diff --git a/ci/github-script/labels.js b/ci/github-script/labels.js
index 7bbe1497d906..d7dbc2b2375c 100644
--- a/ci/github-script/labels.js
+++ b/ci/github-script/labels.js
@@ -292,11 +292,16 @@ module.exports = async function ({ github, context, core, dry }) {
         })
       ).data.workflow_runs[0]
 
-      // Go back as far as the last successful run of this workflow to make sure
-      // we are not leaving anyone behind on GHA failures.
-      // Defaults to go back 1 hour on the first run.
       const cutoff = new Date(
-        lastRun?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000,
+        Math.max(
+          // Go back as far as the last successful run of this workflow to make sure
+          // we are not leaving anyone behind on GHA failures.
+          // Defaults to go back 1 hour on the first run.
+          new Date(lastRun?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000).getTime(),
+          // Go back max. 1 day to prevent hitting all API rate limits immediately,
+          // when GH API returns a wrong workflow by accident.
+          new Date().getTime() - 24 * 60 * 60 * 1000,
+        ),
       )
       core.info('cutoff timestamp: ' + cutoff.toISOString())
 
@@ -308,6 +313,7 @@ module.exports = async function ({ github, context, core, dry }) {
             'is:open',
             `updated:>=${cutoff.toISOString()}`,
           ].join(' AND '),
+          per_page: 100,
           // TODO: Remove in 2025-10, when it becomes the default.
           advanced_search: true,
         },
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a7d8467e28ce..95bdc8434abc 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25980,6 +25980,11 @@
     githubId = 57819359;
     name = "Binh Nguyen";
   };
+  tuynia = {
+    github = "mivorasu";
+    githubId = 221005165;
+    name = "Qylia Vorlaque";
+  };
   tv = {
     email = "tv@krebsco.de";
     github = "4z3";
diff --git a/nixos/doc/manual/development/writing-nixos-tests.section.md b/nixos/doc/manual/development/writing-nixos-tests.section.md
index f69ea279abb5..9751dbd7ff49 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.section.md
+++ b/nixos/doc/manual/development/writing-nixos-tests.section.md
@@ -343,6 +343,15 @@ source: @NIXOS_TEST_OPTIONS_JSON@
 
 ## Accessing VMs in the sandbox with SSH {#sec-test-sandbox-breakpoint}
 
+::: {.note}
+For debugging with SSH access into the machines, it's recommended to try using
+[the interactive driver](#sec-running-nixos-tests-interactively) with its
+[SSH backdoor](#sec-nixos-test-ssh-access) first.
+
+This feature is mostly intended to debug flaky test failures that aren't
+reproducible elsewhere.
+:::
+
 As explained in [](#sec-nixos-test-ssh-access), it's possible to configure an
 SSH backdoor based on AF_VSOCK. This can be used to SSH into a VM of a running
 build in a sandbox.
diff --git a/nixos/modules/services/printing/cupsd.nix b/nixos/modules/services/printing/cupsd.nix
index a0932f131ec4..9e1ab0abef4b 100644
--- a/nixos/modules/services/printing/cupsd.nix
+++ b/nixos/modules/services/printing/cupsd.nix
@@ -71,7 +71,7 @@ let
     };
 
   cupsFilesFile = writeConf "cups-files.conf" ''
-    SystemGroup root wheel
+    SystemGroup root wheel lpadmin
 
     ServerBin ${bindir}/lib/cups
     DataDir ${bindir}/share/cups
@@ -361,10 +361,15 @@ in
 
   config = mkIf config.services.printing.enable {
 
-    users.users.cups = {
-      uid = config.ids.uids.cups;
-      group = "lp";
-      description = "CUPS printing services";
+    users = {
+      users.cups = {
+        uid = config.ids.uids.cups;
+        group = "lp";
+        description = "CUPS printing services";
+      };
+
+      # It seems that groups provided for `SystemGroup` must exist
+      groups.lpadmin = { };
     };
 
     # We need xdg-open (part of xdg-utils) for the desktop-file to proper open the users default-browser when opening "Manage Printing"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 166dbbdca2e5..fd7caf0bacf6 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1331,7 +1331,7 @@ in
   ssh-audit = runTest ./ssh-audit.nix;
   sssd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd.nix { };
   sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix { };
-  stalwart-mail = runTest ./stalwart-mail.nix;
+  stalwart-mail = runTest ./stalwart/stalwart-mail.nix;
   stargazer = runTest ./web-servers/stargazer.nix;
   starship = runTest ./starship.nix;
   stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix { };
diff --git a/nixos/tests/stalwart/stalwart-mail-config.nix b/nixos/tests/stalwart/stalwart-mail-config.nix
new file mode 100644
index 000000000000..800090ab5949
--- /dev/null
+++ b/nixos/tests/stalwart/stalwart-mail-config.nix
@@ -0,0 +1,81 @@
+{ pkgs, lib, ... }:
+
+let
+  certs = import ../common/acme/server/snakeoil-certs.nix;
+  domain = certs.domain;
+in
+{
+  security.pki.certificateFiles = [ certs.ca.cert ];
+
+  services.stalwart-mail = {
+    enable = true;
+    settings = {
+      server.hostname = domain;
+
+      certificate."snakeoil" = {
+        cert = "%{file:${certs.${domain}.cert}}%";
+        private-key = "%{file:${certs.${domain}.key}}%";
+      };
+
+      server.tls = {
+        certificate = "snakeoil";
+        enable = true;
+        implicit = false;
+      };
+
+      server.listener = {
+        "smtp-submission" = {
+          bind = [ "[::]:587" ];
+          protocol = "smtp";
+        };
+
+        "imap" = {
+          bind = [ "[::]:143" ];
+          protocol = "imap";
+        };
+
+        "http" = {
+          bind = [ "[::]:80" ];
+          protocol = "http";
+        };
+      };
+
+      session.auth.mechanisms = "[plain]";
+      session.auth.directory = "'in-memory'";
+      storage.directory = "in-memory";
+
+      storage.data = "rocksdb";
+      storage.fts = "rocksdb";
+      storage.blob = "rocksdb";
+      storage.lookup = "rocksdb";
+
+      session.rcpt.directory = "'in-memory'";
+      queue.outbound.next-hop = "'local'";
+
+      store."rocksdb" = {
+        type = "rocksdb";
+        path = "/var/lib/stalwart-mail/data";
+        compression = "lz4";
+      };
+
+      directory."in-memory" = {
+        type = "memory";
+        principals = [
+          {
+            class = "individual";
+            name = "alice";
+            secret = "foobar";
+            email = [ "alice@${domain}" ];
+          }
+          {
+            class = "individual";
+            name = "bob";
+            secret = "foobar";
+            email = [ "bob@${domain}" ];
+          }
+        ];
+      };
+    };
+  };
+
+}
diff --git a/nixos/tests/stalwart-mail.nix b/nixos/tests/stalwart/stalwart-mail.nix
similarity index 53%
rename from nixos/tests/stalwart-mail.nix
rename to nixos/tests/stalwart/stalwart-mail.nix
index 4eef33e63e81..f7b733f7f658 100644
--- a/nixos/tests/stalwart-mail.nix
+++ b/nixos/tests/stalwart/stalwart-mail.nix
@@ -3,9 +3,8 @@
 # - serve this message through IMAP.
 
 let
-  certs = import ./common/acme/server/snakeoil-certs.nix;
+  certs = import ../common/acme/server/snakeoil-certs.nix;
   domain = certs.domain;
-
 in
 { lib, ... }:
 {
@@ -14,78 +13,9 @@ in
   nodes.main =
     { pkgs, ... }:
     {
-      security.pki.certificateFiles = [ certs.ca.cert ];
-
-      services.stalwart-mail = {
-        enable = true;
-        settings = {
-          server.hostname = domain;
-
-          certificate."snakeoil" = {
-            cert = "%{file:${certs.${domain}.cert}}%";
-            private-key = "%{file:${certs.${domain}.key}}%";
-          };
-
-          server.tls = {
-            certificate = "snakeoil";
-            enable = true;
-            implicit = false;
-          };
-
-          server.listener = {
-            "smtp-submission" = {
-              bind = [ "[::]:587" ];
-              protocol = "smtp";
-            };
-
-            "imap" = {
-              bind = [ "[::]:143" ];
-              protocol = "imap";
-            };
-
-            "http" = {
-              bind = [ "[::]:80" ];
-              protocol = "http";
-            };
-          };
-
-          session.auth.mechanisms = "[plain]";
-          session.auth.directory = "'in-memory'";
-          storage.directory = "in-memory";
-
-          storage.data = "rocksdb";
-          storage.fts = "rocksdb";
-          storage.blob = "rocksdb";
-          storage.lookup = "rocksdb";
-
-          session.rcpt.directory = "'in-memory'";
-          queue.outbound.next-hop = "'local'";
-
-          store."rocksdb" = {
-            type = "rocksdb";
-            path = "/var/lib/stalwart-mail/data";
-            compression = "lz4";
-          };
-
-          directory."in-memory" = {
-            type = "memory";
-            principals = [
-              {
-                class = "individual";
-                name = "alice";
-                secret = "foobar";
-                email = [ "alice@${domain}" ];
-              }
-              {
-                class = "individual";
-                name = "bob";
-                secret = "foobar";
-                email = [ "bob@${domain}" ];
-              }
-            ];
-          };
-        };
-      };
+      imports = [
+        ./stalwart-mail-config.nix
+      ];
 
       environment.systemPackages = [
         (pkgs.writers.writePython3Bin "test-smtp-submission" { } ''
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 8d2d915d60e5..c0bd3fb5c3a6 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4055,6 +4055,8 @@ let
 
       reditorsupport.r = callPackage ./reditorsupport.r { };
 
+      release-candidate.vscode-scheme-repl = callPackage ./release-candidate.vscode-scheme-repl { };
+
       reloadedextensions.reloaded-cpp = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "reloaded-cpp";
@@ -4929,6 +4931,8 @@ let
         };
       };
 
+      tsyesika.guile-scheme-enhanced = callPackage ./tsyesika.guile-scheme-enhanced { };
+
       tuttieee.emacs-mcx = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "emacs-mcx";
@@ -4983,6 +4987,8 @@ let
         };
       };
 
+      ufo5260987423.magic-scheme = callPackage ./ufo5260987423.magic-scheme { };
+
       uiua-lang.uiua-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "uiua-vscode";
diff --git a/pkgs/applications/editors/vscode/extensions/release-candidate.vscode-scheme-repl/default.nix b/pkgs/applications/editors/vscode/extensions/release-candidate.vscode-scheme-repl/default.nix
new file mode 100644
index 000000000000..234508bd76eb
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/release-candidate.vscode-scheme-repl/default.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  vscode-utils,
+  jq,
+  chez,
+  moreutils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "release-candidate";
+    name = "vscode-scheme-repl";
+    version = "0.7.4";
+    hash = "sha256-Pfy0aJXq8I53o5mG4dfzyqsyLQX0bs+phBgN46yU/Yw=";
+  };
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    ${lib.getExe jq} '.contributes.configuration.properties."chezScheme.schemePath" = "${lib.getExe' chez "scheme"}"' package.json | ${lib.getExe' moreutils "sponge"} package.json
+  '';
+
+  meta = {
+    description = "Uses REPL for autocompletions and to evaluate expressions";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=release-candidate.vscode-scheme-repl";
+    homepage = "https://github.com/Release-Candidate/vscode-scheme-repl";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tuynia ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/tsyesika.guile-scheme-enhanced/default.nix b/pkgs/applications/editors/vscode/extensions/tsyesika.guile-scheme-enhanced/default.nix
new file mode 100644
index 000000000000..ceb3b3706f0b
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/tsyesika.guile-scheme-enhanced/default.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  vscode-utils,
+  jq,
+  guile,
+  moreutils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "tsyesika";
+    name = "guile-scheme-enhanced";
+    version = "0.0.2";
+    hash = "sha256-uoHYfbLeANHnMB7OgDQPfIIlNN7LgERS9zQfa+QIk0M=";
+  };
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    ${lib.getExe jq} '.contributes.configuration.properties."guileScheme.guileREPLCommand".default = "${lib.getExe' guile "guile"}"' package.json | ${lib.getExe' moreutils "sponge"} package.json
+  '';
+
+  meta = {
+    description = "Better experience for working with scheme";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=tsyesika.guile-scheme-enhanced";
+    homepage = "https://codeberg.org/tsyesika/vscode-guile-scheme-enhanced";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ tuynia ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/ufo5260987423.magic-scheme/default.nix b/pkgs/applications/editors/vscode/extensions/ufo5260987423.magic-scheme/default.nix
new file mode 100644
index 000000000000..318bd03ab95c
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ufo5260987423.magic-scheme/default.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  vscode-utils,
+  jq,
+  akkuPackages,
+  chez,
+  akku,
+  moreutils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ufo5260987423";
+    name = "magic-scheme";
+    version = "0.0.5";
+    hash = "sha256-br1Vr4gIC2Zo74NHyCLTJL+GCjFzdOZh2oXIXZdJuRw=";
+  };
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    ${lib.getExe jq} '.contributes.configuration.properties."magicScheme.scheme-langserver.serverPath".default = "${lib.getExe' akkuPackages.scheme-langserver "scheme-langserver"}" | .contributes.configuration.properties."magicScheme.scheme.path".default = "${lib.getExe' chez "scheme"}" | .contributes.configuration.properties."magicScheme.akku.path".default = "${lib.getExe akku}"' package.json | ${lib.getExe' moreutils "sponge"} package.json
+  '';
+
+  meta = {
+    description = "Adds support for Scheme(r6rs standard)";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ufo5260987423.magic-scheme";
+    homepage = "https://github.com/ufo5260987423/magic-scheme";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tuynia ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
index 0c096a93a107..b146f9026926 100644
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-/6V4hjwp3Vy4WEwTtcYvJk6Rt3AIeKqXWJ09Zsp9CZg=";
+          hash = "sha256-QOMJIhgc/dixPDUmir7bq5dWYGUfEWHJOlgTbGkxuDo=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-bMwiMIhsvF6Q12vCgt9Os109acqW8Ovpt3o9Y8Sf+gk=";
+          hash = "sha256-CucMSzmeYdrSbXZbevyJb3M2oTkyatddAt2MUMXNwl0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-SwBHNKqif3mGqNSF6Y100HCDaLmARe0jApPol7AzsOQ=";
+          hash = "sha256-Lv/Hqp5OGC66qdIj/5VPlj434ftK4BBHNWlgg2ZAAac=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-SGTQdjvrXkEaCuHv9dfJfCBUgkfOtf+kLPiHYAqJ7+8=";
+          hash = "sha256-KuAT8+8t6YlQ4VygtxGindvSRs1x7oKT9ZgE7Vhvf8I=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.15.4";
+      version = "0.16.1";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index dba00724a2b6..477f18a4fb36 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -38,14 +38,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.7.9";
+  version = "1.7.10";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nIu6JrFqJ1QsALei9Bmrs6Bd2qM/37nb0ouxDymMN8k=";
+    hash = "sha256-ik/UKemhSuhe3oXPPLAR/qKO7J4Mq35zimixVHNj7go=";
   };
 
   buildInputs =
diff --git a/pkgs/applications/networking/browsers/firefox/mobile-config.nix b/pkgs/applications/networking/browsers/firefox/mobile-config.nix
index db88c0931201..027be201c3b3 100644
--- a/pkgs/applications/networking/browsers/firefox/mobile-config.nix
+++ b/pkgs/applications/networking/browsers/firefox/mobile-config.nix
@@ -7,113 +7,46 @@
 
 let
   pkg = fetchFromGitLab {
+    domain = "gitlab.postmarketos.org";
     owner = "postmarketOS";
     repo = "mobile-config-firefox";
-    rev = "ff2f07873f4ebc6e220da0e9b9f04c69f451edda";
-    sha256 = "sha256-8wRz8corz00+0qROMiOmZAddM4tjfmE91bx0+P8JNx4=";
+    rev = "4.6.0";
+    hash = "sha256-tISfxN/04spgtKStkkn+zlCtFU6GbtwuZubqpGN2olA=";
   };
-  userChrome = runCommand "userChrome.css" { } ''
-    cat ${pkg}/src/userChrome/*.css > $out
+  mobileConfigDir = runCommand "mobile-config-firefox" { } ''
+    mkdir -p $out/mobile-config-firefox/{common,userChrome,userContent}
+
+    cp ${pkg}/src/common/*.css $out/mobile-config-firefox/common/
+    cp ${pkg}/src/userChrome/*.css $out/mobile-config-firefox/userChrome/
+    cp ${pkg}/src/userContent/*.css $out/mobile-config-firefox/userContent/
+
+    (cd $out/mobile-config-firefox && find common -name "*.css" | sort) >> $out/mobile-config-firefox/userChrome.files
+    (cd $out/mobile-config-firefox && find common -name "*.css" | sort) >> $out/mobile-config-firefox/userContent.files
+
+    (cd $out/mobile-config-firefox && find userChrome -name "*.css" | sort) > $out/mobile-config-firefox/userChrome.files
+    (cd $out/mobile-config-firefox && find userContent -name "*.css" | sort) > $out/mobile-config-firefox/userContent.files
+
   '';
-  userContent = runCommand "userContent.css" { } ''
-    cat ${pkg}/src/userContent/*.css > $out
+
+  mobileConfigAutoconfig = runCommand "mobile-config-autoconfig.js" { } ''
+    substitute ${pkg}/src/mobile-config-autoconfig.js $out \
+      --replace "/etc/mobile-config-firefox" "${mobileConfigDir}/mobile-config-firefox"
+  '';
+
+  mobileConfigPrefs = runCommand "mobile-config-prefs.js" { } ''
+    # Remove the autoconfig setup lines since we handle that through extraPrefsFiles
+    grep -v "general.config.filename" ${pkg}/src/mobile-config-prefs.js | \
+    grep -v "general.config.obscure_value" | \
+    grep -v "general.config.sandbox_enabled" > $out
   '';
 in
 wrapFirefox firefox-unwrapped {
-  # extraPolicies = (lib.importJSON "${pkg}/src/policies.json").policies;
-  extraPoliciesFiles = [ "${pkg}/src/policies.json" ];
-  extraPrefs = ''
-    // Copyright 2022 Arnaud Ferraris, Oliver Smith
-    // SPDX-License-Identifier: MPL-2.0
+  extraPrefsFiles = [
+    mobileConfigAutoconfig
+    mobileConfigPrefs
+  ];
 
-    // This is a Firefox autoconfig file:
-    // https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig
-
-    // Import custom userChrome.css on startup or new profile creation
-    const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
-    Cu.import("resource://gre/modules/Services.jsm");
-    Cu.import("resource://gre/modules/FileUtils.jsm");
-
-    var updated = false;
-
-    // Create <profile>/chrome/ directory if not already present
-    var chromeDir = Services.dirsvc.get("ProfD", Ci.nsIFile);
-    chromeDir.append("chrome");
-    if (!chromeDir.exists()) {
-        chromeDir.create(Ci.nsIFile.DIRECTORY_TYPE, FileUtils.PERMS_DIRECTORY);
-    }
-
-    // Create nsIFile objects for userChrome.css in <profile>/chrome/ and in /etc/
-    var chromeFile = chromeDir.clone();
-    chromeFile.append("userChrome.css");
-    var defaultChrome = new FileUtils.File("${userChrome}");
-
-    // No auto-upgrade. Should this be replaced with symlinking?
-    // // Remove the existing userChrome.css if older than the installed one
-    // if (chromeFile.exists() && defaultChrome.exists() &&
-    //   chromeFile.lastModifiedTime < defaultChrome.lastModifiedTime) {
-    //   chromeFile.remove(false);
-    // }
-
-    // Copy userChrome.css to <profile>/chrome/
-    if (!chromeFile.exists()) {
-      defaultChrome.copyTo(chromeDir, "userChrome.css");
-      updated = true;
-    }
-
-    // Create nsIFile objects for userContent.css in <profile>/chrome/ and in /etc/
-    var contentFile = chromeDir.clone();
-    contentFile.append("userContent.css");
-    var defaultContent = new FileUtils.File("${userContent}");
-
-    // No auto-upgrade. Should this be replaced with symlinking?
-    // // Remove the existing userContent.css if older than the installed one
-    // if (contentFile.exists() && defaultContent.exists() &&
-    //   contentFile.lastModifiedTime < defaultContent.lastModifiedTime) {
-    //   contentFile.remove(false);
-    // }
-
-    // Copy userContent.css to <profile>/chrome/
-    if (!contentFile.exists()) {
-      defaultContent.copyTo(chromeDir, "userContent.css");
-      updated = true;
-    }
-
-    // Restart Firefox immediately if one of the files got updated
-    if (updated === true) {
-        var appStartup = Cc["@mozilla.org/toolkit/app-startup;1"].getService(Ci.nsIAppStartup);
-        appStartup.quit(Ci.nsIAppStartup.eForceQuit | Ci.nsIAppStartup.eRestart);
-    }
-
-    defaultPref('general.useragent.override', 'Mozilla/5.0 (Android 11; Mobile; rv:96.0) Gecko/96.0 Firefox/96.0');
-    defaultPref('browser.urlbar.suggest.topsites', false);
-    defaultPref('browser.urlbar.suggest.engines', false);
-    defaultPref('browser.newtabpage.enabled', true);
-
-    // Enable android-style pinch-to-zoom
-    pref('dom.w3c.touch_events.enabled', true);
-    pref('apz.allow_zooming', true);
-    pref('apz.allow_double_tap_zooming', true);
-
-    // Save vertical space by hiding the titlebar
-    pref('browser.tabs.inTitlebar', 1);
-
-    // Disable search suggestions
-    pref('browser.search.suggest.enabled', false);
-
-    // Empty new tab page: faster, less distractions
-    pref('browser.newtabpage.enabled', false);
-
-    // Allow UI customizations with userChrome.css and userContent.css
-    pref('toolkit.legacyUserProfileCustomizations.stylesheets', true);
-
-    // Select the entire URL with one click
-    pref('browser.urlbar.clickSelectsAll', true);
-
-    // Disable cosmetic animations, save CPU
-    pref('toolkit.cosmeticAnimations.enabled', false);
-
-    // Disable download animations, save CPU
-    pref('browser.download.animateNotifications', false);
-  '';
+  extraPoliciesFiles = [
+    "${pkg}/src/policies.json"
+  ];
 }
diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix
index 1dc5effb7044..6a6b819f2770 100644
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@@ -73,9 +73,9 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  virtualboxVersion = "7.1.10";
+  virtualboxVersion = "7.1.12";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "7d60010a4c9102613554b46f61d17b825c30ee59d8be071e52d8aac664ca9869";
+  virtualboxSha256 = "6f9618f39168898134975f51df7c2d6d5129c0aa82b6ae11cf47f920c70df276";
 
   kvmPatchVersion = "20250207";
   kvmPatchHash = "sha256-GzRLIXhzWL1NLvaGKcWVBCdvay1IxgJUE4koLX1ze7Y=";
@@ -247,8 +247,8 @@ stdenv.mkDerivation (finalAttrs: {
     ++ optional enableKvm (
       let
         patchVboxVersion =
-          # There is no updated patch for 7.1.10 yet, but the older one still applies.
-          if finalAttrs.virtualboxVersion == "7.1.10" then "7.1.6" else finalAttrs.virtualboxVersion;
+          # There is no updated patch for 7.1.12 yet, but the older one still applies.
+          if finalAttrs.virtualboxVersion == "7.1.12" then "7.1.6" else finalAttrs.virtualboxVersion;
       in
       fetchpatch {
         name = "virtualbox-${finalAttrs.virtualboxVersion}-kvm-dev-${finalAttrs.kvmPatchVersion}.patch";
diff --git a/pkgs/applications/virtualization/virtualbox/extpack.nix b/pkgs/applications/virtualization/virtualbox/extpack.nix
index 3d771d975798..ffa0b896eda0 100644
--- a/pkgs/applications/virtualization/virtualbox/extpack.nix
+++ b/pkgs/applications/virtualization/virtualbox/extpack.nix
@@ -4,7 +4,7 @@
   virtualbox,
 }:
 let
-  virtualboxExtPackVersion = "7.1.10";
+  virtualboxExtPackVersion = "7.1.12";
 in
 fetchurl rec {
   name = "Oracle_VirtualBox_Extension_Pack-${virtualboxExtPackVersion}.vbox-extpack";
@@ -14,7 +14,7 @@ fetchurl rec {
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://www.virtualbox.org/download/hashes/${version}/SHA256SUMS
     let
-      value = "e020755711849fa0ee23d3bc47bc90cb0ea595da7dda804499568a0dc2387989";
+      value = "c7ed97f4755988ecc05ec633475e299bbc1e0418cc3d143747a45c99df53abd3";
     in
     assert (builtins.stringLength value) == 64;
     value;
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix
index d78248dbb752..f0b46ad56772 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix
@@ -5,7 +5,7 @@
 }:
 fetchurl {
   url = "http://download.virtualbox.org/virtualbox/${virtualboxVersion}/VBoxGuestAdditions_${virtualboxVersion}.iso";
-  sha256 = "59c92f7f5fd7e081211e989f5117fc53ad8d8800ad74a01b21e97bb66fe62972";
+  sha256 = "256883e2eabf7ab5c10fb3b6831c294942ce34bc615807f9d0cf6c3d2e882236";
   meta = {
     description = "Guest additions ISO for VirtualBox";
     longDescription = ''
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index 3d8cbf6fe5f3..3d69d726dbe5 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -12,9 +12,9 @@
   libX11,
 }:
 let
-  virtualboxVersion = "7.1.10";
+  virtualboxVersion = "7.1.12";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "7d60010a4c9102613554b46f61d17b825c30ee59d8be071e52d8aac664ca9869";
+  virtualboxSha256 = "6f9618f39168898134975f51df7c2d6d5129c0aa82b6ae11cf47f920c70df276";
 
   virtualBoxNixGuestAdditionsBuilder = callPackage ./builder.nix {
     inherit virtualboxVersion virtualboxSubVersion virtualboxSha256;
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
index da2b2cbd51af..8cd3353bfcd1 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/default.nix
@@ -1,4 +1,5 @@
 {
+  config,
   lib,
   callPackage,
   pkg-config,
@@ -28,12 +29,12 @@ let
     { hypr-dynamic-cursors = import ./hypr-dynamic-cursors.nix; }
     { hyprfocus = import ./hyprfocus.nix; }
     { hyprgrass = import ./hyprgrass.nix; }
-    {
-      hyprscroller = throw "hyprlandPlugins.hyprscroller has been removed as the upstream project is deprecated. Consider using `hyprlandPlugins.hyprscrolling`.";
-    } # Added 2025-05-09
     { hyprspace = import ./hyprspace.nix; }
     { hyprsplit = import ./hyprsplit.nix; }
     (import ./hyprland-plugins.nix)
+    (lib.optionalAttrs config.allowAliases {
+      hyprscroller = throw "hyprlandPlugins.hyprscroller has been removed as the upstream project is deprecated. Consider using `hyprlandPlugins.hyprscrolling`."; # Added 2025-05-09
+    })
   ];
 in
 (lib.mapAttrs (name: plugin: callPackage plugin { inherit mkHyprlandPlugin; }) plugins)
diff --git a/pkgs/by-name/bi/bikeshed/package.nix b/pkgs/by-name/bi/bikeshed/package.nix
index 934393647bef..d71596af980a 100644
--- a/pkgs/by-name/bi/bikeshed/package.nix
+++ b/pkgs/by-name/bi/bikeshed/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bikeshed";
-  version = "5.3.2";
+  version = "5.3.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+TY26g685eIMXUjTG876r9gryg/tR6EtMGWAhk2kkis=";
+    hash = "sha256-hHLodlbHuDRXCR8GlTwSvaryOENPCiHgFj3S1hpApA8=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ca/cargo-tauri/package.nix b/pkgs/by-name/ca/cargo-tauri/package.nix
index 42f9aeec2039..e864859d2497 100644
--- a/pkgs/by-name/ca/cargo-tauri/package.nix
+++ b/pkgs/by-name/ca/cargo-tauri/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tauri";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "tauri-apps";
     repo = "tauri";
     tag = "tauri-cli-v${version}";
-    hash = "sha256-QdboIHbRKC/0k6FGKDuCA7AR3eIa7KVij3fGekD9kNk=";
+    hash = "sha256-nEt4xoVHozqxWnyrXTn7XDgH2HYCzrfqBgt71+goYms=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-GFqUQLLURfm6sRpf4MwAp89aKpTwWIlxk3NNRf9QgC0=";
+  cargoHash = "sha256-av5UF0MgKnTwEX4dHhekvj2tz/BOZyUbs1YqLwx28Cw=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ca/cargo-tauri/test-app.nix b/pkgs/by-name/ca/cargo-tauri/test-app.nix
index 67d17cece65c..865aa902dc46 100644
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
 
     fetcherVersion = 1;
-    hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
+    hash = "sha256-I++iYwqSxACmXFvfPYAnY/0WSWSY6ElJYnylJDC03D8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/cosign/package.nix b/pkgs/by-name/co/cosign/package.nix
index 52de7fc557cd..30556885da1d 100644
--- a/pkgs/by-name/co/cosign/package.nix
+++ b/pkgs/by-name/co/cosign/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cosign";
-  version = "2.5.0";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "cosign";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QvU+JpIcE9EX+ehRWvs2bS2VGgGVekNX8f5+mITIwU0=";
+    hash = "sha256-EpCG20SSZFNc/oMgyUP/oARNTrpkzNsTvsA0Wx+zI00=";
   };
 
   buildInputs = lib.optional (stdenv.hostPlatform.isLinux && pivKeySupport) (lib.getDev pcsclite);
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
     installShellFiles
   ];
 
-  vendorHash = "sha256-qIi+Pp4XZg1GxOhM9fCyD9rPaIiQHhoQudB50gzWgrM=";
+  vendorHash = "sha256-YwSi1TqtcGE1sV9NLJ3lxA8kk0gL+9kTgcJzvIJRanE=";
 
   subPackages = [
     "cmd/cosign"
@@ -50,14 +50,21 @@ buildGoModule (finalAttrs: {
   preCheck = ''
     # test all paths
     unset subPackages
-
-    rm pkg/cosign/ctlog_test.go # Require network access
-    rm pkg/cosign/tlog_test.go # Require network access
-    rm cmd/cosign/cli/verify/verify_test.go # Require network access
-    rm cmd/cosign/cli/verify/verify_blob_attestation_test.go # Require network access
-    rm cmd/cosign/cli/verify/verify_blob_test.go # Require network access
   '';
 
+  checkFlags =
+    let
+      # Skip tests that require network access
+      skippedTests = [
+        "TestLoadCertsKeylessVerification/default_fulcio"
+        "TestGetCTLogPubKeys"
+        "TestGetRekorPubKeys"
+        "TestVerifyEmbeddedSCT"
+        "TestValidateAndUnpackCertWithSCT"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd cosign \
       --bash <($out/bin/cosign completion bash) \
diff --git a/pkgs/by-name/dn/dnf5/package.nix b/pkgs/by-name/dn/dnf5/package.nix
index 373191c04721..78c6e4fbb9d7 100644
--- a/pkgs/by-name/dn/dnf5/package.nix
+++ b/pkgs/by-name/dn/dnf5/package.nix
@@ -33,7 +33,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.2.14.0";
+  version = "5.2.15.0";
 
   outputs = [
     "out"
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rpm-software-management";
     repo = "dnf5";
     tag = finalAttrs.version;
-    hash = "sha256-dCeTOJrOjnGvRhY8u8mMOgm/mbUoTbYqzjiAkbIlSo0=";
+    hash = "sha256-WlQfvWDd9Eay9TPq2EfFlQGljEskJqL3xyNIJDdaNps=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/hy/hyprprop/package.nix b/pkgs/by-name/hy/hyprprop/package.nix
index 63a8d07dbf78..a155b272b2af 100644
--- a/pkgs/by-name/hy/hyprprop/package.nix
+++ b/pkgs/by-name/hy/hyprprop/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hyprprop";
-  version = "0.1-unstable-2025-06-19";
+  version = "0.1-unstable-2025-07-18";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "189f32f56285aae9646bf1292976392beba5a2e2";
-    hash = "sha256-LPwgPRBTfnA76rHUr7KYvwq2pNt5IfxymNAZUJFvn/M=";
+    rev = "481175e17e155f19a3b31416530b6edf725e7034";
+    hash = "sha256-usBNOT/uzFdsKDe5Ik+C36zqL+BfT7Lp2rqKWrpQuqk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/hyprprop";
diff --git a/pkgs/by-name/in/intel-gmmlib/package.nix b/pkgs/by-name/in/intel-gmmlib/package.nix
index 0197c3273edd..62006fbb8687 100644
--- a/pkgs/by-name/in/intel-gmmlib/package.nix
+++ b/pkgs/by-name/in/intel-gmmlib/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.7.3";
+  version = "22.8.1";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     tag = "intel-gmmlib-${version}";
-    hash = "sha256-3KGDKdhy4jtBVdZYY6fhEEBQYmfYzXoTR7yPAuFqBvI=";
+    hash = "sha256-TFa8EfrL14w8ameIinRhmeNnfOJ18hoXWEpTgxTeBBE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/li/librime/package.nix b/pkgs/by-name/li/librime/package.nix
index e219a6c5c10c..b847adda5e7a 100644
--- a/pkgs/by-name/li/librime/package.nix
+++ b/pkgs/by-name/li/librime/package.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "librime";
-  version = "1.13.1";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "rime";
     repo = "librime";
     rev = version;
-    sha256 = "sha256-pv1I/YFzPLOmBDcT4HcrJWSikPEErEB5UzGrGqfJBvg=";
+    sha256 = "sha256-dks8Ab2YQ8t4hZRneMP9aU0VFZgIg+meh8RI0pp0lR0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libtracefs/package.nix b/pkgs/by-name/li/libtracefs/package.nix
index 0dd3bda9726b..d06f703b9e24 100644
--- a/pkgs/by-name/li/libtracefs/package.nix
+++ b/pkgs/by-name/li/libtracefs/package.nix
@@ -8,13 +8,11 @@
   xmlto,
   docbook_xml_dtd_45,
   docbook_xsl,
-  valgrind,
   sourceHighlight,
   meson,
   flex,
   bison,
   ninja,
-  cunit,
   gitUpdater,
 }:
 
@@ -46,7 +44,6 @@ stdenv.mkDerivation rec {
     xmlto
     docbook_xml_dtd_45
     docbook_xsl
-    valgrind
     sourceHighlight
     flex
     bison
@@ -58,8 +55,7 @@ stdenv.mkDerivation rec {
     "docs"
   ];
 
-  doCheck = true;
-  checkInputs = [ cunit ];
+  doCheck = false; # needs root
 
   passthru.updateScript = gitUpdater {
     # No nicer place to find latest release.
diff --git a/pkgs/by-name/li/lightning-terminal/package.nix b/pkgs/by-name/li/lightning-terminal/package.nix
index f656f0670ead..9d221a2bcd93 100644
--- a/pkgs/by-name/li/lightning-terminal/package.nix
+++ b/pkgs/by-name/li/lightning-terminal/package.nix
@@ -10,19 +10,25 @@
   fetchYarnDeps,
   go,
   versionCheckHook,
-  testers,
+  runCommandWith,
   curl,
   lightning-terminal,
+  _experimental-update-script-combinators,
+  gitUpdater,
+  nurl,
+  nix,
+  gitMinimal,
+  writeShellScript,
 }:
 
 buildGoModule rec {
   pname = "lightning-terminal";
-  version = "0.14.1-alpha";
+  version = "0.15.1-alpha";
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "lightning-terminal";
     tag = "v${version}";
-    hash = "sha256-sv/NsjAAF0vwD2xjRuGwHwV0L1gjCFQEw0SVp14Zyz0=";
+    hash = "sha256-aCZ1dzbj1SYBYQ6ysnk9MQs4V6ysljZYOYp0gOw0WFQ=";
     leaveDotGit = true;
     # Populate values that require us to use git.
     postFetch = ''
@@ -35,7 +41,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-Gbx4uz6q9Ef4QNv6DpIoCACjhT66iZ7GPNpd/g9MgKQ=";
+  vendorHash = "sha256-tjNF6Llsaba/IlhtrOU4ebzSRHGVy+LPzwhBsS5xJgQ=";
 
   buildInputs = [ lightning-app ];
   postUnpack = ''
@@ -94,24 +100,71 @@ buildGoModule rec {
     versionCheckHook
   ];
 
-  passthru.tests.litd-app = testers.runCommand {
-    name = "test-litd-app";
-    nativeBuildInputs = [
-      curl
-      lightning-terminal
-    ];
-    script = ''
-      litd \
-        --uipassword=12345678 \
-        --insecure-httplisten=127.0.0.1:8080 \
-        --httpslisten= &
-      sleep 2
-      GETindexHTTPCode=$(curl -o /dev/null -w "%{http_code}" -Lvs 127.0.0.1:8080/index.html)
-      if [ "$GETindexHTTPCode" = 200 ]; then
-        touch $out
-      fi
-    '';
-  };
+  passthru.tests.litd-app =
+    runCommandWith
+      {
+        name = "test-litd-app";
+        derivationArgs = {
+          nativeBuildInputs = [
+            curl
+            lightning-terminal
+          ];
+        };
+      }
+      ''
+        litd \
+          --uipassword=12345678 \
+          --insecure-httplisten=127.0.0.1:8080 \
+          --httpslisten= &
+        sleep 2
+        GETindexHTTPCode=$(curl -o /dev/null -w "%{http_code}" -Lvs 127.0.0.1:8080/index.html)
+        if [ "$GETindexHTTPCode" = 200 ]; then
+          touch $out
+        fi
+      '';
+
+  # Usage: nix-shell maintainers/scripts/update.nix --argstr package lightning-terminal --argstr commit true
+  passthru.updateScript = _experimental-update-script-combinators.sequence [
+    (gitUpdater {
+      rev-prefix = "v";
+      ignoredVersions = ".*rc.*";
+    })
+    {
+      command = [
+        (writeShellScript "update-hashes.sh" ''
+          set -euxo pipefail
+
+          . ${stdenv}/setup
+          PATH="${
+            lib.makeBinPath [
+              gitMinimal
+              nix
+              nurl
+            ]
+          }:$PATH"
+
+          nixpkgs="$(git rev-parse --show-toplevel)"
+          packageVersion=$(nix --extra-experimental-features nix-command eval --impure --raw -f "$nixpkgs" "$UPDATE_NIX_ATTR_PATH.version")
+          if [ x"$UPDATE_NIX_OLD_VERSION" != x"$packageVersion" ]; then
+            vendorHashOld=${lightning-terminal.vendorHash}
+            vendorHashNew=$(nurl -e "(import $nixpkgs/. { }).$UPDATE_NIX_ATTR_PATH.goModules")
+            yarnOfflineCacheHashOld=${lightning-app.yarnOfflineCache.outputHash}
+            yarnOfflineCacheHashNew=$(nurl -e "let pkgs = (import $nixpkgs/. { }); in \
+              pkgs.fetchYarnDeps \
+                { yarnLock = pkgs.$UPDATE_NIX_ATTR_PATH.src + \"/app/yarn.lock\"; \
+                  hash = pkgs.lib.fakeHash; \
+                }")
+
+            substituteInPlace \
+              "$nixpkgs"/pkgs/by-name/li/lightning-terminal/package.nix \
+              --replace-fail "$vendorHashOld" "$vendorHashNew" \
+              --replace-fail "$yarnOfflineCacheHashOld" "$yarnOfflineCacheHashNew"
+          fi
+        '')
+      ];
+      supportedFeatures = [ "silent" ];
+    }
+  ];
 
   lightning-app = stdenv.mkDerivation {
     pname = "lightning-app";
@@ -119,7 +172,7 @@ buildGoModule rec {
     version = "0.0.1";
     yarnOfflineCache = fetchYarnDeps {
       yarnLock = "${src}/app/yarn.lock";
-      hash = "sha256-ulOgKQRLG4cRi1N1DajmbZ0L7d08g5cYDA9itXu+Esw=";
+      hash = "sha256-FYRWyZxTPo4YwN5AiXsuubZoCVRcOeCrsUU/+ON4gx4=";
     };
 
     # Remove this command from package.json. It requires Git and it is not
diff --git a/pkgs/by-name/mo/mongosh/package.nix b/pkgs/by-name/mo/mongosh/package.nix
index 1edaf93a10c2..f5f79c4f8609 100644
--- a/pkgs/by-name/mo/mongosh/package.nix
+++ b/pkgs/by-name/mo/mongosh/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mongosh";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "mongodb-js";
     repo = "mongosh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dngguv/ShxwfFpbYyyfJ1SmQhSgEsDOKcRSXdjsfcmo=";
+    hash = "sha256-QK2woc6tlnTwYCZ7QEWCn2bRknye2qY8AYAHMVR9i24=";
   };
 
-  npmDepsHash = "sha256-W5qq3XUV+x0Ko1Ftp2JTHbaOSGsSG5a7qABthtnaU4o=";
+  npmDepsHash = "sha256-TfakEOiCtoRz2Fhwz5teOWq0OLb7uZaYiKHLSq/c1OU=";
 
   patches = [
     ./disable-telemetry.patch
diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeysAudio/package.nix
index e6467727e4e8..b4c00396a67a 100644
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.20";
+  version = "11.21";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-grZji+s1nffeSMdvsJBsmY0tW4yul2a7gYnenOtGa8g=";
+    hash = "sha256-nMxGrOjgjxJAHWJdJMGJl+QEwOZtuYsJlkzlpM0hnd0=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ns/nsncd/package.nix b/pkgs/by-name/ns/nsncd/package.nix
index a39f21e3d9ec..7618db6a9df4 100644
--- a/pkgs/by-name/ns/nsncd/package.nix
+++ b/pkgs/by-name/ns/nsncd/package.nix
@@ -25,19 +25,27 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-9M8Y0WwXFlrpRleSQPYDpnjNnxKGvrtO6Istl9qM30M=";
 
-  checkFlags = [
-    # Relies on the test environment to be able to resolve "localhost"
-    # on IPv4. That's not the case in the Nix sandbox somehow. Works
-    # when running cargo test impurely on a (NixOS|Debian) machine.
-    "--skip=ffi::test_gethostbyname2_r"
+  checkFlags =
+    [
+      # Relies on the test environment to be able to resolve "localhost"
+      # on IPv4. That's not the case in the Nix sandbox somehow. Works
+      # when running cargo test impurely on a (NixOS|Debian) machine.
+      "--skip=ffi::test_gethostbyname2_r"
 
-    # Relies on /etc/services to be present?
-    "--skip=handlers::test::test_handle_getservbyname_name"
-    "--skip=handlers::test::test_handle_getservbyname_name_proto"
-    "--skip=handlers::test::test_handle_getservbyport_port"
-    "--skip=handlers::test::test_handle_getservbyport_port_proto"
-    "--skip=handlers::test::test_handle_getservbyport_port_proto_aliases"
-  ];
+      # Relies on /etc/services to be present?
+      "--skip=handlers::test::test_handle_getservbyname_name"
+      "--skip=handlers::test::test_handle_getservbyname_name_proto"
+      "--skip=handlers::test::test_handle_getservbyport_port"
+      "--skip=handlers::test::test_handle_getservbyport_port_proto"
+      "--skip=handlers::test::test_handle_getservbyport_port_proto_aliases"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isBigEndian [
+      # Expected serialisation output in tests doesn't account for endianness differences
+      # https://github.com/twosigma/nsncd/issues/160
+      "--skip=handlers::test::test_hostent_serialization"
+      "--skip=handlers::test::test_innetgroup_serialization_in_group"
+      "--skip=handlers::test::test_netgroup_serialization"
+    ];
 
   meta = with lib; {
     description = "Name service non-caching daemon";
diff --git a/pkgs/by-name/ph/phpactor/package.nix b/pkgs/by-name/ph/phpactor/package.nix
index 1ca6d5454213..dc21ef689e72 100644
--- a/pkgs/by-name/ph/phpactor/package.nix
+++ b/pkgs/by-name/ph/phpactor/package.nix
@@ -21,7 +21,14 @@ php.buildComposerProject2 (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  php = php.withExtensions ({ all, ... }: with all; [ mbstring ]);
+  php = php.withExtensions (
+    { all, ... }:
+    with all;
+    [
+      mbstring
+      tokenizer
+    ]
+  );
 
   postInstall = ''
     installShellCompletion --cmd phpactor \
diff --git a/pkgs/by-name/pr/pragtical/package.nix b/pkgs/by-name/pr/pragtical/package.nix
index a77e50810126..f94b451d40d1 100644
--- a/pkgs/by-name/pr/pragtical/package.nix
+++ b/pkgs/by-name/pr/pragtical/package.nix
@@ -15,13 +15,14 @@
   mbedtls_2,
   pcre2,
   SDL2,
+  xz,
   zlib,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pragtical";
-  version = "3.5.2";
-  pluginManagerVersion = "1.2.9";
+  version = "3.6.0";
+  pluginManagerVersion = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "pragtical";
@@ -44,10 +45,13 @@ stdenv.mkDerivation (finalAttrs: {
       find subprojects -type d -name .git -prune -execdir rm -r {} +
     '';
 
-    hash = "sha256-RT+/h5vUILlik/YqcpwgkdOJRmhGBtEHRVynjlHWunw=";
+    hash = "sha256-rJEUTLjMTv19W1wSvW2HJaxHrzrBQHiG74v8XlcqgMc=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
+    lua5_4 # needed for built-time lua bytecode generation
     meson
     ninja
     pkg-config
@@ -63,12 +67,10 @@ stdenv.mkDerivation (finalAttrs: {
     mbedtls_2
     pcre2
     SDL2
+    xz
     zlib
   ];
 
-  # workaround for `libmbedx509.so.1, libmbedcrypto.so.7: error adding symbols: DSO missing from command line`
-  env.NIX_LDFLAGS = "-lmbedx509 -lmbedcrypto";
-
   mesonFlags = [ "-Duse_system_lua=true" ];
 
   meta = {
diff --git a/pkgs/development/compilers/go/1.23.nix b/pkgs/development/compilers/go/1.23.nix
index 76368433205b..4a8bb063a979 100644
--- a/pkgs/development/compilers/go/1.23.nix
+++ b/pkgs/development/compilers/go/1.23.nix
@@ -163,6 +163,13 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd3;
     teams = [ teams.golang ];
     platforms = platforms.darwin ++ platforms.linux ++ platforms.wasi ++ platforms.freebsd;
+    badPlatforms = [
+      # Support for big-endian POWER < 8 was dropped in 1.9, but POWER8 users have less of a reason to run in big-endian mode than pre-POWER8 ones
+      # So non-LE ppc64 is effectively unsupported, and Go SIGILLs on affordable ppc64 hardware
+      # https://github.com/golang/go/issues/19074 - Dropped support for big-endian POWER < 8, with community pushback
+      # https://github.com/golang/go/issues/73349 - upstream will not accept submissions to fix this
+      "powerpc64-linux"
+    ];
     mainProgram = "go";
   };
 })
diff --git a/pkgs/development/compilers/go/1.24.nix b/pkgs/development/compilers/go/1.24.nix
index 688959d7132d..db4a304f451f 100644
--- a/pkgs/development/compilers/go/1.24.nix
+++ b/pkgs/development/compilers/go/1.24.nix
@@ -163,6 +163,13 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd3;
     teams = [ teams.golang ];
     platforms = platforms.darwin ++ platforms.linux ++ platforms.wasi ++ platforms.freebsd;
+    badPlatforms = [
+      # Support for big-endian POWER < 8 was dropped in 1.9, but POWER8 users have less of a reason to run in big-endian mode than pre-POWER8 ones
+      # So non-LE ppc64 is effectively unsupported, and Go SIGILLs on affordable ppc64 hardware
+      # https://github.com/golang/go/issues/19074 - Dropped support for big-endian POWER < 8, with community pushback
+      # https://github.com/golang/go/issues/73349 - upstream will not accept submissions to fix this
+      "powerpc64-linux"
+    ];
     mainProgram = "go";
   };
 })
diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index b5cbfd3aa802..99b684cca449 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -168,6 +168,13 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd3;
     teams = [ teams.golang ];
     platforms = platforms.darwin ++ platforms.linux ++ platforms.wasi ++ platforms.freebsd;
+    badPlatforms = [
+      # Support for big-endian POWER < 8 was dropped in 1.9, but POWER8 users have less of a reason to run in big-endian mode than pre-POWER8 ones
+      # So non-LE ppc64 is effectively unsupported, and Go SIGILLs on affordable ppc64 hardware
+      # https://github.com/golang/go/issues/19074 - Dropped support for big-endian POWER < 8, with community pushback
+      # https://github.com/golang/go/issues/73349 - upstream will not accept submissions to fix this
+      "powerpc64-linux"
+    ];
     mainProgram = "go";
   };
 })
diff --git a/pkgs/development/compilers/go/binary.nix b/pkgs/development/compilers/go/binary.nix
index b32b70a392ec..46f649930455 100644
--- a/pkgs/development/compilers/go/binary.nix
+++ b/pkgs/development/compilers/go/binary.nix
@@ -35,5 +35,12 @@ stdenv.mkDerivation {
     license = lib.licenses.bsd3;
     teams = [ lib.teams.golang ];
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
+    badPlatforms = [
+      # Support for big-endian POWER < 8 was dropped in 1.9, but POWER8 users have less of a reason to run in big-endian mode than pre-POWER8 ones
+      # So non-LE ppc64 is effectively unsupported, and Go SIGILLs on affordable ppc64 hardware
+      # https://github.com/golang/go/issues/19074 - Dropped support for big-endian POWER < 8, with community pushback
+      # https://github.com/golang/go/issues/73349 - upstream will not accept submissions to fix this
+      "powerpc64-linux"
+    ];
   };
 }
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index b4f2d72825c0..9d9bcaa9d1b8 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -34,9 +34,9 @@ let
     "20.1.6".officialRelease.sha256 = "sha256-PfCzECiCM+k0hHqEUSr1TSpnII5nqIxg+Z8ICjmMj0Y=";
     "21.1.0-rc1".officialRelease.sha256 = "sha256-EZMG3kNqGTvKSuvslbrtNnyqBCG5C2gN9Y2qHbiuh8Q=";
     "22.0.0-git".gitRelease = {
-      rev = "f2956173aea4ff0fe0b823be1953d1968f91fb98";
-      rev-version = "22.0.0-unstable-2025-07-17";
-      sha256 = "sha256-qmF67vdfrMB5p9yej1KZeh5Spek67RJXQODpV5w9IQA=";
+      rev = "f3a3270dbca3649b7d56aaa42cb8481fb34e2d67";
+      rev-version = "22.0.0-unstable-2025-07-20";
+      sha256 = "sha256-rMiPa8T2n0IWtOv0SYb+eWWHRfPTBGEb4yCp11gVzRE=";
     };
   } // llvmVersions;
 
diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.0.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.0.x.nix
index 7c6439d1746e..a476886358b1 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.0.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.0.x.nix
@@ -1,4 +1,8 @@
-{ pkgs, haskellLib }:
+{
+  config,
+  pkgs,
+  haskellLib,
+}:
 
 with haskellLib;
 
@@ -108,7 +112,10 @@ self: super: {
 
   doctest = dontCheck super.doctest;
 
-  haskell-language-server = throw "haskell-language-server has dropped support for ghc 9.0 in version 2.4.0.0, please use a newer ghc version or an older nixpkgs version";
+  haskell-language-server =
+    lib.throwIf config.allowAliases
+      "haskell-language-server has dropped support for ghc 9.0 in version 2.4.0.0, please use a newer ghc version or an older nixpkgs version"
+      (markBroken super.haskell-language-server);
 
   # Needs to use ghc-lib due to incompatible GHC
   ghc-tags = doDistribute self.ghc-tags_1_5;
diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
index 6d85d85a8617..cd67a884e853 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.2.x.nix
@@ -1,4 +1,8 @@
-{ pkgs, haskellLib }:
+{
+  config,
+  pkgs,
+  haskellLib,
+}:
 
 with haskellLib;
 
@@ -74,7 +78,10 @@ self: super: {
     }
   );
 
-  haskell-language-server = throw "haskell-language-server has dropped support for ghc 9.2 in version 2.10.0.0, please use a newer ghc version or an older nixpkgs version";
+  haskell-language-server =
+    lib.throwIf config.allowAliases
+      "haskell-language-server has dropped support for ghc 9.2 in version 2.10.0.0, please use a newer ghc version or an older nixpkgs version"
+      (markBroken super.haskell-language-server);
 
   # For GHC < 9.4, some packages need data-array-byte as an extra dependency
   hashable = addBuildDepends [ self.data-array-byte ] super.hashable;
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index d80013fa212d..0a211850b2f4 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -422,8 +422,6 @@ in
     } ./setuptools-build-hook.sh
   ) { };
 
-  setuptoolsCheckHook = throw "The setuptoolsCheckHook has been removed, since the test command has been removed in setuptools 72.0";
-
   setuptoolsRustBuildHook = callPackage (
     { makePythonHook, setuptools-rust }:
     makePythonHook {
diff --git a/pkgs/development/libraries/libfive/default.nix b/pkgs/development/libraries/libfive/default.nix
index 38b3005bbc0c..c898938becfe 100644
--- a/pkgs/development/libraries/libfive/default.nix
+++ b/pkgs/development/libraries/libfive/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation {
   pname = "libfive";
-  version = "0-unstable-2025-05-22";
+  version = "0-unstable-2025-07-07";
 
   src = fetchFromGitHub {
     owner = "libfive";
     repo = "libfive";
-    rev = "daa458279121a95b51482508bcfa906d6227442e";
-    hash = "sha256-YPP3ZSMDCQgeOPugRPmZCDI9iesIMwnU7Xu8yGwV9JM=";
+    rev = "ba841d3ba91b885ba19c40e382d6ae6f3534a4b5";
+    hash = "sha256-YVqP4k8KBLMYZOuWYLXijZBEiNGhQaaVNBVQtpIgvjc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/science/math/magma/generic.nix b/pkgs/development/libraries/science/math/magma/generic.nix
index 394e249abc7e..3ce4d9a7bf66 100644
--- a/pkgs/development/libraries/science/math/magma/generic.nix
+++ b/pkgs/development/libraries/science/math/magma/generic.nix
@@ -42,20 +42,7 @@ let
     ;
   inherit (magmaRelease) version hash supportedGpuTargets;
 
-  # Per https://icl.utk.edu/magma/downloads, support for CUDA 12 wasn't added until 2.7.1.
-  # If we're building a version prior to that, use the latest release of the 11.x series.
-  effectiveCudaPackages =
-    if strings.versionOlder version "2.7.1" then cudaPackages_11 else cudaPackages;
-
-  inherit (effectiveCudaPackages) cudaAtLeast flags cudaOlder;
-
-  effectiveRocmPackages =
-    if strings.versionOlder version "2.8.0" then
-      throw ''
-        the required ROCm 5.7 version for magma ${version} has been removed
-      ''
-    else
-      rocmPackages;
+  inherit (cudaPackages) cudaAtLeast flags cudaOlder;
 
   # NOTE: The lists.subtractLists function is perhaps a bit unintuitive. It subtracts the elements
   #   of the first list *from* the second list. That means:
@@ -65,7 +52,7 @@ let
   # NOTE: The hip.gpuTargets are prefixed with "gfx" instead of "sm" like flags.realArches.
   #   For some reason, Magma's CMakeLists.txt file does not handle the "gfx" prefix, so we must
   #   remove it.
-  rocmArches = lists.map (x: strings.removePrefix "gfx" x) effectiveRocmPackages.clr.gpuTargets;
+  rocmArches = lists.map (x: strings.removePrefix "gfx" x) rocmPackages.clr.gpuTargets;
   supportedRocmArches = lists.intersectLists rocmArches supportedGpuTargets;
   unsupportedRocmArches = lists.subtractLists supportedRocmArches rocmArches;
 
@@ -123,19 +110,12 @@ stdenv.mkDerivation (finalAttrs: {
     "test"
   ];
 
-  postPatch =
-    ''
-      # For rocm version script invoked by cmake
-      patchShebangs tools/
-      # Fixup for the python test runners
-      patchShebangs ./testing/run_{tests,summarize}.py
-    ''
-    + lib.optionalString (strings.versionOlder version "2.9.0") ''
-      substituteInPlace ./testing/run_tests.py \
-        --replace-fail \
-          "print >>sys.stderr, cmdp, \"doesn't exist (original name: \" + cmd + \", precision: \" + precision + \")\"" \
-          "print(f\"{cmdp} doesn't exist (original name: {cmd}, precision: {precision})\", file=sys.stderr)"
-    '';
+  postPatch = ''
+    # For rocm version script invoked by cmake
+    patchShebangs tools/
+    # Fixup for the python test runners
+    patchShebangs ./testing/run_{tests,summarize}.py
+  '';
 
   nativeBuildInputs =
     [
@@ -145,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
       gfortran
     ]
     ++ lists.optionals cudaSupport [
-      effectiveCudaPackages.cuda_nvcc
+      cudaPackages.cuda_nvcc
     ];
 
   buildInputs =
@@ -157,7 +137,7 @@ stdenv.mkDerivation (finalAttrs: {
       (getLib gfortran.cc) # libgfortran.so
     ]
     ++ lists.optionals cudaSupport (
-      with effectiveCudaPackages;
+      with cudaPackages;
       [
         cuda_cccl # <nv/target> and <cuda/std/type_traits>
         cuda_cudart # cuda_runtime.h
@@ -172,7 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
       ]
     )
     ++ lists.optionals rocmSupport (
-      with effectiveRocmPackages;
+      with rocmPackages;
       [
         clr
         hipblas
@@ -203,9 +183,9 @@ stdenv.mkDerivation (finalAttrs: {
       # Can be removed once https://github.com/icl-utk-edu/magma/pull/27 is merged
       # Can't easily apply the PR as a patch because we rely on the tarball with pregenerated
       # hipified files ∴ fetchpatch of the PR will apply cleanly but fail to build
-      (strings.cmakeFeature "ROCM_CORE" "${effectiveRocmPackages.clr}")
-      (strings.cmakeFeature "CMAKE_C_COMPILER" "${effectiveRocmPackages.clr}/bin/hipcc")
-      (strings.cmakeFeature "CMAKE_CXX_COMPILER" "${effectiveRocmPackages.clr}/bin/hipcc")
+      (strings.cmakeFeature "ROCM_CORE" "${rocmPackages.clr}")
+      (strings.cmakeFeature "CMAKE_C_COMPILER" "${rocmPackages.clr}/bin/hipcc")
+      (strings.cmakeFeature "CMAKE_CXX_COMPILER" "${rocmPackages.clr}/bin/hipcc")
     ];
 
   # Magma doesn't have a test suite we can easily run, just loose executables, all of which require a GPU.
@@ -241,8 +221,12 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
   passthru = {
-    inherit cudaSupport rocmSupport gpuTargets;
-    cudaPackages = effectiveCudaPackages;
+    inherit
+      cudaPackages
+      cudaSupport
+      rocmSupport
+      gpuTargets
+      ;
     testers = {
       all =
         let
@@ -395,8 +379,6 @@ stdenv.mkDerivation (finalAttrs: {
       # dynamic CUDA support is broken https://github.com/NixOS/nixpkgs/issues/239237
       (cudaSupport && !static)
       || !(cudaSupport || rocmSupport) # At least one back-end enabled
-      || (cudaSupport && rocmSupport) # Mutually exclusive
-      || (cudaSupport && strings.versionOlder version "2.7.1" && cudaPackages_11 == null)
-      || (rocmSupport && strings.versionOlder version "2.8.0");
+      || (cudaSupport && rocmSupport); # Mutually exclusive
   };
 })
diff --git a/pkgs/development/libraries/science/math/magma/releases.nix b/pkgs/development/libraries/science/math/magma/releases.nix
index beb1559e3762..2d0566300330 100644
--- a/pkgs/development/libraries/science/math/magma/releases.nix
+++ b/pkgs/development/libraries/science/math/magma/releases.nix
@@ -4,68 +4,6 @@
 #   HIP is here: https://github.com/icl-utk-edu/magma/blob/v2.9.0/CMakeLists.txt#L290
 #   CUDA works around magma's wrappers and uses FindCUDAToolkit directly
 [
-  {
-    version = "2.6.2";
-    hash = "sha256-dbVU2rAJA+LRC5cskT5Q5/iMvGLzrkMrWghsfk7aCnE=";
-    supportedGpuTargets = [
-      "700"
-      "701"
-      "702"
-      "703"
-      "704"
-      "705"
-      "801"
-      "802"
-      "803"
-      "805"
-      "810"
-      "900"
-      "902"
-      "904"
-      "906"
-      "908"
-      "909"
-      "90c"
-      "1010"
-      "1011"
-      "1012"
-      "1030"
-      "1031"
-      "1032"
-      "1033"
-    ];
-  }
-  {
-    version = "2.7.2";
-    hash = "sha256-cpvBpw5RinQi/no6VFN6R0EDWne+M0n2bqxcNiV21WA=";
-    supportedGpuTargets = [
-      "700"
-      "701"
-      "702"
-      "703"
-      "704"
-      "705"
-      "801"
-      "802"
-      "803"
-      "805"
-      "810"
-      "900"
-      "902"
-      "904"
-      "906"
-      "908"
-      "909"
-      "90c"
-      "1010"
-      "1011"
-      "1012"
-      "1030"
-      "1031"
-      "1032"
-      "1033"
-    ];
-  }
   {
     version = "2.9.0";
     hash = "sha256-/3f9Nyaz3+w7+1V5CwZICqXMOEOWwts1xW/a5KgsZBw=";
diff --git a/pkgs/development/python-modules/sat-tmp/default.nix b/pkgs/development/python-modules/sat-tmp/default.nix
new file mode 100644
index 000000000000..f055189c2ea9
--- /dev/null
+++ b/pkgs/development/python-modules/sat-tmp/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchhg,
+  setuptools,
+  wokkel,
+}:
+
+buildPythonPackage rec {
+  pname = "sat-tmp";
+  version = "0.8.0";
+  pyproject = true;
+
+  src = fetchhg {
+    url = "https://repos.goffi.org/sat_tmp";
+    rev = "v${version}";
+    hash = "sha256-CEy0/eaPK0nHzsiJq3m7edNyxzAhfwBaNhFhLS0azOw=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ wokkel ];
+
+  # Taken from import_test.py
+  pythonImportsCheck = [
+    "sat_tmp.wokkel.pubsub"
+    "sat_tmp.wokkel.rsm"
+    "sat_tmp.wokkel.mam"
+  ];
+
+  # no pytest tests exist
+
+  meta = {
+    description = "Libervia temporary third party patches";
+    longDescription = ''
+      This module is used by Libervia project (formerly “Salut à Toi”) project to patch third party modules
+      when the patches are not yet available upstream. Patches are removed from this module once merged upstream.
+    '';
+    homepage = "https://libervia.org";
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/development/python-modules/tsplib95/default.nix b/pkgs/development/python-modules/tsplib95/default.nix
new file mode 100644
index 000000000000..1ac82c47d78e
--- /dev/null
+++ b/pkgs/development/python-modules/tsplib95/default.nix
@@ -0,0 +1,62 @@
+{
+  # Basic
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  # Build system
+  setuptools,
+  # Dependencies
+  click,
+  deprecated,
+  networkx,
+  tabulate,
+  # Test
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "tsplib95";
+  version = "0.7.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rhgrant10";
+    repo = "tsplib95";
+    tag = "v${version}";
+    hash = "sha256-rDKnfuauA9+mlgL6Prfz0uRP2rWxiQruXBj422/6Eak=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    deprecated
+    networkx
+    tabulate
+  ];
+
+  # Remove deprecated pytest-runner
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "'pytest-runner'," ""
+  '';
+
+  pythonRelaxDeps = [
+    "networkx"
+    "tabulate"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "tsplib95" ];
+
+  meta = {
+    description = "Library for working with TSPLIB 95 files.";
+    homepage = "https://github.com/rhgrant10/tsplib95";
+    mainProgram = "tsplib95";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ thattemperature ];
+  };
+}
diff --git a/pkgs/development/web/nodejs/update.nix b/pkgs/development/web/nodejs/update.nix
index b3ffde6ac035..fbe2f5474299 100644
--- a/pkgs/development/web/nodejs/update.nix
+++ b/pkgs/development/web/nodejs/update.nix
@@ -13,10 +13,10 @@
 }:
 
 let
-  rev = "08bb3693621796b22511e56b8418737bd116d70b"; # should be the HEAD of nodejs/release-keys
+  rev = "901fc09b83c686693be51b3c9a13578929cbc1ab"; # should be the HEAD of nodejs/release-keys
   pubring = fetchurl {
-    url = "https://github.com/nodejs/release-keys/raw/${rev}/gpg/pubring.kbx";
-    hash = "sha256-j7auIjCzRV7GoX8jdtqHFniwmWWTBoRNmRYWWPFSJ/k=";
+    url = "https://github.com/nodejs/release-keys/raw/${rev}/gpg-only-active-keys/pubring.kbx";
+    hash = "sha256-r/thHVLDlMVRN3Ahr5Apivy+h2IuvPm4QhYFoAmms3E=";
   };
 in
 writeScript "update-nodejs" ''
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 20ebe669387b..5294b31f31dd 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -18,8 +18,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.19.3";
-  sha256 = "99be7b9d268d48b93be568a23240398ceacb0782dc7055b9972305c000b0e292";
+  version = "20.19.4";
+  sha256 = "b87fd7106013d3906706913ffc63a4403715fbb272c4f83ff4338527353eec0f";
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch
diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index b44853fff88e..d9d433a31016 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sgt-puzzles";
-  version = "20250627.8314b03";
+  version = "20250714.880288c";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    hash = "sha256-av7ub9GnI+VwkTGafSB1J9YfCpjZOs2UMKVycMvzXwI=";
+    hash = "sha256-Ml25epg2ir0NqgPCQWpJnfqZU3w0p4pZCHC2esul1Cw=";
   };
 
   sgt-puzzles-menu = fetchurl {
diff --git a/pkgs/servers/nosql/apache-jena/binary.nix b/pkgs/servers/nosql/apache-jena/binary.nix
index a46081d3c7d5..43aa42f24dc9 100644
--- a/pkgs/servers/nosql/apache-jena/binary.nix
+++ b/pkgs/servers/nosql/apache-jena/binary.nix
@@ -8,10 +8,10 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-jena";
-  version = "5.4.0";
+  version = "5.5.0";
   src = fetchurl {
     url = "mirror://apache/jena/binaries/apache-jena-${version}.tar.gz";
-    hash = "sha256-KQoBKPAetKI3ySWvsRn5yrtf5T5ldWiqKGrRDK8O/4Q=";
+    hash = "sha256-atRcW9U3PjX/E3QhTa6dBfvb19Rb3n6ROpLeGinGD1U=";
   };
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/servers/web-apps/outline/default.nix b/pkgs/servers/web-apps/outline/default.nix
index 2529ba6acb92..1423876c41b5 100644
--- a/pkgs/servers/web-apps/outline/default.nix
+++ b/pkgs/servers/web-apps/outline/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "outline";
-  version = "0.85.0";
+  version = "0.85.1";
 
   src = fetchFromGitHub {
     owner = "outline";
     repo = "outline";
     rev = "v${version}";
-    hash = "sha256-xzZQ0+eJOznZWpApbh9SUGuA5XiLnbhQS0qBLrLfk9Y=";
+    hash = "sha256-lErNsYzxqZYVl1MAQdMk062nBORjQGd3C+UbGbZMzvA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9c640f4feafd..e7e84b16a183 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1215,6 +1215,8 @@ mapAliases {
   ma1sd = throw "ma1sd was dropped as it is unmaintained"; # Added 2024-07-10
   mac = monkeysAudio; # Added 2024-11-30
   MACS2 = macs2; # Added 2023-06-12
+  magma_2_6_2 = throw "'magma_2_6_2' has been removed, use the latest 'magma' package instead."; # Added 2025-07-20
+  magma_2_7_2 = throw "'magma_2_7_2' has been removed, use the latest 'magma' package instead."; # Added 2025-07-20
   mailcore2 = throw "'mailcore2' has been removed due to lack of upstream maintenance."; # Added 2025-06-09
   mailctl = throw "mailctl has been renamed to oama"; # Added 2024-08-19
   mailman-rss = throw "The mailman-rss package was dropped since it was unmaintained."; # Added 2024-06-21
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3f69beea97bc..a1398751c002 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15315,7 +15315,7 @@ with pkgs;
   # standard BLAS and LAPACK.
   openblasCompat = openblas.override { blas64 = false; };
 
-  inherit (callPackage ../development/libraries/science/math/magma { }) magma magma_2_7_2 magma_2_6_2;
+  inherit (callPackage ../development/libraries/science/math/magma { }) magma;
 
   magma-cuda = magma.override {
     cudaSupport = true;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0030ad2b5913..d6e988309c12 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1398,11 +1398,11 @@ with self;
   };
 
   AppSqitch = buildPerlModule {
-    version = "1.5.1";
+    version = "1.5.2";
     pname = "App-Sqitch";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/D/DW/DWHEELER/App-Sqitch-v1.5.1.tar.gz";
-      hash = "sha256-Fqo0j8Sedfj/ZQMfBiLUGSkyMhsFvWUYq5lkYYVy1pg=";
+      url = "mirror://cpan/authors/id/D/DW/DWHEELER/App-Sqitch-v1.5.2.tar.gz";
+      hash = "sha256-horqXNSz6uDPrKiXK546ag+PmYiEjVNazstJVbAovNE=";
     };
     buildInputs = [
       CaptureTiny
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index c6b86acc7cea..3cf3e09d014e 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -727,6 +727,7 @@ mapAliases ({
   sequoia = throw "python3Packages.sequoia was replaced by pysequoia - built from a dedicated repository, with a new API."; # added 2023-06-24
   setuptools_dso = setuptools-dso; # added 2024-03-03
   setuptools_scm = setuptools-scm; # added 2021-06-03
+  setuptoolsCheckHook = throw "The setuptoolsCheckHook has been removed, since the test command has been removed in setuptools 72.0."; # added 2024-08-06
   setuptoolsTrial = setuptools-trial; # added 2023-11-11
   sharkiqpy = sharkiq; # added 2022-05-21
   shouldbe = throw "shouldbe was removed, because it was disabled on all python version since 3.8 and last updated in 2019."; # added 2024-05-12
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e26fdbda25db..a5a0200fa6bf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15969,6 +15969,8 @@ self: super: with self; {
 
   sasmodels = callPackage ../development/python-modules/sasmodels { };
 
+  sat-tmp = callPackage ../development/python-modules/sat-tmp { };
+
   satel-integra = callPackage ../development/python-modules/satel-integra { };
 
   sbom2dot = callPackage ../development/python-modules/sbom2dot { };
@@ -18311,6 +18313,8 @@ self: super: with self; {
 
   tskit = callPackage ../development/python-modules/tskit { };
 
+  tsplib95 = callPackage ../development/python-modules/tsplib95 { };
+
   ttach = callPackage ../development/python-modules/ttach { };
 
   ttfautohint-py = callPackage ../development/python-modules/ttfautohint-py { };