/pkgs/by-name/ch/chow-kick/package.nix
index a5fc34ebfda2..cbb4ecce74be 100644
--- a/pkgs/by-name/ch/chow-kick/package.nix
+++ b/pkgs/by-name/ch/chow-kick/package.nix
@@ -88,6 +88,12 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_RANLIB=${stdenv.cc.cc}/bin/gcc-ranlib"
   ];
 
+  postPatch = ''
+    substituteInPlace modules/chowdsp_wdf/CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION 3.1)' \
+      'cmake_minimum_required(VERSION 4.0)'
+  '';
+
   installPhase = ''
     mkdir -p $out/lib/lv2 $out/lib/vst3 $out/bin
     cp -r ChowKick_artefacts/Release/LV2/ChowKick.lv2 $out/lib/lv2
diff --git a/pkgs/by-name/ch/chow-tape-model/package.nix b/pkgs/by-name/ch/chow-tape-model/package.nix
index b3a80202c92c..02d631076bb6 100644
--- a/pkgs/by-name/ch/chow-tape-model/package.nix
+++ b/pkgs/by-name/ch/chow-tape-model/package.nix
@@ -97,7 +97,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeBuildType = "Release";
 
-  postPatch = "cd Plugin";
+  postPatch = ''
+    cd Plugin
+    substituteInPlace modules/RTNeural/CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION 3.1)' \
+      'cmake_minimum_required(VERSION 4.0)'
+  '';
 
   installPhase = ''
     mkdir -p $out/lib/lv2 $out/lib/vst3 $out/lib/clap $out/bin $out/share/doc/CHOWTapeModel/
diff --git a/pkgs/by-name/cl/cloudcompare/package.nix b/pkgs/by-name/cl/cloudcompare/package.nix
index 496b0e7a761e..bcefbc878f88 100644
--- a/pkgs/by-name/cl/cloudcompare/package.nix
+++ b/pkgs/by-name/cl/cloudcompare/package.nix
@@ -91,6 +91,9 @@ stdenv.mkDerivation rec {
     "-DPLUGIN_STANDARD_QRANSAC_SD=OFF" # not compatible with GPL, broken on non-x86
     "-DPLUGIN_STANDARD_QSRA=ON"
     "-DPLUGIN_STANDARD_QCLOUDLAYERS=ON"
+    # Fix the build with CMake 4, by overriding the minimum version globally, as support for < 3.5 was removed
+    # Ideally this can be removed at some time, but there are a lot of dependencies (e.g. plugins) which have a lower minimum version configured.
+    (lib.strings.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/co/codecrafters-cli/package.nix b/pkgs/by-name/co/codecrafters-cli/package.nix
index f81412ca9e53..b81deb83009f 100644
--- a/pkgs/by-name/co/codecrafters-cli/package.nix
+++ b/pkgs/by-name/co/codecrafters-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "codecrafters-cli";
-  version = "42";
+  version = "43";
 
   src = fetchFromGitHub {
     owner = "codecrafters-io";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-vkugNHeajGv/2t3/4eZbcsXXuaD7/fUM/3Cg0AO+6H0=";
+    hash = "sha256-B7vxBl4y2gS4iEmER4Cq1D7yDGFW3Q4DRL+aJESMOMs=";
     # A shortened git commit hash is part of the version output, and is
     # needed at build time. Use the `.git` directory to retrieve the
     # commit SHA, and remove the directory afterwards since it is not needed
diff --git a/pkgs/by-name/co/comaps/package.nix b/pkgs/by-name/co/comaps/package.nix
index dd96be7b040b..be08d8e2d773 100644
--- a/pkgs/by-name/co/comaps/package.nix
+++ b/pkgs/by-name/co/comaps/package.nix
@@ -15,28 +15,35 @@
   nix-update-script,
 }:
 let
-  mapRev = 250822;
+  # https://codeberg.org/comaps/comaps/src/branch/main/data/countries.txt
+  mapRev = 250906;
 
   worldMap = fetchurl {
     url = "https://cdn-fi-1.comaps.app/maps/${toString mapRev}/World.mwm";
-    hash = "sha256-OksUAix8yw0WQiJUwfMrjOCd/OwuRjdCOUjjGpnG2S8=";
+    hash = "sha256-0LjCDVk3vShmn+yHc/SvfJzrj170pO52CqbdKWqTsI4=";
   };
 
   worldCoasts = fetchurl {
     url = "https://cdn-fi-1.comaps.app/maps/${toString mapRev}/WorldCoasts.mwm";
-    hash = "sha256-1OvKZJ3T/YJu6t/qTYliIVkwsT8toBSqGHUpDEk9i2k=";
+    hash = "sha256-2BP6ET8DM3v0KMlzYx+lS0l26WSONQpb4fCMri8Aj2o=";
   };
+
+  pythonEnv = python3.withPackages (
+    ps: with ps; [
+      protobuf
+    ]
+  );
 in
 organicmaps.overrideAttrs (oldAttrs: rec {
   pname = "comaps";
-  version = "2025.08.31-15";
+  version = "2025.10.16-1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "comaps";
     repo = "comaps";
     tag = "v${version}";
-    hash = "sha256-uRShcyMevNb/UE5+l8UabiGSr9TccVWp5xVoqI7+Oh8=";
+    hash = "sha256-2pnAYc5Ru1OK7ecCN1kKryAPPdxUIGQp9x2y4MosRl8=";
     fetchSubmodules = true;
   };
 
@@ -50,14 +57,16 @@ organicmaps.overrideAttrs (oldAttrs: rec {
 
   postPatch = (oldAttrs.postPatch or "") + ''
     rm -f 3party/boost/b2
+    substituteInPlace configure.sh \
+      --replace-fail "git submodule update --init --recursive --depth 1" ""
+
+    patchShebangs tools/unix/generate_categories.sh
+    substituteInPlace tools/python/categories/json_to_txt.py \
+      --replace-fail "/usr/bin/env python3" "${pythonEnv.interpreter}"
   '';
 
   nativeBuildInputs = (builtins.filter (x: x != python3) oldAttrs.nativeBuildInputs or [ ]) ++ [
-    (python3.withPackages (
-      ps: with ps; [
-        protobuf
-      ]
-    ))
+    pythonEnv
     optipng
   ];
 
diff --git a/pkgs/by-name/co/comaps/remove-lto.patch b/pkgs/by-name/co/comaps/remove-lto.patch
index 8959eed2af12..a894f0079e8b 100644
--- a/pkgs/by-name/co/comaps/remove-lto.patch
+++ b/pkgs/by-name/co/comaps/remove-lto.patch
@@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index c559bf5..42ed617 100644
+index 3ba193a9..01e696e3 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -106,7 +106,7 @@ if (${CMAKE_BUILD_TYPE} STREQUAL "Debug")
+@@ -104,7 +104,7 @@ if (${CMAKE_BUILD_TYPE} STREQUAL "Debug")
  elseif (${CMAKE_BUILD_TYPE} MATCHES "Rel")
    add_definitions(-DRELEASE)
    if (NOT MSVC)
@@ -11,7 +11,7 @@ index c559bf5..42ed617 100644
    endif()
  else()
    message(FATAL_ERROR "Unknown build type: " ${CMAKE_BUILD_TYPE})
-@@ -116,19 +116,6 @@ if (${CMAKE_BUILD_TYPE} STREQUAL "RelWithDebInfo")
+@@ -114,19 +114,6 @@ if (${CMAKE_BUILD_TYPE} STREQUAL "RelWithDebInfo")
    add_compile_options(-fno-omit-frame-pointer)
  endif()
  
@@ -21,7 +21,7 @@ index c559bf5..42ed617 100644
 -  add_compile_options(-fno-fat-lto-objects)
 -  # To fix ar and ranlib "plugin needed to handle lto object".
 -  string(REGEX MATCH "[0-9]+" GCC_MAJOR_VERSION ${CMAKE_CXX_COMPILER_VERSION})
--  file(GLOB_RECURSE plugin /usr/lib/gcc/*/${GCC_MAJOR_VERSION}/liblto_plugin.so)
+-  file(GLOB_RECURSE plugin /usr/lib/gcc/*/${GCC_MAJOR_VERSION}*/liblto_plugin.so)
 -  set(CMAKE_C_ARCHIVE_CREATE "<CMAKE_AR> --plugin ${plugin} qcs <TARGET> <OBJECTS>")
 -  set(CMAKE_C_ARCHIVE_FINISH "<CMAKE_RANLIB> --plugin ${plugin} <TARGET>")
 -  set(CMAKE_CXX_ARCHIVE_CREATE "<CMAKE_AR> --plugin ${plugin} qcs <TARGET> <OBJECTS>")
diff --git a/pkgs/by-name/co/comaps/use-vendored-protobuf.patch b/pkgs/by-name/co/comaps/use-vendored-protobuf.patch
index 01527c53b2a8..01634f925256 100644
--- a/pkgs/by-name/co/comaps/use-vendored-protobuf.patch
+++ b/pkgs/by-name/co/comaps/use-vendored-protobuf.patch
@@ -1,5 +1,5 @@
 diff --git a/3party/CMakeLists.txt b/3party/CMakeLists.txt
-index 5178ae0..abe103f 100644
+index dd851d7d..1b4e3ed3 100644
 --- a/3party/CMakeLists.txt
 +++ b/3party/CMakeLists.txt
 @@ -41,9 +41,6 @@ if (NOT WITH_SYSTEM_PROVIDED_3PARTY)
@@ -21,4 +21,34 @@ index 5178ae0..abe103f 100644
 +
  add_subdirectory(agg)
  add_subdirectory(bsdiff-courgette)
- add_subdirectory(minizip)
+ add_subdirectory(glaze)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 3ba193a9..dd2df855 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -225,25 +225,6 @@ endif()
+ # Used in qt/ and shaders/
+ find_package(Python3 REQUIRED COMPONENTS Interpreter)
+
+-execute_process(
+-    COMMAND ${Python3_EXECUTABLE} -c "import google.protobuf; 
+-print(google.protobuf.__version__)"
+-    RESULT_VARIABLE PROTOBUF_CHECK
+-    OUTPUT_VARIABLE PROTOBUF_VERSION
+-    OUTPUT_STRIP_TRAILING_WHITESPACE
+-    ERROR_QUIET
+-)
+-
+-if(PROTOBUF_CHECK EQUAL 0)
+-    if(PROTOBUF_VERSION VERSION_LESS "4.0.0")
+-        message(STATUS "Python protobuf ${PROTOBUF_VERSION} found (< 4.0)")
+-    else()
+-        message(FATAL_ERROR "Python protobuf ${PROTOBUF_VERSION} found, but version < 4.0 required")
+-    endif()
+-else()
+-    message(FATAL_ERROR "Python protobuf not found. Install version <4.0")
+-endif()
+-
+
+ add_subdirectory(libs)
+
diff --git a/pkgs/by-name/di/dita-ot/package.nix b/pkgs/by-name/di/dita-ot/package.nix
index 5ad3cbb2f4ba..d9d9d076e4ed 100644
--- a/pkgs/by-name/di/dita-ot/package.nix
+++ b/pkgs/by-name/di/dita-ot/package.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dita-ot";
-  version = "4.3.4";
+  version = "4.3.5";
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ openjdk17 ];
 
   src = fetchzip {
     url = "https://github.com/dita-ot/dita-ot/releases/download/${finalAttrs.version}/dita-ot-${finalAttrs.version}.zip";
-    hash = "sha256-L3chSLr/S7d2sx0FjGbn1A1GRknBqVIUrklOW7LjakA=";
+    hash = "sha256-odL9i48SICfXLxSDqwqIXBXG57dENRjdkZkRjt3xhMg=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/du/duplicity/package.nix b/pkgs/by-name/du/duplicity/package.nix
index 161efe0f35ee..42907aa7d1a4 100644
--- a/pkgs/by-name/du/duplicity/package.nix
+++ b/pkgs/by-name/du/duplicity/package.nix
@@ -80,16 +80,10 @@ let
       [
         b2sdk
         boto3
-        cffi
-        cryptography
-        ecdsa
         idna
         pygobject3
         fasteners
-        lockfile
         paramiko
-        pyasn1
-        pycrypto
         # Currently marked as broken.
         # pydrive2
       ]
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 5f4bbe34f18e..06032b701f10 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.209.2";
+  version = "0.209.3";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-iaBP1/SszGSVMvS+kEzjbl2saaDbD7wbLdmhkQuKdwg=";
+    hash = "sha256-L3Rxp6p0iuEh06YHPKxK4//w2FPtLj6iy3qHk3hl9L8=";
   };
 
-  vendorHash = "sha256-Is6hv2nkTQhugSj+CqcTiwAPvIBtNNAvWZLLWm0jU/8=";
+  vendorHash = "sha256-T+5kbeKV0KWrKcTZzf7bcnoQUH5pRevj1JGZq3Z6/NM=";
 
   commonMeta = with lib; {
     license = licenses.mit;
@@ -52,7 +52,7 @@ buildGo125Module rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-TGT3lUhUpHJ4Aw43a4C6MBH8jbXKPdM5WZwBVTfJxws=";
+    hash = "sha256-WATWlCqTBY6vVMWpdyZ7Y/s0uI304TEC4gaKM2s5P/U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fl/flood/package.nix b/pkgs/by-name/fl/flood/package.nix
index aac33e941f31..39f7f2c3a108 100644
--- a/pkgs/by-name/fl/flood/package.nix
+++ b/pkgs/by-name/fl/flood/package.nix
@@ -9,13 +9,13 @@
 
 buildNpmPackage rec {
   pname = "flood";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchFromGitHub {
     owner = "jesec";
     repo = "flood";
     rev = "v${version}";
-    hash = "sha256-+mVfaCxSHGy4r3ULO2bnV5X2xG7LJT27Bce0y55i6DA=";
+    hash = "sha256-RBWDEFhLEZdC7luGFGx3qY0Hk7nM44RZgRyCWXFPh1k=";
   };
 
   npmConfigHook = pnpm_9.configHook;
diff --git a/pkgs/by-name/gd/gdscript-formatter/package.nix b/pkgs/by-name/gd/gdscript-formatter/package.nix
new file mode 100644
index 000000000000..b92bbdb93954
--- /dev/null
+++ b/pkgs/by-name/gd/gdscript-formatter/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "gdscript-formatter";
+  version = "0.14.0";
+
+  src = fetchFromGitHub {
+    owner = "GDQuest";
+    repo = "GDScript-formatter";
+    tag = finalAttrs.version;
+    hash = "sha256-cY6Ow1f8o40M9/knneAod8ABj7ObQAkzs3yODMpkCxQ=";
+    # Needed due to .gitattributes being used for the Godot addon and export-ignoring all files
+    deepClone = true;
+  };
+
+  cargoHash = "sha256-U3M1xuSybP9WVHNMYaY6QrBZ//cAGCIOIo2dY0jpJzc=";
+
+  cargoBuildFlags = [
+    "--bin=gdscript-formatter"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fast code formatter for GDScript and Godot 4";
+    homepage = "https://github.com/GDQuest/GDScript-formatter";
+    changelog = "https://github.com/GDQuest/GDScript-formatter/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    mainProgram = "gdscript-formatter";
+    maintainers = with lib.maintainers; [ squarepear ];
+  };
+})
diff --git a/pkgs/by-name/ge/gemini-cli/package.nix b/pkgs/by-name/ge/gemini-cli/package.nix
index 20d75f63e3e7..789b24efd95a 100644
--- a/pkgs/by-name/ge/gemini-cli/package.nix
+++ b/pkgs/by-name/ge/gemini-cli/package.nix
@@ -13,16 +13,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "gemini-cli";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "google-gemini";
     repo = "gemini-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QvcC/QzotP1OhcOyZoNK5FkZwVKm4ZNfU5s3B9UKhc0=";
+    hash = "sha256-h6JyiIh0+PI/5JHlztMKlXlK5XQC8x6V7Yq1VyboaXs=";
   };
 
-  npmDepsHash = "sha256-0Tbwco+9Int7krl2bsphCMPtObJtJhYw8X3zyof30qA=";
+  npmDepsHash = "sha256-4RsZAs9+Q7vnRiyA1OMXC185d9Y9k6mwG+QkOE+5Pas=";
 
   nativeBuildInputs = [
     jq
diff --git a/pkgs/by-name/gi/ginkgo/package.nix b/pkgs/by-name/gi/ginkgo/package.nix
index 063dc6ddab51..aeb981992263 100644
--- a/pkgs/by-name/gi/ginkgo/package.nix
+++ b/pkgs/by-name/gi/ginkgo/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "2.26.0";
+  version = "2.27.1";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-sf8rGRLSX3AsUSGqBXzb0KRwKqpmRiD+U9V/ldLqwps=";
+    sha256 = "sha256-XdJYg0ahUkYdaEc4G5lqxc7gr5fF3BjhVPcaynd7u2Q=";
   };
-  vendorHash = "sha256-CUoVFKA/LQNVf4gnjqguYjPTF4ZdxA+QSJmw/UeUsrM=";
+  vendorHash = "sha256-VKflMZ+qZGLlXdWpdnRV2dSqta4C3SfLKgJcqHHtDNk=";
 
   # integration tests expect more file changes
   # types tests are missing CodeLocation
diff --git a/pkgs/by-name/gl/glooctl/package.nix b/pkgs/by-name/gl/glooctl/package.nix
index 914193157343..acd687d5574b 100644
--- a/pkgs/by-name/gl/glooctl/package.nix
+++ b/pkgs/by-name/gl/glooctl/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.20.2";
+  version = "1.20.3";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-Fc7AxuE2t7tw4Q5/iTcCg417Z0QqzWIB9IBBPysVMGc=";
+    hash = "sha256-i2+CEPHK2C34ulY4nRTVw0sNBsHzD1WlKiZRjwHJOVc=";
   };
 
   vendorHash = "sha256-zJmp3UWzZSI7G54DTOEOEo2ZIKjM6GZ0Cf5/BukaB4o=";
diff --git a/pkgs/by-name/go/gotosocial/package.nix b/pkgs/by-name/go/gotosocial/package.nix
index 54306db43a7f..fe50a35985f7 100644
--- a/pkgs/by-name/go/gotosocial/package.nix
+++ b/pkgs/by-name/go/gotosocial/package.nix
@@ -10,11 +10,11 @@ let
   owner = "superseriousbusiness";
   repo = "gotosocial";
 
-  version = "0.20.0";
+  version = "0.20.1";
 
   web-assets = fetchurl {
     url = "https://${domain}/${owner}/${repo}/releases/download/v${version}/${repo}_${version}_web-assets.tar.gz";
-    hash = "sha256-poG+j5WfbTN7853cOdngv+uIblcL19ySgtguXW5TX+w=";
+    hash = "sha256-0WvaPUVTMYd1tz7Rtmlp37vx/co4efhDdSWBc4gUzAU=";
   };
 in
 buildGo124Module rec {
@@ -24,7 +24,7 @@ buildGo124Module rec {
   src = fetchFromGitea {
     inherit domain owner repo;
     tag = "v${version}";
-    hash = "sha256-RN2U/hYJcmuTGMnTCQCLX74qdxANF8nkIx98uWT/Aww=";
+    hash = "sha256-8z2tBiEVcof0/G41gpc0S8Dye5nynwHSJpTzo/ZseFs=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gr/graphite-cli/package-lock.json b/pkgs/by-name/gr/graphite-cli/package-lock.json
index d9695307c659..e69d407354b0 100644
--- a/pkgs/by-name/gr/graphite-cli/package-lock.json
+++ b/pkgs/by-name/gr/graphite-cli/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.7.1",
+      "version": "1.7.2",
       "hasInstallScript": true,
       "license": "None",
       "dependencies": {
diff --git a/pkgs/by-name/gr/graphite-cli/package.nix b/pkgs/by-name/gr/graphite-cli/package.nix
index 526dc0518f76..6ca571867814 100644
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@@ -9,14 +9,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-kRXL88ZtOhO2pW9VuMfKPvW9pPJ5RsBKDxPDBzbd8zo=";
+    hash = "sha256-FoQvtywam4AXAavRtwfoTMaaMijW67hp317VLupCaCI=";
   };
 
-  npmDepsHash = "sha256-3nr5Q7OyKAVwoG8znf4YT8U0U0nkrvE6M/peKuNtMcw=";
+  npmDepsHash = "sha256-POWRxgrny27+7ymrhP5iFPBYzCmjCDWB8jGmOSieq0k=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/ip/ipxe/package.nix b/pkgs/by-name/ip/ipxe/package.nix
index 89299e2ef688..3919d76f122c 100644
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-10-16";
+  version = "1.21.1-unstable-2025-10-20";
 
   nativeBuildInputs = [
     mtools
@@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "c1badf71ca22f94277873ebc6171bfa41a50e378";
-    hash = "sha256-emPO4DRVr/rQZgr+Tnvg3+oijhh9IzG1TH0BWu96oBY=";
+    rev = "c8f088d4e11a1dedda4829c4be1bb1b14e9da016";
+    hash = "sha256-rNs9KIxK8Q6imv1h7qVE516JccYHNzLUWJrv6sKGRWo=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.
diff --git a/pkgs/by-name/jw/jwtinfo/package.nix b/pkgs/by-name/jw/jwtinfo/package.nix
index d307f2c846e3..abcf18969c39 100644
--- a/pkgs/by-name/jw/jwtinfo/package.nix
+++ b/pkgs/by-name/jw/jwtinfo/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "jwtinfo";
-  version = "0.4.4";
+  version = "0.6.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -14,10 +14,10 @@ rustPlatform.buildRustPackage {
     owner = "lmammino";
     repo = "jwtinfo";
     rev = "v${version}";
-    hash = "sha256-FDN9K7KnMro2BluHB7I0HTDdT9YXxi8UcOoBhKx/5dA=";
+    hash = "sha256-d88RL3Ii2/akIyxmKMEBqILRuaSP2v/RZ5zuWrwyYkc=";
   };
 
-  cargoHash = "sha256-pRlnZAFsEBGz0yYfcZ0SCiH2om8URQ4J3+c01pBT7ag=";
+  cargoHash = "sha256-5lSGVr5iMk4Zai2HNTSXOeJXyXPRAWNEyJeZxMrAMUg=";
 
   meta = {
     description = "Command-line tool to get information about JWTs";
diff --git a/pkgs/by-name/ki/killerbee/package.nix b/pkgs/by-name/ki/killerbee/package.nix
index 51a03e71f0b3..3efd7d527be2 100644
--- a/pkgs/by-name/ki/killerbee/package.nix
+++ b/pkgs/by-name/ki/killerbee/package.nix
@@ -22,6 +22,7 @@ python3.pkgs.buildPythonApplication rec {
   buildInputs = [ libgcrypt ];
 
   dependencies = with python3.pkgs; [
+    pycrypto
     pyserial
     pyusb
     rangeparser
diff --git a/pkgs/by-name/lx/lxgw-neoxihei/package.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
index c428bb8f8757..106ddb457599 100644
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.224";
+  version = "1.225";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-Wib8zZsdw9K5dmVYPymzv4hkAhrOWyEjflzEX8tv0zc=";
+    hash = "sha256-Mvlt9P0/tIuizXLBdzmBJpxd8UsfOwP6saYG17KVeXQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/mc/mcphost/package.nix b/pkgs/by-name/mc/mcphost/package.nix
index 6b3c4cfd614a..1c0d61ed2436 100644
--- a/pkgs/by-name/mc/mcphost/package.nix
+++ b/pkgs/by-name/mc/mcphost/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcphost";
-  version = "0.31.1";
+  version = "0.31.3";
 
   src = fetchFromGitHub {
     owner = "mark3labs";
     repo = "mcphost";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WvoBQLrs9lcbaTueyIPI89Y2t37mKxlE0tOczLhw8Bg=";
+    hash = "sha256-1pPwW4Q84OWTcMVz4rEWEt1ZwWmxHmQTsCiqXKpOkvs=";
   };
 
   vendorHash = "sha256-xZ7JbX1sAt2ZtgSMm86MQEJWwjL17O9LMsjOmkhzWt0=";
diff --git a/pkgs/by-name/me/mediamtx/package.nix b/pkgs/by-name/me/mediamtx/package.nix
index c103101da65e..1da648e268f8 100644
--- a/pkgs/by-name/me/mediamtx/package.nix
+++ b/pkgs/by-name/me/mediamtx/package.nix
@@ -15,16 +15,16 @@ in
 buildGoModule (finalAttrs: {
   pname = "mediamtx";
   # check for hls.js version updates in internal/servers/hls/hlsjsdownloader/VERSION
-  version = "1.15.2";
+  version = "1.15.3";
 
   src = fetchFromGitHub {
     owner = "bluenviron";
     repo = "mediamtx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sqrcfH0A2wvMAhnW/f8Ev3b+neIFv+6//0BFxASyvcM=";
+    hash = "sha256-alZn6o8S6HWlYdsziptsqqSZKdfYHGB1VhPGhTJNbqQ=";
   };
 
-  vendorHash = "sha256-HGh6mbaDANSk8n40Y4RY7L9XFaLe+fSB2afAIVg7M8A=";
+  vendorHash = "sha256-/k0fIxL6x1X1kDNuMVWb40nkXbl+IakSYUgugd8vlLk=";
 
   postPatch = ''
     cp ${hlsJs} internal/servers/hls/hls.min.js
diff --git a/pkgs/by-name/mi/microplane/package.nix b/pkgs/by-name/mi/microplane/package.nix
index fcae4cf42b71..59b6b67f2621 100644
--- a/pkgs/by-name/mi/microplane/package.nix
+++ b/pkgs/by-name/mi/microplane/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "microplane";
-  version = "0.0.35";
+  version = "0.0.37";
 
   src = fetchFromGitHub {
     owner = "Clever";
     repo = "microplane";
     rev = "v${version}";
-    sha256 = "sha256-3QPxH4ZR02bkL2uKoJpLW9e7q1LjSlWw5jo0jxegeiM=";
+    sha256 = "sha256-TwNwXMQGsD9Kx5uH+kAOGlwCF1t1oAefVCbKmRtZ4Vc=";
   };
 
-  vendorHash = "sha256-DizwNph3hmSRoozvJgs3Qw/c9iMTRR1gMGC60pBCFSk=";
+  vendorHash = "sha256-fF1tHhOtw1ms6447lna40NrZT3ItpiQu31Y0psXt1/Y=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 45ff827a80c8..a1366cd36737 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.442";
+  version = "0.0.443";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-SGibs1Jbq6WWeiDS1SbjX5s+Wy2vpCD74TofB9CbuVE=";
+    hash = "sha256-LprQhUIh5wcxiR3sf2+cT3fg458KDDv9f7Sytcs1NC8=";
   };
 
   vendorHash = "sha256-913vffq86pju2UKW0UkTm8qE7bylR9n0SgacELIRhVY=";
diff --git a/pkgs/by-name/ne/networkmanager/package.nix b/pkgs/by-name/ne/networkmanager/package.nix
index dd1d931001a2..51e267cb8a28 100644
--- a/pkgs/by-name/ne/networkmanager/package.nix
+++ b/pkgs/by-name/ne/networkmanager/package.nix
@@ -233,7 +233,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://networkmanager.dev";
     description = "Network configuration and management tool";
     license = licenses.gpl2Plus;
-    changelog = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/raw/${version}/NEWS";
+    changelog = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/raw/${finalAttrs.version}/NEWS";
     maintainers = with maintainers; [
       obadz
     ];
diff --git a/pkgs/by-name/ng/ngrok/versions.json b/pkgs/by-name/ng/ngrok/versions.json
index cfdea158e908..a481d4be6d99 100644
--- a/pkgs/by-name/ng/ngrok/versions.json
+++ b/pkgs/by-name/ng/ngrok/versions.json
@@ -1,38 +1,38 @@
 {
   "linux-386": {
     "sys": "linux-386",
-    "url": "https://bin.equinox.io/a/9q4HZ8StRme/ngrok-v3-3.25.0-linux-386",
-    "sha256": "69a76dacb52e568977d105d0d8945c70d1702f9516d42959a4236daaab53559e",
-    "version": "3.25.0"
+    "url": "https://bin.equinox.io/a/nNTqdX4Ydi/ngrok-v3-3.31.0-linux-386",
+    "sha256": "df57220616e209b18fad5db27ebab459b79d79431845a9f35e39f5f7b482646d",
+    "version": "3.31.0"
   },
   "linux-amd64": {
     "sys": "linux-amd64",
-    "url": "https://bin.equinox.io/a/9smpcEP9X6q/ngrok-v3-3.25.0-linux-amd64",
-    "sha256": "13ec4a15ab815f29cd6d9eafc4bde3b6bb3a7c6ed5d96c3dd093884fb41c7b27",
-    "version": "3.25.0"
+    "url": "https://bin.equinox.io/a/mWtsD5CQpnc/ngrok-v3-3.31.0-linux-amd64",
+    "sha256": "1dab42535428db2a55f44abb0d14f6d9fec7f930f9346c9bd69f0cf5b6529dca",
+    "version": "3.31.0"
   },
   "linux-arm": {
     "sys": "linux-arm",
-    "url": "https://bin.equinox.io/a/jyXJJfSXXDP/ngrok-v3-3.25.0-linux-arm",
-    "sha256": "60901e0ce54f2730b27f76797c2b96f40b9af859403da6c4be81d9d6330bca9f",
-    "version": "3.25.0"
+    "url": "https://bin.equinox.io/a/dDdHR6qWaFy/ngrok-v3-3.31.0-linux-arm",
+    "sha256": "e713bfc77f2fe0a1225215ce5651a3beefb27773b01f1cce442a271512ee60bd",
+    "version": "3.31.0"
   },
   "linux-arm64": {
     "sys": "linux-arm64",
-    "url": "https://bin.equinox.io/a/7TpsSBE1k4y/ngrok-v3-3.25.0-linux-arm64",
-    "sha256": "dd49f434b64c1b4646a2e287f939d77f4dfc8d0a314e39c69a89e8cf5275f55b",
-    "version": "3.25.0"
+    "url": "https://bin.equinox.io/a/2SEt27vYGV3/ngrok-v3-3.31.0-linux-arm64",
+    "sha256": "4bd600d663bcdec42a7d1a6f0c5a042042fecd529b9867b532bd794e62fdb9b4",
+    "version": "3.31.0"
   },
   "darwin-amd64": {
     "sys": "darwin-amd64",
-    "url": "https://bin.equinox.io/a/9pCLo8uquic/ngrok-v3-3.25.0-darwin-amd64",
-    "sha256": "1199c6c6f6f4d5fc7c91ed5dbbbda2cf212568d7397e0785d92b1d1c4bd87a25",
-    "version": "3.25.0"
+    "url": "https://bin.equinox.io/a/8YrgUfMJ8FH/ngrok-v3-3.31.0-darwin-amd64",
+    "sha256": "b4855f6d9b170ffe9a77393e43d1e40a4a5ce66a6906fa2cfcddaf5e05938b98",
+    "version": "3.31.0"
   },
   "darwin-arm64": {
     "sys": "darwin-arm64",
-    "url": "https://bin.equinox.io/a/2PceGNze17x/ngrok-v3-3.25.0-darwin-arm64",
-    "sha256": "a3799883672ed868036ec71353e9feec8389568b75e5d704a32a52a409f37133",
-    "version": "3.25.0"
+    "url": "https://bin.equinox.io/a/9XVR1UCtCce/ngrok-v3-3.31.0-darwin-arm64",
+    "sha256": "407f7e88a57f93536d0981544d4132cdf100aa2799a5b56640ec13726febc970",
+    "version": "3.31.0"
   }
 }
diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index d4967897caaf..05781511931e 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -33,7 +33,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus";
-  version = "3.7.1";
+  version = "3.7.2";
 
   outputs = [
     "out"
@@ -45,14 +45,14 @@ buildGoModule (finalAttrs: {
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m5dQoEn/989gmG5Q4A/oCY6JKvOLzpAU8kaPQOsajlA=";
+    hash = "sha256-bitRDX1oymFfzvQVYL31BON6UBfQYnqjZefQKc+yXx0=";
   };
 
   vendorHash = "sha256-V+qLxjqGOaT1veEwtklqcS7iO31ufvDHBA9DbZLzDiE=";
 
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-88PNQfVM9le+2mqMBq9tyyZ+1J+yloWWIE4VJHSCS1g=";
+    hash = "sha256-NFv6zNpMacd0RgVYBlWKbXKNCEh7WijpREg0bNojisM=";
   };
 
   excludedPackages = [
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index 371267663137..be7157a37b93 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-fvasxm9BjoHvSS5qqlYdCFN7j4E/MAsGhaKxt2y8Bhw=";
+    hash = "sha256-3MqMkef/oc6Fk2PHvdTMlH/lRU19Tru5uqs8yVThSdw=";
   };
 
-  cargoHash = "sha256-yQtsL4FHEuA2Ji5HW4LYoYoY1CDQf8LO0E1en04JpOA=";
+  cargoHash = "sha256-JYsnrZsUrESOZQzVOkHLFDDtjDCzGva6mrFLSOiEUzw=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 6ee6084d8082..2ca6715de353 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -34,13 +34,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.26.0";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "rerun-io";
     repo = "rerun";
     tag = finalAttrs.version;
-    hash = "sha256-aJKrC8cDYHpOEUdzLKJP7t/hn/fOFz2aulz+8BsuXZk=";
+    hash = "sha256-T4Ko0CDaKSEadaKB3JtTK9b2dRT9eJ7ThXEVipCRdBU=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
   '';
 
-  cargoHash = "sha256-oRmOydykTPL8YwyFdD/OqDhHXlUnY5NJewfIQkdMaC4=";
+  cargoHash = "sha256-c234pbC5wNKsWwt049Zmk3gaAEb+obkkwAqefRmsu2A=";
 
   cargoBuildFlags = [ "--package rerun-cli" ];
   cargoTestFlags = [ "--package rerun-cli" ];
diff --git a/pkgs/by-name/ri/ripgrep/package.nix b/pkgs/by-name/ri/ripgrep/package.nix
index c5258bba05e7..26cca99406d2 100644
--- a/pkgs/by-name/ri/ripgrep/package.nix
+++ b/pkgs/by-name/ri/ripgrep/package.nix
@@ -17,16 +17,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ripgrep";
-  version = "15.0.0";
+  version = "15.1.0";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "ripgrep";
     rev = version;
-    hash = "sha256-pYQw4LuKBZdLTc/aBpruwrd9U9s++yXbSXfq2JZ/jyI=";
+    hash = "sha256-0gjwYMUlXYnmIWQS1SVzF1yQw1lpveRLw5qp049lc3I=";
   };
 
-  cargoHash = "sha256-vh5adpwdZHjEXLyiMKvL3LHNPZaiB4TWuypTXsieyek=";
+  cargoHash = "sha256-ry3pLuYNwX776Dpj9IE2+uc7eEa5+sQvdNNeG1eJecs=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/applications/misc/rofi-emoji/0001-Patch-plugindir-to-output.patch b/pkgs/by-name/ro/rofi-emoji/0001-Patch-plugindir-to-output.patch
similarity index 100%
rename from pkgs/applications/misc/rofi-emoji/0001-Patch-plugindir-to-output.patch
rename to pkgs/by-name/ro/rofi-emoji/0001-Patch-plugindir-to-output.patch
diff --git a/pkgs/by-name/ro/rofi-emoji/package.nix b/pkgs/by-name/ro/rofi-emoji/package.nix
new file mode 100644
index 000000000000..03ef3156716e
--- /dev/null
+++ b/pkgs/by-name/ro/rofi-emoji/package.nix
@@ -0,0 +1,85 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  makeWrapper,
+
+  autoreconfHook,
+  pkg-config,
+
+  cairo,
+  glib,
+  libnotify,
+  rofi-unwrapped,
+
+  x11Support ? true,
+  xclip,
+  xdotool,
+
+  waylandSupport ? true,
+  wl-clipboard,
+  wtype,
+
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (final: {
+  pname = "rofi-emoji";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Mange";
+    repo = "rofi-emoji";
+    rev = "v${final.version}";
+    hash = "sha256-Amaz+83mSPue+pjZq/pJiCxu5QczYvmJk6f96eraaK8=";
+  };
+
+  patches = [
+    # Look for plugin-related files in $out/lib/rofi
+    ./0001-Patch-plugindir-to-output.patch
+  ];
+
+  postFixup = ''
+    wrapProgram $out/share/rofi-emoji/clipboard-adapter.sh \
+     --prefix PATH ":" ${
+       lib.makeBinPath (
+         [
+           libnotify
+         ]
+         ++ lib.optionals waylandSupport [
+           wl-clipboard
+           wtype
+         ]
+         ++ lib.optionals x11Support [
+           xclip
+           xdotool
+         ]
+       )
+     }
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    cairo
+    glib
+    rofi-unwrapped
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Emoji selector plugin for Rofi";
+    homepage = "https://github.com/Mange/rofi-emoji";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      cole-h
+      Mange
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ro/rofi-rbw-wayland/package.nix b/pkgs/by-name/ro/rofi-rbw-wayland/package.nix
new file mode 100644
index 000000000000..df14e2c5f67c
--- /dev/null
+++ b/pkgs/by-name/ro/rofi-rbw-wayland/package.nix
@@ -0,0 +1,4 @@
+{ rofi-rbw }:
+rofi-rbw.override {
+  waylandSupport = true;
+}
diff --git a/pkgs/by-name/ro/rofi-rbw-x11/package.nix b/pkgs/by-name/ro/rofi-rbw-x11/package.nix
new file mode 100644
index 000000000000..80ef776daa51
--- /dev/null
+++ b/pkgs/by-name/ro/rofi-rbw-x11/package.nix
@@ -0,0 +1,4 @@
+{ rofi-rbw }:
+rofi-rbw.override {
+  x11Support = true;
+}
diff --git a/pkgs/by-name/ro/rofi-rbw/package.nix b/pkgs/by-name/ro/rofi-rbw/package.nix
new file mode 100644
index 000000000000..c6d82037d52b
--- /dev/null
+++ b/pkgs/by-name/ro/rofi-rbw/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  rbw,
+
+  waylandSupport ? false,
+  wl-clipboard,
+  wtype,
+
+  x11Support ? false,
+  xclip,
+  xdotool,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "rofi-rbw";
+  version = "1.5.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fdw";
+    repo = "rofi-rbw";
+    tag = version;
+    hash = "sha256-Qdbz3UjWMCuJUzR6UMt/apt+OjMAr2U7uMtv9wxEZKE=";
+  };
+
+  build-system = [
+    python3Packages.hatchling
+  ];
+
+  dependencies = [
+    python3Packages.configargparse
+  ];
+
+  pythonImportsCheck = [ "rofi_rbw" ];
+
+  preFixup =
+    let
+      wrapperPaths = [
+        rbw
+      ]
+      ++ lib.optionals waylandSupport [
+        wl-clipboard
+        wtype
+      ]
+      ++ lib.optionals x11Support [
+        xclip
+        xdotool
+      ];
+
+      wrapperFlags =
+        lib.optionalString waylandSupport " --typer wtype --clipboarder wl-copy"
+        + lib.optionalString x11Support " --typer xdotool --clipboarder xclip";
+    in
+    ''
+      makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath wrapperPaths} --add-flags "${wrapperFlags}")
+    '';
+
+  meta = {
+    description = "Rofi frontend for Bitwarden";
+    homepage = "https://github.com/fdw/rofi-rbw";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      equirosa
+      dit7ya
+    ];
+    platforms = lib.platforms.linux;
+    mainProgram = "rofi-rbw";
+  };
+}
diff --git a/pkgs/by-name/se/sentry-cli/package.nix b/pkgs/by-name/se/sentry-cli/package.nix
index 4011acc62608..8ba3950aaa1d 100644
--- a/pkgs/by-name/se/sentry-cli/package.nix
+++ b/pkgs/by-name/se/sentry-cli/package.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.56.1";
+  version = "2.57.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    hash = "sha256-2T4HEWEcT8ehy5wQqKlBPx2MyusLYg8eM/fWlZ83HAw=";
+    hash = "sha256-VcWIeWLWQpEDJhF0f95S9sQ0yC1NJqisOmEONINtKeA=";
   };
   doCheck = false;
 
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  cargoHash = "sha256-6AM1oGX4q6kHePiS0fsoXPt0b89O9WItIBukPIwapJQ=";
+  cargoHash = "sha256-S+A6v4rva8c7QuWP/5dRzUtJDdWryb8Jmu2J4JurNMM=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd sentry-cli \
diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index 257e3234347a..3ea4ed734c81 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 
   # build deps
   cargo-deny,
@@ -21,7 +22,6 @@
   uv,
   which,
   yasm,
-  zlib,
 
   # runtime deps
   fontconfig,
@@ -35,6 +35,7 @@
   vulkan-loader,
   wayland,
   xorg,
+  zlib,
 
   # tests
   nixosTests,
@@ -64,13 +65,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "servo";
-  version = "0-unstable-2025-07-30";
+  version = "0.0.1-unstable-2025-10-22";
 
   src = fetchFromGitHub {
     owner = "servo";
     repo = "servo";
-    rev = "0e180578632facc10f0e8fb29df9084369adc600";
-    hash = "sha256-4EQ15jOZNYjGmhIOJivHT8R6BeT6moGj+AI9DBq58v4=";
+    rev = "efc8c0f6647e542e35bac732585bc3aef6578028";
+    hash = "sha256-mLXs0OaOLD12hFQ8w/3xnDV+4fhjRKToRjZZMPDJ9X8=";
     # Breaks reproducibility depending on whether the picked commit
     # has other ref-names or not, which may change over time, i.e. with
     # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -80,7 +81,7 @@ rustPlatform.buildRustPackage {
     '';
   };
 
-  cargoHash = "sha256-fqIlN+6SEY0LVrUk47U12TuVoRte0oCGJhO7DHovzBM=";
+  cargoHash = "sha256-POMWoM5NVeas/t1XivqBDrhZy7qRvIL3e01Wu3893L4=";
 
   # set `HOME` to a temp dir for write access
   # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
@@ -107,11 +108,21 @@ rustPlatform.buildRustPackage {
     uv
     which
     yasm
-    zlib
   ];
 
   env.UV_PYTHON = customPython.interpreter;
 
+  postPatch = ''
+    # mozjs-sys attempts to find the header path of the icu_capi crate through cargo-metadata at build time.
+    # Unfortunately, cargo-metadata also attempts to fetch optional, disabled crates in the process.
+    # As these are not part of servo's Cargo.lock, they are not included in our cache and cargo-metadata fails.
+    # We work around this by finding the header path ourselves and substituting the invocation in mozjs-sys' build.rs.
+    icu_capi_dir=$(find $cargoDepsCopy -maxdepth 2 -type d -name icu_capi-\*)
+    icu_c_include_path="$icu_capi_dir/bindings/c"
+    substituteInPlace $cargoDepsCopy/mozjs_sys-*/build.rs \
+      --replace-fail "let icu_c_include_path = get_icu_capi_include_path();" "let icu_c_include_path = \"$icu_c_include_path\".to_string();"
+  '';
+
   buildInputs = [
     fontconfig
     freetype
@@ -123,6 +134,7 @@ rustPlatform.buildRustPackage {
     harfbuzz
     libunwind
     libGL
+    zlib
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     wayland
@@ -137,7 +149,16 @@ rustPlatform.buildRustPackage {
     "servo_allocator/use-system-allocator"
   ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-I${lib.getInclude stdenv.cc.libcxx}/include/c++/v1";
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      # mozjs-sys fails with:
+      #  cc1plus: error: '-Wformat-security' ignored without '-Wformat'
+      "-Wno-error=format-security"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "-I${lib.getInclude stdenv.cc.libcxx}/include/c++/v1"
+    ]
+  );
 
   # copy resources into `$out` to be used during runtime
   # link runtime libraries
@@ -150,12 +171,11 @@ rustPlatform.buildRustPackage {
   '';
 
   passthru = {
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
     tests = { inherit (nixosTests) servo; };
   };
 
   meta = {
-    broken = true; # cargo fetcher leaves invalid Cargo.toml around, which breaks mozjs-sys build
     description = "Embeddable, independent, memory-safe, modular, parallel web rendering engine";
     homepage = "https://servo.org";
     license = lib.licenses.mpl20;
@@ -163,6 +183,7 @@ rustPlatform.buildRustPackage {
       hexa
       supinie
     ];
+    teams = with lib.teams; [ ngi ];
     mainProgram = "servo";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/se/servo/update.sh b/pkgs/by-name/se/servo/update.sh
deleted file mode 100755
index ffb4265b6c70..000000000000
--- a/pkgs/by-name/se/servo/update.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils common-updater-scripts curl jq nix-update
-
-# This update script exists, because nix-update is unable to ignore various
-# bogus tags that exist on the upstream repo e.g.
-#  - selectors-v0.18.0/v0.20.0/v0.21.0/v0.22.0
-#  - homu-tmp
-#
-# Once https://github.com/Mic92/nix-update/issues/322 is resolved it can be
-# removed.
-
-set -exuo pipefail
-
-# Determine latest commit id and date
-TMP=$(mktemp)
-curl -o "$TMP" https://api.github.com/repos/servo/servo/commits/main
-COMMIT_ID=$(jq -r '.sha' "$TMP")
-COMMIT_TIMESTAMP=$(jq -r '.commit.author.date' "$TMP")
-COMMIT_DATE=$(date -d "$COMMIT_TIMESTAMP" +"%Y-%m-%d")
-rm $TMP
-
-cd "$(git rev-parse --show-toplevel)"
-
-# Update version, src
-update-source-version servo "0-unstable-${COMMIT_DATE}" --file=pkgs/by-name/se/servo/package.nix --rev="$COMMIT_ID"
-
-# Update cargoHash
-nix-update --version=skip servo
diff --git a/pkgs/by-name/si/signalbackup-tools/package.nix b/pkgs/by-name/si/signalbackup-tools/package.nix
index fbee5740f382..2b8d0dcce12b 100644
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20251015";
+  version = "20251021";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     tag = version;
-    hash = "sha256-/rqYM0KLBcvYt2lpkOZKipb/lpVtkUevGFNWVenPbOk=";
+    hash = "sha256-m9Mg55e9M/v+0ucW6RMNBnY4JLJGY43jwFWufpv2xSY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/su/subxt/package.nix b/pkgs/by-name/su/subxt/package.nix
index 6d176cd6c643..b36424f3e907 100644
--- a/pkgs/by-name/su/subxt/package.nix
+++ b/pkgs/by-name/su/subxt/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "subxt";
-  version = "0.43.0";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "subxt";
     rev = "v${version}";
-    hash = "sha256-BV/zP0L0gDmLSuzkp4OkOPfgldXBUiaHL4rciM7lrno=";
+    hash = "sha256-gn8PdVvXGDEAfeDMXtMILsGBTy6y1jFdYXVeFrbHNyo=";
   };
 
-  cargoHash = "sha256-7kmxnlhgNj0hY9FwVrzmdHw73Jf/pSeTHi6sqDg9X24=";
+  cargoHash = "sha256-JLQr2GDdAFXlsr2F9a5VQ8HwAFpEhYWfsLEdLfABGDM=";
 
   # Only build the command line client
   cargoBuildFlags = [
diff --git a/pkgs/by-name/tr/trurl/package.nix b/pkgs/by-name/tr/trurl/package.nix
index 053e58c8b29d..8d0dcad7b22e 100644
--- a/pkgs/by-name/tr/trurl/package.nix
+++ b/pkgs/by-name/tr/trurl/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   curl,
   python3,
   perl,
@@ -20,6 +21,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-VCMT4WgZ6LG7yiKaRy7KTgTkbACVXb4rw62lWnVAuP0=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/curl/trurl/commit/f22a2c45956f35702e437fb83ac05376f1956ec5.patch";
+      hash = "sha256-7CkUs5tMk77WKc7SlgE2NslHtU5cViKSGhHj3IBlpWo=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs scripts/*
   '';
diff --git a/pkgs/by-name/tu/turso-cli/package.nix b/pkgs/by-name/tu/turso-cli/package.nix
index ba3e9dc26b15..b51755c4b0fb 100644
--- a/pkgs/by-name/tu/turso-cli/package.nix
+++ b/pkgs/by-name/tu/turso-cli/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "turso-cli";
-  version = "1.0.14";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-1wvr2E1sYcDSelTxfl+LYoSDnYBdQqmMt6+UzjpkKa0=";
+    hash = "sha256-c4RtEqMCpRgr4p6STWrRv7+UIA11WySTNhyvkLgzRso=";
   };
 
   vendorHash = "sha256-tBO21IgUczwMgrEyV7scV3YTY898lYHASaLeXqvBopU=";
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index c23132d65d2e..edeaabdb4575 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "42.0.0";
+  version = "42.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "aioesphomeapi";
     tag = "v${version}";
-    hash = "sha256-THhWp5X5oFjFrUMN8Hr0Vs9ElwFro16DoNzvU2Kux/4=";
+    hash = "sha256-3ao0RM+NFzbsj0Ws+A19S+OGwinZI+syU8PFgqcIYMU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-import-export/default.nix b/pkgs/development/python-modules/django-import-export/default.nix
index 15890451fe7a..b0788bb9de88 100644
--- a/pkgs/development/python-modules/django-import-export/default.nix
+++ b/pkgs/development/python-modules/django-import-export/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "django-import-export";
-  version = "4.3.10";
+  version = "4.3.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-import-export";
     repo = "django-import-export";
     tag = version;
-    hash = "sha256-amc5Qp3tdtqUGGN+DMT/r/CKMkMNnx5ryA+HlzQEejk=";
+    hash = "sha256-52nlqgKWh37Qr5UvCRBEPz2WHb2BU987+Ibt9yQyFVM=";
   };
 
   pythonRelaxDeps = [ "tablib" ];
diff --git a/pkgs/development/python-modules/ecdsa/default.nix b/pkgs/development/python-modules/ecdsa/default.nix
index 11fb0ac08cc4..8950bd0d9b71 100644
--- a/pkgs/development/python-modules/ecdsa/default.nix
+++ b/pkgs/development/python-modules/ecdsa/default.nix
@@ -1,28 +1,54 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pkgs,
+  fetchFromGitHub,
+  gitUpdater,
+  hypothesis,
+  openssl,
+  pytestCheckHook,
+  setuptools,
   six,
 }:
 
 buildPythonPackage rec {
   pname = "ecdsa";
   version = "0.19.1";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-R4y6e2JVWGb8s7s/6YXgbey9to71VxPE5auYxX1QjmE=";
+  src = fetchFromGitHub {
+    owner = "tlsfuzzer";
+    repo = "python-ecdsa";
+    tag = "python-ecdsa-${version}";
+    hash = "sha256-PjOjHQziQ9ohXH82Ocaowj/AtsXHMHDhatFPQNccyC8=";
   };
 
-  propagatedBuildInputs = [ six ];
-  # Only needed for tests
-  nativeCheckInputs = [ pkgs.openssl ];
+  build-system = [ setuptools ];
 
-  meta = with lib; {
+  dependencies = [ six ];
+
+  pythonImportsCheck = [ "ecdsa" ];
+
+  nativeCheckInputs = [
+    hypothesis
+    openssl # Only needed for tests
+    pytestCheckHook
+  ];
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "python-ecdsa-";
+  };
+
+  meta = {
+    changelog = "https://github.com/tlsfuzzer/python-ecdsa/blob/${src.tag}/NEWS";
     description = "ECDSA cryptographic signature library";
     homepage = "https://github.com/warner/python-ecdsa";
-    license = licenses.mit;
+    license = lib.licenses.mit;
+    knownVulnerabilities = [
+      # "I don't want people to use this library in production environments.
+      # It's a teaching tool, it's a testing tool, it's absolutely not an
+      # production grade implementation."
+      # https://github.com/tlsfuzzer/python-ecdsa/issues/330
+      "CVE-2024-23342"
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/edk2-pytool-library/default.nix b/pkgs/development/python-modules/edk2-pytool-library/default.nix
index d90b312b155b..a7f996d33900 100644
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "edk2-pytool-library";
-  version = "0.23.8";
+  version = "0.23.10";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "tianocore";
     repo = "edk2-pytool-library";
     tag = "v${version}";
-    hash = "sha256-JSOijiH/de/bItNt7yNu8+P21rI7YqiTf54zV2Ij5Gs=";
+    hash = "sha256-Q10CjpNd6e5xULziJsBTAcEWMaG68ixBnfHUeOxTyj0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 8b42a9d32ba4..c408ab3d9282 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.8.12";
+  version = "1.8.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastai";
     repo = "fastcore";
     tag = version;
-    hash = "sha256-YJONK7WMAQLCkROosGbT5C1G/JtTC7iZs2t+mx03yOo=";
+    hash = "sha256-5bgFV7ZGk+s8jjQaE13lWY+fIStin701ZrzyoJ7ziyY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/firedrake-fiat/default.nix b/pkgs/development/python-modules/firedrake-fiat/default.nix
index 5255fa695da8..015a3fd91b15 100644
--- a/pkgs/development/python-modules/firedrake-fiat/default.nix
+++ b/pkgs/development/python-modules/firedrake-fiat/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "firedrake-fiat";
-  version = "2025.4.2";
+  version = "2025.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firedrakeproject";
     repo = "fiat";
     tag = version;
-    hash = "sha256-SIi/4JW9L4kyFxEmbG9pqe0QtY80UMOh7LSFLmrHhZY=";
+    hash = "sha256-kyQe4VFzcK1idMt/NNND2cytGUryyhh5+ZP292zxT7c=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/firedrake/default.nix b/pkgs/development/python-modules/firedrake/default.nix
index 4788e344cf05..4723401106cc 100644
--- a/pkgs/development/python-modules/firedrake/default.nix
+++ b/pkgs/development/python-modules/firedrake/default.nix
@@ -23,6 +23,7 @@
   libsupermesh,
   loopy,
   petsc4py,
+  petsctools,
   numpy,
   packaging,
   pkgconfig,
@@ -35,6 +36,7 @@
   scipy,
   sympy,
   islpy,
+  vtk,
   matplotlib,
   immutabledict,
 
@@ -59,36 +61,31 @@ let
 in
 buildPythonPackage rec {
   pname = "firedrake";
-  version = "2025.4.2";
+  version = "2025.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firedrakeproject";
     repo = "firedrake";
     tag = version;
-    hash = "sha256-bAGmXoHPAdMYJMMQYVq98LYro1Vd+o9pfvXC3BsQUf0=";
+    hash = "sha256-paZNs6T9v7TNSdc8YJTjNcQvGrPg/Sy9K27/aUxNu5w=";
   };
 
-  postPatch =
-    # relax build-dependency petsc4py
-    ''
-      substituteInPlace pyproject.toml --replace-fail \
-        "petsc4py==3.23.4" "petsc4py"
-    ''
-    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      substituteInPlace firedrake/petsc.py --replace-fail \
-        'program = ["ldd"]' \
-        'program = ["${lib.getExe' pax-utils "lddtree"}"]'
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      substituteInPlace firedrake/petsc.py --replace-fail \
-        'program = ["otool"' \
-        'program = ["${lib.getExe' stdenv.cc.bintools.bintools "otool"}"'
-    '';
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/firedrakeproject/firedrake/pull/4632/commits/717ae8a62e19e0cc91419c12ca14170d252b2bb9.patch?full_index=1";
+      hash = "sha256-XHIcXmfh/brlQkrM4FTRvTrOovLvBN5mBrqZpZewTnc=";
+    })
+  ];
+
+  # relax build-dependency petsc4py
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail \
+      "petsc4py==3.24.0" "petsc4py"
+  '';
 
   pythonRelaxDeps = [
     "decorator"
-    "slepc4py"
   ];
 
   build-system = [
@@ -117,6 +114,7 @@ buildPythonPackage rec {
     libsupermesh
     loopy
     petsc4py
+    petsctools
     numpy
     packaging
     pkgconfig
@@ -128,6 +126,7 @@ buildPythonPackage rec {
     rtree
     scipy
     sympy
+    vtk
     # required by script spydump
     matplotlib
     # required by pyop2
@@ -155,20 +154,11 @@ buildPythonPackage rec {
     writableTmpDirAsHomeHook
   ];
 
-  # These scripts are used by official sdist/editable_wheel only
-  postInstall = ''
-    rm $out/bin/firedrake-{check,status,run-split-tests}
-  '';
-
-  preCheck = ''
-    rm -rf firedrake pyop2 tinyasm tsfc
-  '';
-
   # run official smoke tests
   checkPhase = ''
     runHook preCheck
 
-    make check
+    $out/bin/firedrake-check
 
     runHook postCheck
   '';
diff --git a/pkgs/development/python-modules/home-assistant-chip-core/default.nix b/pkgs/development/python-modules/home-assistant-chip-core/default.nix
index ce3dd7cba288..fbbc011d0b6a 100644
--- a/pkgs/development/python-modules/home-assistant-chip-core/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-core/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   aenum,
   home-assistant-chip-wheels,
   coloredlogs,
@@ -9,7 +8,6 @@
   cryptography,
   dacite,
   deprecation,
-  ecdsa,
   ipdb,
   mobly,
   pygobject3,
@@ -22,8 +20,6 @@ buildPythonPackage rec {
   inherit (home-assistant-chip-wheels) version;
   format = "wheel";
 
-  disabled = pythonOlder "3.7";
-
   src = home-assistant-chip-wheels;
 
   # format=wheel needs src to be a wheel not a folder of wheels
@@ -31,13 +27,12 @@ buildPythonPackage rec {
     src=($src/home_assistant_chip_core*.whl)
   '';
 
-  propagatedBuildInputs = [
+  dependencies = [
     aenum
     coloredlogs
     construct
     cryptography
     dacite
-    ecdsa
     rich
     pyyaml
     ipdb
diff --git a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
index ae78ed9cb1d3..a856179eee7a 100644
--- a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
@@ -166,6 +166,9 @@ stdenv.mkDerivation rec {
       patch -p1 < $patch
     done
 
+    # ecdsa is insecure and only used in tests
+    patch -p1 < ${./dont-import-ecdsa.patch}
+
     # unpin dependencies
     # there are many files to modify, in different formats
     sed -i 's/==.*$//' third_party/pigweed/repo/pw_env_setup/py/pw_env_setup/virtualenv_setup/python_base_requirements.txt
diff --git a/pkgs/development/python-modules/home-assistant-chip-wheels/dont-import-ecdsa.patch b/pkgs/development/python-modules/home-assistant-chip-wheels/dont-import-ecdsa.patch
new file mode 100644
index 000000000000..ec1bb87bd8ac
--- /dev/null
+++ b/pkgs/development/python-modules/home-assistant-chip-wheels/dont-import-ecdsa.patch
@@ -0,0 +1,44 @@
+diff --git a/src/controller/python/chip/crypto/p256keypair.py b/src/controller/python/chip/crypto/p256keypair.py
+index 30198eabee..926f55318e 100644
+--- a/src/controller/python/chip/crypto/p256keypair.py
++++ b/src/controller/python/chip/crypto/p256keypair.py
+@@ -22,7 +22,6 @@ from ctypes import (CFUNCTYPE, POINTER, _Pointer, c_bool, c_char, c_size_t, c_ui
+ from typing import TYPE_CHECKING
+ 
+ from chip import native
+-from ecdsa import ECDH, NIST256p, SigningKey  # type: ignore
+ 
+ # WORKAROUND: Create a subscriptable pointer type (with square brackets) to ensure compliance of type hinting with ctypes
+ if not TYPE_CHECKING:
+@@ -133,31 +132,3 @@ class P256Keypair:
+         format of section 2.3.3 of the SECG SEC 1 standard.
+         '''
+         raise NotImplementedError()
+-
+-
+-class TestP256Keypair(P256Keypair):
+-    ''' The P256Keypair for testing purpose. It is not safe for any productions use
+-    '''
+-
+-    def __init__(self, private_key: SigningKey = None):
+-        super().__init__()
+-
+-        if private_key is None:
+-            self._key = SigningKey.generate(NIST256p)
+-        else:
+-            self._key = private_key
+-
+-        self._pubkey = self._key.verifying_key.to_string(encoding='uncompressed')
+-
+-    @property
+-    def public_key(self) -> bytes:
+-        return self._pubkey
+-
+-    def ECDSA_sign_msg(self, message: bytes) -> bytes:
+-        return self._key.sign_deterministic(message, hashfunc=hashlib.sha256)
+-
+-    def ECDH_derive_secret(self, remote_pubkey: bytes) -> bytes:
+-        ecdh = ECDH(curve=NIST256p)
+-        ecdh.load_private_key(self._key)
+-        ecdh.load_received_public_key_bytes(remote_pubkey[1:])
+-        return ecdh.ecdh1.generate_sharedsecret_bytes()
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 986d4bd3711b..c6ee6dafdf6b 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202510201";
+  version = "0.1.202510221";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-E9yFns1sRSyiFqQA3jXTSvMK7a7nj/UfUFUzh1PlUhM=";
+    hash = "sha256-jFx4B9RQ0tcYySCRdaClVN4tovLA4pPIhJvj7Ld5J1A=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/lacuscore/default.nix b/pkgs/development/python-modules/lacuscore/default.nix
index 70b208bd794d..0313e19e055e 100644
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "lacuscore";
-  version = "1.19.1";
+  version = "1.19.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ail-project";
     repo = "LacusCore";
     tag = "v${version}";
-    hash = "sha256-5cMgeZlbgK+YixHiwnolqxLUVNbfVdabtVZWZIGzjdk=";
+    hash = "sha256-8cAN560wg2MwZ9EooHVz3dsoNC5WQWhCAGqu48ZeRtY=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
index b35b48626644..c97cd755c8e6 100644
--- a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-mermaid2-plugin";
-  version = "1.2.2";
+  version = "1.2.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "fralau";
     repo = "mkdocs-mermaid2-plugin";
     tag = "v${version}";
-    hash = "sha256-4WuE9fO4o0uN48W2Rwd4gKa6pK9bqyrcGjFLEkfJ0E4=";
+    hash = "sha256-EsfcOnfjZpAndYccN8WTpfLoUAlc5JQkgoy1ro1hMRo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/okta/default.nix b/pkgs/development/python-modules/okta/default.nix
index 4bbf77f2c4a0..c5a59b064598 100644
--- a/pkgs/development/python-modules/okta/default.nix
+++ b/pkgs/development/python-modules/okta/default.nix
@@ -6,7 +6,6 @@
   fetchPypi,
   flatdict,
   jwcrypto,
-  pycryptodome,
   pycryptodomex,
   pydash,
   pyfakefs,
@@ -15,7 +14,6 @@
   pytest-mock,
   pytest-recording,
   pytestCheckHook,
-  python-jose,
   pythonOlder,
   pyyaml,
   setuptools,
@@ -42,11 +40,9 @@ buildPythonPackage rec {
     aiohttp
     flatdict
     jwcrypto
-    pycryptodome
     pycryptodomex
     pydash
     pyjwt
-    python-jose
     pyyaml
     xmltodict
     yarl
diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix
index 1e4b06e2d871..897e31c8e350 100644
--- a/pkgs/development/python-modules/orbax-checkpoint/default.nix
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@@ -18,6 +18,7 @@
   nest-asyncio,
   numpy,
   protobuf,
+  psutil,
   pyyaml,
   simplejson,
   tensorstore,
@@ -36,14 +37,14 @@
 
 buildPythonPackage rec {
   pname = "orbax-checkpoint";
-  version = "0.11.25";
+  version = "0.11.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "orbax";
     tag = "v${version}";
-    hash = "sha256-myhPWKP2uI9NQKZki1Rr+B6Kusn0qNWREKHkiDrSheA=";
+    hash = "sha256-CY5Bs/o8fU57QJETYnyJVkP7Y+cahpqZftyIJNU+GvU=";
   };
 
   sourceRoot = "${src.name}/checkpoint";
@@ -65,6 +66,7 @@ buildPythonPackage rec {
     nest-asyncio
     numpy
     protobuf
+    psutil
     pyyaml
     simplejson
     tensorstore
diff --git a/pkgs/development/python-modules/plugp100/default.nix b/pkgs/development/python-modules/plugp100/default.nix
index de9c7beb41cc..9e139df6a276 100644
--- a/pkgs/development/python-modules/plugp100/default.nix
+++ b/pkgs/development/python-modules/plugp100/default.nix
@@ -9,11 +9,10 @@
   aiohttp,
   jsons,
   requests,
+  cryptography,
   # Test inputs
   pytestCheckHook,
-  pyyaml,
   pytest-asyncio,
-  async-timeout,
 }:
 
 buildPythonPackage rec {
@@ -34,15 +33,14 @@ buildPythonPackage rec {
     requests
     aiohttp
     semantic-version
+    cryptography
     scapy
     urllib3
-    pyyaml
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio
-    async-timeout
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/pyadjoint-ad/default.nix b/pkgs/development/python-modules/pyadjoint-ad/default.nix
index 5b91b9dcb6aa..6a6ad8d50eab 100644
--- a/pkgs/development/python-modules/pyadjoint-ad/default.nix
+++ b/pkgs/development/python-modules/pyadjoint-ad/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyadjoint-ad";
-  version = "2025.04.1";
+  version = "2025.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dolfin-adjoint";
     repo = "pyadjoint";
     tag = version;
-    hash = "sha256-S9A0qCatnnLuOkqWsEC4tjVY1HZqqi2T5iXu+WUoN24=";
+    hash = "sha256-caW2X4q0mHnD8CEh5jjelD4xBth/R/8/P3m0tTeO/LQ=";
   };
 
   build-system = [
@@ -30,8 +30,6 @@ buildPythonPackage rec {
   ];
 
   pythonImportsCheck = [
-    # The firedrake_adjoint module is deprecated and requires a cyclic dependency of firedrake
-    # "firedrake_adjoint"
     "numpy_adjoint"
     "pyadjoint"
     "pyadjoint.optimization"
diff --git a/pkgs/development/python-modules/pyecharts/default.nix b/pkgs/development/python-modules/pyecharts/default.nix
index 22a55c389e53..06f7db4eb268 100644
--- a/pkgs/development/python-modules/pyecharts/default.nix
+++ b/pkgs/development/python-modules/pyecharts/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyecharts";
-  version = "2.0.8";
+  version = "2.0.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "pyecharts";
     repo = "pyecharts";
     tag = "v${version}";
-    hash = "sha256-Aax/HpYJRrfituiAIT7Y6F9v9tX9EmVXtr+4R98tces=";
+    hash = "sha256-AMdPsTQsndc0fr4NF2AnJy98k4I2832/GNWeY4IWSRA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-jose/default.nix b/pkgs/development/python-modules/python-jose/default.nix
index 13e7257d63b3..539d1e5644bb 100644
--- a/pkgs/development/python-modules/python-jose/default.nix
+++ b/pkgs/development/python-modules/python-jose/default.nix
@@ -2,14 +2,11 @@
   lib,
   buildPythonPackage,
   cryptography,
-  ecdsa,
   fetchFromGitHub,
   fetchpatch,
-  pyasn1,
   pycrypto,
   pycryptodome,
   pytestCheckHook,
-  rsa,
   setuptools,
 }:
 
@@ -34,17 +31,18 @@ buildPythonPackage rec {
     })
   ];
 
-  pythonRelaxDeps = [
-    # https://github.com/mpdavis/python-jose/pull/376
+  pythonRemoveDeps = [
+    # These aren't needed if the cryptography backend is used:
+    # https://github.com/mpdavis/python-jose/blob/3.5.0/README.rst#cryptographic-backends
+    "ecdsa"
     "pyasn1"
+    "rsa"
   ];
 
   build-system = [ setuptools ];
 
   dependencies = [
-    ecdsa
-    pyasn1
-    rsa
+    cryptography
   ];
 
   optional-dependencies = {
diff --git a/pkgs/development/python-modules/scapy/default.nix b/pkgs/development/python-modules/scapy/default.nix
index 5c457b80a29c..e554dd9df25a 100644
--- a/pkgs/development/python-modules/scapy/default.nix
+++ b/pkgs/development/python-modules/scapy/default.nix
@@ -4,25 +4,15 @@
   stdenv,
   lib,
   isPyPy,
-  pycrypto,
-  ecdsa, # TODO
   mock,
   python-can,
   brotli,
-  withOptionalDeps ? true,
-  tcpdump,
   ipython,
-  withCryptography ? true,
   cryptography,
   withVoipSupport ? true,
   sox,
-  withPlottingSupport ? true,
   matplotlib,
-  withGraphicsSupport ? false,
   pyx,
-  texliveBasic,
-  graphviz,
-  imagemagick,
   withManufDb ? false,
   wireshark,
   libpcap,
@@ -63,22 +53,15 @@ buildPythonPackage rec {
 
   buildInputs = lib.optional withVoipSupport sox;
 
-  propagatedBuildInputs = [
-    pycrypto
-    ecdsa
-  ]
-  ++ lib.optionals withOptionalDeps [
-    tcpdump
-    ipython
-  ]
-  ++ lib.optional withCryptography cryptography
-  ++ lib.optional withPlottingSupport matplotlib
-  ++ lib.optionals withGraphicsSupport [
-    pyx
-    texliveBasic
-    graphviz
-    imagemagick
-  ];
+  optional-dependencies = {
+    all = [
+      cryptography
+      ipython
+      matplotlib
+      pyx
+    ];
+    cli = [ ipython ];
+  };
 
   # Running the tests seems too complicated:
   doCheck = false;
diff --git a/pkgs/development/python-modules/sentence-transformers/default.nix b/pkgs/development/python-modules/sentence-transformers/default.nix
index 456a2f3f2c81..0e63b52faee1 100644
--- a/pkgs/development/python-modules/sentence-transformers/default.nix
+++ b/pkgs/development/python-modules/sentence-transformers/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "sentence-transformers";
-  version = "5.1.1";
+  version = "5.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "UKPLab";
+    owner = "huggingface";
     repo = "sentence-transformers";
     tag = "v${version}";
-    hash = "sha256-n0ZP01BU/s9iJ+RP7rNlBjD11jNDj8A8Q/seekh56nA=";
+    hash = "sha256-FNJ4mWBcgy3J8ZJtHt+uBgNmvMnqphj+sLMmBvgdB1k=";
   };
 
   build-system = [ setuptools ];
@@ -74,6 +74,11 @@ buildPythonPackage rec {
     "test_ParaphraseMiningEvaluator"
     "test_TripletEvaluator"
     "test_cmnrl_same_grad"
+    "test_default_weights_when_none"
+    "test_dense_load_and_save_in_other_precisions"
+    "test_dimension_exceeds_model_dimension_raises_error"
+    "test_dimensions_sorted_descending"
+    "test_empty_matryoshka_dims_raises_error"
     "test_forward"
     "test_initialization_with_embedding_dim"
     "test_initialization_with_embedding_weights"
@@ -81,7 +86,10 @@ buildPythonPackage rec {
     "test_mine_hard_negatives_with_prompt"
     "test_model_card_base"
     "test_model_card_reuse"
+    "test_model_dimension_not_in_dims_warns"
+    "test_mse_loss_matryoshka"
     "test_nanobeir_evaluator"
+    "test_negative_dimension_raises_error"
     "test_paraphrase_mining"
     "test_pretrained_model"
     "test_router_as_middle_module"
@@ -101,6 +109,10 @@ buildPythonPackage rec {
     "test_trainer"
     "test_trainer_invalid_column_names"
     "test_trainer_multi_dataset_errors"
+    "test_valid_initialization_no_warnings"
+    "test_valid_initialization_with_weights"
+    "test_weights_length_mismatch_raises_error"
+    "test_zero_dimension_raises_error"
 
     # Assertion error: Sparse operations take too long
     # (namely, load-sensitive test)
@@ -141,8 +153,8 @@ buildPythonPackage rec {
 
   meta = {
     description = "Multilingual Sentence & Image Embeddings with BERT";
-    homepage = "https://github.com/UKPLab/sentence-transformers";
-    changelog = "https://github.com/UKPLab/sentence-transformers/releases/tag/${src.tag}";
+    homepage = "https://github.com/huggingface/sentence-transformers";
+    changelog = "https://github.com/huggingface/sentence-transformers/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ dit7ya ];
   };
diff --git a/pkgs/development/python-modules/sshpubkeys/default.nix b/pkgs/development/python-modules/sshpubkeys/default.nix
index 0f2fc24474a1..28480e772d2f 100644
--- a/pkgs/development/python-modules/sshpubkeys/default.nix
+++ b/pkgs/development/python-modules/sshpubkeys/default.nix
@@ -2,31 +2,36 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   cryptography,
-  ecdsa,
 }:
 
 buildPythonPackage rec {
   version = "3.3.1";
-  format = "setuptools";
   pname = "sshpubkeys";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ojarva";
-    repo = "python-${pname}";
-    rev = version;
-    sha256 = "1qsixmqg97kyvg1naw76blq4314vaw4hl5f9wi0v111mcmdia1r4";
+    repo = "python-sshpubkeys";
+    # https://github.com/ojarva/python-sshpubkeys/issues/94
+    tag = "v3.2.0";
+    hash = "sha256-2OJatnQuCt9XQ797F5nEmgEZl5/tu9lrAry5yBGW61g=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     cryptography
-    ecdsa
   ];
 
-  meta = with lib; {
+  pythonImportsCheck = [ "sshpubkeys" ];
+
+  meta = {
+    changelog = "https://github.com/ojarva/python-sshpubkeys/releases/tag/${src.tag}";
     description = "OpenSSH Public Key Parser for Python";
     homepage = "https://github.com/ojarva/python-sshpubkeys";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/games/openra_2019/default.nix b/pkgs/games/openra_2019/default.nix
index e2e8c2eac202..375f7b7eef29 100644
--- a/pkgs/games/openra_2019/default.nix
+++ b/pkgs/games/openra_2019/default.nix
@@ -76,6 +76,7 @@ pkgs.recurseIntoAttrs rec {
       homepage,
       mods,
       src,
+      pos,
     }@engine:
     # Allow specifying the name at a later point if no name has been given.
     let
@@ -101,6 +102,7 @@ pkgs.recurseIntoAttrs rec {
       description,
       homepage,
       src,
+      pos,
       engine,
       assetsError ? "",
     }@mod:
diff --git a/pkgs/games/openra_2019/engine.nix b/pkgs/games/openra_2019/engine.nix
index ae207f24729c..ed6342ca0f92 100644
--- a/pkgs/games/openra_2019/engine.nix
+++ b/pkgs/games/openra_2019/engine.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation (
       )}
     '';
 
+    inherit (engine) pos;
     meta = {
       inherit (engine) description homepage;
     };
diff --git a/pkgs/games/openra_2019/engines.nix b/pkgs/games/openra_2019/engines.nix
index 3bbce300cfa5..b3eae5a67322 100644
--- a/pkgs/games/openra_2019/engines.nix
+++ b/pkgs/games/openra_2019/engines.nix
@@ -27,6 +27,7 @@ let
         repo = "OpenRA";
         inherit rev sha256 postFetch;
       };
+      pos = __curPos;
     } name).overrideAttrs
       (origAttrs: {
         postInstall = ''
diff --git a/pkgs/games/openra_2019/mod.nix b/pkgs/games/openra_2019/mod.nix
index 13152e7caa81..d174778608dd 100644
--- a/pkgs/games/openra_2019/mod.nix
+++ b/pkgs/games/openra_2019/mod.nix
@@ -110,6 +110,7 @@ stdenv.mkDerivation (
       runHook postInstall
     '';
 
+    inherit (mod) pos;
     meta = {
       inherit (mod) description homepage;
     };
diff --git a/pkgs/games/openra_2019/mods.nix b/pkgs/games/openra_2019/mods.nix
index a9f95d0f25c8..cd983b85b201 100644
--- a/pkgs/games/openra_2019/mods.nix
+++ b/pkgs/games/openra_2019/mods.nix
@@ -24,6 +24,7 @@ in
       rev = "fc3cf0baf2b827650eaae9e1d2335a3eed24bac9";
       sha256 = "15w91xs253gyrlzsgid6ixxjazx0fbzick6vlkiay0znb58n883m";
     };
+    pos = __curPos;
     engine = {
       version = "b8a7dd5";
       src = fetchFromGitHub {
@@ -48,6 +49,7 @@ in
       rev = "69a4aa708e2c26376469c0048fac13592aa452ca";
       sha256 = "1mfch4s6c05slyqvxllklbxpqq8dqcbx3515n3gyylyq43gq481r";
     };
+    pos = __curPos;
     engine = rec {
       version = "release-20181215";
       mods = [
@@ -81,6 +83,7 @@ in
       rev = "ffcd6ba72979e5f77508136ed7b0efc13e4b100e";
       sha256 = "07g4qw909649s3i1yhw75613mpwfka05jana5mpp5smhnf0pkack";
     };
+    pos = __curPos;
     engine = {
       version = "DarkReign";
       src = fetchFromGitHub {
@@ -105,6 +108,7 @@ in
       rev = "4f5e11d916e4a03d8cf1c97eef484ce2d77d7df2";
       sha256 = "1wnl4qrlhynnlahgdlxwhgsdba5wgdg9yrv9f8hkgi69j60szypd";
     };
+    pos = __curPos;
     engine = rec {
       version = "gen-20190128_3";
       src = fetchFromGitHub {
@@ -134,6 +138,7 @@ in
         rev = "5530babcb05170e0959e4cf2b079161e9fedde4f";
         sha256 = "07jczrarmgm6zdk0myzwgq200x19yvpjyxrnhdac08mjgyz75zk1";
       };
+      pos = __curPos;
       engine = {
         version = "4e8eab4ca00d1910203c8a103dfd2c002714daa8";
         src = fetchFromGitHub {
@@ -165,6 +170,7 @@ in
       rev = "c9be8f2a6f1dd710b1aedd9d5b00b4cf5020e2fe";
       sha256 = "09fp7k95jd6hjqdasbspbd43z5670wkyzbbgqkll9dfsrv0sky0v";
     };
+    pos = __curPos;
     engine = {
       version = "MedievalWarfareEngine";
       src = fetchFromGitHub {
@@ -189,6 +195,7 @@ in
       rev = "2f7c700d6d63c0625e7158ef3098221fa6741569";
       sha256 = "11vnzwczn47wjfrq6y7z9q234p27ihdrcl5p87i6h2xnrpwi8b6m";
     };
+    pos = __curPos;
     engine = rec {
       version = "release-20180923";
       src = fetchFromGitHub {
@@ -217,6 +224,7 @@ in
       rev = "c76c13e9f0912a66ddebae8d05573632b19736b2";
       sha256 = "1cnr3ccvrkjlv8kkdcglcfh133yy0fkva9agwgvc7wlj9n5ydl4g";
     };
+    pos = __curPos;
     engine = rec {
       version = "release-20190314";
       src = fetchFromGitHub {
@@ -241,6 +249,7 @@ in
       rev = "9230e6f1dd9758467832aee4eda115e18f0e635f";
       sha256 = "0bwbmmlhp1kh8rgk2nx1ca9vqssj849amndacf318d61gksc1w9n";
     };
+    pos = __curPos;
     engine = {
       version = "f3873ae";
       mods = [ "as" ];
@@ -270,6 +279,7 @@ in
       rev = "ac000cc15377cdf6d3c2b72c737d692aa0ed8bcd";
       sha256 = "16mzs5wcxj9nlpcyx2c87idsqpbm40lx0rznsccclnlb3hiwqas9";
     };
+    pos = __curPos;
     engine = {
       version = "SP-22-04-19";
       mods = [
@@ -298,6 +308,7 @@ in
       rev = "23e1f3e5d8b98c936797b6680d95d56a69a9e2ab";
       sha256 = "104clmxphchs7r8y7hpmw103bychayz80bqj98bp89i64nv9d89x";
     };
+    pos = __curPos;
     engine = {
       version = "6de92de";
       src = fetchFromGitHub {
@@ -322,6 +333,7 @@ in
       rev = "128dc53741fae923f4af556f2293ceaa0cf571f0";
       sha256 = "1mhr8kyh313z52gdrqv31d6z7jvdldiajalca5mcr8gzg6mph66p";
     };
+    pos = __curPos;
     engine = rec {
       version = "unplugged-cd82382";
       src = fetchFromGitHub {
@@ -346,6 +358,7 @@ in
       rev = "5b8b952dbe21f194a6d00485f20e215ce8362712";
       sha256 = "0hxzrqnz5d7qj1jjr20imiyih62x1cnmndf75nnil4c4sj82f9a6";
     };
+    pos = __curPos;
     engine = rec {
       version = "release-20190314";
       src = fetchFromGitHub {
diff --git a/pkgs/misc/logging/beats/7.x.nix b/pkgs/misc/logging/beats/7.x.nix
index 660349b1ac00..13c7ce8e3979 100644
--- a/pkgs/misc/logging/beats/7.x.nix
+++ b/pkgs/misc/logging/beats/7.x.nix
@@ -42,8 +42,12 @@ let
     );
 in
 rec {
-  auditbeat7 = beat "auditbeat" { meta.description = "Lightweight shipper for audit data"; };
+  auditbeat7 = beat "auditbeat" {
+    pos = __curPos;
+    meta.description = "Lightweight shipper for audit data";
+  };
   filebeat7 = beat "filebeat" {
+    pos = __curPos;
     meta.description = "Lightweight shipper for logfiles";
     buildInputs = [ systemd ];
     tags = [ "withjournald" ];
@@ -51,8 +55,12 @@ rec {
       patchelf --set-rpath ${lib.makeLibraryPath [ (lib.getLib systemd) ]} "$out/bin/filebeat"
     '';
   };
-  heartbeat7 = beat "heartbeat" { meta.description = "Lightweight shipper for uptime monitoring"; };
+  heartbeat7 = beat "heartbeat" {
+    pos = __curPos;
+    meta.description = "Lightweight shipper for uptime monitoring";
+  };
   metricbeat7 = beat "metricbeat" {
+    pos = __curPos;
     meta.description = "Lightweight shipper for metrics";
     passthru.tests = lib.optionalAttrs config.allowUnfree (
       assert metricbeat7.drvPath == nixosTests.elk.unfree.ELK-7.elkPackages.metricbeat.drvPath;
@@ -63,6 +71,7 @@ rec {
   };
   packetbeat7 = beat "packetbeat" {
     buildInputs = [ libpcap ];
+    pos = __curPos;
     meta.description = "Network packet analyzer that ships data to Elasticsearch";
     meta.longDescription = ''
       Packetbeat is an open source network packet analyzer that ships the
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 752e9d0440ca..2ffe92954ffb 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -116,10 +116,15 @@ let
         prePatch = ''
           sed -i 's,[^"]*/var/log,/var/log,g' storage/mroonga/vendor/groonga/CMakeLists.txt
         '';
-        env = lib.optionalAttrs (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isGnu) {
-          # MariaDB uses non-POSIX fopen64, which musl only conditionally defines.
-          NIX_CFLAGS_COMPILE = "-D_LARGEFILE64_SOURCE";
-        };
+        env =
+          lib.optionalAttrs (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isGnu) {
+            # MariaDB uses non-POSIX fopen64, which musl only conditionally defines.
+            NIX_CFLAGS_COMPILE = "-D_LARGEFILE64_SOURCE";
+          }
+          // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) {
+            # Detection of netdb.h doesnt work for some reason on x86_64-darwin
+            NIX_CFLAGS_COMPILE = "-DHAVE_NETDB_H";
+          };
 
         patches = [
           ./patch/cmake-includedir.patch
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1477e0d7a128..96c8c0de6ea3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11839,21 +11839,6 @@ with pkgs;
     withConplay = false;
   };
 
-  rofi-emoji = (callPackage ../applications/misc/rofi-emoji { }).v3;
-
-  rofi-rbw = python3Packages.callPackage ../applications/misc/rofi-rbw {
-    waylandSupport = false;
-    x11Support = false;
-  };
-
-  rofi-rbw-wayland = python3Packages.callPackage ../applications/misc/rofi-rbw {
-    waylandSupport = true;
-  };
-
-  rofi-rbw-x11 = python3Packages.callPackage ../applications/misc/rofi-rbw {
-    x11Support = true;
-  };
-
   # a somewhat more maintained fork of ympd
   memento = qt6Packages.callPackage ../applications/video/memento { };