diff --git a/ci/github-script/labels.js b/ci/github-script/labels.js
index c57a9bb60a56..2d7bafb6c5ae 100644
--- a/ci/github-script/labels.js
+++ b/ci/github-script/labels.js
@@ -26,7 +26,10 @@ module.exports = async ({ github, context, core, dry }) => {
     // be detected, no maintainers pinged.
     // We can just check the temporary merge commit, and if it's empty the PR can safely be
     // closed - there are no further changes.
-    if (pull_request.merge_commit_sha) {
+    // We only do this for PRs, which are non-empty to start with. This avoids closing PRs
+    // which have been created with an empty commit for notification purposes, for example
+    // the yearly election notification for voters.
+    if (pull_request.merge_commit_sha && pull_request.changed_files > 0) {
       const commit = (
         await github.rest.repos.getCommit({
           ...context.repo,
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 66a599383a95..7ef0a3a4a368 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -717,6 +717,7 @@ in
   homepage-dashboard = runTest ./homepage-dashboard.nix;
   homer = handleTest ./homer { };
   honk = runTest ./honk.nix;
+  hoogle = runTest ./hoogle.nix;
   hostname = handleTest ./hostname.nix { };
   hound = runTest ./hound.nix;
   hub = runTest ./git/hub.nix;
diff --git a/nixos/tests/hoogle.nix b/nixos/tests/hoogle.nix
new file mode 100644
index 000000000000..738680938e48
--- /dev/null
+++ b/nixos/tests/hoogle.nix
@@ -0,0 +1,31 @@
+{ lib, ... }:
+{
+  name = "hoogle";
+  meta.maintainers = with lib.maintainers; [ h7x4 ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.hoogle = {
+        enable = true;
+        packages =
+          hp: with hp; [
+            arrows
+            lens
+          ];
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      cfg = nodes.machine.services.hoogle;
+    in
+    ''
+      machine.wait_for_unit("hoogle.service")
+      machine.wait_for_open_port(${toString cfg.port})
+
+      machine.succeed("curl http://${cfg.host}:${toString cfg.port} | grep '<title>Hoogle</title>'")
+      machine.succeed("curl 'http://${cfg.host}:${toString cfg.port}?hoogle=>>>' | grep Arrow")
+    '';
+}
diff --git a/nixos/tests/prometheus/default.nix b/nixos/tests/prometheus/default.nix
index 53cfc80e8f64..2a9e81ca7c37 100644
--- a/nixos/tests/prometheus/default.nix
+++ b/nixos/tests/prometheus/default.nix
@@ -8,4 +8,5 @@
   prometheus-pair = runTest ./prometheus-pair.nix;
   pushgateway = runTest ./pushgateway.nix;
   remote-write = runTest ./remote-write.nix;
+  ui = runTest ./ui.nix;
 }
diff --git a/nixos/tests/prometheus/ui.nix b/nixos/tests/prometheus/ui.nix
new file mode 100644
index 000000000000..fb5ddcd58f55
--- /dev/null
+++ b/nixos/tests/prometheus/ui.nix
@@ -0,0 +1,86 @@
+{ lib, pkgs, ... }:
+
+{
+  name = "prometheus-ui";
+
+  nodes = {
+    browser =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages =
+          let
+            prometheusSeleniumScript =
+              pkgs.writers.writePython3Bin "prometheus-selenium-script"
+                {
+                  libraries = with pkgs.python3Packages; [ selenium ];
+                }
+                ''
+                  from selenium import webdriver
+                  from selenium.webdriver.common.by import By
+                  from selenium.webdriver.firefox.options import Options
+                  from selenium.webdriver.support.ui import WebDriverWait
+
+                  options = Options()
+                  options.add_argument("--headless")
+                  service = webdriver.FirefoxService(executable_path="${lib.getExe pkgs.geckodriver}")  # noqa: E501
+
+                  driver = webdriver.Firefox(options=options, service=service)
+                  driver.implicitly_wait(10)
+                  driver.get("http://prometheus:9090/")
+
+                  wait = WebDriverWait(driver, 60)
+
+                  assert len(driver.find_elements(By.CLASS_NAME, "mantine-AppShell-header")) > 0  # noqa: E501
+                  assert len(driver.find_elements(By.CLASS_NAME, "mantine-AppShell-main")) > 0  # noqa: E501
+
+                  driver.close()
+                '';
+          in
+          with pkgs;
+          [
+            curl
+            firefox-unwrapped
+            geckodriver
+            prometheusSeleniumScript
+          ];
+      };
+
+    prometheus =
+      { config, pkgs, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
+          scrapeConfigs = [
+            {
+              job_name = "prometheus";
+              static_configs = [
+                {
+                  targets = [
+                    "prometheus1:${toString config.services.prometheus.port}"
+                    "prometheus2:${toString config.services.prometheus.port}"
+                  ];
+                }
+              ];
+            }
+          ];
+        };
+      };
+  };
+
+  testScript = ''
+    prometheus.wait_for_unit("prometheus")
+    prometheus.wait_for_open_port(9090)
+    prometheus.wait_until_succeeds("curl -sSf http://localhost:9090/-/healthy")
+
+    browser.systemctl("start network-online.target")
+    browser.wait_for_unit("network-online.target")
+
+    browser.succeed("curl -kLs http://prometheus:9090/query | grep 'Prometheus Time Series Collection and Processing Server'")
+
+    # Ensure the application is actually rendered by the Javascript
+    browser.succeed("PYTHONUNBUFFERED=1 prometheus-selenium-script")
+  '';
+}
diff --git a/nixos/tests/vscode-remote-ssh.nix b/nixos/tests/vscode-remote-ssh.nix
index 3ceaba967fa6..7e563820b581 100644
--- a/nixos/tests/vscode-remote-ssh.nix
+++ b/nixos/tests/vscode-remote-ssh.nix
@@ -27,6 +27,8 @@ import ./make-test-python.nix (
     meta = {
       maintainers = [ ];
       timeout = 600;
+      # https://hydra.nixos.org/build/309924543/nixlog/1
+      broken = true;
     };
 
     nodes =
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index 2e886cb44a12..f259950ecb67 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -112,6 +112,21 @@ stdenv.mkDerivation (finalAttrs: {
       -e 's,-Wno-unused-private-field,,g'
     sed -i CMakeLists.txt \
       -e 's,libprotobuf.a,protobuf,g'
+
+    # CMake 3.0.0 is deprecated and no longer supported by CMake > 4
+    # https://github.com/NixOS/nixpkgs/issues/445447
+    substituteInPlace 3rdparty/{qsqlite,qtsingleapplication,qtiocompressor,qxt}/CMakeLists.txt \
+      cmake/{ParseArguments.cmake,Translations.cmake}                                          \
+      tests/CMakeLists.txt gst/moodbar/CMakeLists.txt                                          \
+      --replace-fail                                                                           \
+        "cmake_minimum_required(VERSION 3.0.0)" \
+        "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace 3rdparty/libmygpo-qt5/CMakeLists.txt --replace-fail \
+      "cmake_minimum_required( VERSION 3.0.0 FATAL_ERROR )" \
+      "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace CMakeLists.txt --replace-fail \
+        "cmake_policy(SET CMP0053 OLD)" \
+        ""
   '';
 
   preConfigure = ''
diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
index 97337f435042..6d934130acd1 100644
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -87,8 +87,8 @@ stdenv.mkDerivation (finalAttrs: {
       publicKeys = fetchFromGitHub {
         owner = "bitcoinknots";
         repo = "guix.sigs";
-        rev = "7ee29a9ffbd1c26ba065ba06055242a01c3e63ff";
-        sha256 = "sha256-ZW1I7Y35Pi4WZhgCCYSI5gPhcvbfnpBObhOUTqZGVvM=";
+        rev = "251a8f2141e5f8439175fdd7b6cd6819d743cc01";
+        sha256 = "sha256-pZOK/lD1m9x8mz1IB39kLA/27fBnLvEL3qrwTRjL9Ec=";
       };
 
       checksums = fetchurl {
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       signatures = fetchurl {
         url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-jy4gxuczCSsJQkkH3axMljuf7k2VdmLp4PkgRoQnoSY=";
+        hash = "sha256-fSjYdscQ4viuXutP43prWjrNT7cMaJ9J8SsUykNjJtw";
       };
 
       verifyBuilderKeys =
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 57f7e03d9012..167c821bc06f 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -36,20 +36,20 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-i1MFtqfWiAsvxgyc/MZlOdo/Py6PQlJmjHGeYnhygso=";
-      x86_64-darwin = "sha256-HElY2mOgYxfE5LULFMpipmd/igDAapd6G2VlZeCGWTI=";
-      aarch64-linux = "sha256-NiVXjiii9Df3mRkDVULsiLgRhfJKX+H2/VYuxUImFzI=";
-      aarch64-darwin = "sha256-IDqupYgoslZb7Po8nimOTwojTJ0TO5efgfTqtTQ+dUI=";
-      armv7l-linux = "sha256-cN4EXCM5v5ULZUb+glqbI9g+oOsjELB+OWEGDVxN/Y4=";
+      x86_64-linux = "sha256-MqZQ8aER3wA1StlXH1fRImg3Z3dnfdWvIWLq2SEGeok=";
+      x86_64-darwin = "sha256-mA8Qpif6drxQDIK8dqp+45P7GHe+2AYS7utsBVeOjAc=";
+      aarch64-linux = "sha256-RXnlJmT+LfLYByS0IKurGCfTBSDw52b3YIQD26L+lL0=";
+      aarch64-darwin = "sha256-p9EFEk1enIHr0LtKr+W7e9OW5n8AdeQEaWNLWe8+Lao=";
+      armv7l-linux = "sha256-X6VhFrlV4S08bPgARVmIAcizYqz2V4sQrwIGzkeDLuE=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.105.0";
+  version = "1.105.1";
 
   # This is used for VS Code - Remote SSH test
-  rev = "03c265b1adee71ac88f833e065f7bb956b60550a";
+  rev = "7d842fb85a0275a4a8e4d7e040d2625abbf7f084";
 in
 callPackage ./generic.nix {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -82,7 +82,7 @@ callPackage ./generic.nix {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-0tGqGDMmLURqdQwqFWCO10d/RkVha8iC0Uv/JFp9nNQ=";
+      hash = "sha256-lMNmzwFh8Wn1xXCTpTnQZozzIRaO5aMJ2wP42u2zWIs=";
     };
     stdenv = stdenvNoCC;
   };
diff --git a/pkgs/applications/emulators/libretro/cores/bsnes.nix b/pkgs/applications/emulators/libretro/cores/bsnes.nix
index cdb25e403ac5..ae63e12c2afe 100644
--- a/pkgs/applications/emulators/libretro/cores/bsnes.nix
+++ b/pkgs/applications/emulators/libretro/cores/bsnes.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bsnes";
-  version = "0-unstable-2025-10-03";
+  version = "0-unstable-2025-10-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bsnes-libretro";
-    rev = "e0e6cef46582a436e8b08a339f4751411dc5bd63";
-    hash = "sha256-fIlTIF1042oWIHxqD7h7MdUfb6QDfIP0jqVlBNOTBmY=";
+    rev = "57155d8037463346307123daabeaa27298e0f956";
+    hash = "sha256-eQaeAdQ7OWRzPVSbNOPUmMKIvkztZYGm2tzBavJO4Gs=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index f08e15ac8948..3d530034d18c 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-10-03";
+  version = "0-unstable-2025-10-18";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "af5f67c15d52b16d35e95671a5b74502288c4397";
-    hash = "sha256-eMkyNwGdgyYDmwqYy3xzzSTYqUcoKpQkDYFP8bQdz58=";
+    rev = "5d628f8167947bc8a2a7608d52e4ff8b71b9ef34";
+    hash = "sha256-QKUAVJsJL1Ff8KNz6lpMU/IZNb1I09++AqqccIBdAPw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index ab9d5f5c667f..ee411c1283e6 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-10-06";
+  version = "0-unstable-2025-10-17";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "252a94c0c40047b52d9ecced567846a9dd5b2020";
-    hash = "sha256-Eys3iDJfi3bRuPjWRK34CEAN5o5MC+of1ktT7z2DdAI=";
+    rev = "a2fa5673736922540978c73f4610b82e71de3cf8";
+    hash = "sha256-CGxfucym0HyrIUZoDFJU5lfq4t5yfnOaJqqggDoQWp8=";
   };
 
   meta = {
diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 2073de8fc4b6..4693f5c78aab 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -81,13 +81,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.10.0";
+  version = "4.8.11.0";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-w1uBhp47XRinZpSuKeFaASOIOyjRDkDA81uqW4pK3F4=";
+    hash = "sha256-JZ6cGqLybHgy6xIklH3A//XNXiXlsM4NixGmk0KoubU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index 24488ad5690e..515a4190aab6 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2025-09-09";
+  version = "0-unstable-2025-10-17";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "0f5d7883cc4c49b8e9c51d5512ba145b5289eb05";
-    hash = "sha256-8zzUp1am6nu/6EnQkPTDkd/TLb2SBgSSyNpUyv44Zr8=";
+    rev = "53b0c689faaa4bb7edcb9dae799602c417634351";
+    hash = "sha256-awGCaVl0m1IqADeQW53wFSEAeUYR6677oc0Z2ZfZ898=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/ba/balsa/package.nix b/pkgs/by-name/ba/balsa/package.nix
index 5a3201507f1e..eff97be1b660 100644
--- a/pkgs/by-name/ba/balsa/package.nix
+++ b/pkgs/by-name/ba/balsa/package.nix
@@ -19,7 +19,7 @@
   ninja,
   pkg-config,
   sqlite,
-  # webkitgtk_4_0,
+  webkitgtk_4_1,
   wrapGAppsHook3,
 }:
 
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     libsecret
     openssl
     sqlite
-    # webkitgtk_4_0
+    webkitgtk_4_1
   ];
 
   mesonFlags = [
@@ -78,8 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   meta = {
-    # webkitgtk_4_0 was removed
-    broken = true;
     description = "E-mail client for GNOME";
     homepage = "https://gitlab.gnome.org/GNOME/balsa";
     changelog = "https://gitlab.gnome.org/GNOME/balsa/-/blob/master/ChangeLog";
diff --git a/pkgs/by-name/ca/cargo-modules/package.nix b/pkgs/by-name/ca/cargo-modules/package.nix
index 6b260b63966b..6a7a27cb3958 100644
--- a/pkgs/by-name/ca/cargo-modules/package.nix
+++ b/pkgs/by-name/ca/cargo-modules/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-modules";
-  version = "0.24.3";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "regexident";
     repo = "cargo-modules";
     tag = "v${version}";
-    hash = "sha256-ZotG9eYVwNb123dQ6D4bsVCb7vS/jc/I67JPrQnJ59U=";
+    hash = "sha256-FghGqRV9KaRPZ7l3t/AB7f1XufOsNdiGFUk8GUwAxtY=";
   };
 
-  cargoHash = "sha256-CNOzNaA/bOvuBsON42m0cPEvAcqpCp1oNNOetuDEN04=";
+  cargoHash = "sha256-Lt5zqhBpHlPYoPgIVmVYu35SnuguqPw5Qg0oTL5cgCs=";
 
   checkFlags = [
     "--skip=cfg_test::with_tests::smoke"
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 60b6929118ca..a9c669125dd5 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-Ty+W5uiFkr8MBhWUweHsFQnIZ8R+oJoCcvQabHFdu7U=";
+    hash = "sha256-MZA9PkDftUyHqcC5i9QLvMTq+q1m7MVEkMPyD4EiWtk=";
   };
 
-  vendorHash = "sha256-YjkO3QTQZlCfbKm/uYNVwnyQ/1Tde77YB2m7CqKsRtM=";
+  vendorHash = "sha256-tPhWKjaoUHQq6MdhktSZpfF7651YKeWd9ecg8V3E6aQ=";
 
   subPackages = [ "cmd/cdncheck/" ];
 
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 8111ba57d56a..51d3144c37b4 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -14,18 +14,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.46.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-o898VjjPKevr1VRlRhJUNWsrHEGEn7jkdzWBj+DpbCs=";
+    hash = "sha256-5AyatNXgHuia656OuSDozQzQv80bNHncgLN1X23bfM4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-Qp5zezXjVdOp8OylLgUZRLc0HQlgII6nOZodnOrok6U=";
+  cargoHash = "sha256-PQ1NxwNBaI48gQ4GGoricA/j7vpsnaLlL6st5P+CTHk=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/cy/cyclonedx-python/package.nix b/pkgs/by-name/cy/cyclonedx-python/package.nix
index d8d714846df9..6d1c1df42727 100644
--- a/pkgs/by-name/cy/cyclonedx-python/package.nix
+++ b/pkgs/by-name/cy/cyclonedx-python/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cyclonedx-python";
-  version = "7.1.0";
+  version = "7.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python";
     tag = "v${version}";
-    hash = "sha256-RHw+FYj1oYM5Yf8YcU8tOsxG+3qu0ti/AYzcGxYAp/8=";
+    hash = "sha256-4Mvt8l6kDT7GR4ufIelQd9rTt5ljdpMVWwRGZV5jIc8=";
   };
 
   build-system = with python3Packages; [ poetry-core ];
diff --git a/pkgs/by-name/de/deezer-enhanced/package.nix b/pkgs/by-name/de/deezer-enhanced/package.nix
index d5d581facd37..b8a2c484a56e 100644
--- a/pkgs/by-name/de/deezer-enhanced/package.nix
+++ b/pkgs/by-name/de/deezer-enhanced/package.nix
@@ -28,11 +28,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "deezer-enhanced";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchurl {
     url = "https://github.com/duzda/deezer-enhanced/releases/download/v${version}/deezer-enhanced_${version}_amd64.deb";
-    hash = "sha256-zHgrLzPByAPww0aSEDETsddX71O/GU80AZH729YjQQ0=";
+    hash = "sha256-/FEp9J+5YrwPIu6/zPqUYjYRSU1iHdoIRs7WJLQIu+8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/em/emmylua-check/package.nix b/pkgs/by-name/em/emmylua-check/package.nix
index 1074990e120d..7dbf104870d6 100644
--- a/pkgs/by-name/em/emmylua-check/package.nix
+++ b/pkgs/by-name/em/emmylua-check/package.nix
@@ -7,18 +7,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_check";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "EmmyLuaLs";
     repo = "emmylua-analyzer-rust";
     tag = finalAttrs.version;
-    hash = "sha256-UfsSsS+yXpWY1L2Wcgcj+JxS/LNr3BYhHq2JzUdxwqE=";
+    hash = "sha256-6mcVIOKsC+1cboZ8e23J0m2ed/2ohR0F3LfrM9UlaR4=";
   };
 
   buildAndTestSubdir = "crates/emmylua_check";
 
-  cargoHash = "sha256-rVTxAOQOngeJaP2SDfgeqOuoc2T8dEvlpe9gKfu5tas=";
+  cargoHash = "sha256-d6dhrib4mz7KmHo3EbkUXBPpjEGu35GeYNkpIrJrKJI=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/em/emmylua-ls/package.nix b/pkgs/by-name/em/emmylua-ls/package.nix
index 4c5c5fc7fe44..71fe171f0465 100644
--- a/pkgs/by-name/em/emmylua-ls/package.nix
+++ b/pkgs/by-name/em/emmylua-ls/package.nix
@@ -7,18 +7,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_ls";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "EmmyLuaLs";
     repo = "emmylua-analyzer-rust";
     tag = finalAttrs.version;
-    hash = "sha256-UfsSsS+yXpWY1L2Wcgcj+JxS/LNr3BYhHq2JzUdxwqE=";
+    hash = "sha256-6mcVIOKsC+1cboZ8e23J0m2ed/2ohR0F3LfrM9UlaR4=";
   };
 
   buildAndTestSubdir = "crates/emmylua_ls";
 
-  cargoHash = "sha256-rVTxAOQOngeJaP2SDfgeqOuoc2T8dEvlpe9gKfu5tas=";
+  cargoHash = "sha256-d6dhrib4mz7KmHo3EbkUXBPpjEGu35GeYNkpIrJrKJI=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/jj/jj-pre-push/package.nix b/pkgs/by-name/jj/jj-pre-push/package.nix
index 75055f7d62fc..e38527c20d8f 100644
--- a/pkgs/by-name/jj/jj-pre-push/package.nix
+++ b/pkgs/by-name/jj/jj-pre-push/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "jj-pre-push";
-  version = "0.2.2";
+  version = "0.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "acarapetis";
     repo = "jj-pre-push";
     tag = "v${version}";
-    hash = "sha256-SdGnhHk8MelX6hqKQmZnQYXBJ5VpjPBe+PWUxaGsxC4=";
+    hash = "sha256-nWkMXXlzJeXz0kHBuN4g8YWW6JmwrfE/y9oFfEOqeQk=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix
index 0983e5015dc1..c9ee2bbe0b7b 100644
--- a/pkgs/by-name/ke/keycloak/package.nix
+++ b/pkgs/by-name/ke/keycloak/package.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "keycloak";
-  version = "26.4.0";
+  version = "26.4.1";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-mWgTkvop5oRA3DzxxI3Q8kgftLZZteGeJ3Zxgh5SIww=";
+    hash = "sha256-TUTTBsxRuk907OLFxFyABuOGMaO7EjqnzD0eEQVfl98=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libui/darwin_versions.patch b/pkgs/by-name/li/libui/darwin_versions.patch
new file mode 100644
index 000000000000..29f646402919
--- /dev/null
+++ b/pkgs/by-name/li/libui/darwin_versions.patch
@@ -0,0 +1,11 @@
+--- a/meson.build
++++ b/meson.build
+@@ -163,7 +163,7 @@
+ 	objc_args: ['-Dlibui_EXPORTS'],
+ 	link_args: libui_libui_link_args,
+ 	soversion: libui_soversion,
+-	darwin_versions: [])		# TODO
++	darwin_versions: '0.0.0')		# TODO
+ install_headers('ui.h')
+ 
+ # TODO when the API is stable enough to be versioned, create a pkg-config file (https://mesonbuild.com/Pkgconfig-module.html) and a declare_dependency() section too
diff --git a/pkgs/by-name/li/libui/libui.pc b/pkgs/by-name/li/libui/libui.pc
deleted file mode 100644
index 42ee86fb550f..000000000000
--- a/pkgs/by-name/li/libui/libui.pc
+++ /dev/null
@@ -1,11 +0,0 @@
-prefix=@out@
-exec_prefix=${prefix}
-libdir=${exec_prefix}/lib
-includedir=${exec_prefix}/include
-
-Name: libui
-Description: Simple and portable (but not inflexible) GUI library
-Version: @version@
-
-Libs: -L${libdir} -lui
-Cflags: -I${includedir}
diff --git a/pkgs/by-name/li/libui/package.nix b/pkgs/by-name/li/libui/package.nix
index 5f5430a72fca..d7304ee37133 100644
--- a/pkgs/by-name/li/libui/package.nix
+++ b/pkgs/by-name/li/libui/package.nix
@@ -2,69 +2,48 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  cmake,
+  meson,
+  ninja,
   pkg-config,
   gtk3,
 }:
 
-let
-  backend = if stdenv.hostPlatform.isDarwin then "darwin" else "unix";
-in
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libui";
-  version = "4.1a";
+  version = "4.1a-unstable-2021-01-02";
+
   src = fetchFromGitHub {
     owner = "andlabs";
     repo = "libui";
-    rev = "alpha4.1";
-    sha256 = "0bm6xvqk4drg2kw6d304x6mlfal7gh8mbl5a9f0509smmdzgdkwm";
+    rev = "fea45b2d5b75839be0af9acc842a147c5cba9295";
+    hash = "sha256-BGbL15hBHY4aZE2ANAEd677vzZMQzMCICBafRtoQIvA=";
   };
 
   nativeBuildInputs = [
-    cmake
+    meson
+    ninja
     pkg-config
   ];
   propagatedBuildInputs = lib.optional stdenv.hostPlatform.isLinux gtk3;
 
+  patches = [
+    ./darwin_versions.patch
+    ./pkg-config.patch
+  ];
+
   postPatch = ''
+    substituteInPlace meson.build \
+      --subst-var-by version "${finalAttrs.version}"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace darwin/text.m unix/text.c \
       --replace-fail "strcasecmp" "g_strcasecmp"
   '';
 
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    sed -i 's/set(CMAKE_OSX_DEPLOYMENT_TARGET "10.8")//' ./CMakeLists.txt
-  '';
-
-  installPhase = ''
-    mkdir -p $out/{include,lib}
-    mkdir -p $out/lib/pkgconfig
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    mv ./out/libui.so.0 $out/lib/
-    ln -s $out/lib/libui.so.0 $out/lib/libui.so
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mv ./out/libui.A.dylib $out/lib/
-    ln -s $out/lib/libui.A.dylib $out/lib/libui.dylib
-  ''
-  + ''
-    cp $src/ui.h $out/include
-    cp $src/ui_${backend}.h $out/include
-
-    cp ${./libui.pc} $out/lib/pkgconfig/libui.pc
-    substituteInPlace $out/lib/pkgconfig/libui.pc \
-      --subst-var-by out $out \
-      --subst-var-by version "${version}"
-  '';
-  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    install_name_tool -id $out/lib/libui.A.dylib $out/lib/libui.A.dylib
-  '';
-
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/andlabs/libui";
     description = "Simple and portable (but not inflexible) GUI library in C that uses the native GUI technologies of each platform it supports";
-    license = licenses.mit;
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/li/libui/pkg-config.patch b/pkgs/by-name/li/libui/pkg-config.patch
new file mode 100644
index 000000000000..45569a388608
--- /dev/null
+++ b/pkgs/by-name/li/libui/pkg-config.patch
@@ -0,0 +1,15 @@
+--- a/meson.build
++++ b/meson.build
+@@ -167,6 +167,12 @@
+ install_headers('ui.h')
+ 
+ # TODO when the API is stable enough to be versioned, create a pkg-config file (https://mesonbuild.com/Pkgconfig-module.html) and a declare_dependency() section too
++pkg = import('pkgconfig')
++pkg.generate(libui_libui,
++	description: 'Simple and portable (but not inflexible) GUI library',
++	filebase: 'libui',
++	name: 'libui',
++	version: '@version@')
+ 
+ libui_binary_deps = []
+ if libui_mode == 'static'
diff --git a/pkgs/by-name/me/memray/package.nix b/pkgs/by-name/me/memray/package.nix
index 28bcc83c412d..f8b11cd05f9e 100644
--- a/pkgs/by-name/me/memray/package.nix
+++ b/pkgs/by-name/me/memray/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "memray";
-  version = "1.19.0";
+  version = "1.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bloomberg";
     repo = "memray";
     tag = "v${version}";
-    hash = "sha256-yOiN4KES+zCHp/n0pN73Yv6ibEtUGy1pqiH/3WECqkA=";
+    hash = "sha256-RdOtgNSkFIVl8Uve2iaJ7G0X1IHJ/Yo4h8hWP3pTV8g=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/mk/mkbrr/package.nix b/pkgs/by-name/mk/mkbrr/package.nix
index 381951185f1f..d2b5528b1c03 100644
--- a/pkgs/by-name/mk/mkbrr/package.nix
+++ b/pkgs/by-name/mk/mkbrr/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mkbrr";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "mkbrr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9BII74aH480UWjrPgoBn+ioXV3TRhtVmxyO+T+fljK4=";
+    hash = "sha256-LVSavGep3/mfDoDkj4uJ8WUTkhdeq+VEi2w7qr44DQg=";
   };
 
-  vendorHash = "sha256-MEDzZd67iXPY/MioMd1FcTLY+8CdJN7+oC7qus63yJ8=";
+  vendorHash = "sha256-mbcbACOKMohBw0SH5gH06CTkHtJk3WmbAqpcO0qMFOs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/nu/nuked-md/package.nix b/pkgs/by-name/nu/nuked-md/package.nix
index 41db685d2755..71af5135a9bd 100644
--- a/pkgs/by-name/nu/nuked-md/package.nix
+++ b/pkgs/by-name/nu/nuked-md/package.nix
@@ -41,7 +41,10 @@ stdenv.mkDerivation (finalAttrs: {
   #   FOUND.
   postPatch = ''
     substituteInPlace CMakeLists.txt \
-      --replace 'SDL2 REQUIRED' 'SDL2'
+      --replace 'SDL2 REQUIRED' 'SDL2' \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+    # CMake 3.0 is deprecated and is no longer supported by CMake > 4
+    # https://github.com/NixOS/nixpkgs/issues/445447
   '';
 
   strictDeps = true;
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index f9652fc9f53c..4f303a9d42d0 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -22,12 +22,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.15.4";
+  version = "0.15.8";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Td5kLiBO21nGSb0c7jmp08giOVbfPniNvQrOTclq664=";
+    hash = "sha256-6brfh6yTFGnhUo9kZ5VAcC1whhMPJYYwVIT7j6g+wkw=";
   };
 
   tui = buildGoModule {
@@ -111,10 +111,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     outputHash =
       {
-        x86_64-linux = "sha256-4O3zDd+beiNrIjHx+GXVo9zXW3YBNDVAqiONqq/Ury8=";
-        aarch64-linux = "sha256-4JoHpUL8AkT96VlG1vb9gA3SfqPaP3A26Vh6WgzJ6zA=";
-        x86_64-darwin = "sha256-6QSahMpCJz0dOTlj1V8ZBECilY7dXhbEDjLVSjGh/LE=";
-        aarch64-darwin = "sha256-HHW0rr656zrBcdT/owEcLv8ZRF3VUshW4gbfU84bTVI=";
+        x86_64-linux = "sha256-EfH8fBgP0zsKVu26BxFq1NCwWLG6vlOhDD/WQ7152hA=";
+        aarch64-linux = "sha256-Bwwe9PTYwEJvTLhB2+6yzC4pB2/1J/JGI8S1TSrdOuM=";
+        x86_64-darwin = "sha256-TBSBpuPE+V7oanEMW6F8PvCZSLqIokibsyO1NtbLQnM=";
+        aarch64-darwin = "sha256-+wUulok3OdJ0YewuyOkv5zbiC+3QzhokfT3aCdL5akk=";
       }
       .${stdenv.hostPlatform.system};
     outputHashAlgo = "sha256";
diff --git a/pkgs/by-name/pe/performous/package.nix b/pkgs/by-name/pe/performous/package.nix
index 48732279f298..aa7e045c64fd 100644
--- a/pkgs/by-name/pe/performous/package.nix
+++ b/pkgs/by-name/pe/performous/package.nix
@@ -55,12 +55,21 @@ stdenv.mkDerivation rec {
       url = "https://github.com/performous/performous/commit/eb9b97f46b7d064c32ed0f086d89a70427ce1d14.patch";
       hash = "sha256-98pcO/sFQJ+G67ErwlO/aAITNDPuRgPziQiF1cAlc0g=";
     })
+    # Fix build with CMake 4
+    (fetchpatch {
+      url = "https://github.com/performous/compact_enc_det/commit/28f46c18c60b851773b0ff61f3ce416fb09adcf3.patch?full_index=1";
+      stripLen = 1;
+      extraPrefix = "ced-src/";
+      hash = "sha256-23VD/4X4BOtcX5k+koSlRMowlbo2jAXbp3XKTXP7VrM=";
+    })
   ];
 
-  postPatch = ''
+  prePatch = ''
     mkdir ced-src
     cp -R ${cedSrc}/* ced-src
+  '';
 
+  postPatch = ''
     substituteInPlace data/CMakeLists.txt \
       --replace "/usr" "$out"
   '';
diff --git a/pkgs/by-name/pf/pffft/package.nix b/pkgs/by-name/pf/pffft/package.nix
index 6631385b9bf2..1679c076425d 100644
--- a/pkgs/by-name/pf/pffft/package.nix
+++ b/pkgs/by-name/pf/pffft/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "pffft";
-  version = "0-unstable-2022-04-10";
+  version = "0-unstable-2025-06-09";
 
   src = fetchFromGitHub {
     owner = "marton78";
     repo = "pffft";
-    rev = "08f5ed2618ac06d7dcc83d209d7253dc215274d5";
-    sha256 = "sha256-9LfLQ17IRsbEwGQJZzhW2Av4en1KuJVicLrS2AyjUZY=";
+    rev = "9ae907aae7a39c08cea398778b9496ba7484423a";
+    sha256 = "sha256-+efWiBrJzC188tDSPHMARRDArzx/4E8GYPMfDHAND8k=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ph/phpactor/package.nix b/pkgs/by-name/ph/phpactor/package.nix
index 96310ff421b7..6be056dd7b52 100644
--- a/pkgs/by-name/ph/phpactor/package.nix
+++ b/pkgs/by-name/ph/phpactor/package.nix
@@ -7,16 +7,16 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpactor";
-  version = "2025.07.25.0";
+  version = "2025.10.17.0";
 
   src = fetchFromGitHub {
     owner = "phpactor";
     repo = "phpactor";
     tag = finalAttrs.version;
-    hash = "sha256-9XWlWwq+xvqPgKIc7IGoMVTxajjYsrPo/ra/0JIE168=";
+    hash = "sha256-A/ajGQ75z/EdWFFJK0kLjcSFfa9z15TZCNZZpwq9k2E=";
   };
 
-  vendorHash = "sha256-91Yz78nh4r+Gr7gKSwelTdO436ehENVTPUWcnDaU7zg=";
+  vendorHash = "sha256-qLcwAmnkh3nxrvdDa/OI3RQOi/4qhxURhcXM1r5iE88=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pi/pipenv-poetry-migrate/package.nix b/pkgs/by-name/pi/pipenv-poetry-migrate/package.nix
index cac51b5f2f80..05a05d9ab39a 100644
--- a/pkgs/by-name/pi/pipenv-poetry-migrate/package.nix
+++ b/pkgs/by-name/pi/pipenv-poetry-migrate/package.nix
@@ -18,6 +18,10 @@ python3Packages.buildPythonApplication rec {
 
   build-system = [ python3Packages.poetry-core ];
 
+  pythonRelaxDeps = [
+    "typer"
+  ];
+
   dependencies = with python3Packages; [
     setuptools # for pkg_resources
     tomlkit
diff --git a/pkgs/by-name/pl/planarity/package.nix b/pkgs/by-name/pl/planarity/package.nix
index 9ecc15b994e5..a1d18bc8a476 100644
--- a/pkgs/by-name/pl/planarity/package.nix
+++ b/pkgs/by-name/pl/planarity/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planarity";
-  version = "4.0.0.0";
+  version = "4.0.1.0";
 
   src = fetchFromGitHub {
     owner = "graph-algorithms";
     repo = "edge-addition-planarity-suite";
     rev = "Version_${version}";
-    sha256 = "sha256-A7huHvMgUyvw2zM9qA7Ax/1Ai5VZ6A1PZIo3eiCpu44=";
+    sha256 = "sha256-uSCQSn3LRi3eQynh71fs1xhVIrPcOqVyGzdHAK9xj7E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index 8af5940becd8..d4967897caaf 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -33,7 +33,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus";
-  version = "3.6.0";
+  version = "3.7.1";
 
   outputs = [
     "out"
@@ -45,14 +45,14 @@ buildGoModule (finalAttrs: {
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GowtA1iTx6lpRW+RBLYFc8s5H8ECPEmcbdVJvGHl5Cw=";
+    hash = "sha256-m5dQoEn/989gmG5Q4A/oCY6JKvOLzpAU8kaPQOsajlA=";
   };
 
-  vendorHash = "sha256-xGMBd/MhwjCbrQrP5d5aSd99F8GN6wB3jaHpOh0M7OA=";
+  vendorHash = "sha256-V+qLxjqGOaT1veEwtklqcS7iO31ufvDHBA9DbZLzDiE=";
 
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-lw097NTDJUWm2RY0RUg/5djNdbj+W9hRdIaF2cQz4Bo=";
+    hash = "sha256-88PNQfVM9le+2mqMBq9tyyZ+1J+yloWWIE4VJHSCS1g=";
   };
 
   excludedPackages = [
diff --git a/pkgs/by-name/pv/pv/package.nix b/pkgs/by-name/pv/pv/package.nix
index 574e3a5db27b..b612e525a7e8 100644
--- a/pkgs/by-name/pv/pv/package.nix
+++ b/pkgs/by-name/pv/pv/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pv";
-  version = "1.9.42";
+  version = "1.9.44";
 
   src = fetchurl {
     url = "https://www.ivarch.com/programs/sources/pv-${finalAttrs.version}.tar.gz";
-    hash = "sha256-+9fRsE7+5iyCQSVaP+HF9SNvGm4e2F8CcwsMZEiBAXU=";
+    hash = "sha256-4TDJ4Ysebp4u+VvsYRfHLLm+J6G4/+l/ynh+TI4BRWI=";
   };
 
   meta = {
diff --git a/pkgs/by-name/rb/rbspy/package.nix b/pkgs/by-name/rb/rbspy/package.nix
index 800990798430..69851711c9fc 100644
--- a/pkgs/by-name/rb/rbspy/package.nix
+++ b/pkgs/by-name/rb/rbspy/package.nix
@@ -8,23 +8,18 @@
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rbspy";
-  version = "0.34.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "rbspy";
     repo = "rbspy";
-    tag = "v${version}";
-    hash = "sha256-yVcVuMCyvk9RbkbKomqjkLY+p5tUzW2zcAKZ8XfsjM0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6pQoCPwrIKaEUYgaHNgFLz+bY4p+ImlhZ2l2vehA4Ic=";
   };
 
-  cargoHash = "sha256-WiIHFwB6BE9VYuC2dCHNnrEFjVsesp0c5i4bH01cXis=";
-
-  # error: linker `aarch64-linux-gnu-gcc` not found
-  postPatch = ''
-    rm .cargo/config
-  '';
+  cargoHash = "sha256-6Q1ebXEknP3qEiU5qMXhHykRwahMZEVXGJGE4EToohA=";
 
   doCheck = true;
 
@@ -32,11 +27,11 @@ rustPlatform.buildRustPackage rec {
   # from nixpkgs during tests.
   preCheck = ''
     substituteInPlace src/core/process.rs \
-      --replace /usr/bin/which '${which}/bin/which'
+      --replace-fail "/usr/bin/which" "${lib.getExe which}"
     substituteInPlace src/sampler/mod.rs \
-      --replace /usr/bin/which '${which}/bin/which'
+      --replace-fail "/usr/bin/which" "${lib.getExe which}"
     substituteInPlace src/core/ruby_spy.rs \
-      --replace /usr/bin/ruby '${ruby}/bin/ruby'
+      --replace-fail "/usr/bin/ruby" "${lib.getExe ruby}"
   '';
 
   checkFlags = [
@@ -60,9 +55,9 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://rbspy.github.io/";
     description = "Sampling CPU Profiler for Ruby";
     mainProgram = "rbspy";
-    changelog = "https://github.com/rbspy/rbspy/releases/tag/v${version}";
+    changelog = "https://github.com/rbspy/rbspy/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ viraptor ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
-}
+})
diff --git a/pkgs/by-name/re/restate/package.nix b/pkgs/by-name/re/restate/package.nix
index 1f147e49da4d..dbdc2eca0ece 100644
--- a/pkgs/by-name/re/restate/package.nix
+++ b/pkgs/by-name/re/restate/package.nix
@@ -25,16 +25,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "restate";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "restatedev";
     repo = "restate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NMT1/Oy0EmAtGqHMK3FL/MZczKz//hXkpKWhQ4S3tLw=";
+    hash = "sha256-lLZuzjx/DKr00GWPTkSncGT2j9M/xUU84Alxqia8IvQ=";
   };
 
-  cargoHash = "sha256-M7p20eeaxijlGjYBAAwmK4y/58eo7NysoK+Gvs86SNo=";
+  cargoHash = "sha256-2z0RcttfwbhehS8k4vu5d1Np0pRWSCIeQk8paH7hJuY=";
 
   env = {
     PROTOC = lib.getExe protobuf;
diff --git a/pkgs/by-name/sh/shark/package.nix b/pkgs/by-name/sh/shark/package.nix
index f5541bf01a8f..354cfb85b646 100644
--- a/pkgs/by-name/sh/shark/package.nix
+++ b/pkgs/by-name/sh/shark/package.nix
@@ -26,6 +26,9 @@ stdenv.mkDerivation (finalAttrs: {
   # Remove explicitly setting C++11, because boost::math headers need C++14 since Boost187.
   postPatch = ''
     sed -i '/CXX_STANDARD/d' src/CMakeLists.txt
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'cmake_minimum_required( VERSION 3.1 FATAL_ERROR)' 'cmake_minimum_required(VERSION 3.10)'
   '';
 
   # https://gitlab.orfeo-toolbox.org/orfeotoolbox/otb/-/blob/develop/SuperBuild/CMake/External_shark.cmake?ref_type=heads
diff --git a/pkgs/by-name/st/stunnel/package.nix b/pkgs/by-name/st/stunnel/package.nix
index 2a5c7722534e..cc8fafd940c8 100644
--- a/pkgs/by-name/st/stunnel/package.nix
+++ b/pkgs/by-name/st/stunnel/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stunnel";
-  version = "5.75";
+  version = "5.76";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.stunnel.org/archive/${lib.versions.major finalAttrs.version}.x/stunnel-${finalAttrs.version}.tar.gz";
-    hash = "sha256-DB7w7YUkCXTcy5T+dPuS1jg0dMfA0Q6HltH3gaO6VoM=";
+    hash = "sha256-zaN+tND7HhKXGO0nrXe1c16Jk5TOBAuyvii7uTf9eeE=";
     # please use the contents of "https://www.stunnel.org/downloads/stunnel-${version}.tar.gz.sha256",
     # not the output of `nix-prefetch-url`
   };
diff --git a/pkgs/by-name/vn/vnote/package.nix b/pkgs/by-name/vn/vnote/package.nix
index 8827834ec375..8862db31ead7 100644
--- a/pkgs/by-name/vn/vnote/package.nix
+++ b/pkgs/by-name/vn/vnote/package.nix
@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vnote";
-  version = "3.19.2";
+  version = "3.19.2-unstable-2025-10-12";
 
   src = fetchFromGitHub {
     owner = "vnotex";
     repo = "vnote";
-    tag = "v${finalAttrs.version}";
+    rev = "1ebe3fd4ecef69c2bacb7f2ec915666f99195ce1";
     fetchSubmodules = true;
-    hash = "sha256-40k0wSqRdwlUqrbb9mDK0dqsSEqCfbNLt+cUKeky+do=";
+    hash = "sha256-vbud2IjmkIIkuZ7ocrQ199CEsKy1nMnidGe/d0UN9jU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/haskell-modules/hoogle.nix b/pkgs/development/haskell-modules/hoogle.nix
index fb5d8bcb7dae..7d2e3517f979 100644
--- a/pkgs/development/haskell-modules/hoogle.nix
+++ b/pkgs/development/haskell-modules/hoogle.nix
@@ -9,6 +9,7 @@
   haskellPackages,
   writeText,
   runCommand,
+  nixosTests,
 }:
 
 # This argument is a function which selects a list of Haskell packages from any
@@ -137,6 +138,8 @@ buildPackages.stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
+  passthru.tests.nixos = nixosTests.hoogle;
+
   meta = {
     description = "Local Hoogle database";
     platforms = ghc.meta.platforms;
diff --git a/pkgs/development/libraries/liblastfm/default.nix b/pkgs/development/libraries/liblastfm/default.nix
index 7530d998e51e..5eba0b261380 100644
--- a/pkgs/development/libraries/liblastfm/default.nix
+++ b/pkgs/development/libraries/liblastfm/default.nix
@@ -30,6 +30,14 @@ stdenv.mkDerivation {
     })
   ];
 
+  # CMake 2.8.6 is deprecated and no longer supported by CMake > 4
+  # https://github.com/NixOS/nixpkgs/issues/445447
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "cmake_minimum_required(VERSION 2.8.6)" \
+      "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   nativeBuildInputs = [
     pkg-config
     which
@@ -41,9 +49,9 @@ stdenv.mkDerivation {
     qtbase
   ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (
-    stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11"
-  ) "-std=c++11";
+  env.NIX_CFLAGS_COMPILE =
+    (lib.optionalString (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") "-std=c++11")
+    + (lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-dynamic-exception-spec");
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/libraries/qjson/default.nix b/pkgs/development/libraries/qjson/default.nix
index 4edb927e2213..2ac2bb4ff56a 100644
--- a/pkgs/development/libraries/qjson/default.nix
+++ b/pkgs/development/libraries/qjson/default.nix
@@ -17,6 +17,19 @@ stdenv.mkDerivation rec {
     sha256 = "1f4wnxzx0qdmxzc7hqk28m0sva7z9p9xmxm6aifvjlp0ha6pmfxs";
   };
 
+  # CMake 2.8.8 is deprecated and no longer supported by CMake > 4
+  # https://github.com/NixOS/nixpkgs/issues/445447
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "CMAKE_MINIMUM_REQUIRED(VERSION 2.8.8)" \
+      "CMAKE_MINIMUM_REQUIRED(VERSION 3.10)"
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "cmake_policy(SET CMP0020 OLD)" \
+      ""
+  '';
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-register";
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ qtbase ];
   dontWrapQtApps = true;
diff --git a/pkgs/development/python-modules/aiostream/default.nix b/pkgs/development/python-modules/aiostream/default.nix
index de2b2fec0067..67466c7e685f 100644
--- a/pkgs/development/python-modules/aiostream/default.nix
+++ b/pkgs/development/python-modules/aiostream/default.nix
@@ -5,23 +5,20 @@
   pytest-asyncio,
   pytest-cov-stub,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "aiostream";
-  version = "0.7.0";
+  version = "0.7.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "vxgmichel";
     repo = "aiostream";
     tag = "v${version}";
-    hash = "sha256-oOx1LG3UyMJRm/HvmrHT00jTp3+XzmvS2XRH4BJNyPE=";
+    hash = "sha256-AxisfmFZMEFJ/zfYCTfelvUGIoz56w6dKoZAMDKOZzk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aioswitcher/default.nix b/pkgs/development/python-modules/aioswitcher/default.nix
index f51a899af510..38b2ed9b105c 100644
--- a/pkgs/development/python-modules/aioswitcher/default.nix
+++ b/pkgs/development/python-modules/aioswitcher/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aioswitcher";
-  version = "6.0.2";
+  version = "6.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "TomerFi";
     repo = "aioswitcher";
     tag = version;
-    hash = "sha256-DtTrfwT8Xvw5byWzTGpO/o2PI7/4Zt++xgKVnNMwA1k=";
+    hash = "sha256-6wBeAbBiuAZW9kHq/bKC0FMJxkLxM6RZN7RLwbF1ig4=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/asyncpraw/default.nix b/pkgs/development/python-modules/asyncpraw/default.nix
index 0126f99cc91e..299b4a384752 100644
--- a/pkgs/development/python-modules/asyncpraw/default.nix
+++ b/pkgs/development/python-modules/asyncpraw/default.nix
@@ -2,57 +2,52 @@
   lib,
   aiofiles,
   aiohttp,
-  aiosqlite,
   asyncprawcore,
   buildPythonPackage,
+  coverage,
+  defusedxml,
   fetchFromGitHub,
-  flit-core,
-  mock,
+  hatchling,
   pytestCheckHook,
-  pytest-asyncio_0,
+  pytest-asyncio,
   pytest-vcr,
-  pythonOlder,
-  requests-toolbelt,
   update-checker,
   vcrpy,
 }:
 
 buildPythonPackage rec {
   pname = "asyncpraw";
-  version = "7.8.1";
+  version = "7.8.1-unstable-2025-10-08";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "praw-dev";
     repo = "asyncpraw";
-    tag = "v${version}";
-    hash = "sha256-glWAQoUjMFbjU3C4+MGuRGSGJS9mun15+6udMPCf9nU=";
+    rev = "9221cbef5d94fce9ecc92376cbab084f0082502d";
+    hash = "sha256-/7x7XYw1JDVaoc2+wKWW3iUkyfI6MVtBNP9G1AEUp4Y=";
   };
 
-  pythonRelaxDeps = [ "aiosqlite" ];
+  pythonRelaxDeps = [
+    "coverage"
+    "defusedxml"
+  ];
 
-  # 'aiosqlite' is also checked when building the wheel
-  pypaBuildFlags = [ "--skip-dependency-check" ];
-
-  build-system = [ flit-core ];
+  build-system = [ hatchling ];
 
   dependencies = [
     aiofiles
     aiohttp
-    aiosqlite
     asyncprawcore
-    mock
+    coverage
+    defusedxml
     update-checker
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    pytest-asyncio_0
+    pytest-asyncio
     pytest-vcr
     vcrpy
-    requests-toolbelt
   ];
 
   disabledTestPaths = [
@@ -70,7 +65,7 @@ buildPythonPackage rec {
   meta = {
     description = "Asynchronous Python Reddit API Wrapper";
     homepage = "https://asyncpraw.readthedocs.io/";
-    changelog = "https://github.com/praw-dev/asyncpraw/blob/v${version}/CHANGES.rst";
+    changelog = "https://github.com/praw-dev/asyncpraw/blob/${src.rev}/CHANGES.rst";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.amadejkastelic ];
   };
diff --git a/pkgs/development/python-modules/asyncprawcore/default.nix b/pkgs/development/python-modules/asyncprawcore/default.nix
index bc8c34f86a01..b6a34a6a2b9a 100644
--- a/pkgs/development/python-modules/asyncprawcore/default.nix
+++ b/pkgs/development/python-modules/asyncprawcore/default.nix
@@ -4,43 +4,35 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
-  mock,
   pytestCheckHook,
-  pytest-asyncio_0,
+  pytest-asyncio,
   pytest-vcr,
-  requests,
-  requests-toolbelt,
-  testfixtures,
   vcrpy,
   yarl,
 }:
 
 buildPythonPackage rec {
   pname = "asyncprawcore";
-  version = "2.4.0";
+  version = "3.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "praw-dev";
     repo = "asyncprawcore";
     tag = "v${version}";
-    hash = "sha256-FDQdtnNjsbiEp9BUYdQFMC/hkyJDhCh2WHhQWSQwrFY=";
+    hash = "sha256-0FOMY/0LXGcHwDe4t+NMAovMhX83/mMv8sWvIf5gxok=";
   };
 
   build-system = [ flit-core ];
 
   dependencies = [
-    requests
     aiohttp
     yarl
   ];
 
   nativeCheckInputs = [
-    testfixtures
-    mock
-    requests-toolbelt
     pytestCheckHook
-    pytest-asyncio_0
+    pytest-asyncio
     pytest-vcr
     vcrpy
   ];
@@ -51,6 +43,11 @@ buildPythonPackage rec {
     "tests/integration/test_sessions.py"
   ];
 
+  disabledTests = [
+    # Test requires network access
+    "test_initialize"
+  ];
+
   pythonImportsCheck = [ "asyncprawcore" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/binsync/default.nix b/pkgs/development/python-modules/binsync/default.nix
index d52a0eac53e5..90d6b92443e7 100644
--- a/pkgs/development/python-modules/binsync/default.nix
+++ b/pkgs/development/python-modules/binsync/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "binsync";
-  version = "5.7.10";
+  version = "5.7.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "binsync";
     repo = "binsync";
     tag = "v${version}";
-    hash = "sha256-QDOfbo2yjfjLsLILMhl/ckKwXDusXfE8+YmFpW5djN0=";
+    hash = "sha256-Rn5ytC7j8HI64NQhvV4QjjBWDeYNkINJGUWDmZ7nQ3w=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/habiticalib/default.nix b/pkgs/development/python-modules/habiticalib/default.nix
index 420c4b7a5f5f..f4093c11ac3a 100644
--- a/pkgs/development/python-modules/habiticalib/default.nix
+++ b/pkgs/development/python-modules/habiticalib/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "habiticalib";
-  version = "0.4.5";
+  version = "0.4.6";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "tr4nt0r";
     repo = "habiticalib";
     tag = "v${version}";
-    hash = "sha256-9IMC4MkL5hRCDjeuSuLBcn986LmO/zz32NV0RGTEf1M=";
+    hash = "sha256-Z3VJ0AaB4HeCOffV5B2WFIvGJXoCn1isNPMnERoUrp0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 22acb6f48d67..f1ba73092291 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202510181";
+  version = "0.1.202510191";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-C9wTZ5cBs7vzAnesEVj8blHoKd7pzYIbMeNGbO6q9lM=";
+    hash = "sha256-sMKlZGaEkzoOhpAOsKBqSUDRe6j7iL2sBivABSCAEA8=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/jupyterhub/default.nix b/pkgs/development/python-modules/jupyterhub/default.nix
index 2494b0efb675..99dd4133d88b 100644
--- a/pkgs/development/python-modules/jupyterhub/default.nix
+++ b/pkgs/development/python-modules/jupyterhub/default.nix
@@ -51,14 +51,14 @@
 
 buildPythonPackage rec {
   pname = "jupyterhub";
-  version = "5.4.0";
+  version = "5.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyterhub";
     repo = "jupyterhub";
-    rev = "refs/tags/${version}";
-    hash = "sha256-OCrEmNwWhOMJE/uTDUyEZzJlWqyzNp6CnvDsOg5hZkU=";
+    tag = version;
+    hash = "sha256-8hClknn0GfXbfXEzoYnb6qCXby7MU6BUDVoAG80UgNA=";
   };
 
   npmDeps = fetchNpmDeps {
diff --git a/pkgs/development/python-modules/mdformat-footnote/default.nix b/pkgs/development/python-modules/mdformat-footnote/default.nix
index 47f7dfe3e1f7..2c153dc363d8 100644
--- a/pkgs/development/python-modules/mdformat-footnote/default.nix
+++ b/pkgs/development/python-modules/mdformat-footnote/default.nix
@@ -5,21 +5,18 @@
   flit-core,
   mdformat,
   mdit-py-plugins,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "mdformat-footnote";
-  version = "0.1.1";
+  version = "0.1.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "executablebooks";
     repo = "mdformat-footnote";
     tag = "v${version}";
-    hash = "sha256-DUCBWcmB5i6/HkqxjlU3aTRO7i0n2sj+e/doKB8ffeo=";
+    hash = "sha256-JVxztVcp60LynacPw8tBrmSfe6Ool8zyK+aYwaKhyiA=";
   };
 
   nativeBuildInputs = [ flit-core ];
@@ -34,6 +31,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Footnote format addition for mdformat";
     homepage = "https://github.com/executablebooks/mdformat-footnote";
+    changelog = "https://github.com/executablebooks/mdformat-footnote/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ aldoborrero ];
   };
diff --git a/pkgs/development/python-modules/precis-i18n/default.nix b/pkgs/development/python-modules/precis-i18n/default.nix
index 0f86be974e55..7bc8741fa8c5 100644
--- a/pkgs/development/python-modules/precis-i18n/default.nix
+++ b/pkgs/development/python-modules/precis-i18n/default.nix
@@ -2,29 +2,29 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "precis-i18n";
-  version = "1.1.1";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  version = "1.1.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "byllyfish";
     repo = "precis_i18n";
     tag = "v${version}";
-    hash = "sha256-rtg3u8lnnmQFPsNC52LNVoEVu6CeHzAWvOjWBlzLKC4=";
+    hash = "sha256-ZMj9KqiPVrpmq4/FweLMDxWQVQEtykimNhMTS9Mh5QY=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "precis_i18n" ];
 
   meta = with lib; {
     description = "Internationalized usernames and passwords";
     homepage = "https://github.com/byllyfish/precis_i18n";
-    changelog = "https://github.com/byllyfish/precis_i18n/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/byllyfish/precis_i18n/blob/${src.tag}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index ad1678c41c1d..f742fa99ab3c 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -9,13 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.102";
+  version = "0.2.103";
   pyproject = true;
 
   src = fetchPypi {
-    pname = "pyExploitDb";
-    inherit version;
-    hash = "sha256-vkqKouvVu+qDcFGODvZuPzhcRVEQRsCa6lqRLekZThw=";
+    inherit pname version;
+    hash = "sha256-UAR3S0Tpo1C6a8YcNjoncPWEklwCsSC+T8E5s5rgaw8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/reflex-hosting-cli/default.nix b/pkgs/development/python-modules/reflex-hosting-cli/default.nix
index 5eaebbeb793b..5bbdedf73e80 100644
--- a/pkgs/development/python-modules/reflex-hosting-cli/default.nix
+++ b/pkgs/development/python-modules/reflex-hosting-cli/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "reflex-hosting-cli";
-  version = "0.1.56";
+  version = "0.1.57";
   pyproject = true;
 
   # source is not published https://github.com/reflex-dev/reflex/issues/3762
   src = fetchPypi {
     pname = "reflex_hosting_cli";
     inherit version;
-    hash = "sha256-spuwor7g7lmsTxx77sxyfpFMPAq3P8SlNqWzPCN/QLc=";
+    hash = "sha256-We51f2pHqC4bR7ofKVVRqNZ++S3x3NAz9Zz8l9S/5wY=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/resend/default.nix b/pkgs/development/python-modules/resend/default.nix
index f34684b9ca4e..6da9d8eb5a74 100644
--- a/pkgs/development/python-modules/resend/default.nix
+++ b/pkgs/development/python-modules/resend/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "resend";
-  version = "2.16.0";
+  version = "2.17.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "resend";
     repo = "resend-python";
     tag = "v${version}";
-    hash = "sha256-BXvy/6LaCQ+fyL6ubWZqIXn/IueE3IEhP07n2oT4cZQ=";
+    hash = "sha256-eR75CDYWBdPzCJ6lFANpxH6IdfZHBJf95RdnWLBfyX0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ssh-python/default.nix b/pkgs/development/python-modules/ssh-python/default.nix
index 2704600d0900..02c957dd2f54 100644
--- a/pkgs/development/python-modules/ssh-python/default.nix
+++ b/pkgs/development/python-modules/ssh-python/default.nix
@@ -11,20 +11,20 @@
 
 buildPythonPackage rec {
   pname = "ssh-python";
-  version = "1.1.1";
-  format = "setuptools";
+  version = "1.2.0.post1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ParallelSSH";
     repo = "ssh-python";
     tag = version;
-    hash = "sha256-kidz4uHT5C8TUROLGQUHihemYtwOoWZQNw7ElbwYKLM=";
+    hash = "sha256-ix6UzyC/mFDVOvfJujwppijmsTrwNtuDAkmikrKKc2o=";
   };
 
   build-system = [ setuptools ];
-  nativeBuildInputs = [
-    cython
-  ];
+
+  nativeBuildInputs = [ cython ];
+
   buildInputs = [
     openssl
     zlib
diff --git a/pkgs/development/python-modules/svg-py/default.nix b/pkgs/development/python-modules/svg-py/default.nix
index f596899bdf75..cf0eb5e1d005 100644
--- a/pkgs/development/python-modules/svg-py/default.nix
+++ b/pkgs/development/python-modules/svg-py/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "svg-py";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "orsinium-labs";
     repo = "svg.py";
     tag = version;
-    hash = "sha256-ILnPviXUHJrdeT6VTUYAZog3zY0tVA+13ddf8yVRYqE=";
+    hash = "sha256-m/ZiEMwoopQiiHeOT27pM9sx4BCVWSK0VV792YGjDlE=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
index 08630cb90c67..41501959d4fa 100644
--- a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
+++ b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "whirlpool-sixth-sense";
-  version = "0.21.3";
+  version = "1.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "abmantis";
     repo = "whirlpool-sixth-sense";
     tag = version;
-    hash = "sha256-ZZrLqHn/O+Z2XtiCIco5PMEprbi9XeJOBXcEdjTDPDc=";
+    hash = "sha256-Xgz9SqH++pWZb7r1qxOrEEfC7I80qhrqcI0Zlduxlq4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/x-transformers/default.nix b/pkgs/development/python-modules/x-transformers/default.nix
index e77bdded50d5..74ed3730a9ec 100644
--- a/pkgs/development/python-modules/x-transformers/default.nix
+++ b/pkgs/development/python-modules/x-transformers/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "x-transformers";
-  version = "2.8.4";
+  version = "2.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lucidrains";
     repo = "x-transformers";
     tag = version;
-    hash = "sha256-EmZW57xWt62RTOGZ7vYE2YcyUqx1vldsb2874XR9UOo=";
+    hash = "sha256-JxIcEGR28VxsosKsEFLpttT9JMeGwcJxjZiDXRhTv/o=";
   };
 
   build-system = [ hatchling ];
@@ -46,9 +46,10 @@ buildPythonPackage rec {
   meta = {
     description = "Concise but fully-featured transformer";
     longDescription = ''
-      A simple but complete full-attention transformer with a set of promising experimental features from various papers
+      A simple but complete full-attention transformer with a set of promising experimental features from various papers.
     '';
     homepage = "https://github.com/lucidrains/x-transformers";
+    changelog = "https://github.com/lucidrains/x-transformers/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ByteSudoer ];
   };
diff --git a/pkgs/development/tools/parsing/antlr/4.10.runtime.cpp.cmake.patch b/pkgs/development/tools/parsing/antlr/4.10.runtime.cpp.cmake.patch
new file mode 100644
index 000000000000..9dcb2aeb7833
--- /dev/null
+++ b/pkgs/development/tools/parsing/antlr/4.10.runtime.cpp.cmake.patch
@@ -0,0 +1,20 @@
+diff --git a/runtime/Cpp/CMakeLists.txt b/runtime/Cpp/CMakeLists.txt
+index 302cd4a78..336a37bf0 100644
+--- a/runtime/Cpp/CMakeLists.txt
++++ b/runtime/Cpp/CMakeLists.txt
+@@ -30,15 +30,10 @@ project(LIBANTLR4)
+ if(CMAKE_VERSION VERSION_EQUAL "3.0.0" OR
+    CMAKE_VERSION VERSION_GREATER "3.0.0")
+   CMAKE_POLICY(SET CMP0026 NEW)
+-  CMAKE_POLICY(SET CMP0054 OLD)
+-  CMAKE_POLICY(SET CMP0045 OLD)
+-  CMAKE_POLICY(SET CMP0042 OLD)
+ endif()
+ 
+ if(CMAKE_VERSION VERSION_EQUAL "3.3.0" OR
+    CMAKE_VERSION VERSION_GREATER "3.3.0")
+-  CMAKE_POLICY(SET CMP0059 OLD)
+-  CMAKE_POLICY(SET CMP0054 OLD)
+ endif()
+ 
+ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
diff --git a/pkgs/development/tools/parsing/antlr/4.11.runtime.cpp.cmake.patch b/pkgs/development/tools/parsing/antlr/4.11.runtime.cpp.cmake.patch
new file mode 100644
index 000000000000..6c40a1bf9633
--- /dev/null
+++ b/pkgs/development/tools/parsing/antlr/4.11.runtime.cpp.cmake.patch
@@ -0,0 +1,20 @@
+diff --git a/runtime/Cpp/CMakeLists.txt b/runtime/Cpp/CMakeLists.txt
+index df621b11d..c20b92170 100644
+--- a/runtime/Cpp/CMakeLists.txt
++++ b/runtime/Cpp/CMakeLists.txt
+@@ -39,15 +39,10 @@ project(LIBANTLR4)
+ if(CMAKE_VERSION VERSION_EQUAL "3.0.0" OR
+    CMAKE_VERSION VERSION_GREATER "3.0.0")
+   CMAKE_POLICY(SET CMP0026 NEW)
+-  CMAKE_POLICY(SET CMP0054 OLD)
+-  CMAKE_POLICY(SET CMP0045 OLD)
+-  CMAKE_POLICY(SET CMP0042 OLD)
+ endif()
+ 
+ if(CMAKE_VERSION VERSION_EQUAL "3.3.0" OR
+    CMAKE_VERSION VERSION_GREATER "3.3.0")
+-  CMAKE_POLICY(SET CMP0059 OLD)
+-  CMAKE_POLICY(SET CMP0054 OLD)
+ endif()
+ 
+ if(APPLE)
diff --git a/pkgs/development/tools/parsing/antlr/4.9.runtime.cpp.cmake.patch b/pkgs/development/tools/parsing/antlr/4.9.runtime.cpp.cmake.patch
new file mode 100644
index 000000000000..979e224756e6
--- /dev/null
+++ b/pkgs/development/tools/parsing/antlr/4.9.runtime.cpp.cmake.patch
@@ -0,0 +1,20 @@
+diff --git a/runtime/Cpp/CMakeLists.txt b/runtime/Cpp/CMakeLists.txt
+index e549f113f..c84f591c2 100644
+--- a/runtime/Cpp/CMakeLists.txt
++++ b/runtime/Cpp/CMakeLists.txt
+@@ -28,15 +28,10 @@ project(LIBANTLR4)
+ if(CMAKE_VERSION VERSION_EQUAL "3.0.0" OR
+    CMAKE_VERSION VERSION_GREATER "3.0.0")
+   CMAKE_POLICY(SET CMP0026 NEW)
+-  CMAKE_POLICY(SET CMP0054 OLD)
+-  CMAKE_POLICY(SET CMP0045 OLD)
+-  CMAKE_POLICY(SET CMP0042 OLD)
+ endif()
+ 
+ if(CMAKE_VERSION VERSION_EQUAL "3.3.0" OR
+    CMAKE_VERSION VERSION_GREATER "3.3.0")
+-  CMAKE_POLICY(SET CMP0059 OLD)
+-  CMAKE_POLICY(SET CMP0054 OLD)
+ endif()
+ 
+ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
diff --git a/pkgs/development/tools/parsing/antlr/4.nix b/pkgs/development/tools/parsing/antlr/4.nix
index c30d235c4f8e..6398c8eed341 100644
--- a/pkgs/development/tools/parsing/antlr/4.nix
+++ b/pkgs/development/tools/parsing/antlr/4.nix
@@ -172,6 +172,9 @@ in
         # not available in a sandboxed build.
         (lib.cmakeBool "ANTLR_BUILD_CPP_TESTS" false)
       ];
+      extraPatches = [
+        ./4.11.runtime.cpp.cmake.patch
+      ];
     }).antlr;
 
   antlr4_10 =
@@ -184,6 +187,9 @@ in
         (lib.cmakeBool "ANTLR4_INSTALL" true)
         (lib.cmakeBool "ANTLR_BUILD_CPP_TESTS" false)
       ];
+      extraPatches = [
+        ./4.10.runtime.cpp.cmake.patch
+      ];
     }).antlr;
 
   antlr4_9 =
@@ -194,9 +200,11 @@ in
       extraCppBuildInputs = [ utf8cpp ] ++ lib.optional stdenv.hostPlatform.isLinux libuuid;
       extraCppCmakeFlags = [
         (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-I${lib.getDev utf8cpp}/include/utf8cpp")
+        (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
       ];
       extraPatches = [
         ./utf8cpp.patch
+        ./4.9.runtime.cpp.cmake.patch
       ];
     }).antlr;
 
diff --git a/pkgs/tools/backup/percona-xtrabackup/8_0.nix b/pkgs/tools/backup/percona-xtrabackup/8_0.nix
index fe335b852064..5136aed309df 100644
--- a/pkgs/tools/backup/percona-xtrabackup/8_0.nix
+++ b/pkgs/tools/backup/percona-xtrabackup/8_0.nix
@@ -3,8 +3,8 @@
 callPackage ./generic.nix (
   args
   // {
-    version = "8.0.35-32";
-    hash = "sha256-aNnAlhhzZ6636dzOz4FFDEE4Mb450HGU42cJrM21GdQ=";
+    version = "8.0.35-34";
+    hash = "sha256-DqjDBLSQqlWazWJjdb+n7RwqSe/OMlZI2ca/JNTX2W8=";
 
     # includes https://github.com/Percona-Lab/libkmip.git
     fetchSubmodules = true;
@@ -12,9 +12,5 @@ callPackage ./generic.nix (
     extraPatches = [
       ./abi-check.patch
     ];
-
-    extraPostInstall = ''
-      rm -r "$out"/docs
-    '';
   }
 )
diff --git a/pkgs/tools/backup/percona-xtrabackup/8_4.nix b/pkgs/tools/backup/percona-xtrabackup/8_4.nix
index 82f2ab5ea95d..dbbe364f802c 100644
--- a/pkgs/tools/backup/percona-xtrabackup/8_4.nix
+++ b/pkgs/tools/backup/percona-xtrabackup/8_4.nix
@@ -3,8 +3,8 @@
 callPackage ./generic.nix (
   args
   // {
-    version = "8.4.0-2";
-    hash = "sha256-ClW/B175z/sxF/MT9iHW1Wtr0ere63tIgUpcMp1IfTs=";
+    version = "8.4.0-4";
+    hash = "sha256-ws+si8bpalL8y7l9W+R4B02GnnGOou50txtS6ktntP4=";
 
     # includes https://github.com/Percona-Lab/libkmip.git
     fetchSubmodules = true;