diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index db358c759d81..77247d269808 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -120,6 +120,8 @@ let
         libc =
           if final.isDarwin then
             "libSystem"
+          else if final.isMsvc then
+            "ucrt"
           else if final.isMinGW then
             "msvcrt"
           else if final.isWasi then
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 152ac4ddc0ec..a3ac648dee18 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -372,6 +372,17 @@ rec {
     useLLVM = true;
   };
 
+  # Target the MSVC ABI
+  x86_64-windows = {
+    config = "x86_64-pc-windows-msvc";
+    useLLVM = true;
+  };
+
+  aarch64-windows = {
+    config = "aarch64-pc-windows-msvc";
+    useLLVM = true;
+  };
+
   # BSDs
 
   aarch64-freebsd = {
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 2cc009133f2a..65fdb9ee1959 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -344,6 +344,10 @@ rec {
       kernel = kernels.windows;
       abi = abis.gnu;
     };
+    isMsvc = {
+      kernel = kernels.windows;
+      abi = abis.msvc;
+    };
     isWasi = {
       kernel = kernels.wasi;
     };
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index fd3302b291d1..d065aef2df48 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -1251,6 +1251,17 @@ with lib.maintainers;
     shortName = "coqui-ai TTS";
   };
 
+  windows = {
+    members = [
+      RossSmyth
+      eveeifyeve
+      ericson2314
+      puffnfresh
+    ];
+    scope = "Maintains the windows package set";
+    shortName = "Windows";
+  };
+
   wdz = {
     members = [
       n0emis
diff --git a/nixos/modules/profiles/base.nix b/nixos/modules/profiles/base.nix
index ba05c31393c0..fffc53c8e551 100644
--- a/nixos/modules/profiles/base.nix
+++ b/nixos/modules/profiles/base.nix
@@ -45,6 +45,9 @@
     # Some compression/archiver tools.
     pkgs.unzip
     pkgs.zip
+
+    # Some utilities
+    pkgs.jq
   ];
 
   # Include support for various filesystems and tools to create / manipulate them.
diff --git a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
index 26f7955d9b08..928104c497e5 100644
--- a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
@@ -300,7 +300,8 @@ in
             "multi-user.target"
           ];
           # https://github.com/rhasspy/wyoming-faster-whisper/issues/27
-          environment."HF_HUB_CACHE" = "/tmp";
+          # https://github.com/NixOS/nixpkgs/issues/429974
+          environment."HF_HOME" = "/tmp";
           serviceConfig = {
             DynamicUser = true;
             User = "wyoming-faster-whisper";
diff --git a/nixos/modules/services/web-apps/homer.nix b/nixos/modules/services/web-apps/homer.nix
index 28936bf57be0..50c460c4a6c1 100644
--- a/nixos/modules/services/web-apps/homer.nix
+++ b/nixos/modules/services/web-apps/homer.nix
@@ -49,7 +49,7 @@ in
 
         To add files such as icons or backgrounds, you can reference them in line such as
         ```nix
-        icon = "$\{./icon.png}";
+        icon = "''${./icon.png}";
         ```
         This will add the file to the nix store upon build, referencing it by file path as expected by Homer.
       '';
diff --git a/nixos/tests/ly.nix b/nixos/tests/ly.nix
index b7bee09c3372..1b57ebfabacd 100644
--- a/nixos/tests/ly.nix
+++ b/nixos/tests/ly.nix
@@ -39,8 +39,8 @@ in
     ''
       start_all()
 
-      machine.wait_until_tty_matches("2", "password:")
-      machine.send_key("ctrl-alt-f2")
+      machine.wait_until_tty_matches("1", "password:")
+      machine.send_key("ctrl-alt-f1")
       machine.sleep(1)
       machine.screenshot("ly")
       machine.send_chars("alice")
@@ -52,8 +52,8 @@ in
       machine.wait_for_window("^IceWM ")
       machine.screenshot("icewm")
 
-      machineNoX11.wait_until_tty_matches("2", "password:")
-      machineNoX11.send_key("ctrl-alt-f2")
+      machineNoX11.wait_until_tty_matches("1", "password:")
+      machineNoX11.send_key("ctrl-alt-f1")
       machineNoX11.sleep(1)
       machineNoX11.screenshot("ly-no-x11")
       machineNoX11.send_chars("alice")
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index c9a87f94e58a..744bf74b6c3d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4290,8 +4290,8 @@ let
         mktplcRef = {
           publisher = "shopify";
           name = "ruby-lsp";
-          version = "0.9.30";
-          hash = "sha256-3V6So2ulRTk1Ityd4ajzx/Vd+qzvqZMzUyTFMgWNztA=";
+          version = "0.9.31";
+          hash = "sha256-ppX0GgLJENXVzXvJ6AZMZihT6FV6o5rkA7qpDrtxhAQ=";
         };
         meta = {
           description = "VS Code plugin for connecting with the Ruby LSP";
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index cb4eaa9110b3..4ea25a9f1bec 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -36,22 +36,22 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-BzJWy/dxOhHilMKh1+w4W569MFudBKAU4fycrYLLW/0=";
-      x86_64-darwin = "sha256-dPtStLcmFm9Zf3gRYz/37qHvV3hEfV3nW/N7TVjI8B8=";
-      aarch64-linux = "sha256-x4f7y2r0CBE8ubwnQNmCIjQOA07/6qW563FqFnn6V5Q=";
-      aarch64-darwin = "sha256-c64gB5t0U0glgcfMlCvVBphQ3rsX758vCUFPVNWqTJY=";
-      armv7l-linux = "sha256-I2uhURbxv1aGruOn28xCssGxPjvEs9qzTfRIZFiKVRI=";
+      x86_64-linux = "sha256-EbgP2CjUBiC+2G7TkGyuxaqr35sTArls4lbDNTH1Pmc=";
+      x86_64-darwin = "sha256-OrDuzSaPxuedhS21Hx1PNTbp6eQpfFfUbO05gIu5Ou8=";
+      aarch64-linux = "sha256-V0aEGqBRf3qVKvPYNypQ9hYWovqQIC3kQq2goq/hVjA=";
+      aarch64-darwin = "sha256-29i/+mz0NCU0ZCO+tzlbSl1iKx5/H89bGQTvRR5/PuA=";
+      armv7l-linux = "sha256-VSsn4d9ztFgGXVZeCeTSHDD5n3aTBbHF/xx2JvTGOeQ=";
     }
     .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.102.2";
+  version = "1.102.3";
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
   # This is used for VS Code - Remote SSH test
-  rev = "c306e94f98122556ca081f527b466015e1bc37b0";
+  rev = "488a1f239235055e34e673291fb8d8c810886f81";
 
   executableName = "code" + lib.optionalString isInsiders "-insiders";
   longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-tvbyqgH8nF0mui0UnDAvN2LdjcB8GQVbSg48cwe6BFA=";
+      hash = "sha256-xVYG/EJRPRJBj3BSarTwpX9F1UM/OI+7ci6vQa64iWI=";
     };
     stdenv = stdenvNoCC;
   };
diff --git a/pkgs/applications/emulators/libretro/cores/mupen64plus.nix b/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
index 7a08c195574f..48b54825b65a 100644
--- a/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
+++ b/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
@@ -12,13 +12,13 @@
 }:
 mkLibretroCore {
   core = "mupen64plus-next";
-  version = "0-unstable-2025-07-01";
+  version = "0-unstable-2025-07-29";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mupen64plus-libretro-nx";
-    rev = "1b693cdac7c42979f6ef53ffe260a76454f0cf45";
-    hash = "sha256-hano/fv7LcinEOYfwwzhn+gXTsB8hDav0KQw5XkmXmY=";
+    rev = "2d923939db32aad01e633010fac71f860c943a6d";
+    hash = "sha256-HNhGVXTeCECqOdyluPq6aYWuA612H+PCJ65XoN9WJXU=";
   };
 
   # Fix for GCC 14
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 4d1928c1636c..0fe351e2637f 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -633,11 +633,11 @@
     "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
   },
   "huaweicloud": {
-    "hash": "sha256-hop7Uv/llV5oUYXZy5dC4YdMDD3BIBz56aHoB/m8ktI=",
+    "hash": "sha256-BzWYtn6KVVMq+wjqj3CMPKSzo9DzePIIdnRjJ53nJBI=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.76.5",
+    "rev": "v1.77.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/ag/ags_1/package.nix b/pkgs/by-name/ag/ags_1/package.nix
index 49f658236ca1..8a652890c3b3 100644
--- a/pkgs/by-name/ag/ags_1/package.nix
+++ b/pkgs/by-name/ag/ags_1/package.nix
@@ -59,6 +59,11 @@ buildNpmPackage (finalAttrs: {
     upower
   ];
 
+  patches = [
+    # Workaround for TypeScript 5.9: https://github.com/Aylur/ags/issues/725#issuecomment-3070009695
+    ./ts59.patch
+  ];
+
   postPatch = ''
     chmod u+x ./post_install.sh && patchShebangs ./post_install.sh
   '';
diff --git a/pkgs/by-name/ag/ags_1/ts59.patch b/pkgs/by-name/ag/ags_1/ts59.patch
new file mode 100644
index 000000000000..5f3f9bb29f33
--- /dev/null
+++ b/pkgs/by-name/ag/ags_1/ts59.patch
@@ -0,0 +1,19 @@
+diff --git a/src/service/greetd.ts b/src/service/greetd.ts
+index 10a475e..621a427 100644
+--- a/src/service/greetd.ts
++++ b/src/service/greetd.ts
+@@ -101,8 +101,12 @@ export class Greetd extends Service {
+             ostream.put_int32(json.length, null);
+             ostream.put_string(json, null);
+ 
+-            const data = await istream.read_bytes_async(4, GLib.PRIORITY_DEFAULT, null);
+-            const length = new Uint32Array(data.get_data()?.buffer || [0])[0];
++            const data = (
++                await istream.read_bytes_async(4, GLib.PRIORITY_DEFAULT, null)
++            ).get_data();
++            const length = data
++                ? new DataView(data.buffer, data.byteOffset, data.byteLength).getUint32(0, true)
++                : 0;
+             const res = await istream.read_bytes_async(length, GLib.PRIORITY_DEFAULT, null);
+             return JSON.parse(this._decoder.decode(res.get_data()!)) as Response;
+         } finally {
diff --git a/pkgs/by-name/ai/airtame/package.nix b/pkgs/by-name/ai/airtame/package.nix
index 2c7b1994e3b4..1f1a3240624d 100644
--- a/pkgs/by-name/ai/airtame/package.nix
+++ b/pkgs/by-name/ai/airtame/package.nix
@@ -67,11 +67,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "airtame-application";
-  version = "4.13.1";
+  version = "4.14.0";
 
   src = fetchurl {
     url = "https://downloads.airtame.com/app/latest/linux/Airtame-${finalAttrs.version}.deb";
-    hash = "sha256-3VvEsohH2siC2SxdrWSg0sjlbrBC2VR3NY5m6Q2YKHU=";
+    hash = "sha256-zOLafN4QFDt2xnn+B8ytz+IvN8R6qje+Sge2Zb5mRZI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index 318dc82af1f1..27c928834e43 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.5.12";
+  version = "0.5.13";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qVVQs0BV/M+rhs+qFiK9nHCKXq+dco6RuBgaUURVpts=";
+    hash = "sha256-z9YuoppOYghsiYhoa6nfbP+VMrdN5oY55+pS6p2pBX0=";
   };
 
-  cargoHash = "sha256-Uv4T65ByYsfmH5OPN0ZdTs7DAOZd9RLfPrT3fBsfXuw=";
+  cargoHash = "sha256-TyxeuDMmoRvIVaapA/KstFnARPpPv9h19Bg3/XnwQWs=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/at/atlantis/package.nix b/pkgs/by-name/at/atlantis/package.nix
index e9bf602a2b37..ccc3a81f89a4 100644
--- a/pkgs/by-name/at/atlantis/package.nix
+++ b/pkgs/by-name/at/atlantis/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlantis";
-  version = "0.35.0";
+  version = "0.35.1";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mdUh/fJo4pA80++nJoYdiAS5oTPpvBsR0TIMHrQO4u8=";
+    hash = "sha256-xYj6qu5bXpryuh2vqtYF+8HP/JRM5Cc8ctT+1S1gS2Q=";
   };
 
   ldflags = [
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
     "-X=main.date=1970-01-01T00:00:00Z"
   ];
 
-  vendorHash = "sha256-QtAR0vO2K014WlzAriAYg7272tZ1iu72g4a3OBsy6Wo=";
+  vendorHash = "sha256-ac2IGN+wtDAXei1uxCIZQGOmwJ3+AhIX2qq0RMqO0G8=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/be/bearer/package.nix b/pkgs/by-name/be/bearer/package.nix
index 8b9ec9e60812..430dbbffeef8 100644
--- a/pkgs/by-name/be/bearer/package.nix
+++ b/pkgs/by-name/be/bearer/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.49.0";
+  version = "1.50.0";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     tag = "v${version}";
-    hash = "sha256-mIjIcJzu3BatV4OQ18yHvwuUjS+zJHe4EFPYEFUwCjo=";
+    hash = "sha256-6GggGsimQShDs/F/H80aBykQYowH55plDQDRjiWKFsA=";
   };
 
   vendorHash = "sha256-+2iiMb2+/a3GCUMVA9boJJxuFgB3NmxpTePyMEA46jw=";
diff --git a/pkgs/by-name/bp/bpfilter/package.nix b/pkgs/by-name/bp/bpfilter/package.nix
index f76bfcb465d3..158e8de49a67 100644
--- a/pkgs/by-name/bp/bpfilter/package.nix
+++ b/pkgs/by-name/bp/bpfilter/package.nix
@@ -1,5 +1,6 @@
 {
   bison,
+  clangStdenv,
   cmake,
   cmocka,
   doxygen,
@@ -14,19 +15,19 @@
   nix-update-script,
   pkg-config,
   sphinx,
-  stdenv,
+  tinyxxd,
   zlib,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+clangStdenv.mkDerivation (finalAttrs: {
   pname = "bpfilter";
-  version = "0.4.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "bpfilter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z0L4sY944cj/rqfOwwjNWOU0tZDAsZ1ocf4/djHad2Q=";
+    hash = "sha256-qL5wRm6QmfMa5L+oZc5E2kAVqvJfCt5fBxjmtWzb2kA=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     lcov
     pkg-config
     sphinx
+    tinyxxd
 
     # bpfilter's cmake files requires this, even if we specify the version
     # we're using without needing to detect the version during the build.
@@ -64,6 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
+  # invalid with -target bpf
+  hardeningDisable = [ "zerocallusedregs" ];
+
   preFixup = ''
     substituteInPlace $out/lib/systemd/system/bpfilter.service --replace-fail /usr/sbin/bpfilter $out/bin/bpfilter
 
diff --git a/pkgs/by-name/cl/clickhouse-backup/package.nix b/pkgs/by-name/cl/clickhouse-backup/package.nix
index 7db90be81f6c..6a56fd570898 100644
--- a/pkgs/by-name/cl/clickhouse-backup/package.nix
+++ b/pkgs/by-name/cl/clickhouse-backup/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.6.29";
+  version = "2.6.30";
 
   src = fetchFromGitHub {
     owner = "Altinity";
     repo = "clickhouse-backup";
     rev = "v${version}";
-    hash = "sha256-B0G4Umnolpc3bACkL3EXN+b8Szb8MnBekQ6GLZAhr/w=";
+    hash = "sha256-9CxmMCtrQlHO9Q7gGMN0mIKVERjdef9IB6YUXXuJxeg=";
   };
 
-  vendorHash = "sha256-Vqudi7sl9VTWo4g+74qh9sMUOGd9OpNDlzimEPm/EtU=";
+  vendorHash = "sha256-tv5UaHoZTEAjo0jgbHRZHN6xiCNaexED+NG7cBDtiWA=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/by-name/co/copybara/package.nix b/pkgs/by-name/co/copybara/package.nix
index cbb365047ca9..9430723fb65a 100644
--- a/pkgs/by-name/co/copybara/package.nix
+++ b/pkgs/by-name/co/copybara/package.nix
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20250721";
+  version = "20250728";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-//HU8zZspR5Rq2xjo1QLLzigGJLuGJE4czUkzXnJ7EA=";
+    hash = "sha256-/ulX5Q+P6ViiDcdwRpd9zhJAQiFULzU2fSXvfOk36xo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cr/criu/package.nix b/pkgs/by-name/cr/criu/package.nix
index 848576385f81..d10b56d71e51 100644
--- a/pkgs/by-name/cr/criu/package.nix
+++ b/pkgs/by-name/cr/criu/package.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "criu";
-  version = "4.1";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "checkpoint-restore";
     repo = "criu";
     rev = "v${version}";
-    hash = "sha256-Z4prbaPYRdN/fPdBwDz7D3/gKybh2ulA3UM1LZGeAK0=";
+    hash = "sha256-SfpJskXX7r3jbAwgZl2qpa7j1M4i8/sV6rlAWiUEoQs=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/dt/dts-lsp/package.nix b/pkgs/by-name/dt/dts-lsp/package.nix
new file mode 100644
index 000000000000..8e2d8786fd1a
--- /dev/null
+++ b/pkgs/by-name/dt/dts-lsp/package.nix
@@ -0,0 +1,34 @@
+{
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "dts-lsp";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "igor-prusov";
+    repo = "dts-lsp";
+    tag = finalAttrs.version;
+    hash = "sha256-8wMY0o8ceVl5UTsSpXf44gbX1ipSuR50cQTRng+MuNk=";
+  };
+
+  cargoHash = "sha256-hZZcu3LaG4kkXJSF0uxHrdPB3YWB3hMv+jrMLMDp2aI=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Language Server for Device Tree Source files";
+    homepage = "https://github.com/igor-prusov/dts-lsp";
+    changelog = "https://github.com/igor-prusov/dts-lsp/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = [ lib.maintainers.jmbaur ];
+    mainProgram = "dts-lsp";
+  };
+})
diff --git a/pkgs/by-name/en/ente-desktop/package.nix b/pkgs/by-name/en/ente-desktop/package.nix
index 4b4831c60a18..3d0eef9ea368 100644
--- a/pkgs/by-name/en/ente-desktop/package.nix
+++ b/pkgs/by-name/en/ente-desktop/package.nix
@@ -20,7 +20,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-desktop";
-  version = "1.7.11";
+  version = "1.7.14";
 
   src = fetchFromGitHub {
     owner = "ente-io";
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
       "web"
     ];
     tag = "photosd-v${finalAttrs.version}";
-    hash = "sha256-yEfJEe+/PnRr9in7+9l54LQqCFkGqDRhqzcsNaEZmhI=";
+    hash = "sha256-UtKXg3SZxHo18VKuVP7W40SfZfa9ni+QJ7+GvGWptSA=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/desktop";
@@ -39,13 +39,13 @@ stdenv.mkDerivation (finalAttrs: {
   offlineCache = fetchYarnDeps {
     name = "ente-desktop-${finalAttrs.version}-offline-cache";
     inherit (finalAttrs) src sourceRoot;
-    hash = "sha256-Cq/4OOgGp6qg2ge5NK5jcYCvS/uF5l9nLLWIslpGRDc=";
+    hash = "sha256-6o5TaqlgEQWZjde5cthiSVLVy5JiCHXApn7uXBWmTo0=";
   };
   webOfflineCache = fetchYarnDeps {
     name = "ente-desktop-${finalAttrs.version}-web-offline-cache";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/web";
-    hash = "sha256-yoCOU4cxxHiWu1+/vGwM9VWRroymr6JTbRHomKRJhU4=";
+    hash = "sha256-gwOeznAp4nGu4spilkFl8Dbmdye3Wg8VnBLroSdUjUo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/fclones/gui.nix b/pkgs/by-name/fc/fclones-gui/package.nix
similarity index 62%
rename from pkgs/tools/misc/fclones/gui.nix
rename to pkgs/by-name/fc/fclones-gui/package.nix
index 05eef704d9c4..999eb2bcf2ca 100644
--- a/pkgs/tools/misc/fclones/gui.nix
+++ b/pkgs/by-name/fc/fclones-gui/package.nix
@@ -9,14 +9,14 @@
   libadwaita,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fclones-gui";
   version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "pkolaczk";
     repo = "fclones-gui";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ad7wyoCjSQ8i6c+4IorImqAY2Q6pwBtI2JkkbkGa46U=";
   };
 
@@ -35,18 +35,17 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     substituteInPlace snap/gui/fclones-gui.desktop \
-      --replace 'Icon=''${SNAP}/meta/gui/fclones-gui.png' Icon=fclones-gui
-
-    install -Dm444 snap/gui/fclones-gui.desktop -t $out/share/applications
-    install -Dm444 snap/gui/fclones-gui.png -t $out/share/pixmaps
+      --replace-fail 'Icon=''${SNAP}/meta/gui/fclones-gui.png' "Icon=fclones-gui"
+    install -Dm 0644 snap/gui/fclones-gui.desktop -t $out/share/applications
+    install -Dm 0644 snap/gui/fclones-gui.png -t $out/share/icons/hicolor/256x256/apps
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Interactive duplicate file remover";
     mainProgram = "fclones-gui";
     homepage = "https://github.com/pkolaczk/fclones-gui";
-    changelog = "https://github.com/pkolaczk/fclones-gui/releases/tag/${src.rev}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda ];
+    changelog = "https://github.com/pkolaczk/fclones-gui/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = builtins.attrValues { inherit (lib.maintainers) figsoda; };
   };
-}
+})
diff --git a/pkgs/by-name/fi/filebot/package.nix b/pkgs/by-name/fi/filebot/package.nix
index ec542be40f16..51fda20db0df 100644
--- a/pkgs/by-name/fi/filebot/package.nix
+++ b/pkgs/by-name/fi/filebot/package.nix
@@ -56,7 +56,23 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     mkdir -p $out/opt $out/bin
     # Since FileBot has dependencies on relative paths between files, all required files are copied to the same location as is.
-    cp -r filebot.sh lib/ jar/ $out/opt/
+    cp -r filebot.sh jar/ $out/opt/
+    # Copy lib based on platform and force filebot to use libmediainfo.so from nix
+    local platformDir
+    case "${stdenv.hostPlatform.system}" in
+      "x86_64-linux")
+        platformDir="Linux-x86_64"
+        ;;
+      "aarch64-linux")
+        platformDir="Linux-aarch64"
+        ;;
+    esac
+    if [ -n "$platformDir" ]; then
+      mkdir -p "$out/opt/lib"
+      cp -r "lib/$platformDir" "$out/opt/lib/"
+      rm "$out/opt/lib/$platformDir/libmediainfo.so"
+      ln -s "${libmediainfo}/lib/libmediainfo.so" "$out/opt/lib/$platformDir/"
+    fi
     # Filebot writes to $APP_DATA, which fails due to read-only filesystem. Using current user .local directory instead.
     substituteInPlace $out/opt/filebot.sh \
       --replace 'APP_DATA="$FILEBOT_HOME/data/$(id -u)"' 'APP_DATA=''${XDG_DATA_HOME:-$HOME/.local/share}/filebot/data' \
diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
index 220ba56dfa04..0cbd3a10643f 100644
--- a/pkgs/by-name/fi/firefoxpwa/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -28,19 +28,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "firefoxpwa";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "filips123";
     repo = "PWAsForFirefox";
     rev = "v${version}";
-    hash = "sha256-yYvQxz+lAxKXpAWeLiBnepGuwYfNLyIhu4vQ8NdH3pc=";
+    hash = "sha256-UqgPAGDekM9bKx4kNH+IuB31ML/Jn4E6g86suVESRRU=";
   };
 
   sourceRoot = "${src.name}/native";
   buildFeatures = [ "immutable-runtime" ];
 
-  cargoHash = "sha256-elVthXdjlI9DSQgaIRzu3M72dgGNXGgMiUXEICaBJCQ=";
+  cargoHash = "sha256-7v+Ohll8k3YHKYoQZIWvV+YLHT62ygFb0kPEIXh0jP4=";
 
   preConfigure = ''
     sed -i 's;version = "0.0.0";version = "${version}";' Cargo.toml
diff --git a/pkgs/by-name/fl/flclash/package.nix b/pkgs/by-name/fl/flclash/package.nix
index d1579fe227a4..0cdcfa56a9ec 100644
--- a/pkgs/by-name/fl/flclash/package.nix
+++ b/pkgs/by-name/fl/flclash/package.nix
@@ -12,14 +12,14 @@
 
 let
   pname = "flclash";
-  version = "0.8.86";
+  version = "0.8.87";
 
   src =
     (fetchFromGitHub {
       owner = "chen08209";
       repo = "FlClash";
       tag = "v${version}";
-      hash = "sha256-bPMj9KWkup0nIhFAQ4BP8KiD8uP2/2b/GPy4APR+dho=";
+      hash = "sha256-vGRq9Kc6XU6r3huIGAKoh5x46fFS8jmXgus9WgpvG3A=";
       fetchSubmodules = true;
     }).overrideAttrs
       (_: {
@@ -41,7 +41,7 @@ let
 
     modRoot = "core";
 
-    vendorHash = "sha256-pc0TnYnY6QWpGdO7IGAquuyS+NXbq7Xkr+dOo8uLPQU=";
+    vendorHash = "sha256-Uc+RvpW3vndPFnM7yhqrNTEexAPaolCk8YK8u/+55RQ=";
 
     env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/fl/flclash/pubspec.lock.json b/pkgs/by-name/fl/flclash/pubspec.lock.json
index 6f16b118f660..bb49e16c8c88 100644
--- a/pkgs/by-name/fl/flclash/pubspec.lock.json
+++ b/pkgs/by-name/fl/flclash/pubspec.lock.json
@@ -566,6 +566,16 @@
       "source": "sdk",
       "version": "0.0.0"
     },
+    "flutter_acrylic": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_acrylic",
+        "sha256": "b3996dbde5abf5823cc9ead4cf2e5267c3181f15585fe47ce4dc4472e7ec827a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.4"
+    },
     "flutter_cache_manager": {
       "dependency": "direct main",
       "description": {
@@ -591,11 +601,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "flutter_lints",
-        "sha256": "5398f14efa795ffb7a33e9b6a08798b26a180edac4ad7db3f231e40f82ce11e1",
+        "sha256": "3105dc8492f6183fb076ccf1f351ac3d60564bff92e20bfc4af9cc1651f4e7e1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.0"
+      "version": "6.0.0"
     },
     "flutter_localizations": {
       "dependency": "direct main",
@@ -989,11 +999,11 @@
       "dependency": "transitive",
       "description": {
         "name": "lints",
-        "sha256": "c35bb79562d980e9a453fc715854e1ed39e24e7d0297a880ef54e17f9874a9d7",
+        "sha256": "a5e2b223cb7c9c8efdc663ef484fdd95bb243bff242ef5b13e26883547fce9a0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.1.1"
+      "version": "6.0.0"
     },
     "logging": {
       "dependency": "transitive",
@@ -1015,6 +1025,16 @@
       "source": "hosted",
       "version": "2.0.3"
     },
+    "macos_window_utils": {
+      "dependency": "transitive",
+      "description": {
+        "name": "macos_window_utils",
+        "sha256": "4e683da162825018580c7341d9e926a6fa39a869a3504c2e5471618553bd55cd",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.8.2"
+    },
     "matcher": {
       "dependency": "transitive",
       "description": {
@@ -2002,7 +2022,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.7.0 <4.0.0",
+    "dart": ">=3.8.0 <4.0.0",
     "flutter": ">=3.29.0"
   }
 }
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index 074651c946b2..12f0c0cd5ec7 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -13,21 +13,45 @@ let
   disabledTests = [
     "Test_runCreateRunnerFile"
     "Test_ping"
+
+    # The following tests were introduced in 9.x with the inclusion of act
+    # the pkgs/by-name/ac/act/package.nix just sets doCheck = false;
+
+    # Requires running docker install
+    "TestDocker"
+    "TestJobExecutor"
+    "TestRunner"
+    "Test_validateCmd"
+
+    # Docker network request for image
+    "TestImageExistsLocally"
+
+    # Reaches out to different websites
+    "TestFindGitRemoteURL"
+    "TestGitFindRef"
+    "TestGitCloneExecutor"
+    "TestCloneIfRequired"
+    "TestActionCache"
+    "TestRunContext_GetGitHubContext"
+
+    # These tests rely on outbound IP address
+    "TestHandler"
+    "TestHandler_gcCache"
   ];
 in
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "8.0.1";
+  version = "9.0.1";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-6FTJYs1dqIAHPxMzRNOHHZQv4be9LaR1wxMJsW3t5kg=";
+    hash = "sha256-3VurTHOM7FMRJzmQ5tBmW4E0mw7hePCnff0vhxPsKfE=";
   };
 
-  vendorHash = "sha256-NykeBR2dnWQaqJuY73i9KLIqehLHniaMqf9oTqUDstQ=";
+  vendorHash = "sha256-7R42Aa04wCba90xLTX2p6oNX58OpfDDKegqwDw3Ycbk=";
 
   # See upstream Makefile
   # https://code.forgejo.org/forgejo/runner/src/branch/main/Makefile
@@ -39,7 +63,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X code.forgejo.org/forgejo/runner/internal/pkg/ver.version=${src.rev}"
+    "-X code.forgejo.org/forgejo/runner/v9/internal/pkg/ver.version=${src.rev}"
   ];
 
   checkFlags = [
diff --git a/pkgs/by-name/fo/foxglove-cli/package.nix b/pkgs/by-name/fo/foxglove-cli/package.nix
index a177bd518359..f696e387a562 100644
--- a/pkgs/by-name/fo/foxglove-cli/package.nix
+++ b/pkgs/by-name/fo/foxglove-cli/package.nix
@@ -11,16 +11,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "foxglove-cli";
-  version = "1.0.23";
+  version = "1.0.24";
 
   src = fetchFromGitHub {
     owner = "foxglove";
     repo = "foxglove-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jJD8sRTiJ4UGouc3KFgdgpjL7AQuU4wdxIaLqd/bih4=";
+    hash = "sha256-JYaBVXSKn4zgWHq+s/tMgHCpQ2z5ZYh/+e+ex4MaUmo=";
   };
 
-  vendorHash = "sha256-8WHfXLcpYI2TlXOgjwcuJW61ftTHQEDP0Wc5XZ8ZsCQ=";
+  vendorHash = "sha256-fL/eOGx81pdIPWHt14cf4VoIqmfUmbkKa8/y0QQKYko=";
 
   env.CGO_ENABLED = 0;
   tags = [ "netgo" ];
diff --git a/pkgs/by-name/gf/gfold/package.nix b/pkgs/by-name/gf/gfold/package.nix
index 5d8bdb9e6ea8..59efe0677e21 100644
--- a/pkgs/by-name/gf/gfold/package.nix
+++ b/pkgs/by-name/gf/gfold/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "gfold";
-  version = "2025.4.0";
+  version = "2025.7.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
     owner = "nickgerace";
     repo = "gfold";
     rev = version;
-    hash = "sha256-7PnqhS80Ozh5ZQNQ8iYgCiFT0JDLzhA09NV1HgrCOww=";
+    hash = "sha256-EWQ17aEOEZnYEe3WJpyNuC+r4tv8DP1fYFH6fII2p+8=";
   };
 
-  cargoHash = "sha256-nGHJ96jFqG1pe3WUILPzm52HxrZYde2Z1p8N4DTaxlw=";
+  cargoHash = "sha256-3hzcYPD/w2vbsSuuHNAD2Oyqw0B0PIdERGgCAvAiQpk=";
 
   passthru.tests.version = testers.testVersion {
     package = gfold;
diff --git a/pkgs/by-name/gi/git-repo/package.nix b/pkgs/by-name/gi/git-repo/package.nix
index 8383c4fcd7ca..481ff124b485 100644
--- a/pkgs/by-name/gi/git-repo/package.nix
+++ b/pkgs/by-name/gi/git-repo/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.56";
+  version = "2.57.2";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    hash = "sha256-zCmLFo3ssfO28F0mHnkQYbd7X/ncpulSzqS+fwfYAO8=";
+    hash = "sha256-B8Z5qkjUrydjWTeAanDHMn7C2qVIIqb90zJ6WrI6fgI=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'
diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index 4aae789ee10a..5a0539dc2933 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitoxide";
-  version = "0.44.0";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "GitoxideLabs";
     repo = "gitoxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TZK4H0PRxsjzDhW05bXD7GkP2JHrBb1tu/oid6GkAWs=";
+    hash = "sha256-mMmyFFEVvzI5UmpA10XxnfYZiCg3tizplqFVUND/wQc=";
   };
 
-  cargoHash = "sha256-5kd9drLnejphmJ6KQ1jSmerIt+rRB4/rFKxhuedkpRk=";
+  cargoHash = "sha256-JMpNe8jg52wDTJkPy4ZnNcLqjH6K1tXo5SFVPJdITdo=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/go/gotestwaf/package.nix b/pkgs/by-name/go/gotestwaf/package.nix
index cedd3648dafd..2d96a832aa7c 100644
--- a/pkgs/by-name/go/gotestwaf/package.nix
+++ b/pkgs/by-name/go/gotestwaf/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gotestwaf";
-  version = "0.5.7";
+  version = "0.5.8";
 
   src = fetchFromGitHub {
     owner = "wallarm";
     repo = "gotestwaf";
     tag = "v${version}";
-    hash = "sha256-3wiMysrjQbTbygcSYwJo62naARS01qrVlhmi2cwdpHA=";
+    hash = "sha256-PZM3+xQnoUat214UCaWtB2NmY6ju4EdfjFbXSdS3IrE=";
   };
 
   vendorHash = "sha256-5rLYepwuy0B92tshVInYPfKyie9n+Xjh4x8XALcRHm4=";
diff --git a/pkgs/by-name/hd/hddfancontrol/package.nix b/pkgs/by-name/hd/hddfancontrol/package.nix
index 2201946b33c0..5729b418a48c 100644
--- a/pkgs/by-name/hd/hddfancontrol/package.nix
+++ b/pkgs/by-name/hd/hddfancontrol/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hddfancontrol";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "desbma";
     repo = "hddfancontrol";
     tag = finalAttrs.version;
-    hash = "sha256-GdvGFNmarLxtO6BoZ8PktVvAiKIxu4FdZWCJeVtW/fI=";
+    hash = "sha256-RnqKqXyR3XN/UL70vG/+NtkxxbwvAoIQaFipUtRQOlE=";
   };
 
-  cargoHash = "sha256-1GPct+CabVE8/tMpWsQ3/XRJQkcAmS6UDNuz5c/Oewo=";
+  cargoHash = "sha256-2jwfdUBpzamsbvkpP+Fn5dz8jj9+Wnp2JpoAT6tHUac=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/ho/host-spawn/package.nix b/pkgs/by-name/ho/host-spawn/package.nix
index 95b06655d7d8..46aec437d7f0 100644
--- a/pkgs/by-name/ho/host-spawn/package.nix
+++ b/pkgs/by-name/ho/host-spawn/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "host-spawn";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "1player";
     repo = "host-spawn";
     rev = "v${version}";
-    hash = "sha256-V8WI0TyJw+dkCyG8huIrg6VDFI2Kmak7bI/GXU8RI/w=";
+    hash = "sha256-bCEyoHsISZ2K7fOsOOAhZRv/a6RptVDlwSspomacb/0=";
   };
 
   vendorHash = "sha256-Agc3hl+VDTNW7cnh/0g4G8BgzNAX11hKASYQKieBN4M=";
diff --git a/pkgs/by-name/hy/hyprpanel/package.nix b/pkgs/by-name/hy/hyprpanel/package.nix
index f0e20c49c119..55c2e30a6062 100644
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -37,7 +37,7 @@
 }:
 ags.bundle {
   pname = "hyprpanel";
-  version = "0-unstable-2025-07-12";
+  version = "0-unstable-2025-07-24";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,8 +45,8 @@ ags.bundle {
   src = fetchFromGitHub {
     owner = "Jas-SinghFSU";
     repo = "HyprPanel";
-    rev = "59b57fca0634c98f23227ea948f87df7814e72f6";
-    hash = "sha256-cl1NEWTUsNxBmLjyvz+GDP4Hy7riaOszSGpfplHA7Y4=";
+    rev = "d24afbec746ed16db9637085b2f6047a2ac491b5";
+    hash = "sha256-pTDsWVppLaWMTRAGTPonz0UZlh/Xa8iJCtCB+qk5o1g=";
   };
 
   # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
diff --git a/pkgs/by-name/hy/hyprpolkitagent/package.nix b/pkgs/by-name/hy/hyprpolkitagent/package.nix
index 0f5c112ab55b..df6ec7f36fdb 100644
--- a/pkgs/by-name/hy/hyprpolkitagent/package.nix
+++ b/pkgs/by-name/hy/hyprpolkitagent/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpolkitagent";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprpolkitagent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K1nSPFlh5VBWNagcaZ/157gfifAXTH8lzeyfYt/UEX8=";
+    hash = "sha256-39xQ6iitVz9KVJz6PPRR+pkS5hBogq25BDd24eUDOQg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/i3/status-rust.nix b/pkgs/by-name/i3/i3status-rust/package.nix
similarity index 100%
rename from pkgs/applications/window-managers/i3/status-rust.nix
rename to pkgs/by-name/i3/i3status-rust/package.nix
diff --git a/pkgs/by-name/ka/kafkactl/package.nix b/pkgs/by-name/ka/kafkactl/package.nix
index 806ec47d44d8..b21b7d8c64f6 100644
--- a/pkgs/by-name/ka/kafkactl/package.nix
+++ b/pkgs/by-name/ka/kafkactl/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "5.11.0";
+  version = "5.11.1";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = "kafkactl";
     tag = "v${version}";
-    hash = "sha256-9d/TXNRuU5+uDImS5hm87tIP1teH6T+/zglRYX+F6Kc=";
+    hash = "sha256-kemN4XJcXH3V7/RT9S2FLiUgS7tisK6wmHyUQnyBfhU=";
   };
 
   vendorHash = "sha256-rxQxNf3FBAGudgrE2wxHw4mVHxTEpQpQ+DX/nEVpoJY=";
diff --git a/pkgs/by-name/ku/kubelogin-oidc/package.nix b/pkgs/by-name/ku/kubelogin-oidc/package.nix
index da853ad32715..5884bf1fa717 100644
--- a/pkgs/by-name/ku/kubelogin-oidc/package.nix
+++ b/pkgs/by-name/ku/kubelogin-oidc/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "1.33.0";
+  version = "1.34.0";
 
   src = fetchFromGitHub {
     owner = "int128";
     repo = "kubelogin";
     tag = "v${version}";
-    hash = "sha256-H/mHC2BwDoHVZ104NNJejhDTihaP3uIcsZokw4yKoz0=";
+    hash = "sha256-eQFPuNSHSRcFLG7UbAb5A++EJawZWHaxmFt0XQVB3Ng=";
   };
 
   subPackages = [ "." ];
@@ -22,7 +22,7 @@ buildGoModule rec {
     "-X main.version=v${version}"
   ];
 
-  vendorHash = "sha256-9yofq5B4Lv/WqD7uwiiR2C88o/q8sTjgph3efYRyKYE=";
+  vendorHash = "sha256-jzKUJkugCDwGtbEXGrjDIAbbe5yQ+1jfn22Q3whLRe4=";
 
   # test all packages
   preCheck = ''
diff --git a/pkgs/by-name/ma/mago/package.nix b/pkgs/by-name/ma/mago/package.nix
index 725ed7b6e672..e3ae5a1b4ce6 100644
--- a/pkgs/by-name/ma/mago/package.nix
+++ b/pkgs/by-name/ma/mago/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mago";
-  version = "0.23.0";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "carthage-software";
     repo = "mago";
     tag = version;
-    hash = "sha256-Kdktcq3czn6YdGKoTB7AjCtfDkNTHhee/kVhMzxsuD8=";
+    hash = "sha256-9WrSHjs1EdDqTXuB0HbIzQCQWp4okkdy3jTVl4J2wUg=";
   };
 
-  cargoHash = "sha256-V7x0n+JcXiSGg8sJBKnsB5/KnfJSadYH0i/dNouhoHc=";
+  cargoHash = "sha256-7/kbuWcy1IwAL7m87WPgyhwPidLL9K65u6ybpj0Ryl0=";
 
   env = {
     # Get openssl-sys to use pkg-config
diff --git a/pkgs/by-name/mp/mpris-discord-rpc/package.nix b/pkgs/by-name/mp/mpris-discord-rpc/package.nix
index 8a613bb35d3f..5f93c48bee2e 100644
--- a/pkgs/by-name/mp/mpris-discord-rpc/package.nix
+++ b/pkgs/by-name/mp/mpris-discord-rpc/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mpris-discord-rpc";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "patryk-ku";
     repo = "mpris-discord-rpc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-szftij29YTLzqBNirvoTgZfPIRznM1Ax5MPTKqB1nYI=";
+    hash = "sha256-CzIHmc1BfKlUjiNjgslNDt00Xwpkz5zoDpYMd0HnHxE=";
   };
 
-  cargoHash = "sha256-/QYeNcmkW6cm1VJkzJfVGvZU79wGswhKUFYc54oQbGw=";
+  cargoHash = "sha256-RUebfsAzn93a0Ebp6cmzZWj72ivkaPzEaN6RIP4/WQM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ni/nightfox-gtk-theme/package.nix b/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
index 219c50bb0390..4361cf140bca 100644
--- a/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
+++ b/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
@@ -70,13 +70,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants lib
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "0-unstable-2025-07-21";
+    version = "0-unstable-2025-07-28";
 
     src = fetchFromGitHub {
       owner = "Fausto-Korpsvart";
       repo = "Nightfox-GTK-Theme";
-      rev = "d6327b176d19f6f00a9fbe0175fb95953c12b7de";
-      hash = "sha256-46ur/Mvc8r1yr/ViZ+pEbK2OdVSqJCSBh7e9AfrRIRY=";
+      rev = "ea0172aa853e8f6c2b00568c4cd6dcbea7991b7c";
+      hash = "sha256-9+RBAG/JKGXjW6zRut8eXM4EYkbNRZ+yw5tLDrSMBXg=";
     };
 
     propagatedUserEnvPkgs = [ gtk-engine-murrine ];
diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index ae21c462c22d..bbcfbc326770 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.10.10";
+  version = "0.10.12";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${version}";
-    hash = "sha256-fZjjfblXFyB4npcv5xKXGqnqNCAdmvJTErI+0PcuaPk=";
+    hash = "sha256-zfWONw72xZy7kYl5jiBcNeCC9YU4s0juDRdeEgyeRrk=";
   };
 
   # No tests
diff --git a/pkgs/by-name/op/opentofu/package.nix b/pkgs/by-name/op/opentofu/package.nix
index f91885db49f4..93424951f681 100644
--- a/pkgs/by-name/op/opentofu/package.nix
+++ b/pkgs/by-name/op/opentofu/package.nix
@@ -15,16 +15,16 @@
 let
   package = buildGoModule rec {
     pname = "opentofu";
-    version = "1.10.3";
+    version = "1.10.4";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       tag = "v${version}";
-      hash = "sha256-2Z2PM1ahkvwtrkfTkVF6wSyk/BI17Ys8CIlB1Xd+fhI=";
+      hash = "sha256-COAX185U35htUL/ZdUy5Rq2/OUVcdGe3zAg8NnjoqnQ=";
     };
 
-    vendorHash = "sha256-npMGiUIDhp4n7nKMWeyq+TDggU1xm5RzQrGOxvzWcnI=";
+    vendorHash = "sha256-+cwFkqhFuLJCb02tvYjccpkNzy7tz979mjgCeqi2DC4=";
     ldflags = [
       "-s"
       "-w"
diff --git a/pkgs/by-name/ps/pspg/package.nix b/pkgs/by-name/ps/pspg/package.nix
index a5a17b8b58af..3e362be08577 100644
--- a/pkgs/by-name/ps/pspg/package.nix
+++ b/pkgs/by-name/ps/pspg/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.8.11";
+  version = "5.8.12";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "pspg";
     rev = version;
-    sha256 = "sha256-ymktt3eQKIwGt2K8cD8x+/OLprvSBrrPYccvbpOIKdc=";
+    sha256 = "sha256-TLHGMqrKqWQ7ccnPFV9N6FuF+ZeOGjhuiS1X8W8kW/4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pu/pulumictl/package.nix b/pkgs/by-name/pu/pulumictl/package.nix
index 3f1c059d75d8..1eb3431cb7a3 100644
--- a/pkgs/by-name/pu/pulumictl/package.nix
+++ b/pkgs/by-name/pu/pulumictl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pulumictl";
-  version = "0.0.49";
+  version = "0.0.50";
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "pulumictl";
     rev = "v${version}";
-    sha256 = "sha256-VEfDKkavZWWxfE1J2Cy/lnPyHiOJWOtwwcYpeb1pkkM=";
+    sha256 = "sha256-Jq7H2lM5Vu/cb+mgoUP6p8MQxJ3w0Pgt+adWey2mPKk=";
   };
 
-  vendorHash = "sha256-IqJdbeayUcTTEiPAar1goqubAjTavJNYOzCyKXGd0Q8=";
+  vendorHash = "sha256-sgI6kpmVofG1yCVH6rWtb7Owoxlypp4we/gPfIGa6sM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index 6550840c324e..4a5c27dfba99 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -12,15 +12,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2025-07-21";
+  version = "2025-07-28";
 
-  cargoHash = "sha256-Of1agDo7/stiS58yTtL0rV/iCRMipO3bQC4xEsi7CGk=";
+  cargoHash = "sha256-htlLYQjUDPvBK5E3xiopWK08OZyRCH7OJ3oCa9/y+QI=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    hash = "sha256-KYavlyBR385om3AOEF+ABCjslJF7vi/Eufo2L56Hhfg=";
+    hash = "sha256-RzsKuX6BQntFOhvqbstzOtzkOv0lkW4l8SYu6ffTf74=";
   };
 
   cargoBuildFlags = [
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index a47d6d75521a..37088e7a3183 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -8,6 +8,7 @@
   libmpc,
   mpfr,
   notcurses,
+  windows,
 
   gsl,
   man,
@@ -15,6 +16,11 @@
 
   unstableGitUpdater,
   writeScript,
+
+  static ? false,
+  withGMP ? !static,
+  withArb ? !static,
+  withNrepl ? if stdenv.hostPlatform.isMinGW then false else true,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,13 +35,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-n6Uattns9TxXRi1lz/adexa13nlYXSp0usTT9uZ47JY=";
   };
 
-  buildInputs = [
-    notcurses
-    gmp
-    mpfr
-    libmpc
-    flint3
-  ];
+  buildInputs =
+    lib.optional withArb flint3
+    ++ lib.optionals withGMP [
+      gmp
+      mpfr
+      libmpc
+    ]
+    ++ lib.optional withNrepl notcurses
+    ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64_pthreads;
 
   # The following scripts are modified from [Guix's](https://packages.guix.gnu.org/packages/s7/).
 
@@ -43,45 +51,83 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace s7.c \
         --replace-fail libc_s7.so $out/lib/libc_s7.so
   '';
+  env.NIX_CFLAGS_COMPILE = toString (
+    [
+      "-I."
+      "-O2"
+    ]
+    ++ lib.optionals withGMP [
+      "-DWITH_GMP"
+    ]
+    ++ lib.optional static "-static"
+  );
+  env.NIX_LDFLAGS = toString (
+    [
+      "-lm"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux) [
+      "-ldl"
+      "--export-dynamic"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isMinGW) [
+      "-lpthread"
+      "--export-all-symbols"
+    ]
+    ++ lib.optional (!static && stdenv.hostPlatform.isMinGW) [ "--out-implib,libs7dll.a" ]
+    ++ lib.optional withArb "-lflint"
+    ++ lib.optionals withGMP [
+      "-lgmp"
+      "-lmpfr"
+      "-lmpc"
+    ]
+  );
 
   buildPhase = ''
     runHook preBuild
 
     # The older REPL
-    cc s7.c -o s7-repl \
-        -O2 -I. \
-        -Wl,-export-dynamic \
-        -lm -ldl \
+    $CC s7.c -o s7-repl \
         -DWITH_MAIN \
         -DS7_LOAD_PATH=\"$out/share/s7/scm\"
 
+    $CC s7.c -c -o s7.o
+
+    # Static library (Unix: .a, Windows: .a)
+    ${lib.optionalString static ''
+      $AR rcs libs7.a s7.o
+    ''}
+
+    # Dynamic library (Unix: .so, Windows: .dll)
+    ${lib.optionalString (!static && stdenv.hostPlatform.isLinux) ''
+      $CC s7.o -o libs7.so \
+        -shared -fPIC
+    ''}
+    ${lib.optionalString (!static && stdenv.hostPlatform.isMinGW) ''
+      $CC s7.o -o libs7.dll \
+        -shared
+    ''}
+
+    ${lib.optionalString withArb ''
+      $CC libarb_s7.c s7.o -o libarb_s7.so \
+          -shared -fPIC
+    ''}
+
     # The newer REPL powered by Notcurses
-    cc s7.c -o s7-nrepl \
-        -O2 -I. \
-        -Wl,-export-dynamic \
-        -lm -ldl \
-        -DWITH_MAIN \
-        -DWITH_NOTCURSES -lnotcurses-core \
-        -DS7_LOAD_PATH=\"$out/share/s7/scm\"
+    ${lib.optionalString withNrepl ''
+      $CC s7.c -o s7-nrepl \
+          -DWITH_MAIN \
+          -DWITH_NOTCURSES -lnotcurses-core \
+          -DS7_LOAD_PATH=\"$out/share/s7/scm\"
 
-    cc libarb_s7.c -o libarb_s7.so \
-        -O2 -I. \
-        -shared \
-        -lflint -lmpc \
-        -fPIC
+      $CC notcurses_s7.c -o libnotcurses_s7.so \
+          -Wno-error=implicit-function-declaration \
+          -lnotcurses-core \
+          -shared -fPIC
+    ''}
 
-    cc notcurses_s7.c -o libnotcurses_s7.so \
-        -O2 -I. \
-        -Wno-error=implicit-function-declaration \
-        -shared \
-        -lnotcurses-core \
-        -fPIC
-
-    cc s7.c -c -o s7.o \
-        -O2 -I. \
-        -ldl -lm
-
-    ./s7-repl libc.scm
+    ${lib.optionalString stdenv.hostPlatform.isLinux ''
+      ./s7-repl libc.scm
+    ''}
 
     runHook postBuild
   '';
@@ -97,9 +143,33 @@ stdenv.mkDerivation (finalAttrs: {
     dst_doc=$out/share/doc/s7
     mkdir -p $dst_bin $dst_lib $dst_inc $dst_share $dst_scm $dst_doc
 
-    mv -t $dst_bin s7-repl s7-nrepl
-    ln -s s7-nrepl $dst_bin/s7
-    mv -t $dst_lib libarb_s7.so libnotcurses_s7.so libc_s7.so
+    ${lib.optionalString static ''
+      mv -t $dst_lib libs7.a
+    ''}
+    ${lib.optionalString (!static && stdenv.hostPlatform.isLinux) ''
+      mv -t $dst_lib libs7.so
+    ''}
+    ${lib.optionalString (!static && stdenv.hostPlatform.isMinGW) ''
+      mv -t $dst_lib libs7.dll libs7dll.a
+    ''}
+
+    ${lib.optionalString stdenv.hostPlatform.isLinux ''
+      mv -t $dst_bin s7-repl
+      mv -t $dst_lib libc_s7.so
+    ''}
+    ${lib.optionalString stdenv.hostPlatform.isMinGW ''
+      mv -t $dst_bin s7-repl.exe
+    ''}
+
+    ${lib.optionalString withArb ''
+      mv -t $dst_lib libarb_s7.so
+    ''}
+    ${lib.optionalString withNrepl ''
+      mv -t $dst_bin s7-nrepl
+      ln -s s7-nrepl $dst_bin/s7
+      mv -t $dst_lib libnotcurses_s7.so
+    ''}
+
     cp -pr -t $dst_share s7.c
     cp -pr -t $dst_inc s7.h
     cp -pr -t $dst_scm *.scm
@@ -128,14 +198,19 @@ stdenv.mkDerivation (finalAttrs: {
   installCheckPhase = ''
     runHook preInstallCheck
 
-    cc ffitest.c s7.o -o ffitest \
-        -I. \
-        -Wl,-export-dynamic \
-        -ldl -lm
+    $CC s7.c -c -o s7.o
+    $CC ffitest.c s7.o -o ffitest
     mv ffitest $dst_bin
     mkdir -p nix-build/home
     ln -sr . nix-build/home/cl
 
+    ${lib.optionalString withArb ''
+      substituteInPlace s7test.scm \
+          --replace-fail '(system "gcc -fPIC -c libarb_s7.c")' "" \
+          --replace-fail '(system "gcc libarb_s7.o -shared -o libarb_s7.so -lflint -larb")' ""
+      cp $out/lib/libarb_s7.so .
+    ''}
+
     USER=nix-s7-builder PATH="$dst_bin:$PATH" HOME=$PWD/nix-build/home \
         s7-repl s7test.scm
 
@@ -176,8 +251,11 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://ccrma.stanford.edu/software/s7/";
     license = lib.licenses.bsd0;
-    maintainers = with lib.maintainers; [ rc-zb ];
+    maintainers = with lib.maintainers; [
+      rc-zb
+      jinser
+    ];
     mainProgram = "s7";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.windows;
   };
 })
diff --git a/pkgs/by-name/sc/scooter/package.nix b/pkgs/by-name/sc/scooter/package.nix
index 3aadbcd20dc7..4c0584208747 100644
--- a/pkgs/by-name/sc/scooter/package.nix
+++ b/pkgs/by-name/sc/scooter/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "scooter";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "thomasschafer";
     repo = "scooter";
     rev = "v${version}";
-    hash = "sha256-/wl6xbAXfPUTSI38htgkWC3IlsxtFbPOpBHqcSVBGPk=";
+    hash = "sha256-WU3vPI6mvEbzGhuQLgtOfPdoxAT/3XZ7b/dQAnBjsho=";
   };
 
-  cargoHash = "sha256-kPweKXAitvODNoKTr2iB+qM9qMWGoKEQCxpkgrpnewY=";
+  cargoHash = "sha256-fG3idOC3EO8WyazRrEWYQgtFbKtJG9jnqVm3EUcw4i8=";
 
   # Ensure that only the `scooter` package is built (excluding `xtask`)
   cargoBuildFlags = [
diff --git a/pkgs/by-name/se/sentry-cli/package.nix b/pkgs/by-name/se/sentry-cli/package.nix
index e086cbd1cbb3..cd2721401a0d 100644
--- a/pkgs/by-name/se/sentry-cli/package.nix
+++ b/pkgs/by-name/se/sentry-cli/package.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.46.0";
+  version = "2.50.2";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    hash = "sha256-IWDMcmpwKCIE7ogo5upGTtWuF00pFlUwj6RRXTC+RDQ=";
+    hash = "sha256-hYJVfKoUZHfqKHqmF1lZyx5MDkILVsibYLLcb9TZ8yw=";
   };
   doCheck = false;
 
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  cargoHash = "sha256-PDDlt0KmPhJWH3Hd9no/cqYdL/QPGdAE2pIj0EXXc70=";
+  cargoHash = "sha256-yAZrjFGSeEA4A0tJZlvyHakbhlZT3gaE6HpKhJzHIFQ=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd sentry-cli \
diff --git a/pkgs/by-name/sf/sfcgal/package.nix b/pkgs/by-name/sf/sfcgal/package.nix
index db7a0e806a80..c9a2fc9c0321 100644
--- a/pkgs/by-name/sf/sfcgal/package.nix
+++ b/pkgs/by-name/sf/sfcgal/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sfcgal";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitLab {
     owner = "sfcgal";
     repo = "SFCGAL";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m8oyfL3rF4qLugoEFa8iiqS5D1Oljg+x1qMp9KfiQ5c=";
+    hash = "sha256-9caucSIEAjzc4cWShuwbBC+BLs5a3e3y58aT4aLzN5E=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/sq/squawk/package.nix b/pkgs/by-name/sq/squawk/package.nix
index a119a0a5a730..34be74c74bc2 100644
--- a/pkgs/by-name/sq/squawk/package.nix
+++ b/pkgs/by-name/sq/squawk/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "squawk";
-  version = "2.15.0";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner = "sbdchd";
     repo = "squawk";
     tag = "v${version}";
-    hash = "sha256-im608G2A2458lZmxHZaciFI4y+gI9MseP1N1Wm9Z0BA=";
+    hash = "sha256-Za+d1o1fmD35yKtiK/SGWucOPeKowbrwzOHdBvAh1EE=";
   };
 
-  cargoHash = "sha256-3pnrMPl6xvy16UexWcV4N7CshVAwM8SfNbs2WCQa564=";
+  cargoHash = "sha256-jSvcuBurw9HDnemm5133ElrDdTMHzlt+C5d99Kywk7w=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index 23b69c0bbe7a..c45eda24cfbd 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "stackit-cli";
-  version = "0.37.0";
+  version = "0.37.3";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${version}";
-    hash = "sha256-tSpdCZpswpgOnFngat8+es9PbLMxmINey/j6lixuYXI=";
+    hash = "sha256-nyNASYpZvao194rlKSyxNa74Ezo5CwiESNj54uBgUL4=";
   };
 
-  vendorHash = "sha256-079qQtZBeIBz6zYs5soozppPZrxlDkJfWm5vet1AoEE=";
+  vendorHash = "sha256-iWGRFjCvXm03GRnmQlscP5Y5di9W4lW3jotyhDcE/x4=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index 3da5c053372b..3e1eab82a26a 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.16.4";
+  version = "3.16.6";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-E4+FdFdc7TNIJ3f2aeo7TkxS1D7KcqNdN8ILfo4T0eA=";
+    hash = "sha256-QrJGRXmyOz7sAxDeefZ/vdeX07RwNqX00WPuw6KOnsI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/st/stripe-cli/package.nix b/pkgs/by-name/st/stripe-cli/package.nix
index ecf3b83991bb..e4d50aab978c 100644
--- a/pkgs/by-name/st/stripe-cli/package.nix
+++ b/pkgs/by-name/st/stripe-cli/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.28.0";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = "stripe-cli";
     rev = "v${version}";
-    hash = "sha256-bMJ5KY6eIdCiAXmk8UWIWPI1CtePo+j83USTpouw4h4=";
+    hash = "sha256-7WL+usB6FrQ7xZwfQT59U1um2eTLDx7sbFsxaAlG9+Y=";
   };
-  vendorHash = "sha256-T8vrEbR240ihkLDG4vu0s+MxKJ5nOLm0aseDgK9EPPE=";
+  vendorHash = "sha256-EDdRgApJ7gv/4ma/IfaHi+jjpTPegsUfqHbvoFMn048=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sy/syft/package.nix b/pkgs/by-name/sy/syft/package.nix
index 40a962f9276e..9e2a085b0646 100644
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "1.29.0";
+  version = "1.29.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     tag = "v${version}";
-    hash = "sha256-h9qNA9UPMLUEMXAWY8E0MW0rKkVy+Zf1lJ9dqbT/BNs=";
+    hash = "sha256-X+7X71M7nJKEAvAm0L9hh/zamJTGb+OyYNFWfiYlyew=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
   # hash mismatch with darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-B6O62qdoWT8+sNJNUDrW0WqarQMNbPfjFlShzaI63i8=";
+  vendorHash = "sha256-xgjnPTeSB+AWFLfXYLW3bveJowVje81lVvO30ZiCLxI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ta/talhelper/package.nix b/pkgs/by-name/ta/talhelper/package.nix
index d58549d2f2b3..c18a494f612f 100644
--- a/pkgs/by-name/ta/talhelper/package.nix
+++ b/pkgs/by-name/ta/talhelper/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.0.31";
+  version = "3.0.32";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/cUW9TzUCNBa/J5GpadzZr+M1K0tIJoYe7g2T3z3kJo=";
+    hash = "sha256-pLVR/vD7wMH/8UziWe5nwL/fBrexg1BtiJouRb73L4E=";
   };
 
-  vendorHash = "sha256-MDl6HEUH4pL+Hin1iBzedIJelvGPwqgpsrREctfNlzk=";
+  vendorHash = "sha256-zmB1XEU6k6PPuz3J9btDJmP0wpj//Ya1xDtkdv+7P24=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ta/talosctl/package.nix b/pkgs/by-name/ta/talosctl/package.nix
index c2b08cc01999..385c34c8bda0 100644
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.10.5";
+  version = "1.10.6";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     tag = "v${version}";
-    hash = "sha256-s+vRJ0qFhsgLiRpQfUnf/p6bcjQq40ISTB042iE7eBQ=";
+    hash = "sha256-s1d1TVBGi9AZD/nXSv7graKgD6H1MLr4Fvg64c88A4A=";
   };
 
-  vendorHash = "sha256-lYfyW3BEqlzf2wesZwNqQPdjSKRRldEbOeyRri4GwvQ=";
+  vendorHash = "sha256-kj0B4OVvIr1lIEA+niZiX97kijgnMxO9tz87yGPzWds=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/to/tokyonight-gtk-theme/package.nix b/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
index c84b969b453a..3ca47fe9f60c 100644
--- a/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
+++ b/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
@@ -71,13 +71,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants lib
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "0-unstable-2025-07-21";
+    version = "0-unstable-2025-07-28";
 
     src = fetchFromGitHub {
       owner = "Fausto-Korpsvart";
       repo = "Tokyonight-GTK-Theme";
-      rev = "803334a2d85ff60597e1ddd6a593462acc570298";
-      hash = "sha256-aJWyMz1FZnGOH5YXiGa9NBlNY5JRw7J7SWqt5XGKznU=";
+      rev = "1814af889223404b60b7a8c6eca61374c76b37ab";
+      hash = "sha256-LVmv7yadNZPDQruHVdiFiZCpIqFN8NU6S0vQ74RZSLc=";
     };
 
     propagatedUserEnvPkgs = [ gtk-engine-murrine ];
diff --git a/pkgs/by-name/ts/tslib/package.nix b/pkgs/by-name/ts/tslib/package.nix
index 3f0857913cde..b4e4a575dd01 100644
--- a/pkgs/by-name/ts/tslib/package.nix
+++ b/pkgs/by-name/ts/tslib/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Touchscreen access library";
     homepage = "http://www.tslib.org/";
     license = lib.licenses.lgpl21;
-    platforms = lib.platforms.all;
+    platforms = lib.platforms.linux; # requires linux headers <linux/input.h>
     maintainers = with lib.maintainers; [ shogo ];
     teams = with lib.teams; [ ngi ];
   };
diff --git a/pkgs/by-name/ty/typescript/package-lock.json b/pkgs/by-name/ty/typescript/package-lock.json
index d268b4eab061..37ce5b206452 100644
--- a/pkgs/by-name/ty/typescript/package-lock.json
+++ b/pkgs/by-name/ty/typescript/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "typescript",
-  "version": "5.8.3",
+  "version": "5.9.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "typescript",
-      "version": "5.8.3",
+      "version": "5.9.2",
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
diff --git a/pkgs/by-name/ty/typescript/package.nix b/pkgs/by-name/ty/typescript/package.nix
index 4ae9be0f2063..df00837bcdc3 100644
--- a/pkgs/by-name/ty/typescript/package.nix
+++ b/pkgs/by-name/ty/typescript/package.nix
@@ -14,7 +14,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "typescript";
-  version = "5.8.3";
+  version = "5.9.2";
 
   # Prefer npmjs over the GitHub repository for source code.
   # The TypeScript project typically publishes stable, versioned code to npmjs,
@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
   #   - https://github.com/microsoft/TypeScript/pull/60150#issuecomment-2648791588, 5.8.3 includes this 5.9 breaking change
   src = fetchurl {
     url = "https://registry.npmjs.org/typescript/-/typescript-${finalAttrs.version}.tgz";
-    hash = "sha256-cuddvrksLm65o0y1nXT6tcLubzKgMkqJQF9hZdWgg3Q=";
+    hash = "sha256-Z6O8gugiuPRfZTqA/DqXMNIyFNNsg7qF3X9avr7oIGI=";
   };
 
   # The upstream GitHub repository's package-lock.json differs from the package.json in the npmjs tarball.
@@ -40,7 +40,7 @@ buildNpmPackage (finalAttrs: {
     mkdir -p node_modules
   '';
 
-  npmDepsHash = "sha256-f/7Dxwoz0qv7T3Ez4jeRvmu7PxhzObwczjO7JcEcCr4=";
+  npmDepsHash = "sha256-dyN94wmEA/jtiJCsEs/MoDSd6AFsaq2r25a/FeuqQ5k=";
   forceEmptyCache = true;
 
   dontNpmBuild = true;
diff --git a/pkgs/by-name/up/upgrade-assistant/package.nix b/pkgs/by-name/up/upgrade-assistant/package.nix
index 7e3d28d05391..7e8a91bc3435 100644
--- a/pkgs/by-name/up/upgrade-assistant/package.nix
+++ b/pkgs/by-name/up/upgrade-assistant/package.nix
@@ -1,9 +1,9 @@
 { lib, buildDotnetGlobalTool }:
 buildDotnetGlobalTool {
   pname = "upgrade-assistant";
-  version = "0.5.1165";
+  version = "1.0.518";
 
-  nugetHash = "sha256-6LHGgpdCTiDaKZN5oWWUotH2SwExu9I1PAyt8TmQAh0=";
+  nugetHash = "sha256-VpesxikW1it/j/Wh4xj5Qj7mdfsgLljTuTJd2IzCHTk=";
 
   meta = {
     homepage = "https://github.com/dotnet/upgrade-assistant";
diff --git a/pkgs/by-name/ve/velero/package.nix b/pkgs/by-name/ve/velero/package.nix
index f8a3bc3a2cf7..c46faeae6ec5 100644
--- a/pkgs/by-name/ve/velero/package.nix
+++ b/pkgs/by-name/ve/velero/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "velero";
-  version = "1.16.1";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KfVMWoBScpHINmT5PlnPY+I5Ec1NRgEXKMtL0M7WyhE=";
+    hash = "sha256-PxM9BjjCYNOOPX/Z8MHBHstZcIujTjsT+L4gxihii/c=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/vr/vrc-get/package.nix b/pkgs/by-name/vr/vrc-get/package.nix
index e5e5d68970bd..f5438b66c9ae 100644
--- a/pkgs/by-name/vr/vrc-get/package.nix
+++ b/pkgs/by-name/vr/vrc-get/package.nix
@@ -10,11 +10,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "vrc-get";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-gZtaeq/PDVFZPIMH/cB/ZJNP+SbksPPbz8L8Hc7FDM8=";
+    hash = "sha256-b/rlHfm+AfrluCqoTyBqx86xVaNV3QBGollk5HyD4xk=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  cargoHash = "sha256-cG6fcSIQ0E1htEM4H914SSKDNRGM5fj52SUoLqRYzoc=";
+  cargoHash = "sha256-TrmWZBEh2+eKqHu3hwrd2pIQggG3yFszxHQVuLHbs3M=";
 
   # Execute the resulting binary to generate shell completions, using emulation if necessary when cross-compiling.
   # If no emulator is available, then give up on generating shell completions
diff --git a/pkgs/by-name/wa/wait4x/package.nix b/pkgs/by-name/wa/wait4x/package.nix
index a87ce1601148..cda146541457 100644
--- a/pkgs/by-name/wa/wait4x/package.nix
+++ b/pkgs/by-name/wa/wait4x/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "wait4x";
-  version = "3.5.0";
+  version = "3.5.1";
 in
 buildGoModule {
   inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
     owner = "wait4x";
     repo = "wait4x";
     rev = "v${version}";
-    hash = "sha256-iHhUimAREKN3o36vi1Ggj8PrhXCHRllxv4yiQ2xcNig=";
+    hash = "sha256-VAt61k2eHQwyLSsvbWxe7jJ/Wyj4U4O2+LzCsoP/Yq4=";
   };
 
-  vendorHash = "sha256-N3HYbeBoDuLvWYX+7mrCTYi38hTdK8BP9uY56fOmuls=";
+  vendorHash = "sha256-KJOKLTjwwgu2MFNIRDk8eeSVnZyjO9dfVyWrF5vqj9g=";
 
   # Tests make network access
   doCheck = false;
diff --git a/pkgs/by-name/x1/x11_ssh_askpass/package.nix b/pkgs/by-name/x1/x11_ssh_askpass/package.nix
index 86a17d34cb0c..5a3f0a0c3004 100644
--- a/pkgs/by-name/x1/x11_ssh_askpass/package.nix
+++ b/pkgs/by-name/x1/x11_ssh_askpass/package.nix
@@ -2,9 +2,10 @@
   lib,
   stdenv,
   fetchurl,
+  fetchDebianPatch,
+  autoreconfHook,
+  pkg-config,
   xorg,
-  imake,
-  gccmakedep,
 }:
 
 stdenv.mkDerivation rec {
@@ -21,10 +22,21 @@ stdenv.mkDerivation rec {
     sha256 = "620de3c32ae72185a2c9aeaec03af24242b9621964e38eb625afb6cdb30b8c88";
   };
 
-  nativeBuildInputs = [
-    imake
-    gccmakedep
+  patches = [
+    (fetchDebianPatch {
+      pname = "ssh-askpass";
+      version = "1:1.2.4.1";
+      debianRevision = "16";
+      patch = "autotools.patch";
+      hash = "sha256-S2tl0GeDia/ZuyXetPOsiu79kS9yLId7gUj3siw7pH4=";
+    })
   ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
   buildInputs = [
     xorg.libX11
     xorg.libXt
@@ -32,20 +44,6 @@ stdenv.mkDerivation rec {
     xorg.libSM
   ];
 
-  configureFlags = [
-    "--with-app-defaults-dir=$out/etc/X11/app-defaults"
-  ];
-
-  dontUseImakeConfigure = true;
-  postConfigure = ''
-    xmkmf -a
-  '';
-
-  installTargets = [
-    "install"
-    "install.man"
-  ];
-
   meta = with lib; {
     homepage = "https://github.com/sigmavirus24/x11-ssh-askpass";
     description = "Lightweight passphrase dialog for OpenSSH or other open variants of SSH";
diff --git a/pkgs/by-name/ya/yaydl/package.nix b/pkgs/by-name/ya/yaydl/package.nix
index 1bb11f6d8e26..dbc9e670e139 100644
--- a/pkgs/by-name/ya/yaydl/package.nix
+++ b/pkgs/by-name/ya/yaydl/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yaydl";
-  version = "0.17.2";
+  version = "0.17.3";
 
   src = fetchFromGitHub {
     owner = "dertuxmalwieder";
     repo = "yaydl";
     rev = "release-${version}";
-    sha256 = "sha256-r+UkwEtuGL6los9ohv86KA/3qsaEkpnI4yV/UnYelgk=";
+    sha256 = "sha256-bDsI61iWKgXDJ6wnK8a+1HCMlgRM0ol0bWb6a8IiY08=";
   };
 
-  cargoHash = "sha256-pljSw8iQFV6ymg2GKwI+P7R4jvysyFFC1EM25Wi8Los=";
+  cargoHash = "sha256-WLWz+xzkxIqlYkNgefyc7c13YjPWpYz9VUlUfWwDN+g=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 198cecd269b0..284a583826ab 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -243,6 +243,7 @@ else
     inherit (unpacked) pname version;
 
     targetPkgs = pkgs: (linuxGetDependencies pkgs) ++ [ unpacked ];
+    extraPreBwrapCmds = "unset QT_PLUGIN_PATH";
     extraBwrapArgs = [ "--ro-bind ${unpacked}/opt /opt" ];
     runScript = "/opt/zoom/ZoomLauncher";
 
diff --git a/pkgs/by-name/zo/zoraxy/package.nix b/pkgs/by-name/zo/zoraxy/package.nix
index 93aabd762824..0f0c45ceb20d 100644
--- a/pkgs/by-name/zo/zoraxy/package.nix
+++ b/pkgs/by-name/zo/zoraxy/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "zoraxy";
-  version = "3.2.4";
+  version = "3.2.5r2";
 
   src = fetchFromGitHub {
     owner = "tobychui";
     repo = "zoraxy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vcsN75o5olK/yQln77OJeq/PmUX1c/RYLBHyP8mRs8Q=";
+    hash = "sha256-O7Rzx62O0h3kK6+lMag+5totijJoobOKi8DNWT9sDjg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
diff --git a/pkgs/development/libraries/schroedinger/default.nix b/pkgs/development/libraries/schroedinger/default.nix
index 8298aa6a6a2b..fe0458917d82 100644
--- a/pkgs/development/libraries/schroedinger/default.nix
+++ b/pkgs/development/libraries/schroedinger/default.nix
@@ -6,6 +6,7 @@
   pkg-config,
   fetchpatch,
   autoreconfHook,
+  gtk-doc,
 }:
 
 stdenv.mkDerivation rec {
@@ -26,6 +27,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
+    gtk-doc
   ];
   buildInputs = [ orc ];
 
diff --git a/pkgs/development/python-modules/cmaes/default.nix b/pkgs/development/python-modules/cmaes/default.nix
index 41a0a886729f..133304f68a4e 100644
--- a/pkgs/development/python-modules/cmaes/default.nix
+++ b/pkgs/development/python-modules/cmaes/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "cmaes";
-  version = "0.11.1";
+  version = "0.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "CyberAgentAILab";
     repo = "cmaes";
     tag = "v${version}";
-    hash = "sha256-u2CgU9n8N9AMxfMBbDbnYzBMdl/IGOLTxOeh8RlnB/Y=";
+    hash = "sha256-Ev3Nes0iJIhndWfVzDVLpoV4TIFaHMOEUgPPdlyU0+s=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -42,7 +42,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for CMA evolution strategy";
     homepage = "https://github.com/CyberAgentAILab/cmaes";
-    changelog = "https://github.com/CyberAgentAILab/cmaes/releases/tag/v${version}";
+    changelog = "https://github.com/CyberAgentAILab/cmaes/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/livekit-api/default.nix b/pkgs/development/python-modules/livekit-api/default.nix
index 88379600c3d2..d1b13ef1e49f 100644
--- a/pkgs/development/python-modules/livekit-api/default.nix
+++ b/pkgs/development/python-modules/livekit-api/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "livekit-api";
-  version = "1.0.3";
+  version = "1.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "python-sdks";
     tag = "api-v${version}";
-    hash = "sha256-W9WmruzN5Nm9vrjG1Kcf3Orst0b2Mxm80hKLjwXowl8=";
+    hash = "sha256-GoVPOLA4aCC26+x9//mlmOO6tb3dczN+s1C+VtGRiRE=";
   };
 
   pypaBuildFlags = [ "livekit-api" ];
diff --git a/pkgs/development/python-modules/llama-cloud-services/default.nix b/pkgs/development/python-modules/llama-cloud-services/default.nix
index 220499e06837..03783310a694 100644
--- a/pkgs/development/python-modules/llama-cloud-services/default.nix
+++ b/pkgs/development/python-modules/llama-cloud-services/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "llama-cloud-services";
-  version = "0.6.51";
+  version = "0.6.53";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "run-llama";
     repo = "llama_cloud_services";
     tag = "v${version}";
-    hash = "sha256-ImqAvi0y11m8GsxHnLjsrp/X+Es9XQ7ZqyzMKn5J2d8=";
+    hash = "sha256-b64yOpjOrcV+6isCVo3CQ/pbzrG8GBZe1rvBiUIJ+Y8=";
   };
 
   pythonRelaxDeps = [ "llama-cloud" ];
diff --git a/pkgs/development/python-modules/llm-ollama/default.nix b/pkgs/development/python-modules/llm-ollama/default.nix
index 425ebf4a1755..47794ed6c12a 100644
--- a/pkgs/development/python-modules/llm-ollama/default.nix
+++ b/pkgs/development/python-modules/llm-ollama/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "llm-ollama";
-  version = "0.12.0";
+  version = "0.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "taketwo";
     repo = "llm-ollama";
     tag = version;
-    hash = "sha256-+4YslGYY8AVwHnj1ahFqtclnaywPVJ0pt2CL9NewuUE=";
+    hash = "sha256-mWiwUXLpyILH1CCi2b0D3TtInEIfK4dubho9EEkbJ0M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/odp-amsterdam/default.nix b/pkgs/development/python-modules/odp-amsterdam/default.nix
index 334d94b1f559..0a025021e1f7 100644
--- a/pkgs/development/python-modules/odp-amsterdam/default.nix
+++ b/pkgs/development/python-modules/odp-amsterdam/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "odp-amsterdam";
-  version = "6.1.1";
+  version = "6.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "klaasnicolaas";
     repo = "python-odp-amsterdam";
     tag = "v${version}";
-    hash = "sha256-ZSo0CNN4NjHQDq3Nx6aqfPEssfty7wNefFX6QG5+pQ4=";
+    hash = "sha256-vamWelyEcwvYI5I9wmKk8kKc7j0OMer/BKgC0pbN4g0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/oralb-ble/default.nix b/pkgs/development/python-modules/oralb-ble/default.nix
index 08953a65f8ca..f35524b46b43 100644
--- a/pkgs/development/python-modules/oralb-ble/default.nix
+++ b/pkgs/development/python-modules/oralb-ble/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "oralb-ble";
-  version = "0.18.0";
+  version = "1.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "oralb-ble";
     tag = "v${version}";
-    hash = "sha256-e6L8HXpqOAHnEktIJ1N1atC5QXno669W3c/S7cISa48=";
+    hash = "sha256-2uXfsWt8MW/neeh2HR59u0jOVXwjt4IM2DGR+vuvi2c=";
   };
 
   build-system = [ poetry-core ];
@@ -54,7 +54,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for Oral B BLE devices";
     homepage = "https://github.com/Bluetooth-Devices/oralb-ble";
-    changelog = "https://github.com/Bluetooth-Devices/oralb-ble/releases/tag/v${version}";
+    changelog = "https://github.com/Bluetooth-Devices/oralb-ble/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix
index 614e010182cf..41723897cc1c 100644
--- a/pkgs/development/python-modules/orbax-checkpoint/default.nix
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@@ -9,6 +9,7 @@
   flit-core,
 
   # dependencies
+  aiofiles,
   etils,
   humanize,
   importlib-resources,
@@ -23,7 +24,6 @@
   typing-extensions,
 
   # tests
-  aiofiles,
   chex,
   google-cloud-logging,
   mock,
@@ -31,18 +31,19 @@
   portpicker,
   pytest-xdist,
   pytestCheckHook,
+  safetensors,
 }:
 
 buildPythonPackage rec {
   pname = "orbax-checkpoint";
-  version = "0.11.19";
+  version = "0.11.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "orbax";
     tag = "v${version}";
-    hash = "sha256-j15E4jGvxIjEdWG6Lwr9mvPXr9WifrD1zFF6Vj+7wik=";
+    hash = "sha256-ZZTmWW0PZHk8Evhk6JnbAyl7RQOAxN4GwXUv5M6GfIQ=";
   };
 
   sourceRoot = "${src.name}/checkpoint";
@@ -55,6 +56,7 @@ buildPythonPackage rec {
 
   dependencies = [
     absl-py
+    aiofiles
     etils
     humanize
     importlib-resources
@@ -70,7 +72,6 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    aiofiles
     chex
     google-cloud-logging
     mock
@@ -78,6 +79,7 @@ buildPythonPackage rec {
     portpicker
     pytest-xdist
     pytestCheckHook
+    safetensors
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/sqlfmt/default.nix b/pkgs/development/python-modules/sqlfmt/default.nix
index 49bfd2a4a202..709a4746c8c9 100644
--- a/pkgs/development/python-modules/sqlfmt/default.nix
+++ b/pkgs/development/python-modules/sqlfmt/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "sqlfmt";
-  version = "0.26.0";
+  version = "0.27.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "tconbeer";
     repo = "sqlfmt";
     tag = "v${version}";
-    hash = "sha256-q0pkwuQY0iLzK+Lef6k62UxMKJy592RsJnSZnVYdMa8=";
+    hash = "sha256-Yel9SB7KrDqtuZxNx4omz6u4AID8Fk5kFYKBEZD1fuU=";
   };
 
   pythonRelaxDeps = [ "platformdirs" ];
@@ -64,7 +64,7 @@ buildPythonPackage rec {
   meta = {
     description = "Sqlfmt formats your dbt SQL files so you don't have to";
     homepage = "https://github.com/tconbeer/sqlfmt";
-    changelog = "https://github.com/tconbeer/sqlfmt/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/tconbeer/sqlfmt/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ pcboy ];
     mainProgram = "sqlfmt";
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index fadb0f84f71e..9cea4971ff75 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1430";
+  version = "3.0.1435";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-8ccjMWruE+6CYVj0MnO51sDUqeC68qAqNI1sW3+KGaI=";
+    hash = "sha256-0kyOd9jY0K12r2SYTwq5xVq58i3R33CCIP7smAkmwV4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index b182e99bb5fd..497167201a1c 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.6.3";
+  version = "5.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-hep";
     repo = "uproot5";
     tag = "v${version}";
-    hash = "sha256-B23LLc0GI1eeKn8eZLaDqeNHMQfvv52hSdgX/wv5OaE=";
+    hash = "sha256-2F2uatdrZd5p6baYuGj24EmUv045Jk3Pp76Zv6eH5yg=";
   };
 
   build-system = [
diff --git a/pkgs/os-specific/linux/hid-tmff2/default.nix b/pkgs/os-specific/linux/hid-tmff2/default.nix
index 2a0485db63a8..7c69a584e81d 100644
--- a/pkgs/os-specific/linux/hid-tmff2/default.nix
+++ b/pkgs/os-specific/linux/hid-tmff2/default.nix
@@ -9,13 +9,13 @@
 stdenv.mkDerivation {
   pname = "hid-tmff2";
   # https://github.com/Kimplul/hid-tmff2/blob/ca168637fbfb085ebc9ade0c47fa0653dac5d25b/dkms/dkms-install.sh#L12
-  version = "0-unstable-2025-06-28";
+  version = "0-unstable-2025-07-28";
 
   src = fetchFromGitHub {
     owner = "Kimplul";
     repo = "hid-tmff2";
-    rev = "49adf5c48ba2784d97384619a52e875daf4bc062";
-    hash = "sha256-J/Ta1o6k4QHLHTEmoQgObv4uk69mAPlPgzdhLe5Pa+I=";
+    rev = "e0a173f3265be8efcbd4a6f34df6c5713d988b15";
+    hash = "sha256-JZ7nNiNlUdzY9ZJ5AT/xMpSZYz8ej9LByybkBEaHHqk=";
     # For hid-tminit. Source: https://github.com/scarburato/hid-tminit
     fetchSubmodules = true;
   };
diff --git a/pkgs/os-specific/windows/cygwin-setup/default.nix b/pkgs/os-specific/windows/cygwin-setup/default.nix
index 9cc920829ecd..6c087dc4de97 100644
--- a/pkgs/os-specific/windows/cygwin-setup/default.nix
+++ b/pkgs/os-specific/windows/cygwin-setup/default.nix
@@ -66,5 +66,7 @@ stdenv.mkDerivation rec {
     homepage = "https://sourceware.org/cygwin-apps/setup.html";
     description = "Tool for installing Cygwin";
     license = lib.licenses.gpl2Plus;
+    platforms = lib.intersectLists lib.platforms.windows lib.platforms.x86;
+    teams = [ lib.teams.windows ];
   };
 }
diff --git a/pkgs/os-specific/windows/libgnurx/default.nix b/pkgs/os-specific/windows/libgnurx/default.nix
index f3bc160e0cff..c67a52ef93be 100644
--- a/pkgs/os-specific/windows/libgnurx/default.nix
+++ b/pkgs/os-specific/windows/libgnurx/default.nix
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
+    downloadPage = "https://sourceforge.net/projects/mingw/files/Other/UserContributed/regex/";
+    description = "Regex functionality from glibc extracted into a separate library for win32";
+    license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.windows;
+    teams = [ lib.teams.windows ];
   };
 }
diff --git a/pkgs/os-specific/windows/mingw-w64/headers.nix b/pkgs/os-specific/windows/mingw-w64/headers.nix
index 34d9a37b6217..abcf07bd374e 100644
--- a/pkgs/os-specific/windows/mingw-w64/headers.nix
+++ b/pkgs/os-specific/windows/mingw-w64/headers.nix
@@ -23,6 +23,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    downloadPage = "https://sourceforge.net/projects/mingw/files/Other/UserContributed/regex/";
+    description = "Collection of headers and libraries for building native Windows applications";
+    license = lib.licenses.publicDomain;
     platforms = lib.platforms.windows;
+    teams = [ lib.teams.windows ];
   };
 })
diff --git a/pkgs/os-specific/windows/msvcSdk/default.nix b/pkgs/os-specific/windows/msvcSdk/default.nix
index f3144e9b14c4..3f7f920b0d67 100644
--- a/pkgs/os-specific/windows/msvcSdk/default.nix
+++ b/pkgs/os-specific/windows/msvcSdk/default.nix
@@ -120,5 +120,6 @@ else
       # The arm manifest is missing critical pieces.
       broken = stdenvNoCC.hostPlatform.isAarch;
       sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+      teams = [ lib.teams.windows ];
     };
   })
diff --git a/pkgs/os-specific/windows/pthread-w32/default.nix b/pkgs/os-specific/windows/pthread-w32/default.nix
index 0db99bf4c97d..2f49156370ee 100644
--- a/pkgs/os-specific/windows/pthread-w32/default.nix
+++ b/pkgs/os-specific/windows/pthread-w32/default.nix
@@ -26,11 +26,12 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "POSIX threads library for Windows";
     homepage = "https://sourceware.org/pthreads-win32";
-    license = licenses.lgpl21Plus;
-    maintainers = [ ];
-    platforms = platforms.windows;
+    license = lib.licenses.lgpl21Plus;
+    maintainers = [ lib.maintainers.RossSmyth ];
+    platforms = lib.platforms.windows;
+    teams = [ lib.teams.windows ];
   };
 }
diff --git a/pkgs/os-specific/windows/w32api/default.nix b/pkgs/os-specific/windows/w32api/default.nix
index e36833852566..be4b21bca0f4 100644
--- a/pkgs/os-specific/windows/w32api/default.nix
+++ b/pkgs/os-specific/windows/w32api/default.nix
@@ -13,9 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "09rhnl6zikmdyb960im55jck0rdy5z9nlg3akx68ixn7khf3j8wb";
   };
 
-  meta = {
-    platforms = lib.platforms.windows;
-  };
-
   dontStrip = true;
+
+  meta = {
+    description = "Core win32 headers and libraries for MinGW";
+    downloadPage = "https://sourceforge.net/projects/mingw/files/MinGW/Base/w32api/";
+    license = lib.licenses.publicDomain;
+    maintainers = [ lib.maintainers.RossSmyth ];
+    platforms = lib.intersectLists lib.platforms.windows lib.platforms.x86;
+    teams = [ lib.teams.windows ];
+  };
 }
diff --git a/pkgs/servers/monitoring/prometheus/pihole-exporter.nix b/pkgs/servers/monitoring/prometheus/pihole-exporter.nix
index 1fae0a609ef9..86675ec1c88c 100644
--- a/pkgs/servers/monitoring/prometheus/pihole-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/pihole-exporter.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pihole-exporter";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "eko";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-T96sNzQHPWM30uzLH3ffH7pKFP3z8DV/e57+TlFuG2Q=";
+    sha256 = "sha256-ge4+sWQkJ2Zc7Y7+IYAq6OK6pYkaE3jjFo1rhTaDMu4=";
   };
 
-  vendorHash = "sha256-/+YHIpaBd9YfmX04CT2ohVpQc6iLFIFLvcIwGtPbc+s=";
+  vendorHash = "sha256-4qbfXRXEViR/2fCmanlU88zvbJb5oppHWC7rVQaneLc=";
 
   meta = with lib; {
     description = "Prometheus exporter for PI-Hole's Raspberry PI ad blocker";
diff --git a/pkgs/servers/xmpp/prosody/default.nix b/pkgs/servers/xmpp/prosody/default.nix
index 997716a8928f..891c7d866300 100644
--- a/pkgs/servers/xmpp/prosody/default.nix
+++ b/pkgs/servers/xmpp/prosody/default.nix
@@ -36,7 +36,7 @@ let
   );
 in
 stdenv.mkDerivation rec {
-  version = "0.12.4"; # also update communityModules
+  version = "0.12.5"; # also update communityModules
   pname = "prosody";
   # The following community modules are necessary for the nixos module
   # prosody module to comply with XEP-0423 and provide a working
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
   ];
   src = fetchurl {
     url = "https://prosody.im/downloads/source/${pname}-${version}.tar.gz";
-    sha256 = "R9cSJzwvKVWMQS9s2uwHMmC7wmt92iQ9tYAzAYPWWFY=";
+    sha256 = "sha256-d4+3cHoPEDmVlbp6ucZt0qIojArjp/5Kt4+X1GK9OZ8=";
   };
 
   # A note to all those merging automated updates: Please also update this
@@ -56,8 +56,8 @@ stdenv.mkDerivation rec {
   # version.
   communityModules = fetchhg {
     url = "https://hg.prosody.im/prosody-modules";
-    rev = "d3a72777f149";
-    hash = "sha256-qLuhEdvtOMfu78oxLUZKWZDb/AME1+IRnk0jkQNxTU8=";
+    rev = "fc521fb5ffa0";
+    hash = "sha256-Ci52Xkx1xd3GW9lBPKgWFBB52SocxKyj8f/Hq3hZeak=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c04f6db459a1..829ffde007b8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8147,9 +8147,9 @@ with pkgs;
     else if libc == "musl" then
       musl
     else if libc == "msvcrt" then
-      windows.mingw_w64
+      if stdenv.hostPlatform.isMinGW then windows.mingw_w64 else windows.sdk
     else if libc == "ucrt" then
-      windows.mingw_w64
+      if stdenv.hostPlatform.isMinGW then windows.mingw_w64 else windows.sdk
     else if libc == "libSystem" then
       if stdenv.hostPlatform.useiOSPrebuilt then darwin.iosSdkPkgs.libraries else darwin.libSystem
     else if libc == "fblibc" then
@@ -9426,9 +9426,7 @@ with pkgs;
 
   rshell = python3.pkgs.callPackage ../development/embedded/rshell { };
 
-  schroedinger = callPackage ../development/libraries/schroedinger {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  schroedinger = callPackage ../development/libraries/schroedinger { };
 
   SDL = SDL_compat;
   SDL2 = sdl2-compat;
@@ -12170,8 +12168,6 @@ with pkgs;
 
   fclones = callPackage ../tools/misc/fclones { };
 
-  fclones-gui = callPackage ../tools/misc/fclones/gui.nix { };
-
   feh = callPackage ../applications/graphics/feh {
     imlib2 = imlib2Full;
   };
@@ -12574,8 +12570,6 @@ with pkgs;
 
   i3status = callPackage ../applications/window-managers/i3/status.nix { };
 
-  i3status-rust = callPackage ../applications/window-managers/i3/status-rust.nix { };
-
   i3wsr = callPackage ../applications/window-managers/i3/wsr.nix { };
 
   i3-wk-switch = callPackage ../applications/window-managers/i3/wk-switch.nix { };
@@ -14092,9 +14086,7 @@ with pkgs;
     onlyLibVLC = true;
   };
 
-  vorbis-tools = callPackage ../applications/audio/vorbis-tools {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  vorbis-tools = callPackage ../applications/audio/vorbis-tools { };
 
   vscode = callPackage ../applications/editors/vscode/vscode.nix { };
   vscode-fhs = vscode.fhs;
diff --git a/pkgs/top-level/packages-config.nix b/pkgs/top-level/packages-config.nix
index a30f233c32cd..7cf415ac8050 100644
--- a/pkgs/top-level/packages-config.nix
+++ b/pkgs/top-level/packages-config.nix
@@ -24,6 +24,7 @@
         roundcubePlugins
         sourceHanPackages
         zabbix60
+        windows
         ;
 
       # Make sure haskell.compiler is included, so alternative GHC versions show up,