diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index be3ed66528da..39f8ece163fa 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -27812,6 +27812,12 @@
     github = "YisuiDenghua";
     githubId = 102890144;
   };
+  yiyu = {
+    email = "yiyuzhou19@gmail.com";
+    name = "Yiyu Zhou";
+    github = "yzhou216";
+    githubId = 50000936;
+  };
   yl3dy = {
     email = "aleksandr.kiselyov@gmail.com";
     github = "yl3dy";
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 2fa9eb16d82b..536174daa08d 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -838,7 +838,11 @@ in
     # error that we’re trying to avoid can’t possibly happen if polkit isn’t enabled. When polkit isn’t
     # enabled, run0 will fail before it even tries to run the command.
     security.pam.services = mkIf config.security.polkit.enable {
-      systemd-run0 = { };
+      systemd-run0 = {
+        # Upstream config: https://github.com/systemd/systemd/blob/main/src/run/systemd-run0.in
+        setLoginUid = true;
+        pamMount = false;
+      };
     };
   };
 
diff --git a/nixos/tests/firefly-iii.nix b/nixos/tests/firefly-iii.nix
index 6c1ff99d9c91..41baf49f7735 100644
--- a/nixos/tests/firefly-iii.nix
+++ b/nixos/tests/firefly-iii.nix
@@ -6,7 +6,10 @@ let
 in
 {
   name = "firefly-iii";
-  meta.maintainers = [ lib.maintainers.savyajha ];
+  meta = {
+    maintainers = [ lib.maintainers.savyajha ];
+    platforms = lib.platforms.linux;
+  };
 
   nodes.fireflySqlite =
     { config, ... }:
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 80c185d12f65..3c8dd8d416f3 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -316,7 +316,9 @@ buildStdenv.mkDerivation {
       # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
       ./139-wayland-drag-animation.patch
     ]
-    ++ lib.optionals (lib.versionAtLeast version "139") [ ./139-relax-apple-sdk.patch ]
+    ++ lib.optionals (lib.versionAtLeast version "139" && lib.versionOlder version "142") [
+      ./139-relax-apple-sdk.patch
+    ]
     ++ lib.optionals (lib.versionOlder version "139") [
       # Fix for missing vector header on macOS
       # https://bugzilla.mozilla.org/show_bug.cgi?id=1959377
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 8dd14fbb7e1f..9b2c1ee89478 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = pname;
-  version = "141.0b9";
+  version = "142.0b3";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "b474898f3e5955c35fa8bef05ea27d68604aad5ec00e3417bfc586e8a6abd55b19d98515719997b179209a38a032cc96245c67acb2fd7df14d8a355b832c6b77";
+    sha512 = "707781fcc59798c0ecbf11532eac41f4f134f24b1d670234cf674e433525ca83fe4fff75874d1a16d2be2039959731e71a5aa56e727d2b46e5bc40f63277b188";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index c7e29fc1677f..e93b0cfff180 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = pname;
-  version = "141.0b9";
+  version = "142.0b3";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "0acb95c53c35d086aa777a96563e5cdc2838b8fedceeba344a2d4f5c9b0cbd148e8d1313463c35cf98fb52048bebd1b7a3aefc63e0d3ac9ae66de69fa25fc2e8";
+    sha512 = "5752c77307e59ad188385bb7bbb440e01a256f437088e051d1bc74e0ccdbde4ddf68c97fdcf0401c03636293753c5e8f7132352aed5f5e9e537c96eaf8784f21";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 9c9b70684474..7efbc8a9ea36 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -72,7 +72,11 @@ lib.extendMkDerivation {
     }@args:
 
     assert lib.assertMsg useFetchCargoVendor
-      "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05";
+      "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it";
+
+    assert lib.warnIf (args ? useFetchCargoVendor)
+      "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it"
+      true;
 
     lib.optionalAttrs (stdenv.hostPlatform.isDarwin && buildType == "debug") {
       RUSTFLAGS = "-C split-debuginfo=packed " + (args.RUSTFLAGS or "");
diff --git a/pkgs/by-name/as/asahi-fwextract/package.nix b/pkgs/by-name/as/asahi-fwextract/package.nix
new file mode 100644
index 000000000000..0db932bcaf0c
--- /dev/null
+++ b/pkgs/by-name/as/asahi-fwextract/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  gzip,
+  gnutar,
+  lzfse,
+  nix-update-script,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "asahi-fwextract";
+  version = "0.7.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "AsahiLinux";
+    repo = "asahi-installer";
+    tag = "v${version}";
+    hash = "sha256-vbhepoZ52k5tW2Gd7tfQTZ5CLqzhV7dUcVh6+AYwECk=";
+  };
+
+  postPatch = ''
+    substituteInPlace asahi_firmware/img4.py \
+      --replace-fail 'liblzfse.so' '${lzfse}/lib/liblzfse.so'
+    substituteInPlace asahi_firmware/update.py \
+      --replace-fail '"tar"' '"${gnutar}/bin/tar"' \
+      --replace-fail '"xf"' '"-x", "-I", "${gzip}/bin/gzip", "-f"'
+  '';
+
+  build-system = [ python3.pkgs.setuptools ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Asahi firmware extraction script";
+    homepage = "https://github.com/AsahiLinux/asahi-installer";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ normalcea ];
+    mainProgram = "asahi-fwextract";
+    platforms = [ "aarch64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/ba/bashunit/package.nix b/pkgs/by-name/ba/bashunit/package.nix
index b601f9000c1d..f7bb37bf26de 100644
--- a/pkgs/by-name/ba/bashunit/package.nix
+++ b/pkgs/by-name/ba/bashunit/package.nix
@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bashunit";
-  version = "0.19.1";
+  version = "0.22.2";
 
   src = fetchFromGitHub {
     owner = "TypedDevs";
     repo = "bashunit";
     tag = finalAttrs.version;
-    hash = "sha256-LoPtWf4Vo7hodWa0WJmqYDW7p7xJDrRZ5/qwUy/rB3U=";
+    hash = "sha256-neQ7/euCGn0u9ph4Z3vGsptayZ47cY0iG6FFRkwBFG0=";
     forceFetchGit = true; # needed to include the tests directory for the check phase
   };
 
diff --git a/pkgs/by-name/ca/cameradar/package.nix b/pkgs/by-name/ca/cameradar/package.nix
index aa44bf6eead4..ca5ec3f8a4c4 100644
--- a/pkgs/by-name/ca/cameradar/package.nix
+++ b/pkgs/by-name/ca/cameradar/package.nix
@@ -8,40 +8,28 @@
 
 buildGoModule rec {
   pname = "cameradar";
-  version = "5.0.2";
+  version = "5.0.4";
 
   src = fetchFromGitHub {
     owner = "Ullaakut";
     repo = "cameradar";
-    rev = "v${version}";
-    sha256 = "sha256-GOqmz/aiOLGMfs9rQBIEQSgBycPzhu8BohcAc2U+gBw=";
+    tag = "v${version}";
+    hash = "sha256-nfqgBUgcLjPLdn8hs1q0FLDBHbloeMKETDrv3a5SZq0=";
   };
 
   vendorHash = "sha256-AIi57DWMvAKl0PhuwHO/0cHoDKk5e0bJsqHYBka4NiU=";
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
+  nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [
-    curl
-  ];
+  buildInputs = [ curl ];
 
-  subPackages = [
-    "cmd/cameradar"
-  ];
-  # At least one test is outdated
-  #doCheck = false;
+  subPackages = [ "cmd/cameradar" ];
 
   meta = {
     description = "RTSP stream access tool";
     homepage = "https://github.com/Ullaakut/cameradar";
-    changelog = "https://github.com/Ullaakut/cameradar/releases/tag/v${version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/Ullaakut/cameradar/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
-    # Upstream issue, doesn't build with latest curl, see
-    # https://github.com/Ullaakut/cameradar/issues/320
-    # https://github.com/andelf/go-curl/issues/84
-    broken = true;
   };
 }
diff --git a/pkgs/by-name/cr/crosswords/package.nix b/pkgs/by-name/cr/crosswords/package.nix
index e1d6b54bfc4e..f2aa015e19f6 100644
--- a/pkgs/by-name/cr/crosswords/package.nix
+++ b/pkgs/by-name/cr/crosswords/package.nix
@@ -1,52 +1,60 @@
 {
   lib,
   stdenv,
-  fetchFromGitLab,
-  meson,
-  ninja,
-  pkg-config,
-  wrapGAppsHook4,
   desktop-file-utils,
-  libadwaita,
+  fetchFromGitLab,
   isocodes,
   json-glib,
+  libadwaita,
   libipuz,
+  meson,
+  ninja,
+  nix-update-script,
+  pkg-config,
+  shared-mime-info,
+  wrapGAppsHook4,
 }:
 
 stdenv.mkDerivation rec {
   pname = "crosswords";
-  version = "0.3.12";
+  version = "0.3.15";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "jrb";
     repo = "crosswords";
     rev = version;
-    hash = "sha256-3RL2LJdIHmDAjXaxqsE0n5UQMsuBJWEMoyAEoSBemR0=";
+    hash = "sha256-KcHcTjPoQNA5TBXnKgudjBTV/0JbeVMJ09XVAL7SizI=";
   };
 
   nativeBuildInputs = [
+    desktop-file-utils
     meson
     ninja
     pkg-config
+    shared-mime-info
     wrapGAppsHook4
-    desktop-file-utils
   ];
 
   buildInputs = [
-    libadwaita
     isocodes
     json-glib
+    libadwaita
     libipuz
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Crossword player and editor for GNOME";
     homepage = "https://gitlab.gnome.org/jrb/crosswords";
     changelog = "https://gitlab.gnome.org/jrb/crosswords/-/blob/${version}/NEWS.md?ref_type=tags";
     license = lib.licenses.gpl3Plus;
     mainProgram = "crosswords";
-    maintainers = with lib.maintainers; [ aleksana ];
+    maintainers = with lib.maintainers; [
+      aleksana
+      l0b0
+    ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/do/dolt/package.nix b/pkgs/by-name/do/dolt/package.nix
index 93cb834ea71d..bd41d5bc198d 100644
--- a/pkgs/by-name/do/dolt/package.nix
+++ b/pkgs/by-name/do/dolt/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "dolt";
-  version = "1.55.4";
+  version = "1.57.0";
 
   src = fetchFromGitHub {
     owner = "dolthub";
     repo = "dolt";
     rev = "v${version}";
-    sha256 = "sha256-zIbyGpr26WL90PPoX0lW01XcrR0rBqWyK1odREnjQV0=";
+    sha256 = "sha256-9N5QPqwO9mzWuNwfRH+prYlq6dKD2NdcHbOE8WJ04r8=";
   };
 
   modRoot = "./go";
   subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-MxYOrK7Wo6tHHsGiFR9V+RosKycm1K2e4HdX0gBkm7A=";
+  vendorHash = "sha256-4lV2IAL/pBC3xyxa6uVslCJY+XwjKviZb9Gp7QyKZR0=";
   proxyVendor = true;
   doCheck = false;
 
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index e0db25ed6308..b7294634a720 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "14.11.0";
+  version = "14.11.1";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-yOwIasMJ0kUGUwj1HN2oPIgu/U0PYT+UmoH8LLUh9EQ=";
+    hash = "sha256-2igmTOGheCMlBo2fKbKOpc+IFhwLcYKJ7u5evKl0buY=";
   };
 
-  npmDepsHash = "sha256-eLhlk/9RmyJg9fpFmQ53IE6m2TN46N801n85yeEDG2M=";
+  npmDepsHash = "sha256-9ysvVXaJbV2axsZn/TEAdDBPwoM8baI5jnMO9dH6JqE=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/by-name/gc/gcfflasher/package.nix b/pkgs/by-name/gc/gcfflasher/package.nix
index 8aac346b5eae..f236a6624048 100644
--- a/pkgs/by-name/gc/gcfflasher/package.nix
+++ b/pkgs/by-name/gc/gcfflasher/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   pkg-config,
   libgpiod,
   cmake,
@@ -10,22 +9,15 @@
 
 stdenv.mkDerivation rec {
   pname = "gcfflasher";
-  version = "4.8.0";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "dresden-elektronik";
     repo = "gcfflasher";
     tag = "v${version}";
-    hash = "sha256-W1sL3RyauEYAC/Fj0JhNnk0k5DT6Q8qIEuZNke3xNAE=";
+    hash = "sha256-ayPo8FHxlH/xaoIwjbATSYLtGJUJkSj0oS16QoMxsbc=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/dresden-elektronik/gcfflasher/commit/c1019d7ef2ab55a598ddd938db1b08169b05fc37.patch";
-      hash = "sha256-Frd3Xerkv3QolGCOrTE4AqBPqPHTKjjhk+DzhHABTqo=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     cmake
diff --git a/pkgs/by-name/ji/jitsi-meet-prosody/package.nix b/pkgs/by-name/ji/jitsi-meet-prosody/package.nix
index 76deae00bb45..f1b8c4365c55 100644
--- a/pkgs/by-name/ji/jitsi-meet-prosody/package.nix
+++ b/pkgs/by-name/ji/jitsi-meet-prosody/package.nix
@@ -8,10 +8,10 @@
 
 stdenv.mkDerivation rec {
   pname = "jitsi-meet-prosody";
-  version = "1.0.8648";
+  version = "1.0.8737";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "JqnLAAWEI57VR5DrQrz4XrIyHE1Z6P0AjtUaTNuWYLE=";
+    sha256 = "fZs1ng1mtxwXgJAQqxAlrNrqUQJc9fGlxJKwuTJLENc=";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/by-name/ku/kuzu/package.nix b/pkgs/by-name/ku/kuzu/package.nix
index e10520903525..a49c0b73884b 100644
--- a/pkgs/by-name/ku/kuzu/package.nix
+++ b/pkgs/by-name/ku/kuzu/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kuzu";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "kuzudb";
     repo = "kuzu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pAMXszaWlUJOg343XUQ+eMUk+yBE9Ksia0gyss36sUI=";
+    hash = "sha256-rRnzAEQhmqO8w+dN0liLGoHympgU5Q/qbsrJqzKpuTw=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libipuz/package.nix b/pkgs/by-name/li/libipuz/package.nix
index f1c62f408693..4648496425a4 100644
--- a/pkgs/by-name/li/libipuz/package.nix
+++ b/pkgs/by-name/li/libipuz/package.nix
@@ -1,31 +1,50 @@
 {
   lib,
   stdenv,
+  cargo,
   fetchFromGitLab,
+  gi-docgen,
+  glib,
+  gobject-introspection,
+  json-glib,
   meson,
   ninja,
+  nix-update-script,
   pkg-config,
-  glib,
-  json-glib,
+  rustPlatform,
 }:
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libipuz";
-  version = "0.4.5";
+  version = "0.5.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "jrb";
     repo = "libipuz";
-    rev = version;
-    hash = "sha256-psC2cFqSTlToCtCxwosXyJbmX/96AEI0xqzXtlc/HQE=";
+    rev = finalAttrs.version;
+    hash = "sha256-8bFMtqRD90SF9uT39Wkjf0eUef+0HgyrqY+DFA/xutI=";
+  };
+
+  cargoRoot = "libipuz/rust";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      pname
+      src
+      version
+      cargoRoot
+      ;
+    hash = "sha256-Aw/caE5Z5JxoKLEr2Dr2wq6cyFleNNwtKM1yXM8ZWmU=";
   };
 
   nativeBuildInputs = [
+    cargo
+    gi-docgen
+    glib
+    gobject-introspection
     meson
     ninja
     pkg-config
-    glib
+    rustPlatform.cargoSetupHook
   ];
 
   buildInputs = [
@@ -33,12 +52,20 @@ stdenv.mkDerivation rec {
     json-glib
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Library for parsing .ipuz puzzle files";
     homepage = "https://gitlab.gnome.org/jrb/libipuz";
-    changelog = "https://gitlab.gnome.org/jrb/libipuz/-/blob/${version}/NEWS.md?ref_type=tags";
-    license = lib.licenses.lgpl21Plus;
-    maintainers = with lib.maintainers; [ aleksana ];
+    changelog = "https://gitlab.gnome.org/jrb/libipuz/-/blob/${finalAttrs.version}/NEWS.md?ref_type=tags";
+    license = with lib.licenses; [
+      lgpl21Plus
+      mit
+    ];
+    maintainers = with lib.maintainers; [
+      aleksana
+      l0b0
+    ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/mc/mcomix/package.nix b/pkgs/by-name/mc/mcomix/package.nix
index 16ff2f73ff57..04537d5bea12 100644
--- a/pkgs/by-name/mc/mcomix/package.nix
+++ b/pkgs/by-name/mc/mcomix/package.nix
@@ -5,7 +5,7 @@
   gobject-introspection,
   gtk3,
   mcomix,
-  python3,
+  python312, # TODO: Revert to python3 when upgrading past 3.1.0
   testers,
   wrapGAppsHook3,
 
@@ -17,7 +17,7 @@
   unrarSupport ? false, # unfree software
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python312.pkgs.buildPythonApplication rec {
   pname = "mcomix";
   version = "3.1.0";
   pyproject = true;
@@ -34,12 +34,12 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    python3.pkgs.setuptools
+    python312.pkgs.setuptools
     wrapGAppsHook3
   ];
 
   propagatedBuildInputs =
-    with python3.pkgs;
+    with python312.pkgs;
     [
       pillow
       pycairo
diff --git a/pkgs/by-name/md/mdp/package.nix b/pkgs/by-name/md/mdp/package.nix
index cc36c93783de..d0a96c8796b1 100644
--- a/pkgs/by-name/md/mdp/package.nix
+++ b/pkgs/by-name/md/mdp/package.nix
@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.17";
+  version = "1.0.18";
   pname = "mdp";
 
   src = fetchFromGitHub {
     owner = "visit1985";
     repo = "mdp";
     rev = version;
-    sha256 = "sha256-g9+bqMoUpcRL1pcNqaeMR3l5uHuiEpDZj/6YmyOSn7k=";
+    sha256 = "sha256-7ltqnvNzdr+sJiiiCQpp25dzhOrcUCOAgMTt1RIgVTw=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/by-name/nb/nbdkit/package.nix b/pkgs/by-name/nb/nbdkit/package.nix
index 5a2adb276b48..4e11dbcb8c0e 100644
--- a/pkgs/by-name/nb/nbdkit/package.nix
+++ b/pkgs/by-name/nb/nbdkit/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nbdkit";
-  version = "1.42.1";
+  version = "1.44.1";
 
   src = fetchurl {
     url = "https://download.libguestfs.org/nbdkit/${lib.versions.majorMinor finalAttrs.version}-stable/nbdkit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Azi8dD59OLKrl0xakd92QdPHVdNYUyJ3FbclJqCZ4KE=";
+    hash = "sha256-WQRLqBtYkPBmeK2I4aCt1P7r78fjVLsCOnUEjml1lmM=";
   };
 
   prePatch = ''
diff --git a/pkgs/by-name/pa/parca-agent/package.nix b/pkgs/by-name/pa/parca-agent/package.nix
index 9c325b010aa0..1a6fd07e01e6 100644
--- a/pkgs/by-name/pa/parca-agent/package.nix
+++ b/pkgs/by-name/pa/parca-agent/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "parca-agent";
-  version = "0.39.2";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "parca-dev";
     repo = "parca-agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gg1xlvvIImqMxAGORdTEK7TQSTXrcJZLuinGoGmkS6E=";
+    hash = "sha256-dtDC0TlyYnoYpKiZ9gb9Dm75LA1r8040IUurnalkO4M=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-h1VyXBsUTOToPnsQq1Z3YA5EDJwz+xdap1i6ntRjccM=";
+  vendorHash = "sha256-10cfmMbNvaX2VksX0WOOHQAMgqfOXbkLXeXAy3b3fhU=";
 
   buildInputs = [
     stdenv.cc.libc.static
diff --git a/pkgs/by-name/so/sogo/package.nix b/pkgs/by-name/so/sogo/package.nix
index 3958eb7ba4ff..b36e3fea31f8 100644
--- a/pkgs/by-name/so/sogo/package.nix
+++ b/pkgs/by-name/so/sogo/package.nix
@@ -25,14 +25,14 @@
 
 clangStdenv.mkDerivation rec {
   pname = "sogo";
-  version = "5.12.1";
+  version = "5.12.3";
 
   # always update the sope package as well, when updating sogo
   src = fetchFromGitHub {
     owner = "Alinto";
     repo = "sogo";
     rev = "SOGo-${version}";
-    hash = "sha256-BBFo8h0YnE/qHbAwu+vHX+eu9f4WXMs1gQT2nAxiPgc=";
+    hash = "sha256-HTfe/ZiipqS6QdKQK0wf4Xl6xCTNw5fEdXfRFbBMWMY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/terminal-toys/package.nix b/pkgs/by-name/te/terminal-toys/package.nix
new file mode 100644
index 000000000000..a005cfb18fe5
--- /dev/null
+++ b/pkgs/by-name/te/terminal-toys/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "terminal-toys";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "Seebass22";
+    repo = "terminal-toys";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-G4UfX1B4TM4w5KQreCXIZh91o0Tvezhz0ZxojyXRtX8=";
+  };
+
+  cargoHash = "sha256-hjWPWNwZxJkuoFuEUuf7SOSJ4CEtqwCOV5ZM7CGtvfY=";
+
+  meta = {
+    description = "Screensavers for your terminal";
+    homepage = "https://github.com/Seebass22/terminal-toys";
+    changelog = "https://github.com/Seebass22/terminal-toys/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ yiyu ];
+    mainProgram = "terminal-toys";
+  };
+})
diff --git a/pkgs/by-name/ur/urn-timer/package.nix b/pkgs/by-name/ur/urn-timer/package.nix
index 8222cac03c2b..d65f97df0dc5 100644
--- a/pkgs/by-name/ur/urn-timer/package.nix
+++ b/pkgs/by-name/ur/urn-timer/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "urn-timer";
-  version = "0-unstable-2025-04-17";
+  version = "0-unstable-2025-07-21";
 
   src = fetchFromGitHub {
     owner = "paoloose";
     repo = "urn";
-    rev = "5eea3f9efb03758bfafcd029406797d34e4c875b";
-    hash = "sha256-rlUFZiA2fMa5QkKqKBRkiM8o2nioD0MPn6eJTJSJq3M=";
+    rev = "3e5d00cfb19c27e155e6bb03a11a70f1e89b0842";
+    hash = "sha256-FttQ9NffJQ8UjNaRUQ6kCDnDHp72q8eOmIhnoplwtYw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 5c0b04eba27d..6d774e0541fe 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -66,7 +66,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.5.3735.54";
+  version = "7.5.3735.56";
 
   suffix =
     {
@@ -79,8 +79,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-wgvqNeRrwPHmv4DNlo69mCJ+/cNOv2ZwvEnijTZke+s=";
-        x86_64-linux = "sha256-Wey4X3GUN1HnJsrEo0E/Zr7ozZiw8DyVYh2jQ67wFM0=";
+        aarch64-linux = "sha256-bHOmd5+YtSd8ZupIPOlPtTIJ5OrDcDMQSk6xq2Y811M=";
+        x86_64-linux = "sha256-yFaHtPTYAK/dOOTyWN8tDs7XJX93mg4OCt8dPd3ScJ8=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/wh/whisper-cpp/package.nix b/pkgs/by-name/wh/whisper-cpp/package.nix
index 9cd415a8bfaf..abf1ac8cfe25 100644
--- a/pkgs/by-name/wh/whisper-cpp/package.nix
+++ b/pkgs/by-name/wh/whisper-cpp/package.nix
@@ -72,13 +72,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "whisper-cpp";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "whisper.cpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tvCT0QRdmRGsjtQZcEZMgSe2/47tSkfdaPqS/2MuQTs=";
+    hash = "sha256-dppBhiCS4C3ELw/Ckx5W0KOMUvOHUiisdZvkS7gkxj4=";
   };
 
   # The upstream download script tries to download the models to the
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index 2e61baac1c6e..2bd1e2f0c586 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.11.0",
+    "version": "1.11.1",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-darwin-arm64-1.11.0.zip",
-    "sha256": "eb0f139db3eb30b93e53afb37ec3d52c9881e39fc100287c25c66452dcefa0c8"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/dbfeb42156b0fd886be70f8e65a180a1ff0ac4f9/Windsurf-darwin-arm64-1.11.1.zip",
+    "sha256": "1462db0940e850a0ca5ff6980e3e062e20473b92a793fb16e34a4064b64f4b35"
   },
   "x86_64-darwin": {
-    "version": "1.11.0",
+    "version": "1.11.1",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-darwin-x64-1.11.0.zip",
-    "sha256": "f020a9e23115043070ac6e4a15614d58967b65c5dc6a09918869ed20e37cddf3"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/dbfeb42156b0fd886be70f8e65a180a1ff0ac4f9/Windsurf-darwin-x64-1.11.1.zip",
+    "sha256": "e365e4e5fe87de1f6d34698cb6bc1a4462d6f849b145b554cf63681fcf3dc839"
   },
   "x86_64-linux": {
-    "version": "1.11.0",
+    "version": "1.11.1",
     "vscodeVersion": "1.99.3",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/7ebe3c84f46e15cc83584023b53a4988df13f475/Windsurf-linux-x64-1.11.0.tar.gz",
-    "sha256": "ff1b9a168c0d60be0f6a97ee9d22d443d5bb3384df69182ea485b7403f4f9d02"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/dbfeb42156b0fd886be70f8e65a180a1ff0ac4f9/Windsurf-linux-x64-1.11.1.tar.gz",
+    "sha256": "617558e5ebf51940a92fcb7dbc6ba7f642021465ebb64ee60f374e80b61c7c25"
   }
 }
diff --git a/pkgs/by-name/yo/yosys/package.nix b/pkgs/by-name/yo/yosys/package.nix
index 66107035aec5..de1b7f3f5227 100644
--- a/pkgs/by-name/yo/yosys/package.nix
+++ b/pkgs/by-name/yo/yosys/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
 
   # nativeBuildInputs
   bison,
@@ -134,6 +135,14 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   patches = [
+    # Backport fix amaranth code compilation
+    # TODO remove when updating to 0.56
+    # https://github.com/YosysHQ/yosys/pull/5182
+    (fetchpatch2 {
+      name = "treat-zero-width-constant-as-zero.patch";
+      url = "https://github.com/YosysHQ/yosys/commit/478b6a2b3fbab0fd4097b841914cbe8bb9f67268.patch";
+      hash = "sha256-KeLoZfkXMk2KIPN9XBQdqWqohywQONlWUIvrGwgphKs=";
+    })
     ./plugin-search-dirs.patch
     ./fix-clang-build.patch
   ];
diff --git a/pkgs/development/python-modules/pyscf/coerce-numpy-to-int.patch b/pkgs/development/python-modules/pyscf/coerce-numpy-to-int.patch
deleted file mode 100644
index 140e6d77b1f0..000000000000
--- a/pkgs/development/python-modules/pyscf/coerce-numpy-to-int.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-commit 6df405512d33d432bb45553ddcffbc70edec51f6
-Author: Lein Matsumaru <applePrincess@applePrincess.io>
-Date:   Sun Jun 29 12:59:57 2025 +0000
-
-    Coerce int
-
-diff --git a/pyscf/ci/gcisd.py b/pyscf/ci/gcisd.py
-index d58e0364c..050f83962 100644
---- a/pyscf/ci/gcisd.py
-+++ b/pyscf/ci/gcisd.py
-@@ -197,7 +197,7 @@ def from_fcivec(ci0, nelec, orbspin, frozen=None):
-              numpy.count_nonzero(orbspin[:nelec] == 1))
-     ucisdvec = ucisd.from_fcivec(ci0, norb//2, nelec, frozen)
-     nocc = numpy.count_nonzero(~frozen_mask[:sum(nelec)])
--    return from_ucisdvec(ucisdvec, nocc, orbspin[~frozen_mask])
-+    return from_ucisdvec(ucisdvec, int(nocc), orbspin[~frozen_mask])
- 
- 
- def make_rdm1(myci, civec=None, nmo=None, nocc=None, ao_repr=False):
diff --git a/pkgs/development/python-modules/pyscf/default.nix b/pkgs/development/python-modules/pyscf/default.nix
index d94587b6ac10..10075479f7e4 100644
--- a/pkgs/development/python-modules/pyscf/default.nix
+++ b/pkgs/development/python-modules/pyscf/default.nix
@@ -24,22 +24,16 @@
 
 buildPythonPackage rec {
   pname = "pyscf";
-  version = "2.9.0";
+  version = "2.10.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pyscf";
     repo = "pyscf";
     tag = "v${version}";
-    hash = "sha256-UTeZXlNuSWDOcBRVbUUWJ3mQnZZQr17aTw6rRA5DRNI=";
+    hash = "sha256-lFYSWCe5THlivpBB6nFBR2zfCIKJ0YJeuY2rCKoXUq8=";
   };
 
-  patches = [
-    # Converts numpy.int64 to int where necessary.
-    # Upstream issue: https://github.com/pyscf/pyscf/issues/2878
-    ./coerce-numpy-to-int.patch
-  ];
-
   # setup.py calls Cmake and passes the arguments in CMAKE_CONFIGURE_ARGS to cmake.
   build-system = [ cmake ];
   dontUseCmakeConfigure = true;
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 089630b5f18c..e36271b47a48 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -663,6 +663,18 @@ in
     ];
   };
 
+  ubootRadxaZero3W = buildUBoot {
+    defconfig = "radxa-zero-3-rk3566_defconfig";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    BL31 = "${armTrustedFirmwareRK3568}/bl31.elf";
+    ROCKCHIP_TPL = rkbin.TPL_RK3566;
+    filesToInstall = [
+      "idbloader.img"
+      "u-boot.itb"
+      "u-boot-rockchip.bin"
+    ];
+  };
+
   ubootRaspberryPi = buildUBoot {
     defconfig = "rpi_defconfig";
     extraMeta.platforms = [ "armv6l-linux" ];
diff --git a/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix b/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
index 1e07f15ef4fa..4da372a027b7 100644
--- a/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/findcrypt/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGhidraExtension (finalAttrs: {
   pname = "findcrypt";
-  version = "3.0.6";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "antoniovazquezblanco";
     repo = "GhidraFindcrypt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-VWi1MP72Vl4XCrbTvRA6qYPk2QyvRyVb9N8QQ/Zml0A=";
+    hash = "sha256-hhcKve3Nw9L+/jHYaJmWtTxwyeH4ZMu0qOgCkpSMU6U=";
   };
 
   meta = {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c3684c78a7e9..2ce000cfa021 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11348,6 +11348,7 @@ with pkgs;
     ubootQemuX86
     ubootQemuX86_64
     ubootQuartz64B
+    ubootRadxaZero3W
     ubootRaspberryPi
     ubootRaspberryPi2
     ubootRaspberryPi3_32bit