diff --git a/nixos/modules/services/matrix/mautrix-signal.nix b/nixos/modules/services/matrix/mautrix-signal.nix
index 9977011e0035..4695d7c7423c 100644
--- a/nixos/modules/services/matrix/mautrix-signal.nix
+++ b/nixos/modules/services/matrix/mautrix-signal.nix
@@ -268,7 +268,7 @@ in
     buildDocsInSandbox = false;
     doc = ./mautrix-signal.md;
     maintainers = with lib.maintainers; [
-      niklaskorz
+      alyaeanyx
       frederictobiasc
     ];
   };
diff --git a/nixos/tests/cosmic.nix b/nixos/tests/cosmic.nix
index 227640c078ee..3f48a384913a 100644
--- a/nixos/tests/cosmic.nix
+++ b/nixos/tests/cosmic.nix
@@ -75,14 +75,14 @@
       if (enableAutologin) then
         ''
           with subtest("cosmic-greeter initialisation"):
-              machine.wait_for_unit("graphical.target")
+              machine.wait_for_unit("graphical.target", timeout=120)
         ''
       else
         ''
           from time import sleep
 
-          machine.wait_for_unit("graphical.target")
-          machine.wait_until_succeeds("pgrep --uid ${toString cfg.users.users.cosmic-greeter.name} --full cosmic-greeter")
+          machine.wait_for_unit("graphical.target", timeout=120)
+          machine.wait_until_succeeds("pgrep --uid ${toString cfg.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
           # Sleep for 10 seconds for ensuring that `greetd` loads the
           # password prompt for the login screen properly.
           sleep(10)
@@ -96,7 +96,7 @@
           # `cosmic-session` target is the Workspaces applet. So, wait
           # for it to start. The process existing means that COSMIC
           # now handles any opened windows from now on.
-          machine.wait_until_succeeds("pgrep --uid ${toString user.uid} --full 'cosmic-panel-button com.system76.CosmicWorkspaces'")
+          machine.wait_until_succeeds("pgrep --uid ${toString user.uid} --full 'cosmic-panel-button com.system76.CosmicWorkspaces'", timeout=30)
 
       # The best way to test for Wayland and XWayland is to launch
       # the GUI applications and see the results yourself.
@@ -121,7 +121,7 @@
               machine.wait_until_succeeds(f''''su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' '''', timeout=30)
               machine.succeed(f"pkill {gui_app}", timeout=5)
 
-      machine.succeed("echo 'test completed succeessfully' > /${testName}")
+      machine.succeed("echo 'test completed succeessfully' > /${testName}", timeout=5)
       machine.copy_from_vm('/${testName}')
 
       machine.shutdown()
diff --git a/pkgs/applications/emulators/blink/default.nix b/pkgs/applications/emulators/blink/default.nix
index a65ebf5886b3..1474675e21bb 100644
--- a/pkgs/applications/emulators/blink/default.nix
+++ b/pkgs/applications/emulators/blink/default.nix
@@ -2,6 +2,7 @@
   stdenv,
   fetchFromGitHub,
   lib,
+  zlib,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -15,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-4wgDftXOYm2fMP+/aTRljDi38EzbbwAJlQkuxjAMl3I=";
   };
 
+  buildInputs = [ zlib ];
+
   # Do not include --enable-static and --disable-shared flags during static compilation
   dontAddStaticConfigureFlags = true;
 
diff --git a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
index a1f582cda4a9..dd0e95243d5f 100644
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-03-18";
+  version = "0-unstable-2025-04-10";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "619c575db6f81d1911e36f1ecd618c9dead86859";
-    hash = "sha256-Pp3OP69KKrznOl1cY5yiKxMJRA7REe4S51zGDHG883c=";
+    rev = "51ca5126ee67e88827c87c761a097a6318ad25e7";
+    hash = "sha256-OBC8y53ljmgmfow7qBWIJYgjAiyv2bVa3CqQFkaJRhQ=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/emulators/libretro/cores/fbneo.nix b/pkgs/applications/emulators/libretro/cores/fbneo.nix
index 9564ccde7b29..f366a11eb0c6 100644
--- a/pkgs/applications/emulators/libretro/cores/fbneo.nix
+++ b/pkgs/applications/emulators/libretro/cores/fbneo.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2025-04-05";
+  version = "0-unstable-2025-04-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "c21c0a0393a1cc68db7250022d18039a30de51f4";
-    hash = "sha256-AZyYUftVHlxR+QHCsIcNI2hTIEDYeInYPdmum++EtpU=";
+    rev = "ffdacc6a7ce719b6371ad0a6143ce46726ed5d25";
+    hash = "sha256-Pdp/pPsZujbAK6pEE5LT6KCdJ/RFW1zR67bWvI/efJI=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index 8823d203a995..24cd24aa79f4 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-04-05";
+  version = "0-unstable-2025-04-15";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "3114394019fc0f772c29d0a1f5493fbdce4745b0";
-    hash = "sha256-bp10601cfcsb62Vy88zIjFZ/yBUGVODEt96Me7XX5kY=";
+    rev = "25a882341d5ebbf8124ddd2a7421592678dfac2e";
+    hash = "sha256-N/7JZbEzYaOAoUShkmQd1G61ke1U3OSeFMXS0lqftYU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/ppsspp.nix b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
index 1a6dab365d44..dcaf99312532 100644
--- a/pkgs/applications/emulators/libretro/cores/ppsspp.nix
+++ b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2025-04-06";
+  version = "0-unstable-2025-04-15";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "031421ba4de8559f8bbdbd9367b29be28f6a45cb";
-    hash = "sha256-eaXR/w0Iz9tmTgZKHVcZYXJbXaVPnYudSal0vcsQ9a0=";
+    rev = "599edb24f01bbb7ce0e685e3c5585a02781549c7";
+    hash = "sha256-cPalfNXV6U2jLCTqXedQzn9pyWiscaZrrQM32D70uYE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/al/alibuild/package.nix b/pkgs/by-name/al/alibuild/package.nix
new file mode 100644
index 000000000000..d9315f52f68c
--- /dev/null
+++ b/pkgs/by-name/al/alibuild/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "alibuild";
+  version = "1.17.18";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-771XCMYNJsQzD7rb/7q5rheeIL8X2bvMWwLkA40CJ9Y=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    setuptools-scm
+  ];
+
+  nativeBuildInputs = with python3Packages; [ pip ];
+
+  dependencies = with python3Packages; [
+    requests
+    pyyaml
+    boto3
+    jinja2
+    distro
+  ];
+
+  pythonRelaxDeps = [ "boto3" ];
+
+  doCheck = false;
+
+  meta = {
+    homepage = "https://alisw.github.io/alibuild/";
+    description = "Build tool for ALICE experiment software";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ ktf ];
+  };
+}
diff --git a/pkgs/by-name/ca/cargo-shear/package.nix b/pkgs/by-name/ca/cargo-shear/package.nix
index f35310fe2f32..c342579c0b44 100644
--- a/pkgs/by-name/ca/cargo-shear/package.nix
+++ b/pkgs/by-name/ca/cargo-shear/package.nix
@@ -6,7 +6,7 @@
   cargo-shear,
 }:
 let
-  version = "1.1.12";
+  version = "1.1.14";
 in
 rustPlatform.buildRustPackage {
   pname = "cargo-shear";
@@ -16,11 +16,11 @@ rustPlatform.buildRustPackage {
     owner = "Boshen";
     repo = "cargo-shear";
     rev = "v${version}";
-    hash = "sha256-FvZJ0RFa5b9BQuZ1fmkvJhZj59yAsKSkKoTE0Emzdos=";
+    hash = "sha256-xGNIk/9UYU1F/Qj2tGvBb5rEZWjVoTyzk23OJE6seps=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-sYRUyTdTT2+VJHuiY1apom+EQU1hR46fJ6TmwNapHb4=";
+  cargoHash = "sha256-olnkcA9Vt1+yFzL2ntfDmO4rzMuJ0JjJVqCl15xcdDI=";
 
   # https://github.com/Boshen/cargo-shear/blob/a0535415a3ea94c86642f39f343f91af5cdc3829/src/lib.rs#L20-L23
   SHEAR_VERSION = version;
diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index c983161978f3..9d8ecd252ad2 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -25,14 +25,14 @@ with py.pkgs;
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.404";
+  version = "3.2.405";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-hxu2FAdLMm54b0SNiHcvdKgxmsDZtA9qEqD/c9vL3Yg=";
+    hash = "sha256-bzHd1gR2YmTyM4D8+Ux8eCEUynN5qu4B/dAGZ6cHXYA=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/cn/cnquery/package.nix b/pkgs/by-name/cn/cnquery/package.nix
index caa454547a5f..1011182dd86b 100644
--- a/pkgs/by-name/cn/cnquery/package.nix
+++ b/pkgs/by-name/cn/cnquery/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.48.0";
+  version = "11.49.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-d+TWg4T4p0QbLoUco88GIgnHfRpyealSasEzYf1YlXk=";
+    hash = "sha256-e/tD/yo7tV2JkQER1KW9qO9YIo2TQR3jt8uYup/wEt4=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-w8xc1lGJkDMwjyVKdUlGfhn7DXlJJnqbOUfFg1Z9qC8=";
+  vendorHash = "sha256-M3pRUXAwXgdWLaEMXRd6hkH4Z2hh4z38SzO6BeOzjeo=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/co/cosmic-protocols/package.nix b/pkgs/by-name/co/cosmic-protocols/package.nix
index fbfe4c5fe5ee..7a01b5746413 100644
--- a/pkgs/by-name/co/cosmic-protocols/package.nix
+++ b/pkgs/by-name/co/cosmic-protocols/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "cosmic-protocols";
-  version = "0-unstable-2025-03-21";
+  version = "0-unstable-2025-04-14";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-protocols";
-    rev = "ee0d46f4b7e1508011a98225f14c4a0528ab2914";
-    hash = "sha256-oD9BYWX0uPpdsOYAyFq/pI6zxM0SfEb8lq9QA2yrBZY=";
+    rev = "67df697105486fa4c9dd6ce00889c8b0526c9bb4";
+    hash = "sha256-rogV5BTloAatfinrgl7I6hakybLkPRKhnwlILBGKkQU=";
   };
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
diff --git a/pkgs/by-name/cr/creek/build.zig.zon.nix b/pkgs/by-name/cr/creek/build.zig.zon.nix
index 551c0489363f..557d54ac178c 100644
--- a/pkgs/by-name/cr/creek/build.zig.zon.nix
+++ b/pkgs/by-name/cr/creek/build.zig.zon.nix
@@ -1,110 +1,31 @@
-# generated by zon2nix (https://github.com/Cloudef/zig2nix)
+# generated by zon2nix (https://github.com/nix-community/zon2nix)
+
 {
-  lib,
   linkFarm,
-  fetchurl,
+  fetchzip,
   fetchgit,
-  runCommandLocal,
-  zig,
-  name ? "zig-packages",
 }:
-let
-  unpackZigArtifact =
-    {
-      name,
-      artifact,
-    }:
-    runCommandLocal name { nativeBuildInputs = [ zig ]; } ''
-      hash="$(zig fetch --global-cache-dir "$TMPDIR" ${artifact})"
-      mv "$TMPDIR/p/$hash" "$out"
-      chmod 755 "$out"
-    '';
 
-  fetchZig =
-    {
-      name,
-      url,
-      hash,
-    }:
-    let
-      artifact = fetchurl { inherit url hash; };
-    in
-    unpackZigArtifact { inherit name artifact; };
-
-  fetchGitZig =
-    {
-      name,
-      url,
-      hash,
-    }:
-    let
-      parts = lib.splitString "#" url;
-      url_base = builtins.elemAt parts 0;
-      url_without_query = builtins.elemAt (lib.splitString "?" url_base) 0;
-      rev_base = builtins.elemAt parts 1;
-      rev =
-        if builtins.match "^[a-fA-F0-9]{40}$" rev_base != null then rev_base else "refs/heads/${rev_base}";
-    in
-    fetchgit {
-      inherit name rev hash;
-      url = url_without_query;
-      deepClone = false;
-    };
-
-  fetchZigArtifact =
-    {
-      name,
-      url,
-      hash,
-    }:
-    let
-      parts = lib.splitString "://" url;
-      proto = builtins.elemAt parts 0;
-      path = builtins.elemAt parts 1;
-      fetcher = {
-        "git+http" = fetchGitZig {
-          inherit name hash;
-          url = "http://${path}";
-        };
-        "git+https" = fetchGitZig {
-          inherit name hash;
-          url = "https://${path}";
-        };
-        http = fetchZig {
-          inherit name hash;
-          url = "http://${path}";
-        };
-        https = fetchZig {
-          inherit name hash;
-          url = "https://${path}";
-        };
-      };
-    in
-    fetcher.${proto};
-in
-linkFarm name [
+linkFarm "zig-packages" [
   {
-    name = "12209db20ce873af176138b76632931def33a10539387cba745db72933c43d274d56";
-    path = fetchZigArtifact {
-      name = "zig-pixman";
-      url = "https://codeberg.org/ifreund/zig-pixman/archive/v0.2.0.tar.gz";
-      hash = "sha256-CYgFIOR9H5q8UUpFglaixOocCMT6FGpcKQQBUVWpDKQ=";
+    name = "fcft-2.0.0-zcx6C5EaAADIEaQzDg5D4UvFFMjSEwDE38vdE9xObeN9";
+    path = fetchzip {
+      url = "https://git.sr.ht/~novakane/zig-fcft/archive/v2.0.0.tar.gz";
+      hash = "sha256-qDEtiZNSkzN8jUSnZP/itqh8rMf+lakJy4xMB0I8sxQ=";
     };
   }
   {
-    name = "1220687c8c47a48ba285d26a05600f8700d37fc637e223ced3aa8324f3650bf52242";
-    path = fetchZigArtifact {
-      name = "zig-wayland";
-      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.2.0.tar.gz";
-      hash = "sha256-gxzkHLCq2NqX3l4nEly92ARU5dqP1SqnjpGMDgx4TXA=";
+    name = "pixman-0.3.0-LClMnz2VAAAs7QSCGwLimV5VUYx0JFnX5xWU6HwtMuDX";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-pixman/archive/v0.3.0.tar.gz";
+      hash = "sha256-8tA4auo5FEI4IPnomV6bkpQHUe302tQtorFQZ1l14NU=";
     };
   }
   {
-    name = "1220a4029ee3ee70d3175c69878e2b70dccd000c4324bc74ba800d8a143b7250fb38";
-    path = fetchZigArtifact {
-      name = "zig-fcft";
-      url = "https://git.sr.ht/~novakane/zig-fcft/archive/1.1.0.tar.gz";
-      hash = "sha256-osL/zsXqa8tC/Qvzf0/wXeNCzw02F2viCo+d8Gh2S7U=";
+    name = "wayland-0.3.0-lQa1kjPIAQDmhGYpY-zxiRzQJFHQ2VqhJkQLbKKdt5wl";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.3.0.tar.gz";
+      hash = "sha256-ydEavD9z20wRwn9ZVX56ZI2T5i1tnm3LupVxfa30o84=";
     };
   }
 ]
diff --git a/pkgs/by-name/cr/creek/package.nix b/pkgs/by-name/cr/creek/package.nix
index c9971a1e6bad..e68f872896fa 100644
--- a/pkgs/by-name/cr/creek/package.nix
+++ b/pkgs/by-name/cr/creek/package.nix
@@ -1,7 +1,7 @@
 {
   callPackage,
   lib,
-  zig_0_13,
+  zig_0_14,
   stdenv,
   fetchFromGitHub,
   fcft,
@@ -12,43 +12,46 @@
   wayland-protocols,
 }:
 let
-  zig = zig_0_13;
+  zig = zig_0_14;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "creek";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "nmeum";
     repo = "creek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3Q690DEMgPqURTHKzJwH5iVyTLvgYqNpxuwAEV+/Lyw=";
+    hash = "sha256-5TANQt/VWafm6Lj4dYViiK0IMy/chGr/Gzq0S66HZqI=";
   };
 
+  depsBuildBuild = [ pkg-config ];
+
   nativeBuildInputs = [
     zig.hook
     pkg-config
-    wayland
     wayland-scanner
   ];
 
   buildInputs = [
     fcft
     pixman
+    wayland
     wayland-protocols
   ];
 
-  deps = callPackage ./build.zig.zon.nix {
-    inherit zig;
-  };
+  deps = callPackage ./build.zig.zon.nix { };
 
   zigBuildFlags = [
     "--system"
     "${finalAttrs.deps}"
   ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
-    homepage = "https://git.8pit.net/creek";
+    homepage = "https://github.com/nmeum/creek";
+    changelog = "https://github.com/nmeum/creek/releases/v${finalAttrs.version}";
     description = "Malleable and minimalist status bar for the River compositor";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ alexandrutocar ];
diff --git a/pkgs/by-name/cr/creek/update.sh b/pkgs/by-name/cr/creek/update.sh
new file mode 100755
index 000000000000..a346ab54c950
--- /dev/null
+++ b/pkgs/by-name/cr/creek/update.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash common-updater-scripts gnused nixfmt-rfc-style
+
+latest_tag=$(list-git-tags --url=https://github.com/nmeum/creek | sed 's/^v//' | tail -n 1)
+
+update-source-version creek "$latest_tag"
+
+wget "https://raw.githubusercontent.com/nmeum/creek/v${latest_tag}/build.zig.zon"
+nix --extra-experimental-features 'nix-command flakes' run github:nix-community/zon2nix# -- build.zig.zon >pkgs/by-name/cr/creek/build.zig.zon.nix
+
+nixfmt pkgs/by-name/cr/creek/build.zig.zon.nix
+
+rm -rf build.zig.zon
diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index 5453a266f42e..afe24ac2b1a3 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -85,6 +85,7 @@ rustPlatform.buildRustPackage {
     license = licenses.bsd3;
     platforms = [
       "aarch64-linux"
+      "riscv64-linux"
       "x86_64-linux"
     ];
   };
diff --git a/pkgs/by-name/el/element-desktop/element-desktop-pin.nix b/pkgs/by-name/el/element-desktop/element-desktop-pin.nix
index 6c2c1af2e9c1..732b2cc0676d 100644
--- a/pkgs/by-name/el/element-desktop/element-desktop-pin.nix
+++ b/pkgs/by-name/el/element-desktop/element-desktop-pin.nix
@@ -1,7 +1,7 @@
 {
-  "version" = "1.11.96";
+  "version" = "1.11.97";
   "hashes" = {
-    "desktopSrcHash" = "sha256-oTU/Pvl4gBp69OrUrXEYXupl0WphsEWt32sB4v6T+gA=";
-    "desktopYarnHash" = "sha256-zMdSA/CkMDXirWZ2uCPTgZ5iErV7rGyR+xcLh9sPDA8=";
+    "desktopSrcHash" = "sha256-4ea5C1I/bdGsy4CxsNB1GWL8RQnJpHr/MbIOB5Z+gFA=";
+    "desktopYarnHash" = "sha256-HI/aRf9pGao8m8z3oA0wdbjDQth3zijJeskV2D+KsgM=";
   };
 }
diff --git a/pkgs/by-name/el/element-desktop/package.nix b/pkgs/by-name/el/element-desktop/package.nix
index 8efe960d6b4f..c3da8dc800a3 100644
--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@@ -8,7 +8,7 @@
   nodejs,
   fetchYarnDeps,
   jq,
-  electron_34,
+  electron_35,
   element-web,
   sqlcipher,
   callPackage,
@@ -22,7 +22,7 @@ let
   pinData = import ./element-desktop-pin.nix;
   inherit (pinData.hashes) desktopSrcHash desktopYarnHash;
   executableName = "element-desktop";
-  electron = electron_34;
+  electron = electron_35;
   keytar = callPackage ./keytar {
     inherit electron;
   };
diff --git a/pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix b/pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix
index e6e132a09f70..efbc4f9e8d79 100644
--- a/pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix
@@ -1,7 +1,7 @@
 {
-  "version" = "1.11.96";
+  "version" = "1.11.97";
   "hashes" = {
-    "webSrcHash" = "sha256-EfSQEyMG9v5Boev98FyfzLA3hZLzxSGxAnZFfbc2aVA=";
-    "webYarnHash" = "sha256-Dp7WXEjWSDQjpmnJUrloIQau6is8YxTYzJmnQBIk+Ys=";
+    "webSrcHash" = "sha256-x7VS4l2uwXq2wjZeGwnaENHlhwnVz5Gt3f55kiH2Zhk=";
+    "webYarnHash" = "sha256-uwuBwAZYjt3WsbUCM8q9PaiV5WxKSpyJyVzM8gJOhPo=";
   };
 }
diff --git a/pkgs/by-name/ha/hawkeye/package.nix b/pkgs/by-name/ha/hawkeye/package.nix
index 87c36b489103..2dc04ad5a976 100644
--- a/pkgs/by-name/ha/hawkeye/package.nix
+++ b/pkgs/by-name/ha/hawkeye/package.nix
@@ -5,14 +5,14 @@
   pkg-config,
 }:
 
-rustPackages.rustPlatform.buildRustPackage rec {
+rustPackages.rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hawkeye";
   version = "6.0.3";
 
   src = fetchFromGitHub {
     owner = "korandoru";
     repo = "hawkeye";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-reeNsnWvn7sSfyqjGIk8jFnv8HaEBJsqitmNbRa9eTM=";
   };
 
@@ -24,10 +24,10 @@ rustPackages.rustPlatform.buildRustPackage rec {
   ];
 
   meta = {
-    homepage = "https://github.com/korandoro/hawkeye";
+    homepage = "https://github.com/korandoru/hawkeye";
     description = "Simple license header checker and formatter, in multiple distribution forms";
     license = lib.licenses.asl20;
     mainProgram = "hawkeye";
     maintainers = with lib.maintainers; [ matthiasbeyer ];
   };
-}
+})
diff --git a/pkgs/by-name/in/industrializer/package.nix b/pkgs/by-name/in/industrializer/package.nix
index 6c51086f6521..ec16b8b80101 100644
--- a/pkgs/by-name/in/industrializer/package.nix
+++ b/pkgs/by-name/in/industrializer/package.nix
@@ -6,10 +6,12 @@
   audiofile,
   autoconf,
   automake,
+  gettext,
   gnome2,
   gtk2,
   libGL,
   libjack2,
+  libpulseaudio,
   libtool,
   libxml2,
   pkg-config,
@@ -28,6 +30,10 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     autoconf
     automake
+    gettext # autopoint
+    libxml2 # AM_PATH_XML2
+    alsa-lib # AM_PATH_ALSA
+    libtool
   ];
 
   buildInputs = [
@@ -37,10 +43,12 @@ stdenv.mkDerivation (finalAttrs: {
     gtk2
     libGL
     libjack2
-    libtool
     libxml2
+    libpulseaudio
   ];
 
+  strictDeps = true;
+
   preConfigure = "./autogen.sh";
 
   # jack.c:190:5: error: initialization of 'const gchar * (*)(int)' {aka 'const char * (*)(int)'} from incompatible pointer type 'const char * (*)(int * (*)())
diff --git a/pkgs/development/misc/juce/juce-8.0.4-cmake_install.patch b/pkgs/by-name/ju/juce/juce-8.0.4-cmake_install.patch
similarity index 100%
rename from pkgs/development/misc/juce/juce-8.0.4-cmake_install.patch
rename to pkgs/by-name/ju/juce/juce-8.0.4-cmake_install.patch
diff --git a/pkgs/development/misc/juce/default.nix b/pkgs/by-name/ju/juce/package.nix
similarity index 87%
rename from pkgs/development/misc/juce/default.nix
rename to pkgs/by-name/ju/juce/package.nix
index 1dc141cee531..308103c09bb7 100644
--- a/pkgs/development/misc/juce/default.nix
+++ b/pkgs/by-name/ju/juce/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  overrideSDK,
   fetchFromGitHub,
 
   # Native build inputs
@@ -32,15 +33,23 @@
   nix-update-script,
 }:
 
+let
+  # Rebind this in a separate let-binding so that we can then rebind stdenv without infrec below
+  stdenv' = stdenv;
+in
+let
+  stdenv = if stdenv'.hostPlatform.isDarwin then overrideSDK stdenv' "11.0" else stdenv';
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "juce";
-  version = "8.0.6";
+  version = "8.0.7";
 
   src = fetchFromGitHub {
     owner = "juce-framework";
     repo = "juce";
     tag = finalAttrs.version;
-    hash = "sha256-uwZVBrvb5O9LEh00y93UeEu4u4rd+tLRCdQdxsMpXNg=";
+    hash = "sha256-nl4pUSkUKqpMoehzq0MS5pjHpYDkrFpUsY8BwpQObCM=";
   };
 
   patches = [
diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index c474a86bfdfe..9d3f621b9215 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -54,6 +54,6 @@ rustPlatform.buildRustPackage rec {
     description = "C ABI library which exposes Signal protocol logic";
     homepage = "https://github.com/signalapp/libsignal";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ niklaskorz ];
+    maintainers = with maintainers; [ alyaeanyx ];
   };
 }
diff --git a/pkgs/by-name/li/libzapojit/package.nix b/pkgs/by-name/li/libzapojit/package.nix
deleted file mode 100644
index ace4b1bbf65f..000000000000
--- a/pkgs/by-name/li/libzapojit/package.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  glib,
-  intltool,
-  json-glib,
-  librest,
-  libsoup_2_4,
-  gnome,
-  gnome-online-accounts,
-  gobject-introspection,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libzapojit";
-  version = "0.0.3";
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0zn3s7ryjc3k1abj4k55dr2na844l451nrg9s6cvnnhh569zj99x";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    intltool
-    gobject-introspection
-  ];
-  propagatedBuildInputs = [
-    glib
-    json-glib
-    librest
-    libsoup_2_4
-    gnome-online-accounts
-  ]; # zapojit-0.0.pc
-
-  passthru = {
-    updateScript = gnome.updateScript {
-      packageName = pname;
-      versionPolicy = "odd-unstable";
-    };
-  };
-
-  meta = with lib; {
-    description = "GObject wrapper for the SkyDrive and Hotmail REST APIs";
-    homepage = "https://gitlab.gnome.org/Archive/libzapojit";
-    license = licenses.lgpl21Plus;
-    maintainers = [ ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index 37f6fddacbd8..ea4a9001efe2 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.14.1",
-    "hash": "sha256-kKupLW0T6XUpmmjlQ4rTBn/bchzkOzvM5qg6PmLSAPk="
+    "version": "5.15.1",
+    "hash": "sha256-nN5bOoLtj5zL5dXZkA/P3sDxZwu/LKfXnMnCxtKJbC0="
   },
   "beta": {
-    "version": "5.14.1",
-    "hash": "sha256-kKupLW0T6XUpmmjlQ4rTBn/bchzkOzvM5qg6PmLSAPk="
+    "version": "5.15.1",
+    "hash": "sha256-nN5bOoLtj5zL5dXZkA/P3sDxZwu/LKfXnMnCxtKJbC0="
   }
 }
diff --git a/pkgs/by-name/ma/mago/package.nix b/pkgs/by-name/ma/mago/package.nix
index 21d545518bfb..ef663c369c3d 100644
--- a/pkgs/by-name/ma/mago/package.nix
+++ b/pkgs/by-name/ma/mago/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mago";
-  version = "0.22.2";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "carthage-software";
     repo = "mago";
     tag = version;
-    hash = "sha256-78lnNbUKjQYS2BSRGiGmFfnu85Mz+xAwaDG5pVCBqkQ=";
+    hash = "sha256-Kdktcq3czn6YdGKoTB7AjCtfDkNTHhee/kVhMzxsuD8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-lwL+5HuT6xiiittGlRDaFWfS9qum4xHginHT/TUMcco=";
+  cargoHash = "sha256-V7x0n+JcXiSGg8sJBKnsB5/KnfJSadYH0i/dNouhoHc=";
 
   env = {
     # Get openssl-sys to use pkg-config
diff --git a/pkgs/by-name/ma/mautrix-signal/package.nix b/pkgs/by-name/ma/mautrix-signal/package.nix
index 5f32a8660522..70e87a2a7961 100644
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -67,7 +67,7 @@ buildGoModule rec {
     description = "Matrix-Signal puppeting bridge";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [
-      niklaskorz
+      alyaeanyx
       ma27
     ];
     mainProgram = "mautrix-signal";
diff --git a/pkgs/by-name/mu/muffon/package.nix b/pkgs/by-name/mu/muffon/package.nix
index 5546b291ec43..70030c4925e8 100644
--- a/pkgs/by-name/mu/muffon/package.nix
+++ b/pkgs/by-name/mu/muffon/package.nix
@@ -7,10 +7,10 @@
 
 let
   pname = "muffon";
-  version = "2.1.0";
+  version = "2.2.0";
   src = fetchurl {
     url = "https://github.com/staniel359/muffon/releases/download/v${version}/muffon-${version}-linux-x86_64.AppImage";
-    hash = "sha256-GT91MLjBWsbk9P5fsIxlYUNziAPsdvMSPq9bLL3rKDw=";
+    hash = "sha256-VzT/jlNmUYFmUUqi8EzE4ilawezqhSgXHz32+S3FMTo=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname src version; };
 in
diff --git a/pkgs/by-name/ni/nixos-anywhere/package.nix b/pkgs/by-name/ni/nixos-anywhere/package.nix
index 4a80fd1b9c9c..2077e794025b 100644
--- a/pkgs/by-name/ni/nixos-anywhere/package.nix
+++ b/pkgs/by-name/ni/nixos-anywhere/package.nix
@@ -31,12 +31,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nixos-anywhere";
-  version = "1.8.0";
+  version = "1.9.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nixos-anywhere";
     rev = finalAttrs.version;
-    hash = "sha256-7kHxBQuzb7gcHzVmLGljJ4kF6BDDSYVCIxYFDmYPnAo=";
+    hash = "sha256-DGJ52K2cN3MRUlI/knH0tipGja0Agfk+QVfIQL1gWT4=";
   };
   nativeBuildInputs = [ makeWrapper ];
   installPhase = ''
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 8234e8ba8f12..d6011a8caa02 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -27,29 +27,20 @@
   xorg,
 }:
 let
-  version = "2.15.1";
+  version = "2.15.2";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-vICkRfVxzQlqhSBCieVNSGeXb6FCOx0qOnInKMy6Lhg=";
+    hash = "sha256-3IGXjMVMSbpcdwEvJcMbFuQI9GYy1TY9NWAvum14UK4=";
   };
 
-  # subpath installation is broken with uvicorn >= 0.26
-  # https://github.com/NixOS/nixpkgs/issues/298719
-  # https://github.com/paperless-ngx/paperless-ngx/issues/5494
   python = python3.override {
     self = python;
     packageOverrides = final: prev: {
       django = prev.django_5;
 
-      django-extensions = prev.django-extensions.overridePythonAttrs (_: {
-        # fails with: TypeError: 'class Meta' got invalid attribute(s): index_together
-        # probably because of django_5 but it is the latest version available and used like that in paperless-ngx
-        doCheck = false;
-      });
-
       # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
       ocrmypdf = prev.ocrmypdf.override { tesseract = tesseract5; };
     };
diff --git a/pkgs/by-name/po/portunus/package.nix b/pkgs/by-name/po/portunus/package.nix
index 96408db6f66d..e09bf265b52f 100644
--- a/pkgs/by-name/po/portunus/package.nix
+++ b/pkgs/by-name/po/portunus/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "portunus";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "majewsky";
     repo = "portunus";
     rev = "v${version}";
-    sha256 = "sha256-+pMMIutj+OWKZmOYH5NuA4a7aS5CD+33vAEC9bJmyfM=";
+    sha256 = "sha256-nLFwfH1K6vsgNATwAxyq/q6HTtfLK8gsQhei7eJ86Kc=";
   };
 
   buildInputs = [ libxcrypt ];
diff --git a/pkgs/by-name/pr/prowler/package.nix b/pkgs/by-name/pr/prowler/package.nix
index 836deed2015e..9677e9f0ce03 100644
--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@@ -21,14 +21,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "prowler";
-  version = "5.5.0";
+  version = "5.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "prowler-cloud";
     repo = "prowler";
     tag = version;
-    hash = "sha256-HHSMGqLroFGY39znzRw8kJpQOyAvHzgeIBcGj5sM24A=";
+    hash = "sha256-SljpmFZNfenLB+meJHjnGsnDCRBi+60/IMlJLWtBw7Q=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/py/pyfa/package.nix b/pkgs/by-name/py/pyfa/package.nix
index 5851bcd5475e..578ef30da73e 100644
--- a/pkgs/by-name/py/pyfa/package.nix
+++ b/pkgs/by-name/py/pyfa/package.nix
@@ -10,7 +10,7 @@
   copyDesktopItems,
 }:
 let
-  version = "2.62.2";
+  version = "2.62.3";
 in
 python3Packages.buildPythonApplication rec {
   inherit version;
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
     owner = "pyfa-org";
     repo = "Pyfa";
     tag = "v${version}";
-    hash = "sha256-7YFObKV4vXiTWgCfek7k4yVq7IG3JMtaB36Jhu7rGjk=";
+    hash = "sha256-PqiwZwok7Mv1M4txU3D5MZYu8WxDCetLmvTqZ30rypY=";
   };
 
   desktopItems = [
diff --git a/pkgs/by-name/sl/slskd/deps.json b/pkgs/by-name/sl/slskd/deps.json
index 2229e5050cb4..afffb6a8d3dd 100644
--- a/pkgs/by-name/sl/slskd/deps.json
+++ b/pkgs/by-name/sl/slskd/deps.json
@@ -781,8 +781,8 @@
   },
   {
     "pname": "Soulseek",
-    "version": "7.0.1",
-    "hash": "sha256-sGs+AomE20UILH0+RcArkMAR/Xk7yewppMnvg2YZ1WQ="
+    "version": "7.0.3",
+    "hash": "sha256-/GCUh4XJ4zs5etxQ0GjNJozkS2GZ/Qq1cot1+bRQack="
   },
   {
     "pname": "SQLitePCLRaw.bundle_e_sqlite3",
diff --git a/pkgs/by-name/sl/slskd/package.nix b/pkgs/by-name/sl/slskd/package.nix
index d022abfbc63c..c42b98dad505 100644
--- a/pkgs/by-name/sl/slskd/package.nix
+++ b/pkgs/by-name/sl/slskd/package.nix
@@ -19,13 +19,13 @@ let
 in
 buildDotnetModule rec {
   pname = "slskd";
-  version = "0.22.3";
+  version = "0.22.5";
 
   src = fetchFromGitHub {
     owner = "slskd";
     repo = "slskd";
     tag = version;
-    hash = "sha256-CXJ55mtNVaPZVxuzYyiMjnJJZPAUlRc/DHKt6+ZfWHo=";
+    hash = "sha256-gLPWbRffoCJAdg8zP9idfnzqT1nIZrI88cYUd/DyxZA=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ buildDotnetModule rec {
     name = "${pname}-${version}-npm-deps";
     inherit src;
     sourceRoot = "${src.name}/${npmRoot}";
-    hash = "sha256-I/rgSIFFCA47Y22zbmrrdUWS7mHCxKmFwO3QNBHTdCM=";
+    hash = "sha256-GACe+ufxiSlS1aD9R+I8VqbZqi2gCHUp+Dm/XMx2WZQ=";
   };
 
   projectFile = "slskd.sln";
diff --git a/pkgs/by-name/sp/spacetimedb/package.nix b/pkgs/by-name/sp/spacetimedb/package.nix
index c96a27fac831..b6bccdac05f6 100644
--- a/pkgs/by-name/sp/spacetimedb/package.nix
+++ b/pkgs/by-name/sp/spacetimedb/package.nix
@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spacetimedb";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "clockworklabs";
     repo = "spacetimedb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yqBKZOUDdvBcW8OzO832P75miNKUluR+fR1FSOcDoSM=";
+    hash = "sha256-WBPH/vwko7Znh6yJi3DOwZ9SnfCpOcX1so/svBCjFQ8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-W3SbJE0tt391k6MscgaijCStSyzfTN2MR66a6K+Ui4s=";
+  cargoHash = "sha256-YObtesidnH0GMGD9ENS4YSrcBB4A4TAQmqV4NodSwfY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ta/tail-tray/package.nix b/pkgs/by-name/ta/tail-tray/package.nix
index 4b502245a003..79fbf5a6b481 100644
--- a/pkgs/by-name/ta/tail-tray/package.nix
+++ b/pkgs/by-name/ta/tail-tray/package.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation rec {
     description = "Tray icon to manage Tailscale";
     homepage = "https://github.com/SneWs/tail-tray";
     changelog = "https://github.com/SneWs/tail-tray/releases/tag/${version}";
+    mainProgram = "tail-tray";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ Svenum ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/te/telepresence2/package.nix b/pkgs/by-name/te/telepresence2/package.nix
index e5aea69a6f1a..67a04bac7181 100644
--- a/pkgs/by-name/te/telepresence2/package.nix
+++ b/pkgs/by-name/te/telepresence2/package.nix
@@ -8,16 +8,16 @@
 let
   fuseftp = buildGoModule rec {
     pname = "go-fuseftp";
-    version = "0.4.2";
+    version = "0.6.6";
 
     src = fetchFromGitHub {
       owner = "datawire";
       repo = "go-fuseftp";
       rev = "v${version}";
-      hash = "sha256-bkaC+EOqFPQA4fDkVhO6EqgGhOJy31yGwVbbPoRd+70=";
+      hash = "sha256-70VmT8F+RNiDk6fnrzDktdfNhZk20sXF+b3TBTAkNHo=";
     };
 
-    vendorHash = "sha256-Dk4wvg2lTGTw8vP42+XuvmMXeMluR0SPwlVHLEB8yCQ=";
+    vendorHash = "sha256-wp4jOmeVdfuRwdclCzBonNCkhgsNUBOBL6gxlrznC1A=";
 
     buildInputs = [ fuse ];
 
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.22.1";
+  version = "2.22.3";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-Bae77Kzc2cWxIb1yYKXctffuiC3ICPfi0qYP6fgaqvQ=";
+    hash = "sha256-xrWlm5crDybvcOX3TevXcEq63Vuw0u9+4NvktIG6LxU=";
   };
 
   propagatedBuildInputs = [
@@ -51,7 +51,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-toqQDa3hY2EvWjYpFXWafV9yj1U5CZXZOqQAQtOMITo=";
+  vendorHash = "sha256-spIdC2ZV+2tm3noyEhygoblN2BjE0w75n4I3jsrg6HI=";
 
   ldflags = [
     "-s"
@@ -68,6 +68,7 @@ buildGoModule rec {
     maintainers = with maintainers; [
       mausch
       vilsol
+      wrbbz
     ];
     mainProgram = "telepresence";
   };
diff --git a/pkgs/by-name/ti/tideways-daemon/package.nix b/pkgs/by-name/ti/tideways-daemon/package.nix
index a7842e63dd2a..a54bc0e3ca65 100644
--- a/pkgs/by-name/ti/tideways-daemon/package.nix
+++ b/pkgs/by-name/ti/tideways-daemon/package.nix
@@ -10,7 +10,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-daemon";
-  version = "1.9.36";
+  version = "1.9.38";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -28,15 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-+EnXHjFAD23jmG8IucnppjWeGNKX6yzWJypICECy3do=";
+        hash = "sha256-zQ8K0oHTZfQCEYAsnKsdgGaDTlRwEfCiJpd4lxy4Q5M=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_aarch64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-p5/wzvr7EyvELADfA1X/mo8VdAT47SbAXZlIWdGZVb4=";
+        hash = "sha256-atRvSpc56z5Vxo5/YGz9QzCPEP79qjl2GN0vR3nkBAE=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-uI7qOO7nj32BXrNFMmQlX32omT4Kxruf/J7A63QQ62w=";
+        hash = "sha256-+X+WbHtOFW4YGyRmj388bBH0jHezWnPfTBiiOw3LFFY=";
       };
     };
     updateScript = "${
diff --git a/pkgs/by-name/tr/treefmt/build-config.nix b/pkgs/by-name/tr/treefmt/build-config.nix
index 65fe7ca8f089..c4eb298a051c 100644
--- a/pkgs/by-name/tr/treefmt/build-config.nix
+++ b/pkgs/by-name/tr/treefmt/build-config.nix
@@ -24,6 +24,7 @@ settingsFile.overrideAttrs {
   passthru = {
     format = settingsFormat;
     settings = configuration.config;
-    inherit (configuration) _module options type;
+    inherit (configuration) _module options;
+    optionType = configuration.type;
   };
 }
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index 2a78c7be03b1..48c57c269c81 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -13,7 +13,7 @@
   pipewire,
   libpulseaudio,
   autoPatchelfHook,
-  pnpm_9,
+  pnpm_10,
   nodejs,
   nix-update-script,
   withTTS ? true,
@@ -24,29 +24,29 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vesktop";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "Vencord";
     repo = "Vesktop";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-z2MKnCWDWUczoz39zzBYRB6wiSU1SRRHLpeUZeJqbLc=";
+    hash = "sha256-hY707k3kpfbDaRsLisVQFUeWgsxkYJ29GTdQtdeC0X4=";
   };
 
-  pnpmDeps = pnpm_9.fetchDeps {
+  pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs)
       pname
       version
       src
       patches
       ;
-    hash = "sha256-xn3yE2S6hfCijV+Edx3PYgGro8eF76/GqarOIRj9Tbg=";
+    hash = "sha256-pL4pxIB+tF9Lv5eQdLilvg/T4knjzPqBMbTxoZ3RqbI=";
   };
 
   nativeBuildInputs =
     [
       nodejs
-      pnpm_9.configHook
+      pnpm_10.configHook
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       # vesktop uses venmic, which is a shipped as a prebuilt node module
diff --git a/pkgs/by-name/wa/wavebox/package.nix b/pkgs/by-name/wa/wavebox/package.nix
index a8a0e0b29b58..fabb5162c298 100644
--- a/pkgs/by-name/wa/wavebox/package.nix
+++ b/pkgs/by-name/wa/wavebox/package.nix
@@ -156,11 +156,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "wavebox";
-  version = "10.135.5-2";
+  version = "10.135.15-2";
 
   src = fetchurl {
     url = "https://download.wavebox.app/stable/linux/deb/amd64/wavebox_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-TTRTQI7CwAs4H47pkCo50yuoXsrD7DXyTyYQDycP9e8=";
+    hash = "sha256-nQWaPDHkwBjV7IUYf+e1NkYzXpnV15XZmqkT/Vz16Gc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index 98b7f159bd24..c40d3dcda16d 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.34.1";
+  version = "2.35.3";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hWkU3tyh0kQ9GNl5gQIs4wTRBQV0B3/0oOAhKLo1hOo=";
+    hash = "sha256-ebbc8pKZ8QkxGq9MttpulBkQLXcjH25Zoq8owxIamKg=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-x9ehxBfyk5sMg71yJcyjcrBAi5bzEnENAaqLXFoGQck=";
+  vendorHash = "sha256-Bgi8Pd7lON0DTSzHKaHHbqdS9S/i01tJV/x5bgmiWCo=";
 
   subPackages = [ "cmd/werf" ];
 
diff --git a/pkgs/by-name/xk/xk6/package.nix b/pkgs/by-name/xk/xk6/package.nix
index 0ad9b244d0e0..62463375c89c 100644
--- a/pkgs/by-name/xk/xk6/package.nix
+++ b/pkgs/by-name/xk/xk6/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "xk6";
-  version = "0.16.1";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "xk6";
     tag = "v${version}";
-    hash = "sha256-fUlK0/P64gCGPek79mYNbL/1PbrZxD9D3Werh9Oe/6k=";
+    hash = "sha256-Ob9H3EMEo611Ivyu2UoR7ZHXvWPjJAR4T0HBTRhmH+M=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/zd/zdns/package.nix b/pkgs/by-name/zd/zdns/package.nix
index 69b23d68c823..808d43a54c3f 100644
--- a/pkgs/by-name/zd/zdns/package.nix
+++ b/pkgs/by-name/zd/zdns/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "zdns";
-  version = "2.0.0";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-ypjUJbTQ0ntLXNRiA96BqDn/SgcbjVe9dd9zmmSqAic=";
+    hash = "sha256-ZwZCDiZ4rZ8ODaEd/81muMT+OvOe59hRcNi9iZKqdFs=";
   };
 
-  vendorHash = "sha256-Q7W+G/yA/EvHqvDUl3T5BoP+K5ZTcLFLSaWw4TPMH2U=";
+  vendorHash = "sha256-f5qboa7AIAG67Yla5sPr7r1HgW8n16SnbIOuGy7JjWs=";
 
   preCheck = ''
     # Tests require network access
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index ae23102b90a6..0c04a505e448 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -31,7 +31,7 @@ let
     "17.0.6".officialRelease.sha256 = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag=";
     "18.1.8".officialRelease.sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE=";
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
-    "20.1.2".officialRelease.sha256 = "sha256-t30Jh8ckp5qD6XDxtvnSaYiAWbEi6L6hAWh6tN8JjtY=";
+    "20.1.3".officialRelease.sha256 = "sha256-sOl90iRBlD+DGJs72JrP9cJz6XmWs/5PL+uW4nt6LA0=";
     "21.0.0-git".gitRelease = {
       rev = "ebba554a3211b0b98d3ae33ba70f9d6ceaab6ad4";
       rev-version = "21.0.0-unstable-2025-04-13";
diff --git a/pkgs/development/libraries/xdg-desktop-portal/default.nix b/pkgs/development/libraries/xdg-desktop-portal/default.nix
index 1b4ec15a1b93..239cbd16be0f 100644
--- a/pkgs/development/libraries/xdg-desktop-portal/default.nix
+++ b/pkgs/development/libraries/xdg-desktop-portal/default.nix
@@ -76,6 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     docutils # for rst2man
+    glib
     meson
     ninja
     pkg-config
@@ -169,6 +170,12 @@ stdenv.mkDerivation (finalAttrs: {
     export LD_PRELOAD=${lib.getLib umockdev}/lib/libumockdev-preload.so
   '';
 
+  # We can't disable the installedTests output when doCheck is disabled,
+  # because that produces an infinite recursion.
+  preFixup = lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
+    mkdir $installedTests
+  '';
+
   passthru = {
     tests = {
       installedTests = nixosTests.installed-tests.xdg-desktop-portal;
diff --git a/pkgs/development/python-modules/aioftp/default.nix b/pkgs/development/python-modules/aioftp/default.nix
index 7daff8dc5845..d40ada974b8e 100644
--- a/pkgs/development/python-modules/aioftp/default.nix
+++ b/pkgs/development/python-modules/aioftp/default.nix
@@ -6,6 +6,7 @@
   fetchPypi,
   pytest-asyncio,
   pytest-cov-stub,
+  pytest-mock,
   pytestCheckHook,
   pythonOlder,
   setuptools,
@@ -15,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aioftp";
-  version = "0.24.1";
+  version = "0.25.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dKx8buSFXk24/6LC+xWXeJppeBfEe6IaVOuQOfQ1aK8=";
+    hash = "sha256-TS+wt30/2kKCz/zQW6cFZ9iUDNn97t8QvfeIoAEggBY=";
   };
 
   build-system = [ setuptools ];
@@ -35,6 +36,7 @@ buildPythonPackage rec {
     async-timeout
     pytest-asyncio
     pytest-cov-stub
+    pytest-mock
     pytestCheckHook
     trustme
   ] ++ lib.flatten (builtins.attrValues optional-dependencies);
@@ -49,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python FTP client/server for asyncio";
     homepage = "https://aioftp.readthedocs.io/";
+    changelog = "https://github.com/aio-libs/aioftp/blob/${version}/history.rst";
     license = licenses.asl20;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index 7fffbeda4894..dc09c49df9b2 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.25.7";
+  version = "0.26.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Nd4fqCQqlRo7pbOl6P+/kdTGpr/o5IjIMIrP6KDFe3w=";
+    hash = "sha256-qNY6fcxkhMXBZ1sxqNG2cmw9yFsTeW+xQ9+wByJgk14=";
   };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/development/python-modules/bc-detect-secrets/default.nix b/pkgs/development/python-modules/bc-detect-secrets/default.nix
index 16d9b839ecce..d887687e6d2d 100644
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.5.40";
+  version = "1.5.41";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     tag = version;
-    hash = "sha256-qvQqcRD4L+due3Rbxp1H+83obg85rNxYPwy/g8zvW38=";
+    hash = "sha256-YFBG/0jT7o2HFUDWzpr1N+aRcg9iVFyyYqDL0TuBOAw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/censys/default.nix b/pkgs/development/python-modules/censys/default.nix
index 62defd84ef41..cd194b0aa219 100644
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "censys";
-  version = "2.2.16";
+  version = "2.2.17";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "censys";
     repo = "censys-python";
     tag = "v${version}";
-    hash = "sha256-OP7+jSt4xS71Kcjy5hFzeZ5rlTPtDx22rPr3UwjI5dk=";
+    hash = "sha256-1V7IeaV7Ro1q5UyD2DDetunaRO2L4UbF1VODg5ktqKs=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/devolo-plc-api/default.nix b/pkgs/development/python-modules/devolo-plc-api/default.nix
index 9f3ba9a4471b..d9dcbbb73a3f 100644
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@@ -12,13 +12,14 @@
   segno,
   setuptools-scm,
   syrupy,
+  tenacity,
   zeroconf,
 }:
 
 buildPythonPackage rec {
   pname = "devolo-plc-api";
-  version = "1.4.1";
-  format = "pyproject";
+  version = "1.5.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -26,7 +27,7 @@ buildPythonPackage rec {
     owner = "2Fake";
     repo = "devolo_plc_api";
     tag = "v${version}";
-    hash = "sha256-EP99AswHmLO+8ZQAPjJyw/P9QqfDawy3AqyJR870Qms=";
+    hash = "sha256-bmZcjvqZwVJzDsdtSbQvJpry2QSSuB6/jOTWG1+jyV4=";
   };
 
   postPatch = ''
@@ -34,12 +35,13 @@ buildPythonPackage rec {
       --replace-fail "protobuf>=4.22.0" "protobuf"
   '';
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     httpx
     protobuf
     segno
+    tenacity
     zeroconf
   ];
 
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 617ecdb8d7f9..69705997f4f9 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -18,15 +18,15 @@
 
 buildPythonPackage rec {
   pname = "env-canada";
-  version = "0.8.0";
+  version = "0.10.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
-    tag = "v${version}";
+    tag = version;
     hash = "sha256-4PztYdQmMH2n3dlV8arJ2UFGp08nkIK80L460UdNhV8=";
   };
 
@@ -66,7 +66,7 @@ buildPythonPackage rec {
     description = "Python library to get Environment Canada weather data";
     homepage = "https://github.com/michaeldavie/env_canada";
     changelog = "https://github.com/michaeldavie/env_canada/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/gcp-storage-emulator/default.nix b/pkgs/development/python-modules/gcp-storage-emulator/default.nix
index 91d4d81042a9..aa60e1faeb2a 100644
--- a/pkgs/development/python-modules/gcp-storage-emulator/default.nix
+++ b/pkgs/development/python-modules/gcp-storage-emulator/default.nix
@@ -39,6 +39,10 @@ buildPythonPackage rec {
     requests
   ];
 
+  disabledTests = [
+    "test_invalid_crc32c_hash" # AssertionError
+  ];
+
   pythonImportsCheck = [
     "gcp_storage_emulator"
   ];
diff --git a/pkgs/development/python-modules/holidays/default.nix b/pkgs/development/python-modules/holidays/default.nix
index 9ed287b200b9..1ff9a7e49695 100644
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.69";
+  version = "0.70";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "vacanza";
     repo = "python-holidays";
     tag = "v${version}";
-    hash = "sha256-dt5f4Mu44YPKdoO6J3WKM5KXrHeAs+hKDF/c5mee6Z8=";
+    hash = "sha256-0YjkuGJZbueoFerHKSHjIGn+NwFrz7rJRnrFLx28v6w=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/kasa-crypt/default.nix b/pkgs/development/python-modules/kasa-crypt/default.nix
index 5d78453d41af..1899befb4bf1 100644
--- a/pkgs/development/python-modules/kasa-crypt/default.nix
+++ b/pkgs/development/python-modules/kasa-crypt/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "kasa-crypt";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = "kasa-crypt";
     tag = "v${version}";
-    hash = "sha256-eP8GgogyvmrPbsXGWq9RqkinezNGVlDXC/BfgO+dUJ0=";
+    hash = "sha256-0E82lMop1fW2NHBO+lQzces19059vMDFeKzLAD9YrEw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/kivy/default.nix b/pkgs/development/python-modules/kivy/default.nix
index 83904935fb45..36b5623e4cf9 100644
--- a/pkgs/development/python-modules/kivy/default.nix
+++ b/pkgs/development/python-modules/kivy/default.nix
@@ -8,6 +8,8 @@
   docutils,
   setuptools,
   kivy-garden,
+  libGL,
+  libX11,
   mtdev,
   SDL2,
   SDL2_image,
@@ -50,6 +52,8 @@ buildPythonPackage rec {
       SDL2_mixer
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libGL
+      libX11
       mtdev
     ]
     ++ lib.optionals withGstreamer (
diff --git a/pkgs/development/python-modules/marimo/default.nix b/pkgs/development/python-modules/marimo/default.nix
index 40c8b266e840..c13eb4f56680 100644
--- a/pkgs/development/python-modules/marimo/default.nix
+++ b/pkgs/development/python-modules/marimo/default.nix
@@ -33,13 +33,13 @@
 
 buildPythonPackage rec {
   pname = "marimo";
-  version = "0.12.2";
+  version = "0.12.9";
   pyproject = true;
 
   # The github archive does not include the static assets
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FrOuujO0YUneQYQdnVKKzJIGqfcUoHDWpf28SJlAgOY=";
+    hash = "sha256-Ikca+3BH14YYSQRyESaU7zXekxsiOq16iGKiXBcOpMU=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index d20b33509c34..c4041838f53f 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "model-checker";
-  version = "0.9.11";
+  version = "0.9.16";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "model_checker";
     inherit version;
-    hash = "sha256-MZchcU9ijdHF9bLF4dwF71fqRNuRO9+vF54dJsVZzyY=";
+    hash = "sha256-AEI92rwUIiK337Jg+hLXWE2L9M/mdcDbtG4lm3x6SHY=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
diff --git a/pkgs/development/python-modules/msgraph-sdk/default.nix b/pkgs/development/python-modules/msgraph-sdk/default.nix
index 34fce1a15757..eb9dde0636ac 100644
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "msgraph-sdk";
-  version = "1.27.0";
+  version = "1.28.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "microsoftgraph";
     repo = "msgraph-sdk-python";
     tag = "v${version}";
-    hash = "sha256-SMb/iw/3TYfWr/1GBF+FKCpgwI32nzpkYw+xQTQmWrQ=";
+    hash = "sha256-ZENjxJPGdMUGwNdETuwXqmlTYR2HkTb8UuDqs/cly7Q=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/otpauth/default.nix b/pkgs/development/python-modules/otpauth/default.nix
index ba926db3e6ed..40ac405462ae 100644
--- a/pkgs/development/python-modules/otpauth/default.nix
+++ b/pkgs/development/python-modules/otpauth/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
-  setuptools,
+  hatchling,
   pytestCheckHook,
 }:
 
@@ -20,11 +20,11 @@ buildPythonPackage rec {
     hash = "sha256-Ev2uZNBmT/v6/a39weyP5XGs0OcaYveSM9072giNOcI=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [ pname ];
+  pythonImportsCheck = [ "otpauth" ];
 
   meta = with lib; {
     description = "Implements one time password of HOTP/TOTP";
diff --git a/pkgs/development/python-modules/py-tes/default.nix b/pkgs/development/python-modules/py-tes/default.nix
index eaa25960948e..4429a8816794 100644
--- a/pkgs/development/python-modules/py-tes/default.nix
+++ b/pkgs/development/python-modules/py-tes/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "py-tes";
-  version = "1.1.0";
+  version = "1.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "ohsu-comp-bio";
     repo = "py-tes";
     tag = version;
-    hash = "sha256-PP6l9HITC8JDOUVwf+S5tDOZDIFST9Uz+ttG0xJwrB0=";
+    hash = "sha256-hZF4koc/nZ8rBYKfhIQCLtn4DKiljJrSBgkKX8bMoQ0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycrdt-websocket/default.nix b/pkgs/development/python-modules/pycrdt-websocket/default.nix
index a5de0310fb25..ec07f899bdbe 100644
--- a/pkgs/development/python-modules/pycrdt-websocket/default.nix
+++ b/pkgs/development/python-modules/pycrdt-websocket/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "pycrdt-websocket";
-  version = "0.15.4";
+  version = "0.15.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
     repo = "pycrdt-websocket";
     tag = "v${version}";
-    hash = "sha256-yDmi8tb7Tq4ro97mFxbPVLwaHhyYKQbnRLB04u2k5xo=";
+    hash = "sha256-piNd85X5YsTAOC9frYQRDyb/DPfzZicIPJ+bEVzgOsU=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index a71c586dbe55..698d2fc51ecb 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -162,9 +162,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.171"
+version = "0.2.172"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
 
 [[package]]
 name = "lock_api"
@@ -245,7 +245,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.12.12"
+version = "0.12.13"
 dependencies = [
  "pyo3",
  "yrs",
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index bd3bc1cd4a97..a6c481bd3ddc 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pycrdt";
-  version = "0.12.12";
+  version = "0.12.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
     repo = "pycrdt";
     tag = version;
-    hash = "sha256-qRr6L27X0g0mvxPECijunpxJilse9fzdKAQZOM0MoDQ=";
+    hash = "sha256-EI8LrT5wddmmw3D5C+IhJnViGnSbHWMD3WFp/f1hY7M=";
   };
 
   postPatch = ''
@@ -53,6 +53,11 @@ buildPythonPackage rec {
     y-py
   ];
 
+  pytestFlagsArray = [
+    "-W"
+    "ignore::pytest.PytestUnknownMarkWarning" # requires unpackaged pytest-mypy-testing
+  ];
+
   passthru.updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; };
 
   meta = {
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index 95130d2d8c31..1ddc28bd2748 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.59.0";
+  version = "0.60.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     tag = version;
-    hash = "sha256-PtvQkUm0YydXg5/NCi7P+nWoJPgIScJbmvG6VR0cvWc=";
+    hash = "sha256-wXf2uqIlzRQ+6vecT0Xk9pWqypRsHefFYMlijc5h1dg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/siosocks/default.nix b/pkgs/development/python-modules/siosocks/default.nix
index 7bbcce74073f..5532b256346f 100644
--- a/pkgs/development/python-modules/siosocks/default.nix
+++ b/pkgs/development/python-modules/siosocks/default.nix
@@ -4,15 +4,17 @@
   fetchPypi,
   pytest-asyncio,
   pytest-trio,
+  pytest-mock,
   pytestCheckHook,
   pythonOlder,
+  setuptools,
   trio,
 }:
 
 buildPythonPackage rec {
   pname = "siosocks";
   version = "0.3.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -21,10 +23,13 @@ buildPythonPackage rec {
     hash = "sha256-uja79vWhPYOhhTUBIh+XpS4GnrYJy0/XpDXXQjnyHWM=";
   };
 
-  propagatedBuildInputs = [ trio ];
+  build-system = [ setuptools ];
+
+  dependencies = [ trio ];
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-mock
     pytestCheckHook
     pytest-trio
   ];
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index 5c652a8fb4c9..3caee9945d97 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "zarr";
-  version = "2.18.5";
+  version = "2.18.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yWW/JbWCX8/PM5vabDKaVskJl98SMkNeJ7ZKoTbxQsc=";
+    hash = "sha256-srj2bxTaxK9msYDSM4gZmBuYH3Dhlsmmbmv6qeWVcvU=";
   };
 
   build-system = [
diff --git a/pkgs/development/tools/build-managers/alibuild/default.nix b/pkgs/development/tools/build-managers/alibuild/default.nix
deleted file mode 100644
index ff502781d317..000000000000
--- a/pkgs/development/tools/build-managers/alibuild/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  python,
-  fetchPypi,
-}:
-
-python.pkgs.buildPythonApplication rec {
-  pname = "alibuild";
-  version = "1.11.2";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-wq2H2inUf2CjPD45krCNdjw2s4FXsEDlfOHqW8VaVKg=";
-  };
-
-  doCheck = false;
-  propagatedBuildInputs = with python.pkgs; [
-    requests
-    pyyaml
-    boto3
-    jinja2
-    distro
-  ];
-
-  meta = with lib; {
-    homepage = "https://alisw.github.io/alibuild/";
-    description = "Build tool for ALICE experiment software";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ ktf ];
-  };
-}
diff --git a/pkgs/tools/networking/opendrop/default.nix b/pkgs/tools/networking/opendrop/default.nix
index 704ee944b685..04c93dd1827d 100644
--- a/pkgs/tools/networking/opendrop/default.nix
+++ b/pkgs/tools/networking/opendrop/default.nix
@@ -10,6 +10,7 @@
   setuptools,
   zeroconf,
   pytestCheckHook,
+  writableTmpDirAsHomeHook,
   openssl,
 }:
 
@@ -48,10 +49,7 @@ buildPythonApplication rec {
     pytestCheckHook
   ];
 
-  preCheck = ''
-    # Solves PermissionError: [Errno 13] Permission denied: '/homeless-shelter'
-    export HOME=$(mktemp -d)
-  '';
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
   meta = with lib; {
     description = "Open Apple AirDrop implementation written in Python";
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index 07179b651fe7..dbcdf20fc543 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "11.49.0";
+  version = "11.50.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${version}";
-    hash = "sha256-rT4BXmUCKC310sEWyNPQHxEtx+Z0ZVf4NQR1AkvRCIo=";
+    hash = "sha256-Ope7bPXTNMWuRlGWBuqjp31xCH6bjbgu6Hjf9sSQB+0=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-evFBYVIR2qNlnpRUzTZBLFknfkLO7zneTIZEAfyzgjg=";
+  vendorHash = "sha256-EChYXDMsk40NyOHTZNMEbfcTu3vqoFgR4n8PXTlerV0=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 06f8f4c78c7e..5cd67e0b58e4 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -966,6 +966,7 @@ mapAliases {
   libxplayer-plparser = throw "libxplayer-plparser has been removed as the upstream project was archived"; # Added 2024-12-27
   libyamlcpp = yaml-cpp; # Added 2023-01-29
   libyamlcpp_0_3 = yaml-cpp_0_3; # Added 2023-01-29
+  libzapojit = throw "'libzapojit' has been removed due to lack of upstream maintenance and archival"; # Added 2025-04-16
   licensor = throw "'licensor' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   lightdm_gtk_greeter = lightdm-gtk-greeter; # Added 2022-08-01
   lightstep-tracer-cpp = throw "lightstep-tracer-cpp is deprecated since 2022-08-29; the upstream recommends migration to opentelemetry projects.";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b03ffcc2e61f..fdd3e8b1effc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2521,10 +2521,6 @@ with pkgs;
 
   jellyfin-mpv-shim = python3Packages.callPackage ../applications/video/jellyfin-mpv-shim { };
 
-  juce = callPackage ../development/misc/juce {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-  };
-
   kaldi = callPackage ../tools/audio/kaldi {
     inherit (darwin.apple_sdk.frameworks) Accelerate;
   };
@@ -19438,10 +19434,6 @@ with pkgs;
 
   openbsd = callPackage ../os-specific/bsd/openbsd { };
 
-  alibuild = callPackage ../development/tools/build-managers/alibuild {
-    python = python3;
-  };
-
   bcompare = libsForQt5.callPackage ../applications/version-management/bcompare { };
 
   xp-pen-deco-01-v2-driver = libsForQt5.xp-pen-deco-01-v2-driver;