diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 65546fe9bea0..b4c0b87610c4 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -31,6 +31,8 @@
 
 - `conftest` since `0.60.0` has moved to use rego `v1` as default. To continue using `v0` use `--rego-version v0`. For more information about upgrading to Rego v1 syntax, see the [upstream docs](https://www.openpolicyagent.org/docs/latest/v0-upgrade/).
 
+- The `archipelago-minecraft` package was removed, as upstream no longer provides support for the Minecraft APWorld.
+
 - `tooling-language-server` has been renamed to `deputy` (both the package and binary), following the rename of the upstream project.
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 50888cbe5111..2ca9edb79453 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7048,6 +7048,13 @@
     githubId = 757125;
     name = "Dzmitry Lahoda";
   };
+  e-v-o-l-v-e = {
+    name = "Ivanoe Megnin-Preiss";
+    email = "megninpreiss.ivanoe@gmail.com";
+    github = "e-v-o-l-v-e";
+    githubId = 84813895;
+    matrix = "@evolve:matrix.imp-network.com";
+  };
   e1mo = {
     email = "nixpkgs@e1mo.de";
     matrix = "@e1mo:chaos.jetzt";
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index e08b4d31c36c..04fd56cf4a55 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -888,9 +888,7 @@
     "index.html#module-services-meilisearch-quickstart-search"
   ],
   "module-services-meilisearch-defaults": [
-    "index.html#module-services-meilisearch-defaults"
-  ],
-  "module-services-meilisearch-missing": [
+    "index.html#module-services-meilisearch-defaults",
     "index.html#module-services-meilisearch-missing"
   ],
   "module-services-networking-yggdrasil": [
diff --git a/nixos/modules/services/search/meilisearch.md b/nixos/modules/services/search/meilisearch.md
index b9f65861b1d1..db53777e063d 100644
--- a/nixos/modules/services/search/meilisearch.md
+++ b/nixos/modules/services/search/meilisearch.md
@@ -32,10 +32,12 @@ you first need to add documents to an index before you can search for documents.
 
 - The default nixos package doesn't come with the [dashboard](https://docs.meilisearch.com/learn/getting_started/quick_start.html#search), since the dashboard features makes some assets downloads at compile time.
 
-- Anonymized Analytics sent to meilisearch are disabled by default.
+- `no_analytics` is set to true by default.
 
-- Default deployment is development mode. It doesn't require a secret master key. All routes are not protected and accessible.
+- `http_addr` is derived from {option}`services.meilisearch.listenAddress` and {option}`services.meilisearch.listenPort`. The two sub-fields are separate because this makes it easier to consume in certain other modules.
 
-## Missing {#module-services-meilisearch-missing}
+- `db_path` is set to `/var/lib/meilisearch` by default. Upstream, the default value is equivalent to `/var/lib/meilisearch/data.ms`.
 
-- the snapshot feature is not yet configurable from the module, it's just a matter of adding the relevant environment variables.
+- `dump_dir` and `snapshot_dir` are set to `/var/lib/meilisearch/dumps` and `/var/lib/meilisearch/snapshots`, respectively. This is equivalent to the upstream defaults.
+
+- All other options inherit their upstream defaults. In particular, the default configuration uses `env = "development"`, which doesn't require a master key, in which case all routes are unprotected.
diff --git a/nixos/modules/services/search/meilisearch.nix b/nixos/modules/services/search/meilisearch.nix
index 0194a658c0d3..e8c6c3e7cdc6 100644
--- a/nixos/modules/services/search/meilisearch.nix
+++ b/nixos/modules/services/search/meilisearch.nix
@@ -7,19 +7,91 @@
 let
   cfg = config.services.meilisearch;
 
+  settingsFormat = pkgs.formats.toml { };
+
+  # These secrets are used in the config file and can be set to paths.
+  secrets-with-path =
+    builtins.map
+      (
+        { environment, name }:
+        {
+          inherit name environment;
+          setting = cfg.settings.${name};
+        }
+      )
+      [
+        {
+          environment = "MEILI_SSL_CERT_PATH";
+          name = "ssl_cert_path";
+        }
+        {
+          environment = "MEILI_SSL_KEY_PATH";
+          name = "ssl_key_path";
+        }
+        {
+          environment = "MEILI_SSL_AUTH_PATH";
+          name = "ssl_auth_path";
+        }
+        {
+          environment = "MEILI_SSL_OCSP_PATH";
+          name = "ssl_ocsp_path";
+        }
+      ];
+
+  # We also handle `master_key` separately.
+  # It cannot be set to a path, so we template it.
+  master-key-placeholder = "@MASTER_KEY@";
+
+  configFile = settingsFormat.generate "config.toml" (
+    builtins.removeAttrs (
+      if cfg.masterKeyFile != null then
+        cfg.settings // { master_key = master-key-placeholder; }
+      else
+        builtins.removeAttrs cfg.settings [ "master_key" ]
+    ) (map (secret: secret.name) secrets-with-path)
+  );
+
 in
 {
-
   meta.maintainers = with lib.maintainers; [
     Br1ght0ne
     happysalada
   ];
   meta.doc = ./meilisearch.md;
 
-  ###### interface
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "environment" ]
+      [ "services" "meilisearch" "settings" "env" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "logLevel" ]
+      [ "services" "meilisearch" "settings" "log_level" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "noAnalytics" ]
+      [ "services" "meilisearch" "settings" "no_analytics" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "maxIndexSize" ]
+      [ "services" "meilisearch" "settings" "max_index_size" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "payloadSizeLimit" ]
+      [ "services" "meilisearch" "settings" "http_payload_size_limit" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "meilisearch" "dumplessUpgrade" ]
+      [ "services" "meilisearch" "settings" "experimental_dumpless_upgrade" ]
+    )
+    (lib.mkRemovedOptionModule [ "services" "meilisearch" "masterKeyEnvironmentFile" ] ''
+      Use `services.meilisearch.masterKeyFile` instead. It does not require you to prefix the file with "MEILI_MASTER_KEY=".
+      If you were abusing this option to set other options, you can now configure them with `services.meilisearch.settings`.
+    '')
+  ];
 
   options.services.meilisearch = {
-    enable = lib.mkEnableOption "MeiliSearch - a RESTful search API";
+    enable = lib.mkEnableOption "Meilisearch - a RESTful search API";
 
     package = lib.mkPackageOption pkgs "meilisearch" {
       extraDescription = ''
@@ -28,106 +100,87 @@ in
     };
 
     listenAddress = lib.mkOption {
-      description = "MeiliSearch listen address.";
-      default = "127.0.0.1";
+      default = "localhost";
       type = lib.types.str;
+      description = ''
+        The IP address that Meilisearch will listen on.
+
+        It can also be a hostname like "localhost". If it resolves to an IPv4 and IPv6 address, Meilisearch will listen on both.
+      '';
     };
 
     listenPort = lib.mkOption {
-      description = "MeiliSearch port to listen on.";
       default = 7700;
       type = lib.types.port;
+      description = ''
+        The port that Meilisearch will listen on.
+      '';
     };
 
-    environment = lib.mkOption {
-      description = "Defines the running environment of MeiliSearch.";
-      default = "development";
-      type = lib.types.enum [
-        "development"
-        "production"
-      ];
-    };
-
-    # TODO change this to LoadCredentials once possible
-    masterKeyEnvironmentFile = lib.mkOption {
+    masterKeyFile = lib.mkOption {
       description = ''
         Path to file which contains the master key.
         By doing so, all routes will be protected and will require a key to be accessed.
         If no master key is provided, all routes can be accessed without requiring any key.
-        The format is the following:
-        MEILI_MASTER_KEY=my_secret_key
       '';
       default = null;
-      type = with lib.types; nullOr path;
+      type = lib.types.nullOr lib.types.path;
     };
 
-    noAnalytics = lib.mkOption {
+    settings = lib.mkOption {
       description = ''
-        Deactivates analytics.
-        Analytics allow MeiliSearch to know how many users are using MeiliSearch,
-        which versions and which platforms are used.
-        This process is entirely anonymous.
+        Configuration settings for Meilisearch.
+        Look at the documentation for available options:
+        https://github.com/meilisearch/meilisearch/blob/main/config.toml
+        https://www.meilisearch.com/docs/learn/self_hosted/configure_meilisearch_at_launch#all-instance-options
       '';
-      default = true;
-      type = lib.types.bool;
+
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        imports = builtins.map (secret: {
+          # give them proper types, just so they're easier to consume from this file
+          options.${secret.name} = lib.mkOption {
+            # but they should not show up in documentation as special in any way.
+            visible = false;
+
+            type = lib.types.nullOr lib.types.path;
+            default = null;
+          };
+        }) secrets-with-path;
+      };
     };
-
-    logLevel = lib.mkOption {
-      description = ''
-        Defines how much detail should be present in MeiliSearch's logs.
-        MeiliSearch currently supports four log levels, listed in order of increasing verbosity:
-        - 'ERROR': only log unexpected events indicating MeiliSearch is not functioning as expected
-        - 'WARN:' log all unexpected events, regardless of their severity
-        - 'INFO:' log all events. This is the default value
-        - 'DEBUG': log all events and including detailed information on MeiliSearch's internal processes.
-          Useful when diagnosing issues and debugging
-      '';
-      default = "INFO";
-      type = lib.types.str;
-    };
-
-    maxIndexSize = lib.mkOption {
-      description = ''
-        Sets the maximum size of the index.
-        Value must be given in bytes or explicitly stating a base unit.
-        For example, the default value can be written as 107374182400, '107.7Gb', or '107374 Mb'.
-        Default is 100 GiB
-      '';
-      default = "107374182400";
-      type = lib.types.str;
-    };
-
-    payloadSizeLimit = lib.mkOption {
-      description = ''
-        Sets the maximum size of accepted JSON payloads.
-        Value must be given in bytes or explicitly stating a base unit.
-        For example, the default value can be written as 107374182400, '107.7Gb', or '107374 Mb'.
-        Default is ~ 100 MB
-      '';
-      default = "104857600";
-      type = lib.types.str;
-    };
-
-    # TODO: turn on by default when it stops being experimental
-    dumplessUpgrade = lib.mkOption {
-      default = false;
-      example = true;
-      description = ''
-        Whether to enable (experimental) dumpless upgrade.
-
-        Allows upgrading from Meilisearch >=v1.12 to Meilisearch >=v1.13 without manually
-        dumping and importing the database.
-
-        More information at https://www.meilisearch.com/docs/learn/update_and_migration/updating#dumpless-upgrade
-      '';
-      type = lib.types.bool;
-    };
-
   };
 
-  ###### implementation
-
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !cfg.settings ? master_key;
+        message = ''
+          Do not set `services.meilisearch.settings.master_key` in your configuration.
+          Use `services.meilisearch.masterKeyFile` instead.
+        '';
+      }
+    ];
+
+    services.meilisearch.settings = {
+      # we use `listenAddress` and `listenPort` to derive the `http_addr` setting.
+      # this is the only setting we treat like this.
+      # we do this because some dependent services like Misskey/Sharkey need separate host,port for no good reason.
+      http_addr = "${cfg.listenAddress}:${toString cfg.listenPort}";
+
+      # upstream's default for `db_path` is `/var/lib/meilisearch/data.ms/`, but ours is different for no reason.
+      db_path = lib.mkDefault "/var/lib/meilisearch";
+      # these are equivalent to the upstream defaults, because we set a working directory.
+      # they are only set here for consistency with `db_path`.
+      dump_dir = lib.mkDefault "/var/lib/meilisearch/dumps";
+      snapshot_dir = lib.mkDefault "/var/lib/meilisearch/snapshots";
+
+      # this is intentionally different from upstream's default.
+      no_analytics = lib.mkDefault true;
+    };
 
     warnings = lib.optional (lib.versionOlder cfg.package.version "1.12") ''
       Meilisearch 1.11 will be removed in NixOS 25.11. As it was the last
@@ -149,24 +202,41 @@ in
     environment.systemPackages = [ cfg.package ];
 
     systemd.services.meilisearch = {
-      description = "MeiliSearch daemon";
+      description = "Meilisearch daemon";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      environment = {
-        MEILI_DB_PATH = "/var/lib/meilisearch";
-        MEILI_HTTP_ADDR = "${cfg.listenAddress}:${toString cfg.listenPort}";
-        MEILI_NO_ANALYTICS = lib.boolToString cfg.noAnalytics;
-        MEILI_ENV = cfg.environment;
-        MEILI_DUMP_DIR = "/var/lib/meilisearch/dumps";
-        MEILI_LOG_LEVEL = cfg.logLevel;
-        MEILI_MAX_INDEX_SIZE = cfg.maxIndexSize;
-        MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE = lib.boolToString cfg.dumplessUpgrade;
-      };
+
+      preStart = lib.mkMerge [
+        ''
+          install -m 700 '${configFile}' "$RUNTIME_DIRECTORY/config.toml"
+        ''
+        (lib.mkIf (cfg.masterKeyFile != null) ''
+          ${lib.getExe pkgs.replace-secret} '${master-key-placeholder}' "$CREDENTIALS_DIRECTORY/master_key" "$RUNTIME_DIRECTORY/config.toml"
+        '')
+      ];
+
+      environment = builtins.listToAttrs (
+        builtins.map (secret: {
+          name = secret.environment;
+          value = lib.mkIf (secret.setting != null) "%d/${secret.name}";
+        }) secrets-with-path
+      );
+
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/meilisearch";
+        LoadCredential = lib.mkMerge (
+          [
+            (lib.mkIf (cfg.masterKeyFile != null) [ "master_key:${cfg.masterKeyFile}" ])
+          ]
+          ++ builtins.map (
+            secret: lib.mkIf (secret.setting != null) [ "${secret.name}:${secret.setting}" ]
+          ) secrets-with-path
+        );
+        ExecStart = "${lib.getExe cfg.package} --config-file-path \${RUNTIME_DIRECTORY}/config.toml";
         DynamicUser = true;
         StateDirectory = "meilisearch";
-        EnvironmentFile = lib.mkIf (cfg.masterKeyEnvironmentFile != null) cfg.masterKeyEnvironmentFile;
+        WorkingDirectory = "%S/meilisearch";
+        RuntimeDirectory = "meilisearch";
+        RuntimeDirectoryMode = "0700";
       };
     };
   };
diff --git a/nixos/modules/services/web-apps/sharkey.nix b/nixos/modules/services/web-apps/sharkey.nix
index 3c891ff5e892..3ff9a37784c3 100644
--- a/nixos/modules/services/web-apps/sharkey.nix
+++ b/nixos/modules/services/web-apps/sharkey.nix
@@ -54,7 +54,7 @@ in
         description = ''
           Whether to automatically set up a local Meilisearch instance and configure Sharkey to use it.
 
-          You need to ensure `services.meilisearch.masterKeyEnvironmentFile` is correctly configured for a working
+          You need to ensure `services.meilisearch.masterKeyFile` is correctly configured for a working
           Meilisearch setup. You also need to configure Sharkey to use an API key obtained from Meilisearch with the
           `MK_CONFIG_MEILISEARCH_APIKEY` environment variable, and set `services.sharkey.settings.meilisearch.index` to
           the created index. See https://docs.joinsharkey.org/docs/customisation/search/meilisearch/ for how to create
@@ -240,7 +240,7 @@ in
       (mkIf cfg.setupMeilisearch {
         services.meilisearch = {
           enable = mkDefault true;
-          environment = mkDefault "production";
+          settings.env = mkDefault "production";
         };
 
         services.sharkey.settings = {
diff --git a/nixos/tests/meilisearch.nix b/nixos/tests/meilisearch.nix
index ae88b8e07157..9a27fd05800c 100644
--- a/nixos/tests/meilisearch.nix
+++ b/nixos/tests/meilisearch.nix
@@ -35,27 +35,26 @@ in
     machine.wait_for_unit("meilisearch")
     machine.wait_for_open_port(7700)
 
+    def wait_task(cmd):
+        response = json.loads(machine.succeed(cmd))
+        task_uid = response["taskUid"]
+        machine.wait_until_succeeds(
+            f"curl ${apiUrl}/tasks/{task_uid} | jq -e '.status | IN(\"succeeded\", \"failed\", \"canceled\")'"
+        )
+        machine.succeed(f"curl ${apiUrl}/tasks/{task_uid} | jq -e '.status == \"succeeded\"'")
+        return response
+
     with subtest("check version"):
         version = json.loads(machine.succeed("curl ${apiUrl}/version"))
         assert version["pkgVersion"] == "${pkgs.meilisearch.version}"
 
     with subtest("create index"):
-        machine.succeed(
-            "curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes --data @${indexJSON}"
-        )
+        wait_task("curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes --data @${indexJSON}")
         indexes = json.loads(machine.succeed("curl ${apiUrl}/indexes"))
         assert indexes["total"] == 1, "index wasn't created"
 
     with subtest("add documents"):
-        response = json.loads(
-            machine.succeed(
-                "curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes/${uid}/documents --data-binary @${moviesJSON}"
-            )
-        )
-        task_uid = response["taskUid"]
-        machine.wait_until_succeeds(
-            f"curl ${apiUrl}/tasks/{task_uid} | jq -e '.status == \"succeeded\"'"
-        )
+        wait_task("curl -X POST -H 'Content-Type: application/json' ${apiUrl}/indexes/${uid}/documents --data-binary @${moviesJSON}")
 
     with subtest("search"):
         response = json.loads(
diff --git a/nixos/tests/web-apps/sharkey.nix b/nixos/tests/web-apps/sharkey.nix
index b10fec68744e..f3261e612100 100644
--- a/nixos/tests/web-apps/sharkey.nix
+++ b/nixos/tests/web-apps/sharkey.nix
@@ -19,9 +19,7 @@ in
         };
       };
 
-      services.meilisearch.masterKeyEnvironmentFile = pkgs.writeText "meilisearch-key" ''
-        MEILI_MASTER_KEY=${meilisearchKey}
-      '';
+      services.meilisearch.masterKeyFile = pkgs.writeText "meilisearch-key" meilisearchKey;
     };
 
   testScript =
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index e22c6cbf7f92..4c90de6ff853 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -89,8 +89,8 @@ let
         mktplcRef = {
           publisher = "42Crunch";
           name = "vscode-openapi";
-          version = "4.35.0";
-          hash = "sha256-wpWPT8BW2GPo2SCzM+l1HTpiXMTnbDOc9Oj9wDT/o/8=";
+          version = "4.37.2";
+          hash = "sha256-XUD5lXybUdUavbiqCqv561NAPAbZ0Q9oLsQkrSRUmsU=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/42Crunch.vscode-openapi/changelog";
@@ -1591,8 +1591,8 @@ let
           # semver scheme, contrary to preview versions which are listed on
           # the VSCode Marketplace and use a calver scheme. We should avoid
           # using preview versions, because they expire after two weeks.
-          version = "17.2.1";
-          hash = "sha256-1p4DDZEFFOIFHV6bkduXmrUGhjMDwrqf5/U2tO00iD0=";
+          version = "17.3.1";
+          hash = "sha256-qZBctE3R39WeU3Fc3pajrUSS6ncni7O+/oAOyZK2EnY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -2455,8 +2455,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.57";
-          hash = "sha256-UJn+RFBlQXmPqKkFIBiD4AblnX4s0O2IK747fG+UC/0=";
+          version = "1.1.58";
+          hash = "sha256-oBm2j7fZBYALkstk1WMgC+o1sq2HY7tX+zLfo5PBMiM=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
@@ -2980,6 +2980,8 @@ let
 
       llvm-org.lldb-vscode = llvmPackages.lldb;
 
+      llvm-vs-code-extensions.lldb-dap = callPackage ./llvm-vs-code-extensions.lldb-dap { };
+
       llvm-vs-code-extensions.vscode-clangd = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "llvm-vs-code-extensions";
diff --git a/pkgs/applications/editors/vscode/extensions/llvm-vs-code-extensions.lldb-dap/default.nix b/pkgs/applications/editors/vscode/extensions/llvm-vs-code-extensions.lldb-dap/default.nix
new file mode 100644
index 000000000000..00b1fbf8a7a6
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/llvm-vs-code-extensions.lldb-dap/default.nix
@@ -0,0 +1,18 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "lldb-dap";
+    publisher = "llvm-vs-code-extensions";
+    version = "0.2.15";
+    hash = "sha256-Xr/TUpte9JqdvQ8eoD0l8ztg0tR8qwX/Ju1eVU6Xc0s=";
+  };
+
+  meta = {
+    description = "Debugging with LLDB in Visual Studio Code";
+    downloadPage = "hhttps://marketplace.visualstudio.com/items?itemName=llvm-vs-code-extensions.lldb-dap";
+    homepage = "https://github.com/llvm/llvm-project";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.m0nsterrr ];
+  };
+}
diff --git a/pkgs/applications/misc/organicmaps/default.nix b/pkgs/applications/misc/organicmaps/default.nix
index 94fa1b837610..93b377672240 100644
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "organicmaps";
-  version = "2025.06.26-3";
+  version = "2025.07.13-9";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     tag = "${finalAttrs.version}-android";
-    hash = "sha256-IXpSY1ZGKAPqFT3B4C8Y+FHUuFQJPVptSKKhXZCYSfo=";
+    hash = "sha256-cEQmghS5qg5HTyWfDIB4G/Arh9BpM3iz1tToRWY8KrE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 2f72810dce81..514b4f2122c6 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -10,7 +10,7 @@ let
     if stdenv.hostPlatform.isLinux then
       {
         stable = "0.0.101";
-        ptb = "0.0.151";
+        ptb = "0.0.152";
         canary = "0.0.716";
         development = "0.0.83";
       }
@@ -30,7 +30,7 @@ let
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-7fQFCPUj59c/OfuNa4RDxGexAKZXLL7M+7n36WE5qDg=";
+        hash = "sha256-GbLEAu6gchwkkupU6k6i7bpdMVnCqB74HDYxyTt3J/w=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
diff --git a/pkgs/applications/science/machine-learning/sc2-headless/default.nix b/pkgs/applications/science/machine-learning/sc2-headless/default.nix
index 0700580b9598..cd067cec8e26 100644
--- a/pkgs/applications/science/machine-learning/sc2-headless/default.nix
+++ b/pkgs/applications/science/machine-learning/sc2-headless/default.nix
@@ -8,66 +8,67 @@
   licenseAccepted ? config.sc2-headless.accept_license or false,
 }:
 
-if !licenseAccepted then
-  throw ''
-    You must accept the Blizzard® Starcraft® II AI and Machine Learning License at
-    https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html
-    by setting nixpkgs config option 'sc2-headless.accept_license = true;'
-  ''
-else
-  assert licenseAccepted;
-  let
-    maps = callPackage ./maps.nix { };
-  in
-  stdenv.mkDerivation rec {
-    version = "4.7.1";
-    pname = "sc2-headless";
+let
+  maps = callPackage ./maps.nix { inherit licenseAccepted; };
+in
+stdenv.mkDerivation rec {
+  version = "4.7.1";
+  pname = "sc2-headless";
 
-    src = fetchurl {
-      url = "https://blzdistsc2-a.akamaihd.net/Linux/SC2.${version}.zip";
-      sha256 = "0q1ry9bd3dm8y4hvh57yfq7s05hl2k2sxi2wsl6h0r3w690v1kdd";
+  src = fetchurl {
+    url = "https://blzdistsc2-a.akamaihd.net/Linux/SC2.${version}.zip";
+    sha256 = "0q1ry9bd3dm8y4hvh57yfq7s05hl2k2sxi2wsl6h0r3w690v1kdd";
+  };
+
+  unpackCmd =
+    if !licenseAccepted then
+      throw ''
+        You must accept the Blizzard® Starcraft® II AI and Machine Learning License at
+        https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html
+        by setting nixpkgs config option 'sc2-headless.accept_license = true;'
+      ''
+    else
+      assert licenseAccepted;
+      ''
+        unzip -P 'iagreetotheeula' $curSrc
+      '';
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r . "$out"
+    rm -r $out/Libs
+
+    cp -ur "${maps.minigames}"/* "${maps.melee}"/* "${maps.ladder2017season1}"/* "${maps.ladder2017season2}"/* "${maps.ladder2017season3}"/* \
+      "${maps.ladder2017season4}"/* "${maps.ladder2018season1}"/* "${maps.ladder2018season2}"/* \
+      "${maps.ladder2018season3}"/*  "${maps.ladder2018season4}"/* "${maps.ladder2019season1}"/* "$out"/Maps/
+  '';
+
+  preFixup = ''
+    find $out -type f -print0 | while IFS=''' read -d ''' -r file; do
+      isELF "$file" || continue
+      patchelf \
+        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath ${
+          lib.makeLibraryPath [
+            stdenv.cc.cc
+            stdenv.cc.libc
+          ]
+        } \
+        "$file"
+    done
+  '';
+
+  meta = {
+    platforms = lib.platforms.linux;
+    description = "Starcraft II headless linux client for machine learning research";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = {
+      fullName = "BLIZZARD® STARCRAFT® II AI AND MACHINE LEARNING LICENSE";
+      url = "https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html";
+      free = false;
     };
-
-    unpackCmd = ''
-      unzip -P 'iagreetotheeula' $curSrc
-    '';
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      cp -r . "$out"
-      rm -r $out/Libs
-
-      cp -ur "${maps.minigames}"/* "${maps.melee}"/* "${maps.ladder2017season1}"/* "${maps.ladder2017season2}"/* "${maps.ladder2017season3}"/* \
-        "${maps.ladder2017season4}"/* "${maps.ladder2018season1}"/* "${maps.ladder2018season2}"/* \
-        "${maps.ladder2018season3}"/*  "${maps.ladder2018season4}"/* "${maps.ladder2019season1}"/* "$out"/Maps/
-    '';
-
-    preFixup = ''
-      find $out -type f -print0 | while IFS=''' read -d ''' -r file; do
-        isELF "$file" || continue
-        patchelf \
-          --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath ${
-            lib.makeLibraryPath [
-              stdenv.cc.cc
-              stdenv.cc.libc
-            ]
-          } \
-          "$file"
-      done
-    '';
-
-    meta = {
-      platforms = lib.platforms.linux;
-      description = "Starcraft II headless linux client for machine learning research";
-      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-      license = {
-        fullName = "BLIZZARD® STARCRAFT® II AI AND MACHINE LEARNING LICENSE";
-        url = "https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html";
-        free = false;
-      };
-      maintainers = [ ];
-    };
-  }
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/applications/science/machine-learning/sc2-headless/maps.nix b/pkgs/applications/science/machine-learning/sc2-headless/maps.nix
index 19019408a18d..2552397c5fdd 100644
--- a/pkgs/applications/science/machine-learning/sc2-headless/maps.nix
+++ b/pkgs/applications/science/machine-learning/sc2-headless/maps.nix
@@ -1,12 +1,21 @@
 {
   fetchzip,
+  licenseAccepted,
 }:
 let
   fetchzip' =
-    args:
-    (fetchzip args).overrideAttrs (old: {
-      UNZIP = "-j -P iagreetotheeula";
-    });
+    if !licenseAccepted then
+      throw ''
+        You must accept the Blizzard® Starcraft® II AI and Machine Learning License at
+        https://blzdistsc2-a.akamaihd.net/AI_AND_MACHINE_LEARNING_LICENSE.html
+        by setting nixpkgs config option 'sc2-headless.accept_license = true;'
+      ''
+    else
+      assert licenseAccepted;
+      args:
+      (fetchzip args).overrideAttrs (old: {
+        UNZIP = "-j -P iagreetotheeula";
+      });
 in
 {
   minigames = fetchzip {
diff --git a/pkgs/by-name/bo/boofuzz/package.nix b/pkgs/by-name/bo/boofuzz/package.nix
index 9063a65785ab..95a9bec60144 100644
--- a/pkgs/by-name/bo/boofuzz/package.nix
+++ b/pkgs/by-name/bo/boofuzz/package.nix
@@ -17,21 +17,17 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-ffZVFmfDAJ+Qn3hbeHY/CvYgpDLxB+jaYOiYyZqZ7mo=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
-    poetry-core
-  ];
+  build-system = with python3.pkgs; [ poetry-core ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     attrs
     click
     colorama
     flask
     funcy
-    future
     psutil
     pyserial
     pydot
-    six
     tornado
   ];
 
@@ -42,27 +38,21 @@ python3.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
-  disabledTests =
-    [
-      "TestNetworkMonitor"
-      "TestNoResponseFailure"
-      "TestProcessMonitor"
-      "TestSocketConnection"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "test_time_repeater"
-    ];
+  disabledTests = [
+    "TestNetworkMonitor"
+    "TestNoResponseFailure"
+    "TestProcessMonitor"
+    "TestSocketConnection"
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ "test_time_repeater" ];
 
-  pythonImportsCheck = [
-    "boofuzz"
-  ];
+  pythonImportsCheck = [ "boofuzz" ];
 
   meta = {
     description = "Network protocol fuzzing tool";
-    mainProgram = "boo";
     homepage = "https://github.com/jtpereyda/boofuzz";
-    changelog = "https://github.com/jtpereyda/boofuzz/blob/v${version}/CHANGELOG.rst";
-    license = with lib.licenses; [ gpl2Plus ];
+    changelog = "https://github.com/jtpereyda/boofuzz/blob/${src.tag}/CHANGELOG.rst";
+    license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "boo";
   };
 }
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index febac012ba76..2542da9f396f 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.55"
+        "@anthropic-ai/claude-code": "^1.0.56"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.55",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.55.tgz",
-      "integrity": "sha512-gCYXKwnU84zhmbNIZaduUY5HtGHBP/SMOxT4i8FmiEGSOeL/nY78mNOawXkRny1Je87WRjWVCBdhRnaxLP5c0w==",
+      "version": "1.0.56",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.56.tgz",
+      "integrity": "sha512-LYOlv9uXtLrJcJqSLvQlhy7shhC6MHEXuSGZ/+BazM4LY36ng3cmKjTCDny0kZQxa+u/+MYOXUrkmkJm2qR75Q==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 0aea7edd1530..2f168bc7783d 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.55";
+  version = "1.0.56";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-xx7Nksfa0IN18i6MoU60olnY/BioS+W+OQmyETQYDHI=";
+    hash = "sha256-q/17LfP5MWeKpt8akPXwMvkZ6Qhc+9IGpM6N34JuExY=";
   };
 
-  npmDepsHash = "sha256-v7a3DQD2Syhr3ITX7yHyEtQMCnrXwaf7IXXtl7JS07Q=";
+  npmDepsHash = "sha256-0hr5Tu2/0ETEgNb2s4BQGZXjsHrFzK+iD2ZtZNTlyoI=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/de/deno/librusty_v8.nix b/pkgs/by-name/de/deno/librusty_v8.nix
index 3820d6327bf7..d44e299628a3 100644
--- a/pkgs/by-name/de/deno/librusty_v8.nix
+++ b/pkgs/by-name/de/deno/librusty_v8.nix
@@ -2,11 +2,11 @@
 { fetchLibrustyV8 }:
 
 fetchLibrustyV8 {
-  version = "137.1.0";
+  version = "137.2.1";
   shas = {
-    x86_64-linux = "sha256-Tiscfy2bzYGR3s0T+SC1IB3xWvTVpVcSEdjq3MCRoRw=";
-    aarch64-linux = "sha256-2GYc+fgZLGUMQCXXSiyYUNKxZM4Mb788by+cWPdA9+4=";
-    x86_64-darwin = "sha256-yOJWfwIdl+uF7z7K6RzTcwnlgkDE8NM+e1tbWshx8+k=";
-    aarch64-darwin = "sha256-QQaC74Itb3D9EaN6PTxrjAGd/F9d6HY6PiLp+8jHK24=";
+    x86_64-linux = "sha256-1mV+UjvJsIyLFpBGVDrGxr/rqUgKzRRFwgnMyYTb/pM=";
+    aarch64-linux = "sha256-Rp7chA+GjsozCkMQrDnOoi4VhVJdrFZd1BuLfcRhGjw=";
+    x86_64-darwin = "sha256-tDMk+F6D/h4osYlzT2qAhqfHYUSDk3nL4RxEKjhBhD0=";
+    aarch64-darwin = "sha256-1eBUjKFalb/CIPfHYP8SvqIaxRep8vU6u9QFShOMUsQ=";
   };
 }
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index e0d836a9bb3a..5ece4a05954e 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -29,18 +29,18 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.4.0";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-YEiqp5KwkzRB/b6HhAtxXJNxHsPMTf3LnNxkP6GgYKw=";
+    hash = "sha256-7VHw+jjQ/N2b2AIBrGBcnLJ/k3MRkPnKRHD134A7mmw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-WQle7a2OjZ5kNg/eCQo0USPZssMaifiXGhlnKJDEtsQ=";
+  cargoHash = "sha256-ZEWSnath9v04wU1VyFDAx3LANnVhfE5s93jX4QW3XlI=";
 
   patches = [
     ./tests-replace-hardcoded-paths.patch
diff --git a/pkgs/by-name/de/devtoolbox/package.nix b/pkgs/by-name/de/devtoolbox/package.nix
index 85ea3b387653..3b19da0d9b3f 100644
--- a/pkgs/by-name/de/devtoolbox/package.nix
+++ b/pkgs/by-name/de/devtoolbox/package.nix
@@ -20,16 +20,17 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "devtoolbox";
-  version = "1.2.5";
+  version = "1.3.0";
   pyproject = false; # uses meson
 
   src = fetchFromGitHub {
     owner = "aleiepure";
     repo = "devtoolbox";
     tag = "v${version}";
-    hash = "sha256-CgpSZvpwBKo2gzp2QbBPFBK0tPhqKFC/DxXdmTWVAwc=";
+    hash = "sha256-ReF70pNMrMweEB4WAGQT++9TxTN4gV1olln7Y6YWCis=";
   };
 
+  # test after update
   postPatch = ''
     substituteInPlace src/views/reverse_cron.py \
       --replace-fail '"\D"' 'r"\D"'
@@ -80,6 +81,8 @@ python3Packages.buildPythonApplication rec {
     python-dateutil
     rcssmin
     rjsmin
+    cryptography
+    color-parser-py
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index e86a40a50599..a6127ebe6d3e 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.2.2",
-  "rev": "7c039464e452ddc3330e2691d3fa6d305521d09b",
-  "hash": "sha256-cHQcEA9Gpza/edEVyXUYiINC/Q2b3bf+zEQbl/Otfr4="
+  "version": "1.3.2",
+  "rev": "0b83e5d2f68bc02dfefde74b846bd039f078affa",
+  "hash": "sha256-6NMQ893g+nOiH8dnb63oa+fZMNXs8N6tJv+Er4x547U="
 }
diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index e0039207108e..2d30995ccce0 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -7,20 +7,20 @@
 
 buildGoModule rec {
   pname = "newt";
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = version;
-    hash = "sha256-8wE0ut+pej1rGve4jyT6/Km2yIcubeAlZL+4yEyuNww=";
+    hash = "sha256-6+Cc2ZyFEs9dVBWPQNBlUoFiFZuwlk/qBQULqGguhO8=";
   };
 
-  vendorHash = "sha256-rLyGju1UfKlzOSH2/NIKvZ8hpVE9+yJdcy4CK/NyoNc=";
+  vendorHash = "sha256-Y/f7GCO7Kf1iQiDR32DIEIGJdcN+PKS0OrhBvXiHvwo=";
 
   postPatch = ''
     substituteInPlace main.go \
-      --replace-fail "replaceme" "${version}"
+      --replace-fail "version_replaceme" "${version}"
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/gc/gcsfuse/package.nix b/pkgs/by-name/gc/gcsfuse/package.nix
index 4392079e3a87..281a030b0015 100644
--- a/pkgs/by-name/gc/gcsfuse/package.nix
+++ b/pkgs/by-name/gc/gcsfuse/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    hash = "sha256-9qm3GmNzjIUdOa3w0cp+UpgTI3VX44qNKHPjoaPL1wc=";
+    hash = "sha256-xTICtyx6YPBe3hfme29M9pX/fX/w+/0pZWUMCbA6ajs=";
   };
 
-  vendorHash = "sha256-7aJ9Nqz4kg1oFCh+VlYPTWFZxACH9uACdhzAwGbAjbc=";
+  vendorHash = "sha256-eTtKjGDJwRJzIb0qLp/HHLc8cYdd3HdWuivVUZOYEBU=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/ge/gerbolyze/package.nix b/pkgs/by-name/ge/gerbolyze/package.nix
index d8910592aed6..d0d72ba07198 100644
--- a/pkgs/by-name/ge/gerbolyze/package.nix
+++ b/pkgs/by-name/ge/gerbolyze/package.nix
@@ -23,18 +23,11 @@ let
 
     sourceRoot = "${src.name}/svg-flatten";
 
-    postPatch = ''
-      substituteInPlace Makefile \
-        --replace "$(INSTALL) $(BUILDDIR)/$(BINARY) $(PREFIX)/bin" \
-        "$(INSTALL) $(BUILDDIR)/$(BINARY) $(PREFIX)/bin/svg-flatten" \
+    preInstall = ''
+      mkdir -p $out/bin
     '';
 
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      PREFIX=$out make install
-      runHook postInstall
-    '';
+    installFlags = [ "PREFIX=$(out)" ];
 
     meta = with lib; {
       description = "svg-flatten SVG downconverter";
@@ -49,35 +42,34 @@ in
 python3Packages.buildPythonApplication rec {
   inherit version src;
   pname = "gerbolyze";
+  pyproject = true;
 
-  format = "setuptools";
+  build-system = with python3Packages; [ setuptools ];
 
-  nativeBuildInputs = [
-    python3Packages.setuptools
+  pythonRemoveDeps = [
+    # we already provide svg-flatten through a binary on the PATH
+    "svg-flatten-wasi"
   ];
 
-  propagatedBuildInputs = [
-    python3Packages.beautifulsoup4
-    python3Packages.click
-    python3Packages.numpy
-    python3Packages.scipy
-    python3Packages.python-slugify
-    python3Packages.lxml
-    python3Packages.gerbonara
-    resvg
-    svg-flatten
+  dependencies = with python3Packages; [
+    beautifulsoup4
+    click
+    numpy
+    python-slugify
+    lxml
+    gerbonara
   ];
 
   preConfigure = ''
     # setup.py tries to execute a call to git in a subprocess, this avoids it.
     substituteInPlace setup.py \
-      --replace "version = get_version()," \
-                "version = '${version}'," \
+      --replace-fail "version = get_version()," \
+                     "version = '${version}'," \
 
     # setup.py tries to execute a call to git in a subprocess, this avoids it.
     substituteInPlace setup.py \
-      --replace "long_description=format_readme_for_pypi()," \
-                "long_description='\n'.join(Path('README.rst').read_text().splitlines()),"
+      --replace-fail "long_description=format_readme_for_pypi()," \
+                     "long_description='\n'.join(Path('README.rst').read_text().splitlines()),"
   '';
 
   pythonImportsCheck = [ "gerbolyze" ];
@@ -88,6 +80,15 @@ python3Packages.buildPythonApplication rec {
     svg-flatten
   ];
 
+  makeWrapperArgs = [
+    "--prefix PATH: ${
+      lib.makeBinPath [
+        resvg
+        svg-flatten
+      ]
+    }"
+  ];
+
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
   };
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index 878af99bd335..eb4dba78cb41 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -17,17 +17,17 @@
 
 buildGoModule rec {
   pname = "grafana-alloy";
-  version = "1.9.2";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "alloy";
     tag = "v${version}";
-    hash = "sha256-ciM5DbP5OTvAPUNgBTuwb+hbVtKGgQzafLLOjDftPZQ=";
+    hash = "sha256-wy4dopRuZthYcc6kWsnE1N6MFbJ2UhechoCJpgg2pWE=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-zmNrnCaUrsYJ0S5MQrj07sV+ZCnXbGQmH8Z0pMpJZk4=";
+  vendorHash = "sha256-Mo++n6zat1OQ8ihA8FFP4i/ypdw22VG7BBFoVpvfgqI=";
 
   nativeBuildInputs = [
     fixup-yarn-lock
diff --git a/pkgs/by-name/ju/just-lsp/package.nix b/pkgs/by-name/ju/just-lsp/package.nix
index 640d14600782..790d0eaceeba 100644
--- a/pkgs/by-name/ju/just-lsp/package.nix
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-1XxC09Q9UGKRzMb51mUjmTJd7vEp0FFqtUD/9cQZvC0=";
+    hash = "sha256-0bt/kovzOgqAaIKArrh0G9ncuD1J7K3OINg9Dpa7fXs=";
   };
 
-  cargoHash = "sha256-mc1kYXfEF+oZO/GEBtCnKwt17LhvGDQK8RcOSsXKFjc=";
+  cargoHash = "sha256-DU8E3r9pjLYYxCEq+6dT2hrV2gDyGbtWD/N0aQFVyZI=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/lo/local-content-share/package.nix b/pkgs/by-name/lo/local-content-share/package.nix
new file mode 100644
index 000000000000..40ed96947db4
--- /dev/null
+++ b/pkgs/by-name/lo/local-content-share/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "local-content-share";
+  version = "31";
+
+  src = fetchFromGitHub {
+    owner = "Tanq16";
+    repo = "local-content-share";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BVO804Ndjbg4uEE1bufZcGZxEVdraV29LJ6yBWXTakA=";
+  };
+
+  vendorHash = null;
+
+  # no test file in upstream
+  doCheck = false;
+
+  meta = {
+    description = "Storing/sharing text/files in your local network with no setup on client devices";
+    homepage = "https://github.com/Tanq16/local-content-share";
+    license = lib.licenses.mit;
+    mainProgram = "local-content-share";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ e-v-o-l-v-e ];
+  };
+})
diff --git a/pkgs/by-name/lu/lunatask/package.nix b/pkgs/by-name/lu/lunatask/package.nix
index 440c8047ae79..9b10af3ab239 100644
--- a/pkgs/by-name/lu/lunatask/package.nix
+++ b/pkgs/by-name/lu/lunatask/package.nix
@@ -6,12 +6,12 @@
 }:
 
 let
-  version = "2.1.2";
+  version = "2.1.3";
   pname = "lunatask";
 
   src = fetchurl {
     url = "https://github.com/lunatask/lunatask/releases/download/v${version}/Lunatask-${version}.AppImage";
-    hash = "sha256-MjzqoLPtTspLowDO3MV0joGoYuxjybuExC1h03AayB0=";
+    hash = "sha256-kVNuCtUyY8UkalXlIpfenjB4JApDZVabawLOhFxToyY=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/ma/maigret/package.nix b/pkgs/by-name/ma/maigret/package.nix
index 581d85c0db86..e8eea02128e5 100644
--- a/pkgs/by-name/ma/maigret/package.nix
+++ b/pkgs/by-name/ma/maigret/package.nix
@@ -3,10 +3,10 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
-  python3,
+  python312,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python312.pkgs.buildPythonApplication rec {
   pname = "maigret";
   version = "0.4.4";
   pyproject = true;
@@ -27,9 +27,9 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
-  build-system = with python3.pkgs; [ setuptools ];
+  build-system = with python312.pkgs; [ setuptools ];
 
-  dependencies = with python3.pkgs; [
+  dependencies = with python312.pkgs; [
     aiodns
     aiohttp
     aiohttp-socks
@@ -70,7 +70,7 @@ python3.pkgs.buildPythonApplication rec {
     yarl
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python312.pkgs; [
     pytest-httpserver
     pytest-asyncio
     pytestCheckHook
@@ -103,11 +103,14 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonImportsCheck = [ "maigret" ];
 
-  meta = with lib; {
+  meta = {
     description = "Tool to collect details about an username";
     homepage = "https://maigret.readthedocs.io";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      fab
+      thtrf
+    ];
     broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/mi/minio-client/package.nix b/pkgs/by-name/mi/minio-client/package.nix
index fa5ae7a74d9d..14ae2563da76 100644
--- a/pkgs/by-name/mi/minio-client/package.nix
+++ b/pkgs/by-name/mi/minio-client/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2025-05-21T01-59-54Z";
+  version = "2025-07-16T15-35-03Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-ss/GqOJz9FNrQzYABb8ePCMcmNVTYVji/Id1WOuu24M=";
+    sha256 = "sha256-U5bKSew/qqbBs/VR0mSserH/0jdzZsztDJiJ02BHFIY=";
   };
 
   vendorHash = "sha256-MpLQZFrf2sBAweXtYeFi5j6p6GaXuN99x+r4UK8D9xM=";
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 4776696291c7..1e7e4470335c 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -12,10 +12,10 @@
 
 let
   opencode-node-modules-hash = {
-    "aarch64-darwin" = "sha256-W/kIKKRt2rBbnb+42NaZ1PsHZPGJbtjB8kV/aP1iZKc=";
-    "aarch64-linux" = "sha256-xDUT61afD8wk3z35NXtQGvZQpxQkN/CPWctVObYQECE=";
-    "x86_64-darwin" = "sha256-Kumy9PeeCO3TQGDdS0Zw9/HlIIQT5O4wrBPGGyl73Og=";
-    "x86_64-linux" = "sha256-VB7bikVFy8w82M6AkYXjsHx34CNHAGMgY69KISOokE4=";
+    "aarch64-darwin" = "sha256-TAeFDsHGFJnUyp20ec+Rxp4t1FrWKfbtnxsE8PnLS0o=";
+    "aarch64-linux" = "sha256-F056MWf2dNAO21ezEvWg689WUibtz4Q4mcSuDuSY5EM=";
+    "x86_64-darwin" = "sha256-AN1Ha/les1ByJGfVkLDibfxjPouC0tAZ//EN3vDi1Hc=";
+    "x86_64-linux" = "sha256-XIRV1QrgRHnpJyrgK9ITxH61dve7nWfVoCPs3Tc8nuU=";
   };
   bun-target = {
     "aarch64-darwin" = "bun-darwin-arm64";
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.3.22";
+  version = "0.3.43";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yT6uaTEKYb/+A1WhP6AQW0hWMnmS9vlfLn1E57cnzn0=";
+    hash = "sha256-EM44FkMPPkRChuLcNEEK3n4dLc5uqnX7dHROsZXyr58=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-G1vM8wxTTPpB1Oaxz2YI8AkirwG54A9i6Uq5e92ucyY=";
+    vendorHash = "sha256-/YxvM+HZM4aRqcjUiSX0D1DhhMJkmLdh7G4+fPqtnic=";
 
     subPackages = [ "cmd/opencode" ];
 
diff --git a/pkgs/by-name/op/openmm/package.nix b/pkgs/by-name/op/openmm/package.nix
index 4f8c4ba7077e..577df689a3aa 100644
--- a/pkgs/by-name/op/openmm/package.nix
+++ b/pkgs/by-name/op/openmm/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openmm";
-  version = "8.3.0";
+  version = "8.3.1";
 
   src = fetchFromGitHub {
     owner = "openmm";
     repo = "openmm";
     rev = finalAttrs.version;
-    hash = "sha256-wXk5s6OascFWjHs4WpxGU9TcX0gSiOZ3BRusIH1NjpI=";
+    hash = "sha256-3e0+8f2V+UCrPJA1wQUZKPvjpmWU9FfOAt9Ako0Lnl0=";
   };
 
   # "This test is stochastic and may occasionally fail". It does.
diff --git a/pkgs/by-name/pr/pre-commit/package.nix b/pkgs/by-name/pr/pre-commit/package.nix
index 0910b550be66..e520d860173a 100644
--- a/pkgs/by-name/pr/pre-commit/package.nix
+++ b/pkgs/by-name/pr/pre-commit/package.nix
@@ -3,8 +3,6 @@
   stdenv,
   python3Packages,
   fetchFromGitHub,
-  julia,
-  julia-bin,
 
   # tests
   cabal-install,
@@ -25,7 +23,6 @@
 
 let
   i686Linux = stdenv.buildPlatform.system == "i686-linux";
-  julia' = if lib.meta.availableOn stdenv.hostPlatform julia then julia else julia-bin;
 in
 python3Packages.buildPythonApplication rec {
   pname = "pre-commit";
@@ -64,7 +61,6 @@ python3Packages.buildPythonApplication rec {
       cargo
       gitMinimal
       go
-      julia'
       perl
       versionCheckHook
       writableTmpDirAsHomeHook
diff --git a/pkgs/by-name/pr/proksi/package.nix b/pkgs/by-name/pr/proksi/package.nix
index c5c31b8074a6..3f8fa3eb4bb1 100644
--- a/pkgs/by-name/pr/proksi/package.nix
+++ b/pkgs/by-name/pr/proksi/package.nix
@@ -13,13 +13,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "proksi";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "luizfonseca";
     repo = "proksi";
     tag = "proksi-v${finalAttrs.version}";
-    hash = "sha256-5IXtMtyKbx7re6CA61AnQ85k/SMdkjZo/ySnNoD2DDo=";
+    hash = "sha256-AVNQBrFxkFPgnVbh3Y0CQ3RajMmh/M6ee/QkumdLDs4=";
   };
 
   postPatch = ''
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yjbtP+FlDaJXPhCu1UyaDolpzy+BUejU8nVVSVsKCzE=";
+  cargoHash = "sha256-MYyPYZFmbQZszYViaGZdbUZWM739MN14J1ckyR8hXZc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix b/pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix
new file mode 100644
index 000000000000..ddfa39745843
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-opnsense-exporter/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "prometheus-opnsense-exporter";
+  version = "0.0.10";
+
+  src = fetchFromGitHub {
+    owner = "athennamind";
+    repo = "opnsense-exporter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-U/F301HkRfmzB8czwHP9u5UajR9CvxhSZwrJSIwcRd4=";
+  };
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/prometheus/common/version.BuildDate=1970-01-01T00:00:00Z"
+    "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
+    "-X github.com/prometheus/common/version.Branch=master"
+    "-X github.com/prometheus/common/version.Revision=${finalAttrs.src.rev}"
+    "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
+  ];
+  vendorHash = null;
+  passthru.updateScript = nix-update-script { };
+  doInstallCheck = true;
+  meta = {
+    changelog = "https://github.com/AthennaMind/opnsense-exporter/releases/tag/v${finalAttrs.version}";
+    homepage = "https://githbub.com/AthennaMind/opnsense-exporter";
+    description = "Prometheus exporter for opnsense firewall appliances";
+    license = lib.licenses.mit;
+    mainProgram = "opnsense-exporter";
+    maintainers = with lib.maintainers; [ paepcke ];
+  };
+})
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index 819680f7f89c..8381b175c6ba 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -12,19 +12,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.100.3";
+  version = "1.101.1";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-2X+vv1OMXKmoXH+WGzHF49HWTCMA9a77BTJqKfkMg0E=";
+        hash = "sha256-/G9cYTecssfmWWnl6fSnIuJgiHNu5ggvyE3xeFfNx2o=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-Ug9starsQ759+9WvGbIvxMf+Hvs+1lj3pViEvcfrc6k=";
+        hash = "sha256-xkUvCig24kGlw9/LQhY7aId7tuccdw8CFSJ9c2lvrsE=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/ra/raylib/package.nix b/pkgs/by-name/ra/raylib/package.nix
index b60d1a9d2f63..d0e9c9f0e4e2 100644
--- a/pkgs/by-name/ra/raylib/package.nix
+++ b/pkgs/by-name/ra/raylib/package.nix
@@ -79,8 +79,10 @@ lib.checkListOfEnum "${pname}: platform"
       meta = {
         description = "Simple and easy-to-use library to enjoy videogames programming";
         homepage = "https://www.raylib.com/";
+        downloadPage = "https://github.com/raysan5/raylib";
         license = lib.licenses.zlib;
         maintainers = [ lib.maintainers.diniamo ];
+        teams = [ lib.teams.ngi ];
         platforms = lib.platforms.all;
         changelog = "https://github.com/raysan5/raylib/blob/${finalAttrs.version}/CHANGELOG";
       };
diff --git a/pkgs/by-name/re/regclient/package.nix b/pkgs/by-name/re/regclient/package.nix
index 919e154a60df..03cd1b939861 100644
--- a/pkgs/by-name/re/regclient/package.nix
+++ b/pkgs/by-name/re/regclient/package.nix
@@ -18,16 +18,16 @@ in
 
 buildGoModule rec {
   pname = "regclient";
-  version = "0.8.3";
+  version = "0.9.0";
   tag = "v${version}";
 
   src = fetchFromGitHub {
     owner = "regclient";
     repo = "regclient";
     rev = tag;
-    sha256 = "sha256-vuZPd51nzCasV3WWulbKCQnqVkupMu5jQhQypvTKGvk=";
+    sha256 = "sha256-FVXTEP1CNlKmuorNxRE2SeiA90u2rz8sXELBtfRm9z0=";
   };
-  vendorHash = "sha256-ad7IPiOMG4G80BdAZz7IN0hBPJgUIVdO9oFlM7IDmp8=";
+  vendorHash = "sha256-MP/drjUbST5s3NKQ6omVOLSvl4rdPSfVaM0zlF/9Cq0=";
 
   outputs = [ "out" ] ++ bins;
 
diff --git a/pkgs/by-name/ro/routersploit/package.nix b/pkgs/by-name/ro/routersploit/package.nix
index 37b2df1807ac..32d8cc7bfe1c 100644
--- a/pkgs/by-name/ro/routersploit/package.nix
+++ b/pkgs/by-name/ro/routersploit/package.nix
@@ -4,9 +4,12 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
-  pname = "routersploit";
+let
   version = "3.4.7";
+in
+python3.pkgs.buildPythonApplication {
+  pname = "routersploit";
+  inherit version;
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -48,11 +51,14 @@ python3.pkgs.buildPythonApplication rec {
     "tests/test_module_info.py"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Exploitation Framework for Embedded Devices";
     homepage = "https://github.com/threat9/routersploit";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      fab
+      thtrf
+    ];
     mainProgram = "rsf";
   };
 }
diff --git a/pkgs/by-name/sf/sfml/package.nix b/pkgs/by-name/sf/sfml/package.nix
index 0d5babc71467..dc0c5b71da2e 100644
--- a/pkgs/by-name/sf/sfml/package.nix
+++ b/pkgs/by-name/sf/sfml/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
 
   # nativeBuildInputs
   cmake,
@@ -12,7 +13,6 @@
   glew,
   libjpeg,
   libvorbis,
-  openal,
   udev,
   libXi,
   libX11,
@@ -20,19 +20,33 @@
   libXrandr,
   libXrender,
   xcbutilimage,
+
+  # miniaudio
+  alsa-lib,
+  libjack2,
+  libpulseaudio,
+  sndio,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sfml";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "SFML";
     repo = "SFML";
     tag = finalAttrs.version;
-    hash = "sha256-e6x/L2D3eT6F/DBLQDZ+j0XD5NL9RalWZA8kcm9lZ3g=";
+    hash = "sha256-yTNoDHcBRzk270QHjSFVpjFKm2+uVvmVLg6XlAppwYk=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "Fix-pkg-config-when-SFML_PKGCONFIG_INSTALL_DIR-is-unset.patch";
+      url = "https://github.com/SFML/SFML/commit/a87763becbc4672b38f1021418ed94caa0f6540a.patch?full_index=1";
+      hash = "sha256-tJmXTdhwtWq6XfUPBzw47yTrc6EzwmSiVj9n6jQwHig=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs =
     [
@@ -41,7 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
       glew
       libjpeg
       libvorbis
-      openal
     ]
     ++ lib.optional stdenv.hostPlatform.isLinux udev
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
@@ -53,11 +66,25 @@ stdenv.mkDerivation (finalAttrs: {
       xcbutilimage
     ];
 
+  # We rely on RUNPATH
+  dontPatchELF = true;
+
   cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeBool "SFML_INSTALL_PKGCONFIG_FILES" true)
     (lib.cmakeFeature "SFML_MISC_INSTALL_PREFIX" "share/SFML")
     (lib.cmakeBool "SFML_BUILD_FRAMEWORKS" false)
     (lib.cmakeBool "SFML_USE_SYSTEM_DEPS" true)
+
+    # FIXME: Unvendor miniaudio and move these deps there
+    (lib.cmakeFeature "CMAKE_INSTALL_RPATH" (
+      lib.makeLibraryPath [
+        alsa-lib
+        libjack2
+        libpulseaudio
+        sndio
+      ]
+    ))
   ];
 
   meta = {
diff --git a/pkgs/applications/audio/strawberry/default.nix b/pkgs/by-name/st/strawberry/package.nix
similarity index 88%
rename from pkgs/applications/audio/strawberry/default.nix
rename to pkgs/by-name/st/strawberry/package.nix
index e1c70ed591ff..36add206b79c 100644
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/by-name/st/strawberry/package.nix
@@ -24,32 +24,30 @@
   nix-update-script,
   p11-kit,
   pkg-config,
-  qtbase,
-  qttools,
+  qt6,
   sqlite,
   stdenv,
   taglib,
   util-linux,
-  wrapQtAppsHook,
   sparsehash,
   rapidjson,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "strawberry";
   version = "1.2.11";
 
   src = fetchFromGitHub {
     owner = "jonaski";
-    repo = pname;
-    rev = version;
+    repo = "strawberry";
+    rev = finalAttrs.finalPackage.version;
     hash = "sha256-AhNx2CdfE7ff3+L47X6lYPD8GA7imkDIJD5ESndn/cc=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
   postPatch = ''
     substituteInPlace src/context/contextalbum.cpp \
-      --replace pictures/strawberry.png pictures/strawberry-grey.png
+      --replace-fail pictures/strawberry.png pictures/strawberry-grey.png
   '';
 
   buildInputs =
@@ -67,7 +65,7 @@ stdenv.mkDerivation rec {
       libmtp
       libpthreadstubs
       libtasn1
-      qtbase
+      qt6.qtbase
       sqlite
       taglib
       sparsehash
@@ -94,8 +92,8 @@ stdenv.mkDerivation rec {
       cmake
       ninja
       pkg-config
-      qttools
-      wrapQtAppsHook
+      qt6.qttools
+      qt6.wrapQtAppsHook
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       util-linux
@@ -115,11 +113,11 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Music player and music collection organizer";
     homepage = "https://www.strawberrymusicplayer.org/";
-    changelog = "https://raw.githubusercontent.com/jonaski/strawberry/${version}/Changelog";
+    changelog = "https://raw.githubusercontent.com/jonaski/strawberry/${finalAttrs.finalPackage.version}/Changelog";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ peterhoeg ];
     # upstream says darwin should work but they lack maintainers as of 0.6.6
     platforms = lib.platforms.linux;
     mainProgram = "strawberry";
   };
-}
+})
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index d421d491dad4..c71f0720853a 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-fN/TiIT3x78uyh78jzj9NtJ80W6cTlB6wWa+SztpqDw=";
-    "x86_64-linux" = "sha256-aNDtIHP9KX2KKsN0YgISqzoT+TMea4pppXJaiZEMXLA=";
-    "aarch64-linux" = "sha256-VB0hqlFAJle+J7kwyGb+eFMVlExT7uoJpgqGaP53V/I=";
+    "universal-macos" = "sha256-DLFAjkAkRemVOo9ZbKimKBpvVy/n/qzD+/dgWN3AfDg=";
+    "x86_64-linux" = "sha256-d+Y5OEHvS1wLDVkddX3r7y8iSLNCCXkzrn/T0lyMxNM=";
+    "aarch64-linux" = "sha256-sLvmm1liXOczLqUIlypu/nClPnQSmf4WkkxNem5vdkw=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.49";
+  version = "0.16.50";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/tr/trinity/package.nix b/pkgs/by-name/tr/trinity/package.nix
index ba745c5252dd..b99895bcbe51 100644
--- a/pkgs/by-name/tr/trinity/package.nix
+++ b/pkgs/by-name/tr/trinity/package.nix
@@ -21,6 +21,9 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs scripts
   '';
 
+  # https://salsa.debian.org/debian/trinity/-/merge_requests/2
+  env.NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
+
   enableParallelBuilding = true;
 
   installFlags = [ "DESTDIR=$(out)" ];
diff --git a/pkgs/by-name/ty/typstyle/package.nix b/pkgs/by-name/ty/typstyle/package.nix
index e66ecce0538d..60a0f77f434c 100644
--- a/pkgs/by-name/ty/typstyle/package.nix
+++ b/pkgs/by-name/ty/typstyle/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "typstyle";
-  version = "0.13.14";
+  version = "0.13.16";
 
   src = fetchFromGitHub {
     owner = "typstyle-rs";
     repo = "typstyle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rIbLYV4f+XaEkyIFkJL1Biwg+TnjHi7e9kvIlroiNNA=";
+    hash = "sha256-dfw1jyPNZ0LDEZ+pbJt9DWKa4aBlFCAZIgKrZK+AmJw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-YRsCuGvfSAUz0qsETIUcTKIchdkvleP3xJy0Hz+2BM0=";
+  cargoHash = "sha256-Eg8i+vsBp0BuxxBWXZisVKiGge25UKfxoK/3Knk+LsU=";
 
   # Disabling tests requiring network access
   checkFlags = [
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index ef7cf8177825..f5cd23e71ff5 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.39.1";
+  version = "2.41.3";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xQ1nh9YL198/ih9rw52rItR3t5Nq901MpDlFVht6kAc=";
+    hash = "sha256-0ttukgb698ipdW2JTS9xbja+3R/VjXQVoXLJYs2lYTs=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-CLe5UuHwAXLk9c+6baOpfFqrE/pl4889PhlajBRV+UU=";
+  vendorHash = "sha256-eXZQYT65tHhMSTulXJ9UBN+9HggQL7Oo3sVFVfJDnGg=";
 
   subPackages = [ "cmd/werf" ];
 
diff --git a/pkgs/by-name/wo/worldpainter/package.nix b/pkgs/by-name/wo/worldpainter/package.nix
index 62b8efce436b..7d90139cbcaf 100644
--- a/pkgs/by-name/wo/worldpainter/package.nix
+++ b/pkgs/by-name/wo/worldpainter/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "worldpainter";
-  version = "2.24.4";
+  version = "2.25.1";
 
   src = fetchurl {
     url = "https://www.worldpainter.net/files/${pname}_${version}.tar.gz";
-    hash = "sha256-j2b/V8MxaMRqGajMy5oYPlGSLVWN4/hdRji2zh8L1cg=";
+    hash = "sha256-AfqMerBvDfMw1WTeQVcPPt1nvBv7+66TolFCX4lFNVY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/x2/x2goserver/package.nix b/pkgs/by-name/x2/x2goserver/package.nix
index 37a19b0a063c..926284c0c5cd 100644
--- a/pkgs/by-name/x2/x2goserver/package.nix
+++ b/pkgs/by-name/x2/x2goserver/package.nix
@@ -117,6 +117,8 @@ stdenv.mkDerivation {
     do
       substituteInPlace $i --replace '/etc/x2go' '/var/lib/x2go/conf'
     done
+    substituteInPlace x2goserver/Makefile \
+      --replace-fail "\$(DESTDIR)/etc" "\$(DESTDIR)/\$(ETCDIR)"
     substituteInPlace x2goserver/sbin/x2gocleansessions \
       --replace '/var/run/x2goserver.pid' '/var/run/x2go/x2goserver.pid'
     substituteInPlace x2goserver/sbin/x2godbadmin --replace 'user="x2gouser"' 'user="x2go"'
@@ -126,16 +128,16 @@ stdenv.mkDerivation {
   '';
 
   makeFlags = [
-    "PREFIX=/"
-    "NXLIBDIR=${nx-libs}/lib/nx"
+    "PREFIX=${placeholder "out"}"
+    "ETCDIR=${placeholder "out"}/etc/x2go"
+    "NXLIBDIR=${placeholder "out"}"
   ];
 
-  installFlags = [ "DESTDIR=$(out)" ];
-
   postInstall = ''
     mv $out/etc/x2go/x2goserver.conf{,.example}
     mv $out/etc/x2go/x2goagent.options{,.example}
     ln -sf ${nx-libs}/bin/nxagent $out/bin/x2goagent
+    ln -sf ${nx-libs}/share/nx/VERSION.nxagent $out/share/x2go/versions/VERSION.x2goserver-x2goagent
     for i in $out/sbin/x2go* $(find $out/bin -type f) \
       $(ls $out/lib/x2go/x2go* | grep -v x2gocheckport)
     do
diff --git a/pkgs/desktops/xfce/applications/xfdashboard/default.nix b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
index 2e590e4ed8a2..54101465e6c0 100644
--- a/pkgs/desktops/xfce/applications/xfdashboard/default.nix
+++ b/pkgs/desktops/xfce/applications/xfdashboard/default.nix
@@ -2,6 +2,7 @@
   lib,
   mkXfceDerivation,
   clutter,
+  gettext,
   libXcomposite,
   libXinerama,
   libXdamage,
@@ -19,10 +20,16 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfdashboard";
-  version = "1.0.0";
+  version = "1.0.0-unstable-2025-07-18";
+  # Fix build with gettext 0.25
+  rev = "93255940950ef5bc89cab729c8b977a706f98e0c";
   rev-prefix = "";
 
-  sha256 = "sha256-iC41I0u9id9irUNyjuvRRzSldF3dzRYkaxb/fgptnq4=";
+  sha256 = "sha256-Qv0ASuJF0FzPoeLx2D6/kXkxnOJV7mdAFD6PCk+CMac=";
+
+  nativeBuildInputs = [
+    gettext
+  ];
 
   buildInputs = [
     clutter
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/default.nix
index 21ca6797c747..048f75f87d0a 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  gettext,
   pkg-config,
   intltool,
   gtk3,
@@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
+    gettext
     pkg-config
     intltool
     xfce4-dev-tools
@@ -37,6 +39,13 @@ stdenv.mkDerivation rec {
     i3ipc-glib
   ];
 
+  patches = [
+    # Fix build with gettext 0.25
+    # https://hydra.nixos.org/build/302762031/nixlog/2
+    # FIXME: remove when gettext is fixed
+    ./gettext-0.25.patch
+  ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/gettext-0.25.patch b/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/gettext-0.25.patch
new file mode 100644
index 000000000000..307c8ca563ef
--- /dev/null
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-i3-workspaces-plugin/gettext-0.25.patch
@@ -0,0 +1,21 @@
+diff --git a/configure.ac.in b/configure.ac.in
+index 7932c16..1778d38 100644
+--- a/configure.ac.in
++++ b/configure.ac.in
+@@ -24,6 +24,7 @@ AC_COPYRIGHT([Copyright (C) 2014
+ AC_INIT([xfce4-i3-workspaces-plugin], [plugin_version], [https://github.com/denesb/xfce4-i3-workspaces-plugin/issues], [xfce4-i3-workspaces-plugin])
+ AC_PREREQ([2.50])
+ AC_REVISION([xfce4_panel_version_build])
++AC_CONFIG_MACRO_DIRS([m4])
+ 
+ dnl ***************************
+ dnl *** Initialize automake ***
+@@ -31,6 +32,8 @@ dnl ***************************
+ AM_INIT_AUTOMAKE([1.8 no-dist-gzip dist-bzip2 tar-ustar])
+ AM_CONFIG_HEADER([config.h])
+ AM_MAINTAINER_MODE()
++AM_GNU_GETTEXT_VERSION([0.21])
++AM_GNU_GETTEXT([external])
+ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+ 
+ dnl **************************
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 40a60265ad01..7cedb913b1a7 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -83,6 +83,11 @@ let
           "--disable-libatomic" # requires libc
           "--disable-decimal-float" # requires libc
           "--disable-libmpx" # requires libc
+          "--disable-hosted-libstdcxx" # requires libc
+          "--disable-libstdcxx-backtrace"
+          "--disable-linux-futex"
+          "--disable-libvtv"
+          "--disable-libitm"
         ]
         ++ lib.optionals crossMingw [
           "--with-headers=${lib.getDev libcCross}/include"
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index a3d54f1b8525..79f65b08a542 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -39,7 +39,7 @@
   name ? "gcc",
   libcCross ? null,
   threadsCross ? { }, # for MinGW
-  withoutTargetLibc ? false,
+  withoutTargetLibc ? stdenv.targetPlatform.libc == null,
   flex,
   gnused ? null,
   buildPackages,
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index 7f2c4879efa8..eac6c5d7c62b 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kotlin";
-  version = "2.1.21";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${finalAttrs.version}/kotlin-compiler-${finalAttrs.version}.zip";
-    sha256 = "sha256-G6CKi0XamTOaBgETTMA3tUz4XpvA7b523L0nwtaEqXc=";
+    sha256 = "sha256-GttvGlhFugqlpZ5BLkTI5AUja5V94aloNhnx3KOxaTI=";
   };
 
   propagatedBuildInputs = [ jre ];
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 1803a04a6638..44259a2f2e48 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -631,32 +631,32 @@ lib.recurseIntoAttrs rec {
   # This derivation deploys the tools package and symlinks all the desired
   # plugins that we want to use. If the license isn't accepted, prints all the licenses
   # requested and throws.
-  androidsdk =
-    if !licenseAccepted then
-      throw ''
-        ${builtins.concatStringsSep "\n\n" (mkLicenseTexts licenseNames)}
+  androidsdk = callPackage ./cmdline-tools.nix {
+    inherit
+      deployAndroidPackage
+      os
+      arch
+      meta
+      ;
 
-        You must accept the following licenses:
-        ${lib.concatMapStringsSep "\n" (str: "  - ${str}") licenseNames}
+    package = cmdline-tools-package;
 
-        a)
-          by setting nixpkgs config option 'android_sdk.accept_license = true;'.
-        b)
-          by an environment variable for a single invocation of the nix tools.
-            $ export NIXPKGS_ACCEPT_ANDROID_SDK_LICENSE=1
-      ''
-    else
-      callPackage ./cmdline-tools.nix {
-        inherit
-          deployAndroidPackage
-          os
-          arch
-          meta
-          ;
+    postInstall =
+      if !licenseAccepted then
+        throw ''
+          ${builtins.concatStringsSep "\n\n" (mkLicenseTexts licenseNames)}
 
-        package = cmdline-tools-package;
+          You must accept the following licenses:
+          ${lib.concatMapStringsSep "\n" (str: "  - ${str}") licenseNames}
 
-        postInstall = ''
+          a)
+            by setting nixpkgs config option 'android_sdk.accept_license = true;'.
+          b)
+            by an environment variable for a single invocation of the nix tools.
+              $ export NIXPKGS_ACCEPT_ANDROID_SDK_LICENSE=1
+        ''
+      else
+        ''
           # Symlink all requested plugins
           ${linkPlugin {
             name = "platform-tools";
@@ -769,5 +769,5 @@ lib.recurseIntoAttrs rec {
             ''
           ) licenseNames}
         '';
-      };
+  };
 }
diff --git a/pkgs/development/ocaml-modules/eio/default.nix b/pkgs/development/ocaml-modules/eio/default.nix
index 224e6051eb04..f9714ee8fbf1 100644
--- a/pkgs/development/ocaml-modules/eio/default.nix
+++ b/pkgs/development/ocaml-modules/eio/default.nix
@@ -1,7 +1,13 @@
 {
   lib,
   ocaml,
-  version ? if lib.versionAtLeast ocaml.version "5.1" then "1.2" else "0.12",
+  version ?
+    if lib.versionAtLeast ocaml.version "5.2" then
+      "1.3"
+    else if lib.versionAtLeast ocaml.version "5.1" then
+      "1.2"
+    else
+      "0.12",
   buildDunePackage,
   bigstringaf,
   cstruct,
@@ -29,6 +35,10 @@ let
         minimalOCamlVersion = "5.1";
         hash = "sha256-N5LpEr2NSUuy449zCBgl5NISsZcM8sHxspZsqp/WvEA=";
       };
+      "1.3" = {
+        minimalOCamlVersion = "5.2";
+        hash = "sha256-jtXBPmaJ8xyF3KXxJ2LYS4zABCp7B9PkZN9utLcrPfw=";
+      };
     }
     ."${version}";
 in
diff --git a/pkgs/development/python-modules/azure-mgmt-storage/default.nix b/pkgs/development/python-modules/azure-mgmt-storage/default.nix
index 656c1ddd798d..33d28d122754 100644
--- a/pkgs/development/python-modules/azure-mgmt-storage/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-storage/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-storage";
-  version = "23.0.0";
+  version = "23.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "azure_mgmt_storage";
     inherit version;
-    hash = "sha256-HFlU1Zvdy5edBbxJ5DFxam4rL3VpCblrp8QyYQcq/L8=";
+    hash = "sha256-w6sqyTUtHAHYW1bWcW3M4eRoD5ILFIoktDabuRuSI7Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/color-parser-py/default.nix b/pkgs/development/python-modules/color-parser-py/default.nix
new file mode 100644
index 000000000000..9f4ae2bc0b00
--- /dev/null
+++ b/pkgs/development/python-modules/color-parser-py/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  rustPlatform,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "color-parser-py";
+  version = "0.1.6";
+  pyproject = true;
+
+  # PyPI has Cargo.lock
+  src = fetchPypi {
+    pname = "color_parser_py";
+    inherit version;
+    hash = "sha256-m1qhVAwQNtCwz+DLSAdfKhzkohMLMjvPHxynKhlJfN8=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-tKXA6sd5gLCJUaqxzFcZ3lePK41Wk2TbLp0HXBacOyo=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "color_parser_py" ];
+
+  # Support newer python versions
+  env.PYO3_USE_ABI3_FORWARD_COMPATIBILITY = true;
+
+  meta = {
+    description = "Python bindings for color parsing and conversion";
+    homepage = "https://github.com/rusiaaman/color-parser-py";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aleksana ];
+  };
+}
diff --git a/pkgs/development/python-modules/curvefitgui/default.nix b/pkgs/development/python-modules/curvefitgui/default.nix
index 5c5f2247e553..29502f64e95c 100644
--- a/pkgs/development/python-modules/curvefitgui/default.nix
+++ b/pkgs/development/python-modules/curvefitgui/default.nix
@@ -2,8 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
-  pythonAtLeast,
+
+  # depedencies
   numpy,
   scipy,
   pyqt5,
@@ -14,11 +17,6 @@ buildPythonPackage {
   pname = "curvefitgui";
   version = "0-unstable-2021-08-25";
   pyproject = true;
-  # For some reason, importing the main module makes the whole python
-  # interpreter crash! This needs further investigation, possibly the problem
-  # is with one of the dependencies.. See upstream report:
-  # https://github.com/moosepy/curvefitgui/issues/2
-  disabled = pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "moosepy";
@@ -27,9 +25,11 @@ buildPythonPackage {
     hash = "sha256-oK0ROKxh/91OrHhuufG6pvc2EMBeMP8R5O+ED2thyW8=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
     scipy
     pyqt5
diff --git a/pkgs/development/python-modules/django-import-export/default.nix b/pkgs/development/python-modules/django-import-export/default.nix
index 4dc5c199bcec..7ce8cc7bda7c 100644
--- a/pkgs/development/python-modules/django-import-export/default.nix
+++ b/pkgs/development/python-modules/django-import-export/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "django-import-export";
-  version = "4.3.7";
+  version = "4.3.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-import-export";
     repo = "django-import-export";
     tag = version;
-    hash = "sha256-hHLFrcCw9PXGh7JbHo76SUZ09ZCK9u72BjiaL5HuVMc=";
+    hash = "sha256-4QZvVFhnXqdeKvADZOIADbRlRllce7WbVOfVJUHndvg=";
   };
 
   pythonRelaxDeps = [ "tablib" ];
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 8706c1979c84..b6b59ab67f26 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -11,6 +11,7 @@
   psutil,
   pybind11,
   setuptools-scm,
+  pytest-reraise,
   pytestCheckHook,
 }:
 
@@ -24,32 +25,33 @@ buildPythonPackage rec {
     ;
   pyproject = true;
 
-  postPatch =
-    (duckdb.postPatch or "")
-    + ''
-      # we can't use sourceRoot otherwise patches don't apply, because the patches apply to the C++ library
-      cd tools/pythonpkg
+  postPatch = (duckdb.postPatch or "") + ''
+    # we can't use sourceRoot otherwise patches don't apply, because the patches apply to the C++ library
+    cd tools/pythonpkg
 
-      # 1. let nix control build cores
-      # 2. default to extension autoload & autoinstall disabled
-      substituteInPlace setup.py \
-        --replace-fail "ParallelCompile()" 'ParallelCompile("NIX_BUILD_CORES")' \
-        --replace-fail "define_macros.extend([('DUCKDB_EXTENSION_AUTOLOAD_DEFAULT', '1'), ('DUCKDB_EXTENSION_AUTOINSTALL_DEFAULT', '1')])" "pass"
-    '';
+    # 1. let nix control build cores
+    # 2. default to extension autoload & autoinstall disabled
+    substituteInPlace setup.py \
+      --replace-fail "ParallelCompile()" 'ParallelCompile("NIX_BUILD_CORES")' \
+      --replace-fail "define_macros.extend([('DUCKDB_EXTENSION_AUTOLOAD_DEFAULT', '1'), ('DUCKDB_EXTENSION_AUTOINSTALL_DEFAULT', '1')])" "pass"
+
+    substituteInPlace pyproject.toml \
+      --replace-fail 'setuptools_scm>=6.4,<8.0' 'setuptools_scm'
+  '';
 
   env = {
     DUCKDB_BUILD_UNITY = 1;
     OVERRIDE_GIT_DESCRIBE = "v${version}-0-g${rev}";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     pybind11
     setuptools-scm
   ];
 
   buildInputs = [ openssl ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     numpy
     pandas
   ];
@@ -58,12 +60,14 @@ buildPythonPackage rec {
     fsspec
     google-cloud-storage
     psutil
+    pytest-reraise
     pytestCheckHook
   ];
 
   pytestFlags = [ "--verbose" ];
 
   # test flags from .github/workflows/Python.yml
+  pytestFlagsArray = [ "--verbose" ];
   enabledTestPaths = if stdenv.hostPlatform.isDarwin then [ "tests/fast" ] else [ "tests" ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/gerbonara/default.nix b/pkgs/development/python-modules/gerbonara/default.nix
index 46a226f5637d..ebef9f4a30a5 100644
--- a/pkgs/development/python-modules/gerbonara/default.nix
+++ b/pkgs/development/python-modules/gerbonara/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "gerbonara";
-  version = "1.4.0";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "jaseg";
     repo = "gerbonara";
     rev = "v${version}";
-    hash = "sha256-SwXoCA9ru5VgH4geKUDgdcPrgEYgNoVwNb5YUBAcXlo=";
+    hash = "sha256-yxSZuBw93wqIAw1wke80Vy/dtBcQwpQ2tQ1nwXdWi4k=";
   };
 
   format = "setuptools";
diff --git a/pkgs/development/python-modules/paddlex/default.nix b/pkgs/development/python-modules/paddlex/default.nix
index f0e3657e3353..ea360f893c51 100644
--- a/pkgs/development/python-modules/paddlex/default.nix
+++ b/pkgs/development/python-modules/paddlex/default.nix
@@ -19,6 +19,7 @@
   ujson,
   distutils,
   huggingface-hub,
+  nix-update-script,
 }:
 
 let
@@ -50,14 +51,14 @@ let
 in
 buildPythonPackage rec {
   pname = "paddlex";
-  version = "3.1.1";
+  version = "3.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PaddlePaddle";
     repo = "PaddleX";
     tag = "v${version}";
-    hash = "sha256-vmb1A7AifQmWv31b847hP1lHeBe+ZDEGR3raIGykRoo=";
+    hash = "sha256-sNnaTB7wJFXVXnc7I1XufAWdTXHr1is3JdXdh6Ssc+s=";
   };
 
   build-system = [ setuptools ];
@@ -86,6 +87,8 @@ buildPythonPackage rec {
     huggingface-hub
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     homepage = "https://github.com/PaddlePaddle/PaddleX";
     license = lib.licenses.asl20;
diff --git a/pkgs/development/python-modules/pandera/default.nix b/pkgs/development/python-modules/pandera/default.nix
index 7ed6e538cd52..59e6a5ee5c47 100644
--- a/pkgs/development/python-modules/pandera/default.nix
+++ b/pkgs/development/python-modules/pandera/default.nix
@@ -14,6 +14,7 @@
   pandas,
   pydantic,
   typeguard,
+  typing-extensions,
   typing-inspect,
 
   # optional-dependencies
@@ -22,6 +23,7 @@
   fastapi,
   geopandas,
   hypothesis,
+  ibis-framework,
   pandas-stubs,
   polars,
   pyyaml,
@@ -29,8 +31,10 @@
   shapely,
 
   # tests
+  duckdb,
   joblib,
   pyarrow,
+  pyarrow-hotfix,
   pytestCheckHook,
   pytest-asyncio,
   pythonAtLeast,
@@ -38,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "pandera";
-  version = "0.24.0";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "unionai-oss";
     repo = "pandera";
     tag = "v${version}";
-    hash = "sha256-S5y717M3rGGO39TOh1X5yePvdcF6ct1Jk51/bbM6X6M=";
+    hash = "sha256-0YeLeGpunjHRWFvSvz0r2BokM4/eJKXuBajgcGquca4=";
   };
 
   build-system = [
@@ -56,11 +60,10 @@ buildPythonPackage rec {
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   dependencies = [
-    numpy
     packaging
-    pandas
     pydantic
     typeguard
+    typing-extensions
     typing-inspect
   ];
 
@@ -96,6 +99,14 @@ buildPythonPackage rec {
           geopandas
           shapely
         ];
+        ibis = [
+          ibis-framework
+          duckdb
+        ];
+        pandas = [
+          numpy
+          pandas
+        ];
         polars = [ polars ];
       };
     in
@@ -106,6 +117,7 @@ buildPythonPackage rec {
     pytest-asyncio
     joblib
     pyarrow
+    pyarrow-hotfix
   ] ++ optional-dependencies.all;
 
   disabledTestPaths = [
@@ -143,7 +155,7 @@ buildPythonPackage rec {
   meta = {
     description = "Light-weight, flexible, and expressive statistical data testing library";
     homepage = "https://pandera.readthedocs.io";
-    changelog = "https://github.com/unionai-oss/pandera/releases/tag/v${version}";
+    changelog = "https://github.com/unionai-oss/pandera/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/petl/default.nix b/pkgs/development/python-modules/petl/default.nix
index 188bbeba821f..0b9c0d8a5bae 100644
--- a/pkgs/development/python-modules/petl/default.nix
+++ b/pkgs/development/python-modules/petl/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "petl";
-  version = "1.7.16";
+  version = "1.7.17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "petl-developers";
     repo = "petl";
     tag = "v${version}";
-    hash = "sha256-rew/+GXQq2l1LlsR4yqHJZ/iY21HJ2Lf86KS55L8jsQ=";
+    hash = "sha256-zYR/9WdaVCmdaCzOFfHirVE4Gg+CVLvWu1RpWXdqLSc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/plopp/default.nix b/pkgs/development/python-modules/plopp/default.nix
index 581dbb51e5d2..50056b6c4f43 100644
--- a/pkgs/development/python-modules/plopp/default.nix
+++ b/pkgs/development/python-modules/plopp/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -35,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "plopp";
-  version = "25.06.0";
+  version = "25.07.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -44,6 +45,13 @@ buildPythonPackage rec {
     tag = version;
     hash = "sha256-SwF0bUU/DAAJ5+0WvZgwqEw6IoaqdbKj0GkCgffGclA=";
   };
+  patches = [
+    # https://github.com/scipp/plopp/issues/472
+    (fetchpatch {
+      url = "https://github.com/scipp/plopp/commit/7af8cbee85796005f2fea79171ae44aba9a8cfc7.patch";
+      hash = "sha256-uyCV/2tSvcnnw+ak6fT99ru+UrTZXsS3b4YGeXVykAY=";
+    })
+  ];
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/plotpy/default.nix b/pkgs/development/python-modules/plotpy/default.nix
index 923ec62e533a..16d654dc7e81 100644
--- a/pkgs/development/python-modules/plotpy/default.nix
+++ b/pkgs/development/python-modules/plotpy/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "plotpy";
-  version = "2.7.4";
+  version = "2.7.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PlotPyStack";
     repo = "PlotPy";
     tag = "v${version}";
-    hash = "sha256-FmSFcCAJZyzD9qRE+L2oxWtyh2spJSLRq+xtx4e1Rhg=";
+    hash = "sha256-g26CWUQTaky7h1wHd9CAB4AEvk24frN7f6wqs1fefJw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyschlage/default.nix b/pkgs/development/python-modules/pyschlage/default.nix
index 6ff308d47081..a78aa21f368c 100644
--- a/pkgs/development/python-modules/pyschlage/default.nix
+++ b/pkgs/development/python-modules/pyschlage/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pyschlage";
-  version = "2025.4.0";
+  version = "2025.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "dknowles2";
     repo = "pyschlage";
     tag = version;
-    hash = "sha256-RgPobb9RhM+eFX3Y+wSKlDQ6SddnGKlNTG1nIeEVDFs=";
+    hash = "sha256-XfYoui3xo8l3wi8nqvyzfYhsHsY8T1t/iYS4ZHNjGUE=";
   };
 
   build-system = [
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for interacting with Schlage Encode WiFi locks";
     homepage = "https://github.com/dknowles2/pyschlage";
-    changelog = "https://github.com/dknowles2/pyschlage/releases/tag/${version}";
+    changelog = "https://github.com/dknowles2/pyschlage/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pytest-reraise/default.nix b/pkgs/development/python-modules/pytest-reraise/default.nix
new file mode 100644
index 000000000000..a55040017dd8
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-reraise/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytest,
+  pytestCheckHook,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-reraise";
+  version = "2.1.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bjoluc";
+    repo = pname;
+    tag = "v${version}";
+    hash = "sha256-mgNKoZ+2sinArTZhSwhLxzBTb4QfiT1LWBs7w5MHXWA=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'poetry>=0.12' 'poetry-core>=1.0.0' \
+      --replace-fail 'poetry.masonry' 'poetry.core.masonry'
+  '';
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ pytest ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pytest_reraise" ];
+
+  meta = {
+    description = "Make multi-threaded pytest test cases fail when they should";
+    longDescription = ''
+      Make multi-threaded pytest test cases fail when they should
+    '';
+    homepage = "https://github.com/bjoluc/pytest-reraise";
+    changelog = "https://github.com/bjoluc/pytest-reraise/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cpcloud ];
+  };
+}
diff --git a/pkgs/development/python-modules/skl2onnx/default.nix b/pkgs/development/python-modules/skl2onnx/default.nix
index cc6667fe48cb..af953ccd7ffa 100644
--- a/pkgs/development/python-modules/skl2onnx/default.nix
+++ b/pkgs/development/python-modules/skl2onnx/default.nix
@@ -4,6 +4,7 @@
   fetchPypi,
   numpy,
   scipy,
+  setuptools,
   protobuf,
   onnx,
   scikit-learn,
@@ -15,14 +16,16 @@
 
 buildPythonPackage rec {
   pname = "skl2onnx";
-  version = "1.18.0";
-  format = "setuptools";
+  version = "1.19.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OepK4wxcGCNVoYJEZwExWCFERODOCxjzMzi9gn1PsA8=";
+    hash = "sha256-DBBfKjuHpiTdIY0fuY/dGc8b9iFxkNJc5+FUhBJ9Dl0=";
   };
 
+  build-system = [ setuptools ];
+
   propagatedBuildInputs = [
     numpy
     scipy
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
index 8fb244417e92..3db68fc6a0a6 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-nix.json
@@ -1,10 +1,10 @@
 {
-  "url": "https://github.com/cstrahan/tree-sitter-nix",
-  "rev": "cfc53fd287d23ab7281440a8526c73542984669b",
-  "date": "2025-03-10T21:49:48Z",
-  "path": "/nix/store/aqzm346ck43x74b409jiikbbxqchgyr1-tree-sitter-nix",
-  "sha256": "0bmalpgvfcz1zd72wq43r5qvhj3dqqp7zn9kfb6bs0valrxagaks",
-  "hash": "sha256-eqqneqZqA73McjPZfy7GbUi4ccmDYC5O++Ezt9+lqi4=",
+  "url": "https://github.com/nix-community/tree-sitter-nix",
+  "rev": "ea1d87f7996be1329ef6555dcacfa63a69bd55c6",
+  "date": "2025-07-18T19:46:47+02:00",
+  "path": "/nix/store/mvq8m0v2cr2xns4807cby54h3wc7xjxr-tree-sitter-nix",
+  "sha256": "1aaq5yv1s8qq3abm0jm884hi4k6n2w0nzd1j3wizv1x1xk6qzlsl",
+  "hash": "sha256-VNOPzeyhh/0jHzK0bwEX1kwSIUGoSlCXGhgjHbYvWKk=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/development/tools/parsing/tree-sitter/update.nix b/pkgs/development/tools/parsing/tree-sitter/update.nix
index ac8b80ccaef7..cf9502ed575e 100644
--- a/pkgs/development/tools/parsing/tree-sitter/update.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/update.nix
@@ -144,7 +144,7 @@ let
       repo = "tree-sitter-just";
     };
     "tree-sitter-nix" = {
-      orga = "cstrahan";
+      orga = "nix-community";
       repo = "tree-sitter-nix";
     };
     "tree-sitter-latex" = {
diff --git a/pkgs/misc/cups/drivers/cnijfilter_2_80/default.nix b/pkgs/misc/cups/drivers/cnijfilter_2_80/default.nix
index 7b32751b4e0f..7e1e9d160471 100644
--- a/pkgs/misc/cups/drivers/cnijfilter_2_80/default.nix
+++ b/pkgs/misc/cups/drivers/cnijfilter_2_80/default.nix
@@ -1,5 +1,5 @@
 {
-  gcc13Stdenv,
+  stdenv,
   lib,
   fetchzip,
   autoconf,
@@ -17,7 +17,7 @@
   file included in the tarball
 */
 
-gcc13Stdenv.mkDerivation {
+stdenv.mkDerivation {
   pname = "cnijfilter";
 
   /*
@@ -51,6 +51,8 @@ gcc13Stdenv.mkDerivation {
     ghostscript
   ];
 
+  env.NIX_CFLAGS_COMPILE = " -std=gnu90";
+
   patches = [
     ./patches/missing-include.patch
     ./patches/libpng15.patch
diff --git a/pkgs/tools/misc/gams/default.nix b/pkgs/tools/misc/gams/default.nix
index c69f98a9ca23..d27d3ddacd9d 100644
--- a/pkgs/tools/misc/gams/default.nix
+++ b/pkgs/tools/misc/gams/default.nix
@@ -8,8 +8,6 @@
   optgamsFile ? null,
 }:
 
-assert licenseFile != null;
-
 stdenv.mkDerivation rec {
   version = "25.0.2";
   pname = "gams";
@@ -23,6 +21,7 @@ stdenv.mkDerivation rec {
   dontBuild = true;
 
   installPhase =
+    assert licenseFile != null;
     ''
       mkdir -p "$out/bin" "$out/share/gams"
       cp -a * "$out/share/gams"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index e9c8a8be2d86..9c640f4feafd 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -301,6 +301,7 @@ mapAliases {
   appthreat-depscan = dep-scan; # Added 2024-04-10
   arb = throw "'arb' has been removed as it has been merged into 'flint3'"; # Added 2025-03-28
   arcanist = throw "arcanist was removed as phabricator is not supported and does not accept fixes"; # Added 2024-06-07
+  archipelago-minecraft = throw "archipelago-minecraft has been removed, as upstream no longer ships minecraft as a default APWorld."; # Added 2025-07-15
   argo = argo-workflows; # Added 2025-02-01
   aria = aria2; # Added 2024-03-26
   armcord = throw "ArmCord was renamed to legcord by the upstream developers. Action is required to migrate configurations between the two applications. Please see this PR for more details: https://github.com/NixOS/nixpkgs/pull/347971"; # Added 2024-10-11
@@ -1897,7 +1898,8 @@ mapAliases {
   steam-small = steam; # Added 2024-09-12
   steam-run-native = steam-run; # added 2022-02-21
   StormLib = stormlib; # Added 2024-01-21
-  strawberry-qt5 = throw "strawberry-qt5 has been replaced by strawberry-qt6"; # Added 2024-11-22
+  strawberry-qt5 = throw "strawberry-qt5 has been replaced by strawberry"; # Added 2024-11-22 and updated 2025-07-19
+  strawberry-qt6 = throw "strawberry-qt6 has been replaced by strawberry"; # Added 2025-07-19
   strelka = throw "strelka depends on Python 2.6+, and does not support Python 3."; # Added 2025-03-17
   subberthehut = throw "'subberthehut' has been removed as it was unmaintained upstream"; # Added 2025-05-17
   substituteAll = throw "`substituteAll` has been removed. Use `replaceVars` instead."; # Added 2025-05-23
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6b89a8b1b012..38a4399dafad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -288,10 +288,6 @@ with pkgs;
   # many more scenarios than just opengl now.
   aocd = with python3Packages; toPythonApplication aocd;
 
-  archipelago-minecraft = callPackage ../by-name/ar/archipelago/package.nix {
-    extraPackages = [ jdk17 ];
-  };
-
   cve = with python3Packages; toPythonApplication cvelib;
 
   basalt-monado = callPackage ../by-name/ba/basalt-monado/package.nix {
@@ -2818,10 +2814,6 @@ with pkgs;
 
   sonobuoy = callPackage ../applications/networking/cluster/sonobuoy { };
 
-  strawberry-qt6 = qt6Packages.callPackage ../applications/audio/strawberry { };
-
-  strawberry = strawberry-qt6;
-
   schleuder = callPackage ../tools/security/schleuder { };
 
   schleuder-cli = callPackage ../tools/security/schleuder/cli { };
@@ -8155,7 +8147,7 @@ with pkgs;
       wasilibc
     else if libc == "relibc" then
       relibc
-    else if name == "llvm" then
+    else if libc == "llvm" then
       llvmPackages_20.libc
     else
       throw "Unknown libc ${libc}";
@@ -11375,6 +11367,7 @@ with pkgs;
   usbrelayd = callPackage ../os-specific/linux/usbrelay/daemon.nix { };
 
   util-linuxMinimal = util-linux.override {
+    fetchurl = stdenv.fetchurlBoot;
     cryptsetupSupport = false;
     nlsSupport = false;
     ncursesSupport = false;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2da9cf1bc4cd..a725c2394350 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2763,6 +2763,8 @@ self: super: with self; {
 
   color-operations = callPackage ../development/python-modules/color-operations { };
 
+  color-parser-py = callPackage ../development/python-modules/color-parser-py { };
+
   colorama = callPackage ../development/python-modules/colorama { };
 
   colorcet = callPackage ../development/python-modules/colorcet { };
@@ -14268,6 +14270,8 @@ self: super: with self; {
 
   pytest-repeat = callPackage ../development/python-modules/pytest-repeat { };
 
+  pytest-reraise = callPackage ../development/python-modules/pytest-reraise { };
+
   pytest-rerunfailures = callPackage ../development/python-modules/pytest-rerunfailures { };
 
   pytest-resource-path = callPackage ../development/python-modules/pytest-resource-path { };