diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 9e1eea6eeab8..51f77d19229b 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -19,7 +19,9 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- `uptime-kuma` has been updated to v2, which requires an automated migration that can take a few hours. **A backup is highly recommended.**
+  If your SQLite database is corrupted, the migration might fail and require [manual intervention](https://github.com/louislam/uptime-kuma/issues/5281).
+  See the [migration guide](https://github.com/louislam/uptime-kuma/wiki/Migration-From-v1-To-v2) for more information.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}
 
diff --git a/lib/asserts.nix b/lib/asserts.nix
index c93254084b83..ce9dea76bbce 100644
--- a/lib/asserts.nix
+++ b/lib/asserts.nix
@@ -14,7 +14,7 @@ in
 rec {
 
   /**
-    Throw if pred is false, else return pred.
+    Throw if `pred` is false, else return `pred`.
     Intended to be used to augment asserts with helpful error messages.
 
     # Inputs
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 564625050b6a..b05f8a2f867e 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -127,7 +127,7 @@ rec {
 
     : A list of strings representing the attribute path to check from `set`
 
-    `e`
+    `set`
 
     : The nested attribute set to check
 
@@ -563,7 +563,7 @@ rec {
 
     : A list of attribute names to get out of `set`
 
-    `attrs`
+    `set`
 
     : The set to get the named attributes from
 
@@ -715,10 +715,10 @@ rec {
     Iterates over every name-value pair in the given attribute set.
     The result of the callback function is often called `acc` for accumulator. It is passed between callbacks from left to right and the final `acc` is the return value of `foldlAttrs`.
 
-    Attention:
-
+    ::: {.note}
     There is a completely different function `lib.foldAttrs`
     which has nothing to do with this function, despite the similar name.
+    :::
 
     # Inputs
 
@@ -918,8 +918,8 @@ rec {
     ) [ { } ] (attrNames attrsOfLists);
 
   /**
-    Return the result of function f applied to the cartesian product of attribute set value combinations.
-    Equivalent to using cartesianProduct followed by map.
+    Return the result of function `f` applied to the cartesian product of attribute set value combinations.
+    Equivalent to using `cartesianProduct` followed by `map`.
 
     # Inputs
 
@@ -1522,7 +1522,7 @@ rec {
     );
 
   /**
-    Merge sets of attributes and use the function f to merge attribute values.
+    Merge sets of attributes and use the function `f` to merge attribute values.
     Like `lib.attrsets.zipAttrsWithNames` with all key names are passed for `names`.
 
     Implementation note: Common names appear multiple times in the list of
@@ -1628,7 +1628,7 @@ rec {
       binaryMerge 0 (length list);
 
   /**
-    Does the same as the update operator '//' except that attributes are
+    Does the same as the update operator `//` except that attributes are
     merged until the given predicate is verified.  The predicate should
     accept 3 arguments which are the path to reach the attribute, a part of
     the first attribute set and a part of the second attribute set.  When
@@ -1701,7 +1701,7 @@ rec {
     f [ ] [ rhs lhs ];
 
   /**
-    A recursive variant of the update operator ‘//’.  The recursion
+    A recursive variant of the update operator `//`.  The recursion
     stops when one of the attribute values is not an attribute set,
     in which case the right hand side value takes precedence over the
     left hand side value.
@@ -2183,7 +2183,7 @@ rec {
   recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
 
   /**
-    Undo the effect of recurseIntoAttrs.
+    Undo the effect of `recurseIntoAttrs`.
 
     # Inputs
 
diff --git a/lib/cli.nix b/lib/cli.nix
index f0ebeb76c4c2..4cf97ba7a25e 100644
--- a/lib/cli.nix
+++ b/lib/cli.nix
@@ -85,7 +85,7 @@
     `optionValueSeparator`
 
     : How to separate an option from its flag;
-    By default, there is no separator, so option `-c` and value `5` would become ["-c" "5"].
+    By default, there is no separator, so option `-c` and value `5` would become `["-c" "5"]`.
     This is useful if the command requires equals, for example, `-c=5`.
 
     # Examples
diff --git a/lib/customisation.nix b/lib/customisation.nix
index 6159ce8ea27a..bb759fd1a0db 100644
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -323,7 +323,7 @@ rec {
       abort "lib.customisation.callPackageWith: ${error}";
 
   /**
-    Like callPackage, but for a function that returns an attribute
+    Like `callPackage`, but for a function that returns an attribute
     set of derivations. The override function is added to the
     individual attributes.
 
@@ -665,7 +665,7 @@ rec {
     };
 
   /**
-    Like makeScope, but aims to support cross compilation. It's still ugly, but
+    Like `makeScope`, but aims to support cross compilation. It's still ugly, but
     hopefully it helps a little bit.
 
     # Type
@@ -775,7 +775,7 @@ rec {
         `excludeFunctionArgNames` is useful for argument deprecation while avoiding ellipses.
 
       `extendDrvArgs` (required)
-      : An extension (overlay) of the argument set, like the one taken by [overrideAttrs](#sec-pkg-overrideAttrs) but applied before passing to `constructDrv`.
+      : An extension (overlay) of the argument set, like the one taken by [`overrideAttrs`](#sec-pkg-overrideAttrs) but applied before passing to `constructDrv`.
 
       `inheritFunctionArgs` (default to `true`)
       : Whether to inherit `__functionArgs` from the base build helper.
diff --git a/lib/derivations.nix b/lib/derivations.nix
index 574b01695d86..da5621c8f0b3 100644
--- a/lib/derivations.nix
+++ b/lib/derivations.nix
@@ -86,7 +86,7 @@ in
       This can be used for adding package attributes, such as `tests`.
 
     `outputs`
-    : Optional list of assumed outputs. Default: ["out"]
+    : Optional list of assumed outputs. Default: `[ "out" ]`
 
       This must match the set of outputs that the returned derivation has.
       You must use this when the derivation has multiple outputs.
diff --git a/lib/fetchers.nix b/lib/fetchers.nix
index c09dbc799103..34698ad872bb 100644
--- a/lib/fetchers.nix
+++ b/lib/fetchers.nix
@@ -43,8 +43,22 @@ rec {
 
     All other attributes in the set remain as-is.
 
-    # Example
+    # Type
+    ```
+    normalizeHash :: { hashTypes :: List String, required :: Bool } -> AttrSet -> AttrSet
+    ```
 
+    # Arguments
+
+    hashTypes
+    : the set of attribute names accepted as hash inputs, in addition to `hash`
+
+    required
+    : whether to throw if no hash was present in the input; otherwise returns the original input, unmodified
+
+    # Example
+    ::: {.example}
+    ## `lib.fetchers.normalizeHash` usage example
     ```nix
     normalizeHash { } { hash = ""; foo = "bar"; }
     =>
@@ -72,19 +86,7 @@ rec {
       outputHashAlgo = "sha512";
     }
     ```
-
-    # Type
-    ```
-    normalizeHash :: { hashTypes :: List String, required :: Bool } -> AttrSet -> AttrSet
-    ```
-
-    # Arguments
-
-    hashTypes
-    : the set of attribute names accepted as hash inputs, in addition to `hash`
-
-    required
-    : whether to throw if no hash was present in the input; otherwise returns the original input, unmodified
+    :::
   */
   normalizeHash =
     {
diff --git a/lib/filesystem.nix b/lib/filesystem.nix
index 750d47f8de18..acc47cd5efdb 100644
--- a/lib/filesystem.nix
+++ b/lib/filesystem.nix
@@ -28,7 +28,8 @@ in
 
   /**
     The type of a path. The path needs to exist and be accessible.
-    The result is either "directory" for a directory, "regular" for a regular file, "symlink" for a symlink, or "unknown" for anything else.
+    The result is either `"directory"` for a directory, `"regular"` for a
+    regular file, `"symlink"` for a symlink, or `"unknown"` for anything else.
 
     # Inputs
 
@@ -160,9 +161,9 @@ in
     in
     builtins.listToAttrs cabal-subdirs;
   /**
-    Find the first directory containing a file matching 'pattern'
-    upward from a given 'file'.
-    Returns 'null' if no directories contain a file matching 'pattern'.
+    Find the first directory containing a file matching `pattern`
+    upward from a given `file`.
+    Returns `null` if no directories contain a file matching `pattern`.
 
     # Inputs
 
diff --git a/lib/fixed-points.nix b/lib/fixed-points.nix
index f4e06473e5ea..6d50a00fc4a1 100644
--- a/lib/fixed-points.nix
+++ b/lib/fixed-points.nix
@@ -329,7 +329,7 @@ rec {
 
   /**
     Compose two overlay functions and return a single overlay function that combines them.
-    For more details see: [composeManyExtensions](#function-library-lib.fixedPoints.composeManyExtensions).
+    For more details see: [`composeManyExtensions`](#function-library-lib.fixedPoints.composeManyExtensions).
   */
   composeExtensions =
     f: g: final: prev:
diff --git a/lib/generators.nix b/lib/generators.nix
index 9f9fb834ca07..764175d626d2 100644
--- a/lib/generators.nix
+++ b/lib/generators.nix
@@ -129,11 +129,11 @@ rec {
       err "this value is" (toString v);
 
   /**
-    Generate a line of key k and value v, separated by
-    character sep. If sep appears in k, it is escaped.
-    Helper for synaxes with different separators.
+    Generate a line of key `k` and value `v`, separated by
+    character `sep`. If `sep` appears in `k`, it is escaped.
+    Helper for syntaxes with different separators.
 
-    mkValueString specifies how values should be formatted.
+    `mkValueString` specifies how values should be formatted.
 
     ```nix
     mkKeyValueDefault {} ":" "f:oo" "bar"
@@ -350,7 +350,7 @@ rec {
     1. values are indented with tabs
     2. sections can have sub-sections
 
-    Further: https://git-scm.com/docs/git-config#EXAMPLES
+    Further: [git-config examples](https://git-scm.com/docs/git-config#EXAMPLES)
 
     # Examples
     :::{.example}
@@ -376,7 +376,7 @@ rec {
     `attrs`
 
     : Key-value pairs to be converted to a git-config file.
-      See: https://git-scm.com/docs/git-config#_variables for possible values.
+      See the [git-config documentation](https://git-scm.com/docs/git-config#_variables) for possible values.
   */
   toGitINI =
     attrs:
@@ -430,13 +430,13 @@ rec {
     toINI_ (gitFlattenAttrs attrs);
 
   /**
-    mkKeyValueDefault wrapper that handles dconf INI quirks.
+    `mkKeyValueDefault` wrapper that handles dconf INI quirks.
     The main differences of the format is that it requires strings to be quoted.
   */
   mkDconfKeyValue = mkKeyValueDefault { mkValueString = v: toString (gvariant.mkValue v); } "=";
 
   /**
-    Generates INI in dconf keyfile style. See https://help.gnome.org/admin/system-admin-guide/stable/dconf-keyfiles.html.en
+    Generates INI in dconf keyfile style. See the [GNOME documentation](https://help.gnome.org/system-admin-guide/dconf-keyfiles.html)
     for details.
   */
   toDconfINI = toINI { mkKeyValue = mkDconfKeyValue; };
@@ -509,9 +509,9 @@ rec {
 
     Structured function argument
     : allowPrettyValues
-      : If this option is true, attrsets like { __pretty = fn; val = …; }
-        will use fn to convert val to a pretty printed representation.
-        (This means fn is type Val -> String.)
+      : If this option is true, attrsets like `{ __pretty = fn; val = …; }`
+        will use `fn` to convert `val` to a pretty printed representation.
+        (This means `fn` is type `Val -> String`.)
     : multiline
       : If this option is true, the output is indented with newlines for attribute sets and lists
     : indent
@@ -748,17 +748,17 @@ rec {
 
   /**
     Translate a simple Nix expression to Lua representation with occasional
-    Lua-inlines that can be constructed by mkLuaInline function.
+    Lua-inlines that can be constructed by `mkLuaInline` function.
 
     Configuration:
 
-    * multiline - by default is true which results in indented block-like view.
-    * indent - initial indent.
-    * asBindings - by default generate single value, but with this use attrset to set global vars.
-
-    Attention:
+    * `multiline` - by default is true which results in indented block-like view.
+    * `indent` - initial indent.
+    * `asBindings` - by default generate single value, but with this use attrset to set global vars.
 
+    ::: {.note}
     Regardless of multiline parameter there is no trailing newline.
+    :::
 
     # Inputs
 
@@ -868,7 +868,7 @@ rec {
       abort "generators.toLua: type ${typeOf v} is unsupported";
 
   /**
-    Mark string as Lua expression to be inlined when processed by toLua.
+    Mark string as Lua expression to be inlined when processed by `toLua`.
 
     # Inputs
 
diff --git a/lib/lists.nix b/lib/lists.nix
index 3be3715b9200..1463ff622b7f 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -439,7 +439,7 @@ rec {
   flatten = x: if isList x then concatMap (y: flatten y) x else [ x ];
 
   /**
-    Remove elements equal to 'e' from a list.  Useful for buildInputs.
+    Remove elements equal to `e` from a list.  Useful for `buildInputs`.
 
     # Inputs
 
@@ -1926,7 +1926,7 @@ rec {
   allUnique = list: (length (unique list) == length list);
 
   /**
-    Intersects list 'list1' and another list (`list2`).
+    Intersects list `list1` and another list (`list2`).
 
     O(nm) complexity.
 
@@ -1954,7 +1954,7 @@ rec {
   intersectLists = e: filter (x: elem x e);
 
   /**
-    Subtracts list 'e' from another list (`list2`).
+    Subtracts list `e` from another list (`list2`).
 
     O(nm) complexity.
 
@@ -1983,7 +1983,7 @@ rec {
 
   /**
     Test if two lists have no common element.
-    It should be slightly more efficient than (intersectLists a b == [])
+    It should be slightly more efficient than `intersectLists a b == []`.
 
     # Inputs
 
diff --git a/lib/meta.nix b/lib/meta.nix
index d60cb9287e3e..62b40344c46b 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -180,7 +180,7 @@ rec {
   lowPrio = setPrio 10;
 
   /**
-    Apply lowPrio to an attrset with derivations.
+    Apply `lowPrio` to an attrset with derivations.
 
     # Inputs
 
@@ -203,7 +203,7 @@ rec {
   hiPrio = setPrio (-10);
 
   /**
-    Apply hiPrio to an attrset with derivations.
+    Apply `hiPrio` to an attrset with derivations.
 
     # Inputs
 
@@ -414,7 +414,7 @@ rec {
     licstr: default: lowercaseLicenses.${lib.toLower licstr} or default;
 
   /**
-    Get the path to the main program of a package based on meta.mainProgram
+    Get the path to the main program of a package based on `meta.mainProgram`
 
     # Inputs
 
diff --git a/lib/options.nix b/lib/options.nix
index b1db6ff76e46..a36fc2220d21 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -77,7 +77,7 @@ rec {
   isOption = lib.isType "option";
 
   /**
-    Creates an Option attribute set. mkOption accepts an attribute set with the following keys:
+    Creates an Option attribute set. `mkOption` accepts an attribute set with the following keys:
 
     # Inputs
 
@@ -152,7 +152,7 @@ rec {
     attrs // { _type = "option"; };
 
   /**
-    Creates an option declaration with a default value of ´false´, and can be defined to ´true´.
+    Creates an option declaration with a default value of `false`, and can be defined to `true`.
 
     # Inputs
 
@@ -444,14 +444,18 @@ rec {
   /**
     Require a single definition.
 
-    WARNING: Does not perform nested checks, as this does not run the merge function!
+    ::: {.warning}
+    Does not perform nested checks, as this does not run the merge function!
+    :::
   */
   mergeOneOption = mergeUniqueOption { message = ""; };
 
   /**
     Require a single definition.
 
-    NOTE: When the type is not checked completely by check, pass a merge function for further checking (of sub-attributes, etc).
+    ::: {.note}
+    When the type is not checked completely by check, pass a merge function for further checking (of sub-attributes, etc).
+    :::
 
     # Inputs
 
@@ -516,7 +520,7 @@ rec {
       ) (head defs) (tail defs)).value;
 
   /**
-    Extracts values of all "value" keys of the given list.
+    Extracts values of all `value` keys of the given list.
 
     # Type
 
@@ -538,7 +542,7 @@ rec {
   getValues = map (x: x.value);
 
   /**
-    Extracts values of all "file" keys of the given list
+    Extracts values of all `file` keys of the given list
 
     # Type
 
@@ -615,7 +619,7 @@ rec {
     (on the order of megabytes) and is not actually used by the
     manual generator.
 
-    This function was made obsolete by renderOptionValue and is kept for
+    This function was made obsolete by `renderOptionValue` and is kept for
     compatibility with out-of-tree code.
 
     # Inputs
diff --git a/lib/sources.nix b/lib/sources.nix
index 78335bd9f06d..2936962c2de1 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -20,7 +20,7 @@ let
 
   /**
     A basic filter for `cleanSourceWith` that removes
-    directories of version control system, backup files (*~)
+    directories of version control system, backup files (`*~`)
     and some generated files.
 
     # Inputs
@@ -72,7 +72,7 @@ let
     );
 
   /**
-    Filters a source tree removing version control files and directories using cleanSourceFilter.
+    Filters a source tree removing version control files and directories using `cleanSourceFilter`.
 
     # Inputs
 
diff --git a/lib/strings.nix b/lib/strings.nix
index ee78db2beafa..f3c7018d4403 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -124,7 +124,7 @@ rec {
   concatMapStrings = f: list: concatStrings (map f list);
 
   /**
-    Like `concatMapStrings` except that the f functions also gets the
+    Like `concatMapStrings` except that the function `f` also gets the
     position as a parameter.
 
     # Inputs
@@ -733,7 +733,7 @@ rec {
       );
 
   /**
-    Depending on the boolean `cond', return either the given string
+    Depending on the boolean `cond`, return either the given string
     or the empty string. Useful to concatenate against a bigger string.
 
     # Inputs
@@ -1937,7 +1937,7 @@ rec {
   versionOlder = v1: v2: compareVersions v2 v1 == 1;
 
   /**
-    Returns true if string v1 denotes a version equal to or newer than v2.
+    Returns true if string `v1` denotes a version equal to or newer than `v2`.
 
     # Inputs
 
@@ -2090,7 +2090,7 @@ rec {
 
     `type`
     : The type of the feature to be set, as described in
-      https://cmake.org/cmake/help/latest/command/set.html
+      [the CMake set documentation](https://cmake.org/cmake/help/latest/command/set.html)
       the possible values (case insensitive) are:
       BOOL FILEPATH PATH STRING INTERNAL LIST
 
@@ -2135,7 +2135,7 @@ rec {
     "-D${feature}:${toUpper type}=${value}";
 
   /**
-    Create a -D<condition>={TRUE,FALSE} string that can be passed to typical
+    Create a `"-D<condition>={TRUE,FALSE}"` string that can be passed to typical
     CMake invocations.
 
     # Inputs
@@ -2170,7 +2170,7 @@ rec {
     cmakeOptionType "bool" condition (lib.toUpper (lib.boolToString flag));
 
   /**
-    Create a -D<feature>:STRING=<value> string that can be passed to typical
+    Create a `"-D<feature>:STRING=<value>"` string that can be passed to typical
     CMake invocations.
     This is the most typical usage, so it deserves a special case.
 
@@ -2206,7 +2206,7 @@ rec {
     cmakeOptionType "string" feature value;
 
   /**
-    Create a -D<feature>=<value> string that can be passed to typical Meson
+    Create a `"-D<feature>=<value>"` string that can be passed to typical Meson
     invocations.
 
     # Inputs
@@ -2241,7 +2241,7 @@ rec {
     "-D${feature}=${value}";
 
   /**
-    Create a -D<condition>={true,false} string that can be passed to typical
+    Create a `"-D<condition>={true,false}"` string that can be passed to typical
     Meson invocations.
 
     # Inputs
@@ -2278,7 +2278,7 @@ rec {
     mesonOption condition (lib.boolToString flag);
 
   /**
-    Create a -D<feature>={enabled,disabled} string that can be passed to
+    Create a `"-D<feature>={enabled,disabled}"` string that can be passed to
     typical Meson invocations.
 
     # Inputs
@@ -2315,7 +2315,7 @@ rec {
     mesonOption feature (if flag then "enabled" else "disabled");
 
   /**
-    Create an --{enable,disable}-<feature> string that can be passed to
+    Create an `"--{enable,disable}-<feature>"` string that can be passed to
     standard GNU Autoconf scripts.
 
     # Inputs
@@ -2352,8 +2352,8 @@ rec {
     "--${if flag then "enable" else "disable"}-${feature}";
 
   /**
-    Create an --{enable-<feature>=<value>,disable-<feature>} string that can be passed to
-    standard GNU Autoconf scripts.
+    Create an `"--{enable-<feature>=<value>,disable-<feature>}"` string that
+    can be passed to standard GNU Autoconf scripts.
 
     # Inputs
 
@@ -2390,7 +2390,7 @@ rec {
     enableFeature flag feature + optionalString flag "=${value}";
 
   /**
-    Create an --{with,without}-<feature> string that can be passed to
+    Create an `"--{with,without}-<feature>"` string that can be passed to
     standard GNU Autoconf scripts.
 
     # Inputs
@@ -2426,7 +2426,7 @@ rec {
     "--${if flag then "with" else "without"}-${feature}";
 
   /**
-    Create an --{with-<feature>=<value>,without-<feature>} string that can be passed to
+    Create an `"--{with-<feature>=<value>,without-<feature>}"` string that can be passed to
     standard GNU Autoconf scripts.
 
     # Inputs
@@ -2576,7 +2576,7 @@ rec {
     lib.warnIf (!precise) "Imprecise conversion from float to string ${result}" result;
 
   /**
-    Check whether a list or other value `x` can be passed to toString.
+    Check whether a list or other value `x` can be passed to `toString`.
 
     Many types of value are coercible to string this way, including `int`, `float`,
     `null`, `bool`, `list` of similarly coercible values.
@@ -2675,7 +2675,7 @@ rec {
 
   /**
     Parse a string as an int. Does not support parsing of integers with preceding zero due to
-    ambiguity between zero-padded and octal numbers. See toIntBase10.
+    ambiguity between zero-padded and octal numbers. See `toIntBase10`.
 
     # Inputs
 
@@ -2904,7 +2904,7 @@ rec {
     Computes the Levenshtein distance between two strings `a` and `b`.
 
     Complexity O(n*m) where n and m are the lengths of the strings.
-    Algorithm adjusted from https://stackoverflow.com/a/9750974/6605742
+    Algorithm adjusted from [this stackoverflow comment](https://stackoverflow.com/a/9750974/6605742)
 
     # Inputs
 
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 0a0a150206e7..317b993f12d2 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -263,7 +263,11 @@ in
   /**
     Merge two attribute sets shallowly, right side trumps left
 
+    # Type
+
+    ```
     mergeAttrs :: attrs -> attrs -> attrs
+    ```
 
     # Inputs
 
@@ -913,7 +917,7 @@ in
   throwIfNot = cond: msg: if cond then x: x else throw msg;
 
   /**
-    Like throwIfNot, but negated (throw if the first argument is `true`).
+    Like `throwIfNot`, but negated (throw if the first argument is `true`).
 
     # Inputs
 
@@ -988,11 +992,16 @@ in
     The metadata should match the format given by
     builtins.functionArgs, i.e. a set from expected argument to a bool
     representing whether that argument has a default or not.
-    setFunctionArgs : (a → b) → Map String Bool → (a → b)
 
     This function is necessary because you can't dynamically create a
-    function of the { a, b ? foo, ... }: format, but some facilities
-    like callPackage expect to be able to query expected arguments.
+    function of the `{ a, b ? foo, ... }:` format, but some facilities
+    like `callPackage` expect to be able to query expected arguments.
+
+    # Type
+
+    ```
+    setFunctionArgs : (a -> b) -> Map String Bool -> (a -> b)
+    ```
 
     # Inputs
 
@@ -1012,10 +1021,15 @@ in
 
   /**
     Extract the expected function arguments from a function.
-    This works both with nix-native { a, b ? foo, ... }: style
-    functions and functions with args set with 'setFunctionArgs'. It
-    has the same return type and semantics as builtins.functionArgs.
-    setFunctionArgs : (a → b) → Map String Bool.
+    This works both with nix-native `{ a, b ? foo, ... }:` style
+    functions and functions with args set with `setFunctionArgs`. It
+    has the same return type and semantics as `builtins.functionArgs`.
+
+    # Type
+
+    ```
+    functionArgs : (a -> b) -> Map String Bool
+    ```
 
     # Inputs
 
@@ -1125,11 +1139,12 @@ in
     # Type
 
     ```
-    fromHexString :: String -> [ String ]
+    fromHexString :: String -> Int
     ```
 
     # Examples
-
+    :::{.example}
+    ## `lib.trivial.fromHexString` usage examples
     ```nix
     fromHexString "FF"
     => 255
@@ -1137,6 +1152,7 @@ in
     fromHexString "0x7fffffffffffffff"
     => 9223372036854775807
     ```
+    :::
   */
   fromHexString =
     str:
@@ -1157,13 +1173,20 @@ in
 
   /**
     Convert the given positive integer to a string of its hexadecimal
-    representation. For example:
+    representation.
 
+    # Examples
+    :::{.example}
+    ## `lib.trivial.toHexString` usage example
+
+    ```nix
     toHexString 0 => "0"
 
     toHexString 16 => "10"
 
     toHexString 250 => "FA"
+    ```
+    :::
   */
   toHexString =
     let
@@ -1180,14 +1203,8 @@ in
     i: lib.concatMapStrings toHexDigit (toBaseDigits 16 i);
 
   /**
-    `toBaseDigits base i` converts the positive integer i to a list of its
-    digits in the given base. For example:
-
-    toBaseDigits 10 123 => [ 1 2 3 ]
-
-    toBaseDigits 2 6 => [ 1 1 0 ]
-
-    toBaseDigits 16 250 => [ 15 10 ]
+    `toBaseDigits base i` converts the positive integer `i` to a list of its
+    digits in the given base.
 
     # Inputs
 
@@ -1198,6 +1215,19 @@ in
     `i`
 
     : 2\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `lib.trivial.toBaseDigits`
+
+    ```nix
+    toBaseDigits 10 123 => [ 1 2 3 ]
+
+    toBaseDigits 2 6 => [ 1 1 0 ]
+
+    toBaseDigits 16 250 => [ 15 10 ]
+    ```
+    :::
   */
   toBaseDigits =
     base: i:
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index cab1e989c14e..5c2100607c73 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -25,6 +25,11 @@ in
         example = {
           PORT = "4000";
           NODE_EXTRA_CA_CERTS = lib.literalExpression "config.security.pki.caBundle";
+          UPTIME_KUMA_DB_TYPE = "mariadb";
+          UPTIME_KUMA_DB_HOSTNAME = "localhost";
+          UPTIME_KUMA_DB_NAME = "uptime-kuma";
+          UPTIME_KUMA_DB_USERNAME = "uptime-kuma";
+          UPTIME_KUMA_DB_PASSWORD = "uptime-kuma";
         };
         description = ''
           Additional configuration for Uptime Kuma, see
@@ -42,6 +47,7 @@ in
       NODE_ENV = lib.mkDefault "production";
       HOST = lib.mkDefault "127.0.0.1";
       PORT = lib.mkDefault "3001";
+      UPTIME_KUMA_DB_TYPE = lib.mkDefault "sqlite";
     };
 
     systemd.services.uptime-kuma = {
diff --git a/nixos/tests/watchdogd.nix b/nixos/tests/watchdogd.nix
index 5519ca6fb695..af9c1d5d961c 100644
--- a/nixos/tests/watchdogd.nix
+++ b/nixos/tests/watchdogd.nix
@@ -20,6 +20,5 @@
     machine.wait_for_unit("watchdogd.service")
 
     assert "i6300ESB" in machine.succeed("watchdogctl status")
-    machine.succeed("watchdogctl test")
   '';
 }
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 537124d91ce5..e6e1c5233b81 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.0.55";
-    hash = "sha256-6ip1ETRDQTjl5bxIGPHTFAL8Ri5xbN2zd6hVVdTnjtE=";
+    version = "2.0.56";
+    hash = "sha256-HWl7I+KXpvPzL6Fyk2lQdZoeYXPgipIABwJBArETylc=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/esbenp.prettier-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/esbenp.prettier-vscode/default.nix
index 50a8fe24498a..bb21dd2a0d7e 100644
--- a/pkgs/applications/editors/vscode/extensions/esbenp.prettier-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/esbenp.prettier-vscode/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "prettier-vscode";
     publisher = "esbenp";
-    version = "11.0.0";
-    hash = "sha256-pNjkJhof19cuK0PsXJ/Q/Zb2H7eoIkfXJMLZJ4lDn7k=";
+    version = "11.0.1";
+    hash = "sha256-k+Hien0huGIn0XRQQSeW6wmd1HTTTfNZPnw36ryGLd8=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 2388fffbc9a9..a3e02391929f 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1075,11 +1075,11 @@
     "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
   },
   "pagerduty_pagerduty": {
-    "hash": "sha256-SH3nsy8viGrHJTQzOc5kvEvM0+K8xNQjyrnexOfxFTk=",
+    "hash": "sha256-3SqhkSed8aO7CP4ONj02ahm5V9xV3xyRBPn03A7xlMA=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.30.6",
+    "rev": "v3.30.7",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/ba/battery-toolkit/package.nix b/pkgs/by-name/ba/battery-toolkit/package.nix
new file mode 100644
index 000000000000..3c459bf76217
--- /dev/null
+++ b/pkgs/by-name/ba/battery-toolkit/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "battery-toolkit";
+  version = "1.8";
+
+  src = fetchzip {
+    url = "https://github.com/mhaeuser/Battery-Toolkit/releases/download/${finalAttrs.version}/Battery-Toolkit-${finalAttrs.version}.zip";
+    hash = "sha256-gsEXTE+pM+rsBhTeup7cWcUljY8u0T+ETON7JeA6g1A=";
+    stripRoot = false;
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications"
+    cp -R "Battery Toolkit.app" "$out/Applications/"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Control the platform power state of your Apple Silicon Mac";
+    longDescription = ''
+      Battery Toolkit allows you to control battery charging behavior on Apple Silicon Macs.
+      Features include setting upper and lower charge limits, disabling the power adapter,
+      and manual control over charging state.
+    '';
+    homepage = "https://github.com/mhaeuser/Battery-Toolkit";
+    changelog = "https://github.com/mhaeuser/Battery-Toolkit/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ shgew ];
+    platforms = [ "aarch64-darwin" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/ca/cargo-careful/package.nix b/pkgs/by-name/ca/cargo-careful/package.nix
index 522e1d9b5ee2..319947b3df3d 100644
--- a/pkgs/by-name/ca/cargo-careful/package.nix
+++ b/pkgs/by-name/ca/cargo-careful/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-careful";
-  version = "0.4.8";
+  version = "0.4.9";
 
   src = fetchFromGitHub {
     owner = "RalfJung";
     repo = "cargo-careful";
     rev = "v${version}";
-    hash = "sha256-KT0sYftintyaFKr+thnK+SV36Gt9BQZL/9j+u9DtzRM=";
+    hash = "sha256-huo5KFb+qoPVHNrnR+vb97iNinGaU5d3NbFhAgGCzCk=";
   };
 
-  cargoHash = "sha256-oLMUGbhN9/6U6mcjxJTLxqogwDaXWhf/gW10l37wNdY=";
+  cargoHash = "sha256-mjGUSwqyqgnGwKjznj8KedIzOJi4GDldJEL0fzpuvec=";
 
   meta = with lib; {
     description = "Tool to execute Rust code carefully, with extra checking along the way";
diff --git a/pkgs/by-name/ca/cargo-show-asm/package.nix b/pkgs/by-name/ca/cargo-show-asm/package.nix
index 9e6f15f78155..8bbf2e701578 100644
--- a/pkgs/by-name/ca/cargo-show-asm/package.nix
+++ b/pkgs/by-name/ca/cargo-show-asm/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-show-asm";
-  version = "0.2.54";
+  version = "0.2.55";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-AF8fFPdiSZ/odPg3Kp72+LlJ+ox0PU+dH1fhPSt61n8=";
+    hash = "sha256-ZSPlFDnLVQp1uz1VrbXmw8bAM1/ZWojAv7PSFG+k2Pw=";
   };
 
-  cargoHash = "sha256-cSlM0Ci0fXhAw7vfTxdkL9a4L9r76XdaR5URYYGAdd0=";
+  cargoHash = "sha256-M4nn9MnFtyHh9QX12CHGGOL4gkTy9lozd87Rph4+OBA=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index d6009e563c2c..4f95cf65a8ed 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.17.1";
+  version = "1.18.1";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-5R20rUW+M2mZ7NkuNWQUnd+UsOb3aFQtRXurYw1rDaI=";
+    hash = "sha256-ZrMG/MxpJqByrST4IXufayw0Hg9t35nfvvIS2MrLcw8=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index b43240b70314..05abed48dd54 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.0.55",
+  "version": "2.0.56",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.0.55",
+      "version": "2.0.56",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 6033d2e72922..d8f940aaa1f9 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -11,14 +11,14 @@ buildNpmPackage (finalAttrs: {
   # ```sh
   # nix-shell maintainers/scripts/update.nix --argstr commit true --argstr package vscode-extensions.anthropic.claude-code && nix-shell maintainers/scripts/update.nix --argstr commit true --argstr package claude-code
   # ```
-  version = "2.0.55";
+  version = "2.0.56";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-wsjOkNxuBLMYprjaZQyUZHiqWl8UG7cZ1njkyKZpRYg=";
+    hash = "sha256-HuT2y0pyVc9wFrWBLffqCrrpN60YN1cl5NPwzOK0q98=";
   };
 
-  npmDepsHash = "sha256-k7sCE3dyHz69qlxxrX+lnPuJUf8w/FAAUQtFuEdlTqA=";
+  npmDepsHash = "sha256-yoVNRg7XdVBHGJPlmZ3g/vQ/0qSroKUVaN91N2XWtEs=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index fb3c53cf8084..958fe7b81649 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.397.0";
+  version = "1.399.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-LeQP2Ula7gPqis7DeaQGDAN2wtQT9ryZhIDYUBEPreo=";
+    hash = "sha256-K+3G7ldtU3kBtqfPB9d3MqvguQSZB1BoQdlx2almwGE=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index b1c62bd24c49..eaf1741ee5ec 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -18,7 +18,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "25.2.5";
+  version = "25.3.0";
 
   src =
     let
@@ -31,10 +31,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-ADF7uFUZjzKaTQFAtqG0O81Yk8SvBh86SsyIOiSp1fY=";
-        aarch64-linux = "sha256-VNip5eplQ2vxi+eKHKGaBbMZ5QPS7GaoGdcZWr+abDM=";
-        x86_64-darwin = "sha256-Wu5rFiQBDR2AcJyj8ySWXR9P3GaClWzkqGRc3ZfOgIU=";
-        aarch64-darwin = "sha256-YhV70euhBuzpwPyb1CEtDsaAZqBDN1J/rw5oTOW4+ss=";
+        x86_64-linux = "sha256-xJI1tNEnFTwnUStccHZEDnP5SiIQHZWEoUTbwnejfyE=";
+        aarch64-linux = "sha256-Nujbjky4XWdtqWKioPXL1oC3bqRlna0tlRJNtrBI7Js=";
+        x86_64-darwin = "sha256-ixnZIdPzNdU2TZfqbx96ty4OEOdQFUsHiJalJLnvWss=";
+        aarch64-darwin = "sha256-xi57pzbw4/7xSFJ3Xr+bJXZjDO2QO0FNeziRVLhy37E=";
       };
     in
     fetchurl {
diff --git a/pkgs/by-name/ef/efibooteditor/package.nix b/pkgs/by-name/ef/efibooteditor/package.nix
index 2273b584c6f5..80e0ea1a9d0a 100644
--- a/pkgs/by-name/ef/efibooteditor/package.nix
+++ b/pkgs/by-name/ef/efibooteditor/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "efibooteditor";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "Neverous";
     repo = "efibooteditor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xD40ZzkpwerDYC8nzGVqEHLV0KWbxcc0ApquQjrPJTc=";
+    hash = "sha256-tufB90EhO/jdCnQfeuibcJu5C7RfCjIxBYp+8uR0Zv0=";
   };
 
   buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isLinux efivar;
@@ -39,7 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
         'sh -c "pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY efibooteditor"'
   '';
 
-  env.BUILD_VERSION = "v${finalAttrs.version}";
+  env = {
+    LANG = "C.UTF8";
+    BUILD_VERSION = "v${finalAttrs.version}";
+  };
+
   cmakeBuildType = "MinSizeRel";
   cmakeFlags = [ "-DQT_VERSION_MAJOR=6" ];
 
@@ -47,6 +51,15 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm644 $src/LICENSE.txt $out/share/licenses/efibooteditor/LICENSE
   '';
 
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+
+    ctest --output-on-failure
+
+    runHook postCheck
+  '';
+
   meta = {
     description = "Boot Editor for (U)EFI based systems";
     homepage = "https://github.com/Neverous/efibooteditor";
diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index 4ce504ab5e39..c0d0a99cda63 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "2.7.4";
-  srcHash = "sha256-O3YaT8fFQz4iF8dZmwIVms/6XtJ+v/8hRw0wlSN2jq0=";
-  vendorHash = "sha256-vrIh4gI5SwhNpquNb5jz821ZHjoYlEHod84ljQkQQE4=";
-  manifestsHash = "sha256-5Bohn437eZcTKQ+7FP7eYdTuTq2X7/ennfKqIm58Lgg=";
+  version = "2.7.5";
+  srcHash = "sha256-vTb1YE73xxCC4GlR6UW5Ibu+ck+N+KKYUg50csb7eUA=";
+  vendorHash = "sha256-AgWDvlXVZXXprWCeoNeAMDb6LeYfa9yG5afc7TNISQs=";
+  manifestsHash = "sha256-CmYuHhEiKxkSRtN+fri2/4ILxpwRy2xGwGqCqcfsQwU=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
diff --git a/pkgs/by-name/ja/jarl/package.nix b/pkgs/by-name/ja/jarl/package.nix
index 9d6627c331b0..6ebd2e2d720f 100644
--- a/pkgs/by-name/ja/jarl/package.nix
+++ b/pkgs/by-name/ja/jarl/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jarl";
-  version = "0.1.2";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "etiennebacher";
     repo = "jarl";
     tag = finalAttrs.version;
-    hash = "sha256-ioX2Vh/uQ+VT/gra+DruG0tMOiobEkbcioeucJHBLfQ=";
+    hash = "sha256-kitOw5etVlYr2wMGgoGgWtEAGIm3G04CjTWqGpx5FwI=";
   };
 
   postPatch = ''
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
                    '(?:/nix)?/(?:build)/(?:nix[\-0-9]+/)?'
   '';
 
-  cargoHash = "sha256-QdOd/l3FNMaVahGo35hdOMel2GDYcf8ZctkwG00KiNM=";
+  cargoHash = "sha256-wYAth0zrpl/Ub7VnSCiuxi4qtQtuH8WB4CWXcdze5Gs=";
 
   # Don't run integration_tests for jarl-lsp, because it doesn't see
   # the CARGO_BIN_EXE_jarl env var even if exported in preCheck
diff --git a/pkgs/by-name/ji/jive/package.nix b/pkgs/by-name/ji/jive/package.nix
index fa5fa418a6d3..35f86112b61a 100644
--- a/pkgs/by-name/ji/jive/package.nix
+++ b/pkgs/by-name/ji/jive/package.nix
@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "jive";
-  version = "7.45";
+  version = "7.46";
 
   src = fetchurl {
     url = "https://repo.maven.apache.org/maven2/org/tango-controls/Jive/${version}/Jive-${version}-jar-with-dependencies.jar";
-    hash = "sha256-a/I4jMlTVYWN9zNBQnWbvT2MBHItexnwPly1XyOeR8U=";
+    hash = "sha256-AbxTRFi5dCsN/HENTI/o3hBQKZM+cFtJxT3A8RKpQM4=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ko/komga/package.nix b/pkgs/by-name/ko/komga/package.nix
index 3572acb97885..693cca332a72 100644
--- a/pkgs/by-name/ko/komga/package.nix
+++ b/pkgs/by-name/ko/komga/package.nix
@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.23.5";
+  version = "1.23.6";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-b8HoXPY6ww4oXtI7ADWh/Mx4W6f2s8OVc7lQ7g3rOiI=";
+    sha256 = "sha256-MU3U9vFtFVUBOKtynwteQfvsCCsyoGHIKwc+0XqDswY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/le/ledger-web/Gemfile.lock b/pkgs/by-name/le/ledger-web/Gemfile.lock
index abb76c81552c..5b9d70d088d0 100644
--- a/pkgs/by-name/le/ledger-web/Gemfile.lock
+++ b/pkgs/by-name/le/ledger-web/Gemfile.lock
@@ -1,42 +1,42 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activemodel (8.0.2)
-      activesupport (= 8.0.2)
-    activerecord (8.0.2)
-      activemodel (= 8.0.2)
-      activesupport (= 8.0.2)
+    activemodel (8.1.1)
+      activesupport (= 8.1.1)
+    activerecord (8.1.1)
+      activemodel (= 8.1.1)
+      activesupport (= 8.1.1)
       timeout (>= 0.4.0)
-    activesupport (8.0.2)
+    activesupport (8.1.1)
       base64
-      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
       minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
-    base64 (0.2.0)
-    benchmark (0.4.0)
-    bigdecimal (3.1.9)
+    base64 (0.3.0)
+    bigdecimal (3.3.1)
     concurrent-ruby (1.3.5)
-    connection_pool (2.5.3)
-    csv (3.3.4)
+    connection_pool (2.5.5)
+    csv (3.3.5)
     database_cleaner (2.1.0)
       database_cleaner-active_record (>= 2, < 3)
-    database_cleaner-active_record (2.2.0)
+    database_cleaner-active_record (2.2.2)
       activerecord (>= 5.a)
-      database_cleaner-core (~> 2.0.0)
+      database_cleaner-core (~> 2.0)
     database_cleaner-core (2.0.1)
-    diff-lcs (1.6.1)
+    diff-lcs (1.6.2)
     directory_watcher (1.5.1)
-    drb (2.2.1)
+    drb (2.2.3)
     i18n (1.14.7)
       concurrent-ruby (~> 1.0)
+    json (2.16.0)
     ledger_web (1.5.2)
       database_cleaner
       directory_watcher (~> 1.5.1)
@@ -48,56 +48,56 @@ GEM
       sinatra-contrib
       sinatra-session
     logger (1.7.0)
-    minitest (5.25.5)
-    multi_json (1.15.0)
-    mustermann (3.0.3)
+    minitest (5.26.2)
+    multi_json (1.17.0)
+    mustermann (3.0.4)
       ruby2_keywords (~> 0.0.1)
-    pg (1.5.9)
-    rack (3.1.14)
-    rack-protection (4.1.1)
+    pg (1.6.2)
+    rack (3.2.4)
+    rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
       rack (>= 3.0.0, < 4)
     rack-session (2.1.1)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
-    rspec (3.13.0)
+    rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.3)
+    rspec-core (3.13.6)
       rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.4)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.4)
+    rspec-mocks (3.13.7)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.3)
+    rspec-support (3.13.6)
     ruby2_keywords (0.0.5)
     securerandom (0.4.1)
-    sequel (5.92.0)
+    sequel (5.98.0)
       bigdecimal
-    sinatra (4.1.1)
+    sinatra (4.2.1)
       logger (>= 1.6.0)
       mustermann (~> 3.0)
       rack (>= 3.0.0, < 4)
-      rack-protection (= 4.1.1)
+      rack-protection (= 4.2.1)
       rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sinatra-contrib (4.1.1)
+    sinatra-contrib (4.2.1)
       multi_json (>= 0.0.2)
       mustermann (~> 3.0)
-      rack-protection (= 4.1.1)
-      sinatra (= 4.1.1)
+      rack-protection (= 4.2.1)
+      sinatra (= 4.2.1)
       tilt (~> 2.0)
     sinatra-session (1.0.0)
       sinatra (>= 1.0)
-    tilt (2.6.0)
-    timeout (0.4.3)
+    tilt (2.6.1)
+    timeout (0.4.4)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    uri (1.0.3)
+    uri (1.1.1)
 
 PLATFORMS
   ruby
diff --git a/pkgs/by-name/le/ledger-web/gemset.nix b/pkgs/by-name/le/ledger-web/gemset.nix
index 67e7c8d3383d..1a1545ae35bd 100644
--- a/pkgs/by-name/le/ledger-web/gemset.nix
+++ b/pkgs/by-name/le/ledger-web/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v35y2jzqlfy1wnrzlzj2cxylhnz09vykaa1l2dnkq7sl5zzpq8a";
+      sha256 = "1gbg3i823vky26mf63wfr69035bv451nmha8cb8cwcz3p6b28zlb";
       type = "gem";
     };
-    version = "8.0.2";
+    version = "8.1.1";
   };
   activerecord = {
     dependencies = [
@@ -20,20 +20,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "02nrya34qviawdkssyahb3mg08kqdc461b320a6ikr245jwp0d3r";
+      sha256 = "05rxrcfsp06ljhm149xwhfm9bjgd3g150hgbk0s81zb4wc1klb73";
       type = "gem";
     };
-    version = "8.0.2";
+    version = "8.1.1";
   };
   activesupport = {
     dependencies = [
       "base64"
-      "benchmark"
       "bigdecimal"
       "concurrent-ruby"
       "connection_pool"
       "drb"
       "i18n"
+      "json"
       "logger"
       "minitest"
       "securerandom"
@@ -44,40 +44,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pm40y64wfc50a9sj87kxvil2102rmpdcbv82zf0r40vlgdwsrc5";
+      sha256 = "0rzadiafj8llldqry9jjnzbw2rgavdlrqy0nddg8p2qcim7574jy";
       type = "gem";
     };
-    version = "8.0.2";
+    version = "8.1.1";
   };
   base64 = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      sha256 = "0yx9yn47a8lkfcjmigk79fykxvr80r4m1i35q82sxzynpbm7lcr7";
       type = "gem";
     };
-    version = "0.2.0";
-  };
-  benchmark = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0jl71qcgamm96dzyqk695j24qszhcc7liw74qc83fpjljp2gh4hg";
-      type = "gem";
-    };
-    version = "0.4.0";
+    version = "0.3.0";
   };
   bigdecimal = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k6qzammv9r6b2cw3siasaik18i6wjc5m0gw5nfdc6jj64h79z1g";
+      sha256 = "0612spks81fvpv2zrrv3371lbs6mwd7w6g5zafglyk75ici1x87a";
       type = "gem";
     };
-    version = "3.1.9";
+    version = "3.3.1";
   };
   concurrent-ruby = {
     groups = [ "default" ];
@@ -94,20 +84,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0nrhsk7b3sjqbyl1cah6ibf1kvi3v93a7wf4637d355hp614mmyg";
+      sha256 = "1b8nlxr5z843ii7hfk6igpr5acw3k2ih9yjrgkyz2gbmallgjkz5";
       type = "gem";
     };
-    version = "2.5.3";
+    version = "2.5.5";
   };
   csv = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kfqg0m6vqs6c67296f10cr07im5mffj90k2b5dsm51liidcsvp9";
+      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
       type = "gem";
     };
-    version = "3.3.4";
+    version = "3.3.5";
   };
   database_cleaner = {
     dependencies = [ "database_cleaner-active_record" ];
@@ -129,10 +119,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1iz1hv2b1z7509dxvxdwzay1hhs24glxls5ldbyh688zxkcdca1j";
+      sha256 = "1203q6zdw14vwmnr2hw0d6b1rdz4d07w3kjg1my1zhw862gnnac8";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.2.2";
   };
   database_cleaner-core = {
     groups = [ "default" ];
@@ -149,10 +139,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1m3cv0ynmxq93axp6kiby9wihpsdj42y6s3j8bsf5a1p7qzsi98j";
+      sha256 = "0qlrj2qyysc9avzlr4zs1py3x684hqm61n4czrsk1pyllz5x5q4s";
       type = "gem";
     };
-    version = "1.6.1";
+    version = "1.6.2";
   };
   directory_watcher = {
     groups = [ "default" ];
@@ -169,10 +159,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
+      sha256 = "0wrkl7yiix268s2md1h6wh91311w95ikd8fy8m5gx589npyxc00b";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.2.3";
   };
   i18n = {
     dependencies = [ "concurrent-ruby" ];
@@ -185,6 +175,16 @@
     };
     version = "1.14.7";
   };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "098m3q2jrx4xbf0knrbmflsynmmb5x9q9b0bzpmj7jmm1cr30mna";
+      type = "gem";
+    };
+    version = "2.16.0";
+  };
   ledger_web = {
     dependencies = [
       "database_cleaner"
@@ -221,20 +221,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mn7q9yzrwinvfvkyjiz548a4rmcwbmz2fn9nyzh4j1snin6q6rr";
+      sha256 = "1qyda32pf9jivaw2m7yymxshqxxd0fhjn7zpbagvmfc5c65128gh";
       type = "gem";
     };
-    version = "5.25.5";
+    version = "5.26.2";
   };
   multi_json = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      sha256 = "06sabsvnw0x1aqdcswc6bqrqz6705548bfd8z22jxgxfjrn1yn3n";
       type = "gem";
     };
-    version = "1.15.0";
+    version = "1.17.0";
   };
   mustermann = {
     dependencies = [ "ruby2_keywords" ];
@@ -242,30 +242,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "123ycmq6pkivv29bqbv79jv2cs04xakzd0fz1lalgvfs5nxfky6i";
+      sha256 = "08ma2fmxlm6i7lih4mc3har2fzsbj1pl4hhva65kljf6nfvdryl5";
       type = "gem";
     };
-    version = "3.0.3";
+    version = "3.0.4";
   };
   pg = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1p2gqqrm895fzr9vi8d118zhql67bm8ydjvgqbq1crdnfggzn7kn";
+      sha256 = "0xf8i58shwvwlka4ld12nxcgqv0d5r1yizsvw74w5jaw83yllqaq";
       type = "gem";
     };
-    version = "1.5.9";
+    version = "1.6.2";
   };
   rack = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0i2bjh42cmlkwxjrldqj8g5sfrasdp64xhfr25kvp4ziilm3qqc4";
+      sha256 = "1xmnrk076sqymilydqgyzhkma3hgqhcv8xhy7ks479l2a3vvcx2x";
       type = "gem";
     };
-    version = "3.1.14";
+    version = "3.2.4";
   };
   rack-protection = {
     dependencies = [
@@ -277,10 +277,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0sniswjyi0yn949l776h7f67rvx5w9f04wh69z5g19vlsnjm98ji";
+      sha256 = "1b4bamcbpk29i7jvly3i7ayfj69yc1g03gm4s7jgamccvx12hvng";
       type = "gem";
     };
-    version = "4.1.1";
+    version = "4.2.1";
   };
   rack-session = {
     dependencies = [
@@ -306,10 +306,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14xrp8vq6i9zx37vh0yp4h9m0anx9paw200l1r5ad9fmq559346l";
+      sha256 = "11q5hagj6vr694innqj4r45jrm8qcwvkxjnphqgyd66piah88qi0";
       type = "gem";
     };
-    version = "3.13.0";
+    version = "3.13.2";
   };
   rspec-core = {
     dependencies = [ "rspec-support" ];
@@ -317,10 +317,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1r6zbis0hhbik1ck8kh58qb37d1qwij1x1d2fy4jxkzryh3na4r5";
+      sha256 = "0bcbh9yv6cs6pv299zs4bvalr8yxa51kcdd1pjl60yv625j3r0m8";
       type = "gem";
     };
-    version = "3.13.3";
+    version = "3.13.6";
   };
   rspec-expectations = {
     dependencies = [
@@ -331,10 +331,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1n7cb6szws90hxbzqrfybs4rj1xb0vhn24xa4l5r1vnzcnblahsf";
+      sha256 = "0dl8npj0jfpy31bxi6syc7jymyd861q277sfr6jawq2hv6hx791k";
       type = "gem";
     };
-    version = "3.13.4";
+    version = "3.13.5";
   };
   rspec-mocks = {
     dependencies = [
@@ -345,20 +345,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14xr5bq7s80hm97fcp3pvk4v515qfw3lrlsf20idalwwf6h5icbb";
+      sha256 = "071bqrk2rblk3zq3jk1xxx0dr92y0szi5pxdm8waimxici706y89";
       type = "gem";
     };
-    version = "3.13.4";
+    version = "3.13.7";
   };
   rspec-support = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0hrzdcklbl8pv721cq906yfl38fmqmlnh33ff8l752z1ys9y6q9a";
+      sha256 = "1cmgz34hwj5s3jwxhyl8mszs24nci12ffbrmr5jb1si74iqf739f";
       type = "gem";
     };
-    version = "3.13.3";
+    version = "3.13.6";
   };
   ruby2_keywords = {
     groups = [ "default" ];
@@ -386,10 +386,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ga49hliy5alb1x42mvpkmasqv71rhm4081zv5gpwr5q8lcsc1nb";
+      sha256 = "0irbjils48r7w14jacka3l96jzh534d98vb88yj1qc9nl43r3r2g";
       type = "gem";
     };
-    version = "5.92.0";
+    version = "5.98.0";
   };
   sinatra = {
     dependencies = [
@@ -404,10 +404,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "002dkzdc1xqhvz5sdnj4vb0apczhs07mnpgq4kkd5dd1ka2pp6af";
+      sha256 = "103h6wjpcqp3i034hi44za2v365yz7qk9s5df8lmasq43nqvkbmp";
       type = "gem";
     };
-    version = "4.1.1";
+    version = "4.2.1";
   };
   sinatra-contrib = {
     dependencies = [
@@ -421,10 +421,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1giziwf8mgki581jf40zzw3dhjkkmdg3yxbrahj9krd5h24vb90y";
+      sha256 = "0jkbsaika8pr9bc90ag3wqrhbgiy7h5a93k11j8sls6j8k4r3l0h";
       type = "gem";
     };
-    version = "4.1.1";
+    version = "4.2.1";
   };
   sinatra-session = {
     dependencies = [ "sinatra" ];
@@ -442,20 +442,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0szpapi229v3scrvw1pgy0vpjm7z3qlf58m1198kxn70cs278g96";
+      sha256 = "0w27v04d7rnxjr3f65w1m7xyvr6ch6szjj2v5wv1wz6z5ax9pa9m";
       type = "gem";
     };
-    version = "2.6.0";
+    version = "2.6.1";
   };
   timeout = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03p31w5ghqfsbz5mcjzvwgkw3h9lbvbknqvrdliy8pxmn9wz02cm";
+      sha256 = "1nqf9rg974k4bjji7aggalg8pfvbkd9hys4hv5y450jb21qgkxph";
       type = "gem";
     };
-    version = "0.4.3";
+    version = "0.4.4";
   };
   tzinfo = {
     dependencies = [ "concurrent-ruby" ];
@@ -473,9 +473,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04bhfvc25b07jaiaf62yrach7khhr5jlr5bx6nygg8pf11329wp9";
+      sha256 = "1ijpbj7mdrq7rhpq2kb51yykhrs2s54wfs6sm9z3icgz4y6sb7rp";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.1.1";
   };
 }
diff --git a/pkgs/by-name/le/ledger-web/package.nix b/pkgs/by-name/le/ledger-web/package.nix
index 8f5a9fa3831e..21efff5a4e29 100644
--- a/pkgs/by-name/le/ledger-web/package.nix
+++ b/pkgs/by-name/le/ledger-web/package.nix
@@ -2,6 +2,7 @@
   lib,
   bundlerApp,
   bundlerUpdateScript,
+  ruby_3_4,
   withPostgresql ? true,
   libpq,
   withSqlite ? false,
@@ -13,6 +14,9 @@ bundlerApp {
   gemdir = ./.;
   exes = [ "ledger_web" ];
 
+  # "Source locally installed gems is ignoring... because it is missing extensions"
+  ruby = ruby_3_4;
+
   buildInputs = lib.optional withPostgresql libpq ++ lib.optional withSqlite sqlite;
 
   passthru.updateScript = bundlerUpdateScript "ledger-web";
@@ -22,7 +26,6 @@ bundlerApp {
     homepage = "https://github.com/peterkeen/ledger-web";
     license = licenses.mit;
     maintainers = with maintainers; [
-      peterhoeg
       manveru
       nicknovitski
     ];
diff --git a/pkgs/by-name/mo/monaspace/fonts.toml b/pkgs/by-name/mo/monaspace/fonts.toml
new file mode 100644
index 000000000000..a75179c1f3cd
--- /dev/null
+++ b/pkgs/by-name/mo/monaspace/fonts.toml
@@ -0,0 +1,38 @@
+version = "1.301"
+baseUrl = "https://github.com/githubnext/monaspace/releases/download"
+fontFamily = "monaspace"
+
+[[fonts]]
+hash = "sha256-/A5/zipWaaSpTGUBVZOE0EihJY9tu0JAH+6+gyHbDxo="
+variant = "static"
+destination = "opentype"
+
+[[fonts]]
+hash = "sha256-7O0qRA12ELPNs4919aW5rUdLs/XaLTJNthL+4Gjlx90="
+variant = "frozen"
+destination = "truetype"
+
+[[fonts]]
+hash = "sha256-cPAQBgrxIFXRjBRK9kvt3uYwewi5Lw/ryiwjUeVJWD4="
+variant = "variable"
+destination = "truetype"
+
+[[fonts]]
+hash = "sha256-3/JOe+aSSA2vxnKHjSwkxukqNYMajsIuQ68IJvY07XI="
+variant = "nerdfonts"
+destination = "opentype"
+
+[[fonts]]
+hash = "sha256-1VtGSqDSRaVfyCWP+ZQtiji/076JdZmRSI0nlzqcuHo="
+variant = "webfont-nerdfonts"
+destination = "woff"
+
+[[fonts]]
+hash = "sha256-mlK1kCun8/rUsDpNh3+dD+mDqvNdCMdIe8u9Y8ORhJ0="
+variant = "webfont-static"
+destination = "woff"
+
+[[fonts]]
+hash = "sha256-aHLPmQzPiA8HQFsz9u6UH0b8kINx/fQ74GcPDs+a1ys="
+variant = "webfont-variable"
+destination = "woff"
diff --git a/pkgs/by-name/mo/monaspace/package.nix b/pkgs/by-name/mo/monaspace/package.nix
index da3fe65ddf0f..c14cb94d37ac 100644
--- a/pkgs/by-name/mo/monaspace/package.nix
+++ b/pkgs/by-name/mo/monaspace/package.nix
@@ -1,38 +1,11 @@
 {
   lib,
+  fetchzip,
   stdenvNoCC,
-  fetchFromGitHub,
+  symlinkJoin,
 }:
-
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "monaspace";
-  version = "1.301";
-
-  src = fetchFromGitHub {
-    owner = "githubnext";
-    repo = "monaspace";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-8tPwm92ZtaXL9qeDL+ay9PdXLUBBsspdk7/0U8VO0Tg=";
-  };
-
-  outputs = [
-    "out"
-    "woff"
-  ];
-
-  installPhase = ''
-    # Install TrueType fonts
-    install -Dm644 -t $out/share/fonts/truetype fonts/Frozen\ Fonts/*/*.ttf
-    install -Dm644 -t $out/share/fonts/truetype fonts/Variable\ Fonts/*/*.ttf
-
-    # Install OpenType fonts
-    install -Dm644 -t $out/share/fonts/opentype fonts/Static\ Fonts/*/*.otf
-    install -Dm644 -t $out/share/fonts/opentype fonts/NerdFonts/*/*.otf
-
-    # Install Web fonts
-    install -Dm644 -t $woff/share/fonts/woff fonts/Web\ Fonts/*/*/*.woff
-    install -Dm644 -t $woff/share/fonts/woff fonts/Web\ Fonts/*/*/*.woff2
-  '';
+let
+  fonts = lib.importTOML ./fonts.toml;
 
   meta = {
     description = "Innovative superfamily of fonts for code";
@@ -60,4 +33,70 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     maintainers = [ ];
     platforms = lib.platforms.all;
   };
-})
+
+  makeFont =
+    {
+      pname,
+      fontFamily,
+      variant,
+      version,
+      baseUrl,
+      hash,
+      destination,
+      meta,
+    }:
+    stdenvNoCC.mkDerivation {
+      inherit pname version;
+
+      src = fetchzip {
+        url = "${baseUrl}/v${version}/${fontFamily}-${variant}-v${version}.zip";
+        inherit hash;
+      };
+
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p "$out/share/fonts/${destination}"
+        find . -type f \( -name "*.otf" -o -name "*.ttf" -o -name "*.woff" \) -exec install -Dm644 {} $out/share/fonts/${destination} \;
+
+        runHook postInstall
+      '';
+      inherit meta;
+    };
+
+  makePackages =
+    filteredFonts:
+    lib.listToAttrs (
+      map (
+        font:
+        let
+          fontAttrs = rec {
+            inherit (fonts) baseUrl fontFamily version;
+            inherit (font) variant hash destination;
+            inherit meta;
+            pname = fontFamily + "-" + variant;
+          };
+        in
+        {
+          name = fontAttrs.variant;
+          value = makeFont fontAttrs;
+        }
+      ) filteredFonts
+    );
+  allFonts = makePackages fonts.fonts;
+  woffFonts = makePackages (builtins.filter (f: f.destination == "woff") fonts.fonts);
+  defaultFonts = lib.removeAttrs allFonts (builtins.attrNames woffFonts);
+in
+symlinkJoin {
+  pname = "monaspace";
+  inherit (fonts) version;
+  paths = builtins.attrValues defaultFonts;
+  passthru = allFonts // {
+    woff = symlinkJoin {
+      pname = "monaspace-webfonts";
+      inherit (fonts) version;
+      paths = builtins.attrValues woffFonts;
+    };
+  };
+  inherit meta;
+}
diff --git a/pkgs/by-name/mo/monero-cli/package.nix b/pkgs/by-name/mo/monero-cli/package.nix
index 4ee8dbcf918a..0c32c4b96592 100644
--- a/pkgs/by-name/mo/monero-cli/package.nix
+++ b/pkgs/by-name/mo/monero-cli/package.nix
@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "monero-cli";
-  version = "0.18.4.3";
+  version = "0.18.4.4";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero";
     rev = "v${version}";
-    hash = "sha256-tu8PHTiz3ScJ0uQh1ztkFmEthjb+BERtPMxCyQhuZPw=";
+    hash = "sha256-NH15PKlkm9Hpt25iIuUQmhDg+X3Qo+yUAbDY4LNnZdM=";
   };
 
   patches = [
@@ -97,8 +97,6 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.hostPlatform.isDarwin "-DBoost_USE_MULTITHREADED=OFF"
   ++ lib.optional trezorSupport [
     "-DUSE_DEVICE_TREZOR=ON"
-    # fix build on recent gcc versions
-    "-DCMAKE_CXX_FLAGS=-fpermissive"
   ];
 
   outputs = [
diff --git a/pkgs/by-name/mo/monero-gui/package.nix b/pkgs/by-name/mo/monero-gui/package.nix
index a607427dda0e..93441d2028c5 100644
--- a/pkgs/by-name/mo/monero-gui/package.nix
+++ b/pkgs/by-name/mo/monero-gui/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.18.4.3";
+  version = "0.18.4.4";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero-gui";
     rev = "v${version}";
-    hash = "sha256-uByiwIyR1pVmIrmu0Jdwb7aZE07hop4bP+PuEvJaIrE=";
+    hash = "sha256-5jtGC0G6M3zEMedLSNIllNjpFPMEAG/5NxvnCxqO9gI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/nest-cli/package.nix b/pkgs/by-name/ne/nest-cli/package.nix
index a5c0601a8a89..cfa7f1fd7926 100644
--- a/pkgs/by-name/ne/nest-cli/package.nix
+++ b/pkgs/by-name/ne/nest-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "nest-cli";
-  version = "11.0.12";
+  version = "11.0.14";
 
   src = fetchFromGitHub {
     owner = "nestjs";
     repo = "nest-cli";
     tag = version;
-    hash = "sha256-bi9kHxAio5ya2slmrm4U/uj9+UZondI/7aEde6rHGgM=";
+    hash = "sha256-FvZRqQ/wDjEBhug99MZa/ZKcQXCF3I8fXom8hi2AQm4=";
   };
 
-  npmDepsHash = "sha256-rsgLe2wZPPHKR8ORI5ICTc5/A03x+ICetvKnltTje4k=";
+  npmDepsHash = "sha256-KnvcJqTSiW9pCt1MhwsTJmmmvwgtVK5hoLAs/B709MI=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   env = {
diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index bbcfbc326770..a363e564e599 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.10.12";
+  version = "0.10.13";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${version}";
-    hash = "sha256-zfWONw72xZy7kYl5jiBcNeCC9YU4s0juDRdeEgyeRrk=";
+    hash = "sha256-TfE2RjbCBoHcdp9st+HeVhSfTMahZdQaItOIuT8Sxcc=";
   };
 
   # No tests
diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix
index cc06ef86f91c..5932fb504015 100644
--- a/pkgs/by-name/sa/saga/package.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "saga";
-  version = "9.10.1";
+  version = "9.10.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${finalAttrs.version}.tar.gz";
-    hash = "sha256-6V7KSdaU3TkdsGr6ll7Q8oSH7/rItgSrgN7Fjn+f9dM=";
+    hash = "sha256-fsMH2dXE0w1DsIYJC3RscT/aDDYeewXLo6MBLCL2zCo=";
   };
 
   sourceRoot = "saga-${finalAttrs.version}/saga-gis";
diff --git a/pkgs/by-name/ss/sshified/package.nix b/pkgs/by-name/ss/sshified/package.nix
index 3a1a26629563..4e4135c06a63 100644
--- a/pkgs/by-name/ss/sshified/package.nix
+++ b/pkgs/by-name/ss/sshified/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "sshified";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "hoffie";
     repo = "sshified";
     tag = "v${version}";
-    hash = "sha256-oCeuQ4Do+Lyqsf8hBH9qvLxWbWQlqol481VrbnAW2ic=";
+    hash = "sha256-+YaqHkcsP6+J39w4WP5iA0LowmGwDHBoDNzT8fhv+Xg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/te/termbench-pro/package.nix b/pkgs/by-name/te/termbench-pro/package.nix
index 31a22abc6064..c5782c59e6ed 100644
--- a/pkgs/by-name/te/termbench-pro/package.nix
+++ b/pkgs/by-name/te/termbench-pro/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     fmt
-    glaze
+    (glaze.override { enableSSL = false; })
   ];
 
   installPhase = ''
diff --git a/pkgs/by-name/up/uptime-kuma/fix-database-permissions.patch b/pkgs/by-name/up/uptime-kuma/fix-database-permissions.patch
index 21fc4c59f91c..ad2000591917 100644
--- a/pkgs/by-name/up/uptime-kuma/fix-database-permissions.patch
+++ b/pkgs/by-name/up/uptime-kuma/fix-database-permissions.patch
@@ -1,12 +1,12 @@
-diff --git a/server/server.js b/server/server.js
-index 0c9a45e6..cec31c7c 100644
---- a/server/server.js
-+++ b/server/server.js
-@@ -1583,6 +1583,7 @@ async function initDatabase(testMode = false) {
-     if (! fs.existsSync(Database.path)) {
-         log.info("server", "Copying Database");
-         fs.copyFileSync(Database.templatePath, Database.path);
-+        fs.chmodSync(Database.path, 0o640);
-     }
+diff --git a/server/database.js b/server/database.js
+index d22ceb29..7490be8a 100644
+--- a/server/database.js
++++ b/server/database.js
+@@ -236,6 +236,7 @@ class Database {
+             if (! fs.existsSync(Database.sqlitePath)) {
+                 log.info("server", "Copying Database");
+                 fs.copyFileSync(Database.templatePath, Database.sqlitePath);
++                fs.chmodSync(Database.sqlitePath, 0o640);
+             }
 
-     log.info("server", "Connecting to the Database");
+             const Dialect = require("knex/lib/dialects/sqlite3/index.js");
diff --git a/pkgs/by-name/up/uptime-kuma/package.nix b/pkgs/by-name/up/uptime-kuma/package.nix
index 087f5c4c35b1..64fed0f6eed2 100644
--- a/pkgs/by-name/up/uptime-kuma/package.nix
+++ b/pkgs/by-name/up/uptime-kuma/package.nix
@@ -3,23 +3,22 @@
   stdenv,
   fetchFromGitHub,
   buildNpmPackage,
-  python3,
   nodejs,
   nixosTests,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "uptime-kuma";
-  version = "1.23.16";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "louislam";
     repo = "uptime-kuma";
-    rev = version;
-    hash = "sha256-+bhKnyZnGd+tNlsxvP96I9LXOca8FmOPhIFHp7ijmyA=";
+    tag = finalAttrs.version;
+    hash = "sha256-zW5sl1g96PvDK3S6XhJ6F369/NSnvU9uSQORCQugfvs=";
   };
 
-  npmDepsHash = "sha256-5i1NxwHqOahkioyM4wSu2X5KeMu7CdC4BqoUooAshn4=";
+  npmDepsHash = "sha256-EmSZJUbtD4FW7Rzdpue6/bV8oZt7RUL11tFBXGJQthg=";
 
   patches = [
     # Fixes the permissions of the database being not set correctly
@@ -27,10 +26,6 @@ buildNpmPackage rec {
     ./fix-database-permissions.patch
   ];
 
-  nativeBuildInputs = [ python3 ];
-
-  CYPRESS_INSTALL_BINARY = 0; # Stops Cypress from trying to download binaries
-
   postInstall = ''
     cp -r dist $out/lib/node_modules/uptime-kuma/
 
@@ -50,10 +45,10 @@ buildNpmPackage rec {
     description = "Fancy self-hosted monitoring tool";
     mainProgram = "uptime-kuma-server";
     homepage = "https://github.com/louislam/uptime-kuma";
-    changelog = "https://github.com/louislam/uptime-kuma/releases/tag/${version}";
+    changelog = "https://github.com/louislam/uptime-kuma/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ julienmalka ];
     # FileNotFoundError: [Errno 2] No such file or directory: 'xcrun'
     broken = stdenv.hostPlatform.isDarwin;
   };
-}
+})
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 593ce00e29be..71df593eb8d1 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.9.13";
+  version = "0.9.14";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-KhJN9aYWeeo3Hc7pprNkzTZS2xsogdJmK5rDKlcjWp4=";
+    hash = "sha256-3onsgWbcjci1X/nFzuZtrqAUbi4h185UUepTlz0rmOs=";
   };
 
-  cargoHash = "sha256-IZ168ImtJ4iBz23KOZzY27urHpj+PexE8IGco0Kd1eg=";
+  cargoHash = "sha256-ZjpONwxIglfft9LMsiyqbelZ1Ybn1pO2Z6/vWZibmXY=";
 
   buildInputs = [
     rust-jemalloc-sys
diff --git a/pkgs/by-name/vo/voicevox-core/onnxruntime.nix b/pkgs/by-name/vo/voicevox-core/onnxruntime.nix
new file mode 100644
index 000000000000..86e3afabdf0a
--- /dev/null
+++ b/pkgs/by-name/vo/voicevox-core/onnxruntime.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "voicevox-onnxruntime";
+  version = "1.17.3";
+
+  src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = [ stdenv.cc.cc.lib ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out"
+    cp -r ./lib "$out/lib"
+
+    runHook postInstall
+  '';
+
+  passthru.sources =
+    let
+      # Note: Only the prebuilt binaries are able to decrypt the encrypted voice models
+      fetchArtifact =
+        { id, hash }:
+        fetchurl {
+          url = "https://github.com/VOICEVOX/onnxruntime-builder/releases/download/voicevox_onnxruntime-${finalAttrs.version}/voicevox_onnxruntime-${id}-${finalAttrs.version}.tgz";
+          inherit hash;
+        };
+    in
+    {
+      "x86_64-linux" = fetchArtifact {
+        id = "linux-x64";
+        hash = "sha256-crUof91I3IM6mSn26eOCbnk7VM4SAhgb6T9jgjoiL1g=";
+      };
+      "aarch64-linux" = fetchArtifact {
+        id = "linux-arm64";
+        hash = "sha256-J27twAe2lDJPWbw1ws+QQXJOt4ZghDemSfCW7eo5Q6k=";
+      };
+      "x86_64-darwin" = fetchArtifact {
+        id = "osx-x86_64";
+        hash = "sha256-We3IYCUtu39kzC63K9SykEpt98NfM9yAgkNbnxWlBd8=";
+      };
+      "aarch64-darwin" = fetchArtifact {
+        id = "osx-arm64";
+        hash = "sha256-ltfqGSigoVSFSS03YhOH31D0CnkuKmgX1N9z7NGFcfI=";
+      };
+    };
+
+  meta = {
+    license = with lib.licenses; [
+      mit
+      {
+        name = "VOICEVOX ONNX Runtime Terms of Use";
+        url = "https://github.com/VOICEVOX/voicevox_resource/blob/main/onnxruntime/README.md";
+        free = false;
+        redistributable = true;
+      }
+    ];
+    maintainers = with lib.maintainers; [
+      tomasajt
+      eljamm
+    ];
+    platforms = lib.attrNames finalAttrs.passthru.sources;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/vo/voicevox-core/openjtalk.patch b/pkgs/by-name/vo/voicevox-core/openjtalk.patch
new file mode 100644
index 000000000000..c35ca5705574
--- /dev/null
+++ b/pkgs/by-name/vo/voicevox-core/openjtalk.patch
@@ -0,0 +1,12 @@
+diff --git a/build.rs b/build.rs
+index 3f1b971..72f722f 100644
+--- a/build.rs
++++ b/build.rs
+@@ -6,6 +6,7 @@ use std::{
+ };
+ fn main() {
+     let mut cmake_conf = cmake::Config::new("open_jtalk");
++    cmake_conf.define("FETCHCONTENT_SOURCE_DIR_OPENJTALK", "@openjtalk_src@");
+     let target = env::var("TARGET").unwrap();
+     let mut include_dirs: Vec<PathBuf> = Vec::new();
+     let cmake_conf = if target.starts_with("i686") {
diff --git a/pkgs/by-name/vo/voicevox-core/package.nix b/pkgs/by-name/vo/voicevox-core/package.nix
index be6f1e0801b7..10e99f0c29d8 100644
--- a/pkgs/by-name/vo/voicevox-core/package.nix
+++ b/pkgs/by-name/vo/voicevox-core/package.nix
@@ -1,81 +1,111 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  unzip,
-  autoPatchelfHook,
+  callPackage,
+  runCommand,
+  rustPlatform,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  python3,
+  openssl,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+let
+  openjtalk-src = fetchFromGitHub {
+    owner = "VOICEVOX";
+    repo = "open_jtalk";
+    rev = "1.11"; # this is actually a branch. why?
+    hash = "sha256-SBLdQ8D62QgktI8eI6eSNzdYt5PmGo6ZUCKxd01Z8UE=";
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "voicevox-core";
-  version = "0.15.9";
+  version = "0.16.2";
+  modelVersion = "0.16.1";
 
-  src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
+  src = fetchFromGitHub {
+    owner = "VOICEVOX";
+    repo = "voicevox_core";
+    tag = finalAttrs.version;
+    hash = "sha256-aRy9x6IzFDwL4HjhCW705LpkZ13/SJ25h45XbbXciy0=";
+  };
 
-  nativeBuildInputs = [ unzip ] ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+  cargoHash = "sha256-8udiXUZGn3ZT7RvmZd/F5tLsCKi5QLPG3pzv7LFyLvQ=";
 
-  buildInputs = [ stdenv.cc.cc.lib ];
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm755 libonnxruntime.* libvoicevox_core.* -t $out/lib
-    install -Dm644 model/* -t $out/lib/model
-    install -Dm644 *.h -t $out/include
-    install -Dm644 README.txt -t $out/share/doc/voicevox-core
-
-    runHook postInstall
+  postPatch = ''
+    cp -r --no-preserve=all ${openjtalk-src} ./openjtalk
+    substitute ${./openjtalk.patch} ./openjtalk.patch \
+      --replace-fail "@openjtalk_src@" "$(pwd)/openjtalk"
+    patch -d $cargoDepsCopy/open_jtalk-sys-* -p1 < ./openjtalk.patch
   '';
 
-  # When updating, run the following command to fetch all FODs:
-  # nix-build -A voicevox-core.sources --keep-going
-  passthru.sources =
-    let
-      # Note: Only the prebuilt binaries are able to decrypt the encrypted voice models
-      fetchCoreArtifact =
-        { id, hash }:
-        fetchurl {
-          url = "https://github.com/VOICEVOX/voicevox_core/releases/download/${finalAttrs.version}/voicevox_core-${id}-cpu-${finalAttrs.version}.zip";
-          inherit hash;
-        };
-    in
-    {
-      "x86_64-linux" = fetchCoreArtifact {
-        id = "linux-x64";
-        hash = "sha256-dEikEQcGL6h59nTxY833XGBawUjceq8NxIUVhRdQ2I8=";
-      };
-      "aarch64-linux" = fetchCoreArtifact {
-        id = "linux-arm64";
-        hash = "sha256-92aZEb2bz7xXA4uSo3lWy/cApr88I+yNqDlAWo6nFpg=";
-      };
-      "x86_64-darwin" = fetchCoreArtifact {
-        id = "osx-x64";
-        hash = "sha256-/5MghfgI8wup+o+eYMgcjI9Mjkjt1NPuN0x3JnqAlxg=";
-      };
-      "aarch64-darwin" = fetchCoreArtifact {
-        id = "osx-arm64";
-        hash = "sha256-UrgI4dy/VQCLZ/gyMX0D0YPabtw3IA76CpjLmbFLQeY=";
-      };
+  cargoBuildFlags = [ "-p voicevox_core_c_api" ];
+
+  # don't link onnxruntime directly
+  buildFeatures = [ "load-onnxruntime" ];
+
+  # setting this to anything disables trying to download onnxruntime
+  env.ORT_LIB_LOCATION = "dummy";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [ openssl ];
+
+  doCheck = false;
+
+  passthru.voicevox-onnxruntime = callPackage ./onnxruntime.nix { };
+
+  passthru.models = stdenv.mkDerivation {
+    pname = "voicevox-models";
+    version = finalAttrs.modelVersion;
+
+    src = fetchFromGitHub {
+      owner = "VOICEVOX";
+      repo = "voicevox_vvm";
+      tag = finalAttrs.modelVersion;
+      hash = "sha256-OY+xuvNjgmH/bxhL61XJZ3JVOxyec6kifkoGD4eN7HA=";
     };
 
+    nativeBuildInputs = [ python3 ];
+
+    installPhase = ''
+      runHook preInstall
+
+      # convert multipart zip archive into single file
+      python scripts/merge_vvm.py
+      mkdir -p "$out"
+      cp vvms/* "$out"
+
+      runHook postInstall
+    '';
+  };
+
+  passthru.wrapped = runCommand "voicevox-core-${finalAttrs.version}-wrapped" { } (
+    ''
+      mkdir -p "$out"/lib
+      cp ${finalAttrs.finalPackage}/lib/* "$out"/lib
+      chmod -R +w "$out/lib"
+      ln -s ${finalAttrs.passthru.voicevox-onnxruntime}/lib/* "$out"/lib
+      ln -s ${finalAttrs.passthru.models} "$out"/lib/model
+    ''
+    # allow loading sibling onnxruntime library
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf --add-rpath '$ORIGIN' "$out"/lib/libvoicevox_core*
+    ''
+  );
+
   meta = {
     changelog = "https://github.com/VOICEVOX/voicevox_core/releases/tag/${finalAttrs.version}";
     description = "Core library for the VOICEVOX speech synthesis software";
     homepage = "https://github.com/VOICEVOX/voicevox_core";
-    license = with lib.licenses; [
-      mit
-      {
-        name = "VOICEVOX Core Library Terms of Use";
-        url = "https://github.com/VOICEVOX/voicevox_resource/blob/main/core/README.md";
-        free = false;
-        redistributable = true;
-      }
-    ];
+    license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [
       tomasajt
       eljamm
     ];
-    platforms = lib.attrNames finalAttrs.passthru.sources;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 })
diff --git a/pkgs/by-name/vo/voicevox-engine/package.nix b/pkgs/by-name/vo/voicevox-engine/package.nix
index 9bf523418e67..2995e9a6f85d 100644
--- a/pkgs/by-name/vo/voicevox-engine/package.nix
+++ b/pkgs/by-name/vo/voicevox-engine/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "voicevox-engine";
-  version = "0.24.1";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
     repo = "voicevox_engine";
     tag = version;
-    hash = "sha256-WoHTv4VjLFJPIi47WETMQM8JmgBctAWlue8yKmi1+6A=";
+    hash = "sha256-ZthTXHXzexbffWoi8AKJrgX9/gd7fmKbYpCwuZZiQWQ=";
   };
 
   patches = [
@@ -35,6 +35,7 @@ python3Packages.buildPythonApplication rec {
     kanalizer
     numpy
     platformdirs
+    psutil
     pydantic
     python-multipart
     pyworld
@@ -52,6 +53,10 @@ python3Packages.buildPythonApplication rec {
     "fastapi-slim"
   ];
 
+  pythonRelaxDeps = [
+    "psutil" # at the time of writing, psutil has not reached version 7.1.1
+  ];
+
   preConfigure = ''
     # copy demo metadata to temporary directory
     mv resources/character_info test_character_info
@@ -73,7 +78,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   makeWrapperArgs = [
-    ''--add-flags "--voicelib_dir=${voicevox-core}/lib"''
+    ''--add-flags "--voicelib_dir=${voicevox-core.wrapped}/lib"''
   ];
 
   preCheck = ''
@@ -98,7 +103,7 @@ python3Packages.buildPythonApplication rec {
       owner = "VOICEVOX";
       repo = "voicevox_resource";
       tag = version;
-      hash = "sha256-4D9b5MjJQq+oCqSv8t7CILgFcotbNBH3m2F/up12pPE=";
+      hash = "sha256-yj3bwEB1qeoXAf3Dr02FF/HB6g7toAd2VUmR2937yzc=";
     };
 
     pyopenjtalk = python3Packages.callPackage ./pyopenjtalk.nix { };
diff --git a/pkgs/by-name/vo/voicevox/hardcode-paths.patch b/pkgs/by-name/vo/voicevox/hardcode-paths.patch
index 9fc62c5f6b72..013d2fa79489 100644
--- a/pkgs/by-name/vo/voicevox/hardcode-paths.patch
+++ b/pkgs/by-name/vo/voicevox/hardcode-paths.patch
@@ -11,15 +11,15 @@ index cc5e2b9..29140f8 100644
          "executionArgs": [],
          "host": "http://127.0.0.1:50021"
      }
-diff --git a/electron-builder.config.cjs b/electron-builder.config.cjs
-index d2a21b4..7b338c0 100644
---- a/electron-builder.config.cjs
-+++ b/electron-builder.config.cjs
-@@ -40,17 +40,6 @@ const isArm64 = process.arch === "arm64";
+diff --git a/build/electronBuilderConfig.ts b/build/electronBuilderConfig.ts
+index 83dcc10..114fb9d 100644
+--- a/build/electronBuilderConfig.ts
++++ b/build/electronBuilderConfig.ts
+@@ -45,17 +45,6 @@ const isArm64 = process.arch === "arm64";
  // cf: https://k-hyoda.hatenablog.com/entry/2021/10/23/000349#%E8%BF%BD%E5%8A%A0%E5%B1%95%E9%96%8B%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E5%85%88%E3%81%AE%E8%A8%AD%E5%AE%9A
  const extraFilePrefix = isMac ? "MacOS/" : "";
  
--const sevenZipFile = readdirSync(resolve(__dirname, "vendored", "7z")).find(
+-const sevenZipFile = readdirSync(path.join(rootDir, "vendored", "7z")).find(
 -  // Windows: 7za.exe, Linux: 7zzs, macOS: 7zz
 -  (fileName) => ["7za.exe", "7zzs", "7zz"].includes(fileName),
 -);
@@ -30,29 +30,29 @@ index d2a21b4..7b338c0 100644
 -  );
 -}
 -
- /** @type {import("electron-builder").Configuration} */
- const builderOptions = {
+ const builderOptions: ElectronBuilderConfiguration = {
    beforeBuild: async () => {
-@@ -91,14 +80,6 @@ const builderOptions = {
+     if (existsSync(path.join(rootDir, "dist_electron"))) {
+@@ -97,14 +86,6 @@ const builderOptions: ElectronBuilderConfiguration = {
        from: "build/README.txt",
        to: extraFilePrefix + "README.txt",
      },
 -    {
 -      from: VOICEVOX_ENGINE_DIR,
--      to: join(extraFilePrefix, "vv-engine"),
+-      to: path.join(extraFilePrefix, "vv-engine"),
 -    },
 -    {
--      from: resolve(__dirname, "vendored", "7z", sevenZipFile),
+-      from: path.join(rootDir, "vendored", "7z", sevenZipFile),
 -      to: extraFilePrefix + sevenZipFile,
 -    },
    ],
    // electron-builder installer
    productName: "VOICEVOX",
 diff --git a/src/backend/electron/vvppFile.ts b/src/backend/electron/vvppFile.ts
-index 7e152f1..1aaa8c4 100644
+index f649bf8..de2f3fa 100644
 --- a/src/backend/electron/vvppFile.ts
 +++ b/src/backend/electron/vvppFile.ts
-@@ -220,6 +220,7 @@ export class VvppFileExtractor {
+@@ -224,6 +224,7 @@ export class VvppFileExtractor {
    }
  
    private getSevenZipPath(): string {
@@ -60,3 +60,26 @@ index 7e152f1..1aaa8c4 100644
      let sevenZipPath = import.meta.env.VITE_7Z_BIN_NAME;
      if (!sevenZipPath) {
        throw new Error("7z path is not defined");
+diff --git a/vite.config.ts b/vite.config.ts
+index 3c9e029..c253a6a 100644
+--- a/vite.config.ts
++++ b/vite.config.ts
+@@ -5,7 +5,6 @@ import { rm } from "node:fs/promises";
+ import electronPlugin from "vite-plugin-electron/simple";
+ import tsconfigPaths from "vite-tsconfig-paths";
+ import vue from "@vitejs/plugin-vue";
+-import electronDefaultImport from "electron";
+ import checker from "vite-plugin-checker";
+ import { BuildOptions, defineConfig, loadEnv, Plugin } from "vite";
+ import { quasar } from "@quasar/vite-plugin";
+@@ -17,9 +16,7 @@ import {
+   SourceFile,
+ } from "./tools/checkSuspiciousImports.js";
+ 
+-// @ts-expect-error electronをelectron環境外からimportするとelectronのファイルパスが得られる。
+-// https://github.com/electron/electron/blob/a95180e0806f4adba8009f46124b6bb4853ac0a6/npm/index.js
+-const electronPath = electronDefaultImport as string;
++const electronPath = "@electron_path@";
+ 
+ const nodeTestPaths = ["../tests/unit/**/*.node.{test,spec}.ts"];
+ const browserTestPaths = ["../tests/unit/**/*.browser.{test,spec}.ts"];
diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index 3b6b99dd7137..5763fc217fd5 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -11,7 +11,7 @@
   makeWrapper,
   moreutils,
   nodejs,
-  pnpm_9,
+  pnpm_10,
 
   _7zz,
   electron,
@@ -19,21 +19,22 @@
 }:
 
 let
-  pnpm = pnpm_9;
+  pnpm = pnpm_10;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "voicevox";
-  version = "0.24.2";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
     repo = "voicevox";
     tag = finalAttrs.version;
-    hash = "sha256-ploFrzxIseyUD7LINnFmshrg3QJV8KUkdbvDoJ/VkRk=";
+    hash = "sha256-s8+uHwqxK9my/850C52VT5kshlGrHOOHtopUlsowNeI=";
   };
 
   patches = [
     (replaceVars ./hardcode-paths.patch {
+      electron_path = lib.getExe electron;
       sevenzip_path = lib.getExe _7zz;
       voicevox_engine_path = lib.getExe voicevox-engine;
     })
@@ -41,11 +42,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     # unlock the overly specific pnpm package version pin
-    jq 'del(.packageManager)' package.json | sponge package.json
-
-    substituteInPlace package.json \
-      --replace-fail "999.999.999" "$version" \
-      --replace-fail ' && electron-builder --config electron-builder.config.cjs --publish never' ""
+    # and also set version to a proper value
+    jq "del(.packageManager) | .version = \"$version\"" package.json | sponge package.json
   '';
 
   pnpmDeps = pnpm.fetchDeps {
@@ -65,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
     fetcherVersion = 1;
-    hash = "sha256-RKgqFmHQnjHS7yeUIbH9awpNozDOCCHplc/bmfxmMyg=";
+    hash = "sha256-no0oFhy7flet9QH4FEkPJdlwNq5YkjIx8Uat3M2ruKI=";
   };
 
   nativeBuildInputs = [
@@ -96,11 +94,11 @@ stdenv.mkDerivation (finalAttrs: {
     chmod -R u+w electron-dist
 
     # note: we patched out the call to electron-builder in postPatch
-    pnpm run electron:build
+    pnpm run electron:build:compile
 
     pnpm exec electron-builder \
       --dir \
-      --config electron-builder.config.cjs \
+      --config ./build/electronBuilderConfigLoader.cjs \
       -c.electronDist=electron-dist \
       -c.electronVersion=${electron.version}
 
diff --git a/pkgs/by-name/vu/vulnix/package.nix b/pkgs/by-name/vu/vulnix/package.nix
index 0b53d2c6e3a9..4ba030e97b36 100644
--- a/pkgs/by-name/vu/vulnix/package.nix
+++ b/pkgs/by-name/vu/vulnix/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vulnix";
-  version = "1.12.1";
+  version = "1.12.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "vulnix";
     tag = version;
-    hash = "sha256-Nxhv3K/wF7AYi5kTJxL2pjiDWgWN+27wKsMXf0yaXrk=";
+    hash = "sha256-RHYiwIWV7gf4Ty70ECY3RLouNZAEG5uxjq0+K4LK5QU=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/by-name/wa/wamr/package.nix b/pkgs/by-name/wa/wamr/package.nix
index ed2f3f319bde..90db2a2e0373 100644
--- a/pkgs/by-name/wa/wamr/package.nix
+++ b/pkgs/by-name/wa/wamr/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wamr";
-  version = "2.4.2";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-micro-runtime";
     tag = "WAMR-${finalAttrs.version}";
-    hash = "sha256-eSBcAGUDAys85LCZwNainiShZzkVMuA3g3fRlHN1dP0=";
+    hash = "sha256-pNudBKnhdR/Ye0m2tVZB/wSfJZYK8+gdCpCp0rDp0o4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/wo/workset/package.nix b/pkgs/by-name/wo/workset/package.nix
new file mode 100644
index 000000000000..78f18ad21b8b
--- /dev/null
+++ b/pkgs/by-name/wo/workset/package.nix
@@ -0,0 +1,41 @@
+{
+  fetchFromGitHub,
+  rustPlatform,
+  lib,
+  versionCheckHook,
+  pkg-config,
+  nix-update-script,
+  git,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "workset";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "fossable";
+    repo = "workset";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aLSpgxTnyloMbCAIf2Uk9w0niJcJ2XZvcIl+T8Dq40U=";
+  };
+
+  cargoHash = "sha256-5bOWtKpC4ZtU5gMvwErd7Xqy+awjp7QlnQIFQ+eHGoA=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  nativeCheckInputs = [ git ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "workset";
+    description = "Manage git repos with working sets";
+    homepage = "https://github.com/fossable/workset";
+    license = lib.licenses.unlicense;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ cilki ];
+  };
+})
diff --git a/pkgs/by-name/ws/wsl2-ssh-agent/package.nix b/pkgs/by-name/ws/wsl2-ssh-agent/package.nix
index 9814b2a4c651..7d2d381381a9 100644
--- a/pkgs/by-name/ws/wsl2-ssh-agent/package.nix
+++ b/pkgs/by-name/ws/wsl2-ssh-agent/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "wsl2-ssh-agent";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchFromGitHub {
     owner = "mame";
     repo = "wsl2-ssh-agent";
     tag = "v${version}";
-    hash = "sha256-oFlp6EIh32tuqBuLlSjURpl85bzw1HymJplXoGJAM8k=";
+    hash = "sha256-7hibPeYoBxhdf+nQy/xUtR4piMP3vddGSNfQwleOgyk=";
   };
 
   vendorHash = "sha256-YnqpP+JkbdkCtmuhqHnKqRfKogl+tGdCG11uIbyHtlI=";
diff --git a/pkgs/development/octave-modules/financial/default.nix b/pkgs/development/octave-modules/financial/default.nix
index 5c7dbbe0c145..bded9c443f48 100644
--- a/pkgs/development/octave-modules/financial/default.nix
+++ b/pkgs/development/octave-modules/financial/default.nix
@@ -2,17 +2,22 @@
   buildOctavePackage,
   lib,
   fetchurl,
+  statistics,
 }:
 
 buildOctavePackage rec {
   pname = "financial";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "0f963yg6pwvrdk5fg7b71ny47gzy48nqxdzj2ngcfrvmb5az4vmf";
+    sha256 = "sha256-C5BohrTHVMaDrV9GTbp5d0OvXR+szQMjV5hvONFtP7s=";
   };
 
+  requiredOctavePackages = [
+    statistics
+  ];
+
   meta = {
     homepage = "https://gnu-octave.github.io/packages/financial/";
     license = lib.licenses.gpl3Plus;
diff --git a/pkgs/development/python-modules/bosch-alarm-mode2/default.nix b/pkgs/development/python-modules/bosch-alarm-mode2/default.nix
index 279a3bacc00b..51244df2d063 100644
--- a/pkgs/development/python-modules/bosch-alarm-mode2/default.nix
+++ b/pkgs/development/python-modules/bosch-alarm-mode2/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "bosch-alarm-mode2";
-  version = "0.4.8";
+  version = "0.4.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mag1024";
     repo = "bosch-alarm-mode2";
     tag = "v${version}";
-    hash = "sha256-UafhNafZ1qb/OYXSvMGaIzDxVGf4jVmdGyv4xrcU43g=";
+    hash = "sha256-XpLMPFi3e6iTtKGfVXN4VbnPyNLVjSFrodyFK+zelF4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-filer/default.nix b/pkgs/development/python-modules/django-filer/default.nix
index 4642e9302cbd..35723823656f 100644
--- a/pkgs/development/python-modules/django-filer/default.nix
+++ b/pkgs/development/python-modules/django-filer/default.nix
@@ -31,7 +31,8 @@ buildPythonPackage rec {
     django
     django-polymorphic
     easy-thumbnails
-  ];
+  ]
+  ++ easy-thumbnails.optional-dependencies.svg;
 
   optional-dependencies = {
     heif = [ pillow-heif ];
diff --git a/pkgs/development/python-modules/django-pglock/default.nix b/pkgs/development/python-modules/django-pglock/default.nix
index 6f6837c940f1..41a321cfefb7 100644
--- a/pkgs/development/python-modules/django-pglock/default.nix
+++ b/pkgs/development/python-modules/django-pglock/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "django-pglock";
-  version = "1.7.2";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AmbitionEng";
     repo = "django-pglock";
     tag = version;
-    hash = "sha256-FKAIftHNpfGzED0nkrLv3gVhfS7lyqfwZ1mEKsw/Vc8=";
+    hash = "sha256-IXP7iZmGx0Odn73Tje/UkIpEkHCLhz42kLJppgy2nuU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/easy-thumbnails/default.nix b/pkgs/development/python-modules/easy-thumbnails/default.nix
index fdf598660a65..ede2bfedfc46 100644
--- a/pkgs/development/python-modules/easy-thumbnails/default.nix
+++ b/pkgs/development/python-modules/easy-thumbnails/default.nix
@@ -41,6 +41,9 @@ buildPythonPackage rec {
   dependencies = [
     django
     pillow
+  ];
+
+  optional-dependencies.svg = [
     reportlab
     svglib
   ];
@@ -48,7 +51,8 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pytest-django
-  ];
+  ]
+  ++ lib.concatAttrValues optional-dependencies;
 
   checkInputs = [ testfixtures ];
 
diff --git a/pkgs/development/python-modules/python-sql/default.nix b/pkgs/development/python-modules/python-sql/default.nix
index f42a3cf0d79c..837310349afb 100644
--- a/pkgs/development/python-modules/python-sql/default.nix
+++ b/pkgs/development/python-modules/python-sql/default.nix
@@ -1,33 +1,35 @@
 {
   lib,
-  fetchPypi,
+  fetchFromGitLab,
   buildPythonPackage,
   pytestCheckHook,
-  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "python-sql";
-  version = "1.6.0";
-  format = "setuptools";
+  version = "1.7.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    pname = "python_sql";
-    inherit version;
-    hash = "sha256-WzShJOitdMU6zZckhoS1v7tFODiPZnZmKYGjJxg+w2w=";
+  src = fetchFromGitLab {
+    domain = "foss.heptapod.net";
+    owner = "tryton";
+    repo = "python-sql";
+    tag = version;
+    hash = "sha256-JhMJEng6QftWBmJIC2pYlf9fkHHmSd3k0tSwr35MmVQ=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "sql" ];
 
-  meta = with lib; {
+  meta = {
     description = "Library to write SQL queries in a pythonic way";
     homepage = "https://foss.heptapod.net/tryton/python-sql";
-    changelog = "https://foss.heptapod.net/tryton/python-sql/-/blob/${version}/CHANGELOG";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ johbo ];
+    changelog = "https://foss.heptapod.net/tryton/python-sql/-/blob/${src.tag}/CHANGELOG";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ johbo ];
   };
 }
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 16ae631686e4..7526dc01c6ba 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -158,6 +158,15 @@ buildPythonPackage {
       "test_uint64_max"
       "test_large_m4" # https://github.com/scipy/scipy/issues/22466
     ]
+    ++ lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) [
+      # https://github.com/scipy/scipy/issues/24090
+      "test_cython_api"
+      "test_distance_transform_cdt05"
+      "test_eval_chebyt_gh20129"
+      "test_hyp0f1"
+      "test_hyp0f1_gh5764"
+      "test_simple_det_shapes_real_complex"
+    ]
     ++ lib.optionals (python.isPy311) [
       # https://github.com/scipy/scipy/issues/22789 Observed only with Python 3.11
       "test_funcs"
diff --git a/pkgs/development/python-modules/textual/default.nix b/pkgs/development/python-modules/textual/default.nix
index dad291e0421e..adb583789998 100644
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "textual";
-  version = "6.7.0";
+  version = "6.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Textualize";
     repo = "textual";
     tag = "v${version}";
-    hash = "sha256-hOjTrZNKjqqv0DnMuJRP62AQ3tzdqHmIf0rsQPVvd8s=";
+    hash = "sha256-JFu30awU50geQI6JMF/3h9ij/fYwczWS22zp9LXtWDk=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index d286bb524968..82432a9773df 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -562,19 +562,24 @@ let
         DRM_DP_CEC = whenOlder "6.10" yes;
         DRM_DISPLAY_DP_AUX_CEC = whenAtLeast "6.10" yes;
       }
+      //
+        lib.optionalAttrs
+          (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux")
+          {
+            # Enable Hyper-V guest stuff
+            HYPERV = lib.mkMerge [
+              (whenOlder "6.18" module)
+              (whenAtLeast "6.18" yes)
+            ];
+            # Enable Hyper-V Synthetic DRM Driver
+            DRM_HYPERV = whenAtLeast "5.14" module;
+            # And disable the legacy framebuffer driver when we have the new one
+            FB_HYPERV = whenAtLeast "5.14" no;
+          }
       // lib.optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
         # Intel GVT-g graphics virtualization supports 64-bit only
         DRM_I915_GVT = yes;
         DRM_I915_GVT_KVMGT = module;
-        # Enable Hyper-V guest stuff
-        HYPERV = lib.mkMerge [
-          (whenOlder "6.18" module)
-          (whenAtLeast "6.18" yes)
-        ];
-        # Enable Hyper-V Synthetic DRM Driver
-        DRM_HYPERV = whenAtLeast "5.14" module;
-        # And disable the legacy framebuffer driver when we have the new one
-        FB_HYPERV = whenAtLeast "5.14" no;
       }
       // lib.optionalAttrs (stdenv.hostPlatform.system == "aarch64-linux") {
         # enable HDMI-CEC on RPi boards
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index 2ca28f659af8..00020e77f0b5 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -99,7 +99,6 @@ postgresqlBuildExtension (finalAttrs: {
       isCross = stdenv.hostPlatform.config != stdenv.buildPlatform.config;
     in
     [
-      (lib.enableFeature false "extension-upgrades-install")
       (lib.withFeatureAs true "pgconfig" "${postgresql.pg_config}/bin/pg_config")
       (lib.withFeatureAs true "gdalconfig" "${gdal}/bin/gdal-config")
       (lib.withFeatureAs true "jsondir" (lib.getDev json_c))