diff --git a/lib/default.nix b/lib/default.nix
index d45e6de0c33f..875a1b9bb3ef 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -287,6 +287,7 @@ let
         init
         crossLists
         unique
+        uniqueStrings
         allUnique
         intersectLists
         subtractLists
diff --git a/lib/lists.nix b/lib/lists.nix
index ec0fe22d2afa..226e264176a0 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -11,7 +11,7 @@ let
     warn
     pipe
     ;
-  inherit (lib.attrsets) mapAttrs;
+  inherit (lib.attrsets) mapAttrs attrNames;
   inherit (lib) max;
 in
 rec {
@@ -1839,6 +1839,10 @@ rec {
   /**
     Remove duplicate elements from the `list`. O(n^2) complexity.
 
+    :::{.note}
+    If the list only contains strings and order is not important, the complexity can be reduced to O(n log n) by using [`lib.lists.uniqueStrings`](#function-library-lib.lists.uniqueStrings) instead.
+    :::
+
     # Inputs
 
     `list`
@@ -1864,6 +1868,43 @@ rec {
   */
   unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [ ];
 
+  /**
+    Removes duplicate strings from the `list`. O(n log n) complexity.
+
+    :::{.note}
+    Order is not preserved.
+
+    All elements of the list must be strings without context.
+
+    This function fails when the list contains a non-string element or a [string with context](https://nix.dev/manual/nix/latest/language/string-context.html).
+    In that case use [`lib.lists.unique`](#function-library-lib.lists.unique) instead.
+    :::
+
+    # Inputs
+
+    `list`
+
+    : List of strings
+
+    # Type
+
+    ```
+    uniqueStrings :: [ String ] -> [ String ]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.lists.uniqueStrings` usage example
+
+    ```nix
+    uniqueStrings [ "foo" "bar" "foo" ]
+    => [ "bar" "foo" ] # order is not preserved
+    ```
+
+    :::
+  */
+  uniqueStrings = list: attrNames (groupBy id list);
+
   /**
     Check if list contains only unique elements. O(n^2) complexity.
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 22188b4b3bae..880396a0de72 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -113,6 +113,7 @@ let
     toIntBase10
     toShellVars
     types
+    uniqueStrings
     updateManyAttrsByPath
     versions
     xor
@@ -1940,6 +1941,69 @@ runTests {
     expected = false;
   };
 
+  testUniqueStrings_empty = {
+    expr = uniqueStrings [ ];
+    expected = [ ];
+  };
+  testUniqueStrings_singles = {
+    expr = uniqueStrings [
+      "all"
+      "unique"
+      "already"
+    ];
+    expected = [
+      "all"
+      "already"
+      "unique"
+    ];
+  };
+  testUniqueStrings_allDuplicates = {
+    expr = uniqueStrings [
+      "dup"
+      "dup"
+      "dup"
+    ];
+    expected = [ "dup" ];
+  };
+  testUniqueStrings_some_duplicates = {
+    expr = uniqueStrings [
+      "foo"
+      "foo"
+      "bar"
+      "bar"
+      "baz"
+    ];
+    expected = [
+      "bar"
+      "baz"
+      "foo"
+    ];
+  };
+  testUniqueStrings_unicode = {
+    expr = uniqueStrings [
+      "café"
+      "@"
+      "#"
+      "@"
+      "#"
+      "$"
+      "😎"
+      "😎"
+      "🙃"
+      ""
+      ""
+    ];
+    expected = [
+      ""
+      "#"
+      "$"
+      "@"
+      "café"
+      "😎"
+      "🙃"
+    ];
+  };
+
   # ATTRSETS
 
   testConcatMapAttrs = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9ed80895b3d0..f1c1d31ef1a3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10778,10 +10778,10 @@
     name = "Ilham AM";
   };
   ilian = {
-    email = "ilian@tuta.io";
+    email = "nixos@ilian.dev";
     github = "ilian";
     githubId = 25505957;
-    name = "Ilian";
+    name = "ilian";
   };
   iliayar = {
     email = "iliayar3@gmail.com";
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
index dc3bf597cd4b..06e5644f76e9 100644
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@@ -34,7 +34,7 @@ in
       ];
     };
 
-    boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;
+    boot.kernelPackages = mkDefault pkgs.linuxKernel.packages.linux_hardened;
 
     nix.settings.allowed-users = mkDefault [ "@users" ];
 
diff --git a/nixos/modules/services/audio/mympd.nix b/nixos/modules/services/audio/mympd.nix
index d6507133366d..3e728abaa4de 100644
--- a/nixos/modules/services/audio/mympd.nix
+++ b/nixos/modules/services/audio/mympd.nix
@@ -61,7 +61,7 @@ in
               description = ''
                 Whether to enable listening on the SSL port.
 
-                Refer to <https://jcorporation.github.io/myMPD/configuration/configuration-files#ssl-options>
+                Refer to <https://jcorporation.github.io/myMPD/020-configuration/configuration-files#ssl-options>
                 for more information.
               '';
               default = false;
@@ -70,7 +70,7 @@ in
         };
         description = ''
           Manages the configuration files declaratively. For all the configuration
-          options, see <https://jcorporation.github.io/myMPD/configuration/configuration-files>.
+          options, see <https://jcorporation.github.io/myMPD/020-configuration/configuration-files>.
 
           Each key represents the "File" column from the upstream configuration table, and the
           value is the content of that file.
diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix
index 34e0597777a6..63e833dd7fb3 100644
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@@ -35,14 +35,8 @@ let
     ) args);
   kernels = pkgs.linuxKernel.vanillaPackages // {
     inherit (pkgs.linuxKernel.packages)
-      linux_5_4_hardened
-      linux_5_10_hardened
-      linux_5_15_hardened
-      linux_6_1_hardened
-      linux_6_6_hardened
       linux_6_12_hardened
-      linux_6_13_hardened
-      linux_6_14_hardened
+      linux_6_15_hardened
       linux_rt_5_4
       linux_rt_5_10
       linux_rt_5_15
diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
index 53f57d737d2e..49e97d731593 100644
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   autoreconfHook,
   pkg-config,
   util-linux,
@@ -21,20 +22,30 @@
   python3,
   withGui,
   withWallet ? true,
+  gnupg,
+  # Signatures from the following GPG public keys checked during verification of the source code.
+  # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
+  builderKeys ? [
+    "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
+    "32FE1E61B1C711186CA378DEFD8981F1BC41ABB9" # oomahq.gpg
+    "CACC7CBB26B3D2EE8FC2F2BC0E37EBAB8574F005" # leo-haf.gpg
+  ],
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
   version = "28.1.knots20250305";
 
   src = fetchurl {
-    url = "https://bitcoinknots.org/files/28.x/${version}/bitcoin-${version}.tar.gz";
+    url = "https://bitcoinknots.org/files/28.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
+    # hash retrieved from signed SHA256SUMS
     hash = "sha256-DKO3+43Tn/BTKQVrLrCkeMtzm8SfbaJD8rPlb6lDA8A=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
+    gnupg
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
@@ -58,11 +69,58 @@ stdenv.mkDerivation rec {
     qttools
   ];
 
+  preUnpack =
+    let
+      majorVersion = lib.versions.major finalAttrs.version;
+
+      publicKeys = fetchFromGitHub {
+        owner = "bitcoinknots";
+        repo = "guix.sigs";
+        rev = "b998306d462f39b6077518521700d7156fec76b8";
+        sha256 = "sha256-q4tumAfTr828AZNOa9ia7Y0PYoe6W47V/7SEApTzl3w=";
+      };
+
+      checksums = fetchurl {
+        url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS";
+        hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs=";
+      };
+
+      signatures = fetchurl {
+        url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
+        hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo=";
+      };
+
+      verifyBuilderKeys =
+        let
+          script = publicKey: ''
+            echo "Checking if public key ${publicKey} signed the checksum file..."
+            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
+            echo "OK"
+          '';
+        in
+        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
+    in
+    ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
+      ln -s ${checksums} ./SHA256SUMS
+      ln -s ${signatures} ./SHA256SUMS.asc
+      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
+      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
+      ${verifyBuilderKeys}
+      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
+      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
+      sha256sum -c SHA256SUMS.filtered
+      popd
+    '';
+
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--disable-bench"
   ]
-  ++ lib.optionals (!doCheck) [
+  ++ lib.optionals (!finalAttrs.doCheck) [
     "--disable-tests"
     "--disable-gui-tests"
   ]
@@ -90,7 +148,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Derivative of Bitcoin Core with a collection of improvements";
     homepage = "https://bitcoinknots.org/";
-    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${version}/doc/release-notes.md";
+    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${finalAttrs.version}/doc/release-notes.md";
     maintainers = with lib.maintainers; [
       prusnak
       mmahut
@@ -98,4 +156,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 809f8665050f..1c63e4293929 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   cmake,
   pkg-config,
   installShellFiles,
@@ -23,6 +24,16 @@
   withGui,
   withWallet ? true,
   enableTracing ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic,
+  gnupg,
+  # Signatures from the following GPG public keys checked during verification of the source code.
+  # The list can be found at https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys
+  builderKeys ? [
+    "152812300785C96444D3334D17565732E08E5E41" # achow101.gpg
+    "9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg
+    "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg
+    "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg
+    "D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg
+  ],
 }:
 
 let
@@ -48,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
     installShellFiles
+    gnupg
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     autoSignDarwinBinariesHook
@@ -70,6 +82,51 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
   ];
 
+  preUnpack =
+    let
+      publicKeys = fetchFromGitHub {
+        owner = "bitcoin-core";
+        repo = "guix.sigs";
+        rev = "a788388207bd244d5ab07b31ecd6c126f213a6c6";
+        sha256 = "sha256-gbenuEWP6pqY9ywPd/yZy6QfWI7jvSObwto27DRXjGI=";
+      };
+
+      checksums = fetchurl {
+        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
+        hash = "sha256-lOwVH0UqIhOT0I9rAvswuqy+tZ8ZRhH0kGnn9VCbRv4=";
+      };
+
+      signatures = fetchurl {
+        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
+        hash = "sha256-s05cRmZ9aoPdSZTaz6D6qmVwX6OprqxynPn5vZQ7bbw=";
+      };
+
+      verifyBuilderKeys =
+        let
+          script = publicKey: ''
+            echo "Checking if public key ${publicKey} signed the checksum file..."
+            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
+            echo "OK"
+          '';
+        in
+        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
+    in
+    ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
+      ln -s ${checksums} ./SHA256SUMS
+      ln -s ${signatures} ./SHA256SUMS.asc
+      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
+      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
+      ${verifyBuilderKeys}
+      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
+      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
+      sha256sum -c SHA256SUMS.filtered
+      popd
+    '';
+
   postInstall = ''
     cd ..
     installShellCompletion --bash contrib/completions/bash/bitcoin-cli.bash
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index 773b149a0b6f..e5e031b2b1f4 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -28,13 +28,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "tiled";
-  version = "1.11.90";
+  # nixpkgs-update: no auto update
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "mapeditor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gGsozdFEE5c315DF+EsIY9wGv50wwrOBycejTkVwEHA=";
+    sha256 = "sha256-9oUKn51MQcsStgIJrp9XW5YAIpAUcO0kzfGnYA3gz/E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
index ba0190c093d1..3afecf4ffc90 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -12,18 +12,18 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2025-08-06";
+  version = "0.0.27-unstable-2025-08-14";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "2fc63d4128d2dc2fef0913c7480b4586959ebe4e";
-    hash = "sha256-hHa300Ldszsnp6AuYVJwOFc5FfuRTd3phyM6/qBUIQo=";
+    rev = "be0937a459624ce1170f158f9d8660d0ade47eb4";
+    hash = "sha256-1NzzyWW2Tp91wa+Ujv2cDTv/Cb/HgA6LiDuwxVWdJwU=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-8mBpzndz34RrmhJYezd4hLrJyhVL4S4IHK3plaue1k8=";
+    cargoHash = "sha256-pTWCT2s820mjnfTscFnoSKC37RE7DAPKxP71QuM+JXQ=";
 
     nativeBuildInputs = [
       pkg-config
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index 2fbae3a49af2..5190b6e64404 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-08-01";
+  version = "0-unstable-2025-08-20";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "40e400ab084175d3bd0f9e10cf8d6ac78c8b9544";
-    hash = "sha256-k/w1tmuGuRD98bR/kmc/9pLFGeobHMhKQapJOv8qVJo=";
+    rev = "9c5408a6d3fff939ae06a319c2fce3aa6f2a4d69";
+    hash = "sha256-AH/XVN7Ah2DzN8/jlagOEAsNSciQMf8WBhfdC7YIMHw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index c33f3c4cef0e..c0f63b9f11f5 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -33,6 +33,7 @@
   librsvg,
   libwmf,
   zlib,
+  xz,
   libzip,
   ghostscript,
   aalib,
@@ -175,6 +176,7 @@ stdenv.mkDerivation (finalAttrs: {
     librsvg
     libwmf
     zlib
+    xz
     libzip
     ghostscript
     aalib
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 51e79dbef9b2..9d1f0d72bd68 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -17,7 +17,7 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.70.3";
+  version = "1.71.0";
 
   outputs = [
     "out"
@@ -28,10 +28,10 @@ buildGoModule rec {
     owner = "rclone";
     repo = "rclone";
     tag = "v${version}";
-    hash = "sha256-3MQyziA+Xq8oSOvex4WeeXs8rPDOcSkLHUH0Fcg8ENs=";
+    hash = "sha256-qTxmcTBZzbQe0TC/MRn9KTKWb/mSWne7L1cQ79AE9bA=";
   };
 
-  vendorHash = "sha256-/A9Sq7KlHitqHxvElVMQtuXUWhweiB0ukut7AJYaJHw=";
+  vendorHash = "sha256-Hapwa+WYz6a22HauRjRUl7q0ZlwR/j/zwex0VebgC+g=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/al/albert/package.nix b/pkgs/by-name/al/albert/package.nix
index c49e42cdce80..3ad42236da59 100644
--- a/pkgs/by-name/al/albert/package.nix
+++ b/pkgs/by-name/al/albert/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "albert";
-  version = "0.32.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "albertlauncher";
     repo = "albert";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qxJ73aI8EgHgv5xWedGXkynMtZ9vLV8azBSmJGd0v7g=";
+    hash = "sha256-v2SMY0KGFwwybsiMu1W1wBWdyoDEFF3hWd4LeaT8Nts=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
index a2b3e1e1eefc..95ff87707a68 100644
--- a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
+++ b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "amazon-cloudwatch-agent";
-  version = "1.300058.1";
+  version = "1.300059.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-cloudwatch-agent";
     tag = "v${version}";
-    hash = "sha256-WamwlJNx7zEHlvFiJghUEvojni6TvdmHnXSz6h3Ifvo=";
+    hash = "sha256-xon1M3xusoFngeZ2CJprS1z4fcrWeKCKaAtAfv4SBWw=";
   };
 
-  vendorHash = "sha256-kUQ0pAtIWPI3/iKUNWW7MQ8vUNQOEgysTTlgPTjynac=";
+  vendorHash = "sha256-79BaMjl1bzQcl3FUvpwRsPneQRyfabU481eLgWA1U6Y=";
 
   # See the list in https://github.com/aws/amazon-cloudwatch-agent/blob/v1.300049.1/Makefile#L68-L77.
   subPackages = [
diff --git a/pkgs/by-name/ch/chameleon-cli/package.nix b/pkgs/by-name/ch/chameleon-cli/package.nix
new file mode 100644
index 000000000000..fec07c514110
--- /dev/null
+++ b/pkgs/by-name/ch/chameleon-cli/package.nix
@@ -0,0 +1,91 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  makeWrapper,
+  xz,
+  python3,
+}:
+
+let
+  # https://github.com/RfidResearchGroup/ChameleonUltra/blob/main/software/script/requirements.txt
+  pythonPath =
+    with python3.pkgs;
+    makePythonPath [
+      colorama
+      prompt-toolkit
+      pyserial
+    ];
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "chameleon-cli";
+  version = "2.0.0-unstable-2025-08-04";
+
+  src = fetchFromGitHub {
+    owner = "RfidResearchGroup";
+    repo = "ChameleonUltra";
+    rev = "098e0a914b206900f7ea7ae7265486c4349ab644";
+    sparseCheckout = [ "software" ];
+    hash = "sha256-WKxP4jLHkTqBO+nwxhr8DRb3TzDIMlwjA4v+6txQbDo=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/software";
+
+  patches = [
+    # Use execute_tool to simplify running hardnested tool,
+    # also fix when the dir conatains hardnested is read only
+    # https://github.com/RfidResearchGroup/ChameleonUltra/pull/266
+    (fetchpatch {
+      url = "https://github.com/RfidResearchGroup/ChameleonUltra/commit/39270fd09ee61ef0659bf3b79ffa4d2b27f3ba63.patch";
+      hash = "sha256-OlHQ2cL+NFdTsSPFI9geg3dabATRjyKxGp5gGG+eDl8=";
+      stripLen = 1;
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/CMakeLists.txt \
+      --replace-fail "liblzma" "lzma" \
+      --replace-fail "FetchContent_MakeAvailable(xz)" ""
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+  ];
+
+  buildInputs = [
+    xz
+  ];
+
+  cmakeFlags = [
+    "-S"
+    "../src"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/libexec
+    cp -r ../script/* $out/libexec
+    rm -r $out/libexec/tests
+    rm $out/libexec/requirements.txt
+    makeWrapper ${lib.getExe python3} $out/bin/chameleon-cli \
+      --add-flags "$out/libexec/chameleon_cli_main.py" \
+      --prefix PYTHONPATH : ${pythonPath}
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Command line interface for Chameleon Ultra";
+    homepage = "https://github.com/RfidResearchGroup/ChameleonUltra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "chameleon-cli";
+    maintainers = with lib.maintainers; [ azuwis ];
+  };
+})
diff --git a/pkgs/by-name/ch/chameleon-cli/update.sh b/pkgs/by-name/ch/chameleon-cli/update.sh
new file mode 100755
index 000000000000..2875b72ffacd
--- /dev/null
+++ b/pkgs/by-name/ch/chameleon-cli/update.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils nix-update
+
+# This update script exists, because nix-update is unable to ignore `dev`
+# tags that exist on the upstream repo.
+#
+# Once https://github.com/Mic92/nix-update/issues/322 is resolved it can be
+# removed.
+
+set -exuo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+nix-update --version=branch chameleon-cli
+
+tag=$(git ls-remote --tags --refs --sort='-version:refname' https://github.com/RfidResearchGroup/ChameleonUltra.git 'v*' | head -n 1 | cut --delimiter=/ --field=3-)
+tag="${tag#v}"
+sed -i -e 's|version = "[^-]*-unstable-|version = "'"${tag}"'-unstable-|' pkgs/by-name/ch/chameleon-cli/package.nix
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index 87cabe193265..75d9a8577dea 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.15.2";
+  version = "1.15.4";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-KxL073BIfZfjFndwtkDNXwlt1xny76BMV9CQF3x7ATQ=";
+    hash = "sha256-plKibAg1tv0Togt+Jlwm8qrTp7UbBmuEM20xKLi7bb4=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 2f73b19d3f68..2a9abd251ea6 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.2.12";
+  version = "6.2.13";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-hV/YWxOPRTojVTFIXwzqImBKyQ1dCDq5+bgCdS7T1p0=";
+    hash = "sha256-onGmDAVhT2lzq2pQ5runGuHgPdh1MjgFLU7DUvN7nt0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-9wXbd56KOQ7suZqtg2cSFf2FGQJADFMHJbwAAxJ2V4g=";
+  cargoHash = "sha256-GbjbVr82Aj/CRdBl9gPGwHiyrc7l2F918DNnlEoPI58=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url
diff --git a/pkgs/by-name/cl/clouddrive2/package.nix b/pkgs/by-name/cl/clouddrive2/package.nix
index 8d5649807fc4..5c8bcfd3fa2b 100644
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-i6+YoZfCFaVcF7XO7wPo8AEpU0LrD4bcsIqLNz/V3aM=";
-        aarch64-linux = "sha256-BV+47uJnvH/Gapz7dACnXIM49x7u/MTdbXiFRGq2DVc=";
-        x86_64-darwin = "sha256-Jjsdx203akCmlveGZD1x8fO6V0N5d3AzGAFIAzgOkHs=";
-        aarch64-darwin = "sha256-DuSZoXTQyfC3CIwNGTsGuQNP410rK9qMBei5T7TZN7A=";
+        x86_64-linux = "sha256-Gsq5rvr0SeGxCRwAeeFRZBPOe32EIa7uO6SAIuinezA=";
+        aarch64-linux = "sha256-M+lCUzoiy/sImBZrOjjeP4eqG3F4wbkMQg9Ho3ELGFo=";
+        x86_64-darwin = "sha256-Uyz1wuHICSq5C+n3ZjPinZznhajd6QR36CZgQBm+QRE=";
+        aarch64-darwin = "sha256-ZQxRHTzLUAhnL1rRLR9l8Ix5XzxeTAds7XAmEgZ9Xmo=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/cr/crush/package.nix b/pkgs/by-name/cr/crush/package.nix
index d7578f1aaffc..8ccf5e0f0454 100644
--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "crush";
-  version = "0.5.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u2w19Xmcm3cx/B8QRNGaP2qeg+Cif/L92RNlJav6H3w=";
+    hash = "sha256-QUYNJ2Ifny9Zj9YVQHcH80E2qa4clWVg2T075IEWujM=";
   };
 
-  vendorHash = "sha256-H92TgZoWdYQ863AAb2116zJtmgkKXh2hRoEBRcn5zeA=";
+  vendorHash = "sha256-vdzAVVGr7uTW/A/I8TcYW189E3960SCIqatu7Kb60hg=";
 
   # rename TestMain to prevent it from running, as it panics in the sandbox.
   postPatch = ''
diff --git a/pkgs/by-name/cs/csharpier/package.nix b/pkgs/by-name/cs/csharpier/package.nix
index 97bebd35bab1..1f6c82c5e380 100644
--- a/pkgs/by-name/cs/csharpier/package.nix
+++ b/pkgs/by-name/cs/csharpier/package.nix
@@ -2,10 +2,10 @@
 
 buildDotnetGlobalTool {
   pname = "csharpier";
-  version = "1.1.1";
+  version = "1.1.2";
   executables = "csharpier";
 
-  nugetHash = "sha256-B0ijqWm3eZ31T+C5zRr4TkmfPsOfseaHpGPYZf5Yiw4=";
+  nugetHash = "sha256-dlWIqlErXT0l8WaLwtgKb7xpYVunkZihaJ3EzKqaqFE=";
 
   meta = with lib; {
     description = "Opinionated code formatter for C#";
diff --git a/pkgs/by-name/de/decker/package.nix b/pkgs/by-name/de/decker/package.nix
index a222e307e220..daebdb06c7d6 100644
--- a/pkgs/by-name/de/decker/package.nix
+++ b/pkgs/by-name/de/decker/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "decker";
-  version = "1.57";
+  version = "1.58";
 
   src = fetchFromGitHub {
     owner = "JohnEarnest";
     repo = "Decker";
     rev = "v${version}";
-    hash = "sha256-2y/kr8kBMfHAiWO6s7rAyDYyv70NnmiKeYhYq9Zmz0Y=";
+    hash = "sha256-oPB+TT7mHJ6GNBnGIVmbAxNoD2oexPI2Sm8kxxsV6d4=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/di/distroshelf/package.nix b/pkgs/by-name/di/distroshelf/package.nix
index 55996833ee50..5437f5c1b284 100644
--- a/pkgs/by-name/di/distroshelf/package.nix
+++ b/pkgs/by-name/di/distroshelf/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "distroshelf";
-  version = "1.0.12";
+  version = "1.0.13";
 
   src = fetchFromGitHub {
     owner = "ranfdev";
     repo = "DistroShelf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pNGIwmw75c7Q+lXZBSZnAnIqJqYOPIA9cpAlzv/HjJU=";
+    hash = "sha256-2R5jDstnzCTG6UfynsO2aeX6eST4cZIEHNdP9OLDKrw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/dr/draupnir/hashes.json b/pkgs/by-name/dr/draupnir/hashes.json
index 25bf893bf38c..a509437a3988 100644
--- a/pkgs/by-name/dr/draupnir/hashes.json
+++ b/pkgs/by-name/dr/draupnir/hashes.json
@@ -1,3 +1,3 @@
 {
-  "yarn_offline_cache_hash": "sha256-xB9SKCM9m2LotwxIzGgT72mLgrDW2spqvR5VoyexIAA="
+  "yarn_offline_cache_hash": "sha256-SoCuCzrKUWWsD/oEh2W3/T1/hhd7ghfpeBojo84sEI8="
 }
diff --git a/pkgs/by-name/dr/draupnir/package.json b/pkgs/by-name/dr/draupnir/package.json
index 5cbbdbf553c8..bbd5e30084f3 100644
--- a/pkgs/by-name/dr/draupnir/package.json
+++ b/pkgs/by-name/dr/draupnir/package.json
@@ -1,6 +1,6 @@
 {
   "name": "draupnir",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "A moderation tool for Matrix",
   "main": "lib/index.js",
   "repository": "https://github.com/the-draupnir-project/Draupnir.git",
@@ -63,8 +63,8 @@
     "jsdom": "^24.0.0",
     "matrix-appservice-bridge": "^10.3.1",
     "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.7.1-element.6",
-    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@3.10.0",
-    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@3.8.0",
+    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@3.11.0",
+    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@3.11.0",
     "pg": "^8.8.0",
     "yaml": "^2.3.2"
   },
diff --git a/pkgs/by-name/dr/draupnir/package.nix b/pkgs/by-name/dr/draupnir/package.nix
index ef61dcf66e02..c36d4823a41b 100644
--- a/pkgs/by-name/dr/draupnir/package.nix
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -22,13 +22,13 @@ let
 in
 mkYarnPackage rec {
   pname = "draupnir";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "the-draupnir-project";
     repo = "Draupnir";
     tag = "v${version}";
-    hash = "sha256-v6dHexu9x60onBoHbdI+15p6r5m6mi7bRLgZ9jqF19s=";
+    hash = "sha256-KO2jm9yD/LnJSY1dAbPQ2fJZhmrxWJHU+TIaZzK97bg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/dr/drawterm/package.nix b/pkgs/by-name/dr/drawterm/package.nix
index da8175e8b3d9..db082e86640a 100644
--- a/pkgs/by-name/dr/drawterm/package.nix
+++ b/pkgs/by-name/dr/drawterm/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "drawterm";
-  version = "0-unstable-2025-06-29";
+  version = "0-unstable-2025-08-18";
 
   src = fetchFrom9Front {
     owner = "plan9front";
     repo = "drawterm";
-    rev = "903bcd8dba9cb9dfc70707a28089c469e5302539";
-    hash = "sha256-gZAPNRzAuvpIAV7ArPGsqVv6SYBJkqA+Okf6FmStvsU=";
+    rev = "44a7bdfaeb268bbc9df69693fa52d551beb2516d";
+    hash = "sha256-ov0BkKWUpRBi4COETtEw3x9WOSMy6HXkxrU9bVSI+AM=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/dr/druid/package.nix b/pkgs/by-name/dr/druid/package.nix
index 1a0455f63838..825ef47959ec 100644
--- a/pkgs/by-name/dr/druid/package.nix
+++ b/pkgs/by-name/dr/druid/package.nix
@@ -20,11 +20,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "apache-druid";
-  version = "33.0.0";
+  version = "34.0.0";
 
   src = fetchurl {
     url = "mirror://apache/druid/${finalAttrs.version}/apache-druid-${finalAttrs.version}-bin.tar.gz";
-    hash = "sha256-XuXdvMInODSvihjdFzsqBLmpEct85RYnnbYFeIq9fXk=";
+    hash = "sha256-y5Sx8mubb+XEqPxlhPL67od1kVck2M+IkvQP/CyrZpA=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/em/emmylua-doc-cli/package.nix b/pkgs/by-name/em/emmylua-doc-cli/package.nix
index 03d11fdd46f0..6f113229a87d 100644
--- a/pkgs/by-name/em/emmylua-doc-cli/package.nix
+++ b/pkgs/by-name/em/emmylua-doc-cli/package.nix
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_doc_cli";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "EmmyLuaLs";
     repo = "emmylua-analyzer-rust";
     tag = finalAttrs.version;
-    hash = "sha256-HbjGOvK/b7SyhNF/Jff0SgJdOfSbzjkDkqQwuflOABA=";
+    hash = "sha256-IXoiXfRnGOZQ7c8AJaK8OGjqp1bczd/tKjtpbYdCZlU=";
   };
 
   buildAndTestSubdir = "crates/emmylua_doc_cli";
 
-  cargoHash = "sha256-3x71VNWCTFb75STx8w/T++dLo1s2FwNhFm+lyZHS7qI=";
+  cargoHash = "sha256-7QQipbnqelLdzQr+lIORyQNM9SS5yHaJLQ31M52lYCw=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 664edf9b73df..884cb31f11cb 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.2.1";
+  version = "18.2.2";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-h4JklXImKwudJT3pb/UhHwQHKd87c5aSH1xYC0lRWKo=";
+      hash = "sha256-+OmduG9neb15m3i57qPfE42HI4w/zgmA5T6bhlwzrT0=";
     };
 
     vendorHash = "sha256-RjDV4NGmmdT9STQBHiYf3UUYwPmuSg6970/W/ekxin0=";
diff --git a/pkgs/by-name/gi/github-mcp-server/package.nix b/pkgs/by-name/gi/github-mcp-server/package.nix
index 5c710851b830..bf6e5836cfac 100644
--- a/pkgs/by-name/gi/github-mcp-server/package.nix
+++ b/pkgs/by-name/gi/github-mcp-server/package.nix
@@ -3,20 +3,21 @@
   buildGoModule,
   fetchFromGitHub,
   versionCheckHook,
+  nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "github-mcp-server";
-  version = "0.10.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "github-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-I7Y2vZdQllT8wVttf+axwvBF7Cv4gYM4vxw7qKEmhog=";
+    hash = "sha256-E1ta3qt0xXOFw9KhQYKt6cLolJ2wkH6JU22NbCWeuf0=";
   };
 
-  vendorHash = "sha256-DeojCgMBwVclvoiEs462FoxIf3700XUjXvPbvRZE3CI=";
+  vendorHash = "sha256-F6PR4bxFSixgYQX65zjrVxcxEQxCoavQqa5mBGrZH8o=";
 
   ldflags = [
     "-s"
@@ -32,6 +33,8 @@ buildGoModule (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     changelog = "https://github.com/github/github-mcp-server/releases/tag/v${finalAttrs.version}";
     description = "GitHub's official MCP Server";
diff --git a/pkgs/by-name/gi/gitlab-container-registry/fix-broken-urlcache-tests.diff b/pkgs/by-name/gi/gitlab-container-registry/fix-broken-urlcache-tests.diff
new file mode 100644
index 000000000000..2da75604d95f
--- /dev/null
+++ b/pkgs/by-name/gi/gitlab-container-registry/fix-broken-urlcache-tests.diff
@@ -0,0 +1,22 @@
+diff --git a/registry/storage/driver/middleware/urlcache/urlcache_test.go b/registry/storage/driver/middleware/urlcache/urlcache_test.go
+index 67ef4abc0e..6644c80837 100644
+--- a/registry/storage/driver/middleware/urlcache/urlcache_test.go
++++ b/registry/storage/driver/middleware/urlcache/urlcache_test.go
+@@ -37,7 +37,7 @@
+ 			name:        "missing redis cache",
+ 			options:     make(map[string]any),
+ 			wantErr:     true,
+-			errContains: "urlcache middleware requires `cache` Redis configured",
++			errContains: "`_redisCache` key has not been passed to urlcache middleware",
+ 		},
+ 		{
+ 			name: "default configuration with redis",
+@@ -231,7 +231,7 @@
+ 				"_redisCache": "not a redis cache",
+ 			},
+ 			wantErr:     true,
+-			errContains: "unusable redis cache object",
++			errContains: "redis cache passed to the middleware cannot be used as the type is wrong",
+ 		},
+ 	}
+ 
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 217966c4b1eb..cbf8c0f80ede 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule rec {
   pname = "gitlab-container-registry";
-  version = "4.25.0";
+  version = "4.26.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,16 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-7jzKFC29NAHi5iag6aA/5LzH6IyqMa3yAxtzV9OsBnQ=";
+    hash = "sha256-XACKJW5sRXNM4Q24DXEVtjzhVfxoBd+JWHJr1s01ocA=";
   };
 
-  vendorHash = "sha256-z9IlfyJ48FQzhbY38GbZaeQjg3cMDU8tLCXKhazP64A=";
+  patches = [
+    # https://gitlab.com/gitlab-org/container-registry/-/merge_requests/2447
+    # Can be removed with next released when merged
+    ./fix-broken-urlcache-tests.diff
+  ];
+
+  vendorHash = "sha256-J4p3vXLmDFYl/z6crqanlmG1FB4Dq04HLx9IhC3usQ4=";
 
   checkFlags =
     let
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 452d624d23e2..e5d5874ba7bb 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.2.1";
+  version = "18.2.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-z1Pl3xeaoqeF/9qOVcuCpuciu1r6NQ4UhlLe9gy9+nE=";
+    hash = "sha256-PPa9SYyE3G+peP2xSpNw7WDDO7WiWKSRpd5tBODkA0g=";
   };
 
   vendorHash = "sha256-OubXCpvGtGqegQmdb6R1zw/0DfQ4FdbJGt7qYYRnWnA=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index c170a0a5d80b..e14fe7e4fd69 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "18.2.1",
-  "repo_hash": "1i0y46w18476gn98fmkixdjiyrwajz2347p57dg2ijch4ivzpmlv",
-  "yarn_hash": "04mqinnbhr6zgab2p1bq6y6b20bf4c4cynkgfc67mzm9xhybr3fk",
+  "version": "18.2.2",
+  "repo_hash": "0fqpfprxmgxaz5g0d5z4gsir1zj9fkhli7iq1ahx413ymsiqrxd0",
+  "yarn_hash": "0c6njrciqcjaswh784yxly4qza6k2ghq1ljbdkcn65cna4f4hwgk",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.2.1-ee",
+  "rev": "v18.2.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.2.1",
-    "GITLAB_PAGES_VERSION": "18.2.1",
+    "GITALY_SERVER_VERSION": "18.2.2",
+    "GITLAB_PAGES_VERSION": "18.2.2",
     "GITLAB_SHELL_VERSION": "14.43.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.7.0",
-    "GITLAB_WORKHORSE_VERSION": "18.2.1"
+    "GITLAB_WORKHORSE_VERSION": "18.2.2"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 739a24476dec..2bec55c36570 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.2.1";
+  version = "18.2.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index 06bc12716d63..a3588b6628a9 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -20,6 +20,7 @@
   ninja,
   pkg-config,
   rustc,
+  rustPlatform,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -39,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     finalAttrs.passthru.glycinPathsPatch
   ];
 
+  cargoVendorDir = "vendor";
+
   nativeBuildInputs = [
     cargo
     gettext # for msgfmt
@@ -47,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     rustc
+    rustPlatform.cargoSetupHook
   ];
 
   buildInputs = [
@@ -68,6 +72,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  postPatch = ''
+    substituteInPlace loaders/meson.build \
+      --replace-fail "cargo_target_dir / rust_target / loader," "cargo_target_dir / '${stdenv.hostPlatform.rust.cargoShortTarget}' / rust_target / loader,"
+  '';
+
+  env.CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
+
   passthru = {
     updateScript = gnome.updateScript {
       attrPath = "glycin-loaders";
diff --git a/pkgs/by-name/go/goresym/package.nix b/pkgs/by-name/go/goresym/package.nix
index fe5ff6119cd0..37c812ea53d3 100644
--- a/pkgs/by-name/go/goresym/package.nix
+++ b/pkgs/by-name/go/goresym/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "goresym";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "mandiant";
     repo = "goresym";
     rev = "v${version}";
-    hash = "sha256-OvdARJwz/ijduil3JIpoR15+F3QNQyqQKeOmiAV7h2A=";
+    hash = "sha256-BgnT0qYPH8kMI837hnUK5zGhboGgRU7VeU5dKNcrj8g=";
   };
 
   subPackages = [ "." ];
diff --git a/pkgs/by-name/ha/hamrs-pro/package.nix b/pkgs/by-name/ha/hamrs-pro/package.nix
index 9de90e310c29..fdc251292e59 100644
--- a/pkgs/by-name/ha/hamrs-pro/package.nix
+++ b/pkgs/by-name/ha/hamrs-pro/package.nix
@@ -8,29 +8,29 @@
 
 let
   pname = "hamrs-pro";
-  version = "2.42.1";
+  version = "2.43.0";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-x86_64.AppImage";
-      hash = "sha256-LPXrzS/OF+O4zYlk+Ubf46mZbjTaE8OEA9n7NkC/jxE=";
+      hash = "sha256-R+yUCqhnFq6ffU0sbearFJ+nsyfrzVnbw/vKV2li8sk=";
     };
 
     aarch64-linux = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-linux-arm64.AppImage";
-      hash = "sha256-WTmUscuz4mCnW19zoqxBkqBrb1VJBn/FBf2sDQQ3hF8=";
+      hash = "sha256-nsZbebiYqAd8By+o3+DgJ51mPAuPzQqRsjxXpWPTgW8=";
     };
 
     x86_64-darwin = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-x64.dmg";
-      hash = "sha256-n1wDHbo8URIZEIzJx6O7zGnH/RtMj75ltXImM3Q1QvI=";
+      hash = "sha256-G2vCdgs8wGsZ5EHeO8CI/BtyxvbBAvHTzqbn7InxEAU=";
     };
 
     aarch64-darwin = fetchurl {
       url = "https://hamrs-dist.s3.amazonaws.com/hamrs-pro-${version}-mac-arm64.dmg";
-      hash = "sha256-x/hxKLCVme5l7lo7REy8EjEBstrWA9uyC2sA811eOPk=";
+      hash = "sha256-CnAbgGsgJCLcKH7HizOncI52G6kn8+FEMhWZR8FPMBc=";
     };
   };
 
diff --git a/pkgs/by-name/im/imaginer/package.nix b/pkgs/by-name/im/imaginer/package.nix
deleted file mode 100644
index a73faf7fad89..000000000000
--- a/pkgs/by-name/im/imaginer/package.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  lib,
-  appstream-glib,
-  blueprint-compiler,
-  desktop-file-utils,
-  fetchFromGitHub,
-  gettext,
-  glib,
-  gobject-introspection,
-  libadwaita,
-  libsoup_3,
-  meson,
-  ninja,
-  pkg-config,
-  python3Packages,
-  wrapGAppsHook4,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "imaginer";
-  version = "0.1.3";
-
-  src = fetchFromGitHub {
-    owner = "ImaginerApp";
-    repo = "Imaginer";
-    rev = "v${version}";
-    hash = "sha256-x1ZnmfaMfxnITiuFDlMPfTU8KZbd1ME9jDevnlsrbJs=";
-  };
-
-  format = "other";
-  dontWrapGApps = true;
-
-  nativeBuildInputs = [
-    appstream-glib
-    blueprint-compiler
-    desktop-file-utils
-    gettext
-    glib
-    gobject-introspection
-    meson
-    ninja
-    pkg-config
-    wrapGAppsHook4
-  ];
-
-  buildInputs = [
-    libadwaita
-    libsoup_3
-  ];
-
-  propagatedBuildInputs = with python3Packages; [
-    openai
-    pillow
-    pygobject3
-    requests
-  ];
-
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/ImaginerApp/Imaginer";
-    description = "AI image generator for GNOME";
-    mainProgram = "imaginer";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ _0xMRTT ];
-  };
-}
diff --git a/pkgs/by-name/im/img4lib/package.nix b/pkgs/by-name/im/img4lib/package.nix
new file mode 100644
index 000000000000..6e66b62d5103
--- /dev/null
+++ b/pkgs/by-name/im/img4lib/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  lzfse,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "img4lib";
+  version = "0-unstable-2021-11-28";
+
+  src = fetchFromGitHub {
+    owner = "xerub";
+    repo = "img4lib";
+    rev = "69772c72f3c08f021ec9fa4c386f2b3df60a38b7";
+    hash = "sha256-xCWovBJ9cxT17u1uo+aUQnxDoYFQXYy9Qer0mD45aOU=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    lzfse
+    openssl
+  ];
+
+  installPhase = "
+    runHook preInstall
+
+    install -Dm755 img4 $out/bin/img4
+
+    runHook postInstall
+  ";
+
+  strictDeps = true;
+
+  meta = {
+    description = "Library and tool for parsing, manipulating, and patching Apple .img4 container files";
+    homepage = "https://github.com/xerub/img4lib";
+    # No licensing information available
+    # https://github.com/xerub/img4lib/issues/14
+    license = lib.licenses.unfree;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ onny ];
+    mainProgram = "img4";
+  };
+})
diff --git a/pkgs/by-name/io/iosevka-bin/package.nix b/pkgs/by-name/io/iosevka-bin/package.nix
index 942b85e8ecef..cc4f54e63013 100644
--- a/pkgs/by-name/io/iosevka-bin/package.nix
+++ b/pkgs/by-name/io/iosevka-bin/package.nix
@@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "33.2.7";
+  version = "33.2.8";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/PkgTTC-${name}-${version}.zip";
diff --git a/pkgs/by-name/io/iosevka-bin/variants.nix b/pkgs/by-name/io/iosevka-bin/variants.nix
index 4115611b72a2..2bc01e5cae6c 100644
--- a/pkgs/by-name/io/iosevka-bin/variants.nix
+++ b/pkgs/by-name/io/iosevka-bin/variants.nix
@@ -1,93 +1,93 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  Iosevka = "0z7w7j7wwc36qzmwralkbyps60p8x5wb514bdnjk8s9023z2w0nz";
-  IosevkaAile = "0pbappmm45vma5d45l2a98zb6213hfb0k30hvwv5298ds3k95f89";
-  IosevkaCurly = "1zw9gas6yw6dxk5ahdbbc9374rzzanr9k38ka4jhydn8zmcnsq85";
-  IosevkaCurlySlab = "1yvlyg5c5lydc5ycn9i8pnch1jwm749sng17b3xc0x18ndrqsa2x";
-  IosevkaEtoile = "12q8bvl8ckkj8v6ngw68bn62mcdfl5w71l7hc3m9b3fr4gfvz2gm";
-  IosevkaSlab = "0fpj2phmmsfqzii39a3zvyjzrbhjnn914cdcgp6g1b6xk5qd1p5n";
-  IosevkaSS01 = "03fzxs4wba1qc5mhy9cr664gfh9zz9wg0qsw3gxnn1rd9xd2y5ri";
-  IosevkaSS02 = "08pi97qzjs4v7xgck8g68llm880bp23kfgp8sqxdv4n2d5cr4yib";
-  IosevkaSS03 = "1d75hzcjz55jb9xwgky1ns78lg776aw0a0a8gyfm8kxhmb8n1kpp";
-  IosevkaSS04 = "0snq7wd02j0xmcf6smqxv33f4z9wdr14dz7hla892hnbm0pymlws";
-  IosevkaSS05 = "0xp502q3zv506fbgjid51n7j5hcq3hjvq8rz417shd9f68mx0z9z";
-  IosevkaSS06 = "0w2rjmv1k13jhndv165xaamcscxbsgh38icnzj72hs3kw8mgijj7";
-  IosevkaSS07 = "17661r5bnwd3hphy52d1mjp9sxs4jfxc741x672jxwdwnj8w6ffh";
-  IosevkaSS08 = "15q1kskng4nsp60kv09zwvp24m9lql9wa3ahb94s57k1rqmf4jn6";
-  IosevkaSS09 = "1l6p0arvndkz36h3x1npb1yj910nvbj3v0a3j5lz6dbhv0imsx0q";
-  IosevkaSS10 = "1agwjpw1hh8wagacld61ld9gyh5vmirrabjvv5s7gzrfr8acgp18";
-  IosevkaSS11 = "1hz7ln5w083z17napnm8v1gw6nzh8dkzbiqw8zrv5bmbj3jzc21n";
-  IosevkaSS12 = "10kz86ypf9c41n8yk7yx2rrxmwr3c0gwznw9lrida15lppwfq6as";
-  IosevkaSS13 = "0wbprdjyilp18j8gxa1fa0iggy84mzy826ms3bq20i4q6xcsqli5";
-  IosevkaSS14 = "07a6xcxl4mksxfpfvwx5pr3vw6mpnz9bfpfbsy53jgn3yc6cfwl1";
-  IosevkaSS15 = "1ij9z4ngh7s7ld4bh0f6mz4zxlsfa2l1dpq3b429na9vachv1khj";
-  IosevkaSS16 = "1skg7aqnzd7nyc43glbgg4b10xzmmc0gn20v6qmkrdv1cyhxwm87";
-  IosevkaSS17 = "0xcdv8zygvmh218qk9lgjcgdflcr54s7p86x5br2aja658azdlzp";
-  IosevkaSS18 = "1nf6wajmjx2aqqmv6zbfa29jsvg4lw8jf1jk32xrd5953yx30y6z";
-  SGr-Iosevka = "1czz0cz9py8ldrp0h1la5dd1b558ss32f2vbmcv5j5c76fify71f";
-  SGr-IosevkaCurly = "0zfqx11alkbd2bj77rnzgb4jy91fa6ns596m82gfkmks7ggq3b4j";
-  SGr-IosevkaCurlySlab = "0l0vfbq5vya9igx6xd9hsnm96bp8j87qnhj553rhd56jy73ms5la";
-  SGr-IosevkaFixed = "100g3j0v8qfmkkhl0zwyy736i5a0ci33hfmh1dwnzkx993qwrv01";
-  SGr-IosevkaFixedCurly = "0nriagy3m1r8fn2r51k4xi69b7xj09dhg4bvl0gj2syrrqldnkyj";
-  SGr-IosevkaFixedCurlySlab = "1bpihhg5gxlbg152vdwbb6kq5k8dcrirzwhay4w5bq9fzfg62p6z";
-  SGr-IosevkaFixedSlab = "0v5mfni7y3h519xa2r70bqx5ragk6l68kghsr1k0wbnv03m3ha7w";
-  SGr-IosevkaFixedSS01 = "158l9b0cdaa7al88wg6bba9xxp6sn914gj58g201w5xsbd0srpql";
-  SGr-IosevkaFixedSS02 = "1082wffk762mdc855iz7zrqhb9dpmd3yj324jzzsvhwhhj66hmnl";
-  SGr-IosevkaFixedSS03 = "1kr194dpq365ickgrmhrrjpsy0mv5ixm5z7xbciw6pppmk8aaami";
-  SGr-IosevkaFixedSS04 = "0z31masbyxvmfagdpcs1iz3ibslvg54ix9w6ld0rzkdjvln8g6pr";
-  SGr-IosevkaFixedSS05 = "0rnda4lnjv0ya1911mbrsymada6qq7nzrnzikzm2140ck3lq8lcl";
-  SGr-IosevkaFixedSS06 = "11p8ks82drhvmm9qnlqqz1r77chg0ffdrx4m0s32k46s928kjkxs";
-  SGr-IosevkaFixedSS07 = "07xfkr1qdvvr5w26q6qgfqbij2d3iaxxwh0ibj0x9v9zwf6nn7w3";
-  SGr-IosevkaFixedSS08 = "0p0phcjakd0x9qph8wr43l4qg8v3kv05k1dzmvbx7v6dbj69b230";
-  SGr-IosevkaFixedSS09 = "1hghv10j5gdizr0yjxs0qdmqvqdi397bzwscdj0asislf2scji52";
-  SGr-IosevkaFixedSS10 = "0yjwyhdkxg2icxsql814a33zf0k4pzsxwnk5wydd535qld2jl188";
-  SGr-IosevkaFixedSS11 = "0jrnmr5aspc155ajn9cxbapvbl240njx2zha7x0r1q471r7kf42y";
-  SGr-IosevkaFixedSS12 = "1p463hmkvmkcr4602blzwafs0gzi83b781barwi862dah5mp3yq6";
-  SGr-IosevkaFixedSS13 = "1jr0rfr276870gdl3ljysw4zp2habyqa80wcbzsdsp2m2nqdwn53";
-  SGr-IosevkaFixedSS14 = "1zryh9bmiipn4zvkga39ksqfrrnsr04invmidhrd955g39yz1c4a";
-  SGr-IosevkaFixedSS15 = "1ly33fh8m3hwkmzm7fr870wys3xp49cknd9dmdm1v4calylfd88w";
-  SGr-IosevkaFixedSS16 = "0gq66d1x5hdfn2iwcl75rq0586l7k6in9vsfhxabfgw9gp6y852c";
-  SGr-IosevkaFixedSS17 = "0sj1jmipz8a2vwizg6p0ywa838w2m3x5lfj49ql1ybh1bjz1cj23";
-  SGr-IosevkaFixedSS18 = "1rkz18k0nrz6if3nmcjpvrcbc2pg5w8z6dsvld90yf1964qll7q3";
-  SGr-IosevkaSlab = "18kif4a83qs1nsv3pvnyf8labw89ix4x42ydji6l387lzzxn5919";
-  SGr-IosevkaSS01 = "1j74h95csjfdvgmbqmnvgavhm5kjvbkh1rsh4xgrf4rqjcnr82kw";
-  SGr-IosevkaSS02 = "1n63pwjm05mwxzy18zw4hd0547ycg1dl0ivykgw1f25yf968wfg9";
-  SGr-IosevkaSS03 = "0a8v523slxnja9vslfz4cxy5g6h0zcj30mky70wxmnf2gmfvc7zv";
-  SGr-IosevkaSS04 = "0ylvzphbhvixfq69zyaick56jpkff33vyc2z1pszqblz0dzdc8kn";
-  SGr-IosevkaSS05 = "1ij58iqs9bmibgg9pj38053phnydwcb2k9npgbs88f08s1pgjvh5";
-  SGr-IosevkaSS06 = "00yfsbhgcxd3dv888hw8r4n4ivwxcn0m3zz99djgzxn0nd8r10y2";
-  SGr-IosevkaSS07 = "0b5c29x479i04afdkjplbq135pzhfcwi144xs0k2ba6s85g0y10d";
-  SGr-IosevkaSS08 = "1by2vd7kjqiqj7f3zps4xiz0ydq3gnljkh7jly513dg0idg2agwv";
-  SGr-IosevkaSS09 = "0a9sgh2vwm57ay1pzlrmwd549aaidg7p8b76dhxvhmvf006ay92b";
-  SGr-IosevkaSS10 = "079vr05ilaijqyy1wkqgk42jg5i2s3sz5y3i19gr1yqgfdpq2b3j";
-  SGr-IosevkaSS11 = "11l0cf7ib9ibcckpjymrpwgsadz3glwdics3mzhhzv28fz91b95c";
-  SGr-IosevkaSS12 = "1sbwi3fbj421z8jaa224hy8vmk565brclxzg9dnsdg5x8kxlf6jg";
-  SGr-IosevkaSS13 = "1qsqa76wkz2adaabigw6d74k0s0jlswagsyknxcpynh6fmzqcrs4";
-  SGr-IosevkaSS14 = "002kzsjqsajz5q1wy0vfr836ljmlm417zb3c6yjlnqp2zpzz26d5";
-  SGr-IosevkaSS15 = "1h74gl7xm2qdy0v3xhj0nmwn6b6zwxnmrv0wwpqd2yn4jf57xa4v";
-  SGr-IosevkaSS16 = "0y58mggxv7bqymf45bcy2mjlngz3hp5mbisy1n65d7kmqcjfyj97";
-  SGr-IosevkaSS17 = "1b728h7qnyd9i3jp1j7d7n11vksw6518rhl7470h01qmqnmpw579";
-  SGr-IosevkaSS18 = "1hh64ys2bjh7qlkz30vnj38grkr4s6c5nm8c1zgf6yi02xcrnxjg";
-  SGr-IosevkaTerm = "1k85q6y3h0i8ivm0llif3k4llgaxin87gmvjxn4h8092yfi59kkh";
-  SGr-IosevkaTermCurly = "1xwif6qjada58mswqd0myr2p2h06dik55cj4bsk3kmva2avvn2d3";
-  SGr-IosevkaTermCurlySlab = "161583x6zphxxzpzkp889rhjihpxy2ahrdc8nbqldn7j2nijz56s";
-  SGr-IosevkaTermSlab = "1fsx3z12plbkgjjdppf9c2b0y40vsavqp5hkj5b1j336cxah97yr";
-  SGr-IosevkaTermSS01 = "1z2xyyb2ddlrarxqzrv9x7hajpifqi15simqnmd31d899kx1zqx3";
-  SGr-IosevkaTermSS02 = "1nrr55hh2kd57ri6ipcm2425g469xj1gxf7lzivi1w8dbgk6mi4j";
-  SGr-IosevkaTermSS03 = "1zp7p0b4y911lxf80bkhj7x68xpjc36a6x6lmq2msq886hyayq14";
-  SGr-IosevkaTermSS04 = "15bzbrch7f0c4sxi01sasavkbjvgja1h740hd2zaqlsshx8sk91z";
-  SGr-IosevkaTermSS05 = "1zl760ikgq7y0x03zjnild7dpx9ndc1g0rjk5drp84qg8saaayz3";
-  SGr-IosevkaTermSS06 = "0zy62b3njnz0ip666xx68lmc8b4yaa610fy5qf9d6c8yj0qfb1gd";
-  SGr-IosevkaTermSS07 = "0m9j0v4ijz6yprvvnbv7591vh81xr1yyr73fy4463v9za99ccpvn";
-  SGr-IosevkaTermSS08 = "1a5qgy3cbf166q2j3gg8h4a0rfz9cjb6c1kqrmkvabxxk6fmg3s5";
-  SGr-IosevkaTermSS09 = "1hz3pasx0zg7467cpdwrm9gnfdwslbp5llawfsr2qp5vzkqggxhj";
-  SGr-IosevkaTermSS10 = "1cgfsmf2arcpjn3wclhkfqajx4nkc24d8ww3k8156bjd7bn8hxa8";
-  SGr-IosevkaTermSS11 = "0z6rw2f8palzm2k00pacnaw27kipr4sd3l9rh3ahw88s4h0r3kgv";
-  SGr-IosevkaTermSS12 = "0qak5xq61wxzr3gcyhamf9sanzisx8n72l7acwd7nffk9c5c7iy9";
-  SGr-IosevkaTermSS13 = "13vi16nks0kbd0hyg1g4cxi3pxxqk3sj297h5nxv0i0khfrdyyys";
-  SGr-IosevkaTermSS14 = "1q004ws9aamdvkfm2as6281ypk0fvq5m9ccv11azs9jcfydx5s1n";
-  SGr-IosevkaTermSS15 = "0fdk1x6wpzsrg0r304nsk9hszpy9yndjkrq62q6a466sxsykj3ij";
-  SGr-IosevkaTermSS16 = "0yiwj0dz7lf1y6v7snmxl5zfqq66hg4dg82fb2axibh0f0k9x51y";
-  SGr-IosevkaTermSS17 = "1xih5lnxl4v3gw3vz93pv2djkibmb13y4a76ky7svyg2y3v5dzhm";
-  SGr-IosevkaTermSS18 = "1qlk7fcsp3sbq4q1zny5gvfbqmkgz7cqxz5pvgfcjd6i6s932lmb";
+  Iosevka = "08vbbk1k1cvg7i89y19j7dfvb5icdw9k17x9viy5in8c3zh8l86b";
+  IosevkaAile = "0d3h9zvmm2jq675ypri8gsnyr480f45a6qy3nxs3zlchdk8x8r6w";
+  IosevkaCurly = "024h777s3ya4rs37qcni694rxnhfz4c48spazy2kyhr1vz144f3p";
+  IosevkaCurlySlab = "1xia7kxfl600v1n0mrfxydl4b44k7qhlm7ziqj11mszfh0nyypjh";
+  IosevkaEtoile = "08ihdsbz04f96s2dh2d8yndc04n2xcx0k4f7ai757vkqvj4acl1s";
+  IosevkaSlab = "1rf2jbir0l09w7ndv4rdj4sj5qhhnq5pm85xz3r057rg21d5knxb";
+  IosevkaSS01 = "0rkwi4cnf03ayllfvmldfksriis6gcfzj9lqj79shqxk7j6lwznp";
+  IosevkaSS02 = "038n78mhbxayslr5p8iminrajh37sjihkc8jzxp16aq4xk0c7j1b";
+  IosevkaSS03 = "1ci08fsz3d35qjrq0jg9bw6vw86ckamlfqsk031ay8prnyycbdvk";
+  IosevkaSS04 = "0n128k5ihp2gjl704xfczdbxlzzahw9xsdl28fp15gyk9a2h8h2i";
+  IosevkaSS05 = "0mdn5f73r50zi4x5851s2rw7ya0l1lm9v2ljbv5rwx9qlcn1mv6l";
+  IosevkaSS06 = "0z0bdgywcp1b5y4j7lym3k3ryg0r576mpbsa3fq8z50h3f15i7y6";
+  IosevkaSS07 = "1rn0q1a44351fcihldvvq379np3a4c4q4msmdcgk2ijfrczr78s3";
+  IosevkaSS08 = "1zvjrvk2lp371k5ph7vpmmxw2hnk26qmyvbnm68vivs4x8vlwk3j";
+  IosevkaSS09 = "0ph2pn6q40z5f7blfig0wr4bl4qnqjsj5l67qjws3vjgzjn795yd";
+  IosevkaSS10 = "1vpk21idk0hczch29rq31rg3qw4yvvg8vyi8j1si42ki9lk3mg61";
+  IosevkaSS11 = "0s626n3a3ns877lv1k55bwasgkkbgsvcbgz3hkvghqj4ln90fv67";
+  IosevkaSS12 = "0blskpw05s9da5i9258ii2nvvrgnyixm9nb5ax5vgi94j290wzcj";
+  IosevkaSS13 = "0r1170rzwknfkf5lq2vqxdgmkdncmddgjbaq8dy7hsa3zjd591j7";
+  IosevkaSS14 = "0v9gs6av365x84c50r7k2yhiv1g19s48iwrlxzxi4yzr15v9z3kd";
+  IosevkaSS15 = "1cw013khszmaaxn4vx0clgkw3xidvlsxd85ykx0kr9np3cxlxn07";
+  IosevkaSS16 = "1qskhwplyp30mds9j06g6b8i9dvxsjdg3j65g0gj15mp027hi8mr";
+  IosevkaSS17 = "14zzcw2pk4w0y2r1aic513cmf961szqrpfkfnj577715ch7x02is";
+  IosevkaSS18 = "0la2ikwkazi9m61hm8i9x2w0ppqc7v1qqpvwvx03hhdx2swgp8x5";
+  SGr-Iosevka = "1k916yy505ww9pyxx0lvifa8p5r9zssfyc6fcrdp0bv8faqkkrvp";
+  SGr-IosevkaCurly = "0mw43birmr6d3ykajm046wx1xqyxfaw0fq4vrwihpaz8nqnlhfki";
+  SGr-IosevkaCurlySlab = "11gyyzd3sjk6w23861mzw7gvgd1qfg3la4ljq087jmh7c4gvi3in";
+  SGr-IosevkaFixed = "17lw03agm4jw8i4gymiwq124dm5zll28mcl2rzzmwsf1xl014v07";
+  SGr-IosevkaFixedCurly = "1jn7qm5mhw1jl1w6vxpbz53hpw2ph04i3kpn13nhsy8dvd4gff67";
+  SGr-IosevkaFixedCurlySlab = "0bdzd4dzg0nm2ffv341kp67vmmd5ykvdiil6igsdxkr5wazvn2pf";
+  SGr-IosevkaFixedSlab = "0djllnvsdhfqyhm5mfxh5rjqsw1kd41a0f7ff36a3cqphd63ac7m";
+  SGr-IosevkaFixedSS01 = "09lvpmkyxk3kylyxjliwmywy9v75azwdhwh51hdyzbr231c0mb3z";
+  SGr-IosevkaFixedSS02 = "0dadqys577f71a5d7rrrwa7wc18jls088s1ig4jgga7pw08r1fhx";
+  SGr-IosevkaFixedSS03 = "0k654b1j5sz896p694j7fh0axkdpdzpn0fr3w44mgry6812mx17s";
+  SGr-IosevkaFixedSS04 = "0n1g0kjx55517xlr42jb1r6gr3lgmnrpbrfwm28j5agzkqnjn3sw";
+  SGr-IosevkaFixedSS05 = "0gs174gfq0x05v2hjx7yxk94sldm9hprypm22mv4ksy4x8nmw372";
+  SGr-IosevkaFixedSS06 = "0sybk7ai6ls338yg01rz2r3xl2xa89s4fz7cy8i0a1cakcblapyq";
+  SGr-IosevkaFixedSS07 = "1sqsn3msld2y08ad1imkrxwqkd32frj63q794ynf0blfnkpsgvc6";
+  SGr-IosevkaFixedSS08 = "14j5w97zikhwn57632rxgmq6zfhfhsl4d9f8yiq7isq45nb7kcvn";
+  SGr-IosevkaFixedSS09 = "1pjv8pf8b4wjbxinqi1d2i452bl44jqi0lksdbwanasv7yy8i8l2";
+  SGr-IosevkaFixedSS10 = "0w9840jfxyms367676lyz7b57r3xn582micxgjh8qmdpbbv36xvn";
+  SGr-IosevkaFixedSS11 = "10fd5jbv3wcgy2r9lvwc1qhd2bzpxxym4z16w99wibadas02jjjf";
+  SGr-IosevkaFixedSS12 = "0dbk3l6yrnpdg9mbdixp201n709j0j9br2k3jvdw83q4mcikfcbs";
+  SGr-IosevkaFixedSS13 = "0rzpw8pna6fz99xi1k3cbjbfc5nbsj43k9k747i3yajy99f37ncp";
+  SGr-IosevkaFixedSS14 = "0qmrdzz94c4fjy771wbx81078zdcqb9vfw1rhmxggxykb7ak69ik";
+  SGr-IosevkaFixedSS15 = "1gswliwkh8bq978mjckpqb9ppk65msp6ljc9fvx6j0kk37kn6bn5";
+  SGr-IosevkaFixedSS16 = "046gpzan4d2r4yfk431dd3204ab6yk3jaxg0n9iqwdinsmlvh296";
+  SGr-IosevkaFixedSS17 = "1ykcb85n4iv8xr9db2dbk5iv42qw85lwr2bbl5ij2q19rj6vp73c";
+  SGr-IosevkaFixedSS18 = "19am4y3wbfdkqfk23cninsv7m6rwysa1ij5x0a4fhg8mrm0acwad";
+  SGr-IosevkaSlab = "1m0pqxdcj1638gc1avlb8z3imccl7aif3kkn78gsbjbax5dln0ic";
+  SGr-IosevkaSS01 = "10csf59fp8s0ygg6j8s2zfzd4740vb5rl4z0vhcvsmwllg6jf6av";
+  SGr-IosevkaSS02 = "1mcxb4p6fw56ncw7wkf6g9mhswpwn6mdbdmpcm0qmvgqw2czp4xw";
+  SGr-IosevkaSS03 = "0abkw56n8ihi6l73xmxjxwgqpgrvmxbf76i70xgmh3s50242ksil";
+  SGr-IosevkaSS04 = "0hm1m1s4mqgz9y1z5xbhi7pq4rzl3h8i951844iw3l0d5h2mcpki";
+  SGr-IosevkaSS05 = "0nf20bwnwrl1l6xy4hb3nap3vzgrmnc7cmkjaip0b2dc9i04rqq6";
+  SGr-IosevkaSS06 = "04ncjbrkfpbm3qms4kwgbgqpa2hzpjh6vd2jgwjzzq2hi00k1dzc";
+  SGr-IosevkaSS07 = "198jjf6mvivb499iazbds3yl2d9xggw6xdc3piij76jx196svppf";
+  SGr-IosevkaSS08 = "0qbn6cf51mgzn2f3z8zcq9j7vs5ihwdw8kxs6svpd88y1dlssmcv";
+  SGr-IosevkaSS09 = "1rh7kzfis3kg80lp3g8cbgr5r7372j98vgpc472n0s5rgsmxwr3z";
+  SGr-IosevkaSS10 = "0ajbgchdlld25f21pdz7rkppa1scly91yjl0nhmm10wc436baij1";
+  SGr-IosevkaSS11 = "009a7y4k9lk622mhv14h9nqflja7bm6p1a3l6qn9fw8gc6kclkjl";
+  SGr-IosevkaSS12 = "1mxckmw297xqyazpkriqgwnki07yxjzi8i7a4gvfhpkaq8vj03yl";
+  SGr-IosevkaSS13 = "18fchw618dwvqas18kmmi863gdp3rswimxykqyvdxyv06fwvlaah";
+  SGr-IosevkaSS14 = "1k1fmfjhg6azlylda1227wa6iy0p4bgn22xkhw162f32pjy28z2l";
+  SGr-IosevkaSS15 = "07c1hs8vfbf3wv0cl21sqhm2al4j0xdiav15xp6vqgldh4l5gjgq";
+  SGr-IosevkaSS16 = "0qwfcw95y63wl6qcggd8y5f56h4ighkz4df994nixlhkyvzfa8kr";
+  SGr-IosevkaSS17 = "1aa5c1fb8r3chnpb9b59s5l7rqi58s5g1n5y7pdcmwp9cl1d3sd4";
+  SGr-IosevkaSS18 = "1nkgw6sqyxmf5aw4sanfa3cb4gbrd5871ni4qqn649lgnsjq8bk7";
+  SGr-IosevkaTerm = "19d26zlapms8ppm4qll5l7rplirj1k6xn4y89v2j857li2i7va95";
+  SGr-IosevkaTermCurly = "11wjd0a4gdyhnl8914j084mlb8z4awkn3pd6a3c2fq8qynwkcvc9";
+  SGr-IosevkaTermCurlySlab = "0kajmdzg6iqzg7y51kl9zh0fvw3yz408j63i3lzlrjj4plqyd59f";
+  SGr-IosevkaTermSlab = "1hbgj4psgv5ci4f0mjxd4q3ydk37jp16b7h8kjlfinhldbsrsd7x";
+  SGr-IosevkaTermSS01 = "0kri3c22j7a6c5m26i5l975w6csbkbv2fb2plrwc8c8sdqh5qy8q";
+  SGr-IosevkaTermSS02 = "10mwqfy38rp6ygy5v6irb57dl0irkmnlv133zhdyqbpn9gaiwc19";
+  SGr-IosevkaTermSS03 = "0rn62yl26abi8p0hz5yzkd4nw4im7p84w957fbyr5g2dmwl377ac";
+  SGr-IosevkaTermSS04 = "1rb1ysqq6mkp7kd518py9lpp4k82v538rv6im464n82kgz0caz4l";
+  SGr-IosevkaTermSS05 = "0kc2b9p933l2q18v3an26l4q7fxc7bsm02zslz91y92rwzvjhxdr";
+  SGr-IosevkaTermSS06 = "1m6jcdaa7rca0310ggi9syzc8a2dxyr88q2h09a8v59zx8cfa0vd";
+  SGr-IosevkaTermSS07 = "16w437n33gbflb0bfh7i9rjr33wh5v98yzfm2g5l8f7wpgbc984i";
+  SGr-IosevkaTermSS08 = "1bppjyyqqjdkka2si6skyc9rqs87l325g2vf7vjfav61ddk804w2";
+  SGr-IosevkaTermSS09 = "0wmz1p0dibyzvqxdb9dwwjnsqly36h3hhz5pj0jamnwbjnynfrqj";
+  SGr-IosevkaTermSS10 = "1i7dvd9v4fq0m32d0gb70pw1ivmr47vrh852zh6drsj6852iqc8m";
+  SGr-IosevkaTermSS11 = "1v3fx9778pnfg3gmpnprhawh8863xjfxjfdb59hpd2g6jjakag3b";
+  SGr-IosevkaTermSS12 = "0laqvc1qgjafk573wx0zmapxdy12a3jpd903zvdnks4z46nspl3q";
+  SGr-IosevkaTermSS13 = "15xpvsay23wpp27j903c4v8zhykj742ydfi15lav7rmbd6k182b2";
+  SGr-IosevkaTermSS14 = "14by0l4a038jwv4n8b7iyyji5zzsd6iqqa9mla0rz1135k9qlvza";
+  SGr-IosevkaTermSS15 = "1bb08wpaxwcaj6i4ib40n3xgjn2ps9znfki222afmlvcd593p307";
+  SGr-IosevkaTermSS16 = "10cv77jncjpf29hba8g9s6ppwlkyk885ik4p1vrlaqa6scvy4i7p";
+  SGr-IosevkaTermSS17 = "1l48b3lb2mmrlbvpzsjd1x7i26mbaxy4idbgf1fsi8pkrz6x2cxr";
+  SGr-IosevkaTermSS18 = "080pyjphx7h4lxsrwxd71dxbv5z45ynkpw97k8x0jf6acmkjisc2";
 }
diff --git a/pkgs/by-name/ip/ipopt/package.nix b/pkgs/by-name/ip/ipopt/package.nix
index 59495c77b3db..e97d3d11192a 100644
--- a/pkgs/by-name/ip/ipopt/package.nix
+++ b/pkgs/by-name/ip/ipopt/package.nix
@@ -19,13 +19,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "ipopt";
-  version = "3.14.17";
+  version = "3.14.18";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Ipopt";
     rev = "releases/${version}";
-    sha256 = "sha256-0IRHryADQArhhtfbQjCy+EDvVRi/ywc51IwiQOfWlR4=";
+    sha256 = "sha256-Tifw0awNLiJrWhMF61O2VW85I3eVxDChkod5avAV6zA=";
   };
 
   CXXDEFS = [
diff --git a/pkgs/by-name/je/jellyfin-tui/package.nix b/pkgs/by-name/je/jellyfin-tui/package.nix
index 0c6b659a011e..5b7840e4b4a6 100644
--- a/pkgs/by-name/je/jellyfin-tui/package.nix
+++ b/pkgs/by-name/je/jellyfin-tui/package.nix
@@ -43,6 +43,10 @@ rustPlatform.buildRustPackage rec {
   '';
   doInstallCheck = true;
 
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
+    install -Dm644 src/extra/jellyfin-tui.desktop $out/share/applications/jellyfin-tui.desktop
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/ku/kubergrunt/package.nix b/pkgs/by-name/ku/kubergrunt/package.nix
index 174edf7187a8..40821ec15751 100644
--- a/pkgs/by-name/ku/kubergrunt/package.nix
+++ b/pkgs/by-name/ku/kubergrunt/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kubergrunt";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = "kubergrunt";
     rev = "v${version}";
-    sha256 = "sha256-w/7GioWDco2bbGNzPY7C9um8yyynD2T/+S0GNOiQoMU=";
+    sha256 = "sha256-S1IJRgUIuoFWOjVkgCFbEokbcRZgcBH/HlFHxKM14WY=";
   };
 
-  vendorHash = "sha256-4iw0wFfjSsqL72E4/VXlGQb947MVS62zwsmAR9sv0H8=";
+  vendorHash = "sha256-f+M/aiHS0dT0Cg1jVP0E+VtlKgMmkLAfZgEK34ZOB1M=";
 
   # Disable tests since it requires network access and relies on the
   # presence of certain AWS infrastructure
diff --git a/pkgs/by-name/li/libcint/package.nix b/pkgs/by-name/li/libcint/package.nix
index a8460668b908..0e6fa2408c0a 100644
--- a/pkgs/by-name/li/libcint/package.nix
+++ b/pkgs/by-name/li/libcint/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcint";
-  version = "6.1.2";
+  version = "6.1.3";
 
   src = fetchFromGitHub {
     owner = "sunqm";
     repo = "libcint";
     rev = "v${version}";
-    hash = "sha256-URJcC0ib87ejrTCglCjhC2tQHNc5TRvo4CQ52N58n+4=";
+    hash = "sha256-k9luTarszZAqh33SzPMM3BYj01HT7cfTipt44nSC+2A=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libguestfs/package.nix b/pkgs/by-name/li/libguestfs/package.nix
index 306bdd38a48e..de1c64979b86 100644
--- a/pkgs/by-name/li/libguestfs/package.nix
+++ b/pkgs/by-name/li/libguestfs/package.nix
@@ -45,11 +45,11 @@ assert appliance == null || lib.isDerivation appliance;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libguestfs";
-  version = "1.56.1";
+  version = "1.56.2";
 
   src = fetchurl {
     url = "https://libguestfs.org/download/${lib.versions.majorMinor finalAttrs.version}-stable/libguestfs-${finalAttrs.version}.tar.gz";
-    hash = "sha256-nK3VUK4xLy/+JDt3N9P0bVa+71Ob7IODyoyw0/32LvU=";
+    hash = "sha256-u0SJGnleC3khPO4sSRSVpt1ksh9ydEVZFzDX94kBaJo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/libsolv/package.nix b/pkgs/by-name/li/libsolv/package.nix
index a2347611dad4..d8ef8279a364 100644
--- a/pkgs/by-name/li/libsolv/package.nix
+++ b/pkgs/by-name/li/libsolv/package.nix
@@ -18,14 +18,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.34";
+  version = "0.7.35";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "libsolv";
     rev = version;
-    hash = "sha256-B/VFrtg/OnAyfgNTlUM9u4YCqsqLD/N3imxWVxZUe6A=";
+    hash = "sha256-DHECjda7s12hSysbaXK2+wM/nXpAOpTn+eSf9XGC3z0=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index ad626ee7c4ce..231fd92e5239 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -12,6 +12,7 @@
 
   rocmSupport ? config.rocmSupport,
   rocmPackages ? { },
+  rocmGpuTargets ? builtins.concatStringsSep ";" rocmPackages.clr.gpuTargets,
 
   openclSupport ? false,
   clblast,
@@ -146,8 +147,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   ]
   ++ optionals rocmSupport [
     (cmakeFeature "CMAKE_HIP_COMPILER" "${rocmPackages.clr.hipClangPath}/clang++")
-    # TODO: this should become `clr.gpuTargets` in the future.
-    (cmakeFeature "CMAKE_HIP_ARCHITECTURES" rocmPackages.rocblas.amdgpu_targets)
+    (cmakeFeature "CMAKE_HIP_ARCHITECTURES" rocmGpuTargets)
   ]
   ++ optionals metalSupport [
     (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1")
diff --git a/pkgs/by-name/ly/LycheeSlicer/package.nix b/pkgs/by-name/ly/LycheeSlicer/package.nix
index 1c859fd9767c..8621e4ce26ca 100644
--- a/pkgs/by-name/ly/LycheeSlicer/package.nix
+++ b/pkgs/by-name/ly/LycheeSlicer/package.nix
@@ -9,11 +9,11 @@
 }:
 let
   pname = "LycheeSlicer";
-  version = "7.4.2";
+  version = "7.4.3";
 
   src = fetchurl {
     url = "https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/LycheeSlicer-${version}.AppImage";
-    hash = "sha256-RTLlNB6eiesXZayC69hpnXQsAgmPuaJTC+18Q6KzAP0=";
+    hash = "sha256-V+X8aF+uFnhSIm5MC8/EfYwWkLoHqqgT1G5Ozn5Y69I=";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 5a0971829d4b..2361333a8112 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -6,7 +6,6 @@
   patchelf,
   bintools,
   dpkg,
-
   # Linked dynamic libraries.
   alsa-lib,
   at-spi2-atk,
@@ -47,20 +46,15 @@
   pipewire,
   vulkan-loader,
   wayland, # ozone/wayland
-
   # Command line programs
   coreutils,
-
   # command line arguments which are always set e.g "--disable-gpu"
   commandLineArgs ? "",
-
   # Will crash without.
   systemd,
-
   # Loaded at runtime.
   libexif,
   pciutils,
-
   # Additional dependencies according to other distros.
   ## Ubuntu
   curl,
@@ -79,34 +73,25 @@
   ## Gentoo
   bzip2,
   libcap,
-
   # Necessary for USB audio devices.
   libpulseaudio,
   pulseSupport ? true,
-
   adwaita-icon-theme,
   gsettings-desktop-schemas,
-
   # For video acceleration via VA-API (--enable-features=VaapiVideoDecoder)
   libva,
   libvaSupport ? true,
-
   # For Vulkan support (--enable-features=Vulkan)
   addDriverRunpath,
-
   # For QT support
   qt6,
-
   # Edge AAD sync
   cacert,
   libsecret,
-
   # Edge Specific
   libuuid,
 }:
-
 let
-
   opusWithCustomModes = libopus.override { withCustomModes = true; };
 
   deps = [
@@ -175,14 +160,13 @@ let
   ++ lib.optionals pulseSupport [ libpulseaudio ]
   ++ lib.optionals libvaSupport [ libva ];
 in
-
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "139.0.3405.102";
+  version = "139.0.3405.111";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-rY6Q3sMIAGX/ZKOVvwSl6cxq24SB1PiCn7b1pMXMeps=";
+    hash = "sha256-1hsvzvaVCDSWGEpqMjsrz7V9Ra+PtoZ//lSXSlmS3FI=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/mi/miller/package.nix b/pkgs/by-name/mi/miller/package.nix
index afcd19a6398d..cae50e379a81 100644
--- a/pkgs/by-name/mi/miller/package.nix
+++ b/pkgs/by-name/mi/miller/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "miller";
-  version = "6.14.0";
+  version = "6.15.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${version}";
-    sha256 = "sha256-tpM+Y65zYvnTd9VNJPDTWyj0RC+VmdmVCNzXyVGs/EI=";
+    sha256 = "sha256-r+eayyxI+qFypDHavv9fOAl3rjjKeQxy8tXetmh/ZAI=";
   };
 
   outputs = [
@@ -20,7 +20,7 @@ buildGoModule rec {
     "man"
   ];
 
-  vendorHash = "sha256-KgQZg8+6Vo4t0yx7AwuOyRWIMT7vwUO5nfDgBSVceIA=";
+  vendorHash = "sha256-siLrJOMvsv8MkDVVK8xPn4tpyYSqoYT2Iku7ZP0NCk0=";
 
   postInstall = ''
     mkdir -p $man/share/man/man1
diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index 6afa78b61844..1d7bc16b5fb8 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -25,14 +25,14 @@ in
 
 py.pkgs.buildPythonApplication rec {
   pname = "oci-cli";
-  version = "3.64.0";
+  version = "3.64.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${version}";
-    hash = "sha256-ywLeU/qX3sJfVothJ/JSEdp3VEkRI9nXNcWHGuY+X84=";
+    hash = "sha256-YiRUvfDtE5uZDI/g4/k0458N8RnNzNgUuU5ZblDsD0E=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/oh/oh-my-zsh/package.nix b/pkgs/by-name/oh/oh-my-zsh/package.nix
index 287515ced0e9..83b2a8c3474c 100644
--- a/pkgs/by-name/oh/oh-my-zsh/package.nix
+++ b/pkgs/by-name/oh/oh-my-zsh/package.nix
@@ -19,14 +19,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2025-08-08";
+  version = "2025-08-16";
   pname = "oh-my-zsh";
 
   src = fetchFromGitHub {
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    rev = "9d8d4cf41482a95127ca41faecc0a7ee0781ca2e";
-    sha256 = "sha256-u98vvBhGYfvfYmo/J8hBc6bDui5HVlgM3hY32LwJGio=";
+    rev = "736632228a5f39573a15f4533b7672851f30bbe6";
+    sha256 = "sha256-NylC656n3cokbacg0YM8xjKtibBK8vvXG/7G3WXiIQw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/pl/plog/package.nix b/pkgs/by-name/pl/plog/package.nix
index 7152799ef7c7..59d7b8456c16 100644
--- a/pkgs/by-name/pl/plog/package.nix
+++ b/pkgs/by-name/pl/plog/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "plog";
-  version = "1.1.10";
+  version = "1.1.11";
 
   outputs = [
     "out"
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     owner = "SergiusTheBest";
     repo = "plog";
     rev = version;
-    hash = "sha256-NZphrg9OB1FTY2ifu76AXeCyGwW2a2BkxMGjZPf4uM8=";
+    hash = "sha256-/H7qNL6aPjmFYk0X1sx4CCSZWrAMQgPo8I9X/P50ln0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 9ede1352de4c..25afdcbf3ad0 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "podman-desktop";
-  version = "1.20.2";
+  version = "1.21.0";
 
   passthru.updateScript = _experimental-update-script-combinators.sequence [
     (nix-update-script { })
@@ -57,13 +57,13 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "containers";
     repo = "podman-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+UdVTTm528Q9TIZwznzseBn8JazvQJOxJyjdzBmVUaA=";
+    hash = "sha256-Wio+lETdsDhcZvluKV6gUqjT0lTE9nYL5TqPLCR4Kr0=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-GX33PE534jWX7v9jCwZALuCT6gQClBXlOTPZC09EuC8=";
+    hash = "sha256-yteFC4/raBdL4gjBtsGL/lVRpo11BuhS7Xm0mFgz3t4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/re/readsb/package.nix b/pkgs/by-name/re/readsb/package.nix
index 5074e1afe289..c3acdec80a4b 100644
--- a/pkgs/by-name/re/readsb/package.nix
+++ b/pkgs/by-name/re/readsb/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "readsb";
-  version = "3.14.1691";
+  version = "3.14.1696";
 
   src = fetchFromGitHub {
     owner = "wiedehopf";
     repo = "readsb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+OZhXyx/eNaMiKdwOK0XtzSHmdaxpCQeEqVwWja9iws=";
+    hash = "sha256-NStX7GwYffXlvoj30ZReVlUHGUSnAZRXdasMYj6C0Dk=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/re/redpanda-client/package.nix b/pkgs/by-name/re/redpanda-client/package.nix
index f53dc6069c97..f3b71d78a597 100644
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "25.2.1";
+  version = "25.2.2";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-zHhWbz2UdsZNMYNhcVBiYE5TD8mSttaD3GltE/9MOTU=";
+    sha256 = "sha256-aISbPpSgqXHmGt5H1t5AcWos+iCKgAOAl+BExYFrdAs=";
   };
 in
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
   inherit doCheck src version;
   modRoot = "./src/go/rpk";
   runVend = false;
-  vendorHash = "sha256-ECShBCtZcrM+pvUQD3UZ2O6tCcOfI8WiOpDQjqKdh64=";
+  vendorHash = "sha256-izVae+BsyTT0QA/Fx7e3oxtyGisM41znDOZJchLNor8=";
 
   ldflags = [
     ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
diff --git a/pkgs/by-name/re/release-plz/package.nix b/pkgs/by-name/re/release-plz/package.nix
index 84ffbab32ec6..535fdaea13a8 100644
--- a/pkgs/by-name/re/release-plz/package.nix
+++ b/pkgs/by-name/re/release-plz/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.139";
+  version = "0.3.140";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-s2PvMJu0RLO2AOMMonq4xdZlQXHrvKoqh4v9tp72Ud0=";
+    hash = "sha256-pJHyf1aSn4YqzFYW6otuRY+gJ6TBCKFGQuH2Py5uWlE=";
   };
 
-  cargoHash = "sha256-S5YhAcEhTbiM0VCAy3IiObc1uCPbsIi0QqeFxocVqw4=";
+  cargoHash = "sha256-LfadgdrGD9g/PNeFs/XNUk2x0h1i3znzMhIV+w1DjMk=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index eb5e17a4b397..55bcc62cdce1 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2025-08-08";
+  version = "0-unstable-2025-08-21";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "0e49cbea7b4047ffec3bb35a59f2ec6dc4606a48";
-    hash = "sha256-YfaOPWJ113UDjmKgj6eaN9bcIk9iW1nc2jeN3M+LyB8=";
+    rev = "94e40c3622d08312226bed788b5d7970e06283c6";
+    hash = "sha256-a8QlQujBQT1ho9JbZjKH2v0l5LugemlGzBKoSSheFMA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ro/rocksdb/package.nix b/pkgs/by-name/ro/rocksdb/package.nix
index ca2b21903415..76a2bec91d6f 100644
--- a/pkgs/by-name/ro/rocksdb/package.nix
+++ b/pkgs/by-name/ro/rocksdb/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocksdb";
-  version = "10.4.2";
+  version = "10.5.1";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "rocksdb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mKh6zsmxsiUix4LX+npiytmKvLbo6WNA9y4Ns/EY+bE=";
+    hash = "sha256-TDYXzYbOLhcIRi+qi0FW1OLVtfKOF+gUbj62Tgpp3/E=";
   };
 
   patches = lib.optional (
diff --git a/pkgs/by-name/ru/ruffle/package.nix b/pkgs/by-name/ru/ruffle/package.nix
index 466011e50e4f..6c1c34a8ee88 100644
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@@ -21,16 +21,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruffle";
-  version = "0-nightly-2025-08-14";
+  version = "0-nightly-2025-08-22";
 
   src = fetchFromGitHub {
     owner = "ruffle-rs";
     repo = "ruffle";
     tag = lib.strings.removePrefix "0-" finalAttrs.version;
-    hash = "sha256-+JdZoYderFUngMbFMNXw1pbW6qogb7vCeqdIHEzqMjQ=";
+    hash = "sha256-bv8ZQuEU8QqtC7fvtELXlkQkjPoGqqSglhE0lzsTEIk=";
   };
 
-  cargoHash = "sha256-P+uFE92ZWa491snEanzB1T0OPPOOYZsy2RAmwtIIAdo=";
+  cargoHash = "sha256-89xxPl6nIp4VLsQqsaXH9VKWX6Ehw6KCJaOuxnSxu0g=";
   cargoBuildFlags = lib.optional withRuffleTools "--workspace";
 
   env =
diff --git a/pkgs/by-name/sc/scip-go/package.nix b/pkgs/by-name/sc/scip-go/package.nix
index 46d0e356b24a..7b4615fd8768 100644
--- a/pkgs/by-name/sc/scip-go/package.nix
+++ b/pkgs/by-name/sc/scip-go/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "scip-go";
-  version = "0.1.24";
+  version = "0.1.25";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "scip-go";
     rev = "v${version}";
-    hash = "sha256-qHGJ6yD3mnhHnu/KOShFb7Gu31jBPtKiEjAkaRlWJpE=";
+    hash = "sha256-qzLDqHnZpJtdBZa/YOLZCiS+V52a1Lxc0TLsfSeRCG8=";
   };
 
-  vendorHash = "sha256-E/1ubWGIx+sGC+owqw4nOkrwUFJfgTeqDNpH8HCwNhA=";
+  vendorHash = "sha256-J/97J/VXmQAYHu1qr9KiTUrB6/SVFcahihRatCKgaD8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/se/sentencepiece/package.nix b/pkgs/by-name/se/sentencepiece/package.nix
index ec3af48b8b83..5963ae9582a9 100644
--- a/pkgs/by-name/se/sentencepiece/package.nix
+++ b/pkgs/by-name/se/sentencepiece/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentencepiece";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "sentencepiece";
     tag = "v${version}";
-    sha256 = "sha256-tMt6UBDqpdjAhxAJlVOFFlE3RC36/t8K0gBAzbesnsg=";
+    sha256 = "sha256-q0JgMxoD9PLqr6zKmOdrK2A+9RXVDub6xy7NOapS+vs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sh/shaarli/package.nix b/pkgs/by-name/sh/shaarli/package.nix
index 034e048e77e1..5c07339d2761 100644
--- a/pkgs/by-name/sh/shaarli/package.nix
+++ b/pkgs/by-name/sh/shaarli/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "shaarli";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchurl {
     url = "https://github.com/shaarli/Shaarli/releases/download/v${version}/shaarli-v${version}-full.tar.gz";
-    sha256 = "sha256-vTSjYrde6ODQnIh77Um4McR9M8KKWnuIGRGE7SCMZC0=";
+    sha256 = "sha256-+UEtbEYHQrLtClk6VemMhSNx0OPh/JDVlDIfeIzdmRI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sh/shpool/package.nix b/pkgs/by-name/sh/shpool/package.nix
index dff35c483400..d8d60b2ced2d 100644
--- a/pkgs/by-name/sh/shpool/package.nix
+++ b/pkgs/by-name/sh/shpool/package.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shpool";
-  version = "0.8.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "shell-pool";
     repo = "shpool";
     rev = "v${version}";
-    hash = "sha256-pSSMC4pUtB38c6UNOj+Ma/Y1jcSfm33QV1B4tA/MyKY=";
+    hash = "sha256-Dh2Law70RbGkD9dlbhes47CTgwPoEnN5WmxL10arCtk=";
   };
 
   postPatch = ''
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
       --replace-fail '/usr/bin/shpool' "$out/bin/shpool"
   '';
 
-  cargoHash = "sha256-JDMgYd9mKsLdqc8rpDg3ymgFj/ntpBBF5fSDb2cLOJs=";
+  cargoHash = "sha256-PCcRtpw+l7a9P2V7O4DGE6uatJ0TfGJyLUxbqiBY1Ro=";
 
   buildInputs = [
     linux-pam
diff --git a/pkgs/by-name/si/simplotask/package.nix b/pkgs/by-name/si/simplotask/package.nix
index 66c0d21ebe0d..d98b732ee128 100644
--- a/pkgs/by-name/si/simplotask/package.nix
+++ b/pkgs/by-name/si/simplotask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "simplotask";
-  version = "1.17.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "umputun";
     repo = "spot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7EavT4IHEAe3nq6tkhX7qHpDzy7UTdBMZ7x/bquv4Z8=";
+    hash = "sha256-0XAxjh9TWMqMkeSEhdgXX9DflHnT40f7VkHgp1QjQUg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/st/strawberry/package.nix b/pkgs/by-name/st/strawberry/package.nix
index 853213f4e720..8380a0f4d67c 100644
--- a/pkgs/by-name/st/strawberry/package.nix
+++ b/pkgs/by-name/st/strawberry/package.nix
@@ -38,13 +38,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "strawberry";
-  version = "1.2.11";
+  version = "1.2.12";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = "strawberry";
     rev = finalAttrs.finalPackage.version;
-    hash = "sha256-AhNx2CdfE7ff3+L47X6lYPD8GA7imkDIJD5ESndn/cc=";
+    hash = "sha256-09aUhouuE9SFHwtNeB4QtrAhKrP8m3ZbO+t4EKvxhMo=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
diff --git a/pkgs/by-name/st/stylelint/package.nix b/pkgs/by-name/st/stylelint/package.nix
index 6b519ac4c79e..7dcc1152ee38 100644
--- a/pkgs/by-name/st/stylelint/package.nix
+++ b/pkgs/by-name/st/stylelint/package.nix
@@ -5,16 +5,16 @@
 }:
 buildNpmPackage rec {
   pname = "stylelint";
-  version = "16.23.0";
+  version = "16.23.1";
 
   src = fetchFromGitHub {
     owner = "stylelint";
     repo = "stylelint";
     tag = version;
-    hash = "sha256-kPqvrcIYxumy/SfW8sVqo2e72z32L4mgfAE79LS8BfE=";
+    hash = "sha256-OABtOdysDm0KpXWJ9fegi1XSZcKi5zohDtwxXvNDAf8=";
   };
 
-  npmDepsHash = "sha256-SJ1r2lINacrdFYUkjse4wx0EwFsFMVoeESzMKH2ijwU=";
+  npmDepsHash = "sha256-/chT/NTvfClFkCA+40BzTl2WNH9JrWzHWZshOCgCxcQ=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/sy/syncstorage-rs/package.nix b/pkgs/by-name/sy/syncstorage-rs/package.nix
index 4eb3bc70888b..7e361abeb4de 100644
--- a/pkgs/by-name/sy/syncstorage-rs/package.nix
+++ b/pkgs/by-name/sy/syncstorage-rs/package.nix
@@ -22,13 +22,13 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "syncstorage-rs";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "mozilla-services";
     repo = "syncstorage-rs";
     tag = version;
-    hash = "sha256-UEBF0z2gn9Jpj6IefvB5XMwt21uuD5PlpHj7Ow7yf/Y=";
+    hash = "sha256-K4oVobACVLc99WNageaXrkJDeNAn8JQNykhcLZdNYck=";
   };
 
   nativeBuildInputs = [
@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage rec {
       --prefix PATH : ${lib.makeBinPath [ pyFxADeps ]}
   '';
 
-  cargoHash = "sha256-fkVqyA296BmK+jK9yJ0gj0V7CThv021AxNMCMFdr8fg=";
+  cargoHash = "sha256-xKLSsTI7Uo1MdTMxp04PW31Fai4tmPLMR3IgiGZD45U=";
 
   # almost all tests need a DB to test against
   doCheck = false;
diff --git a/pkgs/by-name/ta/tageditor/package.nix b/pkgs/by-name/ta/tageditor/package.nix
index f0babd818ed2..de03722f3c4e 100644
--- a/pkgs/by-name/ta/tageditor/package.nix
+++ b/pkgs/by-name/ta/tageditor/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tageditor";
-  version = "3.9.5";
+  version = "3.9.6";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = "tageditor";
     tag = "v${version}";
-    hash = "sha256-Sia6Y/V81WQj4oWjZAAR4o3TngfWq7sWxxiKEuFjQ2M=";
+    hash = "sha256-weGLC8TPSA9XQ/TuLj4DBswmlEbpxPplsxI4sqygHfU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tf/tfmigrate/package.nix b/pkgs/by-name/tf/tfmigrate/package.nix
index 0b8ba744f031..54460e85527c 100644
--- a/pkgs/by-name/tf/tfmigrate/package.nix
+++ b/pkgs/by-name/tf/tfmigrate/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tfmigrate";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "minamijoyo";
     repo = "tfmigrate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+5nw+EgFTor8XL4cibxkpJL4fdEQ6UuEj5wyOjpaANA=";
+    hash = "sha256-tuLbcxJj8TsG3I/o3cHO2DtQm9ql3wlhYBtYiMbRW7o=";
   };
 
-  vendorHash = "sha256-mm34U4nLow4lCz/AgfqYZJRb71GpQjR14+tm0hfmdDc=";
+  vendorHash = "sha256-TqZi5NZ+4eSzq98/ZM4Gab7Sud7bz1DNHrp5nGaGHDE=";
 
   checkFlags = [
     "-skip TestExecutorDir" # assumes /usr/bin to be present
diff --git a/pkgs/by-name/ti/tidb/package.nix b/pkgs/by-name/ti/tidb/package.nix
index bb9ca45ab130..1b813b52c6c6 100644
--- a/pkgs/by-name/ti/tidb/package.nix
+++ b/pkgs/by-name/ti/tidb/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tidb";
-  version = "8.5.2";
+  version = "8.5.3";
 
   src = fetchFromGitHub {
     owner = "pingcap";
     repo = "tidb";
     rev = "v${version}";
-    sha256 = "sha256-6fXkNG+cQh4HCZj3ApmLUA+n5ViSVOyABoCwx0K8Ja4=";
+    sha256 = "sha256-2pg3UxzxzB4V4XhfmSxQCOn+NFqvp7DF+htIY3mtZ4s=";
   };
 
-  vendorHash = "sha256-TLNa4ykczRronsKITPwVFOls8ql7xWXJvOibqYulC/Q=";
+  vendorHash = "sha256-HXN2EkpN2ltBUB2HqSvUOgVTfs2zcTeHoxa5zpccc+A=";
 
   ldflags = [
     "-X github.com/pingcap/tidb/pkg/parser/mysql.TiDBReleaseVersion=${version}"
diff --git a/pkgs/by-name/ur/urlwatch/package.nix b/pkgs/by-name/ur/urlwatch/package.nix
index 972cd24c1cfd..73429bad880c 100644
--- a/pkgs/by-name/ur/urlwatch/package.nix
+++ b/pkgs/by-name/ur/urlwatch/package.nix
@@ -12,22 +12,26 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "thp";
     repo = "urlwatch";
-    rev = version;
+    tag = version;
     hash = "sha256-X1UR9JrQuujOIUg87W0YqfXsM3A5nttWjjJMIe3hgk8=";
   };
 
   build-system = with python3Packages; [ setuptools ];
 
   dependencies = with python3Packages; [
+    aioxmpp
+    beautifulsoup4
+    cssbeautifier
     cssselect
     jq
+    jsbeautifier
     keyring
     lxml
     markdown2
     matrix-client
     minidb
-    playwright
     platformdirs
+    playwright
     pushbullet-py
     pycodestyle
     pyyaml
@@ -41,12 +45,13 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Tool for monitoring webpages for updates";
-    mainProgram = "urlwatch";
     homepage = "https://thp.io/2008/urlwatch/";
+    changelog = "https://github.com/thp/urlwatch/blob/${src.tag}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [
       kmein
       tv
     ];
+    mainProgram = "urlwatch";
   };
 }
diff --git a/pkgs/by-name/ux/uxn/package.nix b/pkgs/by-name/ux/uxn/package.nix
index 9b72375cedc3..4438bbbe03e0 100644
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "1.0-unstable-2025-07-12";
+  version = "1.0-unstable-2025-08-09";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "0bf6fc74c42f2bdfe3c7dfcdcb5290ee72efe99c";
-    hash = "sha256-FSxU6a8+G1iGIj1PCJi7zPLYIfos8Xk7KA4NxTW6+DI=";
+    rev = "b56cb3501b741410188b00ffcac9010cfbe1783c";
+    hash = "sha256-chw6+67JSlzelVhoQ7K1w7i61OnbmnEDyqDyaGAbflE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/vo/volctl/package.nix b/pkgs/by-name/vo/volctl/package.nix
index 57c79d878676..a1578720bd0d 100644
--- a/pkgs/by-name/vo/volctl/package.nix
+++ b/pkgs/by-name/vo/volctl/package.nix
@@ -13,14 +13,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "volctl";
-  version = "0.9.4";
+  version = "0.9.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "buzz";
     repo = "volctl";
     rev = "v${version}";
-    sha256 = "sha256-jzS97KV17wKeBI6deKE4rEj5lvqC38fq1JGundHn2So=";
+    sha256 = "sha256-zL1m/DeSOrNkjt9B+8pdy2jUgjSp7tt81UpAueGsIwQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index d6a1d7141aaf..004077f05d14 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,14 +1,14 @@
 {
   "darwin": {
-    "hash": "sha256-B9Qhh+1vvisdpE9XYQRbJ87Ilo4Qmy9Uvd7Zn4+TLxg=",
-    "version": "0.2025.08.13.08.12.stable_02"
+    "hash": "sha256-qfhEXZbsqLhS1yTWwjbcUwUW5/3mIe2sC+GT6NG9bmY=",
+    "version": "0.2025.08.20.08.11.stable_03"
   },
   "linux_x86_64": {
-    "hash": "sha256-x87HElhBSrh00LiCcKX9AnWiROVN4SEZTqu7D1R72LI=",
-    "version": "0.2025.08.13.08.12.stable_02"
+    "hash": "sha256-8aU5tFqqoD8yABQ2F5axqpD1ppL1FQyu5cY9MBEWgME=",
+    "version": "0.2025.08.20.08.11.stable_03"
   },
   "linux_aarch64": {
-    "hash": "sha256-+lv8dpx5fi12rhG258zSj0att/vTi7DidKCYlUCIbvo=",
-    "version": "0.2025.08.13.08.12.stable_02"
+    "hash": "sha256-xFAMoRQJ1Qpuun+VRmmj8DnJaIk+/48zwyIUO9xl6io=",
+    "version": "0.2025.08.20.08.11.stable_03"
   }
 }
diff --git a/pkgs/by-name/wa/waytrogen/package.nix b/pkgs/by-name/wa/waytrogen/package.nix
index 27aec72ba5b3..922b7e0e19e4 100644
--- a/pkgs/by-name/wa/waytrogen/package.nix
+++ b/pkgs/by-name/wa/waytrogen/package.nix
@@ -16,19 +16,19 @@
   desktop-file-utils,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "waytrogen";
   version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "nikolaizombie1";
     repo = "waytrogen";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-vFzOGadWR5xwhIKrKPHoAHstoeyFw4GrS5aYlpvEF5E=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-k6n6aWEJ/8Dkbd68CJfJ7kbRTltCuQ4AtZ5dALFD3lU=";
   };
 
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
       in the Rust 🦀 programming language. Supports hyprpaper, swaybg, mpvpaper and swww wallpaper changers.
     '';
     homepage = "https://github.com/nikolaizombie1/waytrogen";
-    changelog = "https://github.com/nikolaizombie1/waytrogen/releases/tag/${version}";
+    changelog = "https://github.com/nikolaizombie1/waytrogen/releases/tag/${finalAttrs.version}";
     license = lib.licenses.unlicense;
     maintainers = with lib.maintainers; [
       genga898
@@ -76,4 +76,4 @@ stdenv.mkDerivation rec {
     mainProgram = "waytrogen";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/we/weasis/package.nix b/pkgs/by-name/we/weasis/package.nix
index 9df26fccdeeb..0f513759f20c 100644
--- a/pkgs/by-name/we/weasis/package.nix
+++ b/pkgs/by-name/we/weasis/package.nix
@@ -18,12 +18,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "weasis";
-  version = "4.6.2";
+  version = "4.6.3";
 
   # Their build instructions indicate to use the packaging script
   src = fetchzip {
     url = "https://github.com/nroduit/Weasis/releases/download/v${finalAttrs.version}/weasis-native.zip";
-    hash = "sha256-7oYrUNj9BBcFh+1CQQ4PJW8ln+fd5Ed9y9tMoixc5Mc=";
+    hash = "sha256-1dvBKxInuk8FpZjo59+LkIuEBTr57wkLaHfvvvT6bOg=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/xe/xee/package.nix b/pkgs/by-name/xe/xee/package.nix
index feb6ab8d5572..e8d4eca6fc60 100644
--- a/pkgs/by-name/xe/xee/package.nix
+++ b/pkgs/by-name/xe/xee/package.nix
@@ -8,41 +8,22 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xee";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "Paligo";
     repo = "xee";
     tag = "xee-v${finalAttrs.version}";
-    hash = "sha256-l5g2YZ4lNu+CLyya0FavDEqbJayaTXGrB8fYCr3fj0s=";
+    hash = "sha256-AU1x2Y2oDaUi4XliOf3GxJCwPv/OMTTUE2p/SOJtM2k=";
   };
 
-  cargoHash = "sha256-Ora6VwYLDyFI4iA4FkygGsup8I4OvK0kkLvHs4F/YhY=";
+  cargoHash = "sha256-30OXowgIVSXMFEZVM74kwU8mdDuXVngsISyVQ0MB+VQ=";
 
   cargoBuildFlags = [
     "--package"
     "xee"
   ];
 
-  nativeBuildInputs = [
-    # "${cargoDeps}/build-data-0.2.1/src/lib.rs" is pretty terrible
-    (writers.writePython3Bin "git" { } ''
-      import sys
-      import os
-      sys.argv[0] = os.path.basename(sys.argv[0])
-      if sys.argv == ["git", "rev-parse", "HEAD"]:
-          print("${finalAttrs.src.rev}")
-      elif sys.argv == ["git", "rev-parse", "--abbrev-ref=loose", "HEAD"]:
-          print("${finalAttrs.src.rev}")
-      elif sys.argv == ["git", "status", "-s"]:
-          pass
-      elif sys.argv == ["git", "log", "-1", "--pretty=%ct"]:
-          print(os.environ.get("SOURCE_DATE_EPOCH", "0"))
-      else:
-          raise RuntimeError(sys.argv[1:])
-    '')
-  ];
-
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/yo/yourkit-java/package.nix b/pkgs/by-name/yo/yourkit-java/package.nix
index 64a40c0e80a1..6b92b70900ca 100644
--- a/pkgs/by-name/yo/yourkit-java/package.nix
+++ b/pkgs/by-name/yo/yourkit-java/package.nix
@@ -10,7 +10,7 @@
 let
   vPath = v: lib.elemAt (lib.splitString "-" v) 0;
 
-  version = "2025.3-b153";
+  version = "2025.3-b154";
 
   arches = {
     aarch64-linux = "arm64";
@@ -20,8 +20,8 @@ let
   arch = arches.${stdenvNoCC.targetPlatform.system} or (throw "Unsupported system");
 
   hashes = {
-    arm64 = "sha256-DKpNFv5nuxdIUjgM/+LyVweV0B6SfCojcWfsAkoMH6w=";
-    x64 = "sha256-9CSCJaISxdc7lwZUxyO8gmkxuuvKMb3I9G0ftYfYY7c=";
+    arm64 = "sha256-X9YQy12rfTWOVKX2ufmS4GxLGp/I6jhZAZyRBfLuOuk=";
+    x64 = "sha256-BuEfpMEgkOcbUra6eT/sTiVhXpheMaCe55M/CuG0kHE=";
   };
 
   desktopItem = makeDesktopItem {
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index 3974372a9d36..803a3cbce898 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -19,14 +19,14 @@ python3Packages.buildPythonApplication rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2025.08.20";
+  version = "2025.08.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yt-dlp";
     repo = "yt-dlp";
     tag = version;
-    hash = "sha256-FeIoV7Ya+tGCMvUUXmPrs4MN52zwqrcpzJ6Arh4V450=";
+    hash = "sha256-58Qj+Bt4GEGgWpqAuMVemixm5AUcqS+e2Sajoeun8KY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix
index cde6a3164478..0ce9a1fd6dad 100644
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zizmor";
-  version = "1.11.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "zizmorcore";
     repo = "zizmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zxEF76zpqwLroC5GjSkwIC3+XdXmErvabIEqhVe0zCA=";
+    hash = "sha256-GnKSbcsVYzbhsrwIUAEArltzQe0IE2tiIr2CqsMQyzk=";
   };
 
-  cargoHash = "sha256-vxDyao9pX/CfS08vFmq3vXtgDIg5NXlEwpzroGW48dA=";
+  cargoHash = "sha256-wLJlaV59sAo97KI6Ekw42aaG6hVkul1wFvcC+71+Zp4=";
 
   nativeBuildInputs = lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     installShellFiles
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index d20085c94014..0478e9bd4c85 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -86,4 +86,4 @@ let
 
   llvmPackages = lib.mapAttrs' (version: args: mkPackage (args // { inherit version; })) versions;
 in
-llvmPackages // { inherit mkPackage; }
+llvmPackages // { inherit mkPackage versions; }
diff --git a/pkgs/development/compilers/osl/default.nix b/pkgs/development/compilers/osl/default.nix
index ad77ad53e139..47f6518395df 100644
--- a/pkgs/development/compilers/osl/default.nix
+++ b/pkgs/development/compilers/osl/default.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openshadinglanguage";
-  version = "1.14.6.0";
+  version = "1.14.7.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenShadingLanguage";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HVkZZkB15+PT9HcAo8NPhzM86wv5ZvnARQVu+n2gTGw=";
+    hash = "sha256-w78x0e9T0lYCAPDPkx6T/4TzAs/mpJ/24uQ+yH5gB5I=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index e677d060df81..5607d67d93b0 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clojure";
-  version = "1.12.1.1550";
+  version = "1.12.1.1561";
 
   src = fetchurl {
     # https://github.com/clojure/brew-install/releases
     url = "https://github.com/clojure/brew-install/releases/download/${finalAttrs.version}/clojure-tools-${finalAttrs.version}.tar.gz";
-    hash = "sha256-kGxiVnnHLnA1h1mIpGOSodg9Fu4d9ZmlYaL9M0JLDT8=";
+    hash = "sha256-+7hFf2S/M8yMqve+d8RjCoKBZ0R3d6gJqarlh9U1B18=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/smtml/default.nix b/pkgs/development/ocaml-modules/smtml/default.nix
index dd3999f3f960..28fa178f2a30 100644
--- a/pkgs/development/ocaml-modules/smtml/default.nix
+++ b/pkgs/development/ocaml-modules/smtml/default.nix
@@ -25,13 +25,13 @@
 
 buildDunePackage rec {
   pname = "smtml";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "formalsec";
     repo = "smtml";
     tag = "v${version}";
-    hash = "sha256-gmYyVUkwXBqGKGhp6Pqdf2PJafUJ1hF96WxOLq1h2f8=";
+    hash = "sha256-hgpxOQZ7mhELcT71j1EZJNstnTSntEjKDEokUaj5kAs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/arcam-fmj/default.nix b/pkgs/development/python-modules/arcam-fmj/default.nix
index 94ce7ed66ada..c0ba99e384f9 100644
--- a/pkgs/development/python-modules/arcam-fmj/default.nix
+++ b/pkgs/development/python-modules/arcam-fmj/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   version = "2.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "elupus";
diff --git a/pkgs/development/python-modules/beewi-smartclim/default.nix b/pkgs/development/python-modules/beewi-smartclim/default.nix
new file mode 100644
index 000000000000..083894116408
--- /dev/null
+++ b/pkgs/development/python-modules/beewi-smartclim/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  btlewrap,
+  bluepy,
+}:
+
+buildPythonPackage rec {
+  pname = "beewi-smartclim";
+  version = "0.0.10";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "alemuro";
+    repo = "beewi_smartclim";
+    tag = version;
+    hash = "sha256-xdr545Q4DFhup2BCMZZ1WYWgt97qT6oipIHWcsp90+A=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    btlewrap
+    bluepy
+  ];
+
+  # No tests available
+  doCheck = false;
+
+  pythonImportsCheck = [ "beewi_smartclim" ];
+
+  meta = {
+    description = "Library to read data from BeeWi SmartClim sensor using Bluetooth LE";
+    homepage = "https://github.com/alemuro/beewi_smartclim";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/btlewrap/default.nix b/pkgs/development/python-modules/btlewrap/default.nix
new file mode 100644
index 000000000000..b0d91e996dfe
--- /dev/null
+++ b/pkgs/development/python-modules/btlewrap/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  bluepy,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "btlewrap";
+  version = "0.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ChristianKuehnel";
+    repo = "btlewrap";
+    tag = "v${version}";
+    hash = "sha256-cjPj+Uw/L9kq/BbxlnOCJtaBcnf9VOJKN2NJ3cmKe6U=";
+  };
+
+  build-system = [ setuptools ];
+
+  optional-dependencies = {
+    bluepy = [ bluepy ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTestPaths = [
+    # Require optional dependencies or hardware
+    "test/unit_tests/test_bluepy.py"
+    "test/unit_tests/test_pygatt.py"
+    "test/integration_tests/"
+    "test/unit_tests/test_available_backends.py"
+  ];
+
+  pythonImportsCheck = [ "btlewrap" ];
+
+  meta = {
+    description = "Wrapper around different bluetooth low energy backends";
+    homepage = "https://github.com/ChristianKuehnel/btlewrap";
+    changelog = "https://github.com/ChristianKuehnel/btlewrap/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/cf-xarray/default.nix b/pkgs/development/python-modules/cf-xarray/default.nix
index f6192a9e68fc..c8cc0d1fd416 100644
--- a/pkgs/development/python-modules/cf-xarray/default.nix
+++ b/pkgs/development/python-modules/cf-xarray/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "cf-xarray";
-  version = "0.10.6";
+  version = "0.10.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xarray-contrib";
     repo = "cf-xarray";
     tag = "v${version}";
-    hash = "sha256-zBjNOWDuO6yZNwD4Sv69X2i9ajUGIqvjlRA3gqmtgU8=";
+    hash = "sha256-hFM3xZzal+i4H8wF83LDEL4nAJE1d59LNQgkcrLSE80=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/click-shell/default.nix b/pkgs/development/python-modules/click-shell/default.nix
index fa95216a3267..5f4536439d3e 100644
--- a/pkgs/development/python-modules/click-shell/default.nix
+++ b/pkgs/development/python-modules/click-shell/default.nix
@@ -5,14 +5,15 @@
   click,
   pytestCheckHook,
   pytest-click,
+  setuptools,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "click-shell";
   version = "2.1";
-  format = "setuptools";
+  pyproject = true;
 
-  # PyPi release is missing tests
   src = fetchFromGitHub {
     owner = "clarkperkins";
     repo = "click-shell";
@@ -20,17 +21,18 @@ buildPythonPackage rec {
     hash = "sha256-4QpQzg0yFuOFymGiTI+A8o6LyX78iTJMqr0ernYbilI=";
   };
 
-  propagatedBuildInputs = [ click ];
+  build-system = [ setuptools ];
+
+  dependencies = [ click ];
 
   nativeCheckInputs = [
     pytest-click
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   pythonImportsCheck = [ "click_shell" ];
 
-  preCheck = "export HOME=$(mktemp -d)";
-
   meta = with lib; {
     description = "Extension to click that easily turns your click app into a shell utility";
     longDescription = ''
@@ -40,6 +42,7 @@ buildPythonPackage rec {
       with command completion to any click app.
     '';
     homepage = "https://github.com/clarkperkins/click-shell";
+    changelog = "https://github.com/clarkperkins/click-shell/releases/tag/${src.tag}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ binsky ];
   };
diff --git a/pkgs/development/python-modules/craft-grammar/default.nix b/pkgs/development/python-modules/craft-grammar/default.nix
index a9b5a352eacc..53c8a3691462 100644
--- a/pkgs/development/python-modules/craft-grammar/default.nix
+++ b/pkgs/development/python-modules/craft-grammar/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "craft-grammar";
-  version = "2.0.3";
+  version = "2.1.0";
 
   pyproject = true;
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-grammar";
     tag = version;
-    hash = "sha256-d7U4AAUikYcz26ZSXQwkTobSKN1PpaL20enfggHSKRM=";
+    hash = "sha256-R1+8KuJmG12WhJyeOu5G43hcXPHBD6UOqcKRePQNiZM=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/discid/default.nix b/pkgs/development/python-modules/discid/default.nix
index 75439108a15b..e2cfa9a0670b 100644
--- a/pkgs/development/python-modules/discid/default.nix
+++ b/pkgs/development/python-modules/discid/default.nix
@@ -4,18 +4,23 @@
   libdiscid,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "discid";
   version = "1.3.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-cWChIRrD1qbYIT+4jdPXPjKr5eATNqWkyYWwgql9QzU=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   patchPhase =
     let
       extension = stdenv.hostPlatform.extensions.sharedLibrary;
diff --git a/pkgs/development/python-modules/ecpy/default.nix b/pkgs/development/python-modules/ecpy/default.nix
index da36c1c3c865..4303f4806d44 100644
--- a/pkgs/development/python-modules/ecpy/default.nix
+++ b/pkgs/development/python-modules/ecpy/default.nix
@@ -2,26 +2,21 @@
   lib,
   fetchPypi,
   buildPythonPackage,
-  isPy3k,
-  future,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "ecpy";
   version = "1.2.5";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "ECPy";
     inherit version;
-    sha256 = "9635cffb9b6ecf7fd7f72aea1665829ac74a1d272006d0057d45a621aae20228";
+    hash = "sha256-ljXP+5tuz3/X9yrqFmWCmsdKHScgBtAFfUWmIariAig=";
   };
 
-  prePatch = ''
-    sed -i "s|reqs.append('future')|pass|" setup.py
-  '';
-
-  propagatedBuildInputs = lib.optional (!isPy3k) future;
+  build-system = [ setuptools ];
 
   # No tests implemented
   doCheck = false;
@@ -31,6 +26,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pure Pyhton Elliptic Curve Library";
     homepage = "https://github.com/ubinity/ECPy";
+    changelog = "https://github.com/cslashm/ECPy/releases/tag/${version}";
     license = licenses.asl20;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix
index 884899fc994e..a576b37cd48f 100644
--- a/pkgs/development/python-modules/ffmpy/default.nix
+++ b/pkgs/development/python-modules/ffmpy/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "ffmpy";
-  version = "0.6.0";
+  version = "0.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8.1";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Ch00k";
     repo = "ffmpy";
     tag = version;
-    hash = "sha256-U20mBg+428kkka6NY9qc7X8jH8A5bKa++g2+PTn/MYg=";
+    hash = "sha256-u//L2vxucFlWmk1+pdp+iCrpzzMZUonDAn1LELgX86E=";
   };
 
   postPatch =
@@ -37,11 +37,6 @@ buildPythonPackage rec {
       for fname in tests/*.py; do
         echo >>"$fname" 'FFmpeg.__init__.__defaults__ = ("ffmpeg", *FFmpeg.__init__.__defaults__[1:])'
       done
-    ''
-    # uv-build in nixpkgs is now at 0.8.0, which otherwise breaks the constraint set by the package.
-    + ''
-      substituteInPlace pyproject.toml \
-        --replace-fail 'requires = ["uv_build>=0.7.9,<0.8.0"]' 'requires = ["uv_build>=0.7.9,<0.9.0"]'
     '';
 
   pythonImportsCheck = [ "ffmpy" ];
diff --git a/pkgs/development/python-modules/iglo/default.nix b/pkgs/development/python-modules/iglo/default.nix
new file mode 100644
index 000000000000..3bac1a68efbd
--- /dev/null
+++ b/pkgs/development/python-modules/iglo/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "iglo";
+  version = "1.2.7";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jesserockz";
+    repo = "python-iglo";
+    tag = "v${version}";
+    hash = "sha256-torDjfQcQ+ytv/Qab7PNugt1eLQJ0pPPz6p4f4kcFws=";
+  };
+
+  sourceRoot = "${src.name}/src";
+
+  build-system = [ setuptools ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "iglo" ];
+
+  meta = {
+    description = "Library to control iGlo based RGB lights";
+    homepage = "https://github.com/jesserockz/python-iglo";
+    changelog = "https://github.com/jesserockz/python-iglo/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/jsonargparse/default.nix b/pkgs/development/python-modules/jsonargparse/default.nix
index 90588f7b6864..f1c6e76b41a3 100644
--- a/pkgs/development/python-modules/jsonargparse/default.nix
+++ b/pkgs/development/python-modules/jsonargparse/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "jsonargparse";
-  version = "4.40.1";
+  version = "4.40.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "omni-us";
     repo = "jsonargparse";
     tag = "v${version}";
-    hash = "sha256-GxltSN1o7vAZQXrejpBp5YMqOQaln8pqKxmGNa0vA/Q=";
+    hash = "sha256-3Zs2F46tGcvIF9UOGI/P079BZLJJyEyP9LDPRfvSk4E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/lib50/default.nix b/pkgs/development/python-modules/lib50/default.nix
index 37a8b51eb111..c3b4c55ef63e 100644
--- a/pkgs/development/python-modules/lib50/default.nix
+++ b/pkgs/development/python-modules/lib50/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "lib50";
-  version = "3.1.1";
+  version = "3.1.4";
   pyproject = true;
 
   # latest GitHub release is several years old. Pypi is up to date.
   src = fetchPypi {
     pname = "lib50";
     inherit version;
-    hash = "sha256-DSAYgtce9lU9dlfLejdIH9K8jVeNaPl0wSqStMgwUD4=";
+    hash = "sha256-/fuiizWAvM1L+shuEnYo0pXwWsLAjDEYUNfb56d/8Y0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix b/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix
index 761e7deff0e9..3c3e46f92c0e 100644
--- a/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  fetchpatch,
   setuptools,
   autobahn,
   twisted,
@@ -19,6 +20,15 @@ buildPythonPackage rec {
     hash = "sha256-kS2DXaIbESZsdxEdybXlgAJj/AuY8KF5liJn30GBnow=";
   };
 
+  patches = [
+    # TODO: drop when updating beyond version 0.4.0
+    (fetchpatch {
+      name = "stock-Twisted-testing-reactor-seems-to-work.patch";
+      url = "https://github.com/magic-wormhole/magic-wormhole-transit-relay/commit/3abb80fd5e55bd0ba8ee66278ccf76be5f904622.patch";
+      hash = "sha256-qMaJ58kPWvEfnSZiFzxO6GlkBiyVMsgGDEa1deITZco=";
+    })
+  ];
+
   postPatch = ''
     # Passing the environment to twistd is necessary to preserve Python's site path.
     substituteInPlace src/wormhole_transit_relay/test/test_backpressure.py --replace-fail \
diff --git a/pkgs/development/python-modules/magic-wormhole/default.nix b/pkgs/development/python-modules/magic-wormhole/default.nix
index 83152390624b..810a97f6e641 100644
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   installShellFiles,
 
   # build-system
@@ -41,16 +42,25 @@
 
 buildPythonPackage rec {
   pname = "magic-wormhole";
-  version = "0.19.2";
+  version = "0.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "magic-wormhole";
     repo = "magic-wormhole";
     tag = version;
-    hash = "sha256-5Tipcood5RktXY05p20hQpWhSMMnZm67I4iybjV8TcA=";
+    hash = "sha256-YjzdznZZ/0YTU83f3jlOr6+yOWQ++R1wU9IZDrfAMpo=";
   };
 
+  patches = [
+    # TODO: drop when updating beyond version 0.20.0
+    (fetchpatch {
+      name = "SubchannelDemultiplex._pending_opens-fix-type.patch";
+      url = "https://github.com/magic-wormhole/magic-wormhole/commit/6d7f48786b5506df5b6a254bc4e37f6bf5d75593.patch";
+      hash = "sha256-28YH3enyQ9rTT56OU7FfFonb9l8beJ9QRgPoItzrgu4=";
+    })
+  ];
+
   postPatch =
     # enable tests by fixing the location of the wormhole binary
     ''
@@ -104,16 +114,17 @@ buildPythonPackage rec {
   ++ optional-dependencies.dilation
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ unixtools.locale ];
 
-  enabledTestPaths = [ "src/wormhole/test" ];
-
   __darwinAllowLocalNetworking = true;
 
   postInstall = ''
     install -Dm644 docs/wormhole.1 $out/share/man/man1/wormhole.1
+
+    # https://github.com/magic-wormhole/magic-wormhole/issues/619
     installShellCompletion --cmd ${meta.mainProgram} \
       --bash wormhole_complete.bash \
       --fish wormhole_complete.fish \
       --zsh wormhole_complete.zsh
+    rm $out/wormhole_complete.*
   '';
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 3dd094a0edd8..32201783ddbc 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -402,8 +402,8 @@ rec {
       "sha256-aQR1CrCbisf0vApIjFXa5/oKC4Q1eT0AsLTg0EBojAs=";
 
   mypy-boto3-directconnect =
-    buildMypyBoto3Package "directconnect" "1.40.0"
-      "sha256-UmrcCxy3zK/cEkM/KCGnr4JEMOOjhNwBNRC6IiMm+NM=";
+    buildMypyBoto3Package "directconnect" "1.40.10"
+      "sha256-ZM9nCSSzMmRjyxnypQcaORwYXiXMXz25Gw2dJlOVcc0=";
 
   mypy-boto3-discovery =
     buildMypyBoto3Package "discovery" "1.40.0"
@@ -558,8 +558,8 @@ rec {
       "sha256-i76hozLLcN4Y5Jpg/92+6FSgStpw2SfF0HeRhQiRPqE=";
 
   mypy-boto3-fsx =
-    buildMypyBoto3Package "fsx" "1.40.9"
-      "sha256-mNs8PA3GpvonrX6vwErh1muD4K2+zdr0ZWvOJP8PRjY=";
+    buildMypyBoto3Package "fsx" "1.40.10"
+      "sha256-E9s3Mh66bXUsy/BUPorYaOp58hkY0HpkyX3dX0OsXz4=";
 
   mypy-boto3-gamelift =
     buildMypyBoto3Package "gamelift" "1.40.0"
@@ -576,7 +576,6 @@ rec {
   mypy-boto3-glue =
     buildMypyBoto3Package "glue" "1.40.15"
       "sha256-N7fPk0kCAxoiMds7lDpqUcl32+po7MwWI4lHySADHyA=";
-
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.40.0"
       "sha256-KQqyk9PFUttzDrZW7viev8xbumdud05EBdNoxz//hEY=";
@@ -866,8 +865,8 @@ rec {
       "sha256-DJEU4Ha8jpV/J8UP6emYMjcv9RfZt1njsBPD11q0BUI=";
 
   mypy-boto3-medialive =
-    buildMypyBoto3Package "medialive" "1.40.0"
-      "sha256-+2qM6+qeDJnvkvVI+z1EzMfGps7ejjVq4FOxOfEzJdg=";
+    buildMypyBoto3Package "medialive" "1.40.10"
+      "sha256-hGbdgOvsb+gd7640D1WeXj4tOkzuGwi8Ib/RmmQd4tY=";
 
   mypy-boto3-mediapackage =
     buildMypyBoto3Package "mediapackage" "1.40.15"
@@ -1246,8 +1245,8 @@ rec {
       "sha256-ET2prHzHi0EBkWB9MlmdudaaJhay5in5+rdUF0T6veE=";
 
   mypy-boto3-servicediscovery =
-    buildMypyBoto3Package "servicediscovery" "1.40.0"
-      "sha256-hg/KQ7V0ej2jmLLYLmBChuxZ4IvKypMWAOs6j5zRoYY=";
+    buildMypyBoto3Package "servicediscovery" "1.40.10"
+      "sha256-/Gyq9dgCjeIrNTxUqE/mvfPr+4c+Ann5+ep3/NJhrW8=";
 
   mypy-boto3-ses =
     buildMypyBoto3Package "ses" "1.40.0"
@@ -1426,8 +1425,8 @@ rec {
       "sha256-zApXRQ+MpzmwpQcghnoC34FaKlLQ/g8kZZUwbU0G8p8=";
 
   mypy-boto3-workspaces =
-    buildMypyBoto3Package "workspaces" "1.40.0"
-      "sha256-LRf2JH9+Z+a1yX1TodO6ASUFY7+Ct9RLu2BS0CF3X0U=";
+    buildMypyBoto3Package "workspaces" "1.40.10"
+      "sha256-6PTGF3akduOS0VRS43ykcKzK25iyQb+bqvpCe+BM9Qw=";
 
   mypy-boto3-workspaces-web =
     buildMypyBoto3Package "workspaces-web" "1.40.0"
diff --git a/pkgs/development/python-modules/netbox-contract/default.nix b/pkgs/development/python-modules/netbox-contract/default.nix
index 6bf331f5f595..b0b20ff31db2 100644
--- a/pkgs/development/python-modules/netbox-contract/default.nix
+++ b/pkgs/development/python-modules/netbox-contract/default.nix
@@ -11,7 +11,7 @@
 }:
 buildPythonPackage rec {
   pname = "netbox-contract";
-  version = "2.4.0";
+  version = "2.4.1";
   pyproject = true;
 
   disabled = python.pythonVersion != netbox.python.pythonVersion;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mlebreuil";
     repo = "netbox-contract";
     tag = "v${version}";
-    hash = "sha256-duA53cuJ3q6CRp239xNMXQhGZHGn7IBIGNLoxt7hZh8=";
+    hash = "sha256-2pjApKMybZGzojRF3vH1Ti/Wkmg/tafhpzX+qDkLY8o=";
   };
 
   build-system = [ setuptools ];
@@ -45,7 +45,7 @@ buildPythonPackage rec {
   meta = {
     description = "Contract plugin for netbox";
     homepage = "https://github.com/mlebreuil/netbox-contract";
-    changelog = "https://github.com/mlebreuil/netbox-contract/releases/tag/${src.rev}";
+    changelog = "https://github.com/mlebreuil/netbox-contract/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ felbinger ];
diff --git a/pkgs/development/python-modules/netdisco/default.nix b/pkgs/development/python-modules/netdisco/default.nix
index db1d17de07ca..3b90aaed74b4 100644
--- a/pkgs/development/python-modules/netdisco/default.nix
+++ b/pkgs/development/python-modules/netdisco/default.nix
@@ -1,26 +1,26 @@
 {
   lib,
   buildPythonPackage,
-  isPy3k,
   fetchPypi,
-  requests,
-  zeroconf,
   pytestCheckHook,
+  requests,
+  setuptools,
+  zeroconf,
 }:
 
 buildPythonPackage rec {
   pname = "netdisco";
   version = "3.0.0";
-  format = "setuptools";
-
-  disabled = !isPy3k;
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-TbtZBILzd8zEYeAXQnB8y+jx0tGyhXivkdybf+vNy9I=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     requests
     zeroconf
   ];
diff --git a/pkgs/development/python-modules/nox/default.nix b/pkgs/development/python-modules/nox/default.nix
index f419359780c6..7d5dc73a56e5 100644
--- a/pkgs/development/python-modules/nox/default.nix
+++ b/pkgs/development/python-modules/nox/default.nix
@@ -1,17 +1,26 @@
 {
   lib,
-  argcomplete,
-  attrs,
   buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  attrs,
+  argcomplete,
   colorlog,
   dependency-groups,
-  fetchFromGitHub,
-  hatchling,
   jinja2,
   packaging,
-  pytestCheckHook,
-  pythonOlder,
   tomli,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # passthru
   tox,
   uv,
   virtualenv,
@@ -22,7 +31,7 @@ buildPythonPackage rec {
   version = "2025.05.01";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "wntrblm";
@@ -53,22 +62,20 @@ buildPythonPackage rec {
     uv = [ uv ];
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
 
   pythonImportsCheck = [ "nox" ];
 
   disabledTests = [
-    # our conda is not available on 3.11
-    "test__create_venv_options"
     # Assertion errors
     "test_uv"
-    # calls to naked python
-    "test_noxfile_script_mode"
+    # Test requires network access
     "test_noxfile_script_mode_url_req"
+    # Don't test CLi mode
+    "test_noxfile_script_mode"
   ];
 
   disabledTestPaths = [
@@ -76,12 +83,12 @@ buildPythonPackage rec {
     "tests/test_tox_to_nox.py"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Flexible test automation for Python";
     homepage = "https://nox.thea.codes/";
     changelog = "https://github.com/wntrblm/nox/blob/${src.tag}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       doronbehar
       fab
     ];
diff --git a/pkgs/development/python-modules/oldmemo/default.nix b/pkgs/development/python-modules/oldmemo/default.nix
index cb1eb2f29008..4152ab68500a 100644
--- a/pkgs/development/python-modules/oldmemo/default.nix
+++ b/pkgs/development/python-modules/oldmemo/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "oldmemo";
-  version = "1.1.0";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-oldmemo";
     tag = "v${version}";
-    hash = "sha256-iAsp42VcGsf3Nhk0I97Wi3SlpLxcA6BkVaFm1yY0HrY=";
+    hash = "sha256-upgpyNoyBUg4IskF2DeQGOwm2h+hydO9lBoIHgwho28=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/omemo/default.nix b/pkgs/development/python-modules/omemo/default.nix
index 6da744b55618..8f4fa6a957df 100644
--- a/pkgs/development/python-modules/omemo/default.nix
+++ b/pkgs/development/python-modules/omemo/default.nix
@@ -10,20 +10,23 @@
 
   pytestCheckHook,
   oldmemo,
+  twomemo,
+  pytest-asyncio,
+  pytest-cov-stub,
 
   # passthru
   omemo,
 }:
 buildPythonPackage rec {
   pname = "omemo";
-  version = "1.2.0";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-omemo";
     tag = "v${version}";
-    hash = "sha256-egb4UFoF/gS3LKutArnJSXxDYH/xyBLOxWec98rOT9Y=";
+    hash = "sha256-uA8Nv8xT6ROlE9eM/Oz2j5HsYtvWzKEu7DSd/ws+WZY=";
   };
 
   build-system = [
@@ -40,6 +43,9 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     oldmemo
+    twomemo
+    pytest-asyncio
+    pytest-cov-stub
   ]
   ++ oldmemo.optional-dependencies.xml;
 
diff --git a/pkgs/development/python-modules/parse-type/default.nix b/pkgs/development/python-modules/parse-type/default.nix
index 06a7cc1d6aba..b9af06723939 100644
--- a/pkgs/development/python-modules/parse-type/default.nix
+++ b/pkgs/development/python-modules/parse-type/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "parse-type";
-  version = "0.6.4";
+  version = "0.6.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jenisys";
     repo = "parse_type";
     tag = "v${version}";
-    hash = "sha256-R0HMrZaKjv0KITfHnQBjuXhs3RUgSJzkDXiehRICUUM=";
+    hash = "sha256-4ZQNxvYWqYXcMj3vEtaEdikuJ38llGpmuutIOtr3lz0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pre-commit-hooks/default.nix b/pkgs/development/python-modules/pre-commit-hooks/default.nix
index e75265573a6c..a105ca7f21e8 100644
--- a/pkgs/development/python-modules/pre-commit-hooks/default.nix
+++ b/pkgs/development/python-modules/pre-commit-hooks/default.nix
@@ -7,24 +7,27 @@
   pytestCheckHook,
   pythonOlder,
   ruamel-yaml,
+  setuptools,
   tomli,
 }:
 
 buildPythonPackage rec {
   pname = "pre-commit-hooks";
-  version = "5.0.0";
-  format = "setuptools";
+  version = "6.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "pre-commit";
     repo = "pre-commit-hooks";
     tag = "v${version}";
-    hash = "sha256-BYNi/xtdichqsn55hqr1MSFwWpH+7cCbLfqmpn9cxto=";
+    hash = "sha256-pxtsnRryTguNGYbdiQ55UhuRyJTQvFfaqVOTcCz2jgk=";
   };
 
-  propagatedBuildInputs = [ ruamel-yaml ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];
+  build-system = [ setuptools ];
+
+  dependencies = [ ruamel-yaml ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];
 
   nativeCheckInputs = [
     gitMinimal
@@ -50,7 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Some out-of-the-box hooks for pre-commit";
     homepage = "https://github.com/pre-commit/pre-commit-hooks";
-    changelog = "https://github.com/pre-commit/pre-commit-hooks/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/pre-commit/pre-commit-hooks/blob/${src.tag}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ kalbasit ];
   };
diff --git a/pkgs/development/python-modules/proliphix/default.nix b/pkgs/development/python-modules/proliphix/default.nix
new file mode 100644
index 000000000000..cc5ef5f923d2
--- /dev/null
+++ b/pkgs/development/python-modules/proliphix/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pytestCheckHook,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "proliphix";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Tf6gTRofZXY6ikrXBARgp6grzZGQMjvN5njT+7SRZNQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "proliphix" ];
+
+  meta = {
+    description = "API for Proliphix nt10e network thermostat";
+    homepage = "https://github.com/sdague/proliphix";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/pycasbin/default.nix b/pkgs/development/python-modules/pycasbin/default.nix
index acdc8a94752b..1405569bc3f5 100644
--- a/pkgs/development/python-modules/pycasbin/default.nix
+++ b/pkgs/development/python-modules/pycasbin/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pycasbin";
-  version = "2.0.0";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "casbin";
     repo = "pycasbin";
     tag = "v${version}";
-    hash = "sha256-LbJhpDTNPELsjgTmuYyYrOKzgMe81np49KB2PY1wxZs=";
+    hash = "sha256-rlEO6ZBy23MbYICRWOo/RmiphuN5JtiKNK/+k2Ian+g=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyftdi/default.nix b/pkgs/development/python-modules/pyftdi/default.nix
index b775d1b21ead..c95c9fea7ffb 100644
--- a/pkgs/development/python-modules/pyftdi/default.nix
+++ b/pkgs/development/python-modules/pyftdi/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyftdi";
-  version = "0.56.0";
+  version = "0.57.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "eblot";
     repo = "pyftdi";
     tag = "v${version}";
-    hash = "sha256-/MwgBqwN7xmZepdJzyRhZflbCUpGdWEbEGGKkBnKTFI=";
+    hash = "sha256-RkZXcGvCZXmFrLvj7YqHc6FeZskEqMSQcYgizBSuwIk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyhomematic/default.nix b/pkgs/development/python-modules/pyhomematic/default.nix
index 8b6b6e68627c..a6cd5f14e724 100644
--- a/pkgs/development/python-modules/pyhomematic/default.nix
+++ b/pkgs/development/python-modules/pyhomematic/default.nix
@@ -1,32 +1,31 @@
 {
   lib,
   buildPythonPackage,
-  isPy3k,
+  setuptools,
   fetchPypi,
-  python,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "pyhomematic";
   version = "0.1.78";
-  format = "setuptools";
-
-  disabled = !isPy3k;
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-uB9aDa1urIwL2DBdBwPi0sHWPW7SUZ3EaAjuMLSOudc=";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest
-  '';
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [ "pyhomematic" ];
 
   meta = with lib; {
     description = "Python 3 Interface to interact with Homematic devices";
     homepage = "https://github.com/danielperna84/pyhomematic";
+    changelog = "https://github.com/danielperna84/pyhomematic/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/pynamecheap/default.nix b/pkgs/development/python-modules/pynamecheap/default.nix
index 658ff62a5d26..4ab6da4a25a9 100644
--- a/pkgs/development/python-modules/pynamecheap/default.nix
+++ b/pkgs/development/python-modules/pynamecheap/default.nix
@@ -3,28 +3,35 @@
   buildPythonPackage,
   fetchFromGitHub,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pynamecheap";
   version = "0.0.3";
-  format = "setuptools";
-
-  propagatedBuildInputs = [ requests ];
-
-  # Tests require access to api.sandbox.namecheap.com
-  doCheck = false;
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bemmu";
     repo = "PyNamecheap";
-    rev = "v${version}";
-    sha256 = "1g1cd2yc6rpdsc5ax7s93y5nfkf91gcvbgcaqyl9ida6srd9hr97";
+    tag = "v${version}";
+    hash = "sha256-J2WYWtZGtZiox4q9tdkLyU1nix9Jn64K0+1mw7xoLLw=";
   };
 
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  # Tests require access to api.sandbox.namecheap.com
+  doCheck = false;
+
+  pythonImportsCheck = [ "namecheap" ];
+
   meta = with lib; {
     description = "Namecheap API client in Python";
     homepage = "https://github.com/Bemmu/PyNamecheap";
+    changelog = "https://github.com/Bemmu/PyNamecheap/releases/tag/${src.tag}";
     license = licenses.mit;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pynanoleaf/default.nix b/pkgs/development/python-modules/pynanoleaf/default.nix
index 892900c118ba..113818784680 100644
--- a/pkgs/development/python-modules/pynanoleaf/default.nix
+++ b/pkgs/development/python-modules/pynanoleaf/default.nix
@@ -2,23 +2,23 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  isPy3k,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pynanoleaf";
   version = "0.1.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "32a083759c4f99e019e0013670487841f8edf807c7a07742a971fa18707072a7";
+    hash = "sha256-MqCDdZxPmeAZ4AE2cEh4Qfjt+AfHoHdCqXH6GHBwcqc=";
   };
 
-  disabled = !isPy3k;
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ requests ];
+  dependencies = [ requests ];
 
   # pynanoleaf does not contain tests
   doCheck = false;
@@ -26,8 +26,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pynanoleaf" ];
 
   meta = with lib; {
-    homepage = "https://github.com/Oro/pynanoleaf";
     description = "Python3 wrapper for the Nanoleaf API, capable of controlling both Nanoleaf Aurora and Nanoleaf Canvas";
+    homepage = "https://github.com/Oro/pynanoleaf";
+    changelog = "https://github.com/Oro/pynanoleaf/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ oro ];
   };
diff --git a/pkgs/development/python-modules/pyopenjtalk/default.nix b/pkgs/development/python-modules/pyopenjtalk/default.nix
new file mode 100644
index 000000000000..efc59b4b952e
--- /dev/null
+++ b/pkgs/development/python-modules/pyopenjtalk/default.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  python,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchzip,
+
+  cmake,
+  cython,
+  numpy,
+  setuptools,
+  setuptools-scm,
+
+  tqdm,
+
+  pytestCheckHook,
+}:
+
+let
+  dic-dirname = "open_jtalk_dic_utf_8-1.11";
+  dic-src = fetchzip {
+    name = dic-dirname;
+    url = "https://github.com/r9y9/open_jtalk/releases/download/v1.11.1/${dic-dirname}.tar.gz";
+    hash = "sha256-+6cHKujNEzmJbpN9Uan6kZKsPdwxRRzT3ZazDnCNi3s=";
+  };
+in
+buildPythonPackage rec {
+  pname = "pyopenjtalk";
+  version = "0.4.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "r9y9";
+    repo = "pyopenjtalk";
+    tag = "v${version}";
+    hash = "sha256-f0JNiMCeKpTY+jH3/9LuCkX2DRb9U8sN0SezT6OTm/E=";
+    fetchSubmodules = true;
+  };
+
+  build-system = [
+    cmake
+    cython
+    numpy
+    setuptools
+    setuptools-scm
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  dependencies = [
+    numpy
+    tqdm
+  ];
+
+  postInstall = ''
+    # the package searches for a cached dic directory in this location
+    ln -s ${dic-src} $out/${python.sitePackages}/pyopenjtalk/${dic-dirname}
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    # the built extension modules are only present in $out
+    # so we make sure to resolve pyopenjtalk from $out
+    rm -r pyopenjtalk
+  '';
+
+  pythonImportsCheck = [ "pyopenjtalk" ];
+
+  meta = {
+    changelog = "https://github.com/r9y9/pyopenjtalk/releases/tag/${src.tag}";
+    description = "Python wrapper for OpenJTalk";
+    homepage = "https://github.com/r9y9/pyopenjtalk";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytest-sugar/default.nix b/pkgs/development/python-modules/pytest-sugar/default.nix
index ac77a4ac27f1..eeff296e949c 100644
--- a/pkgs/development/python-modules/pytest-sugar/default.nix
+++ b/pkgs/development/python-modules/pytest-sugar/default.nix
@@ -2,30 +2,30 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   termcolor,
-  pytest,
-  packaging,
   pytestCheckHook,
   pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "pytest-sugar";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.1.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZCLoMlj1sMBM58YyF2x3Msq1/bkJyznMpckTn4EnbAo=";
+    hash = "sha256-c7i2UWPr8Q+fZx76ue7T1W8g0spovag/pkdAqSwI9l0=";
   };
 
-  buildInputs = [ pytest ];
+  build-system = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     termcolor
-    packaging
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/quantulum3/default.nix b/pkgs/development/python-modules/quantulum3/default.nix
index 85e17eaf53c8..1f6605719a4b 100644
--- a/pkgs/development/python-modules/quantulum3/default.nix
+++ b/pkgs/development/python-modules/quantulum3/default.nix
@@ -16,7 +16,7 @@
 }:
 let
   pname = "quantulum3";
-  version = "0.9.0";
+  version = "0.9.2";
 in
 buildPythonPackage {
   inherit version pname;
diff --git a/pkgs/development/python-modules/reconplogger/default.nix b/pkgs/development/python-modules/reconplogger/default.nix
index 30928b536475..08714838c5e7 100644
--- a/pkgs/development/python-modules/reconplogger/default.nix
+++ b/pkgs/development/python-modules/reconplogger/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "reconplogger";
-  version = "4.16.1";
+  version = "4.17.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "omni-us";
     repo = "reconplogger";
     tag = "v${version}";
-    hash = "sha256-F/6vT3jLxpteUFtYNtGyiO/JxeRtwJKpdGXTFJ6IDCE=";
+    hash = "sha256-6oFnERueR8TQOFrMiQGbs05wP1NOhp/hqyFJ9ibquEw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/rencode/default.nix b/pkgs/development/python-modules/rencode/default.nix
index 0d8d495eb41c..b99cff73ea1e 100644
--- a/pkgs/development/python-modules/rencode/default.nix
+++ b/pkgs/development/python-modules/rencode/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   cython,
   poetry-core,
   setuptools,
@@ -20,6 +21,19 @@ buildPythonPackage rec {
     hash = "sha256-k2b6DoKwNeQBkmqSRXqaRTjK7CVX6IKuXCLG9lBdLLY=";
   };
 
+  patches = [
+    # backport fix for -msse being passed on aarch64-linux
+    (fetchpatch {
+      url = "https://github.com/aresch/rencode/commit/591b9f4d85d7e2d4f4e99441475ef15366389be2.patch";
+      hash = "sha256-KhfawtYa4CnYiVzBYdtMn/JRkeqCLJetHvLEm1YVOe4=";
+    })
+    # do not pass -march=native etc. on x86_64
+    (fetchpatch {
+      url = "https://github.com/aresch/rencode/commit/e7ec8ea718e73a8fee7dbc007c262e1584f7f94b.patch";
+      hash = "sha256-gNYjxBsMN1p4IAmutV73JF8yCj0iz3DIl7kg7WrBdbs=";
+    })
+  ];
+
   nativeBuildInputs = [
     poetry-core
     setuptools
diff --git a/pkgs/development/python-modules/scs/default.nix b/pkgs/development/python-modules/scs/default.nix
index 4668c0996151..70292a711206 100644
--- a/pkgs/development/python-modules/scs/default.nix
+++ b/pkgs/development/python-modules/scs/default.nix
@@ -66,6 +66,7 @@ buildPythonPackage rec {
     '';
     inherit (pkgs.scs.meta) homepage;
     downloadPage = "https://github.com/bodono/scs-python";
+    changelog = "https://github.com/bodono/scs-python/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ drewrisinger ];
   };
diff --git a/pkgs/development/python-modules/scsgate/default.nix b/pkgs/development/python-modules/scsgate/default.nix
new file mode 100644
index 000000000000..f61d14a5d418
--- /dev/null
+++ b/pkgs/development/python-modules/scsgate/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pyserial,
+  pyyaml,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "scsgate";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "flavio";
+    repo = "scsgate";
+    tag = version;
+    hash = "sha256-wVzXKOKljENAKppod+guqm+0XMPenLgOsZzMQVTBo+k=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pyserial
+    pyyaml
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "scsgate" ];
+
+  meta = {
+    description = "Python module to interact with SCSGate";
+    homepage = "https://github.com/flavio/scsgate";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/development/python-modules/sqlfmt/default.nix b/pkgs/development/python-modules/sqlfmt/default.nix
index 709a4746c8c9..2f1dff47901a 100644
--- a/pkgs/development/python-modules/sqlfmt/default.nix
+++ b/pkgs/development/python-modules/sqlfmt/default.nix
@@ -5,15 +5,14 @@
   click,
   fetchFromGitHub,
   gitpython,
-  importlib-metadata,
   jinja2,
   platformdirs,
   poetry-core,
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  tomli,
   tqdm,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -21,7 +20,7 @@ buildPythonPackage rec {
   version = "0.27.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "tconbeer";
@@ -30,16 +29,12 @@ buildPythonPackage rec {
     hash = "sha256-Yel9SB7KrDqtuZxNx4omz6u4AID8Fk5kFYKBEZD1fuU=";
   };
 
-  pythonRelaxDeps = [ "platformdirs" ];
-
   build-system = [ poetry-core ];
 
   dependencies = [
     click
-    importlib-metadata
     jinja2
     platformdirs
-    tomli
     tqdm
   ];
 
@@ -51,11 +46,11 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ]
   ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   preCheck = ''
-    export HOME=$(mktemp -d)
     export PATH="$PATH:$out/bin";
   '';
 
diff --git a/pkgs/development/python-modules/sunwatcher/default.nix b/pkgs/development/python-modules/sunwatcher/default.nix
index 0fcac2bfb205..9729093eec66 100644
--- a/pkgs/development/python-modules/sunwatcher/default.nix
+++ b/pkgs/development/python-modules/sunwatcher/default.nix
@@ -4,21 +4,22 @@
   fetchPypi,
   pythonOlder,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "sunwatcher";
   version = "0.2.1";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0swmvmmbfb914k473yv3fc4zizy2abq2qhd7h6lixli11l5wfjxv";
+    hash = "sha256-u0vHCw0h0h6pgadBLPBSwv/4CXNj+3HIJCEtt2rdlWs=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
 
   # Project has no tests
   doCheck = false;
@@ -28,7 +29,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for the SolarLog HTTP API";
     homepage = "https://bitbucket.org/Lavode/sunwatcher/src/master/";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/timetagger/default.nix b/pkgs/development/python-modules/timetagger/default.nix
index ae02585f8ba0..af3444f39a1d 100644
--- a/pkgs/development/python-modules/timetagger/default.nix
+++ b/pkgs/development/python-modules/timetagger/default.nix
@@ -12,17 +12,16 @@
   pscript,
   pyjwt,
   pytestCheckHook,
-  pythonOlder,
   requests,
+  setuptools,
   uvicorn,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "timetagger";
   version = "25.06.1";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "almarklein";
@@ -31,7 +30,9 @@ buildPythonPackage rec {
     hash = "sha256-fuZj4DoqtgIcRd/u7l0GsWqmuLEgF3BW5gN5wY8FdK0=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     asgineer
     bcrypt
     iptools
@@ -43,22 +44,21 @@ buildPythonPackage rec {
     uvicorn
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   nativeCheckInputs = [
     nodejs
     pytestCheckHook
     requests
+    writableTmpDirAsHomeHook
   ];
 
-  meta = with lib; {
+  pythonImportsCheck = [ "timetagger" ];
+
+  meta = {
     description = "Library to interact with TimeTagger";
-    mainProgram = "timetagger";
     homepage = "https://github.com/almarklein/timetagger";
     changelog = "https://github.com/almarklein/timetagger/releases/tag/${src.tag}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ matthiasbeyer ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ matthiasbeyer ];
+    mainProgram = "timetagger";
   };
 }
diff --git a/pkgs/development/python-modules/twomemo/default.nix b/pkgs/development/python-modules/twomemo/default.nix
index a61db1d57e10..4dfbe7e1b9c4 100644
--- a/pkgs/development/python-modules/twomemo/default.nix
+++ b/pkgs/development/python-modules/twomemo/default.nix
@@ -13,14 +13,14 @@
 }:
 buildPythonPackage rec {
   pname = "twomemo";
-  version = "1.1.0";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-twomemo";
     tag = "v${version}";
-    hash = "sha256-jkazeFdNK0iB76oyHbQu+TLaGz+SH/30CmqXk0K6Sy8=";
+    hash = "sha256-TNM7CLxo4C55APuL5BAts8kTyCl2SDajqwkaXxwK19E=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/vultr/default.nix b/pkgs/development/python-modules/vultr/default.nix
index 4e10e0144243..79c4f1060722 100644
--- a/pkgs/development/python-modules/vultr/default.nix
+++ b/pkgs/development/python-modules/vultr/default.nix
@@ -3,21 +3,24 @@
   buildPythonPackage,
   fetchFromGitHub,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
-  version = "1.0.1";
-  format = "setuptools";
   pname = "vultr";
+  version = "1.0.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spry-group";
     repo = "python-vultr";
-    rev = "v${version}";
-    sha256 = "00lc5hdhchvm0472p03019bp9541d8y2773xkjy8vblq9qhys8q7";
+    tag = "v${version}";
+    hash = "sha256-ByPtIU6Yro28nH2cIzxqgZR0VwpggCsOAXVDBhssjAI=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
 
   # Tests disabled. They fail because they try to access the network
   doCheck = false;
@@ -27,6 +30,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Vultr.com API Client";
     homepage = "https://github.com/spry-group/python-vultr";
+    changelog = "https://github.com/spry-group/python-vultr/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ lihop ];
   };
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 1bd981110c02..8899e7bad9d9 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -72,6 +72,7 @@ let
       extraMeta ? { },
       extraPassthru ? { },
 
+      isLTS ? false,
       isZen ? false,
       isLibre ? false,
       isHardened ? false,
@@ -332,6 +333,7 @@ let
               commonStructuredConfig
               structuredExtraConfig
               extraMakeFlags
+              isLTS
               isZen
               isHardened
               isLibre
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index a2c9452954c0..aabd62a41379 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,82 +1,22 @@
 {
-    "5.10": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-v5.10.238-hardened1.patch",
-            "sha256": "1y4srk40v0gzfnlqsbh6g9h5vcs8rp5g2b8jjch6xx7dji189myq",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.238-hardened1/linux-hardened-v5.10.238-hardened1.patch"
-        },
-        "sha256": "1dkblixa0as9h11m081dqq8vlz4dcjbzdz7phkz07p621na55j07",
-        "version": "5.10.238"
-    },
-    "5.15": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-v5.15.185-hardened1.patch",
-            "sha256": "00m1p8cm1d76drdlafv4bdrq81xkh40jgg33kvkk3wqcbiikq3h7",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.185-hardened1/linux-hardened-v5.15.185-hardened1.patch"
-        },
-        "sha256": "1p0kjc09qqv361phscny1gqj38di9dpab9gxywljkwqhi5wyn0rx",
-        "version": "5.15.185"
-    },
-    "5.4": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-v5.4.294-hardened1.patch",
-            "sha256": "1q6ffxnpk8j2fwi3g8rpf1lc247m8xiqix2kichxvggkadmjyzg0",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.294-hardened1/linux-hardened-v5.4.294-hardened1.patch"
-        },
-        "sha256": "16bv0x4c9ssr66vrd6jnv2dw5na1y7hxfn4d67g0zaksh6xd0yf8",
-        "version": "5.4.294"
-    },
-    "6.1": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-v6.1.141-hardened1.patch",
-            "sha256": "10wbx6sjzjh3krx15pb65xxl55xcpia54ws825s9619wx059dskl",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.141-hardened1/linux-hardened-v6.1.141-hardened1.patch"
-        },
-        "sha256": "05n1561cbzaw9vcxp86bqzvhqz5wv7dajpy7cq34bw7myvx4ag5w",
-        "version": "6.1.141"
-    },
     "6.12": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.12.34-hardened1.patch",
-            "sha256": "1aw8r52gbxp53sgl4pwv51axw0kmgh3ib6gfvw81dlyaajmlbm6b",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.34-hardened1/linux-hardened-v6.12.34-hardened1.patch"
+            "name": "linux-hardened-v6.12.41-hardened1.patch",
+            "sha256": "1a0gc03nr0aiy2zadg6hfy718nlb2k8p5h5ymvwsdl6kblxi9f47",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.41-hardened1/linux-hardened-v6.12.41-hardened1.patch"
         },
-        "sha256": "0kf2f3r96npzs01kdq3q2ag7zg8l3avfyqwv5qbs9v373wwgxwx7",
-        "version": "6.12.34"
+        "sha256": "09qfpxyxi3z8cd64r2r5mxvh54a5sx8p5mk4d50y4ga2k6pa66bb",
+        "version": "6.12.41"
     },
-    "6.13": {
+    "6.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.13.12-hardened1.patch",
-            "sha256": "0i9raq3qcc6pxvs9l6yn5b6k8kiywwlis33kkpd8byqhs57aqsic",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.13.12-hardened1/linux-hardened-v6.13.12-hardened1.patch"
+            "name": "linux-hardened-v6.15.9-hardened1.patch",
+            "sha256": "132h0cgv8kzrlz7jprqvwcnragc2v793a759bhg0q6w3ninmncjc",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.15.9-hardened1/linux-hardened-v6.15.9-hardened1.patch"
         },
-        "sha256": "0hhj49k3ksjcp0dg5yiahqzryjfdpr9c1a9ph6j9slzmkikbn7v1",
-        "version": "6.13.12"
-    },
-    "6.14": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-v6.14.11-hardened1.patch",
-            "sha256": "07f0d76rag6jcclxdl24w70545fb8jrqy98xcdmgxwjabclaa1lp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.14.11-hardened1/linux-hardened-v6.14.11-hardened1.patch"
-        },
-        "sha256": "06rvydmc2yfspidnsay5hin3i8p4fxy3bvzwnry7gjf9dl5cs71z",
-        "version": "6.14.11"
-    },
-    "6.6": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-v6.6.94-hardened1.patch",
-            "sha256": "0i1dshmsr8v230qmbawda916420m6njwwmillcbr42hsagdjhd0i",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.94-hardened1/linux-hardened-v6.6.94-hardened1.patch"
-        },
-        "sha256": "0mncdsqbqrxii0hirnymi1kmg50jn9v0p26flimlf2xj4vm82fbi",
-        "version": "6.6.94"
+        "sha256": "0zcma8ycdwwzd4yci9752acsv85wh27lahclh5x2yc4jakw3lkz9",
+        "version": "6.15.9"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py
index 0603812124be..3e12a0e2dd5d 100755
--- a/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -156,10 +156,11 @@ def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]:
     )
 
 
-def parse_version(version_str: str) -> Version:
+def normalize_kernel_version(version_str: str) -> list[str|int]:
     # There have been two variants v6.10[..] and 6.10[..], drop the v
     version_str_without_v = version_str[1:] if not version_str[0].isdigit() else version_str
-    version: Version = []
+
+    version: list[str|int] = []
 
     for component in re.split(r'\.|\-', version_str_without_v):
         try:
@@ -173,14 +174,14 @@ def version_string(version: Version) -> str:
     return ".".join(str(component) for component in version)
 
 
-def major_kernel_version_key(kernel_version: Version) -> str:
+def major_kernel_version_key(kernel_version: list[int|str]) -> str:
     return version_string(kernel_version[:-1])
 
 
-def commit_patches(*, kernel_key: str, message: str) -> None:
+def commit_patches(*, kernel_key: Version, message: str) -> None:
     new_patches_path = HARDENED_PATCHES_PATH.with_suffix(".new")
     with open(new_patches_path, "w") as new_patches_file:
-        json.dump(patches, new_patches_file, indent=4, sort_keys=True)
+        json.dump(patch_json, new_patches_file, indent=4, sort_keys=True)
         new_patches_file.write("\n")
     os.rename(new_patches_path, HARDENED_PATCHES_PATH)
     message = f"linux/hardened/patches/{kernel_key}: {message}"
@@ -197,43 +198,32 @@ def commit_patches(*, kernel_key: str, message: str) -> None:
 
 
 # Load the existing patches.
-patches: Dict[str, Patch]
 with open(HARDENED_PATCHES_PATH) as patches_file:
-    patches = json.load(patches_file)
+    patch_json = json.load(patches_file)
+    patch_versions = set([parse_version(k) for k in patch_json.keys()])
 
-# Get the set of currently packaged kernel versions.
-kernel_versions = {}
 with open(NIXPKGS_KERNEL_PATH / "kernels-org.json") as kernel_versions_json:
     kernel_versions = json.load(kernel_versions_json)
-    for kernel_branch_str in kernel_versions:
-        if kernel_branch_str == "testing": continue
-        kernel_branch = [int(i) for i in kernel_branch_str.split(".")]
-        if kernel_branch < MIN_KERNEL_VERSION: continue
-        kernel_version = [int(i) for i in kernel_versions[kernel_branch_str]["version"].split(".")]
-        kernel_versions[kernel_branch_str] = kernel_version
 
-# Remove patches for unpackaged kernel versions.
-for kernel_key in sorted(patches.keys() - kernel_versions.keys()):
-    del patches[kernel_key]
-    commit_patches(kernel_key=kernel_key, message="remove")
+    kernels = {
+        parse_version(version): meta
+        for version, meta in kernel_versions.items()
+        if version != "testing"
+    }
+
+    latest_lts = sorted(ver for ver, meta in kernels.items() if meta.get("lts", False))[-1]
+    keys = sorted(kernels.keys())
+    latest_release = keys[-1]
+    fallback = keys[-2]
 
 g = Github(os.environ.get("GITHUB_TOKEN"))
 repo = g.get_repo(HARDENED_GITHUB_REPO)
 failures = False
 
-# Match each kernel version with the best patch version.
-releases = {}
-i = 0
-for release in repo.get_releases():
-    # Dirty workaround to make sure that we don't run into issues because
-    # GitHub's API only allows fetching the last 1000 releases.
-    # It's not reliable to exit earlier because not every kernel minor may
-    # have hardened patches, hence the naive search below.
-    i += 1
-    if i > 100:
-        break
-
-    version = parse_version(release.tag_name)
+all_candidates = set([latest_lts, latest_release, fallback])
+kernels_to_package = {}
+for release in repo.get_releases()[:30]:
+    version = normalize_kernel_version(release.tag_name)
     # needs to look like e.g. 5.6.3-hardened1
     if len(version) < 4:
         continue
@@ -242,44 +232,51 @@ for release in repo.get_releases():
         continue
 
     kernel_version = version[:-1]
+    kernel_key = parse_version(major_kernel_version_key(kernel_version))
 
-    kernel_key = major_kernel_version_key(kernel_version)
-    try:
-        packaged_kernel_version = kernel_versions[kernel_key]
-    except KeyError:
+    if kernel_key not in all_candidates:
         continue
 
-    release_info = ReleaseInfo(version=version, release=release)
-
-    if kernel_version == packaged_kernel_version:
-        releases[kernel_key] = release_info
-    else:
-        # Fall back to the latest patch for this major kernel version,
-        # skipping patches for kernels newer than the packaged one.
-        if '.'.join(str(x) for x in kernel_version) > '.'.join(str(x) for x in packaged_kernel_version):
+    try:
+        found = kernels_to_package[kernel_key]
+        if found.version > version:
             continue
-        elif (
-            kernel_key not in releases or releases[kernel_key].version < version
-        ):
-            releases[kernel_key] = release_info
+    except KeyError:
+        pass
+
+    kernels_to_package[kernel_key] = ReleaseInfo(version=version, release=release)
+
+if latest_release in kernels_to_package:
+    if fallback != latest_lts:
+        del kernels_to_package[fallback]
+    kernel_versions = set([latest_lts, latest_release])
+else:
+    kernel_versions = set([latest_lts, fallback])
+
+# Remove patches for unpackaged kernel versions.
+removals = False
+for kernel_key in sorted(patch_versions - kernels_to_package.keys()):
+    del patch_json[str(kernel_key)]
+    removals = True
+    commit_patches(kernel_key=kernel_key, message="remove")
 
 # Update hardened-patches.json for each release.
-for kernel_key in sorted(releases.keys()):
-    release_info = releases[kernel_key]
+for kernel_key in sorted(kernels_to_package.keys()):
+    release_info = kernels_to_package[kernel_key]
     release = release_info.release
     version = release_info.version
     version_str = release.tag_name
     name = f"linux-hardened-{version_str}"
 
-    old_version: Optional[Version] = None
+    old_version: Optional[list[int|str]] = None
     old_version_str: Optional[str] = None
     update: bool
     try:
-        old_filename = patches[kernel_key]["patch"]["name"]
+        old_filename = patch_json[str(kernel_key)]["patch"]["name"]
         old_version_str = old_filename.replace("linux-hardened-", "").replace(
             ".patch", ""
         )
-        old_version = parse_version(old_version_str)
+        old_version = normalize_kernel_version(old_version_str)
         update = old_version < version
     except KeyError:
         update = True
@@ -289,21 +286,16 @@ for kernel_key in sorted(releases.keys()):
         if patch is None:
             failures = True
         else:
-            patches[kernel_key] = patch
-            if old_version:
+            if str(kernel_key) in patch_json:
                 message = f"{old_version_str} -> {version_str}"
             else:
                 message = f"init at {version_str}"
+            patch_json[str(kernel_key)] = patch
+
             commit_patches(kernel_key=kernel_key, message=message)
 
-missing_kernel_versions = kernel_versions.keys() - patches.keys()
-
-if missing_kernel_versions:
-    print(
-        f"warning: no patches for kernel versions "
-        + ", ".join(missing_kernel_versions),
-        file=sys.stderr,
-    )
+if removals:
+    print("Hardened kernels were removed. Don't forget to remove their attributes!")
 
 if failures:
     sys.exit(1)
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 71cf61687254..76b51e7a95cf 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,34 +5,42 @@
     },
     "6.1": {
         "version": "6.1.148",
-        "hash": "sha256:18c024bqqc3srzv2gva55p95yghjc6x3p3f54v3hziki4wx3v86r"
+        "hash": "sha256:18c024bqqc3srzv2gva55p95yghjc6x3p3f54v3hziki4wx3v86r",
+        "lts": false
     },
     "5.15": {
         "version": "5.15.189",
-        "hash": "sha256:1hshd26ahn6dbw6jnqi0v5afpk672w7p09mk7iri93i7hxdh5l73"
+        "hash": "sha256:1hshd26ahn6dbw6jnqi0v5afpk672w7p09mk7iri93i7hxdh5l73",
+        "lts": true
     },
     "5.10": {
         "version": "5.10.240",
-        "hash": "sha256:04sdcf4aqsqchii38anzmk9f9x65wv8q1x3m9dandmi6fabw724d"
+        "hash": "sha256:04sdcf4aqsqchii38anzmk9f9x65wv8q1x3m9dandmi6fabw724d",
+        "lts": true
     },
     "5.4": {
         "version": "5.4.296",
-        "hash": "sha256:0fm73yqzbzclh2achcj8arpg428d412k2wgmlfmyy6xzb1762qrx"
+        "hash": "sha256:0fm73yqzbzclh2achcj8arpg428d412k2wgmlfmyy6xzb1762qrx",
+        "lts": true
     },
     "6.6": {
         "version": "6.6.102",
-        "hash": "sha256:0p6yjifwyrqlppn40isgxb0b5vqmljggmnp7w75vlc2c6fvzxll0"
+        "hash": "sha256:0p6yjifwyrqlppn40isgxb0b5vqmljggmnp7w75vlc2c6fvzxll0",
+        "lts": true
     },
     "6.12": {
         "version": "6.12.43",
-        "hash": "sha256:1vmxywg11z946i806sg7rk7jr9px87spmwwbzjxpps2nsjybpjqg"
+        "hash": "sha256:1vmxywg11z946i806sg7rk7jr9px87spmwwbzjxpps2nsjybpjqg",
+        "lts": true
     },
     "6.15": {
         "version": "6.15.11",
-        "hash": "sha256:14sxwrvw9p4ybizb8ky1rgahc62q0aw5qkmzqp3cpnavqfgldaw9"
+        "hash": "sha256:14sxwrvw9p4ybizb8ky1rgahc62q0aw5qkmzqp3cpnavqfgldaw9",
+        "lts": false
     },
     "6.16": {
-        "version": "6.16.2",
-        "hash": "sha256:0vghyk7ggmgnsldyz67v9llzbi6mxyivx83z7fylyxrxg7xacq5p"
+        "version": "6.16.3",
+        "hash": "sha256:118bg72mdrf75r36gki5zi18ynl2kcygrf24pwd58by1anh9nhw0",
+        "lts": false
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 64580caf4098..d0f1a14c48d8 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -41,6 +41,8 @@ lib.overrideDerivation
       }
       // (args.features or { });
 
+      isLTS = true;
+
       extraMeta =
         if (rpiVersion < 3) then
           {
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 6bc23341acad..08cc4cfce3cb 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -40,6 +40,7 @@ buildLinux (
       in
       [ rt-patch ] ++ kernelPatches;
 
+    isLTS = true;
     structuredExtraConfig =
       with lib.kernel;
       {
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 0db95f0059c7..49c0f89f8a2b 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -57,6 +57,8 @@ buildLinux (
       }
       // structuredExtraConfig;
 
+    isLTS = true;
+
     extraMeta = extraMeta // {
       inherit branch;
     };
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index a621d24576fd..5c95493379da 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -50,6 +50,8 @@ buildLinux (
       }
       // structuredExtraConfig;
 
+    isLTS = true;
+
     extraMeta = extraMeta // {
       inherit branch;
     };
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 6c6459e8b14e..f27de5421729 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -60,6 +60,8 @@ buildLinux (
     extraMeta = extraMeta // {
       inherit branch;
     };
+
+    isLTS = true;
   }
   // argsOverride
 )
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index 5a877d6c32fb..037fb34519e1 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -60,6 +60,8 @@ buildLinux (
     extraMeta = extraMeta // {
       inherit branch;
     };
+
+    isLTS = true;
   }
   // argsOverride
 )
diff --git a/pkgs/os-specific/linux/kernel/mainline.nix b/pkgs/os-specific/linux/kernel/mainline.nix
index 41c5a0218fac..ac8f75c873eb 100644
--- a/pkgs/os-specific/linux/kernel/mainline.nix
+++ b/pkgs/os-specific/linux/kernel/mainline.nix
@@ -32,6 +32,7 @@ let
     (builtins.removeAttrs args [ "branch" ])
     // {
       inherit src version;
+      isLTS = thisKernel.lts;
 
       modDirVersion = lib.versions.pad 3 version;
       extraMeta.branch = branch;
diff --git a/pkgs/os-specific/linux/kernel/update-mainline.py b/pkgs/os-specific/linux/kernel/update-mainline.py
index 13e89d3df1e1..9f61236e67fa 100755
--- a/pkgs/os-specific/linux/kernel/update-mainline.py
+++ b/pkgs/os-specific/linux/kernel/update-mainline.py
@@ -152,6 +152,7 @@ def main():
         all_kernels[branch] = {
             "version": kernel.version,
             "hash": get_hash(kernel),
+            "lts": kernel.nature == KernelNature.LONGTERM,
         }
 
         with VERSIONS_FILE.open("w") as fd:
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 37f23057c66f..9463d9d62df3 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -17,6 +17,7 @@ let
     lts = {
       version = "6.12.43";
       hash = "sha256-Jc3VKpUaIc1nBbbCZ/jAx/kteuQBQBO6TEPlaNq8Jrk=";
+      isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
@@ -30,6 +31,7 @@ let
       version,
       suffix ? "xanmod1",
       hash,
+      isLTS ? false,
     }:
     buildLinux (
       args
@@ -76,6 +78,7 @@ let
           ./update-xanmod.sh
           variant
         ];
+        inherit isLTS;
 
         extraMeta = {
           branch = lib.versions.majorMinor version;
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index a9dd1981e23c..216472d10876 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -562,7 +562,8 @@
       ];
     "beewi_smartclim" =
       ps: with ps; [
-      ]; # missing inputs: beewi-smartclim
+        beewi-smartclim
+      ];
     "bge" =
       ps: with ps; [
       ];
@@ -2590,7 +2591,8 @@
       ];
     "iglo" =
       ps: with ps; [
-      ]; # missing inputs: iglo
+        iglo
+      ];
     "igloohome" =
       ps: with ps; [
         igloohome-api
@@ -4613,7 +4615,8 @@
       ]; # missing inputs: ProgettiHWSW
     "proliphix" =
       ps: with ps; [
-      ]; # missing inputs: proliphix
+        proliphix
+      ];
     "prometheus" =
       ps: with ps; [
         prometheus-client
@@ -5167,7 +5170,8 @@
       ];
     "scsgate" =
       ps: with ps; [
-      ]; # missing inputs: scsgate
+        scsgate
+      ];
     "search" =
       ps: with ps; [
       ];
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index e4ece30ec374..dece0210839e 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.27.5";
-  hash = "sha256-6WrOu5wqbbigAMPdGzLsuhuBDwzVhiMtTZIeN2Z03Q4=";
+  version = "1.29.1";
+  hash = "sha256-xYn35+2AHdvZBK+/PeJq4k6wzOJ8dxei6U33+xLWrSc=";
 }
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index bfab5d5477ad..598714cc3c8e 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "0.13.0-unstable-2025-08-03";
+  version = "0.13.0-unstable-2025-08-15";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "5eb07966b5d7e1534aa40df3b0ea305f5c6d9ae2";
-    sha256 = "sha256-AUK0vGhz1ZvVtEpVto/Qlp4+3PGsjOTBzj8Ik8sfmRQ=";
+    rev = "d34d3b05b89b3bb3d56b61b0029a42af9704b2f2";
+    sha256 = "sha256-HYE6CX2VOOVxfa791dXX1dthKgXG1ezltDlSqebgmuM=";
   };
 
   sourceRoot = "${src.name}/klippy";
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index 5cbd2033445e..57584d390e71 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.45.1";
+  version = "1.45.2";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-cKCAA9C0vsCa0BszspvPfrKbdWyaccrMtiO6UWhLIh4=";
+    hash = "sha256-LDAZdcUfrCWtld6V4GDpAbK+BeT/aeVOQ7G++sMoXU4=";
   };
 
-  vendorHash = "sha256-R4lOmHIBgnlvOukMjXdVx5e9Oneo1EizhsrDXiTbwTc=";
+  vendorHash = "sha256-hr+xIfPjlrH9igRsYeqNOPgx/jWhDfu73gA+/NoWWxI=";
 
   ldflags = [
     "-X 'github.com/jzelinskie/cobrautil/v2.Version=${src.rev}'"
diff --git a/pkgs/tools/filesystems/kdiskmark/default.nix b/pkgs/tools/filesystems/kdiskmark/default.nix
index 2f9f09fdc9d3..c401567ed9b4 100644
--- a/pkgs/tools/filesystems/kdiskmark/default.nix
+++ b/pkgs/tools/filesystems/kdiskmark/default.nix
@@ -6,19 +6,19 @@
   qttools,
   fio,
   cmake,
-  polkit-qt,
+  polkit-qt-1,
   extra-cmake-modules,
   fetchFromGitHub,
 }:
 stdenv.mkDerivation rec {
   pname = "kdiskmark";
-  version = "3.1.4";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "jonmagon";
     repo = "kdiskmark";
     rev = version;
-    hash = "sha256-JueY7zw9PIo9ETi7pQLpw8FGRhNXYXeXEvTzZGz9lbw=";
+    hash = "sha256-b42PNUrG10RyGct6dPtdT89oO222tEovkSPoRcROfaQ=";
     fetchSubmodules = true;
   };
 
@@ -31,12 +31,12 @@ stdenv.mkDerivation rec {
   buildInputs = [
     qtbase
     qttools
-    polkit-qt
+    polkit-qt-1
   ];
 
   preConfigure = ''
     substituteInPlace CMakeLists.txt \
-      --replace \$\{POLKITQT-1_POLICY_FILES_INSTALL_DIR\} $out/share/polkit-1/actions
+      --replace-fail \$\{POLKITQT-1_POLICY_FILES_INSTALL_DIR\} $out/share/polkit-1/actions
   '';
 
   qtWrapperArgs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 6ef821fdd265..6a6ac68b11a7 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1154,6 +1154,7 @@ mapAliases {
   imagemagick7Big = throw "'imagemagick7Big' has been renamed to/replaced by 'imagemagickBig'"; # Converted to throw 2024-10-17
   imagemagick7 = throw "'imagemagick7' has been renamed to/replaced by 'imagemagick'"; # Converted to throw 2024-10-17
   imagemagick7_light = throw "'imagemagick7_light' has been renamed to/replaced by 'imagemagick_light'"; # Converted to throw 2024-10-17
+  imaginer = throw "'imaginer' has been removed due to lack of upstream maintenance"; # Added 2025-08-15
   immersed-vr = lib.warnOnInstantiate "'immersed-vr' has been renamed to 'immersed'" immersed; # Added 2024-08-11
   inconsolata-nerdfont = lib.warnOnInstantiate "inconsolata-nerdfont is redundant. Use nerd-fonts.inconsolata instead." nerd-fonts.inconsolata; # Added 2024-11-10
   incrtcl = tclPackages.incrtcl; # Added 2024-10-02
@@ -1413,6 +1414,22 @@ mapAliases {
   '';
   linux_latest_hardened = linuxPackages_latest_hardened;
 
+  # Added 2025-08-10
+  linuxPackages_hardened = linuxKernel.packages.linux_hardened;
+  linux_hardened = linuxPackages_hardened.kernel;
+  linuxPackages_5_4_hardened = linuxKernel.packages.linux_5_4_hardened;
+  linux_5_4_hardened = linuxKernel.kernels.linux_5_4_hardened;
+  linuxPackages_5_10_hardened = linuxKernel.packages.linux_5_10_hardened;
+  linux_5_10_hardened = linuxKernel.kernels.linux_5_10_hardened;
+  linuxPackages_5_15_hardened = linuxKernel.packages.linux_5_15_hardened;
+  linux_5_15_hardened = linuxKernel.kernels.linux_5_15_hardened;
+  linuxPackages_6_1_hardened = linuxKernel.packages.linux_6_1_hardened;
+  linux_6_1_hardened = linuxKernel.kernels.linux_6_1_hardened;
+  linuxPackages_6_6_hardened = linuxKernel.packages.linux_6_6_hardened;
+  linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;
+  linuxPackages_6_12_hardened = linuxKernel.packages.linux_6_12_hardened;
+  linux_6_12_hardened = linuxKernel.kernels.linux_6_12_hardened;
+
   # Added 2023-11-18, modified 2024-01-09
   linuxPackages_testing_bcachefs = throw "'linuxPackages_testing_bcachefs' has been removed, please use 'linuxPackages_latest', any kernel version at least 6.7, or any other linux kernel with bcachefs support";
   linux_testing_bcachefs = throw "'linux_testing_bcachefs' has been removed, please use 'linux_latest', any kernel version at least 6.7, or any other linux kernel with bcachefs support";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b85fbca632bb..01ca7d904597 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3305,7 +3305,7 @@ with pkgs;
 
   kaffeine = libsForQt5.callPackage ../applications/video/kaffeine { };
 
-  kdiskmark = libsForQt5.callPackage ../tools/filesystems/kdiskmark { };
+  kdiskmark = kdePackages.callPackage ../tools/filesystems/kdiskmark { };
 
   keepkey-agent = with python3Packages; toPythonApplication keepkey-agent;
 
@@ -10602,20 +10602,6 @@ with pkgs;
   linux-rt = linuxPackages-rt.kernel;
   linux-rt_latest = linuxPackages-rt_latest.kernel;
 
-  # hardened kernels
-  linuxPackages_hardened = linuxKernel.packages.linux_hardened;
-  linux_hardened = linuxPackages_hardened.kernel;
-  linuxPackages_5_10_hardened = linuxKernel.packages.linux_5_10_hardened;
-  linux_5_10_hardened = linuxKernel.kernels.linux_5_10_hardened;
-  linuxPackages_5_15_hardened = linuxKernel.packages.linux_5_15_hardened;
-  linux_5_15_hardened = linuxKernel.kernels.linux_5_15_hardened;
-  linuxPackages_6_1_hardened = linuxKernel.packages.linux_6_1_hardened;
-  linux_6_1_hardened = linuxKernel.kernels.linux_6_1_hardened;
-  linuxPackages_6_6_hardened = linuxKernel.packages.linux_6_6_hardened;
-  linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;
-  linuxPackages_6_12_hardened = linuxKernel.packages.linux_6_12_hardened;
-  linux_6_12_hardened = linuxKernel.kernels.linux_6_12_hardened;
-
   # GNU Linux-libre kernels
   linuxPackages-libre = linuxKernel.packages.linux_libre;
   linux-libre = linuxPackages-libre.kernel;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index a34fef40385c..92e7265ed62b 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -294,14 +294,10 @@ in
 
         linux_latest_libre = deblobKernel packageAliases.linux_latest.kernel;
 
-        linux_hardened = hardenedKernelFor packageAliases.linux_default.kernel { };
-
-        linux_5_10_hardened = hardenedKernelFor kernels.linux_5_10 { };
-        linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
-        linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };
-        linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };
         linux_6_12_hardened = hardenedKernelFor kernels.linux_6_12 { };
+        linux_6_15_hardened = hardenedKernelFor kernels.linux_6_15 { };
 
+        linux_hardened = hardenedKernelFor packageAliases.linux_default.kernel { };
       }
       // lib.optionalAttrs config.allowAliases {
         linux_4_19 = throw "linux 4.19 was removed because it will reach its end of life within 24.11";
@@ -311,6 +307,11 @@ in
         linux_6_13 = throw "linux 6.13 was removed because it has reached its end of life upstream";
         linux_6_14 = throw "linux 6.14 was removed because it has reached its end of life upstream";
 
+        linux_5_10_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
+        linux_5_15_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
+        linux_6_1_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
+        linux_6_6_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
+
         linux_4_19_hardened = throw "linux 4.19 was removed because it will reach its end of life within 24.11";
         linux_5_4_hardened = throw "linux_5_4_hardened was removed because it was broken";
         linux_6_9_hardened = throw "linux 6.9 was removed because it has reached its end of life upstream";
@@ -345,7 +346,12 @@ in
         inherit (kernel) stdenv; # in particular, use the same compiler by default
 
         # to help determine module compatibility
-        inherit (kernel) isZen isHardened isLibre;
+        inherit (kernel)
+          isLTS
+          isZen
+          isHardened
+          isLibre
+          ;
         inherit (kernel) kernelOlder kernelAtLeast;
         kernelModuleMakeFlags = self.kernel.commonMakeFlags ++ [
           "KBUILD_OUTPUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
@@ -771,11 +777,8 @@ in
 
       linux_hardened = recurseIntoAttrs (packagesFor kernels.linux_hardened);
 
-      linux_5_10_hardened = recurseIntoAttrs (packagesFor kernels.linux_5_10_hardened);
-      linux_5_15_hardened = recurseIntoAttrs (packagesFor kernels.linux_5_15_hardened);
-      linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);
-      linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);
       linux_6_12_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_12_hardened);
+      linux_6_15_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_15_hardened);
 
       linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
       linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);
@@ -789,6 +792,12 @@ in
       __recurseIntoDerivationForReleaseJobs = true;
     }
     // lib.optionalAttrs config.allowAliases {
+
+      linux_5_10_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
+      linux_5_15_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
+      linux_6_1_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
+      linux_6_6_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
+
       linux_4_19_hardened = throw "linux 4.19 was removed because it will reach its end of life within 24.11";
       linux_5_4_hardened = throw "linux_5_4_hardened was removed because it was broken";
       linux_6_9_hardened = throw "linux 6.9 was removed because it has reached its end of life upstream";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f4128c2b6fc7..064652e4fe5a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1803,6 +1803,8 @@ self: super: with self; {
 
   beetcamp = callPackage ../development/python-modules/beetcamp { };
 
+  beewi-smartclim = callPackage ../development/python-modules/beewi-smartclim { };
+
   before-after = callPackage ../development/python-modules/before-after { };
 
   behave = callPackage ../development/python-modules/behave { };
@@ -2168,6 +2170,8 @@ self: super: with self; {
 
   bthomehub5-devicelist = callPackage ../development/python-modules/bthomehub5-devicelist { };
 
+  btlewrap = callPackage ../development/python-modules/btlewrap { };
+
   btrees = callPackage ../development/python-modules/btrees { };
 
   btrfs = callPackage ../development/python-modules/btrfs { };
@@ -6894,6 +6898,8 @@ self: super: with self; {
     inherit (pkgs) cgal_5 libxml2;
   };
 
+  iglo = callPackage ../development/python-modules/iglo { };
+
   igloohome-api = callPackage ../development/python-modules/igloohome-api { };
 
   ignite = callPackage ../development/python-modules/ignite { };
@@ -12028,6 +12034,8 @@ self: super: with self; {
 
   progressbar33 = callPackage ../development/python-modules/progressbar33 { };
 
+  proliphix = callPackage ../development/python-modules/proliphix { };
+
   prometheus-api-client = callPackage ../development/python-modules/prometheus-api-client { };
 
   prometheus-async = callPackage ../development/python-modules/prometheus-async { };
@@ -13512,6 +13520,8 @@ self: super: with self; {
 
   pyopengltk = callPackage ../development/python-modules/pyopengltk { };
 
+  pyopenjtalk = callPackage ../development/python-modules/pyopenjtalk { };
+
   pyopensprinkler = callPackage ../development/python-modules/pyopensprinkler { };
 
   pyopenssl = callPackage ../development/python-modules/pyopenssl { };
@@ -16299,6 +16309,8 @@ self: super: with self; {
 
   scs = callPackage ../development/python-modules/scs { };
 
+  scsgate = callPackage ../development/python-modules/scsgate { };
+
   scspell = callPackage ../development/python-modules/scspell { };
 
   sdbus = callPackage ../development/python-modules/sdbus { };