diff --git a/lib/default.nix b/lib/default.nix
index 6baea4de0413..3eb2ecc308a4 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -127,6 +127,7 @@ let
         bitXor
         bitNot
         boolToString
+        boolToYesNo
         mergeAttrs
         flip
         defaultTo
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 7e4c5f549ee7..9c4deafb402c 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -240,6 +240,26 @@ in
   */
   boolToString = b: if b then "true" else "false";
 
+  /**
+    Converts a boolean to a string.
+
+    This function uses the strings "yes" and "no" to represent
+    boolean values.
+
+    # Inputs
+
+    `b`
+
+    : The boolean to convert
+
+    # Type
+
+    ```
+    boolToYesNo :: bool -> string
+    ```
+  */
+  boolToYesNo = b: if b then "yes" else "no";
+
   /**
     Merge two attribute sets shallowly, right side trumps left
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 950479a825bd..495eb98c6ae2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16790,6 +16790,14 @@
     githubId = 34864484;
     name = "Mikael Fangel";
   };
+  mikatammi = {
+    email = "mikatammi@gmail.com";
+    github = "mikatammi";
+    githubId = 826368;
+    name = "Mika Tammi";
+    matrix = "@oak:universumi.fi";
+    keys = [ { fingerprint = "3606 AD2B 342F 70B3 B306  E724 BF5B DF55 A973 5223"; } ];
+  };
   mikecm = {
     email = "mikecmcleod@gmail.com";
     github = "MaxwellDupre";
diff --git a/nixos/modules/services/web-servers/phpfpm/default.nix b/nixos/modules/services/web-servers/phpfpm/default.nix
index 6bfc010bb463..34845589fabe 100644
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@@ -302,6 +302,7 @@ in
             RuntimeDirectory = "phpfpm";
             RuntimeDirectoryPreserve = true; # Relevant when multiple processes are running
             Restart = "always";
+            WatchdogSec = 15;
           };
       }
     ) cfg.pools;
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 3fe5a34c27bb..1f38b7b84064 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -1603,6 +1603,16 @@ let
 
           pastery = ignoreCompilationError super.pastery; # elisp error
 
+          pdf-meta-edit = super.pdf-meta-edit.overrideAttrs (attrs: {
+            postPatch =
+              attrs.postPatch or ""
+              + "\n"
+              + ''
+                substituteInPlace pdf-meta-edit.el \
+                    --replace-fail '(executable-find "pdftk")' '"${lib.getExe pkgs.pdftk}"'
+              '';
+          });
+
           pgdevenv = ignoreCompilationError super.pgdevenv; # elisp error
 
           pinot = ignoreCompilationError super.pinot; # elisp error
diff --git a/pkgs/by-name/ar/arashi/package.nix b/pkgs/by-name/ar/arashi/package.nix
index 2b0cb388db49..cfa941014bdd 100644
--- a/pkgs/by-name/ar/arashi/package.nix
+++ b/pkgs/by-name/ar/arashi/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arashi";
-  version = "25.08.3";
+  version = "25.09";
 
   src = fetchFromGitHub {
     owner = "0hStormy";
     repo = "Arashi";
     tag = finalAttrs.version;
-    hash = "sha256-wmYsAfgdwn6ZLF70avNmjoU5VZNBZdV7dPSe8ycNdHE=";
+    hash = "sha256-qSr6wj+O6ieWxgKQxmUz7I3De9MOF5cq0I5DpD8+tug=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
index bf2758609cd4..a6d386fdd5ae 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS) wrapper plugin";
-  hash = "sha256-6iDlZ1e69TM1z0cfGONWyd5vGTYtyDoaw357PgBVyD4=";
+  hash = "sha256-hQL9lzyqXGe2HKED21eGepwNUyYaVVoVnxeONoQFyqE=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.10.1.wasm";
-  version = "0.10.1";
+  url = "https://plugins.dprint.dev/biome-0.10.3.wasm";
+  version = "0.10.3";
 }
diff --git a/pkgs/by-name/fe/fex-headless/package.nix b/pkgs/by-name/fe/fex-headless/package.nix
new file mode 100644
index 000000000000..b9d5eb3ebfe3
--- /dev/null
+++ b/pkgs/by-name/fe/fex-headless/package.nix
@@ -0,0 +1,7 @@
+{
+  fex,
+}:
+
+fex.override {
+  withQt = false;
+}
diff --git a/pkgs/by-name/fe/fex/package.nix b/pkgs/by-name/fe/fex/package.nix
index 726502a66264..9683735feafd 100644
--- a/pkgs/by-name/fe/fex/package.nix
+++ b/pkgs/by-name/fe/fex/package.nix
@@ -5,12 +5,14 @@
   cmake,
   ninja,
   pkg-config,
-  qt5,
   python3,
   nix-update-script,
   xxHash,
   fmt,
+  libxml2,
+  openssl,
   range-v3,
+  catch2,
   nasm,
   buildEnv,
   writeText,
@@ -22,6 +24,8 @@
   libGL,
   wayland,
   xorg,
+  withQt ? true,
+  qt6,
 }:
 
 let
@@ -97,7 +101,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     owner = "FEX-Emu";
     repo = "FEX";
     tag = "FEX-${finalAttrs.version}";
-
     hash = "sha256-Dq87cx7tv+HJvpy57L8dcApE+3E8VEyyTYKhDyoUfVU=";
 
     leaveDotGit = true;
@@ -113,8 +116,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
         External/jemalloc_glibc \
         External/robin-map \
         External/vixl \
-        Source/Common/cpp-optparse \
-        External/Catch2
+        Source/Common/cpp-optparse
 
       find . -name .git -print0 | xargs -0 rm -rf
 
@@ -160,22 +162,21 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     pkg-config
-    qt5.wrapQtAppsHook
     llvmPackages.bintools
-
     (python3.withPackages (
       pythonPackages: with pythonPackages; [
         setuptools
         libclang
       ]
     ))
-  ];
-
-  nativeCheckInputs = [ nasm ];
+  ]
+  ++ lib.optional withQt qt6.wrapQtAppsHook;
 
   buildInputs = [
     xxHash
     fmt
+    libxml2
+    openssl
     range-v3
     pkgsCross64.buildPackages.clang
     pkgsCross32.buildPackages.clang
@@ -183,20 +184,17 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     libllvm
   ]
   ++ libForwardingInputs
-  ++ (with qt5; [
-    qtbase
-    qtdeclarative
-    qtquickcontrols
-    qtquickcontrols2
-  ]);
+  ++ lib.optionals withQt [
+    qt6.qtbase
+    qt6.qtdeclarative
+  ];
 
   cmakeFlags = [
     (lib.cmakeFeature "USE_LINKER" "lld")
-    (lib.cmakeBool "ENABLE_LTO" true)
-    (lib.cmakeBool "ENABLE_ASSERTIONS" false)
     (lib.cmakeFeature "OVERRIDE_VERSION" finalAttrs.version)
     (lib.cmakeBool "BUILD_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "BUILD_THUNKS" true)
+    (lib.cmakeBool "BUILD_FEXCONFIG" withQt)
     (lib.cmakeFeature "X86_32_TOOLCHAIN_FILE" "${toolchain32}")
     (lib.cmakeFeature "X86_64_TOOLCHAIN_FILE" "${toolchain}")
     (lib.cmakeFeature "X86_DEV_ROOTFS" "${devRootFS}")
@@ -207,6 +205,9 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   # Unsupported on non-4K page size kernels (e.g. Apple Silicon)
   doCheck = true;
 
+  nativeCheckInputs = [ nasm ];
+  checkInputs = [ catch2 ];
+
   # List not exhaustive, e.g. because they depend on an x86 compiler or some
   # other difficult-to-build test binaries.
   checkTarget = lib.concatStringsSep " " [
@@ -219,7 +220,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   # Avoid wrapping anything other than FEXConfig, since the wrapped executables
   # don't seem to work when registered as binfmts.
   dontWrapQtApps = true;
-  preFixup = ''
+  preFixup = lib.optionalString withQt ''
     wrapQtApp $out/bin/FEXConfig
   '';
 
diff --git a/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
index 17adf9687a47..2779308ebca1 100644
--- a/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,72 +1,69 @@
-commit 448e265ad3fef9a5ef0ff57593dd5a9164118852
+commit 56507892ff7a03ed283d7fd2d7ff2000fc9c17d7
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Tue Oct 15 11:46:38 2024 +0200
 
     Add option for installation sysconfdir
 
 diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
-index 3f1cb3574..acbdccb61 100644
+index 2a2a07016..99df55afb 100644
 --- a/data/bios-settings.d/meson.build
 +++ b/data/bios-settings.d/meson.build
-@@ -1,6 +1,6 @@
- if build_standalone and host_machine.system() == 'linux'
- install_data('README.md',
-   install_tag: 'doc',
--  install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d')
-+  install_dir: join_paths(datadir, 'fwupd', 'bios-settings.d')
- )
+@@ -2,6 +2,6 @@ if build_standalone and host_machine.system() == 'linux'
+   install_data(
+     'README.md',
+     install_tag: 'doc',
+-    install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d'),
++    install_dir: join_paths(datadir, 'fwupd', 'bios-settings.d'),
+   )
  endif
 diff --git a/data/meson.build b/data/meson.build
-index 78f54bd83..aae01ed56 100644
+index 5716669f0..78e754f40 100644
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -28,7 +28,7 @@ endif
- if build_standalone
-   install_data(['fwupd.conf'],
+@@ -29,7 +29,7 @@ if build_standalone
+   install_data(
+     ['fwupd.conf'],
      install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'fwupd'),
      install_mode: 'rw-r-----',
    )
-   plugin_quirks += files([
+   plugin_quirks += files('cfi.quirk', 'ds20.quirk', 'power.quirk', 'vendors.quirk')
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 9b1e6b372..5c80ba564 100644
+index 5b962adf1..b6575f7e4 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -8,14 +8,14 @@ install_data([
-     'GPG-KEY-Linux-Vendor-Firmware-Service',
-   ],
-   install_tag: 'runtime',
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
- )
- install_data([
-     'GPG-KEY-Linux-Foundation-Metadata',
-     'GPG-KEY-Linux-Vendor-Firmware-Service',
-   ],
-   install_tag: 'runtime',
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
- )
+@@ -12,12 +12,12 @@ if supported_gpg
+   install_data(
+     ['GPG-KEY-Linux-Foundation-Firmware', 'GPG-KEY-Linux-Vendor-Firmware-Service'],
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd'),
++    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd'),
+   )
+   install_data(
+     ['GPG-KEY-Linux-Foundation-Metadata', 'GPG-KEY-Linux-Vendor-Firmware-Service'],
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata'),
++    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata'),
+   )
  endif
  
-@@ -24,12 +24,12 @@ install_data([
-     'LVFS-CA.pem',
-   ],
-   install_tag: 'runtime',
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
- )
- install_data([
-     'LVFS-CA.pem',
-   ],
-   install_tag: 'runtime',
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
- )
+@@ -25,11 +25,11 @@ if supported_pkcs7
+   install_data(
+     ['LVFS-CA.pem'],
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd'),
++    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd'),
+   )
+   install_data(
+     ['LVFS-CA.pem'],
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata'),
++    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata'),
+   )
  endif
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index 77285cafa..7d2cb8f58 100644
+index b8d24c267..0dd4ad32a 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
 @@ -12,7 +12,7 @@ if build_standalone and get_option('lvfs') != 'false'
@@ -87,7 +84,7 @@ index 77285cafa..7d2cb8f58 100644
    )
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
-@@ -58,7 +58,7 @@ configure_file(
+@@ -59,7 +59,7 @@ configure_file(
    configuration: con2,
    install: get_option('vendor_metadata'),
    install_tag: 'runtime',
@@ -96,7 +93,7 @@ index 77285cafa..7d2cb8f58 100644
  )
  configure_file(
    input: 'vendor-directory.conf',
-@@ -66,5 +66,5 @@ configure_file(
+@@ -67,5 +67,5 @@ configure_file(
    configuration: con2,
    install: true,
    install_tag: 'runtime',
@@ -104,10 +101,10 @@ index 77285cafa..7d2cb8f58 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/docs/meson.build b/docs/meson.build
-index c1e483f4f..684ec3fbe 100644
+index 787b4387c..b3144757f 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
-@@ -127,7 +127,7 @@ if build_docs
+@@ -196,7 +196,7 @@ if build_docs
      build_by_default: true,
      install: true,
      install_tag: 'doc',
@@ -116,7 +113,7 @@ index c1e483f4f..684ec3fbe 100644
    )
  
    subdir('hsi-tests.d')
-@@ -186,7 +186,7 @@ if build_docs
+@@ -247,7 +247,7 @@ if build_docs
      build_by_default: true,
      install: true,
      install_tag: 'doc',
@@ -124,39 +121,44 @@ index c1e483f4f..684ec3fbe 100644
 +    install_dir: join_paths(sysconfdir_install, 'doc'),
    )
    man_cmd = []
-   foreach man: man_md
-@@ -201,31 +201,31 @@ if build_docs
-     ],
+   foreach man : man_md
+@@ -260,36 +260,36 @@ if build_docs
+     command: [generate_index, '@INPUT@', '-o', '@OUTPUT@', man_cmd],
      install: true,
      install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'fwupd')
-+    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd')
+-    install_dir: join_paths(datadir, 'doc', 'fwupd'),
++    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
    )
    if hsi
-     install_data(['hsi.html'],
+     install_data(
+       ['hsi.html'],
        install_tag: 'doc',
--      install_dir : join_paths(datadir, 'doc', 'fwupd')
-+      install_dir : join_paths(sysconfdir_install, 'doc', 'fwupd')
+-      install_dir: join_paths(datadir, 'doc', 'fwupd'),
++      install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
      )
    endif
-   install_data(['urlmap_fwupd.js'],
+   install_data(
+     ['urlmap_fwupd.js'],
      install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'libfwupd')
-+    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupd')
+-    install_dir: join_paths(datadir, 'doc', 'libfwupd'),
++    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupd'),
    )
-   install_data(['urlmap_fwupdplugin.js'],
+   install_data(
+     ['urlmap_fwupdplugin.js'],
      install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'libfwupdplugin')
-+    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupdplugin')
+-    install_dir: join_paths(datadir, 'doc', 'libfwupdplugin'),
++    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupdplugin'),
    )
    #make devhelp work
-   install_symlink('libfwupd',
+   install_symlink(
+     'libfwupd',
      install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
      pointing_to: join_paths('..', 'libfwupd'),
    )
-   install_symlink('libfwupdplugin',
+   install_symlink(
+     'libfwupdplugin',
      install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
@@ -164,10 +166,10 @@ index c1e483f4f..684ec3fbe 100644
    )
  endif
 diff --git a/meson.build b/meson.build
-index 4faedcc0b..980f9bb0c 100644
+index ca431980b..d9bab5264 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -212,6 +212,12 @@ endif
+@@ -246,6 +246,12 @@ endif
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
  
@@ -178,8 +180,8 @@ index 4faedcc0b..980f9bb0c 100644
 +endif
 +
  diffcmd = find_program('diff')
- gio = dependency('gio-2.0', version: '>= 2.68.0') # limited by RHEL-9, which has v2.68.4
- giounix = dependency('gio-unix-2.0', version: '>= 2.68.0', required: false)
+ gio = dependency(
+   'gio-2.0',
 diff --git a/meson_options.txt b/meson_options.txt
 index 63c8d288d..04f6651e6 100644
 --- a/meson_options.txt
diff --git a/pkgs/by-name/fw/fwupd/efi-app-path.patch b/pkgs/by-name/fw/fwupd/efi-app-path.patch
index 2411a86c62ed..5014c6c65600 100644
--- a/pkgs/by-name/fw/fwupd/efi-app-path.patch
+++ b/pkgs/by-name/fw/fwupd/efi-app-path.patch
@@ -1,19 +1,19 @@
-commit 1770b1871a567dfa78ae1e32094b6007bb7639e9
+commit f60f2bf6dd4961bdda742f590bf2d7871db6cdab
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Mon Oct 28 12:08:49 2024 +0100
 
     Get the efi app from fwupd-efi
 
 diff --git a/meson.build b/meson.build
-index e4e764b97..8acaa3d2d 100644
+index d9bab5264..ee91d34b0 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -482,7 +482,7 @@ endif
+@@ -650,7 +650,7 @@ endif
  
  # EFI
  if build_standalone
 -  efi_app_location = join_paths(libexecdir, 'fwupd', 'efi')
 +  efi_app_location = join_paths(dependency('fwupd-efi').get_variable(pkgconfig: 'prefix'), 'libexec', 'fwupd', 'efi')
    conf.set_quoted('EFI_APP_LOCATION', efi_app_location)
-   if host_cpu == 'x86'
-     EFI_MACHINE_TYPE_NAME = 'ia32'
+ endif
+ 
diff --git a/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch b/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
index 57726af3bc69..09f562ad28e5 100644
--- a/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
+++ b/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
@@ -1,19 +1,19 @@
-commit 1b7f8b3ad7df9a5911fbc45608d9b40e0787baca
+commit 3ffe2d7842b62986e2267e6542068e6356b06fdf
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Mon Oct 28 12:07:51 2024 +0100
 
     Install fwupdplugin to out
 
 diff --git a/meson.build b/meson.build
-index 747d1b385..312513d75 100644
+index 3a163331e..cb66be0cc 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -548,7 +548,7 @@ if build_standalone
- if host_machine.system() == 'windows'
-   libdir_pkg = bindir
- else
--  libdir_pkg = join_paths(libdir, 'fwupd-@0@'.format(fwupd_version))
-+  libdir_pkg = join_paths(prefix, 'lib', 'fwupd-@0@'.format(fwupd_version))
- endif
- conf.set_quoted('FWUPD_LIBDIR_PKG', libdir_pkg)
+@@ -733,7 +733,7 @@ if build_standalone
+   if host_machine.system() == 'windows'
+     libdir_pkg = bindir
+   else
+-    libdir_pkg = join_paths(libdir, 'fwupd-@0@'.format(fwupd_version))
++    libdir_pkg = join_paths(prefix, 'lib', 'fwupd-@0@'.format(fwupd_version))
+   endif
+   conf.set_quoted('FWUPD_LIBDIR_PKG', libdir_pkg)
  endif
diff --git a/pkgs/by-name/fw/fwupd/installed-tests-path.patch b/pkgs/by-name/fw/fwupd/installed-tests-path.patch
index afcd9f4905c6..f5786fe79e92 100644
--- a/pkgs/by-name/fw/fwupd/installed-tests-path.patch
+++ b/pkgs/by-name/fw/fwupd/installed-tests-path.patch
@@ -1,14 +1,14 @@
-commit abaf36af96c7dfc966110c5342d5a8814c0df492
+commit 954e41500e1b409a24fca43ae3bdc1c6a890db48
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Tue Oct 15 14:49:53 2024 +0200
 
     Add output for installed tests
 
 diff --git a/data/tests/meson.build b/data/tests/meson.build
-index da9524677..505d7a80e 100644
+index 3eba65eea..cf3931bb7 100644
 --- a/data/tests/meson.build
 +++ b/data/tests/meson.build
-@@ -131,7 +131,7 @@ configure_file(
+@@ -122,7 +122,7 @@ configure_file(
    configuration: con2,
    install: true,
    install_tag: 'tests',
@@ -18,10 +18,10 @@ index da9524677..505d7a80e 100644
  
  if umockdev_integration_tests.allowed()
 diff --git a/meson.build b/meson.build
-index 312513d75..4faedcc0b 100644
+index cb66be0cc..ca431980b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -205,8 +205,8 @@ else
+@@ -239,8 +239,8 @@ else
    datadir = join_paths(prefix, get_option('datadir'))
    sysconfdir = join_paths(prefix, get_option('sysconfdir'))
    localstatedir = join_paths(prefix, get_option('localstatedir'))
@@ -32,7 +32,7 @@ index 312513d75..4faedcc0b 100644
    daemon_dir = join_paths(libexecdir, 'fwupd')
  endif
  mandir = join_paths(prefix, get_option('mandir'))
-@@ -536,6 +536,7 @@ gnome = import('gnome')
+@@ -721,6 +721,7 @@ gnome = import('gnome')
  i18n = import('i18n')
  
  conf.set_quoted('FWUPD_PREFIX', prefix)
@@ -56,10 +56,10 @@ index 40103c03e..63c8d288d 100644
    type: 'boolean',
    value: true,
 diff --git a/src/tests/host-emulate/meson.build b/src/tests/host-emulate/meson.build
-index 0a67d70e8..7e07c0a49 100644
+index c36da65cd..f0b70d4d6 100644
 --- a/src/tests/host-emulate/meson.build
 +++ b/src/tests/host-emulate/meson.build
-@@ -10,7 +10,7 @@ if build_standalone
+@@ -9,7 +9,7 @@ if build_standalone
        command: [gzip, '-k', '--stdout', '@INPUT@'],
        install: true,
        install_tag: 'tests',
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index b90d3f399dd1..92e6b11f9a22 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -134,7 +134,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "2.0.15";
+  version = "2.0.16";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -152,7 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     tag = finalAttrs.version;
-    hash = "sha256-p0ZpbthjUaEKAn1UwzoW2gxqiBTsC4GMoXTmV3zKN2o=";
+    hash = "sha256-fsjW3Idaqg4pNGaRP0bm2R94FcW2MVfPQwPFWrN+Qy8=";
   };
 
   patches = [
@@ -400,7 +400,10 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://fwupd.org/";
     changelog = "https://github.com/fwupd/fwupd/releases/tag/${finalAttrs.version}";
-    maintainers = with lib.maintainers; [ rvdp ];
+    maintainers = with lib.maintainers; [
+      rvdp
+      johnazoidberg
+    ];
     license = lib.licenses.lgpl21Plus;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/gp/gpu-screen-recorder/package.nix b/pkgs/by-name/gp/gpu-screen-recorder/package.nix
index cbce7cc28246..d92598f170a6 100644
--- a/pkgs/by-name/gp/gpu-screen-recorder/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder/package.nix
@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation rec {
   pname = "gpu-screen-recorder";
-  version = "5.6.5";
+  version = "5.6.8";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/${pname}";
     tag = version;
-    hash = "sha256-2tlhuJ2Ro2ExIXVO8dUiR749el/R3l9nl6ezShF19Fg=";
+    hash = "sha256-uASmN6RoLoOrPfHhMssaGABBAMxrQcBEO3Czqsgrrlc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/holos/package.nix b/pkgs/by-name/ho/holos/package.nix
index ccecde4c412e..981dd7b06d45 100644
--- a/pkgs/by-name/ho/holos/package.nix
+++ b/pkgs/by-name/ho/holos/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule rec {
   pname = "holos";
-  version = "0.104.2";
+  version = "0.104.3";
 
   src = fetchFromGitHub {
     owner = "holos-run";
     repo = "holos";
     rev = "v${version}";
-    hash = "sha256-FzePCxBnKyEEnJZaKjiignahkGlerdw/j2RfDunQnbc=";
+    hash = "sha256-qcHROEjBEhbqjV7KHSLoCyO/B/DjBA+7nhykt2d78K8=";
   };
 
   vendorHash = "sha256-HbYFQG+iZMP/bcqz0UYduxeFNAAo+e3UUTubblhiNxk=";
diff --git a/pkgs/by-name/ht/htmlhint/package.nix b/pkgs/by-name/ht/htmlhint/package.nix
index 28021fb075dd..77a4c8f9eb7d 100644
--- a/pkgs/by-name/ht/htmlhint/package.nix
+++ b/pkgs/by-name/ht/htmlhint/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "htmlhint";
-  version = "1.6.3";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "htmlhint";
     repo = "HTMLHint";
     rev = "v${version}";
-    hash = "sha256-OId1uuNWry9tXWkewVhOJlWIRlfDPIN18gmYQ43TYdQ=";
+    hash = "sha256-aFydnJiRqGzBKZGX/AvRlxjf3sw+fBwKdGmydFjD/xk=";
   };
 
-  npmDepsHash = "sha256-H9zw04Y9yD044qc3pylQge16QojaUCndHO1haw6FJ5s=";
+  npmDepsHash = "sha256-h37yWpXWh9+cMlI36zucq2ZbYsQUaGuRQGJySKIeda0=";
 
   meta = {
     changelog = "https://github.com/htmlhint/HTMLHint/blob/${src.rev}/CHANGELOG.md";
diff --git a/pkgs/by-name/id/ida-free/package.nix b/pkgs/by-name/id/ida-free/package.nix
index c741c6b5337a..1641cf4228ba 100644
--- a/pkgs/by-name/id/ida-free/package.nix
+++ b/pkgs/by-name/id/ida-free/package.nix
@@ -12,7 +12,6 @@
   libGL,
   libkrb5,
   libsecret,
-  libsForQt5,
   libunwind,
   libxkbcommon,
   makeWrapper,
@@ -21,21 +20,19 @@
   xorg,
   zlib,
 }:
-
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "ida-free";
-  version = "9.1";
+  version = "9.2";
 
   src = requireFile {
     name = "ida-free-pc_${lib.replaceStrings [ "." ] [ "" ] version}_x64linux.run";
-    url = "https://my.hex-rays.com/dashboard/download-center/${version}/ida-free";
-    hash = "sha256-DIkxr9yD6yvziO8XHi0jt80189bXueRxmSFyq2LM0cg=";
+    url = "https://my.hex-rays.com/dashboard/download-center/installers/release/${version}/ida-free";
+    hash = "sha256-CQm9phkqLXhht4UQxooKmhmiGuW3lV8RIJuDrm52aNw=";
   };
 
   nativeBuildInputs = [
     makeWrapper
     autoPatchelfHook
-    libsForQt5.wrapQtAppsHook
   ];
 
   # We just get a runfile in $src, so no need to unpack it.
@@ -53,7 +50,6 @@ stdenv.mkDerivation (finalAttrs: rec {
     libGL
     libkrb5
     libsecret
-    libsForQt5.qtbase
     libunwind
     libxkbcommon
     openssl
@@ -70,11 +66,18 @@ stdenv.mkDerivation (finalAttrs: rec {
     xorg.xcbutilkeysyms
     xorg.xcbutilrenderutil
     xorg.xcbutilwm
+    xorg.xcbutilcursor
     zlib
   ];
   buildInputs = runtimeDependencies;
 
-  dontWrapQtApps = true;
+  # IDA comes with its own Qt6, some dependencies are missing in the installer.
+  autoPatchelfIgnoreMissingDeps = [
+    "libQt6Network.so.6"
+    "libQt6EglFSDeviceIntegration.so.6"
+    "libQt6WaylandEglClientHwIntegration.so.6"
+    "libQt6WlShellIntegration.so.6"
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -101,11 +104,9 @@ stdenv.mkDerivation (finalAttrs: rec {
     # Some libraries come with the installer.
     addAutoPatchelfSearchPath $IDADIR
 
-    for bb in ida assistant; do
-      wrapProgram $IDADIR/$bb \
-        --prefix QT_PLUGIN_PATH : $IDADIR/plugins/platforms
-      ln -s $IDADIR/$bb $out/bin/$bb
-    done
+    # Wrap the ida executable to set QT_PLUGIN_PATH
+    wrapProgram $IDADIR/ida --prefix QT_PLUGIN_PATH : $IDADIR/plugins/platforms
+    ln -s $IDADIR/ida $out/bin/ida
 
     # runtimeDependencies don't get added to non-executables, and openssl is needed
     #  for cloud decompilation
diff --git a/pkgs/by-name/in/intel-gmmlib/package.nix b/pkgs/by-name/in/intel-gmmlib/package.nix
index 62006fbb8687..5b15a495256c 100644
--- a/pkgs/by-name/in/intel-gmmlib/package.nix
+++ b/pkgs/by-name/in/intel-gmmlib/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.8.1";
+  version = "22.8.2";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     tag = "intel-gmmlib-${version}";
-    hash = "sha256-TFa8EfrL14w8ameIinRhmeNnfOJ18hoXWEpTgxTeBBE=";
+    hash = "sha256-dn8I3cuApy+RUWeKDVzU0sr3fUjHoDFHdGasFTAufec=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
index 8c115e07abcb..87214369a26e 100644
--- a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2025-08-01";
+  version = "0-unstable-2025-09-01";
 
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jawiki-archive";
-    rev = "25c2523e2845552101cc8815917619170238d197";
-    hash = "sha256-94qqYqh5KdWQZTVXl8GOXRUI6C0IG8THP9j2t4/8M8Y=";
+    rev = "bcb0ee245aee3ba7769ceec6caf9696c8bae1624";
+    hash = "sha256-Vb+8XE9FFEJfp6++WWr5fT6oWkF8eUtvYLz9ouRHWHA=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/jb/jbrowse/package.nix b/pkgs/by-name/jb/jbrowse/package.nix
index c91d08bed669..daef63642506 100644
--- a/pkgs/by-name/jb/jbrowse/package.nix
+++ b/pkgs/by-name/jb/jbrowse/package.nix
@@ -6,11 +6,11 @@
 
 let
   pname = "jbrowse";
-  version = "3.6.4";
+  version = "3.6.5";
 
   src = fetchurl {
     url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-oSxSW6kZ68iQBdR4Uxd9yiU2S/8bLamXje9FDgahuv4=";
+    sha256 = "sha256-aCmNpZX8TBZm7nbS13GBUG4a/X4kvwWRHvwWWykoLwU=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/jo/jocalsend/package.nix b/pkgs/by-name/jo/jocalsend/package.nix
index 629995b2484a..3e48a267aa71 100644
--- a/pkgs/by-name/jo/jocalsend/package.nix
+++ b/pkgs/by-name/jo/jocalsend/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jocalsend";
-  version = "1.6.18033";
+  version = "1.61803398";
 
   src = fetchFromGitea {
     domain = "git.kittencollective.com";
     owner = "nebkor";
     repo = "joecalsend";
     tag = finalAttrs.version;
-    hash = "sha256-q2fzi0NKfkjCwV7FD0PqXSHtJWQtvdvKx4WmhnZpKvg=";
+    hash = "sha256-7Gl+G4BN3CgF0c/AEhI1OvRhveqGeFNmGRI3XRf6rAo=";
   };
 
-  cargoHash = "sha256-u9Ev/Qr/WN6OOaMXPesA3nmV3efKJA3/2YWm8S60PjU=";
+  cargoHash = "sha256-prT1wO3ctnTfMHfICFcihB739lN/QXPH3AamIR6dM9A=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
index f774c1a0e6f0..ef2959bba858 100644
--- a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
+++ b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "matrix-alertmanager-receiver";
-  version = "2025.9.3";
+  version = "2025.9.10";
 
   src = fetchFromGitHub {
     owner = "metio";
     repo = "matrix-alertmanager-receiver";
     tag = finalAttrs.version;
-    hash = "sha256-RCWQNUZ8ZsGzsjTyqyr2O814qqV6eTumvLU6tvwi7vU=";
+    hash = "sha256-8oi/CeoIiv+yIkYqHXIivrd9iC3PfXbB+cELlKABafQ=";
   };
 
-  vendorHash = "sha256-xkRL0Cq7vXG3dQeyw0IK74xwRiyC89hvB/2BEGQHCN0=";
+  vendorHash = "sha256-zYcc2Gtdrh0xgHc/Bj+XQovlazlHpv7Rm+3lbw1ry1g=";
 
   env.CGO_ENABLED = "0";
 
diff --git a/pkgs/by-name/md/mdsf/package.nix b/pkgs/by-name/md/mdsf/package.nix
index 44cc1a1f2a62..5fef3f28c8cf 100644
--- a/pkgs/by-name/md/mdsf/package.nix
+++ b/pkgs/by-name/md/mdsf/package.nix
@@ -7,7 +7,7 @@
 }:
 let
   pname = "mdsf";
-  version = "0.10.5";
+  version = "0.10.6";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -16,49 +16,13 @@ rustPlatform.buildRustPackage {
     owner = "hougesen";
     repo = "mdsf";
     tag = "v${version}";
-    hash = "sha256-m7VoGozJShEw6qVXScxgX7CCyIh62unVvzjq/W7Ynu8=";
+    hash = "sha256-fWJSCYWbt1P9Y2mZQ3n36SOnW7s3Cu7nmDS9dOv9hII=";
   };
 
-  cargoHash = "sha256-AMo2LPC6RviYu2qx202o0gFIIJdjNJxS/zY06TEcpKw=";
+  cargoHash = "sha256-qwROKSUiTvBix3mxnwtoS9pTlemi9U7oCa/nlERq9sw=";
 
-  checkFlags = [
-    # Failing due to the method under test trying to create a directory & write to the filesystem
-    "--skip=caching::test_cache_entry::it_should_work"
-    # Permissions denied due to the test trying to remove a directory
-    "--skip=commands::prune_cache::test_run::it_should_remove_cache_directory"
-    # Permissions denied due to the test trying to write to a file
-    "--skip=config::test_config::it_should_error_on_broken_config"
-    # The following tests try to create tmp files
-    "--skip=format::accepts_multiple_file_paths"
-    "--skip=format::accepts_multiple_file_paths_with_thread_argument"
-    "--skip=format::accepts_multiple_file_paths_with_thread_argument_zero"
-    "--skip=format::format_with_cache_arg"
-    "--skip=format::formats_broken_input"
-    "--skip=format::formats_broken_input_stdin"
-    "--skip=format::formats_broken_input_with_debug_arg"
-    "--skip=format::on_missing_tool_binary_fail_cli"
-    "--skip=format::on_missing_tool_binary_fail_config"
-    "--skip=format::on_missing_tool_binary_fail_fast_cli"
-    "--skip=format::on_missing_tool_binary_fail_fast_config"
-    "--skip=format::on_missing_tool_binary_ignore_cli"
-    "--skip=format::on_missing_tool_binary_ignore_config"
-    "--skip=format::on_missing_tool_binary_prioritize_cli"
-    "--skip=format::supports_config_path_argument"
-    # Depends on one of gofumpt, gofmt, or crlfmt being available
-    "--skip=test_lib::it_should_add_go_package_if_missing"
-    # The following tests depend on rustfmt being available
-    "--skip=test_lib::it_should_format_the_code"
-    "--skip=test_lib::it_should_format_the_codeblocks_that_start_with_whitespace"
-    "--skip=test_lib::it_should_not_care_if_go_package_is_set"
-    "--skip=test_lib::it_should_not_modify_outside_blocks"
-    # The following tests try to interact with the file system
-    "--skip=verify::accepts_multiple_file_paths_broken"
-    "--skip=verify::accepts_multiple_file_paths_mixed"
-    "--skip=verify::fails_with_broken_input"
-    # The following tests try to interact with stdin
-    "--skip=verify::success_with_formatted_input_stdin"
-    "--skip=verify::supports_log_level_argument"
-  ];
+  # many tests fail for various reasons of which most depend on the build sandbox
+  doCheck = false;
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index ff626a5f2357..360ddbba288f 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -162,11 +162,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "139.0.3405.125";
+  version = "140.0.3485.66";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-MqJPlFoPiTIReXRhLJGR+nbOVwWcpiHTMr5s+M6KXqE=";
+    hash = "sha256-/ITJFChnQa5XK4nQe3biGw6vvV+pLbbZNb989XecUGY=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
@@ -277,6 +277,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       leleuvilela
       bricklou
       jonhermansen
+      iedame
     ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/by-name/mo/monophony/package.nix b/pkgs/by-name/mo/monophony/package.nix
index 9b63ad9e6900..d18fa37612ce 100644
--- a/pkgs/by-name/mo/monophony/package.nix
+++ b/pkgs/by-name/mo/monophony/package.nix
@@ -12,14 +12,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "monophony";
-  version = "3.4.1";
+  version = "3.4.2";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "zehkira";
     repo = "monophony";
     rev = "v${version}";
-    hash = "sha256-84H6JOqKcFSApNnm/C4ftuxqkQrO064OORQSQXIiHps=";
+    hash = "sha256-D/3yJ1KIXF1rv8iH4+HvfD6N94LzkZGRippZj8nk1nQ=";
   };
 
   sourceRoot = "${src.name}/source";
diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix
index 93127ccb8def..48ec6c69596c 100644
--- a/pkgs/by-name/no/notation/package.nix
+++ b/pkgs/by-name/no/notation/package.nix
@@ -49,7 +49,7 @@ buildGoModule (finalAttrs: {
     description = "CLI tool to sign and verify OCI artifacts and container images";
     homepage = "https://notaryproject.dev/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ aaronjheng ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "notation";
   };
 })
diff --git a/pkgs/by-name/pa/parca-agent/package.nix b/pkgs/by-name/pa/parca-agent/package.nix
index 8e2850edfd69..22a391a6ad54 100644
--- a/pkgs/by-name/pa/parca-agent/package.nix
+++ b/pkgs/by-name/pa/parca-agent/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "parca-agent";
-  version = "0.41.0";
+  version = "0.41.1";
 
   src = fetchFromGitHub {
     owner = "parca-dev";
     repo = "parca-agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lWAdi6bgXZ5w68fZpAEUmWvbKmAdz9n92q80gzj21s8=";
+    hash = "sha256-qs4n3gUqbscf5la+OOxgcdc/f3YJ6yn4D4hMTa2IJgE=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-//a6hjQ+pqhNsuj76gqsJ7QKkbyktfY780i5Rmax7Ls=";
+  vendorHash = "sha256-yt2nKrBhcYWxsoEfvKzjml2jsFMAQwlUrYlrsCPkmM4=";
 
   buildInputs = [
     stdenv.cc.libc.static
diff --git a/pkgs/by-name/pa/paretosecurity/package.nix b/pkgs/by-name/pa/paretosecurity/package.nix
index 81f28a4dbade..c33b14a3532f 100644
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@@ -17,16 +17,16 @@ buildGoModule (finalAttrs: {
     webkitgtk_4_1
   ];
   pname = "paretosecurity";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = finalAttrs.version;
-    hash = "sha256-IZrpGwm+j1jcKtcM23lcycOlLUuGerF41fWanWBgr40=";
+    hash = "sha256-jRaCcONfFch4cQ4clS/TaN0KxSnohSzBinIVr0ePymA=";
   };
 
-  vendorHash = "sha256-DlCGCheJHa4HPM7kfX/UbOfLukAiaoP7QZnabkZVASM=";
+  vendorHash = "sha256-y9x5RplVOr4mIOPTg86VvFWXkvZ1FTc9Ulc/yXb9/WU=";
   proxyVendor = true;
 
   # Skip building the Windows installer
diff --git a/pkgs/by-name/re/rebels-in-the-sky/package.nix b/pkgs/by-name/re/rebels-in-the-sky/package.nix
index de27aea2fe6d..00a025c65c10 100644
--- a/pkgs/by-name/re/rebels-in-the-sky/package.nix
+++ b/pkgs/by-name/re/rebels-in-the-sky/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rebels-in-the-sky";
-  version = "1.0.30";
+  version = "1.0.31";
 
   src = fetchFromGitHub {
     owner = "ricott1";
     repo = "rebels-in-the-sky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eC8n9g2kFErTRWWNo6jwAMGBX3+xGjtzq23+r3w0n0I=";
+    hash = "sha256-0/Vsb6GMl0XH7uxyFSUO18kKoz49MXbOEQChhZZJL24=";
   };
 
-  cargoHash = "sha256-dGD0RpelENEWe9W/3CXUS2GhOXRaWhCoD8AI2n4mUfs=";
+  cargoHash = "sha256-DI6BAfbIEGCq3GaBoQz/nn9AZYWUDWBD2osgm1K44+w=";
 
   patches = lib.optionals (!withRadio) [
     ./disable-radio.patch
diff --git a/pkgs/by-name/ru/runc/package.nix b/pkgs/by-name/ru/runc/package.nix
index 70de30901194..684c7963509b 100644
--- a/pkgs/by-name/ru/runc/package.nix
+++ b/pkgs/by-name/ru/runc/package.nix
@@ -9,19 +9,19 @@
   libapparmor,
   libseccomp,
   libselinux,
-  runtimeShell,
-  makeWrapper,
+  stdenv,
+  makeBinaryWrapper,
   nixosTests,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "runc";
   version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-B7x1J2ijM+/RWzPTldBNhvrGa/8de6Unl47lOS/KxXs=";
   };
 
@@ -34,7 +34,7 @@ buildGoModule rec {
   nativeBuildInputs = [
     go-md2man
     installShellFiles
-    makeWrapper
+    makeBinaryWrapper
     pkg-config
     which
   ];
@@ -47,13 +47,13 @@ buildGoModule rec {
 
   makeFlags = [
     "BUILDTAGS+=seccomp"
-    "SHELL=${runtimeShell}"
+    "SHELL=${stdenv.shell}"
   ];
 
   buildPhase = ''
     runHook preBuild
     patchShebangs .
-    make ${toString makeFlags} runc man
+    make ${toString finalAttrs.makeFlags} runc man
     runHook postBuild
   '';
 
@@ -77,4 +77,4 @@ buildGoModule rec {
     platforms = platforms.linux;
     mainProgram = "runc";
   };
-}
+})
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 0df70c12eafb..792f226f3ef5 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -52,13 +52,13 @@ let
     '';
   });
 
-  version = "7.68.0";
+  version = "7.70.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-jsNSRNgIS0ZroM2vwPSFpCVfC81slQ4mUoRq5jDYi8Y=";
+    hash = "sha256-y9i9YQPsLt3SLqROyEZsyIkVy/os3hy+1UMUSFMZJTY=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -134,15 +134,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetcherVersion = 1;
     hash =
       if withAppleEmojis then
-        "sha256-iu/ZjIn5c4X0rxWUFqiNLLAjCGKFYihsYxfgWtfmqk4="
+        "sha256-uVVUHvYhBCplKPyuS2+PKCxox8uWU2E/2EXLCG1ot54="
       else
-        "sha256-gMtBdlcuiAZRV5eeh2NoyOusFheCmn0/NIQwVPrUH/U=";
+        "sha256-tbfk/tIgqpjDtDiULbTVUOJf5i9eLX9xY7vUPrrjmu0=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1756327041;
+    SOURCE_DATE_EPOCH = 1757542492;
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/si/signal-desktop/ringrtc.nix b/pkgs/by-name/si/signal-desktop/ringrtc.nix
index f7a6bcb33347..0f5f892ecc77 100644
--- a/pkgs/by-name/si/signal-desktop/ringrtc.nix
+++ b/pkgs/by-name/si/signal-desktop/ringrtc.nix
@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ringrtc";
-  version = "2.56.0";
+  version = "2.57.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "ringrtc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KEwN6x24hXmK9lqU2M9/5qbBk7zDxeTRbB0vJ1K9d3U=";
+    hash = "sha256-m73SXjTES1sHGbQRtn9CjurFd/Xby5Yyn6uLVLigfiU=";
   };
 
-  cargoHash = "sha256-ghuF1wxAf5psZoWNYOCAubGo0KDwJlqcBXgUbPMD9ac=";
+  cargoHash = "sha256-LRCgK/w+GcYBCWUKjytErQCxDtS15EnsVOr5Uq6F8ww=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
index 99a8b79b90a1..f8c91cb06377 100644
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "node-sqlcipher";
-  version = "2.2.2";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "node-sqlcipher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vrY2cu8yfwMX7O6h2GgLhdvQvYOgl916E2z1Pf77ZI0=";
+    hash = "sha256-70kObW6jYzaquMrj20VMTQg/rDWqIu8o2/m7S3mUZB8=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     name = "sqlcipher-signal-exentsion";
     inherit (finalAttrs) src cargoRoot;
-    hash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
+    hash = "sha256-NtJPwRvjU1WsOxgb2vpokes9eL4DkEcbDaEmML7zsqQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/si/signal-desktop/webrtc-sources.json b/pkgs/by-name/si/signal-desktop/webrtc-sources.json
index 05a4da47fa00..d9b28f488ad7 100644
--- a/pkgs/by-name/si/signal-desktop/webrtc-sources.json
+++ b/pkgs/by-name/si/signal-desktop/webrtc-sources.json
@@ -1,10 +1,10 @@
 {
     "src": {
         "args": {
-            "hash": "sha256-3hgBFFu2m+s9qzqNgbJSAmHH4ouHaQCL9nz2sFMy7hc=",
+            "hash": "sha256-Qj0UFRWfZrBG9WUX4zkyiatIekNSYXsneP5aLvufNh4=",
             "owner": "signalapp",
             "repo": "webrtc",
-            "tag": "7204a"
+            "tag": "7204c"
         },
         "fetcher": "fetchFromGitHub"
     },
diff --git a/pkgs/by-name/sv/svlint/package.nix b/pkgs/by-name/sv/svlint/package.nix
index b58ef72be582..10f0c8c68cde 100644
--- a/pkgs/by-name/sv/svlint/package.nix
+++ b/pkgs/by-name/sv/svlint/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svlint";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-u61gmkO7eij7r1A1RPk0ro+pml7ZmMsg0ukJLCFNaD0=";
+    hash = "sha256-YtBI2AnwSyeirHAXRavRKayfAmgXyyCMNhfEbUMXPgk=";
   };
 
-  cargoHash = "sha256-0vL9fdZqxGleEPTXq+/R+1GzqD91ZTgwt2C8sx0kUbM=";
+  cargoHash = "sha256-78v28MEW06AIMZa2lNmql3/3t6bI+HCW48vKzRTDjFQ=";
 
   cargoBuildFlags = [
     "--bin"
diff --git a/pkgs/by-name/ts/ts_query_ls/package.nix b/pkgs/by-name/ts/ts_query_ls/package.nix
index 144edc46cf62..557ef8368678 100644
--- a/pkgs/by-name/ts/ts_query_ls/package.nix
+++ b/pkgs/by-name/ts/ts_query_ls/package.nix
@@ -6,7 +6,7 @@
 }:
 let
   pname = "ts_query_ls";
-  version = "3.11.0";
+  version = "3.11.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -15,12 +15,12 @@ rustPlatform.buildRustPackage {
     owner = "ribru17";
     repo = "ts_query_ls";
     rev = "v${version}";
-    hash = "sha256-zRUZ+ohZa5pUNJiqNLY1VKEmeRsJyNRyjhzpECsYfZg=";
+    hash = "sha256-SQyy/7M9karkLI2smx6KnJWWuP3qWA4gKh1F/gIGRjQ=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cargoHash = "sha256-gjgoj5EKDPcyPkOnuG8ThhjxF3GiQ8FzhOrqXneqA+E=";
+  cargoHash = "sha256-9I/SiZTG/QAy1iBjWvleTqkile2K0h9TtW90+lILWQ0=";
 
   meta = {
     description = "LSP implementation for Tree-sitter's query files";
diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index 046c23c10acc..6b63b76552e8 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -22,14 +22,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "virglrenderer";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "virgl";
     repo = "virglrenderer";
     tag = finalAttrs.version;
-    hash = "sha256-ah6+AAf7B15rPMb4uO873wieT3+gf/5iGH+ZFoZKAAI=";
+    hash = "sha256-5Ok5ctJ3kcBH05URctvZ0hCZA/o59r2KsAOJYoiWMHs=";
   };
 
   separateDebugInfo = true;
@@ -67,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
       lib.optionalString nativeContextSupport (
         lib.concatStringsSep "," [
           "amdgpu-experimental"
+          "asahi"
           "msm"
         ]
       )
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index 310ee2d4619d..29abaea91b2f 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -338,6 +338,9 @@ package-maintainers:
     - tz
     - weeder
     - witch
+  mikatammi:
+    - botan-bindings
+    - botan-low
   mpscholten:
     - ihp-hsx
     - push-notify-apn
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 45910e661c6d..7dee0b5eb04b 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -114311,6 +114311,7 @@ self: {
       libraryPkgconfigDepends = [ botan ];
       description = "Raw Botan bindings";
       license = lib.licenses.bsd3;
+      maintainers = [ lib.maintainers.mikatammi ];
     }
   ) { botan = null; };
 
@@ -114355,6 +114356,7 @@ self: {
       description = "Low-level Botan bindings";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      maintainers = [ lib.maintainers.mikatammi ];
     }
   ) { };
 
diff --git a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch b/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
new file mode 100644
index 000000000000..0f76f7313fde
--- /dev/null
+++ b/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
@@ -0,0 +1,47 @@
+From 5592bfb58eb8d1c8a644e67c9bba795d1384a995 Mon Sep 17 00:00:00 2001
+From: Marc Lehmann <schmorp@schmorp.de>
+Date: Sat, 6 Sep 2025 11:31:36 +0200
+Subject: [PATCH 1/2] fix json_atof_scan1 overflows
+
+with fuzzed overlong numbers. CVE-2025-40928
+Really the comparisons were wrong.
+---
+ XS.xs | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/XS.xs b/XS.xs
+index 9b1ce2b..94ab0d6 100755
+--- a/XS.xs
++++ b/XS.xs
+@@ -710,16 +710,16 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
+   /* if we recurse too deep, skip all remaining digits */
+   /* to avoid a stack overflow attack */
+   if (UNLIKELY(--maxdepth <= 0))
+-    while (((U8)*s - '0') < 10)
++    while ((U8)(*s - '0') < 10)
+       ++s;
+ 
+   for (;;)
+     {
+-      U8 dig = (U8)*s - '0';
++      U8 dig = (U8)(*s - '0');
+ 
+       if (UNLIKELY(dig >= 10))
+         {
+-          if (dig == (U8)((U8)'.' - (U8)'0'))
++          if (dig == (U8)('.' - '0'))
+             {
+               ++s;
+               json_atof_scan1 (s, accum, expo, 1, maxdepth);
+@@ -739,7 +739,7 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
+               else if (*s == '+')
+                 ++s;
+ 
+-              while ((dig = (U8)*s - '0') < 10)
++              while ((dig = (U8)(*s - '0')) < 10)
+                 exp2 = exp2 * 10 + *s++ - '0';
+ 
+               *expo += neg ? -exp2 : exp2;
+-- 
+2.50.1
+
diff --git a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
new file mode 100644
index 000000000000..f1d258c12a3d
--- /dev/null
+++ b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
@@ -0,0 +1,31 @@
+--- a/XS.xs	2025-09-06 08:34:51.376455632 -0300
++++ b/XS.xs	2025-09-06 08:35:30.725873619 -0300
+@@ -253,16 +253,16 @@
+   // if we recurse too deep, skip all remaining digits
+   // to avoid a stack overflow attack
+   if (expect_false (--maxdepth <= 0))
+-    while (((U8)*s - '0') < 10)
++    while ((U8)(*s - '0') < 10)
+       ++s;
+ 
+   for (;;)
+     {
+-      U8 dig = (U8)*s - '0';
++      U8 dig = *s - '0';
+ 
+       if (expect_false (dig >= 10))
+         {
+-          if (dig == (U8)((U8)'.' - (U8)'0'))
++          if (dig == (U8)('.' - '0'))
+             {
+               ++s;
+               json_atof_scan1 (s, accum, expo, 1, maxdepth);
+@@ -282,7 +282,7 @@
+               else if (*s == '+')
+                 ++s;
+ 
+-              while ((dig = (U8)*s - '0') < 10)
++              while ((dig = (U8)(*s - '0')) < 10)
+                 exp2 = exp2 * 10 + *s++ - '0';
+ 
+               *expo += neg ? -exp2 : exp2;
diff --git a/pkgs/development/php-packages/zstd/default.nix b/pkgs/development/php-packages/zstd/default.nix
index 20ae6a2b83d4..6668969eebe5 100644
--- a/pkgs/development/php-packages/zstd/default.nix
+++ b/pkgs/development/php-packages/zstd/default.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "0.15.1";
+  version = "0.15.2";
 in
 buildPecl {
   inherit version;
@@ -17,7 +17,7 @@ buildPecl {
     owner = "kjdev";
     repo = "php-ext-zstd";
     rev = version;
-    hash = "sha256-Gf9/A4SmeiPGtUcTXoIU1sOzVRqIIpLAbD1QdTmBaHQ=";
+    hash = "sha256-NGbrbvW2kNhgj3nqqjGLqowcp9EKqYffR1DOBIzdXeA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/mitmproxy-linux/default.nix b/pkgs/development/python-modules/mitmproxy-linux/default.nix
index 1af784ed3611..0dd4551a55e4 100644
--- a/pkgs/development/python-modules/mitmproxy-linux/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-linux/default.nix
@@ -44,8 +44,6 @@ buildPythonPackage {
 
   meta = {
     inherit (mitmproxy-rs.meta) changelog license maintainers;
-  }
-  // {
     description = "Linux Rust bits in mitmproxy";
     homepage = "https://github.com/mitmproxy/mitmproxy_rs/tree/main/mitmproxy-linux";
     platforms = lib.platforms.linux;
diff --git a/pkgs/development/python-modules/mitmproxy-macos/default.nix b/pkgs/development/python-modules/mitmproxy-macos/default.nix
index 606ae484f274..3193cc4b405d 100644
--- a/pkgs/development/python-modules/mitmproxy-macos/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-macos/default.nix
@@ -24,13 +24,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "mitmproxy_macos" ];
 
-  meta = with lib; {
+  meta = {
+    inherit (mitmproxy-rs.meta) changelog license maintainers;
     description = "MacOS Rust bits in mitmproxy";
     homepage = "https://github.com/mitmproxy/mitmproxy_rs/tree/main/mitmproxy-macos";
-    changelog = "https://github.com/mitmproxy/mitmproxy_rs/blob/${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ boltzmannrain ];
-    platforms = platforms.darwin;
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
   };
 }
diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index 43c241e1abbc..303176669a29 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "26.5.0";
+  version = "26.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = "python-gvm";
     tag = "v${version}";
-    hash = "sha256-9OSL7Li95p79P1+8yViI/pV/nLwuk580/6Be99+DTWU=";
+    hash = "sha256-n/FYPCJ0Fw2WBLA6dAYUzgwDlol1DRgbCywsvMARTWE=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 34356f77fab4..ac58212aed82 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -175,32 +175,37 @@ stdenv.mkDerivation {
   ++ configureFlags
   ++ map (mod: "--add-module=${mod.src}") modules;
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    [
-      "-I${libxml2.dev}/include/libxml2"
-      "-Wno-error=implicit-fallthrough"
-      (
-        # zlig-ng patch needs this
-        if stdenv.cc.isGNU then
-          "-Wno-error=discarded-qualifiers"
-        else
-          "-Wno-error=incompatible-pointer-types-discards-qualifiers"
-      )
-    ]
-    ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
-      # fix build vts module on gcc11
-      "-Wno-error=stringop-overread"
-    ]
-    ++ lib.optionals stdenv.cc.isClang [
-      "-Wno-error=deprecated-declarations"
-      "-Wno-error=gnu-folding-constant"
-      "-Wno-error=unused-but-set-variable"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isMusl [
-      # fix sys/cdefs.h is deprecated
-      "-Wno-error=cpp"
-    ]
-  );
+  env = {
+    NIX_CFLAGS_COMPILE = toString (
+      [
+        "-I${libxml2.dev}/include/libxml2"
+        "-Wno-error=implicit-fallthrough"
+        (
+          # zlig-ng patch needs this
+          if stdenv.cc.isGNU then
+            "-Wno-error=discarded-qualifiers"
+          else
+            "-Wno-error=incompatible-pointer-types-discards-qualifiers"
+        )
+      ]
+      ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
+        # fix build vts module on gcc11
+        "-Wno-error=stringop-overread"
+      ]
+      ++ lib.optionals stdenv.cc.isClang [
+        "-Wno-error=deprecated-declarations"
+        "-Wno-error=gnu-folding-constant"
+        "-Wno-error=unused-but-set-variable"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isMusl [
+        # fix sys/cdefs.h is deprecated
+        "-Wno-error=cpp"
+      ]
+    );
+  }
+  // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
+    CONFIG_BIG_ENDIAN = if stdenv.hostPlatform.isBigEndian then "y" else "n";
+  };
 
   configurePlatforms = [ ];
 
@@ -218,6 +223,9 @@ stdenv.mkDerivation {
         ./nix-etag-1.15.4.patch
         ./nix-skip-check-logs-path.patch
       ]
+      # Upstream may be against cross-compilation patches.
+      # https://trac.nginx.org/nginx/ticket/2240 https://trac.nginx.org/nginx/ticket/1928#comment:6
+      # That dev quit the project in 2024 so the stance could be different now.
       ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
         (fetchpatch {
           url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/102-sizeof_test_fix.patch";
@@ -231,6 +239,10 @@ stdenv.mkDerivation {
           url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/103-sys_nerr.patch";
           sha256 = "0s497x6mkz947aw29wdy073k8dyjq8j99lax1a1mzpikzr4rxlmd";
         })
+        (fetchpatch {
+          url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/104-endianness_fix.patch";
+          sha256 = "sha256-M7V3ZJfKImur2OoqXcoL+CbgFj/huWnfZ4xMCmvkqfc=";
+        })
       ]
       ++ mapModules "patches"
     )
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index f911579097e8..53c21ffc27a6 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.76.0";
+  version = "1.77.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-LT0YnyvXz1zQBP8NICws6vhW7qqVSFRzlxfdpB8wOr8=";
+    sha256 = "sha256-EqB76iUUIajId4peGW4WEM6esJGPJZlw3QlvLYXeoEQ=";
   };
 
-  vendorHash = "sha256-y1j7s8R8pd3sp9yOlG2aopQ+GNO2Z7OCO1a9i9L6KM4=";
+  vendorHash = "sha256-7/7O61tOEUsRVkFVkmOiHqgxmFDmwaw8s97aOQr89Mg=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index c64bb58d7e2b..f71d254ae7b6 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -118,6 +118,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     cat ${./pg_config.env.mk} >> src/common/Makefile
+  ''
+  # Explicitly disable building the shared libs, because that would fail with pkgsStatic.
+  + lib.optionalString stdenv.hostPlatform.isStatic ''
+    substituteInPlace src/interfaces/libpq/Makefile \
+      --replace-fail "all: all-lib libpq-refs-stamp" "all: all-lib"
+    substituteInPlace src/Makefile.shlib \
+      --replace-fail "all-lib: all-shared-lib" "all-lib: all-static-lib" \
+      --replace-fail "install-lib: install-lib-shared" "install-lib: install-lib-static"
   '';
 
   installPhase = ''
@@ -141,14 +149,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # PostgreSQL always builds both shared and static libs, so we delete those we don't want.
-  postInstall =
-    if stdenv.hostPlatform.isStatic then
-      ''
-        rm -rfv $out/lib/*.so*
-        touch $out/empty
-      ''
-    else
-      "rm -rfv $dev/lib/*.a";
+  postInstall = if stdenv.hostPlatform.isStatic then "touch $out/empty" else "rm -rfv $dev/lib/*.a";
 
   doCheck = false;
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index fa425d494de3..83ef5516af42 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6638,6 +6638,7 @@ with self;
       url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.37.tar.gz";
       hash = "sha256-wkFhWg4X/3Raqoa79Gam4pzSQFFeZfBqegUBe2GebUs=";
     };
+    patches = [ ../development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch ];
     meta = {
       description = "CPanel fork of JSON::XS, fast and correct serializing";
       license = with lib.licenses; [
@@ -18301,6 +18302,7 @@ with self;
       url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.03.tar.gz";
       hash = "sha256-UVU29F8voafojIgkUzdY0BIdJnq5y0U6G1iHyKVrkGg=";
     };
+    patches = [ ../development/perl-modules/JSON-XS-CVE-2025-40928.patch ];
     propagatedBuildInputs = [ TypesSerialiser ];
     buildInputs = [ CanaryStability ];
     meta = {