diff --git a/ci/eval/README.md b/ci/eval/README.md
index ec7429b7bc78..57cde7c65fe9 100644
--- a/ci/eval/README.md
+++ b/ci/eval/README.md
@@ -2,25 +2,44 @@
 
 The code in this directory is used by the [eval.yml](../../.github/workflows/eval.yml) GitHub Actions workflow to evaluate the majority of Nixpkgs for all PRs, effectively making sure that when the development branches are processed by Hydra, no evaluation failures are encountered.
 
-Furthermore it also allows local evaluation using
+Furthermore it also allows local evaluation using:
+
 ```
-nix-build ci -A eval.full \
-  --max-jobs 4 \
-  --cores 2 \
-  --arg chunkSize 10000 \
-  --arg evalSystems '["x86_64-linux" "aarch64-darwin"]'
+nix-build ci -A eval.baseline
 ```
 
+The most important two arguments are:
+- `--arg evalSystems`: The set of systems for which `nixpkgs` should be evaluated.
+  Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
+  Example: `--arg evalSystems '["x86_64-linux" "aarch64-darwin"]'`
+- `--arg quickTest`: Enables testing a single chunk of the current system only for quick iteration.
+  Example: `--arg quickTest true`
+
+The following arguments can be used to fine-tune performance:
 - `--max-jobs`: The maximum number of derivations to run at the same time.
   Only each [supported system](../supportedSystems.json) gets a separate derivation, so it doesn't make sense to set this higher than that number.
 - `--cores`: The number of cores to use for each job.
   Recommended to set this to the amount of cores on your system divided by `--max-jobs`.
-- `chunkSize`: The number of attributes that are evaluated simultaneously on a single core.
+- `--arg chunkSize`: The number of attributes that are evaluated simultaneously on a single core.
   Lowering this decreases memory usage at the cost of increased evaluation time.
   If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.
-- `evalSystems`: The set of systems for which `nixpkgs` should be evaluated.
-  Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
-
-A good default is to set `chunkSize` to 10000, which leads to about 3.6GB max memory usage per core, so suitable for fully utilising machines with 4 cores and 16GB memory, 8 cores and 32GB memory or 16 cores and 64GB memory.
+  The default is 5000.
+  Example: `--arg chunkSize 10000`
 
 Note that 16GB memory is the recommended minimum, while with less than 8GB memory evaluation time suffers greatly.
+
+## Local eval with rebuilds / comparison
+
+To compare two commits locally, first run the following on the baseline commit:
+
+```
+BASELINE=$(nix-build ci -A eval.baseline --no-out-link)
+```
+
+Then, on the commit with your changes:
+
+```
+nix-build ci -A eval.full --arg baseline $BASELINE
+```
+
+Keep in mind to otherwise pass the same set of arguments for both commands (`evalSystems`, `quickTest`, `chunkSize`).
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 8d79034db59e..14005ea401af 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -240,29 +240,44 @@ let
 
   compare = callPackage ./compare { };
 
+  baseline =
+    {
+      # Whether to evaluate on a specific set of systems, by default all are evaluated
+      evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
+      # The number of attributes per chunk, see ./README.md for more info.
+      chunkSize ? 5000,
+      quickTest ? false,
+    }:
+    symlinkJoin {
+      name = "nixpkgs-eval-baseline";
+      paths = map (
+        evalSystem:
+        singleSystem {
+          inherit quickTest evalSystem chunkSize;
+        }
+      ) evalSystems;
+    };
+
   full =
     {
       # Whether to evaluate on a specific set of systems, by default all are evaluated
       evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
       # The number of attributes per chunk, see ./README.md for more info.
-      chunkSize,
+      chunkSize ? 5000,
       quickTest ? false,
+      baseline,
     }:
     let
       diffs = symlinkJoin {
-        name = "diffs";
+        name = "nixpkgs-eval-diffs";
         paths = map (
           evalSystem:
-          let
-            eval = singleSystem {
-              inherit quickTest evalSystem chunkSize;
-            };
-          in
           diff {
             inherit evalSystem;
-            # Local "full" evaluation doesn't do a real diff.
-            beforeDir = eval;
-            afterDir = eval;
+            beforeDir = baseline;
+            afterDir = singleSystem {
+              inherit quickTest evalSystem chunkSize;
+            };
           }
         ) evalSystems;
       };
@@ -280,7 +295,8 @@ in
     combine
     compare
     # The above three are used by separate VMs in a GitHub workflow,
-    # while the below is intended for testing on a single local machine
+    # while the below are intended for testing on a single local machine
+    baseline
     full
     ;
 }
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index b899b5436511..fd5bc2b3945c 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -27,7 +27,11 @@
 - GCC 9, 10, 11, and 12 have been removed, as they have reached end‐of‐life upstream and are no longer supported.
 
 - `base16-builder` node package has been removed due to lack of upstream maintenance.
+
+- `buildGoModule` now warns if `<pkg>.passthru.overrideModAttrs` is lost during the overriding of its result packages.
+
 - `gentium` package now provides `Gentium-*.ttf` files, and not `GentiumPlus-*.ttf` files like before. The font identifiers `Gentium Plus*` are available in the `gentium-plus` package, and if you want to use the more recently updated package `gentium` [by sil](https://software.sil.org/gentium/), you should update your configuration files to use the `Gentium` font identifier.
+
 - `space-orbit` package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.
 
 - Derivations setting both `separateDebugInfo` and one of `allowedReferences`, `allowedRequisites`, `disallowedReferences` or `disallowedRequisites` must now set `__structuredAttrs` to `true`. The effect of reference whitelisting or blacklisting will be disabled on the `debug` output created by `separateDebugInfo`.
diff --git a/doc/using/configuration.chapter.md b/doc/using/configuration.chapter.md
index 8112656eac70..ac67d7a61459 100644
--- a/doc/using/configuration.chapter.md
+++ b/doc/using/configuration.chapter.md
@@ -31,7 +31,7 @@ Most unfree licenses prohibit either executing or distributing the software.
 
 ## Installing broken packages {#sec-allow-broken}
 
-There are two ways to try compiling a package which has been marked as broken.
+There are several ways to try compiling a package which has been marked as broken.
 
 -   For allowing the build of a broken package once, you can use an environment variable for a single invocation of the nix tools:
 
@@ -39,7 +39,15 @@ There are two ways to try compiling a package which has been marked as broken.
     $ export NIXPKGS_ALLOW_BROKEN=1
     ```
 
--   For permanently allowing broken packages to be built, you may add `allowBroken = true;` to your user's configuration file, like this:
+-   For permanently allowing broken packages that match some condition to be built, you may add `allowBrokenPredicate` to your user's configuration file with the desired condition, for example:
+
+    ```nix
+    {
+      allowBrokenPredicate = pkg: builtins.elem (pkgs.lib.getName pkg) [ "hello" ];
+    }
+    ```
+
+-   For permanently allowing all broken packages to be built, you may add `allowBroken = true;` to your user's configuration file, like this:
 
     ```nix
     { allowBroken = true; }
diff --git a/lib/modules.nix b/lib/modules.nix
index cc3148b0eea7..3330579952de 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1121,6 +1121,7 @@ let
       files = map (def: def.file) res.defsFinal;
       definitionsWithLocations = res.defsFinal;
       inherit (res) isDefined;
+      inherit (res.checkedAndMerged) valueMeta;
       # This allows options to be correctly displayed using `${options.path.to.it}`
       __toString = _: showOption loc;
     };
@@ -1164,7 +1165,14 @@ let
     # Type-check the remaining definitions, and merge them. Or throw if no definitions.
     mergedValue =
       if isDefined then
-        if all (def: type.check def.value) defsFinal then
+        if type.merge ? v2 then
+          # check and merge share the same closure
+          # .headError is either not-present, null, or a string describing the error
+          if checkedAndMerged.headError or null != null then
+            throw "A definition for option `${showOption loc}' is not of type `${type.description}'. TypeError: ${checkedAndMerged.headError.message}"
+          else
+            checkedAndMerged.value
+        else if all (def: type.check def.value) defsFinal then
           type.merge loc defsFinal
         else
           let
@@ -1177,6 +1185,43 @@ let
         throw
           "The option `${showOption loc}' was accessed but has no value defined. Try setting the option.";
 
+    checkedAndMerged =
+      (
+        # This function (which is immediately applied) checks that type.merge
+        # returns the proper attrset.
+        # Once use of the merge.v2 feature has propagated, consider removing this
+        # for an estimated one thousandth performance improvement (NixOS by nr.thunks).
+        {
+          headError,
+          value,
+          valueMeta,
+        }@args:
+        args
+      )
+        (
+          if type.merge ? v2 then
+            let
+              r = type.merge.v2 {
+                inherit loc;
+                defs = defsFinal;
+              };
+            in
+            r
+            // {
+              valueMeta = r.valueMeta // {
+                _internal = {
+                  inherit type;
+                };
+              };
+            }
+          else
+            {
+              headError = null;
+              value = mergedValue;
+              valueMeta = { };
+            }
+        );
+
     isDefined = defsFinal != [ ];
 
     optionalValue = if isDefined then { value = mergedValue; } else { };
@@ -1586,13 +1631,11 @@ let
         New option path as list of strings.
       */
       to,
-
       /**
         Release number of the first release that contains the rename, ignoring backports.
         Set it to the upcoming release, matching the nixpkgs/.version file.
       */
       sinceRelease,
-
     }:
     doRename {
       inherit from to;
diff --git a/lib/tests/checkAndMergeCompat.nix b/lib/tests/checkAndMergeCompat.nix
new file mode 100644
index 000000000000..dc6f26fbf917
--- /dev/null
+++ b/lib/tests/checkAndMergeCompat.nix
@@ -0,0 +1,379 @@
+{
+  pkgs ? import ../.. { },
+  currLibPath ? ../.,
+  prevLibPath ? "${
+    pkgs.fetchFromGitHub {
+      owner = "nixos";
+      repo = "nixpkgs";
+      # Parent commit of [#391544](https://github.com/NixOS/nixpkgs/pull/391544)
+      # Which was before the type.merge.v2 introduction
+      rev = "bcf94dd3f07189b7475d823c8d67d08b58289905";
+      hash = "sha256-MuMiIY3MX5pFSOCvutmmRhV6RD0R3CG0Hmazkg8cMFI=";
+    }
+  }/lib",
+}:
+let
+  lib = import currLibPath;
+
+  lib_with_merge_v2 = lib;
+  lib_with_merge_v1 = import prevLibPath;
+
+  getMatrix =
+    {
+      getType ? null,
+      # If getType is set this is only used as test prefix
+      # And the type from getType is used
+      outerTypeName,
+      innerTypeName,
+      value,
+      testAttrs,
+    }:
+    let
+      evalModules.call_v1 = lib_with_merge_v1.evalModules;
+      evalModules.call_v2 = lib_with_merge_v2.evalModules;
+      outerTypes.outer_v1 = lib_with_merge_v1.types;
+      outerTypes.outer_v2 = lib_with_merge_v2.types;
+      innerTypes.inner_v1 = lib_with_merge_v1.types;
+      innerTypes.inner_v2 = lib_with_merge_v2.types;
+    in
+    lib.mapAttrs (
+      _: evalModules:
+      lib.mapAttrs (
+        _: outerTypes:
+        lib.mapAttrs (_: innerTypes: {
+          "test_${outerTypeName}_${innerTypeName}" = testAttrs // {
+            expr =
+              (evalModules {
+                modules = [
+                  (m: {
+                    options.foo = m.lib.mkOption {
+                      type =
+                        if getType != null then
+                          getType outerTypes innerTypes
+                        else
+                          outerTypes.${outerTypeName} innerTypes.${innerTypeName};
+                      default = value;
+                    };
+                  })
+                ];
+              }).config.foo;
+          };
+        }) innerTypes
+      ) outerTypes
+    ) evalModules;
+in
+{
+  # AttrsOf string
+  attrsOf_str_ok = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "str";
+    value = {
+      bar = "test";
+    };
+    testAttrs = {
+      expected = {
+        bar = "test";
+      };
+    };
+  };
+  attrsOf_str_err_inner = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "str";
+    value = {
+      bar = 1; # not a string
+    };
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo.bar' is not of type `string'.*";
+      };
+    };
+  };
+  attrsOf_str_err_outer = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "str";
+    value = [ "foo" ]; # not an attrset
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo' is not of type `attribute set of string'.*";
+      };
+    };
+  };
+
+  # listOf string
+  listOf_str_ok = getMatrix {
+    outerTypeName = "listOf";
+    innerTypeName = "str";
+    value = [
+      "foo"
+      "bar"
+    ];
+    testAttrs = {
+      expected = [
+        "foo"
+        "bar"
+      ];
+    };
+  };
+  listOf_str_err_inner = getMatrix {
+    outerTypeName = "listOf";
+    innerTypeName = "str";
+    value = [
+      "foo"
+      1
+    ]; # not a string
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo."\[definition 1-entry 2\]"' is not of type `string'.'';
+      };
+    };
+  };
+  listOf_str_err_outer = getMatrix {
+    outerTypeName = "listOf";
+    innerTypeName = "str";
+    value = {
+      foo = 42;
+    }; # not a list
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo' is not of type `list of string'.*";
+      };
+    };
+  };
+
+  attrsOf_submodule_ok = getMatrix {
+    getType =
+      a: b:
+      a.attrsOf (
+        b.submodule (m: {
+          options.nested = m.lib.mkOption {
+            type = m.lib.types.str;
+          };
+        })
+      );
+    outerTypeName = "attrsOf";
+    innerTypeName = "submodule";
+    value = {
+      foo = {
+        nested = "test1";
+      };
+      bar = {
+        nested = "test2";
+      };
+    };
+    testAttrs = {
+      expected = {
+        foo = {
+          nested = "test1";
+        };
+        bar = {
+          nested = "test2";
+        };
+      };
+    };
+  };
+  attrsOf_submodule_err_inner = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "submodule";
+    getType =
+      a: b:
+      a.attrsOf (
+        b.submodule (m: {
+          options.nested = m.lib.mkOption {
+            type = m.lib.types.str;
+          };
+        })
+      );
+    value = {
+      foo = [ 1 ]; # not a submodule
+      bar = {
+        nested = "test2";
+      };
+    };
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo.foo' is not of type `submodule'.*";
+      };
+    };
+  };
+  attrsOf_submodule_err_outer = getMatrix {
+    outerTypeName = "attrsOf";
+    innerTypeName = "submodule";
+    getType =
+      a: b:
+      a.attrsOf (
+        b.submodule (m: {
+          options.nested = m.lib.mkOption {
+            type = m.lib.types.str;
+          };
+        })
+      );
+    value = [ 123 ]; # not an attrsOf
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo' is not of type `attribute set of \(submodule\).*'';
+      };
+    };
+  };
+
+  # either
+  either_str_attrsOf_ok = getMatrix {
+    outerTypeName = "either";
+    innerTypeName = "str_or_attrsOf_str";
+
+    getType = a: b: a.either b.str (b.attrsOf a.str);
+    value = "string value";
+    testAttrs = {
+      expected = "string value";
+    };
+  };
+  either_str_attrsOf_err_1 = getMatrix {
+    outerTypeName = "either";
+    innerTypeName = "str_or_attrsOf_str";
+
+    getType = a: b: a.either b.str (b.attrsOf a.str);
+    value = 1;
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo' is not of type `string or attribute set of string'.*";
+      };
+    };
+  };
+  either_str_attrsOf_err_2 = getMatrix {
+    outerTypeName = "either";
+    innerTypeName = "str_or_attrsOf_str";
+
+    getType = a: b: a.either b.str (b.attrsOf a.str);
+    value = {
+      bar = 1; # not a string
+    };
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = "A definition for option `foo.bar' is not of type `string'.*";
+      };
+    };
+  };
+
+  # Coereced to
+  coerce_attrsOf_str_to_listOf_str_run = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "attrsOf_str->listOf_str";
+    getType = a: b: a.coercedTo (b.attrsOf b.str) builtins.attrValues (b.listOf b.str);
+    value = {
+      bar = "test1"; # coerced to listOf string
+      foo = "test2"; # coerced to listOf string
+    };
+    testAttrs = {
+      expected = [
+        "test1"
+        "test2"
+      ];
+    };
+  };
+  coerce_attrsOf_str_to_listOf_str_final = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "attrsOf_str->listOf_str";
+    getType = a: b: a.coercedTo (b.attrsOf b.str) (abort "This shouldnt run") (b.listOf b.str);
+    value = [
+      "test1"
+      "test2"
+    ]; # already a listOf string
+    testAttrs = {
+      expected = [
+        "test1"
+        "test2"
+      ]; # Order should be kept
+    };
+  };
+  coerce_attrsOf_str_to_listOf_err_coercer_input = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "attrsOf_str->listOf_str";
+    getType = a: b: a.coercedTo (b.attrsOf b.str) builtins.attrValues (b.listOf b.str);
+    value = [
+      { }
+      { }
+    ]; # not coercible to listOf string, with the given coercer
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo."\[definition 1-entry 1\]"' is not of type `string'.*'';
+      };
+    };
+  };
+  coerce_attrsOf_str_to_listOf_err_coercer_ouput = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "attrsOf_str->listOf_str";
+    getType = a: b: a.coercedTo (b.attrsOf b.str) builtins.attrValues (b.listOf b.str);
+    value = {
+      foo = {
+        bar = 1;
+      }; # coercer produces wrong type -> [ { bar = 1; } ]
+    };
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo."\[definition 1-entry 1\]"' is not of type `string'.*'';
+      };
+    };
+  };
+  coerce_str_to_int_coercer_ouput = getMatrix {
+    outerTypeName = "coercedTo";
+    innerTypeName = "int->str";
+    getType = a: b: a.coercedTo b.int builtins.toString a.str;
+    value = [ ];
+    testAttrs = {
+      expectedError = {
+        type = "ThrownError";
+        msg = ''A definition for option `foo' is not of type `string or signed integer convertible to it.*'';
+      };
+    };
+  };
+
+  # Submodule
+  submodule_with_ok = getMatrix {
+    outerTypeName = "submoduleWith";
+    innerTypeName = "mixed_types";
+    getType =
+      a: b:
+      a.submodule (m: {
+        options.attrs = m.lib.mkOption {
+          type = b.attrsOf b.str;
+        };
+        options.list = m.lib.mkOption {
+          type = b.listOf b.str;
+        };
+        options.either = m.lib.mkOption {
+          type = b.either a.str a.int;
+        };
+      });
+    value = {
+      attrs = {
+        foo = "bar";
+      };
+      list = [
+        "foo"
+        "bar"
+      ];
+      either = 123; # int
+    };
+    testAttrs = {
+      expected = {
+        attrs = {
+          foo = "bar";
+        };
+        list = [
+          "foo"
+          "bar"
+        ];
+        either = 123;
+      };
+    };
+  };
+}
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index 301808ae6651..fbbccd8172f6 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -345,14 +345,14 @@ checkConfigOutput '^true$' "$@" ./define-module-check.nix
 set --
 checkConfigOutput '^"42"$' config.value ./declare-coerced-value.nix
 checkConfigOutput '^"24"$' config.value ./declare-coerced-value.nix ./define-value-string.nix
-checkConfigError 'A definition for option .* is not.*string or signed integer convertible to it.*. Definition values:\n\s*- In .*: \[ \]' config.value ./declare-coerced-value.nix ./define-value-list.nix
+checkConfigError 'A definition for option .*. is not of type .*.\n\s*- In .*: \[ \]' config.value ./declare-coerced-value.nix ./define-value-list.nix
 
 # Check coerced option merging.
 checkConfigError 'The option .value. in .*/declare-coerced-value.nix. is already declared in .*/declare-coerced-value-no-default.nix.' config.value ./declare-coerced-value.nix ./declare-coerced-value-no-default.nix
 
 # Check coerced value with unsound coercion
 checkConfigOutput '^12$' config.value ./declare-coerced-value-unsound.nix
-checkConfigError 'A definition for option .* is not of type .*. Definition values:\n\s*- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
+checkConfigError 'A definition for option .* is not of type .*.\n\s*- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
 checkConfigError 'toInt: Could not convert .* to int' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix
 
 # Check `graph` attribute
@@ -761,6 +761,26 @@ checkConfigOutput '"bar"' config.sub.conditionalImportAsNixos.foo ./specialArgs-
 checkConfigError 'attribute .*bar.* not found' config.sub.conditionalImportAsNixos.bar ./specialArgs-class.nix
 checkConfigError 'attribute .*foo.* not found' config.sub.conditionalImportAsDarwin.foo ./specialArgs-class.nix
 checkConfigOutput '"foo"' config.sub.conditionalImportAsDarwin.bar ./specialArgs-class.nix
+# Check that some types expose the 'valueMeta'
+checkConfigOutput '\{\}' options.str.valueMeta ./types-valueMeta.nix
+checkConfigOutput '["foo", "bar"]' config.attrsOfResult ./types-valueMeta.nix
+checkConfigOutput '2' config.listOfResult ./types-valueMeta.nix
+
+# Check that composed types expose the 'valueMeta'
+# attrsOf submodule (also on merged options,types)
+checkConfigOutput '42' options.attrsOfModule.valueMeta.attrs.foo.configuration.options.bar.value ./composed-types-valueMeta.nix
+checkConfigOutput '42' options.mergedAttrsOfModule.valueMeta.attrs.foo.configuration.options.bar.value ./composed-types-valueMeta.nix
+
+# listOf submodule (also on merged options,types)
+checkConfigOutput '42' config.listResult ./composed-types-valueMeta.nix
+checkConfigOutput '42' config.mergedListResult ./composed-types-valueMeta.nix
+
+# Add check
+checkConfigOutput '^0$' config.v1CheckedPass ./add-check.nix
+checkConfigError 'A definition for option .* is not of type .signed integer.*' config.v1CheckedFail ./add-check.nix
+checkConfigOutput '^true$' config.v2checkedPass ./add-check.nix
+checkConfigError 'A definition for option .* is not of type .attribute set of signed integer.*' config.v2checkedFail ./add-check.nix
+
 
 cat <<EOF
 ====== module tests ======
diff --git a/lib/tests/modules/add-check.nix b/lib/tests/modules/add-check.nix
new file mode 100644
index 000000000000..3bd993694994
--- /dev/null
+++ b/lib/tests/modules/add-check.nix
@@ -0,0 +1,36 @@
+(
+  { lib, ... }:
+  let
+    inherit (lib) types mkOption;
+    inherit (types) addCheck int attrsOf;
+
+    # type with a v1 merge
+    v1Type = addCheck int (v: v == 0);
+
+    # type with a v2 merge
+    v2Type = addCheck (attrsOf int) (v: v ? foo);
+  in
+  {
+    options.v1CheckedPass = mkOption {
+      type = v1Type;
+      default = 0;
+    };
+    options.v1CheckedFail = mkOption {
+      type = v1Type;
+      default = 1;
+    };
+    options.v2checkedPass = mkOption {
+      type = v2Type;
+      default = {
+        foo = 1;
+      };
+      # plug the value to make test script regex simple
+      apply = v: v.foo == 1;
+    };
+    options.v2checkedFail = mkOption {
+      type = v2Type;
+      default = { };
+      apply = v: lib.deepSeq v v;
+    };
+  }
+)
diff --git a/lib/tests/modules/composed-types-valueMeta.nix b/lib/tests/modules/composed-types-valueMeta.nix
new file mode 100644
index 000000000000..734917f8b67d
--- /dev/null
+++ b/lib/tests/modules/composed-types-valueMeta.nix
@@ -0,0 +1,75 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+
+  attrsOfModule = mkOption {
+    type = types.attrsOf (
+      types.submodule {
+        options.bar = mkOption {
+          type = types.int;
+        };
+      }
+    );
+  };
+
+  listOfModule = mkOption {
+    type = types.listOf (
+      types.submodule {
+        options.bar = mkOption {
+          type = types.int;
+        };
+      }
+    );
+  };
+
+in
+{
+  imports = [
+    #  Module A
+    ({
+      options.attrsOfModule = attrsOfModule;
+      options.mergedAttrsOfModule = attrsOfModule;
+      options.listOfModule = listOfModule;
+      options.mergedListOfModule = listOfModule;
+    })
+    # Module B
+    ({
+      options.mergedAttrsOfModule = attrsOfModule;
+      options.mergedListOfModule = listOfModule;
+    })
+    # Values
+    # It is important that the value is defined in a separate module
+    # Without valueMeta the actual value and sub-options wouldn't be accessible via:
+    # options.attrsOfModule.type.getSubOptions
+    ({
+      attrsOfModule = {
+        foo.bar = 42;
+      };
+      mergedAttrsOfModule = {
+        foo.bar = 42;
+      };
+    })
+    (
+      { options, ... }:
+      {
+        config.listOfModule = [
+          {
+            bar = 42;
+          }
+        ];
+        config.mergedListOfModule = [
+          {
+            bar = 42;
+          }
+        ];
+        # Result options to expose the list module to bash as plain attribute path
+        options.listResult = mkOption {
+          default = (builtins.head options.listOfModule.valueMeta.list).configuration.options.bar.value;
+        };
+        options.mergedListResult = mkOption {
+          default = (builtins.head options.mergedListOfModule.valueMeta.list).configuration.options.bar.value;
+        };
+      }
+    )
+  ];
+}
diff --git a/lib/tests/modules/types-valueMeta.nix b/lib/tests/modules/types-valueMeta.nix
new file mode 100644
index 000000000000..3004898f112a
--- /dev/null
+++ b/lib/tests/modules/types-valueMeta.nix
@@ -0,0 +1,60 @@
+{ lib, ... }:
+let
+  inherit (lib) types mkOption;
+
+  inherit (types)
+    # attrsOf uses attrsWith internally
+    attrsOf
+    listOf
+    submoduleOf
+    str
+    ;
+in
+{
+  imports = [
+    (
+      { options, ... }:
+      {
+        # Should have an empty valueMeta
+        options.str = mkOption {
+          type = str;
+        };
+
+        # Should have some valueMeta which is an attribute set of the nested valueMeta
+        options.attrsOf = mkOption {
+          type = attrsOf str;
+          default = {
+            foo = "foo";
+            bar = "bar";
+          };
+        };
+        options.attrsOfResult = mkOption {
+          default = builtins.attrNames options.attrsOf.valueMeta.attrs;
+        };
+
+        # Should have some valueMeta which is the list of the nested valueMeta of types.str
+        # [ {} {} ]
+        options.listOf = mkOption {
+          type = listOf str;
+          default = [
+            "foo"
+            "bar"
+          ];
+        };
+        options.listOfResult = mkOption {
+          default = builtins.length options.listOf.valueMeta.list;
+        };
+
+        # Should have some valueMeta which is the submodule evaluation
+        # { _module, options, config, ...}
+        options.submoduleOf = mkOption {
+          type = submoduleOf {
+            options.str = mkOption {
+              type = str;
+            };
+          };
+        };
+      }
+    )
+  ];
+}
diff --git a/lib/tests/nix-unit.nix b/lib/tests/nix-unit.nix
new file mode 100644
index 000000000000..ff62aff4d96b
--- /dev/null
+++ b/lib/tests/nix-unit.nix
@@ -0,0 +1,25 @@
+{
+  pkgs ? import ../.. { },
+}:
+let
+  prevNixpkgs = pkgs.fetchFromGitHub {
+    owner = "nixos";
+    repo = "nixpkgs";
+    # Parent commit of [#391544](https://github.com/NixOS/nixpkgs/pull/391544)
+    # Which was before the type.merge.v2 introduction
+    rev = "bcf94dd3f07189b7475d823c8d67d08b58289905";
+    hash = "sha256-MuMiIY3MX5pFSOCvutmmRhV6RD0R3CG0Hmazkg8cMFI=";
+  };
+in
+(pkgs.runCommand "lib-cross-eval-merge-v2"
+  {
+    nativeBuildInputs = [ pkgs.nix-unit ];
+  }
+  ''
+    export HOME=$TMPDIR
+    nix-unit --eval-store "$HOME" ${./checkAndMergeCompat.nix} \
+      --arg currLibPath "${../.}" \
+      --arg prevLibPath "${prevNixpkgs}/lib"
+    mkdir $out
+  ''
+)
diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index 4209fd9274b6..54d62f87b3d5 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -29,6 +29,9 @@ in
 pkgsBB.symlinkJoin {
   name = "nixpkgs-lib-tests";
   paths = map testWithNix nixVersions ++ [
+    (import ./nix-unit.nix {
+      inherit pkgs;
+    })
     (import ./maintainers.nix {
       inherit pkgs;
       lib = import ../.;
diff --git a/lib/types.nix b/lib/types.nix
index dcb536c4723b..6b51f9254a00 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -20,7 +20,6 @@ let
     toList
     ;
   inherit (lib.lists)
-    all
     concatLists
     count
     elemAt
@@ -48,6 +47,7 @@ let
     mergeOneOption
     mergeUniqueOption
     showFiles
+    showDefs
     showOption
     ;
   inherit (lib.strings)
@@ -99,6 +99,13 @@ let
       }is accessed, use `${lib.optionalString (loc != null) "type."}nestedTypes.elemType` instead.
     '' payload.elemType;
 
+  checkDefsForError =
+    check: loc: defs:
+    let
+      invalidDefs = filter (def: !check def.value) defs;
+    in
+    if invalidDefs != [ ] then { message = "Definition values: ${showDefs invalidDefs}"; } else null;
+
   outer_types = rec {
     isType = type: x: (x._type or "") == type;
 
@@ -705,26 +712,36 @@ let
           }";
           descriptionClass = "composite";
           check = isList;
-          merge =
-            loc: defs:
-            map (x: x.value) (
-              filter (x: x ? value) (
-                concatLists (
-                  imap1 (
-                    n: def:
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                evals = filter (x: x.optionalValue ? value) (
+                  concatLists (
                     imap1 (
-                      m: def':
-                      (mergeDefinitions (loc ++ [ "[definition ${toString n}-entry ${toString m}]" ]) elemType [
-                        {
-                          inherit (def) file;
-                          value = def';
-                        }
-                      ]).optionalValue
-                    ) def.value
-                  ) defs
-                )
-              )
-            );
+                      n: def:
+                      imap1 (
+                        m: def':
+                        (mergeDefinitions (loc ++ [ "[definition ${toString n}-entry ${toString m}]" ]) elemType [
+                          {
+                            inherit (def) file;
+                            value = def';
+                          }
+                        ])
+                      ) def.value
+                    ) defs
+                  )
+                );
+              in
+              {
+                headError = checkDefsForError check loc defs;
+                value = map (x: x.optionalValue.value or x.mergedValue) evals;
+                valueMeta.list = map (v: v.checkedAndMerged.valueMeta) evals;
+              };
+          };
           emptyValue = {
             value = [ ];
           };
@@ -801,42 +818,43 @@ let
           lazy ? false,
           placeholder ? "name",
         }:
-        mkOptionType {
+        mkOptionType rec {
           name = if lazy then "lazyAttrsOf" else "attrsOf";
           description =
             (if lazy then "lazy attribute set" else "attribute set")
             + " of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
           descriptionClass = "composite";
           check = isAttrs;
-          merge =
-            if lazy then
-              (
-                # Lazy merge Function
-                loc: defs:
-                zipAttrsWith
-                  (
-                    name: defs:
-                    let
-                      merged = mergeDefinitions (loc ++ [ name ]) elemType defs;
-                      # mergedValue will trigger an appropriate error when accessed
-                    in
-                    merged.optionalValue.value or elemType.emptyValue.value or merged.mergedValue
-                  )
-                  # Push down position info.
-                  (pushPositions defs)
-              )
-            else
-              (
-                # Non-lazy merge Function
-                loc: defs:
-                mapAttrs (n: v: v.value) (
-                  filterAttrs (n: v: v ? value) (
-                    zipAttrsWith (name: defs: (mergeDefinitions (loc ++ [ name ]) elemType (defs)).optionalValue)
-                      # Push down position info.
-                      (pushPositions defs)
-                  )
-                )
-              );
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                evals =
+                  if lazy then
+                    zipAttrsWith (name: defs: mergeDefinitions (loc ++ [ name ]) elemType defs) (pushPositions defs)
+                  else
+                    # Filtering makes the merge function more strict
+                    # Meaning it is less lazy
+                    filterAttrs (n: v: v.optionalValue ? value) (
+                      zipAttrsWith (name: defs: mergeDefinitions (loc ++ [ name ]) elemType defs) (pushPositions defs)
+                    );
+              in
+              {
+                headError = checkDefsForError check loc defs;
+                value = mapAttrs (
+                  n: v:
+                  if lazy then
+                    v.optionalValue.value or elemType.emptyValue.value or v.mergedValue
+                  else
+                    v.optionalValue.value
+                ) evals;
+                valueMeta.attrs = mapAttrs (n: v: v.checkedAndMerged.valueMeta) evals;
+              };
+          };
+
           emptyValue = {
             value = { };
           };
@@ -1218,6 +1236,7 @@ let
 
           name = "submodule";
 
+          check = x: isAttrs x || isFunction x || path.check x;
         in
         mkOptionType {
           inherit name;
@@ -1229,13 +1248,25 @@ let
                 docsEval = base.extendModules { modules = [ noCheckForDocsModule ]; };
               in
               docsEval._module.freeformType.description or name;
-          check = x: isAttrs x || isFunction x || path.check x;
-          merge =
-            loc: defs:
-            (base.extendModules {
-              modules = [ { _module.args.name = last loc; } ] ++ allModules defs;
-              prefix = loc;
-            }).config;
+          inherit check;
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                configuration = base.extendModules {
+                  modules = [ { _module.args.name = last loc; } ] ++ allModules defs;
+                  prefix = loc;
+                };
+              in
+              {
+                headError = checkDefsForError check loc defs;
+                value = configuration.config;
+                valueMeta = { inherit configuration; };
+              };
+          };
           emptyValue = {
             value = { };
           };
@@ -1383,17 +1414,50 @@ let
               }";
           descriptionClass = "conjunction";
           check = x: t1.check x || t2.check x;
-          merge =
-            loc: defs:
-            let
-              defList = map (d: d.value) defs;
-            in
-            if all (x: t1.check x) defList then
-              t1.merge loc defs
-            else if all (x: t2.check x) defList then
-              t2.merge loc defs
-            else
-              mergeOneOption loc defs;
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                t1CheckedAndMerged =
+                  if t1.merge ? v2 then
+                    t1.merge.v2 { inherit loc defs; }
+                  else
+                    {
+                      value = t1.merge loc defs;
+                      headError = checkDefsForError t1.check loc defs;
+                      valueMeta = { };
+                    };
+                t2CheckedAndMerged =
+                  if t2.merge ? v2 then
+                    t2.merge.v2 { inherit loc defs; }
+                  else
+                    {
+                      value = t2.merge loc defs;
+                      headError = checkDefsForError t2.check loc defs;
+                      valueMeta = { };
+                    };
+
+                checkedAndMerged =
+                  if t1CheckedAndMerged.headError == null then
+                    t1CheckedAndMerged
+                  else if t2CheckedAndMerged.headError == null then
+                    t2CheckedAndMerged
+                  else
+                    rec {
+                      valueMeta = {
+                        inherit headError;
+                      };
+                      headError = {
+                        message = "The option `${showOption loc}` is neither a value of type `${t1.description}` nor `${t2.description}`, Definition values: ${showDefs defs}";
+                      };
+                      value = abort "(t.merge.v2 defs).value must only be accessed when `.headError == null`. This is a bug in code that consumes a module system type.";
+                    };
+              in
+              checkedAndMerged;
+          };
           typeMerge =
             f':
             let
@@ -1434,12 +1498,47 @@ let
             optionDescriptionPhrase (class: class == "noun") coercedType
           } convertible to it";
           check = x: (coercedType.check x && finalType.check (coerceFunc x)) || finalType.check x;
-          merge =
-            loc: defs:
-            let
-              coerceVal = val: if coercedType.check val then coerceFunc val else val;
-            in
-            finalType.merge loc (map (def: def // { value = coerceVal def.value; }) defs);
+          merge = {
+            __functor =
+              self: loc: defs:
+              (self.v2 { inherit loc defs; }).value;
+            v2 =
+              { loc, defs }:
+              let
+                finalDefs = (
+                  map (
+                    def:
+                    def
+                    // {
+                      value =
+                        let
+                          merged = coercedType.merge.v2 {
+                            inherit loc;
+                            defs = [ def ];
+                          };
+                        in
+                        if coercedType.merge ? v2 then
+                          if merged.headError == null then coerceFunc def.value else def.value
+                        else if coercedType.check def.value then
+                          coerceFunc def.value
+                        else
+                          def.value;
+                    }
+                  ) defs
+                );
+              in
+              if finalType.merge ? v2 then
+                finalType.merge.v2 {
+                  inherit loc;
+                  defs = finalDefs;
+                }
+              else
+                {
+                  value = finalType.merge loc finalDefs;
+                  valueMeta = { };
+                  headError = checkDefsForError check loc defs;
+                };
+          };
           emptyValue = finalType.emptyValue;
           getSubOptions = finalType.getSubOptions;
           getSubModules = finalType.getSubModules;
@@ -1451,6 +1550,7 @@ let
           nestedTypes.coercedType = coercedType;
           nestedTypes.finalType = finalType;
         };
+
       /**
         Augment the given type with an additional type check function.
 
@@ -1459,8 +1559,33 @@ let
         Fixing is not trivial, we appreciate any help!
         :::
       */
-      addCheck = elemType: check: elemType // { check = x: elemType.check x && check x; };
-
+      addCheck =
+        elemType: check:
+        if elemType.merge ? v2 then
+          elemType
+          // {
+            check = x: elemType.check x && check x;
+            merge = {
+              __functor =
+                self: loc: defs:
+                (self.v2 { inherit loc defs; }).value;
+              v2 =
+                { loc, defs }:
+                let
+                  orig = elemType.merge.v2 { inherit loc defs; };
+                  headError' = if orig.headError != null then orig.headError else checkDefsForError check loc defs;
+                in
+                orig
+                // {
+                  headError = headError';
+                };
+            };
+          }
+        else
+          elemType
+          // {
+            check = x: elemType.check x && check x;
+          };
     };
 
     /**
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 64683022706e..b1735ce93e59 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22358,6 +22358,12 @@
     githubId = 2660;
     name = "Russell Sim";
   };
+  RustyNova = {
+    email = "rusty.nova.jsb@gmail.com";
+    github = "RustyNova016";
+    githubId = 50844553;
+    name = "RustyNova";
+  };
   rutherther = {
     name = "Rutherther";
     email = "rutherther@proton.me";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 9259a18ebdde..32bc1298f71c 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -421,7 +421,6 @@ with lib.maintainers;
       frlan
       leona
       osnyx
-      ma27
     ];
     scope = "Team for Flying Circus employees who collectively maintain packages.";
     shortName = "Flying Circus employees";
diff --git a/nixos/modules/services/mail/exim.nix b/nixos/modules/services/mail/exim.nix
index 77f8bd4b0dca..56b29a311497 100644
--- a/nixos/modules/services/mail/exim.nix
+++ b/nixos/modules/services/mail/exim.nix
@@ -123,18 +123,11 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."exim.conf".source ];
       serviceConfig = {
+        ExecStartPre = "+${coreutils}/bin/install --group=${cfg.group} --owner=${cfg.user} --mode=0700 --directory ${cfg.spoolDir}";
         ExecStart = "!${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}";
         ExecReload = "!${coreutils}/bin/kill -HUP $MAINPID";
         User = cfg.user;
       };
-      preStart = ''
-        if ! test -d ${cfg.spoolDir}; then
-          ${coreutils}/bin/mkdir -p ${cfg.spoolDir}
-          ${coreutils}/bin/chown ${cfg.user}:${cfg.group} ${cfg.spoolDir}
-        fi
-      '';
     };
-
   };
-
 }
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index be0b8aaefd51..3493f5f9a1a5 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -481,7 +481,6 @@ in
       settings.Manager.DefaultEnvironment = "PATH=/bin:/sbin";
 
       contents = {
-        "/tmp/.keep".text = "systemd requires the /tmp mount point in the initrd cpio archive";
         "/init".source = "${cfg.package}/lib/systemd/systemd";
         "/etc/systemd/system".source = stage1Units;
 
@@ -503,6 +502,8 @@ in
 
         "/bin".source = "${initrdBinEnv}/bin";
         "/sbin".source = "${initrdBinEnv}/sbin";
+        "/usr/bin".source = "${initrdBinEnv}/bin";
+        "/usr/sbin".source = "${initrdBinEnv}/sbin";
 
         "/etc/os-release".source = config.boot.initrd.osRelease;
         "/etc/initrd-release".source = config.boot.initrd.osRelease;
diff --git a/nixos/tests/oci-containers.nix b/nixos/tests/oci-containers.nix
index d50a8c44aaa4..9d41e4baffdf 100644
--- a/nixos/tests/oci-containers.nix
+++ b/nixos/tests/oci-containers.nix
@@ -73,7 +73,7 @@ let
     type:
     makeTest {
       name = "oci-containers-podman-rootless-${type}";
-      meta.maintainers = lib.teams.flyingcircus.members;
+      meta.maintainers = lib.teams.flyingcircus.members ++ [ lib.maintainers.ma27 ];
       nodes = {
         podman =
           { pkgs, ... }:
diff --git a/pkgs/applications/backup/timeshift/unwrapped.nix b/pkgs/applications/backup/timeshift/unwrapped.nix
index d55d908e55ca..da3082ccd12c 100644
--- a/pkgs/applications/backup/timeshift/unwrapped.nix
+++ b/pkgs/applications/backup/timeshift/unwrapped.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "timeshift";
-  version = "25.07.5";
+  version = "25.07.6";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "timeshift";
     rev = version;
-    hash = "sha256-AXtHs19DeSF2v5v4aBchGlsO59Z7h5OfmAaDb9SjwSc=";
+    hash = "sha256-M3r5CUSMF2Es1EDolmZAwqj2uX76wARk5oefqdf2eYk=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix
index f126b71e64f3..c9960ceee70e 100644
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.8.1.2";
+  version = "33.8.2";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -173,11 +173,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-qgabtZ/8nBaOGP0pIXd/byd9XCxulT8w+7uczJE4SAg=";
+          hash = "sha256-W5N2OzHTYhJ7Lha/iduN7JPcczF+VPU9I36BAUiXUmU=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-qeA8EYRY9STsezWrvlVt73fgxPB0mynkxtTV71HFMgU=";
+          hash = "sha256-RmX/yCWHzZEdkh6TnUQ/guIc7+iEdpK8ANhJxL3MbzI=";
         };
       };
 
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
index 64bbec0904ce..e2d0919b516d 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "helm-secrets";
-  version = "4.6.5";
+  version = "4.6.6";
 
   src = fetchFromGitHub {
     owner = "jkroepke";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gSWavqvKdVBRF182fzEiRqEVg8douzEcpKiOdmSZ9hg=";
+    hash = "sha256-sAGENuyg2t/H7BYF+Y+Nk3SB2/PA/V+L374iXmppkqc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index af2e6267c448..0d3334b085bf 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -335,13 +335,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-kn9qUKvCV0vbOHDsgByO8MAJA/xwEzoBzRO9poWs0V0=",
+    "hash": "sha256-Zfsxcfi55RjG5Jq/MnDZ8yfOjg78ORrUMhK300EFxes=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.71.0",
+    "rev": "v3.72.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0aYkDyqpXzGXZR4ua4rru9Bwt5R+UjDdozO8ZnHm1xQ="
+    "vendorHash": "sha256-Zi1SyC2SdYBMO0r7QVYS51XOodRG1JHcuIrMu0JRkn0="
   },
   "deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -1147,13 +1147,13 @@
     "vendorHash": "sha256-39OiEYntUmX2fJZh7G/LcCNFXFmHwdLgFGYz6BUEyOA="
   },
   "routeros": {
-    "hash": "sha256-q0ZRAip6mgHkdBcns8G7VlDnMNB+ux6ITKwcSL4WrcY=",
+    "hash": "sha256-XKKbw8tMtRkOU2lJEieK3CEokNAkiS1Wr1l5XnKW8qI=",
     "homepage": "https://registry.terraform.io/providers/terraform-routeros/routeros",
     "owner": "terraform-routeros",
     "repo": "terraform-provider-routeros",
-    "rev": "v1.86.2",
+    "rev": "v1.86.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-et1xqcaCKTRz9bJjTlRnxhXBoc6PaeSwJgBI4pAzcdg="
+    "vendorHash": "sha256-Je7pWso3kDttP5Isn3Atryg3RZOlvj3g6nTTzuvpA5Y="
   },
   "rundeck": {
     "hash": "sha256-g8unbz8+UGLiAOJju6E2bLkygvZgHkv173PdMDefmrc=",
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 8bb0d9277411..336d1a1136a9 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -314,7 +314,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       fpletz
       globin
-      ma27
       SchweGELBin
     ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/applications/window-managers/wayfire/wf-shell.nix b/pkgs/applications/window-managers/wayfire/wf-shell.nix
index 479b38bc802a..737fb83fca50 100644
--- a/pkgs/applications/window-managers/wayfire/wf-shell.nix
+++ b/pkgs/applications/window-managers/wayfire/wf-shell.nix
@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wf-shell";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wf-shell";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-J5KmUxM/mU5I1YfkfwZgbK7VxMTKKKGGvxYS5Rnbqnc=";
+    hash = "sha256-PLTeFGecxVwU2LdwnDwiWB1OcbaZjJemMpT0pcCFf/w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 790ca307cdb1..8dc3dd3b9e40 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -444,7 +444,20 @@ buildStdenv.mkDerivation {
     # linking firefox hits the vm.max_map_count kernel limit with the default musl allocator
     # TODO: Default vm.max_map_count has been increased, retest without this
     export LD_PRELOAD=${mimalloc}/lib/libmimalloc.so
-  '';
+  ''
+  +
+    # fileport.h was exposed in SDK 15.4 but we have only 15.2 in nixpkgs so far.
+    lib.optionalString
+      (
+        stdenv.hostPlatform.isDarwin
+        && lib.versionAtLeast version "143"
+        && lib.versionOlder apple-sdk_15.version "15.4"
+      )
+      ''
+        mkdir -p xnu/sys
+        cp ${apple-sdk_15.sourceRelease "xnu"}/bsd/sys/fileport.h xnu/sys
+        export CXXFLAGS="-isystem $(pwd)/xnu"
+      '';
 
   # firefox has a different definition of configurePlatforms from nixpkgs, see configureFlags
   configurePlatforms = [ ];
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 5c9b7a84f8a3..788e4ebb6758 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -202,7 +202,15 @@ lib.extendMkDerivation {
             outputHashAlgo = if finalAttrs.vendorHash == "" then "sha256" else null;
             # in case an overlay clears passthru by accident, don't fail evaluation
           }).overrideAttrs
-            (finalAttrs.passthru.overrideModAttrs or overrideModAttrs);
+            (
+              let
+                pos = builtins.unsafeGetAttrPos "passthru" finalAttrs;
+                posString =
+                  if pos == null then "unknown" else "${pos.file}:${toString pos.line}:${toString pos.column}";
+              in
+              finalAttrs.passthru.overrideModAttrs
+                or (lib.warn "buildGoModule: ${finalAttrs.name or finalAttrs.pname}: passthru.overrideModAttrs missing after overrideAttrs. Last overridden at ${posString}." overrideModAttrs)
+            );
 
       nativeBuildInputs = [ go ] ++ nativeBuildInputs;
 
diff --git a/pkgs/build-support/kernel/make-initrd-ng.nix b/pkgs/build-support/kernel/make-initrd-ng.nix
index b5cfc55c695e..35fd66e89db7 100644
--- a/pkgs/build-support/kernel/make-initrd-ng.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng.nix
@@ -100,7 +100,8 @@ runCommand name
     ++ lib.optional makeUInitrd ubootTools;
   })
   ''
-    mkdir -p ./root/var/empty
+    mkdir -p ./root/{run,tmp,var/empty}
+    ln -s ../run ./root/var/run
     make-initrd-ng "$contentsPath" ./root
     mkdir "$out"
     (cd root && find . -exec touch -h -d '@1' '{}' +)
diff --git a/pkgs/by-name/ac/action-validator/package.nix b/pkgs/by-name/ac/action-validator/package.nix
index 01848555df5d..e7556ce0043a 100644
--- a/pkgs/by-name/ac/action-validator/package.nix
+++ b/pkgs/by-name/ac/action-validator/package.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "action-validator";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "mpalmer";
     repo = "action-validator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pqWowcc/3NHtVcNDZ+4opgtwttcKdUVoi4qkv56JvY4=";
+    hash = "sha256-irBK27De9W5BSNIQynguOY8oPgA7K03dleE/0YvY75o=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch b/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch
deleted file mode 100644
index 07bec5bffbd8..000000000000
--- a/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 2bbe75fe0bc87ab4c1e16c5a18c6200224391629 Mon Sep 17 00:00:00 2001
-From: Nicole Patricia Mazzuca <nicole@streganil.no>
-Date: Fri, 9 May 2025 09:32:21 +0200
-Subject: [PATCH] open: fix opening text/html messages
-
-This fixes a bug introduced in 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329:
-aerc started using `path.Base(<part>)`, which returns `"."` on an empty
-path, but still checked for `""` two lines later.
-
-On macOS, the result is that aerc attempts to open the directory:
-
-```
-open /var/folders/vn/hs0zvdsx3vq6svvry8s1bnym0000gn/T/aerc-4229266673: is a directory
-```
-
-Signed-off-by: Nicole Patricia Mazzuca <nicole@streganil.no>
-Acked-by: Robin Jarry <robin@jarry.cc>
----
- commands/msgview/open.go | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/commands/msgview/open.go b/commands/msgview/open.go
-index a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3..7c770d4a90b771e3a18dfcb327f5e9306d5b5fa7 100644
---- a/commands/msgview/open.go
-+++ b/commands/msgview/open.go
-@@ -59,7 +59,7 @@ func (o Open) Execute(args []string) error {
- 		}
- 		filename := path.Base(part.FileName())
- 		var tmpFile *os.File
--		if filename == "" {
-+		if filename == "." {
- 			extension := ""
- 			if exts, _ := mime.ExtensionsByType(mimeType); len(exts) > 0 {
- 				extension = exts[0]
diff --git a/pkgs/by-name/ae/aerc/basename-temp-file.patch b/pkgs/by-name/ae/aerc/basename-temp-file.patch
deleted file mode 100644
index 8ca81c21db95..000000000000
--- a/pkgs/by-name/ae/aerc/basename-temp-file.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 Mon Sep 17 00:00:00 2001
-From: Robin Jarry <robin@jarry.cc>
-Date: Wed, 9 Apr 2025 10:49:24 +0200
-Subject: [PATCH] open: only use part basename for temp file
-
-When an attachment part has a name such as "/tmp/55208186_AllDocs.pdf",
-aerc creates a temp folder and tries to store the file by blindly
-concatenating the path as follows:
-
-	/tmp/aerc-3444057757/tmp/55208186_AllDocs.pdf
-
-And when writing to this path, it gets a "No such file or directory"
-error because the intermediate "tmp" subfolder isn't created.
-
-Reported-by: Erik Colson <eco@ecocode.net>
-Signed-off-by: Robin Jarry <robin@jarry.cc>
----
- commands/msgview/open.go | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/commands/msgview/open.go b/commands/msgview/open.go
-index 4293b7e4892c137a7f3fbbe79245ffb6733b2671..a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3 100644
---- a/commands/msgview/open.go
-+++ b/commands/msgview/open.go
-@@ -5,6 +5,7 @@ import (
- 	"io"
- 	"mime"
- 	"os"
-+	"path"
- 	"path/filepath"
- 
- 	"git.sr.ht/~rjarry/aerc/app"
-@@ -56,7 +57,7 @@ func (o Open) Execute(args []string) error {
- 			app.PushError(err.Error())
- 			return
- 		}
--		filename := part.FileName()
-+		filename := path.Base(part.FileName())
- 		var tmpFile *os.File
- 		if filename == "" {
- 			extension := ""
diff --git a/pkgs/by-name/ae/aerc/package.nix b/pkgs/by-name/ae/aerc/package.nix
index 12ebcc226eb6..878962a650ec 100644
--- a/pkgs/by-name/ae/aerc/package.nix
+++ b/pkgs/by-name/ae/aerc/package.nix
@@ -16,31 +16,24 @@
 
 buildGoModule (finalAttrs: {
   pname = "aerc";
-  version = "0.20.1";
+  version = "0.21.0";
 
   src = fetchFromSourcehut {
     owner = "~rjarry";
     repo = "aerc";
     rev = finalAttrs.version;
-    hash = "sha256-IBTM3Ersm8yUCgiBLX8ozuvMEbfmY6eW5xvJD20UgRA=";
+    hash = "sha256-UBXMAIuB0F7gG0dkpEF/3V4QK6FEbQw2ZLGGmRF884I=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-O1j0J6vCE6rap5/fOTxlUpXAG5mgZf8CfNOB4VOBxms=";
+  vendorHash = "sha256-E/DnfiHoDDNNoaNGZC/nvs8DiJ8F2+H2FzxpU7nK+bE=";
 
   nativeBuildInputs = [
     scdoc
     python3Packages.wrapPython
   ];
 
-  patches = [
-    ./runtime-libexec.patch
-
-    # TODO remove these with the next release
-    # they resolve a path injection vulnerability when saving attachments (CVE-2025-49466)
-    ./basename-temp-file.patch
-    ./basename-temp-file-fixup.patch
-  ];
+  patches = [ ./runtime-libexec.patch ];
 
   postPatch = ''
     substituteAllInPlace config/aerc.conf
diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index 27c928834e43..294b0fdcdd24 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -21,6 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-TyxeuDMmoRvIVaapA/KstFnARPpPv9h19Bg3/XnwQWs=";
 
+  buildNoDefaultFeatures = true;
+  # Would be cleaner with an "--all-features" option
+  buildFeatures = [ "full" ];
+
   nativeBuildInputs = [
     pkg-config
   ];
@@ -39,7 +43,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     changelog = "https://github.com/RustyNova016/Alistral/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Power tools for Listenbrainz";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ jopejoe1 ];
+    maintainers = with lib.maintainers; [
+      jopejoe1
+      RustyNova
+    ];
     mainProgram = "alistral";
   };
 })
diff --git a/pkgs/by-name/am/amp-cli/package-lock.json b/pkgs/by-name/am/amp-cli/package-lock.json
index b5730d72dc13..c1b939f51ac3 100644
--- a/pkgs/by-name/am/amp-cli/package-lock.json
+++ b/pkgs/by-name/am/amp-cli/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1755532879-g2b6e3d"
+        "@sourcegraph/amp": "^0.0.1756368086-g6e639d"
       }
     },
     "node_modules/@colors/colors": {
@@ -37,11 +37,231 @@
         "node": ">= 10"
       }
     },
+    "node_modules/@napi-rs/keyring": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-1.1.9.tgz",
+      "integrity": "sha512-qjg04yaJ/gFqgG7wDqLlWBvZpsjvYDtwL+xOr2vSM2JrhojuIKsw7pH013U7xJOradTVGeQqhwqgZtt2IblgOw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "optionalDependencies": {
+        "@napi-rs/keyring-darwin-arm64": "1.1.9",
+        "@napi-rs/keyring-darwin-x64": "1.1.9",
+        "@napi-rs/keyring-freebsd-x64": "1.1.9",
+        "@napi-rs/keyring-linux-arm-gnueabihf": "1.1.9",
+        "@napi-rs/keyring-linux-arm64-gnu": "1.1.9",
+        "@napi-rs/keyring-linux-arm64-musl": "1.1.9",
+        "@napi-rs/keyring-linux-riscv64-gnu": "1.1.9",
+        "@napi-rs/keyring-linux-x64-gnu": "1.1.9",
+        "@napi-rs/keyring-linux-x64-musl": "1.1.9",
+        "@napi-rs/keyring-win32-arm64-msvc": "1.1.9",
+        "@napi-rs/keyring-win32-ia32-msvc": "1.1.9",
+        "@napi-rs/keyring-win32-x64-msvc": "1.1.9"
+      }
+    },
+    "node_modules/@napi-rs/keyring-darwin-arm64": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-arm64/-/keyring-darwin-arm64-1.1.9.tgz",
+      "integrity": "sha512-/lVnrSFrut+8pQC6IcqlfHKzcEmf2XvQDOZPB5X4vI23GrNXBd56EuBlFPdTBtx46A8Bn+Aqi6pS8cnprHtcCw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-darwin-x64": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-x64/-/keyring-darwin-x64-1.1.9.tgz",
+      "integrity": "sha512-G3PiFZTAFTzUnpSB31A/UaPjl48/3sDTLmLxaAZBEk7HcOyBnL31gA1YqhDCO7F2y5sD5TWiFiuID9MyqYOcjw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-freebsd-x64": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-freebsd-x64/-/keyring-freebsd-x64-1.1.9.tgz",
+      "integrity": "sha512-R4XbvRhEzQyOy4yM+SMDgk8BgkLPkIzXGwR6QR0wJ2YrPeBx3F2TrgdHfsIGSn/X5Axg/2UlrCiZVciZ5BmusA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm-gnueabihf": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm-gnueabihf/-/keyring-linux-arm-gnueabihf-1.1.9.tgz",
+      "integrity": "sha512-UrKy110I+zQyBtw4HLVUqZ1jDq11K3PmQIYgWAJNwB5VQOj4IQ63zLxk4V01Jx4bNOJmGNlvHDJUAyh/lC5Yww==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm64-gnu": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-gnu/-/keyring-linux-arm64-gnu-1.1.9.tgz",
+      "integrity": "sha512-yOrhVpNGexDYzybe3dhmHQRPBDjlZPtJDE+eGSi1JwEqYlWDB+4IWjRsetxnO63DhnMFRLeMTdwWghsYrA7VwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm64-musl": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-musl/-/keyring-linux-arm64-musl-1.1.9.tgz",
+      "integrity": "sha512-82EcuzoV/+Dxwi1HHhrEEprN5Ou7OsRKyTJSaRqiVuGvLaQDUhZX/4zXTTh4Pz24m22Q4aoJogafS31w8iKGGw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-riscv64-gnu": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-riscv64-gnu/-/keyring-linux-riscv64-gnu-1.1.9.tgz",
+      "integrity": "sha512-Q1ar7DszC1X8FW6w7Ql7b72GFeAUxkTiOuxXChCFBy7eWCQSDrr52ZLroIowp82RmkQLZebnK+IwSssD2Ntoag==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-x64-gnu": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-gnu/-/keyring-linux-x64-gnu-1.1.9.tgz",
+      "integrity": "sha512-LMvrYt1ho3pEDECssA7ATbcMDgayEUwwSD+UfrC7Hj1+C6dlvipwt5njwUDCno2OeXbjjisCo4CR9fDmXa4sZA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-x64-musl": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-musl/-/keyring-linux-x64-musl-1.1.9.tgz",
+      "integrity": "sha512-x2i/TgS2/fM+6LRj1MrtVC580sepz5GcxbSCXpttx2H58uZKBF0vVM9HDPHoKP2w5++fyrA17eltJNYN3Ob46A==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-arm64-msvc": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-arm64-msvc/-/keyring-win32-arm64-msvc-1.1.9.tgz",
+      "integrity": "sha512-14t6p8CTBNfGzLO5LXqurT+pAOf/ocGjOM/qiG/LW+jPkhyJYBNI9e3HKq3QX+ObbnxVpt4fAY02b4XLt7EWig==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-ia32-msvc": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-ia32-msvc/-/keyring-win32-ia32-msvc-1.1.9.tgz",
+      "integrity": "sha512-7+7aXz5op6PtOnWYcK1GYXWQlk2zfpdPt9taLqmCCVpk1g4m3Gw1wyKyQxjrg9clHWdNhdWxhFEA0osDxG8/Eg==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-x64-msvc": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-x64-msvc/-/keyring-win32-x64-msvc-1.1.9.tgz",
+      "integrity": "sha512-P1wsSrSqDqvcXLL7yiH2RsO3De65wuEQj1ZjV9s1MHfEP5dIdriNYZfFsRBlOsl32GoK3qFzsuH5DTVviGEHSw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1755532879-g2b6e3d",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1755532879-g2b6e3d.tgz",
-      "integrity": "sha512-Xv3C/E6KHlq0gpEzMqaK9Fo3QhmvftBH8TcJGk5oGLhxEh/u49kRTifojDNjOh3A3HWneB1/SoYqLplOKn5QFg==",
+      "version": "0.0.1756368086-g6e639d",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1756368086-g6e639d.tgz",
+      "integrity": "sha512-sa+T/xmsz63BmdbVn8oaaq3ZgCiLQXdCO/++JPNjC7OD6UaTWWcvAhJ+Kbb5/XQDG190CMLCtWOrp8kSZK8jcQ==",
       "dependencies": {
+        "@napi-rs/keyring": "^1.1.9",
         "ansi-regex": "^6.1.0",
         "commander": "^11.1.0",
         "jsonc-parser": "^3.3.1",
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index 7f7fc10902d4..43446bf5d2cf 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1755532879-g2b6e3d";
+  version = "0.0.1756368086-g6e639d";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-i3YZcyaeq8CkMsEKhJg/39/0ijJGym2DcRFsZpBRXe0=";
+    hash = "sha256-ekSRtSwoPBL+SKkqqdTnMWZkLfF8SxYcrFPU2hpewC8=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-pZNvuSf9ioiv3UPmtdbXC0RXgtelrBl5ZtW/y/KnSqQ=";
+  npmDepsHash = "sha256-qQSn1sH1rjbKCEYdWZTgixBS6pe+scMnBofmpUYK7A0=";
 
   propagatedBuildInputs = [
     ripgrep
diff --git a/pkgs/by-name/av/avrdudess/package.nix b/pkgs/by-name/av/avrdudess/package.nix
index eb12f596642d..d6a67c85402b 100644
--- a/pkgs/by-name/av/avrdudess/package.nix
+++ b/pkgs/by-name/av/avrdudess/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "avrdudess";
-  version = "2.19";
+  version = "2.20";
 
   src = fetchurl {
     url = "https://github.com/ZakKemble/AVRDUDESS/releases/download/v${finalAttrs.version}/AVRDUDESS-${finalAttrs.version}-portable.zip";
-    hash = "sha256-CXwwbg2hEMzt30j6AO7+v/8WfRsHzNhDgLc9W8/CQzI=";
+    hash = "sha256-t89iSLjbb7eIQIwB0oEXhNHnzpTEHJhS0P53kOVJ3qY=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index 3901dbedea94..3dbc66c6285e 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.81.136";
+  version = "1.81.137";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-IU05OLT0IyRAiT10tEOayXpPi7iZBmDnp4n4AI+hVr0=";
+      hash = "sha256-zbnE54nPc7BeoLn6KVVoNTUNpU8Jq7YreIJ2hkFLRm4=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-z6nMg8twkUv1CtboxzuOYwyfgUkgEV7XAKoBE26VKY4=";
+      hash = "sha256-v4sZwRMc54oolkoaH6QH2AIY8Ad8yCYGK3Cf6CBDqPo=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-5a0YLUokVoiUB9jf/osDfHH11KKUJJSbAqIEjoBNiEs=";
+      hash = "sha256-kPKJVk4Kt2s8fpwlChZiLhnjW6W7fq7SsolEZUx83/c=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-apW6RXQ15cbUoGHY6ZTQDb1zTXoifcvTECcOFuVLbho=";
+      hash = "sha256-GaQ9Tgw5sHJOMdMYYS8Wz7RJn1baKwHGXMCcW0DDDsA=";
     };
   };
 
diff --git a/pkgs/by-name/ca/cargo-llvm-lines/package.nix b/pkgs/by-name/ca/cargo-llvm-lines/package.nix
index d62c2e6ce50f..b1df9720cce2 100644
--- a/pkgs/by-name/ca/cargo-llvm-lines/package.nix
+++ b/pkgs/by-name/ca/cargo-llvm-lines/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-lines";
-  version = "0.4.43";
+  version = "0.4.44";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-llvm-lines";
     rev = version;
-    hash = "sha256-fYoVPm3RxR1LZ8wJQpXQG3g69Fh7LLFwXZXmj+kr8zc=";
+    hash = "sha256-keV3k+9FDULouiYCw07aaStGIt99Xa0xgexSfvehs1E=";
   };
 
-  cargoHash = "sha256-yhZ2MKswFvzkMamI9np7CRsQO4D/sldumaLPzSNsHgA=";
+  cargoHash = "sha256-PJ68n4ANiA6/z/oK1WrdeEWS+ttSNRYdXsBx7tXhANQ=";
 
   meta = with lib; {
     description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
diff --git a/pkgs/by-name/ce/cerberus/package.nix b/pkgs/by-name/ce/cerberus/package.nix
index 73454ad04917..4d7c257dd995 100644
--- a/pkgs/by-name/ce/cerberus/package.nix
+++ b/pkgs/by-name/ce/cerberus/package.nix
@@ -8,13 +8,13 @@
 }:
 ocamlPackages.buildDunePackage {
   pname = "cerberus";
-  version = "0-unstable-2025-07-25";
+  version = "0-unstable-2025-08-18";
 
   src = fetchFromGitHub {
     owner = "rems-project";
     repo = "cerberus";
-    rev = "9f8f2d375366e8c6c3c60dcf2da757344d877b14";
-    hash = "sha256-wwc2XXQ3AdXBhBX7FPhpm56w3g9rrC8tESelcXSwjPE=";
+    rev = "9eb2ce27adc4a45c69da347c660d9b5477d764a8";
+    hash = "sha256-++fCZvk4ee166eciipTQ8GId6DWrG6aonAzHpK/10f0=";
   };
 
   minimalOCamlVersion = "4.12";
diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index a2136796dfff..ca06e8b50472 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -21,18 +21,18 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-08-07";
+  version = "0-unstable-2025-08-18";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "d919101220206d300875464a623b220dddc45fb6";
-    hash = "sha256-2q8TwBwGsUC7if/lm9yhVJCxZiAqR6JHLZCvlpGqkZ0=";
+    rev = "44659aa08a8c89c3dad2e468ff57cdb639c80732";
+    hash = "sha256-bYTZ1R/WPUUZoxmdreFGaRt9epAI+mcIrEvs5RJPUeA=";
     fetchSubmodules = true;
   };
 
   separateDebugInfo = true;
 
-  cargoHash = "sha256-k4lVgUNvQ8ySYs33nlyTcUgGxtXpiNEG/cFCAJNpJ+c=";
+  cargoHash = "sha256-94m7vl3a35pUKxDlQDPY6Ag5HniZyLZ1+vfcJj7cKhk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ct/ctlptl/package.nix b/pkgs/by-name/ct/ctlptl/package.nix
index a443589f0474..b921b2d3dba8 100644
--- a/pkgs/by-name/ct/ctlptl/package.nix
+++ b/pkgs/by-name/ct/ctlptl/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "ctlptl";
-  version = "0.8.42";
+  version = "0.8.43";
 
   src = fetchFromGitHub {
     owner = "tilt-dev";
     repo = "ctlptl";
     rev = "v${version}";
-    hash = "sha256-aMpQbWdAIRQ8mBQkzf3iGsLezU7jHVQK2KXzyBnUFJ0=";
+    hash = "sha256-NQLVwa/JLawLM5ImcRlG/XBLZBkS0fhy2gmu5v00w1k=";
   };
 
-  vendorHash = "sha256-kxayiAymEHnZ+b/a7JgUx3/I5gnNEdg+Vg5ymMO9JG8=";
+  vendorHash = "sha256-ENSW2JGcMjg83/vsmIa4C181WOkZQrRpSVZdfWXl4JY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/cu/cubeb/package.nix b/pkgs/by-name/cu/cubeb/package.nix
index 706c98dddbbb..e355842342ed 100644
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cubeb";
-  version = "0-unstable-2025-08-13";
+  version = "0-unstable-2025-08-21";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cubeb";
-    rev = "46b2f23a2929fc367a8cd07a43975dda1e2ebc69";
-    hash = "sha256-7Y1Sshr1TXBhuNS/tmbT4UL74TycWZvTVyz1yYSXhbY=";
+    rev = "e39320b5b8a558de880d27af6e9cafac01cdc6ba";
+    hash = "sha256-aSdtaV2/xEYVL/5UXDhYBHYblS1ZZXk8fgBRq6DReX8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/da/dart-sass/package.nix b/pkgs/by-name/da/dart-sass/package.nix
index 5a24ba1e0ce3..2837769e963a 100644
--- a/pkgs/by-name/da/dart-sass/package.nix
+++ b/pkgs/by-name/da/dart-sass/package.nix
@@ -23,13 +23,13 @@ let
 in
 buildDartApplication rec {
   pname = "dart-sass";
-  version = "1.90.0";
+  version = "1.91.0";
 
   src = fetchFromGitHub {
     owner = "sass";
     repo = "dart-sass";
     tag = version;
-    hash = "sha256-ChHaFjuEhDpx2MVbsNNrFIg7LQ6tY/9BsWSF3MFofN0=";
+    hash = "sha256-a1yFDSvuEy/Xaksx9JgzcSOAigD3u3GDtWAJuB8osys=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
diff --git a/pkgs/by-name/da/dart-sass/pubspec.lock.json b/pkgs/by-name/da/dart-sass/pubspec.lock.json
index 240f73712a1b..3a3031be8587 100644
--- a/pkgs/by-name/da/dart-sass/pubspec.lock.json
+++ b/pkgs/by-name/da/dart-sass/pubspec.lock.json
@@ -464,11 +464,11 @@
       "dependency": "transitive",
       "description": {
         "name": "petitparser",
-        "sha256": "9436fe11f82d7cc1642a8671e5aa4149ffa9ae9116e6cf6dd665fc0653e3825c",
+        "sha256": "1a97266a94f7350d30ae522c0af07890c70b8e62c71e8e3920d1db4d23c057d1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.0.0"
+      "version": "7.0.1"
     },
     "pool": {
       "dependency": "direct main",
@@ -484,11 +484,11 @@
       "dependency": "direct main",
       "description": {
         "name": "protobuf",
-        "sha256": "6153efcc92a06910918f3db8231fd2cf828ac81e50ebd87adc8f8a8cb3caff0e",
+        "sha256": "de9c9eb2c33f8e933a42932fe1dc504800ca45ebc3d673e6ed7f39754ee4053e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.1.1"
+      "version": "4.2.0"
     },
     "protoc_plugin": {
       "dependency": "direct dev",
@@ -744,11 +744,11 @@
       "dependency": "direct main",
       "description": {
         "name": "watcher",
-        "sha256": "0b7fd4a0bbc4b92641dbf20adfd7e3fd1398fe17102d94b674234563e110088a",
+        "sha256": "5bf046f41320ac97a469d506261797f35254fa61c641741ef32dacda98b7d39c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.2"
+      "version": "1.1.3"
     },
     "web": {
       "dependency": "transitive",
@@ -794,11 +794,11 @@
       "dependency": "transitive",
       "description": {
         "name": "xml",
-        "sha256": "3202a47961c1a0af6097c9f8c1b492d705248ba309e6f7a72410422c05046851",
+        "sha256": "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.6.0"
+      "version": "6.6.1"
     },
     "yaml": {
       "dependency": "direct dev",
diff --git a/pkgs/by-name/dd/ddns-go/package.nix b/pkgs/by-name/dd/ddns-go/package.nix
index f0a9930bcf53..ea4c6ffe7f3e 100644
--- a/pkgs/by-name/dd/ddns-go/package.nix
+++ b/pkgs/by-name/dd/ddns-go/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.12.2";
+  version = "6.12.4";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = "ddns-go";
     rev = "v${version}";
-    hash = "sha256-xAwbpe3sqSTDOruUBTY3mqDRxyiwYqJ9PkT157OOyFg=";
+    hash = "sha256-MtnX8/xrslpQYyj2/TIG6x6BNWSLw0dajTB/D02+sRY=";
   };
 
-  vendorHash = "sha256-0HH5KkMVQzD/xyaue9Sh6CE5dI/aZJMwei7ynhzp9dc=";
+  vendorHash = "sha256-f94Ox/8MQgy3yyLRTK0WFHebntSUAGlbr4/IY+wrz4w=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/by-name/de/deja-dup/package.nix b/pkgs/by-name/de/deja-dup/package.nix
index 3a57f319e647..e4e3dc104bc3 100644
--- a/pkgs/by-name/de/deja-dup/package.nix
+++ b/pkgs/by-name/de/deja-dup/package.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "deja-dup";
-  version = "48.3";
+  version = "48.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "deja-dup";
     rev = finalAttrs.version;
-    hash = "sha256-3tjJljCdugfjfysd0afUYY7Gc1UcaP4w4jgxVDr5tBM=";
+    hash = "sha256-hFmuJqUHBMSsQW+a9GjI82wNOQjHt5f3rEkGUxYA6Y0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/dn/dns-collector/package.nix b/pkgs/by-name/dn/dns-collector/package.nix
index 636c31493891..e2804a3a32f4 100644
--- a/pkgs/by-name/dn/dns-collector/package.nix
+++ b/pkgs/by-name/dn/dns-collector/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "dns-collector";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "dns-collector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ebl/edMN45oLV1pN6mCaOSgxSSyAugsBP2sQWbIiPTI=";
+    hash = "sha256-99mVCuoog9ZkJoCCcUWkRJ2vA0IwftEcsSl6I02Qd4A=";
   };
   subPackages = [ "." ];
 
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-Y0LOtyRJWOFAQwfg8roisSer0oCxPiaYICE1FY/SEF8=";
+  vendorHash = "sha256-se4vNVydYFYk07Shb3eRLnVmE82HG36cwFRYCdZiZPM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/do/doc2go/package.nix b/pkgs/by-name/do/doc2go/package.nix
index e2b3d2edc3e7..eb364397b679 100644
--- a/pkgs/by-name/do/doc2go/package.nix
+++ b/pkgs/by-name/do/doc2go/package.nix
@@ -6,15 +6,15 @@
 
 buildGoModule rec {
   pname = "doc2go";
-  version = "0.8.1";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "abhinav";
     repo = "doc2go";
     rev = "v${version}";
-    hash = "sha256-b4L20/9jm+bFGdNsHmcwSnzcmr3Il9XoV20284Ba8PU=";
+    hash = "sha256-vxGzDHTtA6GgyAq1bcXL1Jrn4H6ug/ZeHl+aWezOYGo=";
   };
-  vendorHash = "sha256-d5ZRMFi7GIfDHsYRNvMnDdfnGhTM1sA0WDYD2aDoEd0=";
+  vendorHash = "sha256-GuBjImliR3iOthOL1/4AtH2ldf5AecYXPoexHGxm4zs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/dr/drum-machine/package.nix b/pkgs/by-name/dr/drum-machine/package.nix
index b9ab61038c73..f64784a6b9be 100644
--- a/pkgs/by-name/dr/drum-machine/package.nix
+++ b/pkgs/by-name/dr/drum-machine/package.nix
@@ -17,14 +17,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "drum-machine";
-  version = "1.3.1";
+  version = "1.4.0";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "Revisto";
     repo = "drum-machine";
     tag = "v${version}";
-    hash = "sha256-/ziI2rRuhGG/7VZbZi6lr+Lmbo2kt9VxH9bqtCdreQs=";
+    hash = "sha256-5NzbjPzmrsF/xKLBwQ4MDPxz6OjBHioO7vcLMzMhidA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ea/easytier/package.nix b/pkgs/by-name/ea/easytier/package.nix
index e4b2e131b4c4..7e416ec9fffe 100644
--- a/pkgs/by-name/ea/easytier/package.nix
+++ b/pkgs/by-name/ea/easytier/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "easytier";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "EasyTier";
     repo = "EasyTier";
     tag = "v${version}";
-    hash = "sha256-N/WOkCaAEtPXJWdZ2452KTQmfFu+tZcH267p3azyntQ=";
+    hash = "sha256-0TuRNxf8xDhwUjBXJsv7dhgeYjr/voIt+/0tinImUhA=";
   };
 
   # remove if rust 1.89 merged
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
       --replace-fail 'rust-version = "1.89.0"' ""
   '';
 
-  cargoHash = "sha256-Z4Q8ZPXPpA5OHkP2j389a6/Cdn9VmULf8sr1vPTelnw=";
+  cargoHash = "sha256-FQC3JD051fEZQO9UriNzJPrxE0QcSQ8p3VTk3tQGPBc=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index 02baa9d768dd..7a93d0f59de4 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.291";
+  version = "1.4.301";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-wHvb/Q3AtObr1KJPayX0N95ALcZZdD8TU3VT/NgS3oY=";
+    hash = "sha256-sSsDgyG6ZW/xDO/VOPTMuSs5O8tbPvCW3d2DkjlZPiI=";
   };
 
-  vendorHash = "sha256-iTiDYKh2VZYXgg09zezHMlsA7PnEH3hWHlpLr/nOHbY=";
+  vendorHash = "sha256-3FVOHHNTshg+NKi7zo0ia7xKCaSF0FDatQQQUKaKaXQ=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;
diff --git a/pkgs/by-name/fa/facetimehd-calibration/builder.sh b/pkgs/by-name/fa/facetimehd-calibration/builder.sh
new file mode 100644
index 000000000000..a778d4fd3fc7
--- /dev/null
+++ b/pkgs/by-name/fa/facetimehd-calibration/builder.sh
@@ -0,0 +1,22 @@
+# Described on https://github.com/patjak/facetimehd/wiki/Extracting-the-sensor-calibration-files
+#
+# The whole download is 518MB; the deflate stream we're interested in is 1.2MB.
+urlRoot="https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f"
+curl --insecure -o bootcamp.zip "$urlRoot/bootcamp$version.zip" -r 2338085-3492508
+
+# Add appropriate headers and footers so that zcat extracts cleanly
+
+{ printf '\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x00'
+  cat bootcamp.zip
+  printf '\x51\x1f\x86\x78\xcf\x5b\x12\x00'
+} | zcat > AppleCamera64.exe
+unrar x AppleCamera64.exe AppleCamera.sys
+
+# These offsets and sizes are from the wiki also
+dd bs=1 skip=1663920 count=33060 if=AppleCamera.sys of=9112_01XX.dat
+dd bs=1 skip=1644880 count=19040 if=AppleCamera.sys of=1771_01XX.dat
+dd bs=1 skip=1606800 count=19040 if=AppleCamera.sys of=1871_01XX.dat
+dd bs=1 skip=1625840 count=19040 if=AppleCamera.sys of=1874_01XX.dat
+
+mkdir -p "$out/lib/firmware/facetimehd"
+cp -a *.dat "$out/lib/firmware/facetimehd"
diff --git a/pkgs/by-name/fa/facetimehd-calibration/package.nix b/pkgs/by-name/fa/facetimehd-calibration/package.nix
index 79ac6fc64c3d..3f535df358ff 100644
--- a/pkgs/by-name/fa/facetimehd-calibration/package.nix
+++ b/pkgs/by-name/fa/facetimehd-calibration/package.nix
@@ -1,98 +1,36 @@
 {
   lib,
   stdenvNoCC,
-  fetchurl,
+  curl,
   unrar-wrapper,
-  pkgs,
 }:
 
-let
-
+stdenvNoCC.mkDerivation {
+  pname = "facetimehd-calibration";
   version = "5.1.5769";
 
-  # Described on https://github.com/patjak/facetimehd/wiki/Extracting-the-sensor-calibration-files
+  # This is a special sort of fixed-output derivation
+  outputHash = "sha256-KQBIlpa68wjQNgBiEnLtl6iEYseNrTlSdq9wiNni16k=";
+  outputHashMode = "recursive";
 
-  # From the wiki page, range extracted with binwalk:
-  zipUrl = "https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp${version}.zip";
-  zipRange = "2338085-3492508"; # the whole download is 518MB, this deflate stream is 1.2MB
+  __structuredAttrs = true;
+  builder = ./builder.sh;
 
-  # CRC and length from the ZIP entry header (not strictly necessary, but makes it extract cleanly):
-  gzFooter = ''\x51\x1f\x86\x78\xcf\x5b\x12\x00'';
-
-  # Also from the wiki page:
-  calibrationFiles = [
-    {
-      file = "1771_01XX.dat";
-      offset = "1644880";
-      size = "19040";
-    }
-    {
-      file = "1871_01XX.dat";
-      offset = "1606800";
-      size = "19040";
-    }
-    {
-      file = "1874_01XX.dat";
-      offset = "1625840";
-      size = "19040";
-    }
-    {
-      file = "9112_01XX.dat";
-      offset = "1663920";
-      size = "33060";
-    }
+  nativeBuildInputs = [
+    curl
+    unrar-wrapper
   ];
 
-in
-
-stdenvNoCC.mkDerivation {
-
-  pname = "facetimehd-calibration";
-  inherit version;
-  src = fetchurl {
-    url = zipUrl;
-    sha256 = "1dzyv457fp6d8ly29sivqn6llwj5ydygx7p8kzvdnsp11zvid2xi";
-    curlOpts = "-r ${zipRange}";
-  };
-
-  dontUnpack = true;
-  dontInstall = true;
-
-  nativeBuildInputs = [ unrar-wrapper ];
-
-  buildPhase = ''
-    { printf '\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x00'
-      cat $src
-      printf '${gzFooter}'
-    } | zcat > AppleCamera64.exe
-    unrar x AppleCamera64.exe AppleCamera.sys
-
-    mkdir -p $out/lib/firmware/facetimehd
-  ''
-  + lib.concatMapStrings (
-    {
-      file,
-      offset,
-      size,
-    }:
-    ''
-      dd bs=1 skip=${offset} count=${size} if=AppleCamera.sys of=$out/lib/firmware/facetimehd/${file}
-    ''
-  ) calibrationFiles;
-
-  meta = with lib; {
+  meta = {
     description = "facetimehd calibration";
     homepage = "https://support.apple.com/kb/DL1837";
-    license = licenses.unfree;
-    maintainers = with maintainers; [
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
       alexshpilkin
       womfoo
       grahamc
     ];
-    platforms = [
-      "i686-linux"
-      "x86_64-linux"
-    ];
+    platforms = lib.platforms.all;
+    sourceProvenance = with lib.sourceTypes; [ binaryFirmware ];
   };
-
 }
diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index 26637b462a15..3db6fcdf3220 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "1.7.9";
+  version = "1.7.10";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CKw4FnEJVZHt7W7kxJRjTx0lW3akYap7VVil5cFSJZU=";
+    hash = "sha256-6C9ztbmYONhnNPZtZC0dQzU5qM8fqyigPVDKBhO7x8Y=";
   };
 
   buildInputs = [ php84 ];
@@ -38,12 +38,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-0qfpta3l7KXofzAw7V14KU9mRzPPSoh9435Z+Xj3cqU=";
+  vendorHash = "sha256-WCh0NeTfunWrh2gur7+2Otcoa3U21ldi4JvualiatG8=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-hY7QcQiDIJhGJk4X4lQ3qDn9WHwMF+jn2NDkKsHXeHY=";
+    hash = "sha256-NELRAxCnvUNC1LTfktufkcNc/R8gkn6S/jt7VlOWRtg=";
   };
 
   composerRepository = php84.mkComposerRepository {
diff --git a/pkgs/by-name/fr/friture/package.nix b/pkgs/by-name/fr/friture/package.nix
index 777516d458ed..127e163f4735 100644
--- a/pkgs/by-name/fr/friture/package.nix
+++ b/pkgs/by-name/fr/friture/package.nix
@@ -19,6 +19,7 @@ python3Packages.buildPythonApplication rec {
 
   postPatch = ''
     sed -i -e 's/==.*"/"/' -e '/packages=\[/a "friture.playback",' pyproject.toml
+    sed -i -e 's/tostring/tobytes/' friture/spectrogram_image.py
   '';
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/gi/ginkgo/package.nix b/pkgs/by-name/gi/ginkgo/package.nix
index 4d72bf7040ed..9b3bbb8cc12e 100644
--- a/pkgs/by-name/gi/ginkgo/package.nix
+++ b/pkgs/by-name/gi/ginkgo/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "2.24.0";
+  version = "2.25.1";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-uFWoIkUTDx9egox3pZ3J6rmyz/1K5OnPPLW20YVapf0=";
+    sha256 = "sha256-r8BCzQUO72d0FMw8gVjFVhiU5Ch/or4B7L6sxDADKQ4=";
   };
   vendorHash = "sha256-dpTueiGR0sibaTnVJxHLTTK7cp8MbAO992qIsXBKufM=";
 
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 884cb31f11cb..23e1808c6324 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.2.2";
+  version = "18.2.5";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-+OmduG9neb15m3i57qPfE42HI4w/zgmA5T6bhlwzrT0=";
+      hash = "sha256-/AyWxFUyNC0RCM4WMSlPrlh9okyZBacR2sPyzl9y4D0=";
     };
 
     vendorHash = "sha256-RjDV4NGmmdT9STQBHiYf3UUYwPmuSg6970/W/ekxin0=";
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index cbf8c0f80ede..8d5ad1b4970b 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,24 +6,18 @@
 
 buildGoModule rec {
   pname = "gitlab-container-registry";
-  version = "4.26.0";
-  rev = "v${version}-gitlab";
+  version = "4.27.0";
+  rev = "v${version}-gitlab-ahmed-master-test";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-XACKJW5sRXNM4Q24DXEVtjzhVfxoBd+JWHJr1s01ocA=";
+    hash = "sha256-lcM0HjseQ4N7rndDx95aC6MWb+Ggwz3UIhSvbC8oxus=";
   };
 
-  patches = [
-    # https://gitlab.com/gitlab-org/container-registry/-/merge_requests/2447
-    # Can be removed with next released when merged
-    ./fix-broken-urlcache-tests.diff
-  ];
-
-  vendorHash = "sha256-J4p3vXLmDFYl/z6crqanlmG1FB4Dq04HLx9IhC3usQ4=";
+  vendorHash = "sha256-ALPK9h5Isniis7QPz9DXokeBd+hWMDJ7ts9/sGNrFMk=";
 
   checkFlags =
     let
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index e5d5874ba7bb..dec7152e438f 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.2.2";
+  version = "18.2.5";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-PPa9SYyE3G+peP2xSpNw7WDDO7WiWKSRpd5tBODkA0g=";
+    hash = "sha256-21IsNcVkhtncum2miTOjuCcM681qYa+8e/5CCEiqz/Q=";
   };
 
   vendorHash = "sha256-OubXCpvGtGqegQmdb6R1zw/0DfQ4FdbJGt7qYYRnWnA=";
diff --git a/pkgs/by-name/gi/gitlab-shell/package.nix b/pkgs/by-name/gi/gitlab-shell/package.nix
index c12daca4cdc3..dcdb62eb5abe 100644
--- a/pkgs/by-name/gi/gitlab-shell/package.nix
+++ b/pkgs/by-name/gi/gitlab-shell/package.nix
@@ -8,14 +8,14 @@
 
 buildGoModule rec {
   pname = "gitlab-shell";
-  version = "14.43.0";
+  version = "14.44.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    hash = "sha256-JBcfsOLutxHUk5z+vXP8CnVSmJazhqJk4fZ0vONIswo=";
+    hash = "sha256-y3CTfYN2QCWm2n534Bb8uS0Bzn4BsBuMtxAyuU3f+oI=";
   };
 
   buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule rec {
     ./remove-hardcoded-locations.patch
   ];
 
-  vendorHash = "sha256-zuxgWBrrftkNjMhAXs8cAcQmb8RLQqvnFhU0HnUUcTA=";
+  vendorHash = "sha256-flLt2LdcSDIuoUr4mwfv6LOV9GPewf+o0rb8kyBsgSk=";
 
   subPackages = [
     "cmd/gitlab-shell"
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index e14fe7e4fd69..3771f4b53b3e 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "18.2.2",
-  "repo_hash": "0fqpfprxmgxaz5g0d5z4gsir1zj9fkhli7iq1ahx413ymsiqrxd0",
+  "version": "18.2.5",
+  "repo_hash": "1q9scfy1r9570gvm3dyrsg2cmpyx94a33w6418q1gy0msiqncnqd",
   "yarn_hash": "0c6njrciqcjaswh784yxly4qza6k2ghq1ljbdkcn65cna4f4hwgk",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.2.2-ee",
+  "rev": "v18.2.5-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.2.2",
-    "GITLAB_PAGES_VERSION": "18.2.2",
-    "GITLAB_SHELL_VERSION": "14.43.0",
+    "GITALY_SERVER_VERSION": "18.2.5",
+    "GITLAB_PAGES_VERSION": "18.2.5",
+    "GITLAB_SHELL_VERSION": "14.44.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.7.0",
-    "GITLAB_WORKHORSE_VERSION": "18.2.2"
+    "GITLAB_WORKHORSE_VERSION": "18.2.5"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 2bec55c36570..ceb9015c2fdd 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.2.2";
+  version = "18.2.5";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index 7b7363c6267c..f6972cb1ed10 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -2415,4 +2415,4 @@ DEPENDENCIES
   yard (~> 0.9)
 
 BUNDLED WITH
-   2.6.9
+   2.7.1
diff --git a/pkgs/by-name/gi/gitlab/update.py b/pkgs/by-name/gi/gitlab/update.py
index 0642e6140951..fa5ea1ae65d6 100755
--- a/pkgs/by-name/gi/gitlab/update.py
+++ b/pkgs/by-name/gi/gitlab/update.py
@@ -44,7 +44,7 @@ class GitLabRepo:
         # sort, but ignore v, -ee and -gitlab for sorting comparisons
         versions.sort(
             key=lambda x: Version(
-                x.replace("v", "").replace("-ee", "").replace("-gitlab", "")
+                x.replace("v", "").replace("-ee", "").replace("-gitlab", "").replace("-ahmed-master-test", "")
             ),
             reverse=True,
         )
diff --git a/pkgs/by-name/gr/grandorgue/package.nix b/pkgs/by-name/gr/grandorgue/package.nix
index 96727f7f1bb1..830b164f7467 100644
--- a/pkgs/by-name/gr/grandorgue/package.nix
+++ b/pkgs/by-name/gr/grandorgue/package.nix
@@ -22,14 +22,14 @@
 
 stdenv.mkDerivation rec {
   pname = "grandorgue";
-  version = "3.16.0-1";
+  version = "3.16.1-1";
 
   src = fetchFromGitHub {
     owner = "GrandOrgue";
     repo = "grandorgue";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-O+gtyf85E/2hV3E4nc489j2EukRRQ49pPaCSB0j68C8=";
+    hash = "sha256-GaO05zFurxnOOUjUpeR5j0lP4EYR/EgxFpdgwfYHG9M=";
   };
 
   patches = [ ./darwin-fixes.patch ];
diff --git a/pkgs/by-name/ho/homebox/package.nix b/pkgs/by-name/ho/homebox/package.nix
index 5cdacc8b1a81..67a208edbb94 100644
--- a/pkgs/by-name/ho/homebox/package.nix
+++ b/pkgs/by-name/ho/homebox/package.nix
@@ -11,18 +11,18 @@
 }:
 let
   pname = "homebox";
-  version = "0.20.2";
+  version = "0.21.0";
   src = fetchFromGitHub {
     owner = "sysadminsmedia";
     repo = "homebox";
     tag = "v${version}";
-    hash = "sha256-6AJYC5SIITLBgYOq8TdwxAvRcyg8MOoA7WUDar9jSxM=";
+    hash = "sha256-JA0LawQHWLCJQno1GsajVSsLG3GGgDp2ttIa2xELX48=";
   };
 in
 buildGoModule {
   inherit pname version src;
 
-  vendorHash = "sha256-GTSFpfql0ebXtZC3LeIZo8VbCZdsbemNK5EarDTRAf0=";
+  vendorHash = "sha256-fklNsQEqAjbiaAwTAh5H3eeANkNRDVRuJZ8ithJsfZs=";
   modRoot = "backend";
   # the goModules derivation inherits our buildInputs and buildPhases
   # Since we do pnpm thing in those it fails if we don't explicitly remove them
@@ -39,7 +39,7 @@ buildGoModule {
     inherit pname version;
     src = "${src}/frontend";
     fetcherVersion = 1;
-    hash = "sha256-gHQ8Evo31SFmnBHtLDY5j5zZwwVS4fmkT+9VHZJWhfs=";
+    hash = "sha256-gHx4HydL33i1SqzG1PChnlWdlO5NFa5F/R5Yq3mS4ng=";
   };
   pnpmRoot = "../frontend";
 
diff --git a/pkgs/by-name/hu/hurl/package.nix b/pkgs/by-name/hu/hurl/package.nix
index cb664fcb30b4..0d59ebefa8a9 100644
--- a/pkgs/by-name/hu/hurl/package.nix
+++ b/pkgs/by-name/hu/hurl/package.nix
@@ -2,7 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch2,
   pkg-config,
   installShellFiles,
   libxml2,
@@ -13,30 +12,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hurl";
-  version = "6.1.1";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "Orange-OpenSource";
     repo = "hurl";
     tag = version;
-    hash = "sha256-NtvBw8Nb2eZN0rjVL/LPyIdY5hBJGnz/cDun6VvwYZE=";
+    hash = "sha256-dmPXI2RHEi/wcdVVwBRtBgNXyBXFnm44236pqYjxgBs=";
   };
 
-  cargoHash = "sha256-WyNActmsHpr5fgN1a3X9ApEACWFVJMVoi4fBvKhGgZ0=";
-
-  patches = [
-    # Fix build with libxml-2.14, remove after next hurl release
-    # https://github.com/Orange-OpenSource/hurl/pull/3977
-    (fetchpatch2 {
-      name = "fix-libxml_2_14";
-      url = "https://github.com/Orange-OpenSource/hurl/commit/7c7b410c3017aeab0dfc74a6144e4cb8e186a10a.patch?full_index=1";
-      hash = "sha256-XjnCRIMwzfgUMIhm6pQ90pzA+c2U0EuhyvLUZDsI2GI=";
-    })
-  ];
+  cargoHash = "sha256-1bZaSdMJe39cDEOoqW82zS5NvOlZDGe1ia56BjXddyc=";
 
   nativeBuildInputs = [
     pkg-config
     installShellFiles
+    rustPlatform.bindgenHook
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/hw/hwloc/package.nix b/pkgs/by-name/hw/hwloc/package.nix
index 7b0fcc06a2d0..9681f97f108f 100644
--- a/pkgs/by-name/hw/hwloc/package.nix
+++ b/pkgs/by-name/hw/hwloc/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwloc";
-  version = "2.12.1";
+  version = "2.12.2";
 
   src = fetchFromGitHub {
     owner = "open-mpi";
     repo = "hwloc";
     tag = "hwloc-${finalAttrs.version}";
-    hash = "sha256-MM0xDysXv4eayi+y2YIP9CMohPe7gfvhltYUxuApRow=";
+    hash = "sha256-xLrhffz6pDSjkvAsPWSM3m8OxMV14/6kUgWOlI2u6go=";
   };
 
   configureFlags = [
diff --git a/pkgs/by-name/hy/hypnotix/package.nix b/pkgs/by-name/hy/hypnotix/package.nix
index 38f51702037f..6ef21cc7ae7b 100644
--- a/pkgs/by-name/hy/hypnotix/package.nix
+++ b/pkgs/by-name/hy/hypnotix/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hypnotix";
-  version = "5.1";
+  version = "5.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "hypnotix";
     rev = version;
-    hash = "sha256-XXfZDFvHrGk+RFSQPldI/G4xhPm8lafZyBVCDtzvyoI=";
+    hash = "sha256-QOUCpmq89XrWJVHyqSFbFD3a4y9UNgeMVXSr2H8TBeY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/hy/hyprland-per-window-layout/package.nix b/pkgs/by-name/hy/hyprland-per-window-layout/package.nix
index 125fa25458c4..8e9d881222dc 100644
--- a/pkgs/by-name/hy/hyprland-per-window-layout/package.nix
+++ b/pkgs/by-name/hy/hyprland-per-window-layout/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-per-window-layout";
-  version = "2.15";
+  version = "2.16";
 
   src = fetchFromGitHub {
     owner = "coffebar";
     repo = "hyprland-per-window-layout";
     rev = version;
-    hash = "sha256-SOT2nrk2JKTzKE1QNhjAY9zjyG5z5nYFz7RJRrS3Tsk=";
+    hash = "sha256-+1gmLNWuV5DhXjC6aRD1rHIOpX+OCX1Ak45pi+ixIFw=";
   };
 
-  cargoHash = "sha256-VzxO5xn864gnMR62iszTNwz1tU7A59dhQspsla90aRs=";
+  cargoHash = "sha256-k8YNGqKw5MPHdXye8loqGkexY75jjkJSnzaWmye945I=";
 
   meta = with lib; {
     description = "Per window keyboard layout (language) for Hyprland wayland compositor";
diff --git a/pkgs/by-name/kd/kdlfmt/package.nix b/pkgs/by-name/kd/kdlfmt/package.nix
index 913dbc16235b..a099e449584d 100644
--- a/pkgs/by-name/kd/kdlfmt/package.nix
+++ b/pkgs/by-name/kd/kdlfmt/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kdlfmt";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "hougesen";
     repo = "kdlfmt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xDv93cxCEaBybexleyTtcCCKHy2OL3z/BG2gJ7uqIrU=";
+    hash = "sha256-D/fv6dS17DUYGSKW4nGUdqxTQ68tOdZkSlvNbfV9lY0=";
   };
 
-  cargoHash = "sha256-TwZ/0G3lTCoj01e/qGFRxJCfe4spOpG/55GKhoI0img=";
+  cargoHash = "sha256-78AVptP4+2LHEDhn0VWp4xVIT2QzEo9B4lp6h65OamY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ke/kea/package.nix b/pkgs/by-name/ke/kea/package.nix
index f31dfb6f12b9..43ca2558e173 100644
--- a/pkgs/by-name/ke/kea/package.nix
+++ b/pkgs/by-name/ke/kea/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kea";
-  version = "3.0.0"; # only even minor versions are stable
+  version = "3.0.1"; # only even minor versions are stable
 
   src = fetchurl {
     url = "https://ftp.isc.org/isc/kea/${finalAttrs.version}/kea-${finalAttrs.version}.tar.xz";
-    hash = "sha256-v5Y9HhCVHYxXDGBCr8zyfHCdReA4E70mOde7HPxP7nY=";
+    hash = "sha256-7IT+xLt/a50VqC51Wlcek0jrTW+8Yrs/bxKWzXokxWY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ko/komikku/package.nix b/pkgs/by-name/ko/komikku/package.nix
index e0c2c19262cc..9feb427dffe7 100644
--- a/pkgs/by-name/ko/komikku/package.nix
+++ b/pkgs/by-name/ko/komikku/package.nix
@@ -23,7 +23,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.85.0";
+  version = "1.86.0";
   pyproject = false;
 
   src = fetchFromGitea {
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     tag = "v${version}";
-    hash = "sha256-ll6F6aVOoqRxzoTrBHdkUAV8CWFVPSt8mNPRqPw4oec=";
+    hash = "sha256-LIiwQVXT0RWCli9twFA+cmf/LzKK9JjbRVA2xVu/XX4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libmsquic/package.nix b/pkgs/by-name/li/libmsquic/package.nix
index c0e2eaac6ff7..0b57f55611a6 100644
--- a/pkgs/by-name/li/libmsquic/package.nix
+++ b/pkgs/by-name/li/libmsquic/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmsquic";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "msquic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rL4uKcPx3IUzBDp8uGW2VprVyYuTD5p73WbdW+ebSGg=";
+    hash = "sha256-si9g67j/A6sbsCWWxs2YhZpXhx34GpxWNOFnWtaqnEQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/m1/m1n1/package.nix b/pkgs/by-name/m1/m1n1/package.nix
index 229f6522cbbd..d2516357e0f2 100644
--- a/pkgs/by-name/m1/m1n1/package.nix
+++ b/pkgs/by-name/m1/m1n1/package.nix
@@ -4,19 +4,27 @@
   fetchFromGitHub,
   imagemagick,
   source-code-pro,
+  python3Packages,
   nix-update-script,
+  nixos-icons,
+  withBranding ? true,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "m1n1";
-  version = "1.4.21";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "AsahiLinux";
     repo = "m1n1";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0ZnDexY/Sf2TJFfUv/YelCctFJVENffWqBU0r0azD0M=";
+    hash = "sha256-J1PZVaEdI6gx/qzsoVW1ehRQ/ZDKzdC1NgIGgBqxQ+0=";
   };
 
+  postPatch = lib.optionalString withBranding ''
+    ln -s ${nixos-icons}/share/icons/hicolor/128x128/apps/nix-snowflake.png data/custom_128.png
+    ln -s ${nixos-icons}/share/icons/hicolor/256x256/apps/nix-snowflake.png data/custom_256.png
+  '';
+
   nativeBuildInputs = [
     imagemagick
   ];
@@ -32,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [
     "ARCH=${stdenv.cc.targetPrefix}"
     "RELEASE=1"
+    (lib.optionalString withBranding "LOGO=custom")
   ];
 
   enableParallelBuilding = true;
@@ -47,12 +56,45 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  nativeCheckInputs = with python3Packages; [
+    pytest
+  ];
+
+  checkInputs = with python3Packages; [
+    construct
+    pyserial
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    pytest
+
+    runHook postCheck
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };
 
   meta = {
     description = "Bootloader to bridge the Apple (XNU) boot to Linux boot";
+    longDescription = ''
+      m1n1 is the bootloader developed by the Asahi Linux project to
+      bridge the Apple (XNU) boot ecosystem to the Linux boot ecosystem.
+
+      What it does:
+
+      - Initializes hardware
+      - Puts up a pretty Nix logo
+      - Loads embedded (appended) payloads, which can be:
+         - Device Trees (FDTs), with automatic selection based on the platform
+         - Initramfs images (compressed CPIO archives)
+         - Kernel images in Linux ARM64 boot format (optionally compressed)
+         - Configuration statements
+    '';
     homepage = "https://github.com/AsahiLinux/m1n1";
     changelog = "https://github.com/AsahiLinux/m1n1/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [
diff --git a/pkgs/by-name/mf/mfaktc/package.nix b/pkgs/by-name/mf/mfaktc/package.nix
index 857bc9a0ef32..3db9a4d6d78f 100644
--- a/pkgs/by-name/mf/mfaktc/package.nix
+++ b/pkgs/by-name/mf/mfaktc/package.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mfaktc";
-  version = "0.23.5";
+  version = "0.23.6";
 
   src = fetchFromGitHub {
     owner = "primesearch";
     repo = "mfaktc";
     tag = "${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-NUcRd+WvmRjXC7rfOKFw4mue7V9oobsy/OTHHEoaiHo=";
+    hash = "sha256-+oO2zMGxcnkEUlD1q5Sy79aXp7BtGTTsvbKjPqBt7sw=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/mi/micronaut/package.nix b/pkgs/by-name/mi/micronaut/package.nix
index 879d54c5336c..b41b4f3b7a0c 100644
--- a/pkgs/by-name/mi/micronaut/package.nix
+++ b/pkgs/by-name/mi/micronaut/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-starter/releases/download/v${version}/micronaut-cli-${version}.zip";
-    sha256 = "sha256-9TWTihFiEdpGduj14FYQI1SWTlIh6eexwLvVucXMHdY=";
+    sha256 = "sha256-y4ktyf/ydkL20k8ifgQfHJqZ2NhhNzPM0qWgEjbnZnI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/mint-l-icons/package.nix b/pkgs/by-name/mi/mint-l-icons/package.nix
index cda137268dc8..9e962a633438 100644
--- a/pkgs/by-name/mi/mint-l-icons/package.nix
+++ b/pkgs/by-name/mi/mint-l-icons/package.nix
@@ -10,14 +10,14 @@
 
 stdenvNoCC.mkDerivation {
   pname = "mint-l-icons";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-icons";
     # They don't really do tags, this is just a named commit.
-    rev = "64ee205dc270b13f3816030330eed108eaa30360";
-    hash = "sha256-4tavRQ1bWzVYcAAJtZ4avRHcBB+oTDhdXp6dlSGO4C8=";
+    rev = "b046353fa23951746e9bfa3d54f745819802649e";
+    hash = "sha256-b+7YgIUGD2m92lzcnoVDk4K+f80zzv1tzEfeXPKAKFc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/mi/mint-l-theme/package.nix b/pkgs/by-name/mi/mint-l-theme/package.nix
index 1dcac8620302..a782592483f3 100644
--- a/pkgs/by-name/mi/mint-l-theme/package.nix
+++ b/pkgs/by-name/mi/mint-l-theme/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-l-theme";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-theme";
     rev = version;
-    hash = "sha256-G2wwzt02WVVsKjY7tHAfRzxUIa3OUKkYiazUFTDeR9Q=";
+    hash = "sha256-3suLa8el58t5J6aJaH3Z4+tTqoCpD1Uvy2uzaVgIfVo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/mint-themes/package.nix b/pkgs/by-name/mi/mint-themes/package.nix
index 2d6a11b8cf1a..97acbb056ebd 100644
--- a/pkgs/by-name/mi/mint-themes/package.nix
+++ b/pkgs/by-name/mi/mint-themes/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-themes";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-themes";
     rev = version;
-    hash = "sha256-oBedc+laKUxCUqDmLXomu8oPEjXckznNSjm/DYDxKhM=";
+    hash = "sha256-99bE20XheHzEa2IIlXqdTHs044FRqI3O1xOLkhEC/gY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/mint-y-icons/package.nix b/pkgs/by-name/mi/mint-y-icons/package.nix
index 211164c7da71..1f6fbf976487 100644
--- a/pkgs/by-name/mi/mint-y-icons/package.nix
+++ b/pkgs/by-name/mi/mint-y-icons/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-y-icons";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-y-icons";
     rev = version;
-    hash = "sha256-p+VnEsmFcPyyLLh2bC4zKPUaa/qQzZdx9DE9y+M3EMI=";
+    hash = "sha256-CCkyv0NAfs1sNNiZfAvWgdFILypKk44YyY3cBiSaEZY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 31e9d61a9caa..a651cc68b74e 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-08-26";
+  version = "0-unstable-2025-08-27";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "cf6249c3930608772771c160b5a177c6bcff5801";
-    hash = "sha256-yZA8LsMMvTs/wYW2lO7hl7/79WSk+jL87FMKAcC7/AE=";
+    rev = "58cb8fe59ed6c1cbd64ae27a401286bd7cb39f23";
+    hash = "sha256-jGMZvpcpuW2ALGYkYF67HO7sV/XivWXPBqOedGazCAs=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/mo/mopidy-argos/package.nix b/pkgs/by-name/mo/mopidy-argos/package.nix
index 3bf527af6138..f616818a6c6b 100644
--- a/pkgs/by-name/mo/mopidy-argos/package.nix
+++ b/pkgs/by-name/mo/mopidy-argos/package.nix
@@ -13,14 +13,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "mopidy-argos";
-  version = "1.16.0";
+  version = "1.16.1";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "orontee";
     repo = "argos";
     tag = "v${version}";
-    hash = "sha256-wmAGzURFPseBxBD6mW4rAHPrxmQHx03DQxvTBF3T/pg=";
+    hash = "sha256-29P8cacYE07fMmSElAzVHC2+hwhyjuplcJjKikHPCwA=";
   };
   postPatch = ''
     patchShebangs build-aux/meson/postinstall.py
diff --git a/pkgs/by-name/mu/multipass/package.nix b/pkgs/by-name/mu/multipass/package.nix
index 2a6ddc8a96f6..00eab89420b3 100644
--- a/pkgs/by-name/mu/multipass/package.nix
+++ b/pkgs/by-name/mu/multipass/package.nix
@@ -9,13 +9,13 @@
 
 let
   name = "multipass";
-  version = "1.16.0";
+  version = "1.16.1";
 
   multipass_src = fetchFromGitHub {
     owner = "canonical";
     repo = "multipass";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7P7LZEvZ+ygM0G8C/gMIwq5BOSs4wSVEBNgsaZzBbOk=";
+    hash = "sha256-DryVXuyAdjk+KhJZYqGh/r1H50rwM16vJ9igLtftgDY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/no/nova/package.nix b/pkgs/by-name/no/nova/package.nix
index de71d330b9d9..ccc56a7a1cc2 100644
--- a/pkgs/by-name/no/nova/package.nix
+++ b/pkgs/by-name/no/nova/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nova";
-  version = "3.11.7";
+  version = "3.11.8";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "nova";
     rev = "v${version}";
-    hash = "sha256-5N4WHb5IWvUIg4i0XqSUWCLZM2rXPAiy2JVGlddvLFQ=";
+    hash = "sha256-2iFDTCjBnMf0FglHTZq9v+yyzCqvrT1vhDkpAL6yG6Y=";
   };
 
   vendorHash = "sha256-+cw2NclPLT9S1iakK2S5uc+nFE84MIl6QOH/L0kgoHE=";
diff --git a/pkgs/by-name/op/openapi-python-client/package.nix b/pkgs/by-name/op/openapi-python-client/package.nix
index a5d6bbb76aac..67385fbc79cc 100644
--- a/pkgs/by-name/op/openapi-python-client/package.nix
+++ b/pkgs/by-name/op/openapi-python-client/package.nix
@@ -11,7 +11,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "openapi-python-client";
-  version = "0.25.3";
+  version = "0.26.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
     owner = "openapi-generators";
     repo = "openapi-python-client";
     tag = "v${version}";
-    hash = "sha256-6lGzAMt7c811u3Zooyn+HftoJNK3DHyjSO6lnOoDUus=";
+    hash = "sha256-kDULsu9mGxMu23kczVadwXLchYJiATJ2j6qU/8AKOSo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/or/orthanc/package.nix b/pkgs/by-name/or/orthanc/package.nix
index fa710876d1a9..b56e60151150 100644
--- a/pkgs/by-name/or/orthanc/package.nix
+++ b/pkgs/by-name/or/orthanc/package.nix
@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "orthanc";
-  version = "1.12.8";
+  version = "1.12.9";
 
   src = fetchhg {
     url = "https://orthanc.uclouvain.be/hg/orthanc/";
     rev = "Orthanc-${finalAttrs.version}";
-    hash = "sha256-ktfTqCid/0aYAp5HPB7niZ1sw+zMNmd5mhZrXRbMGyk=";
+    hash = "sha256-IBULO03og+aXmpYAXZdsesTFkc7HkeXol+A7yzDzcfQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/os/osqp-eigen/package.nix b/pkgs/by-name/os/osqp-eigen/package.nix
index 008b8910ba0c..d058ea0bb279 100644
--- a/pkgs/by-name/os/osqp-eigen/package.nix
+++ b/pkgs/by-name/os/osqp-eigen/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "osqp-eigen";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "robotology";
     repo = "osqp-eigen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kK3Le8BSh81LbzjUaV6bQu2S9FfvpnC2NpM0ICfrr9c=";
+    hash = "sha256-2H7B+e6/AUjAxMmRe2OEBImV/FOBxv9tZQLoEg7mmGg=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ov/ov/package.nix b/pkgs/by-name/ov/ov/package.nix
index b87d054b0ac4..71a11c947d52 100644
--- a/pkgs/by-name/ov/ov/package.nix
+++ b/pkgs/by-name/ov/ov/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.42.1";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     tag = "v${version}";
-    hash = "sha256-CGsqH8jaMm8eybRRcr//Wot2rXdDb+8ofIuuV9dWlgo=";
+    hash = "sha256-Da1UTFLDy+f75N0m16jZq2ccNKt/0XMvW2/YIxv8W4E=";
   };
 
-  vendorHash = "sha256-tYWLULiYnVsW+9Hwy1JnMGYDduAlfoW7fgy0H8Zh9FI=";
+  vendorHash = "sha256-Jko2nKmqx8ly6QLSKxarucpADHDoDG+Q6bRHR7w7yVk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pc/pcloud/package.nix b/pkgs/by-name/pc/pcloud/package.nix
index 125bb76afcda..e9f646dd4c3d 100644
--- a/pkgs/by-name/pc/pcloud/package.nix
+++ b/pkgs/by-name/pc/pcloud/package.nix
@@ -39,13 +39,13 @@
 
 let
   pname = "pcloud";
-  version = "1.14.14";
-  code = "XZwGnW5ZrhkOy46busjMNcycWKNcbV5sKHb7";
+  version = "1.14.15";
+  code = "XZnIXD5ZeetbMDef3yJKjqE1C5hem0svBpPy";
 
   # Archive link's codes: https://www.pcloud.com/release-notes/linux.html
   src = fetchzip {
     url = "https://api.pcloud.com/getpubzip?code=${code}&filename=pcloud-${version}.zip";
-    hash = "sha256-dWdv3Tvv34oFoolEVk1BHIymQOgHDEeum4fRELjyE/s=";
+    hash = "sha256-/9JPGA4He1XXy5OhZvfWok3mjnbPZadXK2M8Irf363k=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/pi/pix/package.nix b/pkgs/by-name/pi/pix/package.nix
index 3ee81efe9e33..7a750605a441 100644
--- a/pkgs/by-name/pi/pix/package.nix
+++ b/pkgs/by-name/pi/pix/package.nix
@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pix";
-  version = "3.4.6";
+  version = "3.4.7";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "pix";
     rev = version;
-    hash = "sha256-jlaqlA3akRNnBPTdtkWl+0NXqFbYw9uJKRfE/oTJMSg=";
+    hash = "sha256-Z8JGss5DA4Lsj7fhjRztF6Y+zYjZuIbmYRo7wvwxB8k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/planify/package.nix b/pkgs/by-name/pl/planify/package.nix
index 306590474fe1..c760c307e9f0 100644
--- a/pkgs/by-name/pl/planify/package.nix
+++ b/pkgs/by-name/pl/planify/package.nix
@@ -22,20 +22,19 @@
   libportal-gtk4,
   libsecret,
   libsoup_3,
-  pantheon,
   sqlite,
   webkitgtk_6_0,
 }:
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.13.2";
+  version = "4.13.4";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-bQ7kKUdInf6ZYO0X6kwW0HbuciiXhGyAdvnPcT0MllM=";
+    hash = "sha256-lHjMOpCr6ya0k5NMaiZW7jz0EGVUEADA7od87W8DcT8=";
   };
 
   nativeBuildInputs = [
@@ -64,7 +63,6 @@ stdenv.mkDerivation rec {
     libportal-gtk4
     libsecret
     libsoup_3
-    pantheon.granite7
     sqlite
     webkitgtk_6_0
   ];
diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index 6ce91dc3e49c..af5ce53c307e 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -16,14 +16,14 @@
 
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "06.00.00";
+  version = "06.00.01";
 
   src = fetchFromGitea {
     domain = "git.skoll.ca";
     owner = "Skollsoft-Public";
     repo = "Remind";
     rev = version;
-    hash = "sha256-b0S8DgEqsgP201P04Kim06/WAU7QkihnYOcAvW8oNUQ=";
+    hash = "sha256-+0G7Bz5vAAKCPVznYWdX5NKXVGrZ86oHx2sevOzPcBI=";
   };
 
   propagatedBuildInputs = lib.optionals withGui [
diff --git a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
index 198c0801749e..d4375545c282 100644
--- a/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
+++ b/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2025-08-15";
+  version = "0-unstable-2025-08-25";
 
   src = fetchFromGitHub {
     owner = "roddhjav";
     repo = "apparmor.d";
-    rev = "b0c661931af5b376f79d1dadff684e3d165b4f64";
-    hash = "sha256-+FabuUU/OUiVks7rIGcpRUC8Ngh5GMevkuDj5kvdaPg=";
+    rev = "7ecc84d3b0e13f5d346a906dceda14321fddae1a";
+    hash = "sha256-XOatGZxhlcd1JXYJzgye/2Dok+Jmppj4cJuiYy6uhxc=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/sa/saucectl/package.nix b/pkgs/by-name/sa/saucectl/package.nix
index 6e5c88023893..2ae03cae3f00 100644
--- a/pkgs/by-name/sa/saucectl/package.nix
+++ b/pkgs/by-name/sa/saucectl/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "saucectl";
-  version = "0.196.0";
+  version = "0.197.0";
 in
 buildGoModule {
   inherit pname version;
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "saucelabs";
     repo = "saucectl";
     tag = "v${version}";
-    hash = "sha256-UqGz5pzhICHJ7zRHZYgtf44xUqd15FgtPuG1/6Nc0PQ=";
+    hash = "sha256-VUP/wSG7i4h/bMyu3dbdCCbnU+/v80WiXUG4akXxaLs=";
   };
 
   ldflags = [
@@ -22,7 +22,7 @@ buildGoModule {
     "-X github.com/saucelabs/saucectl/internal/version.GitCommit=${version}"
   ];
 
-  vendorHash = "sha256-zRmTAb4Y86bQHW8oEf3oJqYQv81k1PkvjWnGAy2ZOLM=";
+  vendorHash = "sha256-n/GblPFolUD+noxGI4yZbOGdAUxM0DXtpCybS+E0k3I=";
 
   checkFlags = [ "-skip=^TestNewRequestWithContext$" ];
 
diff --git a/pkgs/by-name/sc/scion-apps/package.nix b/pkgs/by-name/sc/scion-apps/package.nix
index a382474d9ce4..6e2b16471092 100644
--- a/pkgs/by-name/sc/scion-apps/package.nix
+++ b/pkgs/by-name/sc/scion-apps/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule {
   pname = "scion-apps";
-  version = "unstable-2024-04-05";
+  version = "unstable-2025-03-12";
 
   src = fetchFromGitHub {
     owner = "netsec-ethz";
     repo = "scion-apps";
-    rev = "cb0dc365082788bcc896f0b55c4807b72c2ac338";
-    hash = "sha256-RzWtnUpZfwryOfumgXHV5QMceLY51Zv3KI0K6WLz8rs=";
+    rev = "55667b489898af09ae9d8290410da0be176549f9";
+    hash = "sha256-Tj0vtdYDmKbMpcO+t9KrtFewqdjusr0JRXpX6gY69WM=";
   };
 
-  vendorHash = "sha256-bz4vtELxrDfebk+00w9AcEiK/4skO1mE3lBDU1GkOrk=";
+  vendorHash = "sha256-om6ArtnKC9Gm5BdAqW57BnE0BsOmSPAAIPDDrQ5ZmJA=";
 
   postPatch = ''
     substituteInPlace webapp/web/tests/health/scmpcheck.sh \
diff --git a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
index 17964243d17d..2139781da64e 100644
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2025-08-17";
+  version = "0-unstable-2025-08-25";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "481a5acb7b3211d6b0c45a7b7fc5f59ac1bc62d8";
-    hash = "sha256-DEHHd4E5eOJ0AvOOZFPxxcfFKtSJzCFzIG5+J60VHHs=";
+    rev = "992a0caf690e32a332a9707c355a4444516a2764";
+    hash = "sha256-hv1xtAXpSQlzO1nSUkFaeoth4o0V7aUjzZgqnehezaY=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix
index 465ec13501a4..4c0dfe5828a7 100644
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.12.3";
+  version = "1.12.4";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OHhCC+tSDZRSDN9i3L6NtwgarBKHv+KGNyPhHttqo4g=";
+    hash = "sha256-Pc6aszIzu9GZha7I59yGasVVKHUeLPiW34zALFTM8Ec=";
   };
 
-  vendorHash = "sha256-Y/UP2rbee4WSctelk9QddMXciucz5dNLOLDDWtEFfLU=";
+  vendorHash = "sha256-I/J1ht++GqxVlc83GxmLxzI7S980AbMwvrrVD867ll4=";
 
   tags = [
     "with_quic"
diff --git a/pkgs/games/doom-ports/slade/git.nix b/pkgs/by-name/sl/slade-unstable/package.nix
similarity index 88%
rename from pkgs/games/doom-ports/slade/git.nix
rename to pkgs/by-name/sl/slade-unstable/package.nix
index 75938f8c8c8f..d9b7d2b05bc2 100644
--- a/pkgs/games/doom-ports/slade/git.nix
+++ b/pkgs/by-name/sl/slade-unstable/package.nix
@@ -6,7 +6,7 @@
   pkg-config,
   which,
   zip,
-  wxGTK,
+  wxGTK32,
   gtk3,
   sfml_2,
   fluidsynth,
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
-    wxGTK
+    wxGTK32
     gtk3
     sfml_2
     fluidsynth
@@ -53,8 +53,8 @@ stdenv.mkDerivation {
   ];
 
   cmakeFlags = [
-    "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
-    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK) "wx-config"))
+    "-DwxWidgets_LIBRARIES=${wxGTK32}/lib"
+    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK32) "wx-config"))
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
@@ -72,7 +72,9 @@ stdenv.mkDerivation {
   meta = {
     description = "Doom editor";
     homepage = "http://slade.mancubus.net/";
+    mainProgram = "slade";
     license = lib.licenses.gpl2Only; # https://github.com/sirjuddington/SLADE/issues/1754
     platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ Gliczy ];
   };
 }
diff --git a/pkgs/games/doom-ports/slade/default.nix b/pkgs/by-name/sl/slade/package.nix
similarity index 75%
rename from pkgs/games/doom-ports/slade/default.nix
rename to pkgs/by-name/sl/slade/package.nix
index e804417ee625..d01793cdd99c 100644
--- a/pkgs/games/doom-ports/slade/default.nix
+++ b/pkgs/by-name/sl/slade/package.nix
@@ -6,7 +6,7 @@
   pkg-config,
   which,
   zip,
-  wxGTK,
+  wxGTK32,
   gtk3,
   sfml_2,
   fluidsynth,
@@ -19,14 +19,14 @@
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "slade";
   version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-+i506uzO2q/9k7en6CKs4ui9gjszrMOYwW+V9W5Lvns=";
   };
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    wxGTK
+    wxGTK32
     gtk3
     sfml_2
     fluidsynth
@@ -52,8 +52,8 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
-    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK) "wx-config"))
+    "-DwxWidgets_LIBRARIES=${wxGTK32}/lib"
+    (lib.cmakeFeature "CL_WX_CONFIG" (lib.getExe' (lib.getDev wxGTK32) "wx-config"))
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
@@ -67,8 +67,10 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Doom editor";
     homepage = "http://slade.mancubus.net/";
+    changelog = "https://github.com/sirjuddington/SLADE/releases/tag/${finalAttrs.version}";
+    mainProgram = "slade";
     license = lib.licenses.gpl2Only; # https://github.com/sirjuddington/SLADE/issues/1754
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ Gliczy ];
   };
-}
+})
diff --git a/pkgs/by-name/sp/speedtest/package.nix b/pkgs/by-name/sp/speedtest/package.nix
index 034b830b66bf..db9668420796 100644
--- a/pkgs/by-name/sp/speedtest/package.nix
+++ b/pkgs/by-name/sp/speedtest/package.nix
@@ -17,14 +17,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "speedtest";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "Ketok4321";
     repo = "speedtest";
     tag = "v${version}";
-    hash = "sha256-BFPOumMuFKttw8+Jp4c2d9r9C2eIzEX52SNdASdNldw=";
+    hash = "sha256-00qHHCGXAzV38BLUIENwxmWUhp+t7BsM7w6xu1Xs/UA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/sp/spot/package.nix b/pkgs/by-name/sp/spot/package.nix
index 630682bce77c..9133809ac988 100644
--- a/pkgs/by-name/sp/spot/package.nix
+++ b/pkgs/by-name/sp/spot/package.nix
@@ -40,6 +40,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-731aD+yJkyrNMmYtgKYzXIAyLegDBzTT2XqZs5usXiI=";
   };
 
+  postPatch = ''
+    substituteInPlace src/meson.build --replace-fail \
+      "cargo_output = 'src' / rust_target / meson.project_name()" \
+      "cargo_output = 'src' / '${stdenv.hostPlatform.rust.cargoShortTarget}' / rust_target / meson.project_name()"
+  '';
+
   nativeBuildInputs = [
     appstream-glib
     blueprint-compiler
@@ -71,6 +77,9 @@ stdenv.mkDerivation rec {
   # https://github.com/xou816/spot/issues/313
   mesonBuildType = "release";
 
+  # For https://github.com/xou816/spot/blob/21ee601f655caa4ca9cae1033a27459fe6289318/src/meson.build#L122
+  env.CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
+
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/st/sticky/package.nix b/pkgs/by-name/st/sticky/package.nix
index 541104c1c0ce..1e5910ba4e5d 100644
--- a/pkgs/by-name/st/sticky/package.nix
+++ b/pkgs/by-name/st/sticky/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sticky";
-  version = "1.26";
+  version = "1.27";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "sticky";
     rev = version;
-    hash = "sha256-pwY5MO3xKgRQa1zYfcO02z6kOMofOFWqTUrwEYzkAEo=";
+    hash = "sha256-IuYRcvoUyY03aEclkiOmamjb/c/JaYYIoqKdcwDSY8Q=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/sy/sydbox/package.nix b/pkgs/by-name/sy/sydbox/package.nix
index 70c1ac166a33..5467a2cc958f 100644
--- a/pkgs/by-name/sy/sydbox/package.nix
+++ b/pkgs/by-name/sy/sydbox/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sydbox";
-  version = "3.37.8";
+  version = "3.37.9";
 
   outputs = [
     "out"
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Sydbox";
     repo = "sydbox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d3kGLVAGo6El0IQzdASR5kNmcLOPig1fHnrEtPFo6H4=";
+    hash = "sha256-SG19p7TuN7+TX5tafNBU6R48PzT44WqvGydmpfUo+FU=";
   };
 
-  cargoHash = "sha256-wpu8jeptwWHgqdWKHD5Nbs9WtZm7PjbO0lBk5fTbYuM=";
+  cargoHash = "sha256-rxlnlu8RziOhSNbCU8ESL0a+f+594E0q+3gmyQLhPaw=";
 
   nativeBuildInputs = [
     mandoc
diff --git a/pkgs/by-name/ta/tana/package.nix b/pkgs/by-name/ta/tana/package.nix
index 388581be277f..638eea46ec42 100644
--- a/pkgs/by-name/ta/tana/package.nix
+++ b/pkgs/by-name/ta/tana/package.nix
@@ -62,7 +62,7 @@ let
     stdenv.cc.cc
     stdenv.cc.libc
   ];
-  version = "1.0.39";
+  version = "1.0.41";
 in
 stdenv.mkDerivation {
   pname = "tana";
@@ -70,7 +70,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-iMuDIy1/ZIsFAhQwzEYQa6Slj207qA2CwSeMgJosIDs=";
+    hash = "sha256-x1L0Al/3RDVuAIqA/5ntnU0Iz77N3sPyD0dNHpi+S74=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index bf4264e540b4..c1fc05d023a9 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.3.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-wbkjLPaQFfAQmWtWVZ5U6PslaO7XvuuvU1yjlgaiKwQ=";
+    hash = "sha256-yjMhWP/AtjFKhbvSR4RzYD6vedc+OgqPU7bTWrNqtmo=";
   };
 
-  npmDepsHash = "sha256-OesAv8y2FWWJsNS4ms/B65cbJ7jEwnuQLVUb8zm1oSQ=";
+  npmDepsHash = "sha256-wnr1MO0DN+2rKjmM75V3m1oOVczfDslOtULn/tLbRzM=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/te/terminal-toys/package.nix b/pkgs/by-name/te/terminal-toys/package.nix
index 56594e17941d..a17067709fda 100644
--- a/pkgs/by-name/te/terminal-toys/package.nix
+++ b/pkgs/by-name/te/terminal-toys/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "terminal-toys";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "Seebass22";
     repo = "terminal-toys";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G4UfX1B4TM4w5KQreCXIZh91o0Tvezhz0ZxojyXRtX8=";
+    hash = "sha256-42NaTYEerkhexsmG6WEaC9uEC+YCJsShVlAsQFT4eJ0=";
   };
 
-  cargoHash = "sha256-hjWPWNwZxJkuoFuEUuf7SOSJ4CEtqwCOV5ZM7CGtvfY=";
+  cargoHash = "sha256-/L0JQDyjn5xuWIrx4EM2+uTbQt6uuOTHE27xfhmUjjY=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/ti/tiledb/package.nix b/pkgs/by-name/ti/tiledb/package.nix
index f17e00fba28c..84acdafc39b7 100644
--- a/pkgs/by-name/ti/tiledb/package.nix
+++ b/pkgs/by-name/ti/tiledb/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   zlib,
   lz4,
@@ -22,6 +23,8 @@
   libpng,
   file,
   runCommand,
+  curl,
+  capnproto,
   useAVX2 ? stdenv.hostPlatform.avx2Support,
 }:
 
@@ -45,7 +48,17 @@ stdenv.mkDerivation rec {
     hash = "sha256-Cs3Lr8I/Mu02x78d7IySG0XX4u/VAjBs4p4b00XDT5k=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./generate_embedded_data_header.patch ];
+  patches = [
+    # capnproto was updated to 1.2 in Nixpkgs, bring TileDB codebase up to speed
+    # patch only affects serialization related code, extracted from https://github.com/TileDB-Inc/TileDB/pull/5616
+    (fetchpatch {
+      url = "https://github.com/TileDB-Inc/TileDB/pull/5616.patch";
+      relative = "tiledb/sm/serialization";
+      extraPrefix = "tiledb/sm/serialization/";
+      hash = "sha256-5z/eJEHl+cnWRf1sMULodJyhmNh5KinDLlL1paMNiy4=";
+    })
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./generate_embedded_data_header.patch ];
 
   # libcxx (as of llvm-19) does not yet support `stop_token` and `jthread`
   # without the -fexperimental-library flag. Tiledb adds its own
@@ -62,6 +75,7 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DTILEDB_WEBP=OFF"
     "-DTILEDB_WERROR=OFF"
+    "-DTILEDB_SERIALIZATION=ON"
     # https://github.com/NixOS/nixpkgs/issues/144170
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
     "-DCMAKE_INSTALL_LIBDIR=lib"
@@ -74,6 +88,9 @@ stdenv.mkDerivation rec {
     cmake
     python3
     doxygen
+    # Required for serialization
+    curl
+    capnproto
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/by-name/tr/trilium-desktop/package.nix b/pkgs/by-name/tr/trilium-desktop/package.nix
index 76ae0feb72c6..8404a5c6ae70 100644
--- a/pkgs/by-name/tr/trilium-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-desktop/package.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-desktop";
-  version = "0.98.0";
+  version = "0.98.1";
 
   triliumSource = os: arch: hash: {
     url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip";
@@ -26,10 +26,10 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.hash = "sha256-GrREVY6P9L0ymH6QbXdtOm3mNzFD3u8HAOWDI7/x1VU=";
-  aarch64-linux.hash = "sha256-bLeU2REsKuVRei3WujGJEponiCZAviE8WyofWu2/NPg=";
-  x86_64-darwin.hash = "sha256-pN+6HapDxL/anMQJ2JeGmtBcRrlLMzJlEpSTo9QBbpg=";
-  aarch64-darwin.hash = "sha256-9y8NDrwiz9ql1Ia2F0UYF0XWBCyCahHZaAPOsvIJ5l0=";
+  x86_64-linux.hash = "sha256-e8duXDIODrU3eYuZvUcOoT8pAquRIOQ1aUtceY49s+s=";
+  aarch64-linux.hash = "sha256-HtNzzlnqApwt04R9W6cby8J/0xuYdUX2kMN4vBNKeiQ=";
+  x86_64-darwin.hash = "sha256-guM1FmDD+J0oBEH+hCzXBkrF0bzvyp5yvCeIO7mGcJg=";
+  aarch64-darwin.hash = "sha256-fHgPbJS4ZraqowkjPdDg0BbPiI+4dk9JpMSDKASl8wE=";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.hash;
diff --git a/pkgs/by-name/tr/trilium-server/package.nix b/pkgs/by-name/tr/trilium-server/package.nix
index 822b7acfabbc..60bf63bfa01b 100644
--- a/pkgs/by-name/tr/trilium-server/package.nix
+++ b/pkgs/by-name/tr/trilium-server/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.98.0";
+  version = "0.98.1";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.hash = "sha256-m5QDm8XOFi5Blbif044WMm/yyRrJx5t9/LjSto/gSL0=";
+  serverSource_x64.hash = "sha256-Ipl9mEDj6Wgzl31WonH4nouCoYs1lLgdxRAJr6I8l9c=";
   serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.hash = "sha256-1pdQEJIOxDU05z+31gNpsb9K4BpJ3njNsqxJymfD4wg=";
+  serverSource_arm64.hash = "sha256-XssGT2F1Idv7ICuTjJTAUYyors8ml50EXiOTHeA8KOw=";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then
diff --git a/pkgs/by-name/vi/video-trimmer/package.nix b/pkgs/by-name/vi/video-trimmer/package.nix
index 5f7ef32cac21..cf022cab10d7 100644
--- a/pkgs/by-name/vi/video-trimmer/package.nix
+++ b/pkgs/by-name/vi/video-trimmer/package.nix
@@ -35,6 +35,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-3ycc4jXneGsz9Jp9Arzf224JPAKM+PxUkitWcIXre8Y=";
   };
 
+  postPatch = ''
+    substituteInPlace build-aux/cargo.sh --replace-fail \
+      'cp "$CARGO_TARGET_DIR"/' \
+      'cp "$CARGO_TARGET_DIR"/${stdenv.hostPlatform.rust.cargoShortTarget}/'
+  '';
+
   nativeBuildInputs = [
     pkg-config
     meson
@@ -60,6 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
     gst_all_1.gst-plugins-bad
   ];
 
+  # For https://gitlab.gnome.org/YaLTeR/video-trimmer/-/blob/cf64e8dea345bcd991db29a3f862a9277c71fe81/build-aux/cargo.sh#L19
+  env.CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
+
   doCheck = true;
 
   strictDeps = true;
diff --git a/pkgs/by-name/wa/waymore/package.nix b/pkgs/by-name/wa/waymore/package.nix
index a0f6c6fdcea1..76bcbae211c1 100644
--- a/pkgs/by-name/wa/waymore/package.nix
+++ b/pkgs/by-name/wa/waymore/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "waymore";
-  version = "4.7";
+  version = "6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xnl-h4ck3r";
     repo = "waymore";
     tag = "v${version}";
-    hash = "sha256-oaswuXQPdAl2XExwEWnSN15roqNj9OVUr1Y1vsX461o=";
+    hash = "sha256-eoq1F6P3ZMb+O+SYmVhV3JHJMNbfcdyCnn4wy17RBv0=";
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/wi/wiki-js/package.nix b/pkgs/by-name/wi/wiki-js/package.nix
index 81b66b23839b..159ecabc0a2d 100644
--- a/pkgs/by-name/wi/wiki-js/package.nix
+++ b/pkgs/by-name/wi/wiki-js/package.nix
@@ -44,6 +44,6 @@ stdenv.mkDerivation rec {
     homepage = "https://js.wiki/";
     description = "Modern and powerful wiki app built on Node.js";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/by-name/xf/xfsprogs/package.nix b/pkgs/by-name/xf/xfsprogs/package.nix
index 2bd9a341ac3a..0529b8efbfbf 100644
--- a/pkgs/by-name/xf/xfsprogs/package.nix
+++ b/pkgs/by-name/xf/xfsprogs/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xfsprogs";
-  version = "6.15.0";
+  version = "6.16.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
-    hash = "sha256-E7kfdL7vitERN/fZ1xBVVz2R6WG8VbsCRZVvabhM1wQ=";
+    hash = "sha256-+nuow1y5iOfWW352MP6dDhfo15eZ07mNt+GfK5sVBQY=";
   };
 
   outputs = [
diff --git a/pkgs/development/beam-modules/build-mix.nix b/pkgs/development/beam-modules/build-mix.nix
index 7903647ef43d..b8b365cdf01d 100644
--- a/pkgs/development/beam-modules/build-mix.nix
+++ b/pkgs/development/beam-modules/build-mix.nix
@@ -25,6 +25,7 @@
   meta ? { },
   enableDebugInfo ? false,
   mixEnv ? "prod",
+  mixTarget ? "host",
   removeConfig ? true,
   # A config directory that is considered for all the dependencies of an app, typically in $src/config/
   # This was initially added, as some of Mobilizon's dependencies need to access the config at build time.
@@ -51,6 +52,8 @@ let
         inherit version src;
 
         MIX_ENV = mixEnv;
+        MIX_TARGET = mixTarget;
+        MIX_BUILD_PREFIX = (if mixTarget == "host" then "" else "${mixTarget}_") + "${mixEnv}";
         MIX_DEBUG = if enableDebugInfo then 1 else 0;
         HEX_OFFLINE = 1;
 
@@ -122,7 +125,7 @@ let
 
             # Some packages like db_connection will use _build/shared instead of
             # honoring the $MIX_ENV variable.
-            for reldir in _build/{$MIX_ENV,shared}/lib/${name}/{src,ebin,priv,include} ; do
+            for reldir in _build/{$MIX_BUILD_PREFIX,shared}/lib/${name}/{src,ebin,priv,include} ; do
               if test -d $reldir ; then
                 # Some builds produce symlinks (eg: phoenix priv dircetory). They must
                 # be followed with -H flag.
diff --git a/pkgs/development/beam-modules/fetch-mix-deps.nix b/pkgs/development/beam-modules/fetch-mix-deps.nix
index 867410e4f0a0..b7b3a40e25e1 100644
--- a/pkgs/development/beam-modules/fetch-mix-deps.nix
+++ b/pkgs/development/beam-modules/fetch-mix-deps.nix
@@ -16,6 +16,7 @@
   sha256 ? "",
   src,
   mixEnv ? "prod",
+  mixTarget ? "host",
   debug ? false,
   meta ? { },
   patches ? [ ],
@@ -53,6 +54,7 @@ stdenvNoCC.mkDerivation (
     ];
 
     MIX_ENV = mixEnv;
+    MIX_TARGET = mixTarget;
     MIX_DEBUG = if debug then 1 else 0;
     DEBUG = if debug then 1 else 0; # for rebar3
     # the api with `mix local.rebar rebar path` makes a copy of the binary
diff --git a/pkgs/development/beam-modules/mix-configure-hook.sh b/pkgs/development/beam-modules/mix-configure-hook.sh
index f8b4f3d159fe..8c0ee23d5a1c 100755
--- a/pkgs/development/beam-modules/mix-configure-hook.sh
+++ b/pkgs/development/beam-modules/mix-configure-hook.sh
@@ -2,13 +2,13 @@
 # this hook will symlink all dependencies found in ERL_LIBS
 # since Elixir 1.12.2 elixir does not look into ERL_LIBS for
 # elixir depencencies anymore, so those have to be symlinked to the _build directory
-mkdir -p _build/"$MIX_ENV"/lib
+mkdir -p _build/"$MIX_BUILD_PREFIX"/lib
 while read -r -d ':' lib; do
     for dir in "$lib"/*; do
     # Strip version number for directory name if it exists, so naming of
     # all libs matches what mix's expectation.
     dest=$(basename "$dir" | cut -d '-' -f1)
-    build_dir="_build/$MIX_ENV/lib/$dest"
+    build_dir="_build/$MIX_BUILD_PREFIX/lib/$dest"
     ((MIX_DEBUG == 1)) && echo "Linking $dir to $build_dir"
     # Symlink libs to _build so that mix can find them when compiling.
     # This is what allows mix to compile the package without searching
diff --git a/pkgs/development/beam-modules/mix-release.nix b/pkgs/development/beam-modules/mix-release.nix
index eedd0917617b..ffc5e6a58979 100644
--- a/pkgs/development/beam-modules/mix-release.nix
+++ b/pkgs/development/beam-modules/mix-release.nix
@@ -27,6 +27,7 @@
   meta ? { },
   enableDebugInfo ? false,
   mixEnv ? "prod",
+  mixTarget ? "host",
   compileFlags ? [ ],
   # Build a particular named release.
   # see https://hexdocs.pm/mix/1.12/Mix.Tasks.Release.html#content
@@ -123,6 +124,8 @@ stdenv.mkDerivation (
     buildInputs = buildInputs ++ lib.optionals (escriptBinName != null) [ erlang ];
 
     MIX_ENV = mixEnv;
+    MIX_TARGET = mixTarget;
+    MIX_BUILD_PREFIX = (if mixTarget == "host" then "" else "${mixTarget}_") + "${mixEnv}";
     MIX_DEBUG = if enableDebugInfo then 1 else 0;
     HEX_OFFLINE = 1;
 
diff --git a/pkgs/development/php-packages/gnupg/default.nix b/pkgs/development/php-packages/gnupg/default.nix
index ab3e4f28caf3..9cfa7e0eaafb 100644
--- a/pkgs/development/php-packages/gnupg/default.nix
+++ b/pkgs/development/php-packages/gnupg/default.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "1.5.3";
+  version = "1.5.4";
 in
 buildPecl {
   inherit version;
@@ -20,7 +20,7 @@ buildPecl {
     repo = "php-gnupg";
     rev = "gnupg-${version}";
     fetchSubmodules = true;
-    hash = "sha256-F9Rq+mmUhvXfIuoifqRM/ZIMYszCF93cvv13Vt/A5Mo=";
+    hash = "sha256-g9w0v9qc/Q5qjB9/ekZyheQ1ClIEqMEoBc32nGWhXYA=";
   };
 
   buildInputs = [ gpgme ];
@@ -43,6 +43,11 @@ buildPecl {
       --replace-fail 'string(12)' 'string(${toString (lib.stringLength "${gnupg}/bin/gpg")})'
   '';
 
+  patches = [
+    # https://github.com/php-gnupg/php-gnupg/issues/62
+    ./missing-new-line-test.patch
+  ];
+
   doCheck = true;
 
   meta = {
diff --git a/pkgs/development/php-packages/gnupg/missing-new-line-test.patch b/pkgs/development/php-packages/gnupg/missing-new-line-test.patch
new file mode 100644
index 000000000000..5a31f7c931d5
--- /dev/null
+++ b/pkgs/development/php-packages/gnupg/missing-new-line-test.patch
@@ -0,0 +1,28 @@
+diff --git a/tests/gnupg_oo_sign_clear.phpt b/tests/gnupg_oo_sign_clear.phpt
+index 4f9b79c..05fda25 100644
+--- a/tests/gnupg_oo_sign_clear.phpt
++++ b/tests/gnupg_oo_sign_clear.phpt
+@@ -38,8 +38,7 @@ array(1) {
+     int(0)
+   }
+ }
+-string(8) "foo bar
+-"
++string(7) "foo bar"
+ --CLEAN--
+ <?php
+ require_once "gnupgt.inc";
+diff --git a/tests/gnupg_res_sign_clear.phpt b/tests/gnupg_res_sign_clear.phpt
+index 71dd6c2..74fd26d 100644
+--- a/tests/gnupg_res_sign_clear.phpt
++++ b/tests/gnupg_res_sign_clear.phpt
+@@ -36,8 +36,7 @@ array(1) {
+     int(0)
+   }
+ }
+-string(8) "foo bar
+-"
++string(7) "foo bar"
+ --CLEAN--
+ <?php
+ require_once "gnupgt.inc";
\ No newline at end of file
diff --git a/pkgs/development/python-modules/beetcamp/default.nix b/pkgs/development/python-modules/beetcamp/default.nix
index 4d267ef0fd40..775c96ddf7ba 100644
--- a/pkgs/development/python-modules/beetcamp/default.nix
+++ b/pkgs/development/python-modules/beetcamp/default.nix
@@ -53,6 +53,11 @@ buildPythonPackage {
     filelock
   ];
 
+  disabledTests = [
+    # AssertionError: assert ''
+    "test_get_html"
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/development/python-modules/clearpasspy/default.nix b/pkgs/development/python-modules/clearpasspy/default.nix
new file mode 100644
index 000000000000..54bbbc571d42
--- /dev/null
+++ b/pkgs/development/python-modules/clearpasspy/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "clearpasspy";
+  version = "1.1.3";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-HAi9z7DT5g0Pkr+rASUK18/tEsorWXScCODE95Q+ZZ0=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  pythonRelaxDeps = [ "requests" ];
+
+  dependencies = [ requests ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "clearpasspy" ];
+
+  meta = {
+    description = "ClearPass API Python Library";
+    homepage = "https://github.com/zemerick1/clearpasspy";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/clx-sdk-xms/default.nix b/pkgs/development/python-modules/clx-sdk-xms/default.nix
new file mode 100644
index 000000000000..dd5a56dfbca0
--- /dev/null
+++ b/pkgs/development/python-modules/clx-sdk-xms/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  iso8601,
+  requests,
+  setuptools,
+  unstableGitUpdater,
+}:
+
+buildPythonPackage {
+  pname = "clx-sdk-xms";
+  version = "0-unstable-2017-01-23";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "clxcommunications";
+    repo = "sdk-xms-python";
+    rev = "8d629cd7bcaf91eaafee265a825e3c52191f1425";
+    hash = "sha256-qMR9OT+QAKZGwDuoZVAtfKD3PQB7rEU/iTRjgACVGBs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    iso8601
+    requests
+  ];
+
+  pythonImportsCheck = [ "clx.xms" ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Python SDK for the CLX Communications REST API (XMS) for sending and receiving SMS";
+    homepage = "https://github.com/clxcommunications/sdk-xms-python";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/dnachisel/default.nix b/pkgs/development/python-modules/dnachisel/default.nix
index ad0ec55aec7c..b066b937d3c2 100644
--- a/pkgs/development/python-modules/dnachisel/default.nix
+++ b/pkgs/development/python-modules/dnachisel/default.nix
@@ -1,26 +1,24 @@
 {
   lib,
-  buildPythonPackage,
-  fetchFromGitHub,
   biopython,
+  buildPythonPackage,
   docopt,
+  fetchFromGitHub,
   flametree,
-  numpy,
-  proglog,
-  pytestCheckHook,
-  pythonOlder,
-  python-codon-tables,
-  primer3,
   genome-collector,
   matplotlib,
+  numpy,
+  primer3,
+  proglog,
+  pytestCheckHook,
+  python-codon-tables,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "dnachisel";
   version = "3.2.16";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Edinburgh-Genome-Foundry";
@@ -29,7 +27,9 @@ buildPythonPackage rec {
     hash = "sha256-F+G7dwehUCHYKSGsLQR4OZg2NQ4677XMlN6jOcmz8No=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     biopython
     docopt
     flametree
diff --git a/pkgs/development/python-modules/flametree/default.nix b/pkgs/development/python-modules/flametree/default.nix
index 8070c91bc66e..292659ba3f15 100644
--- a/pkgs/development/python-modules/flametree/default.nix
+++ b/pkgs/development/python-modules/flametree/default.nix
@@ -6,13 +6,14 @@
   matplotlib,
   pandas,
   pytestCheckHook,
+  setuptools,
   weasyprint,
 }:
 
 buildPythonPackage rec {
   pname = "flametree";
   version = "0.2.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Edinburgh-Genome-Foundry";
@@ -21,6 +22,8 @@ buildPythonPackage rec {
     hash = "sha256-5vtDfGmSX5niMXLnMqmafhq6D1gxhxVS3xbOAvQs3Po=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [
     matplotlib
     pandas
@@ -42,6 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python file and zip operations made easy";
     homepage = "https://github.com/Edinburgh-Genome-Foundry/Flametree";
+    changelog = "https://github.com/Edinburgh-Genome-Foundry/Flametree/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ prusnak ];
   };
diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 5c4c653ed981..905dc5d47a04 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -15,30 +15,21 @@
   ninja,
   numpy,
   torch,
+  pynvml,
+  einops,
 }:
 
-let
+buildPythonPackage rec {
   pname = "flashinfer";
-  version = "0.2.9";
-
-  src_cutlass = fetchFromGitHub {
-    owner = "NVIDIA";
-    repo = "cutlass";
-    # Using the revision obtained in submodule inside flashinfer's `3rdparty`.
-    tag = "v${version}";
-    hash = "sha256-d4czDoEv0Focf1bJHOVGX4BDS/h5O7RPoM/RrujhgFQ=";
-  };
-
-in
-buildPythonPackage {
-  format = "setuptools";
-  inherit pname version;
+  version = "0.2.14";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "flashinfer-ai";
     repo = "flashinfer";
     tag = "v${version}";
-    hash = "sha256-M0q6d+EpuTehbw68AQ73Fhwmw2tzjymYjSXaol9QC7Y=";
+    hash = "sha256-MZiZwdedz+Vxa1+VBfHDKf4NVSiOAytGboIJ0DvCXmk=";
+    fetchSubmodules = true;
   };
 
   build-system = [ setuptools ];
@@ -48,20 +39,16 @@ buildPythonPackage {
     ninja
     (lib.getBin cudaPackages.cuda_nvcc)
   ];
+
   dontUseCmakeConfigure = true;
 
-  buildInputs = [
-    cudaPackages.cuda_cudart
-    cudaPackages.libcublas
-    cudaPackages.cuda_cccl
-    cudaPackages.libcurand
+  buildInputs = with cudaPackages; [
+    cuda_cccl
+    cuda_cudart
+    libcublas
+    libcurand
   ];
 
-  postPatch = ''
-    rmdir 3rdparty/cutlass
-    ln -s ${src_cutlass} 3rdparty/cutlass
-  '';
-
   # FlashInfer offers two installation modes:
   #
   # JIT mode: CUDA kernels are compiled at runtime using PyTorch’s JIT, with
@@ -86,6 +73,8 @@ buildPythonPackage {
   dependencies = [
     numpy
     torch
+    pynvml
+    einops
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/flask-webtest/default.nix b/pkgs/development/python-modules/flask-webtest/default.nix
index 416a7684c064..9f145f10f12b 100644
--- a/pkgs/development/python-modules/flask-webtest/default.nix
+++ b/pkgs/development/python-modules/flask-webtest/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "flask-webtest";
-  version = "0.1.4";
+  version = "0.1.6";
   pyproject = true;
 
   # Pypi tarball doesn't include version.py
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "level12";
     repo = "flask-webtest";
     tag = version;
-    hash = "sha256-4USNT6HYh49v+euCePYkL1gR6Ul8C0+/xanuYGxKpfM=";
+    hash = "sha256-wcEc9j62bQXAmXczsunITQP3sU040d6Ws8cz0w7+5r4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/gitterpy/default.nix b/pkgs/development/python-modules/gitterpy/default.nix
new file mode 100644
index 000000000000..ee35d962d1d8
--- /dev/null
+++ b/pkgs/development/python-modules/gitterpy/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "gitterpy";
+  version = "0.1.7";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-nmZ6sVjrHRLfvXMr/fYiN+a4Wly87YKwAR+heP/sNkE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "gitterpy" ];
+
+  meta = {
+    description = "Python interface for the Gitter API";
+    homepage = "https://github.com/MichaelYusko/GitterPy";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/google-cloud-kms/default.nix b/pkgs/development/python-modules/google-cloud-kms/default.nix
index b671e36c0c90..508a28a22356 100644
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@@ -59,6 +59,9 @@ buildPythonPackage rec {
     rev-prefix = "google-cloud-kms-v";
   };
 
+  # picks the wrong tag
+  passthru.skipBulkUpdate = true;
+
   meta = {
     description = "Cloud Key Management Service (KMS) API API client library";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-kms";
diff --git a/pkgs/development/python-modules/greenwavereality/default.nix b/pkgs/development/python-modules/greenwavereality/default.nix
new file mode 100644
index 000000000000..b49b9cd01a94
--- /dev/null
+++ b/pkgs/development/python-modules/greenwavereality/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  requests,
+  xmltodict,
+  urllib3,
+}:
+
+buildPythonPackage rec {
+  pname = "greenwavereality";
+  version = "0.5.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-bNTO9qHoOe3A7TYiUwLBVq4eWyGoIfCoguizM1hKk/Y=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    requests
+    xmltodict
+    urllib3
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "greenwavereality" ];
+
+  meta = {
+    description = "Control of Greenwave Reality Lights";
+    homepage = "https://github.com/dfiel/greenwavereality";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/horimote/default.nix b/pkgs/development/python-modules/horimote/default.nix
new file mode 100644
index 000000000000..17926647ab23
--- /dev/null
+++ b/pkgs/development/python-modules/horimote/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "horimote";
+  version = "0.4.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "benleb";
+    repo = "horimote";
+    tag = "v${version}";
+    hash = "sha256-rEtE0Z/PV/n9pz2mLbHeREv/sl4SexTSOq2yx4LDnAo=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "horimote" ];
+
+  meta = {
+    description = "Async API wrapper for Samsung's set-top boxes SMT-G7400 and SMT-G7401";
+    homepage = "https://github.com/benleb/horimote";
+    changelog = "https://github.com/benleb/horimote/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/ibmiotf/default.nix b/pkgs/development/python-modules/ibmiotf/default.nix
new file mode 100644
index 000000000000..5f68b854723e
--- /dev/null
+++ b/pkgs/development/python-modules/ibmiotf/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  iso8601,
+  pytz,
+  paho-mqtt,
+  requests,
+  requests-toolbelt,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "ibmiotf";
+  version = "0.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ibm-watson-iot";
+    repo = "iot-python";
+    tag = version;
+    hash = "sha256-/hRRYf3mY7LqZq0jq7neJRwpvgKczHNNo5bN92Rcv5M=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    iso8601
+    pytz
+    paho-mqtt
+    requests
+    requests-toolbelt
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  # Tests require network access and IBM Watson IoT Platform credentials
+  doCheck = false;
+
+  pythonImportsCheck = [ "ibmiotf" ];
+
+  meta = {
+    description = "Python Client for IBM Watson IoT Platform";
+    homepage = "https://github.com/ibm-watson-iot/iot-python";
+    changelog = "https://github.com/ibm-watson-iot/iot-python/releases/tag/${version}";
+    license = lib.licenses.epl10;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index fc46c24eb25b..04101b3c90af 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "intake";
-  version = "2.0.7";
+  version = "2.0.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "intake";
     repo = "intake";
     tag = version;
-    hash = "sha256-F13jbAQP3G3cKeAegM1w/t32xyC0BgL9/67aIlzA4SE=";
+    hash = "sha256-Mjf4CKLFrIti9pFP6HTt1D/iYw0WMowLIfMdfM7Db+E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ionoscloud/default.nix b/pkgs/development/python-modules/ionoscloud/default.nix
index d0ee3b283306..e369d55f7509 100644
--- a/pkgs/development/python-modules/ionoscloud/default.nix
+++ b/pkgs/development/python-modules/ionoscloud/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "ionoscloud";
-  version = "6.1.12";
+  version = "6.1.13";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sc1qJjfLiI+KjLe3b+JE66giV1pIakYT7FsSjQjWA30=";
+    hash = "sha256-8QgweGXPWcvGQcp22yo4KovkVXrDI2eSWNMUnGhDWEI=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/kserve/default.nix b/pkgs/development/python-modules/kserve/default.nix
index 56c1382c95bd..10d86bf89974 100644
--- a/pkgs/development/python-modules/kserve/default.nix
+++ b/pkgs/development/python-modules/kserve/default.nix
@@ -158,6 +158,14 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
+    # AssertionError: assert CompletionReq...lm_xargs=None) == CompletionReq...lm_xargs=None)
+    "test_convert_params"
+
+    # Flaky: ray.exceptions.ActorDiedError: The actor died unexpectedly before finishing this task.
+    "test_explain"
+    "test_infer"
+    "test_predict"
+
     # Require network access
     "test_infer_graph_endpoint"
     "test_infer_path_based_routing"
diff --git a/pkgs/development/python-modules/luna-usb/default.nix b/pkgs/development/python-modules/luna-usb/default.nix
index 1ea097280ed0..460fa5115669 100644
--- a/pkgs/development/python-modules/luna-usb/default.nix
+++ b/pkgs/development/python-modules/luna-usb/default.nix
@@ -20,14 +20,14 @@
 }:
 buildPythonPackage rec {
   pname = "luna-usb";
-  version = "0.2.2";
+  version = "0.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greatscottgadgets";
     repo = "luna";
     tag = version;
-    hash = "sha256-gySaNbebWUS8wS8adPQo1mT+jmdb+2ddlMckTa36JCY=";
+    hash = "sha256-kH5PlgJRMymBZZ3oANR8xlAUPUgGZjqw9s9DcpQ809A=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lw12/default.nix b/pkgs/development/python-modules/lw12/default.nix
new file mode 100644
index 000000000000..a679fb1b1bde
--- /dev/null
+++ b/pkgs/development/python-modules/lw12/default.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "lw12";
+  version = "0.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jaypikay";
+    repo = "python-lw12";
+    tag = "v${version}";
+    hash = "sha256-6zZolUfs1SzCH0DT2YYuP4eXt8Hxv+TYIDgLnR51MAQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  # Tests require hardware access
+  doCheck = false;
+
+  meta = {
+    description = "Library to control the Lagute LW-12 WiFi LED controller";
+    homepage = "https://github.com/jaypikay/python-lw12";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/microbeespy/default.nix b/pkgs/development/python-modules/microbeespy/default.nix
new file mode 100644
index 000000000000..5bf477d7ab24
--- /dev/null
+++ b/pkgs/development/python-modules/microbeespy/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  aiohttp,
+  paho-mqtt,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "microbeespy";
+  version = "0.3.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "microBeesTech";
+    repo = "pythonSDK";
+    tag = version;
+    hash = "sha256-h3IbWdZ/iHsNlAr/DfASj4dKNkQ4t1mUUeUIs00L8iU=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    paho-mqtt
+  ];
+
+  # Package doesn't include tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "microBeesPy" ];
+
+  meta = {
+    description = "Official microBees Python Library";
+    homepage = "https://github.com/microBeesTech/pythonSDK";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/mistral-common/default.nix b/pkgs/development/python-modules/mistral-common/default.nix
index e245f5b7e524..305581a4ef91 100644
--- a/pkgs/development/python-modules/mistral-common/default.nix
+++ b/pkgs/development/python-modules/mistral-common/default.nix
@@ -1,57 +1,96 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  poetry-core,
-  numpy,
-  pydantic,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   jsonschema,
+  numpy,
   opencv-python-headless,
-  sentencepiece,
-  typing-extensions,
-  tiktoken,
   pillow,
+  pydantic,
+  pydantic-extra-types,
   requests,
+  sentencepiece,
+  tiktoken,
+  typing-extensions,
+
+  # tests
+  click,
+  fastapi,
+  huggingface-hub,
+  openai,
+  pycountry,
+  pydantic-settings,
+  pytestCheckHook,
+  soundfile,
+  soxr,
+  uvicorn,
 }:
 
 buildPythonPackage rec {
   pname = "mistral-common";
-  version = "1.8.3";
+  version = "1.8.4";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "mistral_common";
-    inherit version;
-    hash = "sha256-DRl52CIntiX21xs8goF28FnajQ9aMwfN9TtIQJo5cKQ=";
+  src = fetchFromGitHub {
+    owner = "mistralai";
+    repo = "mistral-common";
+    tag = "v${version}";
+    hash = "sha256-HB6dsqiDSLhjyANk7ZT/cU98mjJamegAF0uKH8GfgM8=";
   };
 
-  pythonRelaxDeps = [
-    "pillow"
-    "tiktoken"
-  ];
-
-  build-system = [ poetry-core ];
+  build-system = [ setuptools ];
 
   dependencies = [
-    numpy
-    pydantic
     jsonschema
+    numpy
     opencv-python-headless
-    sentencepiece
-    typing-extensions
-    tiktoken
     pillow
+    pydantic
+    pydantic-extra-types
     requests
+    sentencepiece
+    tiktoken
+    typing-extensions
   ];
 
-  doCheck = true;
-
   pythonImportsCheck = [ "mistral_common" ];
 
-  meta = with lib; {
+  nativeCheckInputs = [
+    click
+    fastapi
+    huggingface-hub
+    openai
+    pycountry
+    pydantic-settings
+    pytestCheckHook
+    soundfile
+    soxr
+    uvicorn
+  ];
+
+  disabledTests = [
+    # Require internet
+    "test_download_gated_image"
+    "test_image_encoder_formats"
+    "test_image_processing"
+
+    # AssertionError: Regex pattern did not match.
+    "test_from_url"
+
+    # AssertionError, Extra items in the right set
+    "test_openai_chat_fields"
+  ];
+
+  meta = {
     description = "Tools to help you work with Mistral models";
     homepage = "https://github.com/mistralai/mistral-common";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ bgamari ];
+    changelog = "https://github.com/mistralai/mistral-common/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bgamari ];
   };
 }
diff --git a/pkgs/development/python-modules/numato-gpio/default.nix b/pkgs/development/python-modules/numato-gpio/default.nix
new file mode 100644
index 000000000000..126e3993635d
--- /dev/null
+++ b/pkgs/development/python-modules/numato-gpio/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  pyserial,
+  rich,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "numato-gpio";
+  version = "0.14.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "clssn";
+    repo = "numato-gpio";
+    tag = "v${version}";
+    hash = "sha256-9kbPEtJOQhCxYh8cjyCAufV63mV7ZF1x7CdUyJLfqII=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    pyserial
+    rich
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Exclude system tests that require hardware
+    "sys_tests"
+  ];
+
+  pythonImportsCheck = [
+    "numato_gpio"
+  ];
+
+  meta = {
+    description = "Python API for Numato GPIO Expanders";
+    homepage = "https://github.com/clssn/numato-gpio";
+    changelog = "https://github.com/clssn/numato-gpio/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index 12aed15167c0..f4ca5a1aac98 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "oelint-data";
-  version = "1.0.25";
+  version = "1.0.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = version;
-    hash = "sha256-obX8grYYSa9H/UoSBQon44Of4Eh4BtqJrfwZbaqh6IU=";
+    hash = "sha256-lPlWBYKGJHy0VTSf4YSMqKqpxhMsSyQG4TP8Jg/cqlI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/openai-harmony/default.nix b/pkgs/development/python-modules/openai-harmony/default.nix
new file mode 100644
index 000000000000..74251b28ad4e
--- /dev/null
+++ b/pkgs/development/python-modules/openai-harmony/default.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  rustPlatform,
+
+  # dependencies
+  pydantic,
+
+  # optional-dependencies
+  fastapi,
+  uvicorn,
+}:
+
+buildPythonPackage rec {
+  pname = "openai-harmony";
+  version = "0.0.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "openai";
+    repo = "harmony";
+    rev = "v${version}";
+    hash = "sha256-2LOrMLrNR1D3isbjiv5w+1Ni9IMwMEPPTOnG1rm//ag=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-tQq6PFMYghIfJu8CddbXFKXxr41GJaElbCCQuSpnaqk=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  dependencies = [
+    pydantic
+  ];
+
+  optional-dependencies = {
+    demo = [
+      fastapi
+      uvicorn
+    ];
+  };
+
+  pythonImportsCheck = [ "openai_harmony" ];
+
+  # Tests require internet access
+  doCheck = false;
+
+  meta = {
+    description = "Renderer for the harmony response format to be used with gpt-oss";
+    homepage = "https://github.com/openai/harmony";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/optuna/default.nix b/pkgs/development/python-modules/optuna/default.nix
index 7bc6f58ee068..a7407fdec887 100644
--- a/pkgs/development/python-modules/optuna/default.nix
+++ b/pkgs/development/python-modules/optuna/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage rec {
   pname = "optuna";
-  version = "4.4.0";
+  version = "4.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "optuna";
     repo = "optuna";
     tag = "v${version}";
-    hash = "sha256-S9F9xni1cnmIbWu5n7BFvUCvQmBP3iBYS1ntg6vQ8ZQ=";
+    hash = "sha256-qaCOpqKRepm/a1Nh98PV6RcRkadLK5E429pn1zaWQDA=";
   };
 
   build-system = [
@@ -138,6 +138,8 @@ buildPythonPackage rec {
     "test_visualizations_with_single_objectives"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "optuna" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pinboard/default.nix b/pkgs/development/python-modules/pinboard/default.nix
index d9ee6abaa67d..848a926488ad 100644
--- a/pkgs/development/python-modules/pinboard/default.nix
+++ b/pkgs/development/python-modules/pinboard/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "pinboard";
-  version = "2.1.8";
+  version = "2.1.9";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "lionheart";
     repo = "pinboard";
     rev = version;
-    sha256 = "0ppc3vwv48ahqx6n5c7d7066zhi31cjdik0ma9chq6fscq2idgdf";
+    sha256 = "sha256-+JWr2QmdqASK/X10U0ZOZ95K2ctWceSW167raxZjIW4=";
   };
 
   # tests require an API key
diff --git a/pkgs/development/python-modules/pizzapi/default.nix b/pkgs/development/python-modules/pizzapi/default.nix
new file mode 100644
index 000000000000..c048eb58a481
--- /dev/null
+++ b/pkgs/development/python-modules/pizzapi/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  requests,
+  xmltodict,
+  pyhamcrest,
+  mock,
+  pytestCheckHook,
+}:
+
+buildPythonPackage {
+  pname = "pizzapi";
+  version = "0.0.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ggrammar";
+    repo = "pizzapi";
+    rev = "2a67ceb0f6df285988f1a2d7b678bbd2526c26a4";
+    hash = "sha256-oBwNNsnRhm/kv8DxNrAKkeGv2RZA+RMdYRgByy3qmsU=";
+  };
+
+  postPatch = ''
+    # Remove pytest-runner from setup_requires
+    substituteInPlace setup.py \
+      --replace-fail 'setup_requires=["pytest-runner"],' 'setup_requires=[],'
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    requests
+    xmltodict
+    pyhamcrest
+  ];
+
+  nativeCheckInputs = [
+    mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "pizzapi" ];
+
+  meta = {
+    description = "Python wrapper for the Dominos Pizza API";
+    homepage = "https://github.com/ggrammar/pizzapi";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/plumlightpad/default.nix b/pkgs/development/python-modules/plumlightpad/default.nix
new file mode 100644
index 000000000000..b6d40f5f007b
--- /dev/null
+++ b/pkgs/development/python-modules/plumlightpad/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  requests,
+  standard-telnetlib,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "plumlightpad";
+  version = "0.0.11";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-5J+kk/fn45v/1WIsBuq6o7hivXkCaJ1Of7BLRf10rCk=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    requests
+    standard-telnetlib
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "plumlightpad" ];
+
+  meta = {
+    description = "A python package that interacts with the Plum Lightpad";
+    homepage = "https://github.com/heathbar/plum-lightpad-python";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/primer3/default.nix b/pkgs/development/python-modules/primer3/default.nix
index 2c93e066ad14..7e15a122711a 100644
--- a/pkgs/development/python-modules/primer3/default.nix
+++ b/pkgs/development/python-modules/primer3/default.nix
@@ -2,10 +2,11 @@
   lib,
   stdenv,
   buildPythonPackage,
-  fetchFromGitHub,
-  cython,
-  gcc,
   click,
+  cython,
+  distutils,
+  fetchFromGitHub,
+  gcc,
   pytestCheckHook,
   pythonOlder,
   setuptools,
@@ -25,7 +26,10 @@ buildPythonPackage rec {
     hash = "sha256-GrVYYjS/+LZScZETfk7YcSy2yrWc3SPumXvyQeEpFUg=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    distutils
+    setuptools
+  ];
 
   nativeBuildInputs = [ cython ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ gcc ];
 
diff --git a/pkgs/development/python-modules/progettihwsw/default.nix b/pkgs/development/python-modules/progettihwsw/default.nix
new file mode 100644
index 000000000000..965d02274742
--- /dev/null
+++ b/pkgs/development/python-modules/progettihwsw/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  lxml,
+}:
+
+buildPythonPackage rec {
+  pname = "progettihwsw";
+  version = "0.1.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ardaseremet";
+    repo = "progettihwsw";
+    tag = version;
+    hash = "sha256-9dpZyQ7i3WNdDVyEBLz4bJcWF1Ap7SH089PXWYI6UOA=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    lxml
+  ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "ProgettiHWSW" ];
+
+  meta = {
+    description = "Controls ProgettiHWSW relay boards";
+    homepage = "https://github.com/ardaseremet/progettihwsw";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/py-air-control/default.nix b/pkgs/development/python-modules/py-air-control/default.nix
index 2cb2e82edf54..ce88995cd598 100644
--- a/pkgs/development/python-modules/py-air-control/default.nix
+++ b/pkgs/development/python-modules/py-air-control/default.nix
@@ -1,37 +1,39 @@
 {
+  lib,
   buildPythonPackage,
   coapthon3,
   fetchFromGitHub,
-  isPy27,
-  lib,
   pycryptodomex,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "py-air-control";
-  version = "2.1.0";
-  format = "setuptools";
-  disabled = isPy27;
+  version = "2.3.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rgerganov";
     repo = "py-air-control";
-    rev = "v${version}";
-    sha256 = "0mkggl5hwmj90djxbbz4svim6iv7xl8k324cb4rlc75p5rgcdwmh";
+    tag = "v${version}";
+    hash = "sha256-3Qk1cmF31vJhUEckjfbYM9IDgD+gVkZtQlXel8iP/b8=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     pycryptodomex
     coapthon3
   ];
 
   # tests sometimes hang forever on tear-down
   doCheck = false;
+
   pythonImportsCheck = [ "pyairctrl" ];
 
   meta = with lib; {
-    inherit (src.meta) homepage;
     description = "Command Line App for Controlling Philips Air Purifiers";
+    homepage = "https://github.com/rgerganov/py-air-control";
     license = licenses.mit;
     maintainers = with maintainers; [ urbas ];
   };
diff --git a/pkgs/development/python-modules/pycmus/default.nix b/pkgs/development/python-modules/pycmus/default.nix
new file mode 100644
index 000000000000..66fbba7eafa3
--- /dev/null
+++ b/pkgs/development/python-modules/pycmus/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pbr,
+  setuptools,
+  six,
+}:
+
+buildPythonPackage rec {
+  pname = "pycmus";
+  version = "0.1.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Wk9J/XjKZB13o8QmdByVWHcAdfNOicwLaH2Sh4qJcIw=";
+  };
+
+  build-system = [
+    pbr
+    setuptools
+  ];
+
+  dependencies = [
+    six
+  ];
+
+  # No tests available
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pycmus"
+  ];
+
+  meta = {
+    description = "Python library for sending commands to the cmus music player";
+    homepage = "https://github.com/mtreinish/pycmus";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/pycontrol4/default.nix b/pkgs/development/python-modules/pycontrol4/default.nix
index 6b85f6ba3f18..719836899b9c 100644
--- a/pkgs/development/python-modules/pycontrol4/default.nix
+++ b/pkgs/development/python-modules/pycontrol4/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pycontrol4";
-  version = "1.2.1";
+  version = "1.5.0";
 
   disabled = pythonOlder "3.6";
 
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "lawtancool";
     repo = "pyControl4";
     tag = "v${version}";
-    hash = "sha256-0ZuztqHbrd+kMDGv3xyUYoTF/Ho+oHkycjSrKz8JABM=";
+    hash = "sha256-r90v9vy8avvEbNKrzZgYtDS5Z5hV66Fd9fF9XJ4r7B4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pydash/default.nix b/pkgs/development/python-modules/pydash/default.nix
index 27f1675ccdf3..57600d4fa5b7 100644
--- a/pkgs/development/python-modules/pydash/default.nix
+++ b/pkgs/development/python-modules/pydash/default.nix
@@ -50,6 +50,6 @@ buildPythonPackage rec {
     homepage = "https://pydash.readthedocs.io";
     changelog = "https://github.com/dgilland/pydash/blob/v${version}/CHANGELOG.rst";
     license = licenses.mit;
-    maintainers = with maintainers; [ ma27 ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyebox/default.nix b/pkgs/development/python-modules/pyebox/default.nix
new file mode 100644
index 000000000000..c55e49ff53fe
--- /dev/null
+++ b/pkgs/development/python-modules/pyebox/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  async-timeout,
+  beautifulsoup4,
+}:
+
+buildPythonPackage rec {
+  pname = "pyebox";
+  version = "1.1.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "titilambert";
+    repo = "pyebox";
+    tag = version;
+    hash = "sha256-87u16rJmwdGiUz3DxThCsNXnz0tpH/9i26eyYwSqpDg=";
+  };
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace-fail "bs4" "beautifulsoup4"
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    async-timeout
+    beautifulsoup4
+  ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pyebox" ];
+
+  meta = {
+    description = "Get your EBox consumption (www.ebox.ca)";
+    homepage = "https://github.com/titilambert/pyebox";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/pygelf/default.nix b/pkgs/development/python-modules/pygelf/default.nix
index 6b31df89924c..c4a2ef485ceb 100644
--- a/pkgs/development/python-modules/pygelf/default.nix
+++ b/pkgs/development/python-modules/pygelf/default.nix
@@ -28,17 +28,16 @@ buildPythonPackage rec {
     requests
   ];
 
-  disabledTests = [
-    # ConnectionRefusedError: [Errno 111] Connection refused
-    "test_static_fields"
-    "test_dynamic_fields"
-  ];
-
   disabledTestPaths = [
-    # These tests requires files that are stripped off by Pypi packaging
-    "tests/test_queuehandler_support.py"
-    "tests/test_debug_mode.py"
+    # The fixtures in these files fail to evaluate due to missing files `tests/config/cert.pem` and
+    # `tests/config/key.pem`. It suffices to replace them with any self-signed certificate e.g. from
+    # `nixos/tests/common/acme/server/snakeoil-certs.nix`, but after resolving that, all of the
+    # tests fail anyway with “ConnectionRefusedError: [Errno 111] Connection refused”.
     "tests/test_common_fields.py"
+    "tests/test_debug_mode.py"
+    "tests/test_dynamic_fields.py"
+    "tests/test_queuehandler_support.py"
+    "tests/test_static_fields.py"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
index bf459b29718f..d2663cb70d56 100644
--- a/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
+++ b/pkgs/development/python-modules/pyhanko-certvalidator/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pyhanko-certvalidator";
-  version = "0.26.5";
+  version = "0.26.8";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "MatthiasValvekens";
     repo = "certvalidator";
     tag = "v${version}";
-    hash = "sha256-+/3n+v/8Tpqt7UoOrBi4S84N6Jioay7e2j+SvKJeoLA=";
+    hash = "sha256-Gvahyuz3n/CNAEzMXS5Z0Z85yDqLUQu8Yis5oJ2jaKc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyirishrail/default.nix b/pkgs/development/python-modules/pyirishrail/default.nix
new file mode 100644
index 000000000000..493311511528
--- /dev/null
+++ b/pkgs/development/python-modules/pyirishrail/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pyirishrail";
+  version = "0.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ttroy50";
+    repo = "pyirishrail";
+    tag = version;
+    hash = "sha256-NgARqhcXP0lgGpgBRiNtQaSn9JcRNtCcZPljcL7t3Xc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pyirishrail" ];
+
+  meta = {
+    description = "Python library to get the real-time transport information (RTPI) from Irish Rail";
+    homepage = "https://github.com/ttroy50/pyirishrail";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyiskra/default.nix b/pkgs/development/python-modules/pyiskra/default.nix
index 22da96bb17b0..9b2b998846e8 100644
--- a/pkgs/development/python-modules/pyiskra/default.nix
+++ b/pkgs/development/python-modules/pyiskra/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyiskra";
-  version = "0.1.21";
+  version = "0.1.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Iskramis";
     repo = "pyiskra";
     tag = "v${version}";
-    hash = "sha256-ZFva7pyilMjvgRfsDhnsLGKRjl9Jf4vdFfK4RFb3sSE=";
+    hash = "sha256-feD4oqH7W0gJwPqdgAJEzmnadgXHkzFDc/NXY54aMXI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pykalman/default.nix b/pkgs/development/python-modules/pykalman/default.nix
index f4662d07d2b0..4d8b902b46b7 100644
--- a/pkgs/development/python-modules/pykalman/default.nix
+++ b/pkgs/development/python-modules/pykalman/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pykalman";
-  version = "0.10.1";
+  version = "0.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pykalman";
     repo = "pykalman";
     tag = "v${version}";
-    hash = "sha256-9HaDNYVPdRvQH3r5j7r0uHqyuR6HqV7QaNuxKEYDcy8=";
+    hash = "sha256-SMK0b2twlHk4sbNfwWafqDYXlhrZhgpaC1nhv2XQaqo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyopengl-accelerate/default.nix b/pkgs/development/python-modules/pyopengl-accelerate/default.nix
index c56ab161a921..551b059d8f34 100644
--- a/pkgs/development/python-modules/pyopengl-accelerate/default.nix
+++ b/pkgs/development/python-modules/pyopengl-accelerate/default.nix
@@ -10,14 +10,15 @@
 
 buildPythonPackage rec {
   pname = "pyopengl-accelerate";
-  version = "3.1.9";
+  version = "3.1.10";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "pyopengl_accelerate";
     inherit version;
-    hash = "sha256-hZV8fHaXWBj/dZ7JJD+dxwke9vNz6jei61DDIP2ahvM=";
+    hash = "sha256-gnUcg/Cm9zK4tZI5kO3CRB04F2qYdWsXGOjWxDefWnE=";
   };
+
   build-system = [
     cython
     numpy
@@ -25,11 +26,6 @@ buildPythonPackage rec {
     wheel
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=int-conversion"
-    "-Wno-error=incompatible-pointer-types"
-  ];
-
   meta = {
     description = "This set of C (Cython) extensions provides acceleration of common operations for slow points in PyOpenGL 3.x";
     homepage = "https://pyopengl.sourceforge.net/";
diff --git a/pkgs/development/python-modules/pythinkingcleaner/default.nix b/pkgs/development/python-modules/pythinkingcleaner/default.nix
new file mode 100644
index 000000000000..c729f19aadd7
--- /dev/null
+++ b/pkgs/development/python-modules/pythinkingcleaner/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pythinkingcleaner";
+  version = "0.0.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "TheRealLink";
+    repo = "pythinkingcleaner";
+    tag = version;
+    hash = "sha256-YaHBZwJvgI3uFkFtZ4KWrKKGRPuNhBBrhCvGC65Jsks=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pythinkingcleaner" ];
+
+  meta = {
+    description = "Library to control ThinkingCleaner devices";
+    homepage = "https://github.com/TheRealLink/pythinkingcleaner";
+    changelog = "https://github.com/TheRealLink/pythinkingcleaner/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-clementine-remote/default.nix b/pkgs/development/python-modules/python-clementine-remote/default.nix
new file mode 100644
index 000000000000..00abc62b2075
--- /dev/null
+++ b/pkgs/development/python-modules/python-clementine-remote/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  protobuf,
+}:
+
+buildPythonPackage rec {
+  pname = "python-clementine-remote";
+  version = "1.0.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jjmontesl";
+    repo = "python-clementine-remote";
+    tag = version;
+    hash = "sha256-tPaxRBvt+tW4yV5Ap3YxMQxK3o7BJF3nP/wzBJeDgic=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ protobuf ];
+
+  # Project has no tests
+  doCheck = false;
+
+  env = {
+    # https://github.com/jjmontesl/python-clementine-remote/pull/7
+    PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION = "python";
+  };
+
+  pythonImportsCheck = [ "clementineremote" ];
+
+  meta = {
+    description = "Python library and CLI for the Clementine Music Player remote protocol";
+    homepage = "https://github.com/jjmontesl/python-clementine-remote";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-codon-tables/default.nix b/pkgs/development/python-modules/python-codon-tables/default.nix
index af72906af4eb..e1ba3a0b8f5e 100644
--- a/pkgs/development/python-modules/python-codon-tables/default.nix
+++ b/pkgs/development/python-modules/python-codon-tables/default.nix
@@ -2,12 +2,13 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "python-codon-tables";
   version = "0.1.18";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "python_codon_tables";
@@ -15,6 +16,8 @@ buildPythonPackage rec {
     hash = "sha256-c/VSmArSkq+46LzW3r+CQEG1mwp87ACbZ7EWkMOGOQc=";
   };
 
+  build-system = [ setuptools ];
+
   # no tests in tarball
   doCheck = false;
 
@@ -23,6 +26,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/Edinburgh-Genome-Foundry/codon-usage-tables";
     description = "Codon Usage Tables for Python, from kazusa.or.jp";
+    changelog = "https://github.com/Edinburgh-Genome-Foundry/python_codon_tables/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ prusnak ];
   };
diff --git a/pkgs/development/python-modules/raspyrfm-client/default.nix b/pkgs/development/python-modules/raspyrfm-client/default.nix
new file mode 100644
index 000000000000..25bd389e83f7
--- /dev/null
+++ b/pkgs/development/python-modules/raspyrfm-client/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  rstr,
+  python,
+}:
+
+buildPythonPackage rec {
+  pname = "raspyrfm-client";
+  version = "1.2.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "markusressel";
+    repo = "raspyrfm-client";
+    tag = "v${version}";
+    hash = "sha256-WiL69bb4h8xVdMYxAVU0NHEfTWyW2NVR86zigsr5dmk=";
+  };
+
+  # while we may not actually be on master, the script needs a git branch to function
+  # and master here is better than beta or pre-alpha
+  postPatch = ''
+    substituteInPlace ./setup.py \
+      --replace-fail 'subprocess.check_output(["git", "rev-parse", "--abbrev-ref", "HEAD"])' '"master"' \
+      --replace-fail 'GIT_BRANCH.decode()' '"master"' \
+      --replace-fail 'GIT_BRANCH.rstrip()' '"master"'
+  '';
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "raspyrfm_client" ];
+
+  nativeCheckInputs = [ rstr ];
+
+  # pytestCheckHook does not auto detect the only test, run manually
+  checkPhase = ''
+    runHook preCheck
+
+    ${python.interpreter} tests/automatic_tests.py
+
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "Send rc signals with the RaspyRFM module";
+    homepage = "https://github.com/markusressel/raspyrfm-client";
+    changelog = "https://github.com/markusressel/raspyrfm-client/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+  };
+}
diff --git a/pkgs/development/python-modules/rfk101py/default.nix b/pkgs/development/python-modules/rfk101py/default.nix
new file mode 100644
index 000000000000..ff0beda1ef12
--- /dev/null
+++ b/pkgs/development/python-modules/rfk101py/default.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "rfk101py";
+  version = "0.0.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-O8W404opbjH4AIUAfM01xrzXM/2WzU6q7uxM5ySgdhg=";
+  };
+
+  build-system = [ setuptools ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "rfk101py" ];
+
+  meta = {
+    description = "RFK101 Proximity card reader over Ethernet";
+    homepage = "https://github.com/dubnom/rfk101py";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/sepaxml/default.nix b/pkgs/development/python-modules/sepaxml/default.nix
index d1e12b2ae1fa..93487b445532 100644
--- a/pkgs/development/python-modules/sepaxml/default.nix
+++ b/pkgs/development/python-modules/sepaxml/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "sepaxml";
-  version = "2.6.1";
+  version = "2.6.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "raphaelm";
     repo = "python-sepaxml";
     rev = version;
-    hash = "sha256-l5UMy0M3Ovzb6rcSAteGOnKdmBPHn4L9ZWY+YGOCn40=";
+    hash = "sha256-T+pHspKUxH/mW+pnotQ9I0EXX1EjgFwtP9za41BySuE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/tapsaff/default.nix b/pkgs/development/python-modules/tapsaff/default.nix
new file mode 100644
index 000000000000..2aaf9182a3af
--- /dev/null
+++ b/pkgs/development/python-modules/tapsaff/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "tapsaff";
+  version = "0.2.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Q3VLbPsgXAYvZsjcW1m3lus2SFMjNJ8AmkcNK0THB6I=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    requests
+  ];
+
+  # Package does not have tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "tapsaff"
+  ];
+
+  meta = {
+    description = "Provides an API for requesting information from taps-aff.co.uk";
+    homepage = "https://github.com/bazwilliams/python-taps-aff";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 5467626ee628..944834ab0b33 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1449";
+  version = "3.0.1451";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-j2AJiG764xB01bch/bAhxqc2KwgtRAfUaSYvhxKy5I4=";
+    hash = "sha256-2i5TQduEbvUGW4JYihh6Z0kKA6BGXzytjk/ojSPD3TY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tiledb/default.nix b/pkgs/development/python-modules/tiledb/default.nix
index d43419139032..04383797afb9 100644
--- a/pkgs/development/python-modules/tiledb/default.nix
+++ b/pkgs/development/python-modules/tiledb/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   python,
   buildPythonPackage,
   fetchFromGitHub,
@@ -12,12 +13,19 @@
   setuptools-scm,
   psutil,
   pandas,
+  cmake,
+  ninja,
+  scikit-build-core,
+  packaging,
+  pytest,
+  hypothesis,
+  pyarrow,
 }:
 
 buildPythonPackage rec {
   pname = "tiledb";
   version = "0.34.2";
-  format = "setuptools";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "TileDB-Inc";
@@ -26,58 +34,50 @@ buildPythonPackage rec {
     hash = "sha256-EXRrWp/2sMn7DCzgXk5L0692rhGtQZwWpVWYnfrxmGA=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     cython
     pybind11
     setuptools-scm
+    scikit-build-core
+    packaging
+    cmake
+    ninja
   ];
 
   buildInputs = [ tiledb ];
 
   propagatedBuildInputs = [
     numpy
-    wheel # No idea why but it is listed
   ];
 
   nativeCheckInputs = [
     psutil
     # optional
     pandas
+    pytest
+    hypothesis
+    pyarrow
   ];
 
   TILEDB_PATH = tiledb;
 
   disabled = !isPy3k; # Not bothering with python2 anymore
 
-  postPatch = ''
-    # Hardcode path to shared object
-    substituteInPlace tiledb/__init__.py --replace \
-      'os.path.join(lib_dir, lib_name)' 'os.path.join("${tiledb}/lib", lib_name)'
-
-    # Disable failing test
-    substituteInPlace tiledb/tests/test_examples.py --replace \
-      "test_docs" "dont_test_docs"
-    # these tests don't always fail
-    substituteInPlace tiledb/tests/test_libtiledb.py --replace \
-      "test_varlen_write_int_subarray" "dont_test_varlen_write_int_subarray" \
-      --replace "test_memory_cleanup" "dont_test_memory_cleanup" \
-      --replace "test_ctx_thread_cleanup" "dont_test_ctx_thread_cleanup"
-    substituteInPlace tiledb/tests/test_metadata.py --replace \
-      "test_metadata_consecutive" "dont_test_metadata_consecutive"
-  '';
+  dontUseCmakeConfigure = true;
 
+  # We have to run pytest from a diffferent directory to force it to import tiledb from $out
+  # otherwise it cannot be imported because extension modules are not compiled in sources
   checkPhase = ''
     pushd "$TMPDIR"
-    ${python.interpreter} -m unittest tiledb.tests.all.suite_test
+    ${python.interpreter} -m pytest --pyargs tiledb${lib.optionalString stdenv.isDarwin " -k 'not test_ctx_thread_cleanup and not test_array'"}
     popd
   '';
+
   pythonImportsCheck = [ "tiledb" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python interface to the TileDB storage manager";
     homepage = "https://github.com/TileDB-Inc/TileDB-Py";
-    license = licenses.mit;
-    # tiledb/core.cc:556:30: error: ‘struct std::array<long unsigned int, 2>’ has no member named ‘second’
-    broken = true;
+    license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/development/python-modules/travispy/default.nix b/pkgs/development/python-modules/travispy/default.nix
new file mode 100644
index 000000000000..d8d6cbe96baa
--- /dev/null
+++ b/pkgs/development/python-modules/travispy/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  requests,
+  pytestCheckHook,
+  pytest-rerunfailures,
+}:
+
+buildPythonPackage rec {
+  pname = "travispy";
+  version = "0.3.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "menegazzo";
+    repo = "travispy";
+    tag = "v${version}";
+    hash = "sha256-jYuRaKtoWaWq6QWinXnuBfqanTCMibouwwWHfcmioGo=";
+  };
+
+  postPatch = ''
+    # Fix deprecated pytest configuration
+    substituteInPlace setup.cfg \
+      --replace-fail "[pytest]" "[tool:pytest]"
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-rerunfailures
+  ];
+
+  tests = [
+    "travispy/_tests/"
+  ];
+
+  # Skip tests that require network access
+  disabledTests = [
+    "test_not_authenticated"
+  ];
+
+  pythonImportsCheck = [ "travispy" ];
+
+  meta = {
+    description = "Python API for Travis CI";
+    homepage = "https://github.com/menegazzo/travispy";
+    changelog = "https://github.com/menegazzo/travispy/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/vbuild/default.nix b/pkgs/development/python-modules/vbuild/default.nix
index e54f584ad896..a491abb0bfd1 100644
--- a/pkgs/development/python-modules/vbuild/default.nix
+++ b/pkgs/development/python-modules/vbuild/default.nix
@@ -31,6 +31,8 @@ buildPythonPackage rec {
       --replace-fail 'build-backend = "poetry.masonry.api"' 'build-backend = "poetry.core.masonry.api"'
   '';
 
+  pythonRelaxDeps = [ "pscript" ];
+
   build-system = [ poetry-core ];
 
   dependencies = [ pscript ];
diff --git a/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch b/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch
deleted file mode 100644
index 3c80f8e24e65..000000000000
--- a/pkgs/development/python-modules/vllm/0004-drop-lsmod.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- a/setup.py
-+++ b/setup.py
-@@ -340,14 +340,7 @@ def _is_hpu() -> bool:
-         out = subprocess.run(["hl-smi"], capture_output=True, check=True)
-         is_hpu_available = out.returncode == 0
-     except (FileNotFoundError, PermissionError, subprocess.CalledProcessError):
--        if sys.platform.startswith("linux"):
--            try:
--                output = subprocess.check_output(
--                    'lsmod | grep habanalabs | wc -l', shell=True)
--                is_hpu_available = int(output) > 0
--            except (ValueError, FileNotFoundError, PermissionError,
--                    subprocess.CalledProcessError):
--                pass
-+        is_hpu_available = False
-     return is_hpu_available
- 
- 
diff --git a/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch b/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
index 9bf7d3cdf4d8..f16982ece4a7 100644
--- a/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
+++ b/pkgs/development/python-modules/vllm/0005-drop-intel-reqs.patch
@@ -1,25 +1,12 @@
-From 7511784ceb9252091a9d63ac6b54dcc67dd2b262 Mon Sep 17 00:00:00 2001
-From: Conroy Cheers <conroy@corncheese.org>
-Date: Fri, 13 Jun 2025 17:42:10 +1000
-Subject: [PATCH] drop intel reqs
-
----
- requirements/cpu.txt | 3 ---
- 1 file changed, 3 deletions(-)
-
 diff --git a/requirements/cpu.txt b/requirements/cpu.txt
-index d7b0fc6d8..be2df751b 100644
+index d80354342..7434f32f0 100644
 --- a/requirements/cpu.txt
 +++ b/requirements/cpu.txt
-@@ -24,8 +24,5 @@ datasets # for benchmark scripts
- # cpu cannot use triton 3.3.0
- triton==3.2.0; platform_machine == "x86_64"
+@@ -21,7 +21,4 @@ torchvision; platform_machine != "ppc64le" and platform_machine != "s390x"
+ torchvision==0.22.0; platform_machine == "ppc64le"
+ datasets # for benchmark scripts
  
 -# Intel Extension for PyTorch, only for x86_64 CPUs
 -intel-openmp==2024.2.1; platform_machine == "x86_64"
--intel_extension_for_pytorch==2.7.0; platform_machine == "x86_64"
- py-libnuma; platform_system != "Darwin"
- psutil; platform_system != "Darwin"
--- 
-2.49.0
-
+-intel_extension_for_pytorch==2.6.0; platform_machine == "x86_64" # torch>2.6.0+cpu has performance regression on x86 platform, see https://github.com/pytorch/pytorch/pull/151218
+ triton==3.2.0; platform_machine == "x86_64" # Triton is required for torch 2.6+cpu, as it is imported in torch.compile.
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index cec9c00eadcc..b5e4edd75edc 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -5,7 +5,6 @@
   buildPythonPackage,
   pythonAtLeast,
   fetchFromGitHub,
-  fetchpatch,
   symlinkJoin,
   autoAddDriverRunpath,
 
@@ -45,6 +44,8 @@
   lm-format-enforcer,
   prometheus-fastapi-instrumentator,
   cupy,
+  cbor2,
+  pybase64,
   gguf,
   einops,
   importlib-metadata,
@@ -69,6 +70,8 @@
   bitsandbytes,
   flashinfer,
   py-libnuma,
+  setproctitle,
+  openai-harmony,
 
   # internal dependency - for overriding in overlays
   vllm-flash-attn ? null,
@@ -92,13 +95,13 @@ let
   shouldUsePkg =
     pkg: if pkg != null && lib.meta.availableOn stdenv.hostPlatform pkg then pkg else null;
 
-  # see CMakeLists.txt, grepping for GIT_TAG near cutlass
+  # see CMakeLists.txt, grepping for CUTLASS_REVISION
   # https://github.com/vllm-project/vllm/blob/v${version}/CMakeLists.txt
   cutlass = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cutlass";
-    tag = "v3.9.2";
-    hash = "sha256-teziPNA9csYvhkG5t2ht8W8x5+1YGGbHm8VKx4JoxgI=";
+    tag = "v4.0.0";
+    hash = "sha256-HJY+Go1viPkSVZPEs/NyMtYJzas4mMLiIZF3kNX+WgA=";
   };
 
   flashmla = stdenv.mkDerivation {
@@ -111,8 +114,8 @@ let
     src = fetchFromGitHub {
       owner = "vllm-project";
       repo = "FlashMLA";
-      rev = "575f7724b9762f265bbee5889df9c7d630801845";
-      hash = "sha256-8WrKMl0olr0nYV4FRJfwSaJ0F5gWQpssoFMjr9tbHBk=";
+      rev = "0e43e774597682284358ff2c54530757b654b8d1";
+      hash = "sha256-wxL/jtq/lsLg1o+4392KNgfw5TYlW6lqEVbmR3Jl4/Q=";
     };
 
     dontConfigure = true;
@@ -138,8 +141,8 @@ let
     src = fetchFromGitHub {
       owner = "vllm-project";
       repo = "flash-attention";
-      rev = "8798f27777fb57f447070301bf33a9f9c607f491";
-      hash = "sha256-UTUvATGN1NU/Bc8qo078q6bEgILLmlrjL7Yk2iAJhg4=";
+      rev = "57b4e68b9f9d94750b46de8f8dbd2bfcc86edd4f";
+      hash = "sha256-c7L7WZVVEnXMOTPBoSp7jhkl9d4TA4sj11QvOSWTDIE=";
     };
 
     dontConfigure = true;
@@ -161,7 +164,7 @@ let
 
   cpuSupport = !cudaSupport && !rocmSupport;
 
-  # https://github.com/pytorch/pytorch/blob/v2.7.0/torch/utils/cpp_extension.py#L2343-L2345
+  # https://github.com/pytorch/pytorch/blob/v2.7.1/torch/utils/cpp_extension.py#L2343-L2345
   supportedTorchCudaCapabilities =
     let
       real = [
@@ -231,6 +234,7 @@ let
     libcusolver # cusolverDn.h
     cuda_nvtx
     cuda_nvrtc
+    # cusparselt # cusparseLt.h
     libcublas
   ];
 
@@ -247,7 +251,7 @@ in
 
 buildPythonPackage rec {
   pname = "vllm";
-  version = "0.9.1";
+  version = "0.10.1.1";
   pyproject = true;
 
   # https://github.com/vllm-project/vllm/issues/12083
@@ -259,23 +263,12 @@ buildPythonPackage rec {
     owner = "vllm-project";
     repo = "vllm";
     tag = "v${version}";
-    hash = "sha256-sp7rDpewTPXTVRBJHJMj+8pJDS6wAu0/OTJZwbPPqKc=";
+    hash = "sha256-lLNjBv5baER0AArX3IV4HWjDZ2jTGXyGIvnHupR8MGM=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "remove-unused-opentelemetry-semantic-conventions-ai-dep.patch";
-      url = "https://github.com/vllm-project/vllm/commit/6a5d7e45f52c3a13de43b8b4fa9033e3b342ebd2.patch";
-      hash = "sha256-KYthqu+6XwsYYd80PtfrMMjuRV9+ionccr7EbjE4jJE=";
-    })
-    (fetchpatch {
-      name = "fall-back-to-gloo-when-nccl-unavailable.patch";
-      url = "https://github.com/vllm-project/vllm/commit/aa131a94410683b0a02e74fed2ce95e6c2b6b030.patch";
-      hash = "sha256-jNlQZQ8xiW85JWyBjsPZ6FoRQsiG1J8bwzmQjnaWFBg=";
-    })
     ./0002-setup.py-nix-support-respect-cmakeFlags.patch
     ./0003-propagate-pythonpath.patch
-    ./0004-drop-lsmod.patch
     ./0005-drop-intel-reqs.patch
   ];
 
@@ -354,6 +347,7 @@ buildPythonPackage rec {
     aioprometheus
     blake3
     cachetools
+    cbor2
     depyf
     fastapi
     llguidance
@@ -366,6 +360,7 @@ buildPythonPackage rec {
     prometheus-fastapi-instrumentator
     py-cpuinfo
     pyarrow
+    pybase64
     pydantic
     python-json-logger
     python-multipart
@@ -393,6 +388,8 @@ buildPythonPackage rec {
     opentelemetry-api
     opentelemetry-exporter-otlp
     bitsandbytes
+    setproctitle
+    openai-harmony
     # vLLM needs Torch's compiler to be present in order to use torch.compile
     torch.stdenv.cc
   ]
@@ -476,8 +473,5 @@ buildPythonPackage rec {
       # find_isa
       "x86_64-darwin"
     ];
-    # ValueError: 'aimv2' is already used by a Transformers config, pick another name.
-    # Version bump ongoing in https://github.com/NixOS/nixpkgs/pull/429117
-    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/webio-api/default.nix b/pkgs/development/python-modules/webio-api/default.nix
new file mode 100644
index 000000000000..b77a2460b0b0
--- /dev/null
+++ b/pkgs/development/python-modules/webio-api/default.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  aiohttp,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "webio-api";
+  version = "0.1.11";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "webio_api";
+    inherit version;
+    hash = "sha256-fPlAWu/P9gOjlQ62qAesLcLkNznAiMAAqxAlQi9oxZk=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "webio_api" ];
+
+  meta = {
+    description = "Simple API to use for communication with WebIO device meant for Home Assistant integration";
+    homepage = "https://github.com/nasWebio/webio_api";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/whisperx/default.nix b/pkgs/development/python-modules/whisperx/default.nix
index 72883f63cf76..e6ad813d8e33 100644
--- a/pkgs/development/python-modules/whisperx/default.nix
+++ b/pkgs/development/python-modules/whisperx/default.nix
@@ -67,10 +67,14 @@ buildPythonPackage rec {
       '"ffmpeg"' '"${lib.getExe ffmpeg}"'
   '';
 
-  # > Checking runtime dependencies for whisperx-3.3.2-py3-none-any.whl
-  # >   - faster-whisper==1.1.0 not satisfied by version 1.1.1
-  # This has been updated on main, so we expect this clause to be removed upon the next update.
-  pythonRelaxDeps = [ "faster-whisper" ];
+  pythonRelaxDeps = [
+    # > Checking runtime dependencies for whisperx-3.3.2-py3-none-any.whl
+    # >   - faster-whisper==1.1.0 not satisfied by version 1.1.1
+    # This has been updated on main, so we expect this clause to be removed upon the next update.
+    "faster-whisper"
+
+    "ctranslate2"
+  ];
 
   # Import check fails due on `aarch64-linux` ONLY in the sandbox due to onnxruntime
   # not finding its default logger, which then promptly segfaults.
diff --git a/pkgs/development/python-modules/yeelightsunflower/default.nix b/pkgs/development/python-modules/yeelightsunflower/default.nix
new file mode 100644
index 000000000000..b061674e2446
--- /dev/null
+++ b/pkgs/development/python-modules/yeelightsunflower/default.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "yeelightsunflower";
+  version = "0.0.10";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-l4Rl6WSCK68/XBwCndonNu3kePDXfSs/uIXaCkrIT7g==";
+  };
+
+  build-system = [ setuptools ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "yeelightsunflower" ];
+
+  meta = {
+    description = "Python package for interacting with Yeelight Sunflower bulbs";
+    homepage = "https://github.com/lindsaymarkward/python-yeelight-sunflower";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/zhong-hong-hvac/default.nix b/pkgs/development/python-modules/zhong-hong-hvac/default.nix
new file mode 100644
index 000000000000..c04344d1349b
--- /dev/null
+++ b/pkgs/development/python-modules/zhong-hong-hvac/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  attrs,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "zhong-hong-hvac";
+  version = "1.0.13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "crhan";
+    repo = "ZhongHongHVAC";
+    tag = "v${version}";
+    hash = "sha256-WLSmzvRydfYhLBZZW4EZDCFXZYqowA6vS0GJUl2UadQ=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ attrs ];
+
+  # Tests require network hardware connection
+  doCheck = false;
+
+  pythonImportsCheck = [ "zhong_hong_hvac" ];
+
+  meta = {
+    description = "Python library for interfacing with ZhongHong HVAC controller";
+    homepage = "https://github.com/crhan/ZhongHongHVAC";
+    changelog = "https://github.com/crhan/ZhongHongHVAC/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index d8dd5c0382a6..32e976b0cc3e 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtcreator";
-  version = "17.0.0";
+  version = "17.0.1";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-YW3+pDphYrwajM9EDh32p0uXf8sCjXa3x3mh+43jnow=";
+    hash = "sha256-9WcYCEdnBzkami7bmWPqSmtrkMeMvnTs4aygxrQuUYQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
index aa4967e2c512..eeac3be85758 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
@@ -57,6 +57,15 @@ lib.makeOverridable (
       ++ attrs.extraNativeBuildInputs or [ ];
       buildInputs = compatIfNeeded;
 
+      preBuild =
+        lib.optionalString (stdenv'.hasCC && stdenv'.cc.isClang or false && attrs.clangFixup or true) ''
+          export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -D_VA_LIST -D_VA_LIST_DECLARED -Dva_list=__builtin_va_list -D_SIZE_T_DECLARED -D_SIZE_T -Dsize_t=__SIZE_TYPE__ -D_WCHAR_T"
+        ''
+        + lib.optionalString (versionData.major == 13) ''
+          export NIX_LDFLAGS="$NIX_LDFLAGS --undefined-version"
+        ''
+        + (attrs.preBuild or "");
+
       makeFlags = [
         "STRIP=-s" # flag to install, not command
       ]
@@ -77,6 +86,13 @@ lib.makeOverridable (
 
         # don't set filesystem flags that require root
         NO_FSCHG = "yes";
+
+        HAVE_LLVM = lib.optionalString stdenv'.cc.isClang or false (
+          lib.versions.major (lib.getVersion stdenv'.cc.cc)
+        );
+        HAVE_GCC = lib.optionalString stdenv'.cc.isGNU or false (
+          lib.versions.major (lib.getVersion stdenv'.cc.cc)
+        );
       }
       // lib.optionalAttrs stdenv'.hasCC {
         # TODO should CC wrapper set this?
@@ -87,12 +103,6 @@ lib.makeOverridable (
       }
       // lib.optionalAttrs (!stdenv.hostPlatform.isFreeBSD) { BOOTSTRAPPING = true; }
       // lib.optionalAttrs stdenv'.hostPlatform.isDarwin { MKRELRO = "no"; }
-      // lib.optionalAttrs (stdenv'.cc.isClang or false) {
-        HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-      }
-      // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
-        HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
-      }
       // lib.optionalAttrs (stdenv'.hostPlatform.isx86_32) { USE_SSP = "no"; }
       // (attrs.env or { });
 
@@ -113,15 +123,6 @@ lib.makeOverridable (
       dontBuild = true;
     }
     // (builtins.removeAttrs attrs [ "env" ])
-    // lib.optionalAttrs (stdenv'.hasCC && stdenv'.cc.isClang or false && attrs.clangFixup or true) {
-      preBuild = ''
-        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -D_VA_LIST -D_VA_LIST_DECLARED -Dva_list=__builtin_va_list -D_SIZE_T_DECLARED -D_SIZE_T -Dsize_t=__SIZE_TYPE__ -D_WCHAR_T"
-      ''
-      + lib.optionalString (versionData.major == 13) ''
-        export NIX_LDFLAGS="$NIX_LDFLAGS --undefined-version"
-      ''
-      + (attrs.preBuild or "");
-    }
     // {
       patches =
         (lib.optionals (attrs.autoPickPatches or true) (
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 8899e7bad9d9..5f6111e5f7fa 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -38,8 +38,8 @@ let
       # Additional make flags passed to kbuild
       extraMakeFlags ? [ ],
 
-      # enables the options in ./common-config.nix; if `false` then only
-      # `structuredExtraConfig` is used
+      # enables the options in ./common-config.nix and lib/systems/platform.nix;
+      # if `false` then only `structuredExtraConfig` is used
       enableCommonConfig ? true
 
       , # kernel intermediate config overrides, as a set
@@ -136,7 +136,8 @@ let
         configfile.moduleStructuredConfig.intermediateNixConfig
         # extra config in legacy string format
         + extraConfig
-        + stdenv.hostPlatform.linux-kernel.extraConfig or "";
+        # need the 'or ""' at the end in case enableCommonConfig = true and extraConfig is not present
+        + lib.optionalString enableCommonConfig stdenv.hostPlatform.linux-kernel.extraConfig or "";
 
       structuredConfigFromPatches = map (
         {
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 8da20935de80..7234a4bf12a1 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,33 +5,33 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.148",
-        "hash": "sha256:18c024bqqc3srzv2gva55p95yghjc6x3p3f54v3hziki4wx3v86r",
-        "lts": false
+        "version": "6.1.149",
+        "hash": "sha256:0fdyfxw80zhkwh29m5v7xfmbyks5wi6isdq6bv96cn4ssfw0dsf4",
+        "lts": true
     },
     "5.15": {
-        "version": "5.15.189",
-        "hash": "sha256:1hshd26ahn6dbw6jnqi0v5afpk672w7p09mk7iri93i7hxdh5l73",
+        "version": "5.15.190",
+        "hash": "sha256:0146lslj0my0mhcx7wfp984f270zr8iiyq9899v6f7cflkqi9f32",
         "lts": true
     },
     "5.10": {
-        "version": "5.10.240",
-        "hash": "sha256:04sdcf4aqsqchii38anzmk9f9x65wv8q1x3m9dandmi6fabw724d",
+        "version": "5.10.241",
+        "hash": "sha256:1mnqjvb1hmr7p035c66k3z0idirhsj9j5zwgb92gi0ac0s1fkh88",
         "lts": true
     },
     "5.4": {
-        "version": "5.4.296",
-        "hash": "sha256:0fm73yqzbzclh2achcj8arpg428d412k2wgmlfmyy6xzb1762qrx",
+        "version": "5.4.297",
+        "hash": "sha256:0hd8x32xgvj4qnc6cls0q21zfgvxxfz7xhbwgl48hxfggbmgq37i",
         "lts": true
     },
     "6.6": {
-        "version": "6.6.102",
-        "hash": "sha256:0p6yjifwyrqlppn40isgxb0b5vqmljggmnp7w75vlc2c6fvzxll0",
+        "version": "6.6.103",
+        "hash": "sha256:13mi8blsw0gps586qbvh7ga5r9pv9jld4fkbp9vaaaz6qcwdv26j",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.43",
-        "hash": "sha256:1vmxywg11z946i806sg7rk7jr9px87spmwwbzjxpps2nsjybpjqg",
+        "version": "6.12.44",
+        "hash": "sha256:1bmx2vpxy6nkxnmm2a3zmv9smaajfhvslj6id54j4yq2sc722l5n",
         "lts": true
     },
     "6.15": {
@@ -40,8 +40,8 @@
         "lts": false
     },
     "6.16": {
-        "version": "6.16.3",
-        "hash": "sha256:118bg72mdrf75r36gki5zi18ynl2kcygrf24pwd58by1anh9nhw0",
+        "version": "6.16.4",
+        "hash": "sha256:08mnd8qir2vxjmgblhnqfrfbv2zlig68f4r5askk7d8h3b3y79fn",
         "lts": false
     }
 }
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 693c0572297b..dbb703a754e6 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -900,7 +900,8 @@
       ];
     "clementine" =
       ps: with ps; [
-      ]; # missing inputs: python-clementine-remote
+        python-clementine-remote
+      ];
     "clickatell" =
       ps: with ps; [
       ];
@@ -934,7 +935,8 @@
       ];
     "cmus" =
       ps: with ps; [
-      ]; # missing inputs: pycmus
+        pycmus
+      ];
     "co2signal" =
       ps: with ps; [
         aioelectricitymaps
@@ -1016,7 +1018,8 @@
       ];
     "cppm_tracker" =
       ps: with ps; [
-      ]; # missing inputs: clearpasspy
+        clearpasspy
+      ];
     "cpuspeed" =
       ps: with ps; [
         py-cpuinfo
@@ -1253,7 +1256,8 @@
       ];
     "dominos" =
       ps: with ps; [
-      ]; # missing inputs: pizzapi
+        pizzapi
+      ];
     "doods" =
       ps: with ps; [
         pillow
@@ -1362,7 +1366,8 @@
       ];
     "ebox" =
       ps: with ps; [
-      ]; # missing inputs: pyebox
+        pyebox
+      ];
     "ebusd" =
       ps: with ps; [
         ebusdpy
@@ -2039,7 +2044,8 @@
       ];
     "gitter" =
       ps: with ps; [
-      ]; # missing inputs: gitterpy
+        gitterpy
+      ];
     "glances" =
       ps: with ps; [
         glances-api
@@ -2190,7 +2196,8 @@
       ];
     "greenwave" =
       ps: with ps; [
-      ]; # missing inputs: greenwavereality
+        greenwavereality
+      ];
     "group" =
       ps: with ps; [
       ];
@@ -2428,7 +2435,8 @@
       ];
     "horizon" =
       ps: with ps; [
-      ]; # missing inputs: horimote
+        horimote
+      ];
     "hp_ilo" =
       ps: with ps; [
         python-hpilo
@@ -2584,7 +2592,8 @@
       ];
     "idteck_prox" =
       ps: with ps; [
-      ]; # missing inputs: rfk101py
+        rfk101py
+      ];
     "ifttt" =
       ps: with ps; [
         pyfttt
@@ -2781,7 +2790,8 @@
       ];
     "irish_rail_transport" =
       ps: with ps; [
-      ]; # missing inputs: pyirishrail
+        pyirishrail
+      ];
     "iron_os" =
       ps: with ps; [
         aioesphomeapi
@@ -3393,7 +3403,8 @@
       ];
     "lw12wifi" =
       ps: with ps; [
-      ]; # missing inputs: lw12
+        lw12
+      ];
     "lyric" =
       ps: with ps; [
         aiolyric
@@ -3590,7 +3601,8 @@
       ];
     "microbees" =
       ps: with ps; [
-      ]; # missing inputs: microBeesPy
+        microbeespy
+      ];
     "microsoft" =
       ps: with ps; [
         pycsspeechtts
@@ -3885,7 +3897,8 @@
       ];
     "nasweb" =
       ps: with ps; [
-      ]; # missing inputs: webio-api
+        webio-api
+      ];
     "national_grid_us" =
       ps: with ps; [
       ];
@@ -4063,7 +4076,8 @@
       ];
     "numato" =
       ps: with ps; [
-      ]; # missing inputs: numato-gpio
+        numato-gpio
+      ];
     "number" =
       ps: with ps; [
       ];
@@ -4524,7 +4538,8 @@
       ];
     "plum_lightpad" =
       ps: with ps; [
-      ]; # missing inputs: plumlightpad
+        plumlightpad
+      ];
     "pocketcasts" =
       ps: with ps; [
         pycketcasts
@@ -4612,7 +4627,8 @@
       ];
     "progettihwsw" =
       ps: with ps; [
-      ]; # missing inputs: ProgettiHWSW
+        progettihwsw
+      ];
     "proliphix" =
       ps: with ps; [
         proliphix
@@ -4863,7 +4879,8 @@
       ];
     "raspyrfm" =
       ps: with ps; [
-      ]; # missing inputs: raspyrfm-client
+        raspyrfm-client
+      ];
     "raven_rock_mfg" =
       ps: with ps; [
       ];
@@ -5393,7 +5410,8 @@
       ];
     "sinch" =
       ps: with ps; [
-      ]; # missing inputs: clx-sdk-xms
+        clx-sdk-xms
+      ];
     "siren" =
       ps: with ps; [
       ];
@@ -5862,7 +5880,8 @@
       ];
     "tapsaff" =
       ps: with ps; [
-      ]; # missing inputs: tapsaff
+        tapsaff
+      ];
     "tasmota" =
       ps: with ps; [
         aiohasupervisor
@@ -6017,7 +6036,8 @@
       ];
     "thinkingcleaner" =
       ps: with ps; [
-      ]; # missing inputs: pythinkingcleaner
+        pythinkingcleaner
+      ];
     "thomson" =
       ps: with ps; [
       ];
@@ -6213,7 +6233,8 @@
       ];
     "travisci" =
       ps: with ps; [
-      ]; # missing inputs: TravisPy
+        travispy
+      ];
     "trend" =
       ps: with ps; [
         numpy
@@ -6512,7 +6533,8 @@
       ];
     "watson_iot" =
       ps: with ps; [
-      ]; # missing inputs: ibmiotf
+        ibmiotf
+      ];
     "watttime" =
       ps: with ps; [
         aiowatttime
@@ -6794,7 +6816,8 @@
       ];
     "yeelightsunflower" =
       ps: with ps; [
-      ]; # missing inputs: yeelightsunflower
+        yeelightsunflower
+      ];
     "yi" =
       ps: with ps; [
         aioftp
@@ -6854,7 +6877,8 @@
       ];
     "zhong_hong" =
       ps: with ps; [
-      ]; # missing inputs: zhong-hong-hvac
+        zhong-hong-hvac
+      ];
     "ziggo_mediabox_xl" =
       ps: with ps; [
       ]; # missing inputs: ziggo-mediabox-xl
@@ -7390,6 +7414,7 @@
     "meteoclimatic"
     "metoffice"
     "mfi"
+    "microbees"
     "microsoft"
     "microsoft_face"
     "microsoft_face_detect"
@@ -7436,6 +7461,7 @@
     "nam"
     "namecheapdns"
     "nanoleaf"
+    "nasweb"
     "neato"
     "ness_alarm"
     "nest"
@@ -7466,6 +7492,7 @@
     "ntfy"
     "nuheat"
     "nuki"
+    "numato"
     "number"
     "nut"
     "nws"
@@ -7531,6 +7558,7 @@
     "playstation_network"
     "plex"
     "plugwise"
+    "plum_lightpad"
     "point"
     "poolsense"
     "powerfox"
@@ -7538,6 +7566,7 @@
     "private_ble_device"
     "probe_plus"
     "profiler"
+    "progettihwsw"
     "prometheus"
     "prosegur"
     "proximity"
diff --git a/pkgs/servers/home-assistant/custom-components/samsungtv-smart/package.nix b/pkgs/servers/home-assistant/custom-components/samsungtv-smart/package.nix
index 0e76b72beda9..c4e71e1ba60c 100644
--- a/pkgs/servers/home-assistant/custom-components/samsungtv-smart/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/samsungtv-smart/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "ollo69";
   domain = "samsungtv_smart";
-  version = "0.13.6";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "ollo69";
     repo = "ha-samsungtv-smart";
     tag = "v${version}";
-    hash = "sha256-4tBluCKt8e5tyUkv79t+pW/KNZUTEIeTY012x7CLN38=";
+    hash = "sha256-naogq/7yGj2OD93JayOH8kHZhyDsKkWa2v+lKL0FlPU=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index b8ba563931b7..6052bde08752 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -28,21 +28,21 @@ let
   # stable is on an older patch-release of Go and then the build would fail
   # after a backport.
   patchGoVersion = ''
-    find . -name go.mod -not -path "./.bingo/*" -print0 | while IFS= read -r -d ''' line; do
+    find . -name go.mod -not -path "./.bingo/*" -and -not -path "./hack/*" -and -not -path "./.citools/*" -print0 | while IFS= read -r -d ''' line; do
       substituteInPlace "$line" \
-        --replace-fail "go 1.24.4" "go 1.24.0"
+        --replace-fail "go 1.24.6" "go 1.24.0"
     done
     find . -name go.work -print0 | while IFS= read -r -d ''' line; do
       substituteInPlace "$line" \
-        --replace-fail "go 1.24.4" "go 1.24.0"
+        --replace-fail "go 1.24.6" "go 1.24.0"
     done
     substituteInPlace Makefile \
-      --replace-fail "GO_VERSION = 1.24.4" "GO_VERSION = 1.24.0"
+      --replace-fail "GO_VERSION = 1.24.6" "GO_VERSION = 1.24.0"
   '';
 in
 buildGoModule rec {
   pname = "grafana";
-  version = "12.1.0";
+  version = "12.1.1";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -54,7 +54,7 @@ buildGoModule rec {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-yraCuPLe68ryCgFzOZPL1H/JYynEvxijjgxMmQvcPZE=";
+    hash = "sha256-41OqvOTHlP66UtAecrpeArKldj0DNxK1oxTtQEihbo8=";
   };
 
   # Fix build
@@ -78,14 +78,14 @@ buildGoModule rec {
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry_4.fetchYarnBerryDeps {
     inherit src missingHashes;
-    hash = "sha256-+0L68wHR2nCp1g1PqyLIYatc+CIbvLqVUDa7CoyV/fo=";
+    hash = "sha256-51jCwnfWJoBICesM3SKiEvRC/Q1qUD310q59DucPdMs=";
   };
 
   disallowedRequisites = [ offlineCache ];
 
   postPatch = patchGoVersion;
 
-  vendorHash = "sha256-a31jJN1NIHihFwbtBuLzV4lRKYWv8GtIHh6EwVMWdbM=";
+  vendorHash = "sha256-9z3HqheXLNh3zfmp1A620vzzf5yZBUJsbj/cc6J+xTg=";
 
   proxyVendor = true;
 
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-sentry-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-sentry-datasource/default.nix
new file mode 100644
index 000000000000..309413cb645f
--- /dev/null
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-sentry-datasource/default.nix
@@ -0,0 +1,18 @@
+{ grafanaPlugin, lib }:
+
+grafanaPlugin {
+  pname = "grafana-sentry-datasource";
+  version = "2.2.1";
+  zipHash = {
+    x86_64-linux = "sha256-6pjBUqUHXLLgFzfal/OKsMBVlVXxuRglOj3XRnnduRY=";
+    aarch64-linux = "sha256-0kjxBnv34lRB5qeVOyik7qvlEsz7CYur9EyIDTe+AKM=";
+    x86_64-darwin = "sha256-yHgF+XmJXnJjfPwabs1dsrnWvssTmYpeZUXUl+gQxfM=";
+    aarch64-darwin = "sha256-ysLXSKG7q/u70NynYqKKRlYIl5rkYy0AMoza3sQSPNM=";
+  };
+  meta = {
+    description = "Integrate Sentry data into Grafana";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ arianvp ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/servers/monitoring/grafana/plugins/plugins.nix b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
index bc22c3443e98..89c749ef3bcf 100644
--- a/pkgs/servers/monitoring/grafana/plugins/plugins.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/plugins.nix
@@ -23,6 +23,7 @@
   grafana-piechart-panel = callPackage ./grafana-piechart-panel { };
   grafana-polystat-panel = callPackage ./grafana-polystat-panel { };
   grafana-pyroscope-app = callPackage ./grafana-pyroscope-app { };
+  grafana-sentry-datasource = callPackage ./grafana-sentry-datasource { };
   grafana-worldmap-panel = callPackage ./grafana-worldmap-panel { };
   marcusolsson-calendar-panel = callPackage ./marcusolsson-calendar-panel { };
   marcusolsson-csv-datasource = callPackage ./marcusolsson-csv-datasource { };
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 145708bc4fdf..38b967095c78 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -59,14 +59,14 @@ let
 in
 {
   nextcloud30 = generic {
-    version = "30.0.13";
-    hash = "sha256-viMmo689YHK08Uza05O5Y3qj3EDK9W/TgXXuo6j/j4Y=";
+    version = "30.0.14";
+    hash = "sha256-LUT1nji4UE/98GhY9I+yVboTqsJONVzfR6Q+qiLY0EE=";
     packages = nextcloud30Packages;
   };
 
   nextcloud31 = generic {
-    version = "31.0.7";
-    hash = "sha256-ACpdA64Fp/DDBWlH1toLeaRNPXIPVyj+UVWgxaO07Gk=";
+    version = "31.0.8";
+    hash = "sha256-YhF9t4P+d1Z3zotoD0tIwTuVkWV/7TtQi9w6MrQRXLA=";
     packages = nextcloud31Packages;
   };
 
diff --git a/pkgs/servers/nextcloud/packages/30.json b/pkgs/servers/nextcloud/packages/30.json
index b51036e1df9e..a627f1779696 100644
--- a/pkgs/servers/nextcloud/packages/30.json
+++ b/pkgs/servers/nextcloud/packages/30.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-D0p9ny3KeuBdWVirQUDb4gq+eCusZKrDxJ+UAjEJz84=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.2.4/contacts-v7.2.4.tar.gz",
-    "version": "7.2.4",
+    "hash": "sha256-A8dFfPee4Te1zbLaJfohuyxnMbaysmfDa3hicJnqfkM=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.2.5/contacts-v7.2.5.tar.gz",
+    "version": "7.2.5",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -210,8 +210,8 @@
     ]
   },
   "maps": {
-    "hash": "sha256-E0S/CwXyye19lcuiONEQCyHJqlL0ZG1A9Q7oOTEZH1g=",
-    "url": "https://github.com/nextcloud/maps/releases/download/v1.6.0-3-nightly/maps-1.6.0-3-nightly.tar.gz",
+    "hash": "sha256-IupRymjs955TiUutzoTTMeESNfBmAp51l+oBaZwfdN0=",
+    "url": "https://github.com/nextcloud/maps/releases/download/v1.6.0/maps-1.6.0.tar.gz",
     "version": "1.6.0",
     "description": "**The whole world fits inside your cloud!**\n\n- **🗺 Beautiful map:** Using [OpenStreetMap](https://www.openstreetmap.org) and [Leaflet](https://leafletjs.com), you can choose between standard map, satellite, topographical, dark mode or even watercolor! 🎨\n- **⭐ Favorites:** Save your favorite places, privately! Sync with [GNOME Maps](https://github.com/nextcloud/maps/issues/30) and mobile apps is planned.\n- **🧭 Routing:** Possible using either [OSRM](http://project-osrm.org), [GraphHopper](https://www.graphhopper.com) or [Mapbox](https://www.mapbox.com).\n- **🖼 Photos on the map:** No more boring slideshows, just show directly where you were!\n- **🙋 Contacts on the map:** See where your friends live and plan your next visit.\n- **📱 Devices:** Lost your phone? Check the map!\n- **〰 Tracks:** Load GPS tracks or past trips. Recording with [PhoneTrack](https://f-droid.org/en/packages/net.eneiluj.nextcloud.phonetrack/) or [OwnTracks](https://owntracks.org) is planned.",
     "homepage": "https://github.com/nextcloud/maps",
@@ -250,9 +250,9 @@
     ]
   },
   "notes": {
-    "hash": "sha256-WpxRJ45N+aO+cOp5u6+uwlijzofpmdcUg07ax3p3WDA=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.2/notes-v4.12.2.tar.gz",
-    "version": "4.12.2",
+    "hash": "sha256-tFR9r5kmR7Egczt62I7k8JUllAc4cNu95d3NSUGD108=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.3/notes-v4.12.3.tar.gz",
+    "version": "4.12.3",
     "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
@@ -270,10 +270,10 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-Nj8siAeNyN/lyq+K5y92ZXMqRLmhawtR9Q6b5dq7LL0=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.9.0/onlyoffice.tar.gz",
-    "version": "9.9.0",
-    "description": "ONLYOFFICE app allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
+    "hash": "sha256-JNAQQK1jA2RI3aDuIXw7NC047oXSZKkzkVjZbw8BxXs=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.10.0/onlyoffice.tar.gz",
+    "version": "9.10.0",
+    "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
       "agpl"
@@ -450,9 +450,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-MS1+fiDTufQXtKCG/45B2hQEfAVbsZb+TZb74f4EvAE=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v6.6.0/user_saml-v6.6.0.tar.gz",
-    "version": "6.6.0",
+    "hash": "sha256-kE51sQWjGzDbJxgRQNFmexcW+s9/6lcbW2Rxf+Tj6hA=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v7.0.0/user_saml-v7.0.0.tar.gz",
+    "version": "7.0.0",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
@@ -460,9 +460,9 @@
     ]
   },
   "whiteboard": {
-    "hash": "sha256-njiTDKDiwDeOH9biOohIQueAI8/pSijWy8EDXHoVeQo=",
-    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.1.2/whiteboard-v1.1.2.tar.gz",
-    "version": "1.1.2",
+    "hash": "sha256-oNu4q/s+77+h4xDhfwn4y3bQ6hxooj9gG2FC38EY8gY=",
+    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.1.3/whiteboard-v1.1.3.tar.gz",
+    "version": "1.1.3",
     "description": "The official whiteboard app for Nextcloud. It allows users to create and share whiteboards with other users and collaborate in real-time.\n\n**Whiteboard requires a separate collaboration server to work.** Please see the [documentation](https://github.com/nextcloud/whiteboard?tab=readme-ov-file#backend) on how to install it.\n\n- 🎨 Drawing shapes, writing text, connecting elements\n- 📝 Real-time collaboration\n- 🖼️ Add images with drag and drop\n- 📊 Easily add mermaid diagrams\n- ✨ Use the Smart Picker to embed other elements from Nextcloud\n- 📦 Image export\n- 💪 Strong foundation: We use Excalidraw as our base library",
     "homepage": "https://github.com/nextcloud/whiteboard",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/31.json b/pkgs/servers/nextcloud/packages/31.json
index 9580741eface..add61545b387 100644
--- a/pkgs/servers/nextcloud/packages/31.json
+++ b/pkgs/servers/nextcloud/packages/31.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-D0p9ny3KeuBdWVirQUDb4gq+eCusZKrDxJ+UAjEJz84=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.2.4/contacts-v7.2.4.tar.gz",
-    "version": "7.2.4",
+    "hash": "sha256-A8dFfPee4Te1zbLaJfohuyxnMbaysmfDa3hicJnqfkM=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.2.5/contacts-v7.2.5.tar.gz",
+    "version": "7.2.5",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -250,9 +250,9 @@
     ]
   },
   "notes": {
-    "hash": "sha256-WpxRJ45N+aO+cOp5u6+uwlijzofpmdcUg07ax3p3WDA=",
-    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.2/notes-v4.12.2.tar.gz",
-    "version": "4.12.2",
+    "hash": "sha256-tFR9r5kmR7Egczt62I7k8JUllAc4cNu95d3NSUGD108=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.12.3/notes-v4.12.3.tar.gz",
+    "version": "4.12.3",
     "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
     "homepage": "https://github.com/nextcloud/notes",
     "licenses": [
@@ -270,10 +270,10 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-Nj8siAeNyN/lyq+K5y92ZXMqRLmhawtR9Q6b5dq7LL0=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.9.0/onlyoffice.tar.gz",
-    "version": "9.9.0",
-    "description": "ONLYOFFICE app allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
+    "hash": "sha256-JNAQQK1jA2RI3aDuIXw7NC047oXSZKkzkVjZbw8BxXs=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.10.0/onlyoffice.tar.gz",
+    "version": "9.10.0",
+    "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
       "agpl"
@@ -450,9 +450,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-MS1+fiDTufQXtKCG/45B2hQEfAVbsZb+TZb74f4EvAE=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v6.6.0/user_saml-v6.6.0.tar.gz",
-    "version": "6.6.0",
+    "hash": "sha256-kE51sQWjGzDbJxgRQNFmexcW+s9/6lcbW2Rxf+Tj6hA=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v7.0.0/user_saml-v7.0.0.tar.gz",
+    "version": "7.0.0",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
@@ -460,9 +460,9 @@
     ]
   },
   "whiteboard": {
-    "hash": "sha256-njiTDKDiwDeOH9biOohIQueAI8/pSijWy8EDXHoVeQo=",
-    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.1.2/whiteboard-v1.1.2.tar.gz",
-    "version": "1.1.2",
+    "hash": "sha256-oNu4q/s+77+h4xDhfwn4y3bQ6hxooj9gG2FC38EY8gY=",
+    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.1.3/whiteboard-v1.1.3.tar.gz",
+    "version": "1.1.3",
     "description": "The official whiteboard app for Nextcloud. It allows users to create and share whiteboards with other users and collaborate in real-time.\n\n**Whiteboard requires a separate collaboration server to work.** Please see the [documentation](https://github.com/nextcloud/whiteboard?tab=readme-ov-file#backend) on how to install it.\n\n- 🎨 Drawing shapes, writing text, connecting elements\n- 📝 Real-time collaboration\n- 🖼️ Add images with drag and drop\n- 📊 Easily add mermaid diagrams\n- ✨ Use the Smart Picker to embed other elements from Nextcloud\n- 📦 Image export\n- 💪 Strong foundation: We use Excalidraw as our base library",
     "homepage": "https://github.com/nextcloud/whiteboard",
     "licenses": [
diff --git a/pkgs/servers/shishi/default.nix b/pkgs/servers/shishi/default.nix
index e9dfddb839de..b0ec3ee78b62 100644
--- a/pkgs/servers/shishi/default.nix
+++ b/pkgs/servers/shishi/default.nix
@@ -25,21 +25,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "shishi";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchurl {
     url = "mirror://gnu/shishi/shishi-${version}.tar.gz";
-    sha256 = "032qf72cpjdfffq1yq54gz3ahgqf2ijca4vl31sfabmjzq9q370d";
+    hash = "sha256-lXmP/RLdAaT4jgMR7gPKSibly05ekFmkDk/E2fKRfpI=";
   };
 
   separateDebugInfo = true;
 
-  # Fixes support for gcrypt 1.6+
-  patches = [
-    ./gcrypt-fix.patch
-    ./freebsd-unistd.patch
-  ];
-
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libgcrypt
diff --git a/pkgs/servers/shishi/freebsd-unistd.patch b/pkgs/servers/shishi/freebsd-unistd.patch
deleted file mode 100644
index 9399e20205b9..000000000000
--- a/pkgs/servers/shishi/freebsd-unistd.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/gl/unistd.in.h b/gl/unistd.in.h
-index 2ea9af4..ed58960 100644
---- a/gl/unistd.in.h
-+++ b/gl/unistd.in.h
-@@ -116,6 +116,7 @@
- # include <getopt.h>
- #endif
- 
-+#include "config.h"
- _GL_INLINE_HEADER_BEGIN
- #ifndef _GL_UNISTD_INLINE
- # define _GL_UNISTD_INLINE _GL_INLINE
diff --git a/pkgs/servers/shishi/gcrypt-fix.patch b/pkgs/servers/shishi/gcrypt-fix.patch
deleted file mode 100644
index ccc37389401b..000000000000
--- a/pkgs/servers/shishi/gcrypt-fix.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/configure b/configure
-index c9a442b..a596bfe 100755
---- a/configure
-+++ b/configure
-@@ -24491,12 +24491,6 @@ else
- /* end confdefs.h.  */
- 
- #include <gcrypt.h>
--/* GCRY_MODULE_ID_USER was added in 1.4.4 and gc-libgcrypt.c
--   will fail on startup if we don't have 1.4.4 or later, so
--   test for it early. */
--#if !defined GCRY_MODULE_ID_USER
--error too old libgcrypt
--#endif
- 
- int
- main ()
-diff --git a/gl/m4/gc.m4 b/gl/m4/gc.m4
-index b352e33..4bab9f4 100644
---- a/gl/m4/gc.m4
-+++ b/gl/m4/gc.m4
-@@ -12,12 +12,6 @@ AC_DEFUN([gl_GC],
-   if test "$libgcrypt" != no; then
-     AC_LIB_HAVE_LINKFLAGS([gcrypt], [gpg-error], [
- #include <gcrypt.h>
--/* GCRY_MODULE_ID_USER was added in 1.4.4 and gc-libgcrypt.c
--   will fail on startup if we don't have 1.4.4 or later, so
--   test for it early. */
--#if !defined GCRY_MODULE_ID_USER
--error too old libgcrypt
--#endif
- ])
-   fi
- ])
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index d2c7d0b2f168..3a42ab4f15aa 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -125,6 +125,18 @@ let
 
   isMarkedBroken = attrs: attrs.meta.broken or false;
 
+  # Allow granular checks to allow only some broken packages
+  # Example:
+  # { pkgs, ... }:
+  # {
+  #   allowBroken = false;
+  #   allowBrokenPredicate = pkg: builtins.elem (pkgs.lib.getName pkg) [ "hello" ];
+  # }
+  allowBrokenPredicate = config.allowBrokenPredicate or (x: false);
+
+  hasDeniedBroken =
+    attrs: (attrs.meta.broken or false) && !allowBroken && !allowBrokenPredicate attrs;
+
   hasUnsupportedPlatform = pkg: !(availableOn hostPlatform pkg);
 
   isMarkedInsecure = attrs: (attrs.meta.knownVulnerabilities or [ ]) != [ ];
@@ -516,7 +528,7 @@ let
         reason = "non-source";
         errormsg = "contains elements not built from source (‘${showSourceType attrs.meta.sourceProvenance}’)";
       }
-    else if !allowBroken && attrs.meta.broken or false then
+    else if hasDeniedBroken attrs then
       {
         valid = "no";
         reason = "broken";
diff --git a/pkgs/tools/security/ghidra/extensions/kaiju/default.nix b/pkgs/tools/security/ghidra/extensions/kaiju/default.nix
index 6a9113e37f49..c01f642bf279 100644
--- a/pkgs/tools/security/ghidra/extensions/kaiju/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/kaiju/default.nix
@@ -26,13 +26,13 @@ let
 
   self = buildGhidraExtension (finalAttrs: {
     pname = "kaiju";
-    version = "250709";
+    version = "250828";
 
     src = fetchFromGitHub {
       owner = "CERTCC";
       repo = "kaiju";
       rev = finalAttrs.version;
-      hash = "sha256-xt/h0HeFCk4s1GIr3wKegGCGIUxMPFfyKKJ9o/WId/E=";
+      hash = "sha256-edsQIBoOTY+WxVBtH1bbM7TZZHhA0jgVb2iJKC66iVM=";
     };
 
     buildInputs = [
diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index 446ec69617f1..0012e2f9c595 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -76,7 +76,13 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals withTpm2Tss [ tpm2-tss ];
 
-  # Maintained by Andrew Gallapher, who's involved with GPG in multiple ways: https://andrewg.com/
+  # FreePG (https://freepg.org) is a set of commonly-used patches for GnuPG that
+  # have not been merged upstream. It is used by Arch Linux, Debian, Fedora and
+  # NixOS, and is maintained by Andrew Gallagher.
+  #
+  # The main purpose of including these patches in Nixpkgs is to maintain
+  # compatibility with OpenPGP.
+  #
   freepgPatches = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "freepg";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2d3fcb430b0a..145fddcfad51 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2130,6 +2130,7 @@ mapAliases {
   SkypeExport = skypeexport; # Added 2024-06-12
   skypeforlinux = throw "Skype has been shut down in May 2025"; # Added 2025-05-05
   slack-dark = throw "'slack-dark' has been renamed to/replaced by 'slack'"; # Converted to throw 2024-10-17
+  sladeUnstable = slade-unstable; # Added 2025-08-26
   slic3r = throw "'slic3r' has been removed because it is unmaintained"; # Added 2025-08-26
   slimerjs = throw "slimerjs does not work with any version of Firefox newer than 59; upstream ended the project in 2021. <https://slimerjs.org/faq.html#end-of-development>"; # added 2025-01-06
   sloccount = throw "'sloccount' has been removed because it is unmaintained. Consider migrating to 'loccount'"; # added 2025-05-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 198b3929d527..3f92ab2e2292 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13837,18 +13837,6 @@ with pkgs;
 
   enyo-launcher = libsForQt5.callPackage ../games/doom-ports/enyo-launcher { };
 
-  slade = callPackage ../games/doom-ports/slade {
-    wxGTK = wxGTK32.override {
-      withWebKit = true;
-    };
-  };
-
-  sladeUnstable = callPackage ../games/doom-ports/slade/git.nix {
-    wxGTK = wxGTK32.override {
-      withWebKit = true;
-    };
-  };
-
   zandronum = callPackage ../games/doom-ports/zandronum { };
 
   zandronum-server = zandronum.override {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b694e5c529eb..24933b3dd7f8 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4597,10 +4597,10 @@ with self;
 
   CGISimple = buildPerlPackage {
     pname = "CGI-Simple";
-    version = "1.280";
+    version = "1.282";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MA/MANWAR/CGI-Simple-1.280.tar.gz";
-      hash = "sha256-GOAen/uBTl5O6neshImyBp/oNlGFUPN/bCIT61Wcar8=";
+      url = "mirror://cpan/authors/id/M/MA/MANWAR/CGI-Simple-1.282.tar.gz";
+      hash = "sha256-xX8PPjLN2AYSZFFVwbgptMy+TO1lXegzq5MAWYnCfy8=";
     };
     buildInputs = [
       TestException
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1f45c475922e..e722cfc7ae0c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1803,6 +1803,8 @@ self: super: with self; {
 
   beetcamp = callPackage ../development/python-modules/beetcamp { };
 
+  beets = toPythonModule (pkgs.beets.override { python3Packages = self; });
+
   beewi-smartclim = callPackage ../development/python-modules/beewi-smartclim { };
 
   before-after = callPackage ../development/python-modules/before-after { };
@@ -2590,6 +2592,8 @@ self: super: with self; {
 
   cleanvision = callPackage ../development/python-modules/cleanvision { };
 
+  clearpasspy = callPackage ../development/python-modules/clearpasspy { };
+
   cleo = callPackage ../development/python-modules/cleo { };
 
   clevercsv = callPackage ../development/python-modules/clevercsv { };
@@ -2694,6 +2698,8 @@ self: super: with self; {
 
   clustershell = callPackage ../development/python-modules/clustershell { };
 
+  clx-sdk-xms = callPackage ../development/python-modules/clx-sdk-xms { };
+
   cma = callPackage ../development/python-modules/cma { };
 
   cmaes = callPackage ../development/python-modules/cmaes { };
@@ -5880,6 +5886,8 @@ self: super: with self; {
 
   gitpython = callPackage ../development/python-modules/gitpython { };
 
+  gitterpy = callPackage ../development/python-modules/gitterpy { };
+
   giturlparse = callPackage ../development/python-modules/giturlparse { };
 
   glad = callPackage ../development/python-modules/glad { };
@@ -6272,6 +6280,8 @@ self: super: with self; {
   # built-in for pypi
   greenlet = if isPyPy then null else callPackage ../development/python-modules/greenlet { };
 
+  greenwavereality = callPackage ../development/python-modules/greenwavereality { };
+
   gremlinpython = callPackage ../development/python-modules/gremlinpython { };
 
   grep-ast = callPackage ../development/python-modules/grep-ast { };
@@ -6654,6 +6664,8 @@ self: super: with self; {
 
   hopcroftkarp = callPackage ../development/python-modules/hopcroftkarp { };
 
+  horimote = callPackage ../development/python-modules/horimote { };
+
   horizon-eda = callPackage ../development/python-modules/horizon-eda { inherit (pkgs) horizon-eda; };
 
   housekeeping = callPackage ../development/python-modules/housekeeping { };
@@ -6852,6 +6864,8 @@ self: super: with self; {
 
   ibm-watson = callPackage ../development/python-modules/ibm-watson { };
 
+  ibmiotf = callPackage ../development/python-modules/ibmiotf { };
+
   ical = callPackage ../development/python-modules/ical { };
 
   icalendar = callPackage ../development/python-modules/icalendar { };
@@ -8757,6 +8771,8 @@ self: super: with self; {
 
   luxtronik = callPackage ../development/python-modules/luxtronik { };
 
+  lw12 = callPackage ../development/python-modules/lw12 { };
+
   lxmf = callPackage ../development/python-modules/lxmf { };
 
   lxml = callPackage ../development/python-modules/lxml { inherit (pkgs) libxml2 libxslt zlib; };
@@ -9185,6 +9201,8 @@ self: super: with self; {
 
   micloud = callPackage ../development/python-modules/micloud { };
 
+  microbeespy = callPackage ../development/python-modules/microbeespy { };
+
   microdata = callPackage ../development/python-modules/microdata { };
 
   microsoft-kiota-abstractions =
@@ -10567,6 +10585,8 @@ self: super: with self; {
 
   num2words = callPackage ../development/python-modules/num2words { };
 
+  numato-gpio = callPackage ../development/python-modules/numato-gpio { };
+
   numba = callPackage ../development/python-modules/numba { inherit (pkgs.config) cudaSupport; };
 
   numba-scipy = callPackage ../development/python-modules/numba-scipy { };
@@ -10797,6 +10817,8 @@ self: super: with self; {
 
   openai-agents = callPackage ../development/python-modules/openai-agents { };
 
+  openai-harmony = callPackage ../development/python-modules/openai-harmony { };
+
   openai-whisper = callPackage ../development/python-modules/openai-whisper { };
 
   openaiauth = callPackage ../development/python-modules/openaiauth { };
@@ -11731,6 +11753,8 @@ self: super: with self; {
 
   pixel-ring = callPackage ../development/python-modules/pixel-ring { };
 
+  pizzapi = callPackage ../development/python-modules/pizzapi { };
+
   pjsua2 =
     (toPythonModule (
       pkgs.pjsip.override {
@@ -11829,6 +11853,8 @@ self: super: with self; {
 
   plumbum = callPackage ../development/python-modules/plumbum { };
 
+  plumlightpad = callPackage ../development/python-modules/plumlightpad { };
+
   pluthon = callPackage ../development/python-modules/pluthon { };
 
   plux = callPackage ../development/python-modules/plux { };
@@ -12024,6 +12050,8 @@ self: super: with self; {
 
   prodict = callPackage ../development/python-modules/prodict { };
 
+  progettihwsw = callPackage ../development/python-modules/progettihwsw { };
+
   proglog = callPackage ../development/python-modules/proglog { };
 
   progress = callPackage ../development/python-modules/progress { };
@@ -12595,6 +12623,8 @@ self: super: with self; {
 
   pycmarkgfm = callPackage ../development/python-modules/pycmarkgfm { };
 
+  pycmus = callPackage ../development/python-modules/pycmus { };
+
   pycocotools = callPackage ../development/python-modules/pycocotools { };
 
   pycodestyle = callPackage ../development/python-modules/pycodestyle { };
@@ -12775,6 +12805,8 @@ self: super: with self; {
 
   pyeapi = callPackage ../development/python-modules/pyeapi { };
 
+  pyebox = callPackage ../development/python-modules/pyebox { };
+
   pyebus = callPackage ../development/python-modules/pyebus { };
 
   pyecharts = callPackage ../development/python-modules/pyecharts { };
@@ -13094,6 +13126,8 @@ self: super: with self; {
 
   pyiqvia = callPackage ../development/python-modules/pyiqvia { };
 
+  pyirishrail = callPackage ../development/python-modules/pyirishrail { };
+
   pyisbn = callPackage ../development/python-modules/pyisbn { };
 
   pyisemail = callPackage ../development/python-modules/pyisemail { };
@@ -14539,6 +14573,8 @@ self: super: with self; {
 
   pytestcache = callPackage ../development/python-modules/pytestcache { };
 
+  pythinkingcleaner = callPackage ../development/python-modules/pythinkingcleaner { };
+
   python-aodhclient = callPackage ../development/python-modules/python-aodhclient { };
 
   python-apt = callPackage ../development/python-modules/python-apt { };
@@ -14581,6 +14617,8 @@ self: super: with self; {
 
   python-cinderclient = callPackage ../development/python-modules/python-cinderclient { };
 
+  python-clementine-remote = callPackage ../development/python-modules/python-clementine-remote { };
+
   python-codon-tables = callPackage ../development/python-modules/python-codon-tables { };
 
   python-coinmarketcap = callPackage ../development/python-modules/python-coinmarketcap { };
@@ -15509,6 +15547,8 @@ self: super: with self; {
 
   rarfile = callPackage ../development/python-modules/rarfile { inherit (pkgs) libarchive; };
 
+  raspyrfm-client = callPackage ../development/python-modules/raspyrfm-client { };
+
   rasterio = callPackage ../development/python-modules/rasterio { };
 
   ratarmount = callPackage ../development/python-modules/ratarmount { };
@@ -15816,6 +15856,8 @@ self: super: with self; {
 
   rfcat = callPackage ../development/python-modules/rfcat { };
 
+  rfk101py = callPackage ../development/python-modules/rfk101py { };
+
   rflink = callPackage ../development/python-modules/rflink { };
 
   rgpio = toPythonModule (
@@ -17811,6 +17853,8 @@ self: super: with self; {
 
   tappy = callPackage ../development/python-modules/tappy { };
 
+  tapsaff = callPackage ../development/python-modules/tapsaff { };
+
   tasklib = callPackage ../development/python-modules/tasklib { };
 
   taskw = callPackage ../development/python-modules/taskw { };
@@ -18447,6 +18491,8 @@ self: super: with self; {
 
   transmission-rpc = callPackage ../development/python-modules/transmission-rpc { };
 
+  travispy = callPackage ../development/python-modules/travispy { };
+
   trectools = callPackage ../development/python-modules/trectools { };
 
   tree-sitter = callPackage ../development/python-modules/tree-sitter { };
@@ -19773,6 +19819,8 @@ self: super: with self; {
 
   webidl = callPackage ../development/python-modules/webidl { };
 
+  webio-api = callPackage ../development/python-modules/webio-api { };
+
   weblate-language-data = callPackage ../development/python-modules/weblate-language-data { };
 
   weblate-schemas = callPackage ../development/python-modules/weblate-schemas { };
@@ -20184,6 +20232,8 @@ self: super: with self; {
 
   yeelight = callPackage ../development/python-modules/yeelight { };
 
+  yeelightsunflower = callPackage ../development/python-modules/yeelightsunflower { };
+
   yfinance = callPackage ../development/python-modules/yfinance { };
 
   yoda = toPythonModule (pkgs.yoda.override { python3 = python; });
@@ -20296,6 +20346,8 @@ self: super: with self; {
 
   zhon = callPackage ../development/python-modules/zhon { };
 
+  zhong-hong-hvac = callPackage ../development/python-modules/zhong-hong-hvac { };
+
   ziafont = callPackage ../development/python-modules/ziafont { };
 
   ziamath = callPackage ../development/python-modules/ziamath { };
diff --git a/pkgs/top-level/release-cuda.nix b/pkgs/top-level/release-cuda.nix
index 2574550342f3..e87cd289e7a1 100644
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@@ -86,6 +86,8 @@ let
       colmap = linux;
       ctranslate2 = linux;
       ffmpeg-full = linux;
+      firefox = linux;
+      firefox-unwrapped = linux;
       gimp = linux;
       gimp3 = linux;
       gpu-screen-recorder = linux;
@@ -112,6 +114,8 @@ let
       saga = linux;
       suitesparse = linux;
       sunshine = linux;
+      thunderbird = linux;
+      thunderbird-unwrapped = linux;
       truecrack-cuda = linux;
       tts = linux;
       ueberzugpp = linux; # Failed in https://github.com/NixOS/nixpkgs/pull/233581