diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 7409518345dc..df34d5c69dde 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -67,6 +67,9 @@
 
 - `lisp-modules` were brought in sync with the [June 2025 Quicklisp release](http://blog.quicklisp.org/2025/07/june-2025-quicklisp-dist-now-available.html).
 
+- `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
+  If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.
+
 - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.
 
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 84c9a040d1ae..585dc6fbb230 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28007,12 +28007,6 @@
     githubId = 65394961;
     name = "Yves Straten";
   };
-  yvt = {
-    email = "i@yvt.jp";
-    github = "yvt";
-    githubId = 5253988;
-    name = "yvt";
-  };
   yzx9 = {
     email = "yuan.zx@outlook.com";
     github = "yzx9";
diff --git a/nixos/modules/services/mail/tlsrpt.nix b/nixos/modules/services/mail/tlsrpt.nix
index 732679c9b05a..83b219443fd0 100644
--- a/nixos/modules/services/mail/tlsrpt.nix
+++ b/nixos/modules/services/mail/tlsrpt.nix
@@ -270,9 +270,17 @@ in
       };
     };
 
-    systemd.services.postfix.serviceConfig.SupplementaryGroups = mkIf (
-      config.services.postfix.enable && cfg.collectd.configurePostfix
-    ) [ "tlsrpt" ];
+    users.users.tlsrpt = {
+      isSystemUser = true;
+      group = "tlsrpt";
+    };
+    users.groups.tlsrpt = { };
+
+    users.users.postfix.extraGroups =
+      lib.mkIf (config.services.postfix.enable && cfg.collectd.configurePostfix)
+        [
+          "tlsrpt"
+        ];
 
     systemd.services.tlsrpt-collectd = {
       description = "TLSRPT datagram collector";
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index e7a10bfffaba..3e6872e5cfe1 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -24,13 +24,8 @@ let
     # write NixOS settings as JSON
     (
       umask 077
-      cp --no-preserve=mode ${settingsFile} settings.yml
+      ${pkgs.envsubst}/bin/envsubst < ${settingsFile} > settings.yml
     )
-
-    # substitute environment variables
-    env -0 | while IFS='=' read -r -d ''' n v; do
-      sed "s#@$n@#$v#g" -i settings.yml
-    done
   '';
 
   settingType =
@@ -95,20 +90,20 @@ in
           {
             server.port = 8080;
             server.bind_address = "0.0.0.0";
-            server.secret_key = "@SEARX_SECRET_KEY@";
+            server.secret_key = "$SEARX_SECRET_KEY";
 
-            engines = lib.singleton {
+            engines = [ {
               name = "wolframalpha";
               shortcut = "wa";
-              api_key = "@WOLFRAM_API_KEY@";
+              api_key = "$WOLFRAM_API_KEY";
               engine = "wolframalpha_api";
-            };
+            } ];
           }
         '';
         description = ''
           Searx settings.
           These will be merged with (taking precedence over) the default configuration.
-          It's also possible to refer to environment variables (defined in [](#opt-services.searx.environmentFile)) using the syntax `@VARIABLE_NAME@`.
+          It's also possible to refer to environment variables (defined in [](#opt-services.searx.environmentFile)) using the syntax `$VARIABLE_NAME`.
 
           ::: {.note}
           For available settings, see the Searx [docs](https://docs.searxng.org/admin/settings/index.html).
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5fdeacd8e59b..9d6907a1d909 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1061,7 +1061,7 @@ in
   ollama-cuda = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-cuda.nix;
   ollama-rocm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ollama-rocm.nix;
   ombi = runTest ./ombi.nix;
-  omnom = runTest ./omnom.nix;
+  omnom = runTest ./omnom;
   openarena = runTest ./openarena.nix;
   openbao = runTest ./openbao.nix;
   opencloud = runTest ./opencloud.nix;
@@ -1082,6 +1082,7 @@ in
   open-web-calendar = runTest ./web-apps/open-web-calendar.nix;
   ocsinventory-agent = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./ocsinventory-agent.nix { };
   orthanc = runTest ./orthanc.nix;
+  owi = runTest ./owi.nix;
   owncast = runTest ./owncast.nix;
   outline = runTest ./outline.nix;
   i18n = runTest ./i18n.nix;
diff --git a/nixos/tests/omnom.nix b/nixos/tests/omnom.nix
deleted file mode 100644
index 4bfdbd679b39..000000000000
--- a/nixos/tests/omnom.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, ... }:
-let
-  servicePort = 9090;
-in
-{
-  name = "Basic Omnom Test";
-  meta = {
-    maintainers = lib.teams.ngi.members;
-  };
-
-  nodes = {
-    server =
-      { config, lib, ... }:
-      {
-        services.omnom = {
-          enable = true;
-          openFirewall = true;
-
-          port = servicePort;
-
-          settings = {
-            app = {
-              disable_signup = false; # restrict CLI user-creation
-              results_per_page = 50;
-            };
-            server.address = "0.0.0.0:${toString servicePort}";
-          };
-        };
-      };
-  };
-
-  # TODO: take a snapshot
-  testScript =
-    { nodes, ... }:
-    # python
-    ''
-      server.start()
-      server.wait_for_unit("omnom.service")
-      server.wait_for_open_port(${toString servicePort})
-      server.succeed("curl -sf http://localhost:${toString servicePort}")
-    '';
-}
diff --git a/nixos/tests/omnom/config.nix b/nixos/tests/omnom/config.nix
new file mode 100644
index 000000000000..55c2cca56f2e
--- /dev/null
+++ b/nixos/tests/omnom/config.nix
@@ -0,0 +1,36 @@
+{ config, pkgs, ... }:
+{
+  services.omnom = {
+    enable = true;
+    openFirewall = true;
+
+    port = 9090;
+
+    settings = {
+      app = {
+        disable_signup = false; # restrict CLI user-creation
+        results_per_page = 50;
+      };
+      server.address = "0.0.0.0:${toString config.services.omnom.port}";
+    };
+  };
+
+  programs.firefox = {
+    enable = true;
+    # librewolf allows installations of unsigned extensions
+    package = pkgs.wrapFirefox pkgs.librewolf-unwrapped {
+      nixExtensions = [
+        (
+          let
+            # specified in manifest.json of the addon
+            extid = "{f0bca7ce-0cda-41dc-9ea8-126a50fed280}";
+          in
+          pkgs.runCommand "omnom" { passthru = { inherit extid; }; } ''
+            mkdir -p $out
+            cp ${pkgs.omnom}/share/addons/omnom_ext_firefox.zip $out/${extid}.xpi
+          ''
+        )
+      ];
+    };
+  };
+}
diff --git a/nixos/tests/omnom/default.nix b/nixos/tests/omnom/default.nix
new file mode 100644
index 000000000000..6f115037aca5
--- /dev/null
+++ b/nixos/tests/omnom/default.nix
@@ -0,0 +1,105 @@
+{ config, pkgs, ... }:
+{
+  name = "Basic Omnom Test";
+  meta = {
+    inherit (pkgs.omnom.meta) maintainers;
+  };
+
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        imports = [
+          ../common/x11.nix
+          ./config.nix
+        ];
+
+        environment.systemPackages = [ pkgs.xdotool ];
+      };
+  };
+
+  testScript =
+    let
+      port = toString config.nodes.server.services.omnom.port;
+    in
+    # python
+    ''
+      import re
+
+      def open_omnom():
+        # Add-ons Manager
+        server.succeed("xdotool mousemove --sync 960 90 click 1")
+        server.sleep(10)
+        # omnom
+        server.succeed("xdotool mousemove --sync 700 190 click 1")
+        server.sleep(10)
+
+
+      service_url = "http://127.0.0.1:${toString port}"
+
+      server.start()
+      server.wait_for_unit("omnom.service")
+      server.wait_for_open_port(${toString port})
+      server.succeed(f"curl -sf '{service_url}'")
+
+      output = server.succeed("omnom create-user user user@example.com")
+      match = re.search(r"Visit (.+?) to sign in", output)
+      assert match is not None, "Login URL not found"
+      login_url = match[1].replace("0.0.0.0", "127.0.0.1")
+
+      output = server.succeed("omnom create-token user addon")
+      match = re.search(r"Token (.+?) created", output)
+      assert match is not None, "Addon token not found"
+      token = match[1]
+
+      server.wait_for_x()
+      server.succeed(f"librewolf --new-window '{login_url}' >&2 &")
+      server.wait_for_window("Omnom")
+
+      open_omnom()
+
+      # token
+      server.succeed("xdotool mousemove --sync 700 350 click 1")
+      server.succeed(f"xdotool type {token}")
+      server.sleep(10)
+
+      # url
+      server.succeed("xdotool mousemove --sync 700 470 click 1")
+      server.succeed(f"xdotool type '{service_url}'")
+      server.sleep(10)
+
+      # submit
+      server.succeed("xdotool mousemove --sync 900 520 click 1")
+      server.sleep(10)
+
+      open_omnom()
+
+      # save
+      server.succeed("xdotool mousemove --sync 900 520 click 1")
+      server.sleep(10)
+
+      # refresh
+      server.succeed("xdotool mousemove --sync 100 80 click 1")
+      server.sleep(10)
+
+      server.screenshot("home.png")
+
+      # view bookmarks
+      server.succeed("xdotool mousemove --sync 300 130 click 1")
+      server.sleep(10)
+
+      # view snapshot
+      server.succeed("xdotool mousemove --sync 970 230 click 1")
+      server.sleep(10)
+      server.succeed("xdotool mousemove --sync 160 340 click 1")
+      server.sleep(10)
+
+      server.screenshot("screenshot.png")
+
+      # view details
+      server.succeed("xdotool mousemove --sync 290 200 click 1")
+      server.sleep(10)
+
+      server.screenshot("snapshot_details.png")
+    '';
+}
diff --git a/nixos/tests/owi.nix b/nixos/tests/owi.nix
new file mode 100644
index 000000000000..74e9d2d394fd
--- /dev/null
+++ b/nixos/tests/owi.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "owi";
+
+  meta.maintainers = with lib.maintainers; [ ethancedwards8 ];
+
+  nodes.machine = {
+    environment.systemPackages = with pkgs; [ owi ];
+
+    environment.etc."owipass.rs".source = pkgs.writeText "owi.rs" ''
+      use owi_sym::Symbolic;
+
+      fn mean_one(x: i32, y: i32) -> i32 {
+          (x + y)/2
+      }
+
+      fn mean_two(x: i32, y: i32) -> i32 {
+          (y + x)/2
+      }
+
+      fn main() {
+          let x = i32::symbol();
+          let y = i32::symbol();
+          // proving the commutative property of addition!
+          owi_sym::assert(mean_one(x, y) == mean_two(x, y))
+      }
+    '';
+
+    environment.etc."owifail.rs".source = pkgs.writeText "owi.rs" ''
+      use owi_sym::Symbolic;
+
+      fn mean_wrong(x: i32, y: i32) -> i32 {
+          (x + y) / 2
+      }
+
+      fn mean_correct(x: i32, y: i32) -> i32 {
+          (x & y) + ((x ^ y) >> 1)
+      }
+
+      fn main() {
+          let x = i32::symbol();
+          let y = i32::symbol();
+          owi_sym::assert(mean_wrong(x, y) == mean_correct(x, y))
+      }
+    '';
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      # testing
+      machine.succeed("owi rust --fail-on-assertion-only /etc/owipass.rs")
+      machine.fail("owi rust --fail-on-assertion-only /etc/owifail.rs")
+    '';
+}
diff --git a/nixos/tests/searx.nix b/nixos/tests/searx.nix
index 6cbc878df2c8..18199e6db3ed 100644
--- a/nixos/tests/searx.nix
+++ b/nixos/tests/searx.nix
@@ -28,7 +28,7 @@
         server = {
           port = "8080";
           bind_address = "0.0.0.0";
-          secret_key = "@SEARX_SECRET_KEY@";
+          secret_key = "$SEARX_SECRET_KEY";
         };
       };
     };
diff --git a/nixos/tests/tlsrpt.nix b/nixos/tests/tlsrpt.nix
index d93ac78b5240..92a7d0cda78e 100644
--- a/nixos/tests/tlsrpt.nix
+++ b/nixos/tests/tlsrpt.nix
@@ -35,7 +35,7 @@
 
     # Enabling postfix should put sendmail as the sendmail setting
     machine.succeed("grep -q sendmail_script=sendmail /etc/tlsrpt/reportd.cfg")
-    machine.succeed("systemctl show --property SupplementaryGroups postfix.service | grep tlsrpt")
+    machine.succeed("getent group tlsrpt | grep -q postfix")
 
     machine.log(machine.succeed("systemd-analyze security tlsrpt-collectd.service tlsrpt-reportd.service | grep -v ✓"))
   '';
diff --git a/pkgs/applications/editors/greenfoot/default.nix b/pkgs/applications/editors/greenfoot/default.nix
index a88ab68cef87..4b1ff0007b45 100644
--- a/pkgs/applications/editors/greenfoot/default.nix
+++ b/pkgs/applications/editors/greenfoot/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${openjdk}/bin/java $out/bin/greenfoot \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "-Dawt.useSystemAAFontSettings=on -Xmx512M \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp -Xmx512M \
                    --add-opens javafx.graphics/com.sun.glass.ui=ALL-UNNAMED \
                    -cp $out/share/greenfoot/boot.jar bluej.Boot \
                    -greenfoot=true -bluej.compiler.showunchecked=false \
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 09a6e442549e..eaf0cc7f1b59 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2045,8 +2045,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.33.2";
-          hash = "sha256-28J1PxqJgULkbO49gjMyJf79pSlN1ZeN9vN5clJ2wYo=";
+          version = "6.35.0";
+          hash = "sha256-stSo+GHhEzIE1HevACEUmum9tNetMIfpz0t8330QlTI=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -4403,8 +4403,8 @@ let
         mktplcRef = {
           publisher = "sonarsource";
           name = "sonarlint-vscode";
-          version = "4.26.0";
-          hash = "sha256-Mru3dz0Dl/oDHd0tB/0Ixd+EselC+e70Cn7sdu1gkwk=";
+          version = "4.27.0";
+          hash = "sha256-0BqIJL9Vyccjsov1JQil3dRUdo9w8ecOUotVKzBlYGQ=";
         };
         meta.license = lib.licenses.lgpl3Only;
       };
diff --git a/pkgs/applications/graphics/processing/default.nix b/pkgs/applications/graphics/processing/default.nix
index 401e9881032b..65e28fec764a 100644
--- a/pkgs/applications/graphics/processing/default.nix
+++ b/pkgs/applications/graphics/processing/default.nix
@@ -131,11 +131,11 @@ stdenv.mkDerivation rec {
     makeWrapper $out/share/${pname}/processing $out/bin/processing \
       ''${gappsWrapperArgs[@]} \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
-      --prefix _JAVA_OPTIONS " " -Dawt.useSystemAAFontSettings=lcd
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
     makeWrapper $out/share/${pname}/processing-java $out/bin/processing-java \
       ''${gappsWrapperArgs[@]} \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
-      --prefix _JAVA_OPTIONS " " -Dawt.useSystemAAFontSettings=lcd
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/misc/ganttproject-bin/default.nix b/pkgs/applications/misc/ganttproject-bin/default.nix
index f50aff51f579..0065eac9c8d5 100644
--- a/pkgs/applications/misc/ganttproject-bin/default.nix
+++ b/pkgs/applications/misc/ganttproject-bin/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       };
 
       javaOptions = [
-        "-Dawt.useSystemAAFontSettings=on"
+        "-Dawt.useSystemAAFontSettings=gasp"
       ];
 
     in
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
       mkdir -pv "$out/bin"
       wrapProgram "$out/share/ganttproject/ganttproject" \
         --set JAVA_HOME "${jre}" \
-        --set _JAVA_OPTIONS "${builtins.toString javaOptions}"
+        --prefix _JAVA_OPTIONS " " "${builtins.toString javaOptions}"
 
       mv -v "$out/share/ganttproject/ganttproject" "$out/bin"
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 3902cc789074..654be090912b 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -18,13 +18,13 @@
     "vendorHash": null
   },
   "acme": {
-    "hash": "sha256-/EY9I0o8vlc+J2KvMwCXApFwDfJuA0NqYraugnJ7tcM=",
+    "hash": "sha256-GHS8CRu89cd6RMMbEB8ct27w2w4lWdKTbvoihaVpexQ=",
     "homepage": "https://registry.terraform.io/providers/vancluever/acme",
     "owner": "vancluever",
     "repo": "terraform-provider-acme",
-    "rev": "v2.32.1",
+    "rev": "v2.34.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-eaDEZyweUL9D1e2BhOQJy4ewSWJry7DmXiYzQgBqEes="
+    "vendorHash": "sha256-tGfA5LMXECGsu5BIIeMb1+ze7T84Gyrn4h+IzcI79OA="
   },
   "age": {
     "hash": "sha256-bJrzjvkrCX93bNqCA+FdRibHnAw6cb61StqtwUY5ok4=",
@@ -36,13 +36,13 @@
     "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
   },
   "aiven": {
-    "hash": "sha256-TJWa1vGYfC8mSzOdMI0WKU8ZXkm26pZKyoXLfAJVehQ=",
+    "hash": "sha256-36gEDXAZgeniGe6zCmfLkVj0yxYfSk11tmk61cWly04=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.42.0",
+    "rev": "v4.43.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-pQMQvJ/T6adUydIu6vRvSxaeEry22wYmIzY3ryPncJc="
+    "vendorHash": "sha256-jZ950/nPFt3+t3CHsNEkYo7POabRCHVvcfu04Iq3cJc="
   },
   "akamai": {
     "hash": "sha256-JALEVzmBVmHtCG4B1jNeNdSWb+SGZWDSZgUQ5voMQPg=",
@@ -54,11 +54,11 @@
     "vendorHash": "sha256-sf6gCPsKnBVjMsCw7ZA4BKt9GAGtAcgU7vRZN8xzN9Q="
   },
   "alicloud": {
-    "hash": "sha256-RSZaZ8+m+e2ZbJIcv9In0HJRhuk1rTGmMcUT0hTqwHA=",
+    "hash": "sha256-HXrE/EsxTPH6lO2jpxz9Mkr6/eSodfLK9Akpv6wGUK0=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.252.0",
+    "rev": "v1.253.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Ww4l3ffnx0CB+wnQfaiHI+25JtnNsGaTCsmXfd54R4g="
   },
@@ -216,13 +216,13 @@
     "vendorHash": "sha256-r4Q7b7ZzK+ZDXhIabTSgP7HY5Q51Hz5ErnW+nV+ZIqA="
   },
   "buildkite": {
-    "hash": "sha256-oc6zIV2czDE1rPjCAFLxJ0OJ9ChNi7rd2cfT1NEDwfk=",
+    "hash": "sha256-XhO780RsMUx5J/GJ8xcFjN97b6XJ8eHuQjOQiuFUWHY=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.21.0",
+    "rev": "v1.22.1",
     "spdx": "MIT",
-    "vendorHash": "sha256-PzKn6QxmsD7p1WjKsXnETipDMs1QdbmWyrIV05JSNlo="
+    "vendorHash": "sha256-UgGfLh7kDOQK/EwuHQM0HoAaN95WyPWwypGPboPY9+s="
   },
   "ccloud": {
     "hash": "sha256-Dpx0eugcHCJV8GNPqjxx4P9ohgJgB10DTnHr+CeN/iQ=",
@@ -261,13 +261,13 @@
     "vendorHash": "sha256-shRiTPn4A1rmwBnoSlRDfdYuHqSFvL4o6o8vAJutu3Q="
   },
   "cloudflare": {
-    "hash": "sha256-RChYMs2i4E+7RqRnYfeQftETUyHMWh/UeUd4/6kNmag=",
+    "hash": "sha256-GCyynAWMTVbZ58XLpFF8JkFDhdGwavg3VpYtzy6NdOg=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.6.0",
+    "rev": "v5.7.1",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-BecQ41WKBb+w3eWGH3U/h6GjIKceCB+xDSzQSqrqJ2k="
+    "vendorHash": "sha256-erBpARE/YlmD8RjlV3uBE0S8NyH/WR5rmsiY6gO9mSQ="
   },
   "cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
@@ -326,13 +326,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-u+iiWStjO2OFMkQp8Skynb4seTK61ETSKrEP+6o16LA=",
+    "hash": "sha256-BywMGXd6UedyjcVjT0SUq9D+1FpgR9yvas/vWdkLmW8=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.67.0",
+    "rev": "v3.68.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-fLdJxYuN4p0ZwXUXcN6BtATcwVg9asgdjHg9nOPcxK4="
+    "vendorHash": "sha256-AQ+/+NCBBj4ptBGHJmibH6QZo4560dRRbs55SqY9buE="
   },
   "deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -363,11 +363,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "digitalocean": {
-    "hash": "sha256-XUwHBwxkOG4oK0W1IcvIWgov3AShMmeYPoc0gu6YEwY=",
+    "hash": "sha256-+JX1EJBRJee6nvn5srwGWSE++LagHw+n1bgfZTBXzKU=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.57.0",
+    "rev": "v2.60.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -390,13 +390,13 @@
     "vendorHash": "sha256-xu5t7VaLvbwo/Q7Xb4mkNt7UjU+hzfk7NgfFlxwbIhU="
   },
   "dnsimple": {
-    "hash": "sha256-7o8shnWECaCLTCvmXrJ2eYloxtln2A2No8OK8Ig36qE=",
+    "hash": "sha256-Zx4M0TKamyfm5Z5EAtiHWQQTNX/VT0EkAaHM7x/2SGk=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v1.9.1",
+    "rev": "v1.10.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0axKIqF1t4AW1PPi+fHfsFQLRrjhpsloQIZ9clR+8Gc="
+    "vendorHash": "sha256-M6Z/wMOKhQncuHAhkSPfWT77b14lIZ/sVQT7DmM60FI="
   },
   "docker": {
     "hash": "sha256-THMGfpRrPFReRdYusdrJGnUKEUtxy4Pu+HdcceK2FNc=",
@@ -516,22 +516,22 @@
     "vendorHash": "sha256-G325isVj6JKs58i59V/A51vE8mzgxk/1EqSVvb6TiH4="
   },
   "google": {
-    "hash": "sha256-i3gKrK5EcIQbVwJI7sfRam3H0mideGO1VgPuzL4l+Xw=",
+    "hash": "sha256-la+jN1muZqAqgR2emDhB71L01gAVtH60OLZ199h6Cq0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v6.40.0",
+    "rev": "v6.44.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-YZI6zhxXU2aABARP6GcTMeU98F4+imbL1vKIEMzsJHM="
+    "vendorHash": "sha256-s5tShmcGeY/PivF2soP0PWZp9MlqYt9yvsjrNArqYGk="
   },
   "google-beta": {
-    "hash": "sha256-DPvZzEAFrQaHwaIRbQoVsZpc1xEhgd3HvO6qF8uwBgE=",
+    "hash": "sha256-FmVPRx7EWPUT38IKKnmPf96FJGHj8FUzNzfYzCm2UeA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v6.42.0",
+    "rev": "v6.43.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-RTcJIBbeoVX5iZ9kNHnsJHRMKXrizVDtd+Hbh4ZWAFo="
+    "vendorHash": "sha256-dvmv7tOY89Gft0qdb33mX90gD7WX/hhPkUSBogMevPA="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -543,11 +543,11 @@
     "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
   },
   "grafana": {
-    "hash": "sha256-c/ed8oLmpwE3UjUpwc06O65PItX/3VzuVbn3pzzmrbI=",
+    "hash": "sha256-qa5ynLx77SEAgJzRHPAj2VtX2ryYpYA2JCH56aZOKuA=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v3.25.6",
+    "rev": "v3.25.9",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-QTcWJlwE6s4nEPSg6svzIhsJo9p9rk1gQiSr4qSTfns="
   },
@@ -624,11 +624,11 @@
     "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
   },
   "huaweicloud": {
-    "hash": "sha256-jXppJtVMPpipXbEhgenVtFP5YxwlQzekquRoZmgoP0Q=",
+    "hash": "sha256-hop7Uv/llV5oUYXZy5dC4YdMDD3BIBz56aHoB/m8ktI=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.76.4",
+    "rev": "v1.76.5",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -714,13 +714,13 @@
     "vendorHash": "sha256-5cqj1O57snU+NoVqmWc/KIGnowQNMww+rJxYfIPvHWU="
   },
   "keycloak": {
-    "hash": "sha256-DqGM7nmblbt0sD5dKzQ7URL9LYbaMSfP01nrjEwyado=",
+    "hash": "sha256-IgSc6GhXpyH1LCElGALMmEE7MACTvwOzLLQgWl5qEcc=",
     "homepage": "https://registry.terraform.io/providers/keycloak/keycloak",
     "owner": "keycloak",
     "repo": "terraform-provider-keycloak",
-    "rev": "v5.2.0",
+    "rev": "v5.3.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-I1e1/Qr/22zAXDcEmfx7BHqKVUl8tcomqBk7SQv8aR4="
+    "vendorHash": "sha256-n78cEI1JKtPKZmNnAHykt9oRixZUjddpAIWD3ct3e1c="
   },
   "kubectl": {
     "hash": "sha256-UQ/xvhs7II+EGH5bKdrVC47hp5dhLqQZeqSBz06ho1s=",
@@ -822,31 +822,31 @@
     "vendorHash": "sha256-QxbZv6YMa5/I4bTeQBNdmG3EKtLEmstnH7HMiZzFJrI="
   },
   "migadu": {
-    "hash": "sha256-91aWxh7q1q46FaORwgZJ9Aqm/xrF7hLjqbKB9PZD5Ts=",
+    "hash": "sha256-3q9vhHt4VDqcIYHEZjJY0whvGPQWMDHkGsAQEES8EkE=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2025.6.19",
+    "rev": "2025.7.17",
     "spdx": "0BSD",
-    "vendorHash": "sha256-eAPRtvpaVBirZ5WwmUi53S8oCKCrZyZNHiak76whLuQ="
+    "vendorHash": "sha256-oipY2hwgRrntCxxHPyH06e8p+0fKfAQwhh2iBI4RGHQ="
   },
   "minio": {
-    "hash": "sha256-q5qpzrkQpT8dkcir7UdadbiLSf2bJry1HjQzMUp6xGw=",
+    "hash": "sha256-DRWzgVp01qTvyf30GgxWx9/RvjAfoNu3SXZQVQ1jYa0=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.5.4",
+    "rev": "v3.6.1",
     "spdx": "AGPL-3.0",
     "vendorHash": "sha256-QWBzQXx/dzWZr9dn3LHy8RIvZL1EA9xYqi7Ppzvju7g="
   },
   "mongodbatlas": {
-    "hash": "sha256-qoGhHEWhkznrC2G0Rv0/6dPLSjJzME6bz8Ffc3zXDII=",
+    "hash": "sha256-ZmQw87cBWt8bfLTkeEAopVBEoLCvyAXb001mWK6SnZE=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.37.0",
+    "rev": "v1.38.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-fCor4fuOnOmxvAgejaQyH44FyuQULdXm0GBlffVZxok="
+    "vendorHash": "sha256-r874TWc0OCXMin2VYHmOSg4sBjIgCxJUiykw+A7oMsk="
   },
   "namecheap": {
     "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
@@ -976,13 +976,13 @@
     "vendorHash": "sha256-ke7Dd3I/6Mja8SzrDy/f4GGgcB3C9xpCT4KiCr0PNZw="
   },
   "opentelekomcloud": {
-    "hash": "sha256-u2bKqEPsytjYU5NeY7NZmDemHA4hgqSn8fKiJxwCNKI=",
+    "hash": "sha256-HbtNk5UAr+q09mOICkKzh9wIP0HM9MFVVR6gEIBdnvs=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.42",
+    "rev": "v1.36.43",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-lgz2WH6vuwjC6tpkVDAneLcXLZSwNfJnd/xRXyLW1b4="
+    "vendorHash": "sha256-9ese4fUPQifxbvcK6QiSIet++WFaK9XuyBv6oJiIOGA="
   },
   "openwrt": {
     "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@@ -1012,11 +1012,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-X2u/JSm1JhIxvW5F/8QQqhlVdmAUvP/2Ux5QxmfKejI=",
+    "hash": "sha256-L4ZqC11Uz7DhzAxcGfCfOEf3s9Fg+YFVa3Imy9GuYBU=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.26.3",
+    "rev": "v3.27.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1093,11 +1093,11 @@
     "vendorHash": "sha256-j+3qtGlueKZgf0LuNps4Wc9G3EmpSgl8ZNSLqslyizI="
   },
   "rancher2": {
-    "hash": "sha256-5NkvGETjJ5eoZC5Ohnoq2y1DQVs2WTrh/wEVO1HQsOA=",
+    "hash": "sha256-vRZdNxtuXAoCbc7QFL1IAPokug8perRRk/PfRpZJDUQ=",
     "homepage": "https://registry.terraform.io/providers/rancher/rancher2",
     "owner": "rancher",
     "repo": "terraform-provider-rancher2",
-    "rev": "v7.2.0",
+    "rev": "v7.3.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-M2lJKmIR66lQKFkInjizn68ax2Gq4sim5Y3vZKyDhZ8="
   },
@@ -1156,13 +1156,13 @@
     "vendorHash": "sha256-HKmIl/GjGJZmhWLrK3lMjYo1F5nmo+U9ZpvBo5hDH/0="
   },
   "scaleway": {
-    "hash": "sha256-3MLtSOcMCIl3pFJH/xKK/fPQcRrW2Nx4b2jCZiUE2aw=",
+    "hash": "sha256-rSchMweT5Hxz2tpX6V7cBzntJzIeFB46bjV9lkaIWAQ=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.56.0",
+    "rev": "v2.57.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-EmLIBIyZ52iWua3c69m8JCQKsj8qykuGjo6Tf8Y+sM8="
+    "vendorHash": "sha256-p9rESR1A1SEYlvjf8du2j2yAlI39LsMRcPvyyJIwWdg="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1183,13 +1183,13 @@
     "vendorHash": "sha256-uMZIze8sng80sCb6f9CsWHVMmUGMaaOD4Ezx9B2fAJ4="
   },
   "sentry": {
-    "hash": "sha256-/rulw49DcAi5tk4j6XpvlG0X6HJgcMI+zotKsFU2MmI=",
+    "hash": "sha256-b5a0++mu6roN6VuJaBZEczfqA6Stt+a7fTOLGLvqPeQ=",
     "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
     "owner": "jianyuan",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.14.5",
+    "rev": "v0.14.6",
     "spdx": "MIT",
-    "vendorHash": "sha256-OurLZioO4zEBwsOyeUhv2KpQZEPySJn7I65w2rmvUn8="
+    "vendorHash": "sha256-67xoILi88FEN005tk8Z3ggc3ggfuS1AHthYglqvOLE4="
   },
   "shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",
@@ -1201,13 +1201,13 @@
     "vendorHash": "sha256-MIO0VHofPtKPtynbvjvEukMNr5NXHgk7BqwIhbc9+u0="
   },
   "signalfx": {
-    "hash": "sha256-8G+IYK3vt6kyNtccmuz0OtTWvZPH8p9kWSY0guAdASo=",
+    "hash": "sha256-EoehHn7j3nnXzpHEjX4FQSO1na9xSmVpnTiPnTqUrpE=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v9.16.0",
+    "rev": "v9.17.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1iRf42VxhKvmmasQ3IaPBbLcRmB8SavFXzwXlmFwYfU="
+    "vendorHash": "sha256-404/DlCtz0yAaM8zJ3ngJ2/DwoUJImjIqKYwdigHl4U="
   },
   "skytap": {
     "hash": "sha256-JII4czazo6Di2sad1uFHMKDO2gWgZlQE8l/+IRYHQHU=",
@@ -1246,22 +1246,22 @@
     "vendorHash": "sha256-4gtM8U//RXpYc4klCgpZS/3ZRzAHfcbOPTnNqlX4H7M="
   },
   "spacelift": {
-    "hash": "sha256-lBt1ZtQ5pxX/t4b264LzQwajXDozE9veYOOV3lhfTZQ=",
+    "hash": "sha256-qz7rOdjC3H+Qu0FXqPG91AlGozhQVPAVow/ZrJHgZ+E=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.25.0",
+    "rev": "v1.27.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-Tft0YjNUtwDH0SliSseXHqMKB2yzQTsAG1Wfc5ihpvE="
+    "vendorHash": "sha256-D8VG9CWP4wo+cxb/ewP+b6qAeaBCu6lNwH2leoiBMAc="
   },
   "spotinst": {
-    "hash": "sha256-BDg9ttK3hDewGPPYVa84uKITMPGHNLO11Yk9juhHr1M=",
+    "hash": "sha256-GU0r4mdV3pv7uv2r/GkDVhvTyHA3lsxd3npSaYdA1Kw=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.221.0",
+    "rev": "v1.224.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QXIKjBV19mGdiqFTpoilegMRQ8b1QeCi3TG6ImYydtU="
+    "vendorHash": "sha256-vY8ii9HtItuNmbX1ij/orH7RmVV6OhIbKV0VEjQpaig="
   },
   "ssh": {
     "hash": "sha256-1UN5QJyjCuxs2vQYlSuz2jsu/HgGTxOoWWRcv4qcwow=",
@@ -1291,13 +1291,13 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic": {
-    "hash": "sha256-7UjfkRCYay2bHUrnvLbadjSeCrhm6w6RzvRtUznpTDA=",
+    "hash": "sha256-+/evQ3bpgvjTjRD7BT90rkJtMYPddf95p/MP8QxL5xI=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.1.0",
+    "rev": "v3.1.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jGGdSKXpg/N80lNsHFt1nU1t3oW5uDphGYHhBZmAgxE="
+    "vendorHash": "sha256-IR6KjFW5GbsOIm3EEFyx3ctwhbifZlcNaZeGhbeK/Wo="
   },
   "sysdig": {
     "hash": "sha256-RGHf1JpcPP6VMPZSvj3HsL4Z7EnJKv5Y0T+tSk2hauc=",
@@ -1336,11 +1336,11 @@
     "vendorHash": "sha256-PVN3oPT3cxsnWH03twbPSIIERGHCp3XAmcqrQAOULZ4="
   },
   "tencentcloud": {
-    "hash": "sha256-MMmBhzhD5SPvTJPzuxAPEmE2ydcwVH4cYAx21ze/umk=",
+    "hash": "sha256-oHvmCNgGguKdu/LbTyRG/vl9+xGan1vR6T9Ej5MX9l4=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.5",
+    "rev": "v1.82.11",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/terminal-emulators/st/mcaimi-st.nix b/pkgs/applications/terminal-emulators/st/mcaimi-st.nix
deleted file mode 100644
index 972b6523df16..000000000000
--- a/pkgs/applications/terminal-emulators/st/mcaimi-st.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fontconfig,
-  libX11,
-  libXext,
-  libXft,
-  ncurses,
-  pkg-config,
-}:
-
-stdenv.mkDerivation {
-  pname = "mcaimi-st";
-  version = "0.pre+unstable=2021-08-30";
-
-  src = fetchFromGitHub {
-    owner = "mcaimi";
-    repo = "st";
-    rev = "1a8cad03692ee6d32c03a136cdc76bdb169e15d8";
-    hash = "sha256-xyVEvD8s1J9Wj9NB4Gg+0ldvde7M8IVpzCOTttC1IY0=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-  buildInputs = [
-    fontconfig
-    libX11
-    libXext
-    libXft
-    ncurses
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    TERMINFO=$out/share/terminfo make install PREFIX=$out
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/gnotclub/xst";
-    description = "Suckless Terminal fork";
-    mainProgram = "st";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index 7296265b84f0..4be39c483282 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -1,56 +1,56 @@
 {
   "stable": {
     "linux": {
-      "version": "8.11.0",
+      "version": "8.11.2",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.0.x64.tar.gz",
-          "hash": "sha256-aE7AQPzgMNZh++HOFduT4c7qipEvjUdQ9sBH8epuXeE="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.2.x64.tar.gz",
+          "hash": "sha256-2yYzUO/ZdB/BA3wT+2fKM0ZzJzBpVH/N5xaIg50lzzo="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.0.arm64.tar.gz",
-          "hash": "sha256-5jmMolrISZaoqsGEYhsTxlKgAZk+RdVUOBMQDIn9nFM="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.2.arm64.tar.gz",
+          "hash": "sha256-slKgf7ahA6pFBR2V9L8mI7ROisARRY7M4IjB1UYhwvU="
         }
       }
     },
     "darwin": {
-      "version": "8.11.0",
+      "version": "8.11.2",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.0-x86_64.zip",
-          "hash": "sha256-bZoX7mxh7JqYKgPQGUjrWEFYKGjl7dzhpL/CIt5IY00="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.2-x86_64.zip",
+          "hash": "sha256-jcfSjcAajkgRQP0JA//f4Ltc62nDeISFZxYuGObFMKA="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.0-aarch64.zip",
-          "hash": "sha256-I88nfsb1xsErgafmo0qqSHcalhTMkGH9m0bMWAGlad8="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.2-aarch64.zip",
+          "hash": "sha256-pdnEhTJCSod/VnbKVvCEqQzNjGwDPz28Or97+jLSwJk="
         }
       }
     }
   },
   "beta": {
     "linux": {
-      "version": "8.11.2-18.BETA",
+      "version": "8.11.4-21.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.2-18.BETA.x64.tar.gz",
-          "hash": "sha256-/8sXdF1JmJX3kFOn9SCRz6Cr/ZldzHfhvq1oJlV19v8="
+          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.4-21.BETA.x64.tar.gz",
+          "hash": "sha256-HWPeTCtjHH8vngDX0+tGbiDMj1FoW8a4RCu34RqJXmI="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.2-18.BETA.arm64.tar.gz",
-          "hash": "sha256-bDRJAU6LgkoHp1Fi/KQPm/Fe/BkGt7V+dGVnLh9awcs="
+          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.4-21.BETA.arm64.tar.gz",
+          "hash": "sha256-yPjzweuJPvvOkJcIElaAogzBpWPvYch6DQarRoaZojc="
         }
       }
     },
     "darwin": {
-      "version": "8.11.2-18.BETA",
+      "version": "8.11.4-21.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.2-18.BETA-x86_64.zip",
-          "hash": "sha256-oZqrNB49SR8UWh8qXnKi/xlT/b2YUxPCLpz2tjwzzuw="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.4-21.BETA-x86_64.zip",
+          "hash": "sha256-FozwWYQCrqWbfw9qaPRLbaUVWa5hTwG3NHjtZc4smdk="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.2-18.BETA-aarch64.zip",
-          "hash": "sha256-+EXrqEe3cDp9Ez8iug53HhSTtz0tDYsUXHAsXtRHGH4="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.4-21.BETA-aarch64.zip",
+          "hash": "sha256-0eXtLqknEPG+G+mxa7QYWkUVPu13/KAdkOb9fklZIqg="
         }
       }
     }
diff --git a/pkgs/by-name/_1/_1password-gui/update.sh b/pkgs/by-name/_1/_1password-gui/update.sh
index 07fc726e2f74..b4a2fb91f1f2 100755
--- a/pkgs/by-name/_1/_1password-gui/update.sh
+++ b/pkgs/by-name/_1/_1password-gui/update.sh
@@ -37,6 +37,7 @@ read_local_versions() {
 
 read_remote_versions() {
   local channel="$1"
+  local darwin_beta_maybe
 
   if [[ ${channel} == "stable" ]]; then
     remote_versions["stable/linux"]=$(
@@ -56,10 +57,17 @@ read_remote_versions() {
         | "${JQ[@]}" '.[] | select(.repo == "aur" and .srcname == "1password-beta") | .version | sub("_"; "-")'
     )
 
-    remote_versions["beta/darwin"]=$(
+    # Handle macOS Beta app-update feed quirk.
+    # If there is a newer release in the stable channel, queries for beta
+    # channel will return the stable channel version; masking the current beta.
+    darwin_beta_maybe=$(
       "${CURL[@]}" "${APP_UPDATES_URI_BASE}/Y" \
         | "${JQ[@]}" 'select(.available == "1") | .version'
     )
+    # Only consider versions that end with '.BETA'
+    if [[ ${darwin_beta_maybe} =~ \.BETA$ ]]; then
+      remote_versions["beta/darwin"]=${darwin_beta_maybe}
+    fi
   fi
 }
 
@@ -98,9 +106,12 @@ for i in "${!remote_versions[@]}"; do
   fi
 done
 
-if [[ ${#new_version_available[@]} -eq 0 ]]; then
-  # up to date
-  exit
+num_updates=${#new_version_available[@]}
+if (( num_updates == 0 )); then
+  exit # up to date
+elif (( num_updates == 1 )); then
+  os=$(cut -d / -f 2 <<<"${new_version_available[@]}")
+  os_specific_update=" (${os} only)"
 fi
 
 ./update-sources.py "${new_version_available[@]}"
@@ -109,7 +120,7 @@ cat <<EOF
   {
     "attrPath": "${attr_path}",
     "oldVersion": "${old_version}",
-    "newVersion": "${new_version}",
+    "newVersion": "${new_version}${os_specific_update-}",
     "files": [
       "$PWD/sources.json"
     ]
diff --git a/pkgs/by-name/ab/abiword/package.nix b/pkgs/by-name/ab/abiword/package.nix
index aaac2f39a4f1..08a8ced24788 100644
--- a/pkgs/by-name/ab/abiword/package.nix
+++ b/pkgs/by-name/ab/abiword/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  autoreconfHook269,
+  autoreconfHook,
   autoconf-archive,
   pkg-config,
   gtk3,
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    autoreconfHook269
+    autoreconfHook
     autoconf-archive
     pkg-config
     wrapGAppsHook3
diff --git a/pkgs/by-name/al/alacritty-theme/package.nix b/pkgs/by-name/al/alacritty-theme/package.nix
index df06e6abf25e..e441805d46c3 100644
--- a/pkgs/by-name/al/alacritty-theme/package.nix
+++ b/pkgs/by-name/al/alacritty-theme/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (self: {
   pname = "alacritty-theme";
-  version = "0-unstable-2025-05-15";
+  version = "0-unstable-2025-07-16";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "59a96ef4c734f97a1aadaa619b31cc1ca90a0fbc";
-    hash = "sha256-7Qu00+odZblXqN9e3uVZWfIWySFT0IiwIyK5wEbtReE=";
+    rev = "6c91a0e913396daafdb7ca43e84014d4e176623c";
+    hash = "sha256-Rq5AB9BktTaCQ1UzUITgu6g5a74C0sHpiiHAjeC1RiA=";
     sparseCheckout = [ "themes" ];
   };
 
diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index 430c563295eb..48da2357d034 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "7.24.0";
+  version = "7.25.0";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-iURIOxRgGCNXJA+9cDb07iwj0b4H8TdX8bPPmM3RjyI=";
+    hash = "sha256-e13en0fQHO0i49gP1zU6ms9TDMAwo1qsubsTi/DdIUo=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index a855ab261d01..56f3ff246ac7 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -63,9 +63,9 @@
 
   confcom = mkAzExtension rec {
     pname = "confcom";
-    version = "1.2.1";
+    version = "1.2.6";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/confcom-${version}-py3-none-any.whl";
-    hash = "sha256-D78WwrOKbc8RNAa9Q3wgZRjVOUy/012+KIlTtk5NeTM=";
+    hash = "sha256-kyJ4AkPcpP/10nf4whJiuraC7hn0E6iBkhRIn43E9J0=";
     description = "Microsoft Azure Command-Line Tools Confidential Container Security Policy Generator Extension";
     nativeBuildInputs = [ autoPatchelfHook ];
     buildInputs = [ openssl_1_1 ];
diff --git a/pkgs/by-name/ba/babeltrace2/package.nix b/pkgs/by-name/ba/babeltrace2/package.nix
index e26811b6a653..91d6c8e35441 100644
--- a/pkgs/by-name/ba/babeltrace2/package.nix
+++ b/pkgs/by-name/ba/babeltrace2/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "babeltrace2";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "efficios";
     repo = "babeltrace";
     rev = "v${version}";
-    hash = "sha256-ppSPly4HR/oemsX069o6VqwSB1AU1mKRwRepwPORf7I=";
+    hash = "sha256-4vqeIwCWEAzsHTdM2S2grF7F4vPqiWTeTEZpxsqf2g8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/be/bee/package.nix b/pkgs/by-name/be/bee/package.nix
index 3ad451df6c4f..4bffa8569d31 100644
--- a/pkgs/by-name/be/bee/package.nix
+++ b/pkgs/by-name/be/bee/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "bee";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "ethersphere";
     repo = "bee";
     rev = "v${version}";
-    hash = "sha256-44mjSeV8imatPpNkRSA5Uewunvkc5j6Eo+gKya+dqzE=";
+    hash = "sha256-Yz23iVYGZ4PS1jbV5zFaCEsQOoAbHBpePml0zp5GSkQ=";
   };
 
-  vendorHash = "sha256-1Hl0tT6ZI3otEdOQw9adipOGcSyZXLbSLC8s7YsFRZA=";
+  vendorHash = "sha256-0czsloD2EhSWKQbj7NJ4IqGgKM9+Vp8gSIhOKWg/onA=";
 
   subPackages = [ "cmd/bee" ];
 
diff --git a/pkgs/by-name/bl/bluej/package.nix b/pkgs/by-name/bl/bluej/package.nix
index 52e46d1f30fd..ff2238a5323a 100644
--- a/pkgs/by-name/bl/bluej/package.nix
+++ b/pkgs/by-name/bl/bluej/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${openjdk}/bin/java $out/bin/bluej \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "-Dawt.useSystemAAFontSettings=on -Xmx512M \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp -Xmx512M \
                    --add-opens javafx.graphics/com.sun.glass.ui=ALL-UNNAMED \
                    -cp $out/share/bluej/boot.jar bluej.Boot"
 
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index e60de5ac2d97..54dc21c11237 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.80.122";
+  version = "1.80.124";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-UQmSZ3Xi96Q6/8Y09L5VaPVJHv7gUXcOyv5Ba35Z80s=";
+      hash = "sha256-K3AlYkAMDz988klsGTqYtvt3tswyLa5PhTdy4f0mU9E=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-Q/m81hCZF8om3Tlxlj77GPiBElJVibJFA/ts7mtN6n8=";
+      hash = "sha256-4WP9uGuFcpW9Z0omqQBDTAjr+XCYa9mXcJGnxcm2inQ=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-BezJ5ZXUBC2itSNUivnqygY8VzzIXM6wb3QSC+LE1uM=";
+      hash = "sha256-vgqYktoVPDOmhibes9ghPcV2cpnyxliKvmELI8Brh0I=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-NN7Anrjym50DRo0qI5bF/XzhssgPuKOhk1CJgMoOq70=";
+      hash = "sha256-hVKuO3sSMc+yQiwHpwgYxfh7tyXHUpcWNQO6o9uf5Ro=";
     };
   };
 
diff --git a/pkgs/by-name/br/brmodelo/package.nix b/pkgs/by-name/br/brmodelo/package.nix
index bcc9e5c2df60..409b2e82cabb 100644
--- a/pkgs/by-name/br/brmodelo/package.nix
+++ b/pkgs/by-name/br/brmodelo/package.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
     # _JAVA_AWT_WM_NONREPARENTING=1.
     makeWrapper ${jdk8}/bin/java $out/bin/brmodelo \
        --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
-       --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on" \
+       --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
        --add-flags "-jar $out/share/java/brModelo.jar"
 
     for size in 16 24 32 48 64 128 256; do
diff --git a/pkgs/by-name/bu/bun/package.nix b/pkgs/by-name/bu/bun/package.nix
index 4b69f29021dc..ceeb62523e3c 100644
--- a/pkgs/by-name/bu/bun/package.nix
+++ b/pkgs/by-name/bu/bun/package.nix
@@ -17,7 +17,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.2.18";
+  version = "1.2.19";
   pname = "bun";
 
   src =
@@ -86,19 +86,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-zKnrUnYrvYHriU/IJ1u6CgZU6BqtMY0ZhphUow83aaI=";
+        hash = "sha256-Z0pIN4NC76rcPCkVlrVzAQ88I4iVj3xEZ42H9vt1mZE=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-G60WcdBboVaWMVynJI7AQ9KbWV/1+xX6hraZwiVdi8U=";
+        hash = "sha256-/P1HHNvVp4/Uo5DinMzSu3AEpJ01K6A3rzth1P1dC4M=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-1/XHbGiaZ/D5pRmDy2EJacwUYhdr2P0BSDwKDBoG9P4=";
+        hash = "sha256-7CE3X3nul26pjI7wn+KnijCkibQxWUd13amCgPexEGQ=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-kOAyqYKuKZxi1kXaxsqqjrALaQkryFAb8TpZDejQmcg=";
+        hash = "sha256-w9PBTppeyD/2fQrP525DFa0G2p809Z/HsTgTeCyvH2Y=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/by-name/ca/capnproto-rust/package.nix b/pkgs/by-name/ca/capnproto-rust/package.nix
index 0cb462c0d63d..01a7e50751e6 100644
--- a/pkgs/by-name/ca/capnproto-rust/package.nix
+++ b/pkgs/by-name/ca/capnproto-rust/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "capnproto-rust";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchCrate {
     crateName = "capnpc";
     inherit version;
-    hash = "sha256-WqzcUnAx/qD50/ZlWlWS4bguTxW+qFj0uFzwsbxHBaw=";
+    hash = "sha256-9Vsr6pRfC8Onqw/Yna2cJl1L70uo3K/C80CztNw0XoQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FtJvm6uUFSHn8lQxEFoWpSZgqomfHYkR3E0kKsV/II4=";
+  cargoHash = "sha256-V92zF75fd5MVz84YnWJONNjxZsA4zHTee1hAPAkoX6k=";
 
   postInstall = ''
     mkdir -p $out/include/capnp
diff --git a/pkgs/by-name/ci/cie-middleware-linux/package.nix b/pkgs/by-name/ci/cie-middleware-linux/package.nix
index 77c9528e4451..e765490f117b 100644
--- a/pkgs/by-name/ci/cie-middleware-linux/package.nix
+++ b/pkgs/by-name/ci/cie-middleware-linux/package.nix
@@ -120,7 +120,7 @@ stdenv.mkDerivation {
     mkdir -p "$out/bin"
     makeWrapper "${jre}/bin/java" "$out/bin/cieid" \
       --add-flags "-Djna.library.path='$out/lib:${libraries}'" \
-      --add-flags '-Dawt.useSystemAAFontSettings=on' \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp" \
       --add-flags "-cp $out/share/cieid/cieid.jar" \
       --add-flags "app.m0rf30.cieid.MainApplication"
 
diff --git a/pkgs/by-name/cl/clojure-lsp/package.nix b/pkgs/by-name/cl/clojure-lsp/package.nix
index 561a18d097f6..9ccd78034f9f 100644
--- a/pkgs/by-name/cl/clojure-lsp/package.nix
+++ b/pkgs/by-name/cl/clojure-lsp/package.nix
@@ -5,6 +5,8 @@
   fetchurl,
   fetchFromGitHub,
   writeScript,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
   testers,
 }:
 
@@ -25,21 +27,11 @@ buildGraalvmNativeImage (finalAttrs: {
     "--features=clj_easy.graal_build_time.InitClojureClasses"
   ];
 
-  doCheck = true;
-  checkPhase = ''
-    runHook preCheck
-
-    export HOME="$(mktemp -d)"
-    ./clojure-lsp --version | fgrep -q '${finalAttrs.version}'
-
-    runHook postCheck
-  '';
-
-  passthru.tests.version = testers.testVersion {
-    inherit (finalAttrs) version;
-    package = finalAttrs.finalPackage;
-    command = "clojure-lsp --version";
-  };
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook
+    versionCheckHook
+  ];
 
   passthru.updateScript = writeScript "update-clojure-lsp" ''
     #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/co/compare50/package.nix b/pkgs/by-name/co/compare50/package.nix
new file mode 100644
index 000000000000..0981bb9454b7
--- /dev/null
+++ b/pkgs/by-name/co/compare50/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "compare50";
+  version = "1.2.7";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cs50";
+    repo = "compare50";
+    tag = "v${version}";
+    hash = "sha256-T7ts/9Uux2gVhh5EGv8PRh9cbCQDbLBYD06sWqNSvLU=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py --replace-fail \
+      'scripts=["bin/compare50"]' 'entry_points={"console_scripts": ["compare50=compare50.__main__:main"]}'
+    # auto included in current python version, no install needed
+    substituteInPlace setup.py --replace-fail \
+      'importlib' ' '
+  '';
+
+  build-system = [
+    python3Packages.setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    attrs
+    intervaltree
+    jinja2
+    lib50
+    numpy
+    packaging
+    pygments
+    termcolor
+    tqdm
+  ];
+
+  pythonRelaxDeps = [
+    "attrs"
+    "numpy"
+    "termcolor"
+  ];
+
+  pythonImportsCheck = [ "compare50" ];
+
+  versionCheckProgramArg = "--version";
+  nativeCheckInputs = [ versionCheckHook ];
+
+  # repo does not use pytest
+  checkPhase = ''
+    runHook preCheck
+
+    ${python3Packages.python.interpreter} -m tests
+
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "Tool for detecting similarity in code supporting over 300 languages";
+    homepage = "https://cs50.readthedocs.io/projects/compare50/en/latest/";
+    downloadPage = "https://github.com/cs50/compare50";
+    changelog = "https://github.com/cs50/compare50/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "compare50";
+  };
+}
diff --git a/pkgs/by-name/co/copybara/package.nix b/pkgs/by-name/co/copybara/package.nix
index 7e3ff087f355..cbb365047ca9 100644
--- a/pkgs/by-name/co/copybara/package.nix
+++ b/pkgs/by-name/co/copybara/package.nix
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20250714";
+  version = "20250721";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-pvJnBMuTJb4juJBJObpA9hP2Fw42IssdAARUGUuEgJo=";
+    hash = "sha256-//HU8zZspR5Rq2xjo1QLLzigGJLuGJE4czUkzXnJ7EA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cr/crossfire-gridarta/package.nix b/pkgs/by-name/cr/crossfire-gridarta/package.nix
index 59d274d9774b..e60dad6e0d91 100644
--- a/pkgs/by-name/cr/crossfire-gridarta/package.nix
+++ b/pkgs/by-name/cr/crossfire-gridarta/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${jre}/bin/java $out/bin/crossfire-gridarta \
       --add-flags "-jar $out/share/java/CrossfireEditor.jar" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=on' \
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
       --set _JAVA_AWT_WM_NONREPARENTING 1
 
     runHook postInstall
diff --git a/pkgs/by-name/cr/crossfire-jxclient/package.nix b/pkgs/by-name/cr/crossfire-jxclient/package.nix
index e5297d6fab50..b214fce6dcd1 100644
--- a/pkgs/by-name/cr/crossfire-jxclient/package.nix
+++ b/pkgs/by-name/cr/crossfire-jxclient/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${jre}/bin/java $out/bin/crossfire-jxclient \
       --add-flags "-jar $out/share/java/jxclient.jar" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=on' \
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
       --set _JAVA_AWT_WM_NONREPARENTING 1
 
     runHook postInstall
diff --git a/pkgs/applications/misc/dmenu/wayland.nix b/pkgs/by-name/dm/dmenu-wayland/package.nix
similarity index 88%
rename from pkgs/applications/misc/dmenu/wayland.nix
rename to pkgs/by-name/dm/dmenu-wayland/package.nix
index eb9a12416714..0c5fbb9a360a 100644
--- a/pkgs/applications/misc/dmenu/wayland.nix
+++ b/pkgs/by-name/dm/dmenu-wayland/package.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation {
   pname = "dmenu-wayland";
-  version = "unstable-2023-05-18";
+  version = "0-unstable-2023-05-18";
 
   src = fetchFromGitHub {
     owner = "nyyManni";
@@ -63,12 +63,12 @@ stdenv.mkDerivation {
       --prefix PATH : $out/bin
   '';
 
-  meta = with lib; {
-    license = licenses.mit;
-    platforms = platforms.linux;
+  meta = {
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
     description = "Efficient dynamic menu for wayland (wlroots)";
     homepage = "https://github.com/nyyManni/dmenu-wayland";
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ rewine ];
     mainProgram = "dmenu-wl";
   };
 }
diff --git a/pkgs/applications/misc/dmenu/default.nix b/pkgs/by-name/dm/dmenu/package.nix
similarity index 62%
rename from pkgs/applications/misc/dmenu/default.nix
rename to pkgs/by-name/dm/dmenu/package.nix
index 8479bf15d382..6996b62c0e47 100644
--- a/pkgs/applications/misc/dmenu/default.nix
+++ b/pkgs/by-name/dm/dmenu/package.nix
@@ -1,37 +1,36 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchzip,
   fontconfig,
   libX11,
   libXinerama,
   libXft,
-  pkg-config,
-  zlib,
   writeText,
-  conf ? null,
-  patches ? null,
+  # customization
+  config,
+  conf ? config.dmenu.conf or null,
+  extraLibs ? config.dmenu.extraLibs or [ ],
+  patches ? config.dmenu.patches or [ ],
   # update script dependencies
   gitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dmenu";
   version = "5.3";
 
-  src = fetchurl {
-    url = "https://dl.suckless.org/tools/dmenu-${version}.tar.gz";
-    sha256 = "sha256-Go9T5v0tdJg57IcMXiez4U2lw+6sv8uUXRWeHVQzeV8=";
+  src = fetchzip {
+    url = "https://dl.suckless.org/tools/dmenu-${finalAttrs.version}.tar.gz";
+    hash = "sha256-3lRLa3NIg+7bUSDnef/rVL3XwvWWHTIPQ8mcVaq/SVI=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     fontconfig
     libX11
     libXinerama
-    zlib
     libXft
-  ];
+  ] ++ extraLibs;
 
   inherit patches;
 
@@ -50,25 +49,22 @@ stdenv.mkDerivation rec {
     makeFlagsArray+=(
       PREFIX="$out"
       CC="$CC"
-      # default config.mk hardcodes dependent libraries and include paths
-      INCS="`$PKG_CONFIG --cflags fontconfig x11 xft xinerama`"
-      LIBS="`$PKG_CONFIG --libs   fontconfig x11 xft xinerama`"
     )
   '';
 
   passthru.updateScript = gitUpdater { url = "git://git.suckless.org/dmenu"; };
 
-  meta = with lib; {
+  meta = {
     description = "Generic, highly customizable, and efficient menu for the X Window System";
     homepage = "https://tools.suckless.org/dmenu";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
       pSub
       globin
       qusic
       _0david0mp
     ];
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
     mainProgram = "dmenu";
   };
-}
+})
diff --git a/pkgs/by-name/do/do-agent/package.nix b/pkgs/by-name/do/do-agent/package.nix
index b22911ed1b7f..95438e444052 100644
--- a/pkgs/by-name/do/do-agent/package.nix
+++ b/pkgs/by-name/do/do-agent/package.nix
@@ -37,7 +37,7 @@ buildGoModule rec {
     '';
     homepage = "https://github.com/digitalocean/do-agent";
     license = licenses.asl20;
-    maintainers = with maintainers; [ yvt ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/window-managers/dwm/dwm-status.nix b/pkgs/by-name/dw/dwm-status/package.nix
similarity index 89%
rename from pkgs/applications/window-managers/dwm/dwm-status.nix
rename to pkgs/by-name/dw/dwm-status/package.nix
index 0da73c866772..55bc5836a37e 100644
--- a/pkgs/applications/window-managers/dwm/dwm-status.nix
+++ b/pkgs/by-name/dw/dwm-status/package.nix
@@ -7,7 +7,7 @@
   libnotify,
   makeWrapper,
   pkg-config,
-  xorg,
+  libX11,
   enableAlsaUtils ? true,
   alsa-utils,
   coreutils,
@@ -31,14 +31,14 @@ let
     ];
 in
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dwm-status";
   version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
-    repo = pname;
-    tag = version;
+    repo = "dwm-status";
+    tag = finalAttrs.version;
     hash = "sha256-982JFYZroskKppAOZjBWOFt624FfRjhXpYN57s/cM50=";
   };
 
@@ -50,7 +50,7 @@ rustPlatform.buildRustPackage rec {
     dbus
     gdk-pixbuf
     libnotify
-    xorg.libX11
+    libX11
   ];
 
   useFetchCargoVendor = true;
@@ -65,7 +65,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Highly performant and configurable DWM status service";
     homepage = "https://github.com/Gerschtli/dwm-status";
-    changelog = "https://github.com/Gerschtli/dwm-status/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/Gerschtli/dwm-status/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       gepbird
@@ -74,4 +74,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "dwm-status";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/window-managers/dwm/default.nix b/pkgs/by-name/dw/dwm/package.nix
similarity index 67%
rename from pkgs/applications/window-managers/dwm/default.nix
rename to pkgs/by-name/dw/dwm/package.nix
index efb5f34363ce..39dcd69080b4 100644
--- a/pkgs/applications/window-managers/dwm/default.nix
+++ b/pkgs/by-name/dw/dwm/package.nix
@@ -1,25 +1,28 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchzip,
   libX11,
   libXinerama,
   libXft,
   writeText,
   pkg-config,
-  patches ? [ ],
-  conf ? null,
+  # customization
+  config,
+  conf ? config.dwm.conf or null,
+  patches ? config.dwm.patches or [ ],
+  extraLibs ? config.dwm.extraLibs or [ ],
   # update script dependencies
   gitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dwm";
   version = "6.5";
 
-  src = fetchurl {
-    url = "https://dl.suckless.org/dwm/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Ideev6ny+5MUGDbCZmy4H0eExp1k5/GyNS+blwuglyk=";
+  src = fetchzip {
+    url = "https://dl.suckless.org/dwm/dwm-${finalAttrs.version}.tar.gz";
+    hash = "sha256-Cc4B8evvuRxOjbeOhg3oAs3Nxi/msxWg950/eiq536w=";
   };
 
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isStatic pkg-config;
@@ -28,14 +31,16 @@ stdenv.mkDerivation rec {
     libX11
     libXinerama
     libXft
-  ];
+  ] ++ extraLibs;
 
-  prePatch = ''
-    sed -i "s@/usr/local@$out@" config.mk
-  '';
-
-  preBuild = lib.optional stdenv.hostPlatform.isStatic ''
-    makeFlagsArray+=(LDFLAGS="$(${stdenv.cc.targetPrefix}pkg-config --static --libs x11 xinerama xft)")
+  preBuild = ''
+    makeFlagsArray+=(
+      "PREFIX=$out"
+      "CC=$CC"
+      ${lib.optionalString stdenv.hostPlatform.isStatic ''
+        LDFLAGS="$(${stdenv.cc.targetPrefix}pkg-config --static --libs x11 xinerama xft)"
+      ''}
+    )
   '';
 
   # Allow users set their own list of patches
@@ -49,13 +54,11 @@ stdenv.mkDerivation rec {
     in
     lib.optionalString (conf != null) "cp ${configFile} config.def.h";
 
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
-
   passthru.updateScript = gitUpdater {
     url = "git://git.suckless.org/dwm";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://dwm.suckless.org/";
     description = "Extremely fast, small, and dynamic window manager for X";
     longDescription = ''
@@ -67,9 +70,9 @@ stdenv.mkDerivation rec {
       multiple tags. Selecting certain tags displays all windows with these
       tags.
     '';
-    license = licenses.mit;
-    maintainers = with maintainers; [ neonfuz ];
-    platforms = platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ neonfuz ];
+    platforms = lib.platforms.all;
     mainProgram = "dwm";
   };
-}
+})
diff --git a/pkgs/development/mobile/fdroidcl/default.nix b/pkgs/by-name/fd/fdroidcl/package.nix
similarity index 52%
rename from pkgs/development/mobile/fdroidcl/default.nix
rename to pkgs/by-name/fd/fdroidcl/package.nix
index 60bccaef812a..f637760f5871 100644
--- a/pkgs/development/mobile/fdroidcl/default.nix
+++ b/pkgs/by-name/fd/fdroidcl/package.nix
@@ -5,20 +5,18 @@
   android-tools,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "fdroidcl";
-  version = "0.7.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
-    owner = "mvdan";
+    owner = "Hoverth";
     repo = "fdroidcl";
-    rev = "v${version}";
-    hash = "sha256-tqhs3b/DHfnGOm9qcM56NSzt1GJflJfbemkp7+nXbug=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SmPtMNHxktyhc0/izWmAzcfCXqF2BpPNJjsrqRlU1K0=";
   };
 
-  patches = [ ./go_mod_version_update.patch ];
-
-  vendorHash = "sha256-BWbwhHjfmMjiRurrZfW/YgIzJUH/hn+7qonD0BcTLxs=";
+  vendorHash = "sha256-PNj5gkFj+ruxv1I4SezJxebDO2e1qGTYp3ZgekRLNt0=";
 
   postPatch = ''
     substituteInPlace adb/{server,device}.go \
@@ -28,11 +26,11 @@ buildGoModule rec {
   # TestScript/search attempts to connect to fdroid
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "F-Droid command line interface written in Go";
     mainProgram = "fdroidcl";
-    homepage = "https://github.com/mvdan/fdroidcl";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ aleksana ];
+    homepage = "https://github.com/Hoverth/fdroidcl";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ aleksana ];
   };
-}
+})
diff --git a/pkgs/by-name/fi/filebeat8/package.nix b/pkgs/by-name/fi/filebeat8/package.nix
index 3cda7cb06e17..8a5e0eadaabc 100644
--- a/pkgs/by-name/fi/filebeat8/package.nix
+++ b/pkgs/by-name/fi/filebeat8/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "filebeat";
-  version = "8.18.3";
+  version = "8.18.4";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${version}";
-    hash = "sha256-Lg+3M4zw0m7URBvC2G3aasXG7owc8JslMX4kI95qSCU=";
+    hash = "sha256-H7UKYp+REz7d9wKrP+AhIJp4ydCVS8NGKfBFvDFZWiA=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-2Rl4OJOMbt74QVb57Or2JklYSjTFRkly5GXrW0LAkoI=";
+  vendorHash = "sha256-G4+FsmmPDyssD+n1N1BnCElYv/bW7kY2tF60r49ZhN8=";
 
   subPackages = [ "filebeat" ];
 
diff --git a/pkgs/applications/audio/fmit/default.nix b/pkgs/by-name/fm/fmit/package.nix
similarity index 79%
rename from pkgs/applications/audio/fmit/default.nix
rename to pkgs/by-name/fm/fmit/package.nix
index 9455874ded68..16fca47c5506 100644
--- a/pkgs/applications/audio/fmit/default.nix
+++ b/pkgs/by-name/fm/fmit/package.nix
@@ -1,13 +1,10 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
   fetchFromGitHub,
+  libsForQt5,
   fftw,
-  qtbase,
-  qtmultimedia,
-  qmake,
   itstool,
-  wrapQtAppsHook,
   alsaSupport ? true,
   alsa-lib ? null,
   jackSupport ? false,
@@ -20,34 +17,34 @@ assert alsaSupport -> alsa-lib != null;
 assert jackSupport -> libjack2 != null;
 assert portaudioSupport -> portaudio != null;
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fmit";
   version = "1.2.14";
 
   src = fetchFromGitHub {
     owner = "gillesdegottex";
     repo = "fmit";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "1q062pfwz2vr9hbfn29fv54ip3jqfd9r99nhpr8w7mn1csy38azx";
   };
 
   nativeBuildInputs = [
-    qmake
+    libsForQt5.qmake
     itstool
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
   buildInputs =
     [
       fftw
-      qtbase
-      qtmultimedia
+      libsForQt5.qtbase
+      libsForQt5.qtmultimedia
     ]
     ++ lib.optionals alsaSupport [ alsa-lib ]
     ++ lib.optionals jackSupport [ libjack2 ]
     ++ lib.optionals portaudioSupport [ portaudio ];
 
   postPatch = ''
-    substituteInPlace fmit.pro --replace '$$FMITVERSIONGITPRO' '${version}'
+    substituteInPlace fmit.pro --replace '$$FMITVERSIONGITPRO' '${finalAttrs.version}'
   '';
 
   qmakeFlags =
@@ -64,15 +61,15 @@ mkDerivation rec {
       "CONFIG+=acs_portaudio"
     ];
 
-  meta = with lib; {
+  meta = {
     description = "Free Musical Instrument Tuner";
     longDescription = ''
       FMIT is a graphical utility for tuning musical instruments, with error
       and volume history, and advanced features.
     '';
     homepage = "http://gillesdegottex.github.io/fmit/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ orivej ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ orivej ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/fr/freeplane/package.nix b/pkgs/by-name/fr/freeplane/package.nix
index adc4de096c11..51950507ec63 100644
--- a/pkgs/by-name/fr/freeplane/package.nix
+++ b/pkgs/by-name/fr/freeplane/package.nix
@@ -102,7 +102,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         ]
       } \
       --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
-      --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on"
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';
diff --git a/pkgs/tools/misc/gazelle-origin/default.nix b/pkgs/by-name/ga/gazelle-origin/package.nix
similarity index 73%
rename from pkgs/tools/misc/gazelle-origin/default.nix
rename to pkgs/by-name/ga/gazelle-origin/package.nix
index 37ef0aedd9cc..3fa2a2431b86 100644
--- a/pkgs/tools/misc/gazelle-origin/default.nix
+++ b/pkgs/by-name/ga/gazelle-origin/package.nix
@@ -1,26 +1,23 @@
 {
   lib,
-  buildPythonApplication,
   fetchFromGitHub,
-  bencoder,
-  pyyaml,
-  requests,
+  python3Packages,
 }:
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "gazelle-origin";
   version = "3.0.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
-    repo = pname;
+    repo = "gazelle-origin";
     # Use the spinfast319 fork, since it seems that upstream
     # at <https://github.com/x1ppy/gazelle-origin> is inactive
     owner = "spinfast319";
-    rev = version;
+    tag = version;
     hash = "sha256-+yMKnfG2f+A1/MxSBFLaHfpCgI2m968iXqt+2QanM/c=";
   };
 
-  propagatedBuildInputs = [
+  dependencies = with python3Packages; [
     bencoder
     pyyaml
     requests
@@ -28,12 +25,12 @@ buildPythonApplication rec {
 
   pythonImportsCheck = [ "gazelleorigin" ];
 
-  meta = with lib; {
+  meta = {
     description = "Tool for generating origin files using the API of Gazelle-based torrent trackers";
     homepage = "https://github.com/spinfast319/gazelle-origin";
     # TODO license is unspecified in the upstream, as well as the fork
-    license = licenses.unfree;
-    maintainers = with maintainers; [ somasis ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ somasis ];
     mainProgram = "gazelle-origin";
   };
 }
diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 3608a13dd2c3..2af5d3736a3b 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.76.0";
+  version = "2.76.1";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-69vSmV+CKRQOuUxsiBBlZBSRqwEtJil4oAse+RSuSVM=";
+    hash = "sha256-5m7BIjJqggQZYwxfUlsU+WBw6BxK0PBQYOSrw3I7gLA=";
   };
 
-  vendorHash = "sha256-go5hB6vjZZrTa3PMHWpv+J0yNewijXkRD8iGL6O2GgM=";
+  vendorHash = "sha256-NXyqWeiESkLVb2Bb88MoD+4ssvfOy0HGHFAOrT83t0c=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/go/go-licence-detector/package.nix b/pkgs/by-name/go/go-licence-detector/package.nix
index f4e1d3f66c8b..7e6fb1aacfcd 100644
--- a/pkgs/by-name/go/go-licence-detector/package.nix
+++ b/pkgs/by-name/go/go-licence-detector/package.nix
@@ -6,20 +6,15 @@
 
 buildGoModule rec {
   pname = "go-licence-detector";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "go-licence-detector";
     rev = "v${version}";
-    hash = "sha256-z2fJsDnDhD/0fF1QEQIKB398TqAsug1Ye5LbGpJWyfE=";
+    hash = "sha256-Mo4eBBP9UueLEMVnxndatizDaxVyZuHACvFoV38dRVI=";
   };
 
-  postPatch = ''
-    substituteInPlace go.mod \
-      --replace-fail "go 1.24.5" "go 1.24"
-  '';
-
   vendorHash = "sha256-quFa2gBPsyRMOBde+KsIF8NCHYSF+X9skvIWnpm2Nss=";
 
   meta = with lib; {
diff --git a/pkgs/by-name/go/gocryptfs/package.nix b/pkgs/by-name/go/gocryptfs/package.nix
index 7c25e508a09f..eace2edb9f10 100644
--- a/pkgs/by-name/go/gocryptfs/package.nix
+++ b/pkgs/by-name/go/gocryptfs/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "gocryptfs";
-  version = "2.5.4";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "gocryptfs";
     rev = "v${version}";
-    sha256 = "sha256-lDIKMcZLAE1ehijzhpx6G966xzdhusT40Dy06LXBn74=";
+    sha256 = "sha256-zvem4Uc+pNCDVMsnl/BwMYLp3DSYnYy6jwWM2kduq7k=";
   };
 
-  vendorHash = "sha256-WfTJ8TuFupEa391XQMDl3hKTjrmRHJqvYb1haAGHW/U=";
+  vendorHash = "sha256-dvOROh5TsMl+52RvKmDG4ftNv3WF19trgttu5BGWktU=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/go/golangci-lint/package.nix b/pkgs/by-name/go/golangci-lint/package.nix
index 5da1c501a11d..0a87d4a4ef2b 100644
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "golangci-lint";
-  version = "2.2.2";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XpFbcyuARE4gvSsWoIXM+CMUiDeuIiM5dbGPt5ACLA8=";
+    hash = "sha256-Kr4nkoqlCGyuaa4X1BLqe/WZA+ofYkWPizPMzcZQDQg=";
   };
 
-  vendorHash = "sha256-Dh+HTUM3uD/l2g4R0hFEtrzjlrOcZQf2S3ELXKWl01U=";
+  vendorHash = "sha256-SsKypfsr1woHah9rIyFnUNdp0mTde7k++E2CfE22LK4=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/applications/misc/hovercraft/default.nix b/pkgs/by-name/ho/hovercraft/package.nix
similarity index 57%
rename from pkgs/applications/misc/hovercraft/default.nix
rename to pkgs/by-name/ho/hovercraft/package.nix
index a9c882443d0f..6d25cddf4c03 100644
--- a/pkgs/applications/misc/hovercraft/default.nix
+++ b/pkgs/by-name/ho/hovercraft/package.nix
@@ -1,33 +1,26 @@
 {
   lib,
-  buildPythonApplication,
-  isPy3k,
   fetchFromGitHub,
-  manuel,
-  setuptools,
-  docutils,
-  lxml,
-  svg-path,
-  pygments,
-  watchdog,
+  python3Packages,
   fetchpatch,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "hovercraft";
   version = "2.7";
   format = "setuptools";
-  disabled = !isPy3k;
+  disabled = !python3Packages.isPy3k;
 
   src = fetchFromGitHub {
     owner = "regebro";
     repo = "hovercraft";
-    rev = version;
-    sha256 = "0k0gjlqjz424rymcfdjpj6a71ppblfls5f8y2hd800d1as4im8az";
+    tag = version;
+    hash = "sha256-X6EaiVahAYAaFB65oqmj695wlJFXNseqz0SQLzGVD0w=";
   };
 
-  nativeCheckInputs = [ manuel ];
-  propagatedBuildInputs = [
+  nativeCheckInputs = with python3Packages; [ manuel ];
+
+  dependencies = with python3Packages; [
     setuptools
     docutils
     lxml
@@ -39,15 +32,15 @@ buildPythonApplication rec {
     (fetchpatch {
       name = "fix tests with pygments 2.14";
       url = "https://sources.debian.org/data/main/h/hovercraft/2.7-5/debian/patches/0003-Fix-tests-with-pygments-2.14.patch";
-      sha256 = "sha256-qz4Kp4MxlS3KPKRB5/VESCI++66U9q6cjQ0cHy3QjTc=";
+      hash = "sha256-qz4Kp4MxlS3KPKRB5/VESCI++66U9q6cjQ0cHy3QjTc=";
     })
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Makes impress.js presentations from reStructuredText";
     mainProgram = "hovercraft";
     homepage = "https://github.com/regebro/hovercraft";
-    license = licenses.mit;
-    maintainers = with maintainers; [ makefu ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ makefu ];
   };
 }
diff --git a/pkgs/by-name/ii/iio-sensor-proxy/package.nix b/pkgs/by-name/ii/iio-sensor-proxy/package.nix
index dee2b98620a6..e30fb572ea1b 100644
--- a/pkgs/by-name/ii/iio-sensor-proxy/package.nix
+++ b/pkgs/by-name/ii/iio-sensor-proxy/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch2,
   glib,
   cmake,
   libxml2,
@@ -26,6 +27,26 @@ stdenv.mkDerivation rec {
     hash = "sha256-MAfh6bgh39J5J3rlyPjyCkk5KcfWHMZLytZcBRPHaJE=";
   };
 
+  # Fix devices with cros-ec-accel, like Chromebooks and Framework Laptop 12
+  # https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/merge_requests/400
+  patches = [
+    (fetchpatch2 {
+      name = "mr400_1.patch";
+      url = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/commit/f35d293e65841a3b9c0de778300c7fa58b181fd0.patch";
+      hash = "sha256-Gk8Wpy+KFhHAsR3XklcsL3Eo4fHjQuFT6PCN5hz9KHk=";
+    })
+    (fetchpatch2 {
+      name = "mr400_2.patch";
+      url = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/commit/7416edf4da98d8e3b75f9eddb7e5c488ac4a4c54.patch";
+      hash = "sha256-5UnYam6P+paBHAI0qKXDAvrFM8JYhRVTUFePRTHCp+U=";
+    })
+    (fetchpatch2 {
+      name = "mr400_3.patch";
+      url = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/commit/d00109194422a4fe3e9a7bc1235ffc492459c61a.patch";
+      hash = "sha256-58KrXbdpR1eWbPmsr8b0ke67hX5J0o0gtqzrz3dc+ck=";
+    })
+  ];
+
   postPatch = ''
     # upstream meson.build currently doesn't have an option to change the default polkit dir
     substituteInPlace data/meson.build \
diff --git a/pkgs/tools/misc/instaloader/default.nix b/pkgs/by-name/in/instaloader/package.nix
similarity index 52%
rename from pkgs/tools/misc/instaloader/default.nix
rename to pkgs/by-name/in/instaloader/package.nix
index 4c62eb14d938..60d9ec1ed193 100644
--- a/pkgs/tools/misc/instaloader/default.nix
+++ b/pkgs/by-name/in/instaloader/package.nix
@@ -1,43 +1,37 @@
 {
   lib,
-  buildPythonPackage,
-  pythonOlder,
+  python3Packages,
   fetchFromGitHub,
-  setuptools,
-  sphinx,
-  requests,
 }:
 
-buildPythonPackage rec {
+python3Packages.buildPythonApplication rec {
   pname = "instaloader";
-  version = "4.14.1";
+  version = "4.14.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
-
   src = fetchFromGitHub {
     owner = "instaloader";
     repo = "instaloader";
     tag = "v${version}";
-    sha256 = "sha256-ZGCO5xNUwrQFsSaAiP1yffrkSN+Mxdtrw+Kve0s2t2E=";
+    hash = "sha256-q5/lZ+BHnrod0vG/ZJw/5iJRKKaP3Gbns5yaZH0P2rE=";
   };
 
-  nativeBuildInputs = [
-    setuptools
+  build-system = [
+    python3Packages.setuptools
   ];
 
-  propagatedBuildInputs = [
-    requests
-    sphinx
+  dependencies = [
+    python3Packages.requests
+    python3Packages.sphinx
   ];
 
   pythonImportsCheck = [ "instaloader" ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://instaloader.github.io/";
     description = "Download pictures (or videos) along with their captions and other metadata from Instagram";
-    maintainers = with maintainers; [ creator54 ];
-    license = licenses.mit;
+    maintainers = with lib.maintainers; [ creator54 ];
+    license = lib.licenses.mit;
     mainProgram = "instaloader";
   };
 }
diff --git a/pkgs/by-name/ir/irpf/package.nix b/pkgs/by-name/ir/irpf/package.nix
index b7e593ee2dfe..c18bff4254e0 100644
--- a/pkgs/by-name/ir/irpf/package.nix
+++ b/pkgs/by-name/ir/irpf/package.nix
@@ -65,7 +65,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     # make xdg-open overrideable at runtime
     makeWrapper ${jdk11}/bin/java $out/bin/irpf \
-      --add-flags "-Dawt.useSystemAAFontSettings=on" \
+      --add-flags "-Dawt.useSystemAAFontSettings=gasp" \
       --add-flags "-Dswing.aatext=true" \
       --add-flags "-jar $BASEDIR/irpf.jar" \
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
diff --git a/pkgs/by-name/jf/jflap/package.nix b/pkgs/by-name/jf/jflap/package.nix
index 90f32b821fa5..fbc7a152c8ce 100644
--- a/pkgs/by-name/jf/jflap/package.nix
+++ b/pkgs/by-name/jf/jflap/package.nix
@@ -55,7 +55,7 @@ stdenvNoCC.mkDerivation rec {
     mkdir -p $out/share/java
     cp -s $src $out/share/java/jflap.jar
     makeWrapper ${jre8}/bin/java $out/bin/jflap \
-      --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on" \
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
       --add-flags "-jar $out/share/java/jflap.jar"
     runHook postInstall
   '';
diff --git a/pkgs/by-name/jo/josm/package.nix b/pkgs/by-name/jo/josm/package.nix
index 75ece04ea875..e2cd5ece6505 100644
--- a/pkgs/by-name/jo/josm/package.nix
+++ b/pkgs/by-name/jo/josm/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation {
           --add-flags "${baseJavaOpts} ${extraJavaOpts} -jar $out/share/josm/josm.jar" \
           --prefix LD_LIBRARY_PATH ":" '${libXxf86vm}/lib' \
           --prefix _JAVA_AWT_WM_NONREPARENTING : 1 \
-          --prefix _JAVA_OPTIONS : "-Dawt.useSystemAAFontSettings=on"
+          --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
       '';
 
   passthru = {
diff --git a/pkgs/by-name/ka/kafkactl/package.nix b/pkgs/by-name/ka/kafkactl/package.nix
index 1fa763de19cb..806ec47d44d8 100644
--- a/pkgs/by-name/ka/kafkactl/package.nix
+++ b/pkgs/by-name/ka/kafkactl/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "5.10.1";
+  version = "5.11.0";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = "kafkactl";
     tag = "v${version}";
-    hash = "sha256-DFtpzsydA5bPec7LPSJJngS12+ekwJ/Un04yTYOLZts=";
+    hash = "sha256-9d/TXNRuU5+uDImS5hm87tIP1teH6T+/zglRYX+F6Kc=";
   };
 
   vendorHash = "sha256-rxQxNf3FBAGudgrE2wxHw4mVHxTEpQpQ+DX/nEVpoJY=";
diff --git a/pkgs/by-name/ka/kamilalisp/package.nix b/pkgs/by-name/ka/kamilalisp/package.nix
index ca898af85554..efaed71a73e0 100644
--- a/pkgs/by-name/ka/kamilalisp/package.nix
+++ b/pkgs/by-name/ka/kamilalisp/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     cp ${src} $out/share/java/kamilalisp-${version}.jar
     makeWrapper ${jre}/bin/java $out/bin/kamilalisp \
       --add-flags "-jar $out/share/java/kamilalisp-${version}.jar" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=on' \
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp" \
       --set _JAVA_AWT_WM_NONREPARENTING 1
   '';
 
diff --git a/pkgs/by-name/ko/koto-ls/package.nix b/pkgs/by-name/ko/koto-ls/package.nix
index 63d1c16bbe2c..ff5e509a55dc 100644
--- a/pkgs/by-name/ko/koto-ls/package.nix
+++ b/pkgs/by-name/ko/koto-ls/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "koto-ls";
-  version = "0.15.3";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "koto-lang";
     repo = "koto-ls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4s+zWiI6Yxv1TB0drds27txnL0kE6RoqjRI36Clls6Y=";
+    hash = "sha256-a2YGjAZvLyPRfFdZdd0z7sbijS1RCPa5wY2DkJZwbmk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ewBAixbksI9ora5hBZR12lzxCPzxM2Cp6GvQz6hGCSY=";
+  cargoHash = "sha256-GFgIW+x+kncf1OTWZZZjD9yoLEwW01pWAUnJQCpPFhQ=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ko/koto/package.nix b/pkgs/by-name/ko/koto/package.nix
index 3d82d8b3682b..0525e87dbe88 100644
--- a/pkgs/by-name/ko/koto/package.nix
+++ b/pkgs/by-name/ko/koto/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "koto";
-  version = "0.15.3";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "koto-lang";
     repo = "koto";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sFADZj0mBe8TQ2x6NeXLqvvXK13WhVGD2anGWoWrSZw=";
+    hash = "sha256-KdwKJ0ZKKHU+Fe/TTIITHOyRH9uoJ3LU3qXqUwpJI6g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Ok4rgqiQ7N5knXdb0Mfn3fYPPLXoRtOZVv8RvWR2h3k=";
+  cargoHash = "sha256-5uWCpTnGbqoogOxSD2GcXMjQpoYIp1GfB9k4bd+Easc=";
 
   postPatch = ''
     tomlq -ti 'del(.bench)' crates/koto/Cargo.toml
diff --git a/pkgs/by-name/la/lanzaboote-tool/package.nix b/pkgs/by-name/la/lanzaboote-tool/package.nix
deleted file mode 100644
index e6883bb8a15e..000000000000
--- a/pkgs/by-name/la/lanzaboote-tool/package.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  systemd,
-  stdenv,
-  makeWrapper,
-  binutils-unwrapped,
-  sbsigntool,
-  rustPlatform,
-  fetchFromGitHub,
-  lib,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "lanzaboote-tool";
-  version = "0.3.0";
-
-  src = fetchFromGitHub {
-    owner = "nix-community";
-    repo = "lanzaboote";
-    rev = "v${version}";
-    hash = "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=";
-  };
-
-  sourceRoot = "${src.name}/rust/tool";
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-HnTsu46P3HRYo2d1DeaP6hqn+pVW3J4IM+CneckSFoM=";
-
-  env.TEST_SYSTEMD = systemd;
-  doCheck = lib.meta.availableOn stdenv.hostPlatform systemd;
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  postInstall = ''
-    # Clean PATH to only contain what we need to do objcopy.
-    # This is still an unwrapped lanzaboote tool lacking of the
-    # UEFI stub location.
-    mv $out/bin/lzbt $out/bin/lzbt-unwrapped
-    wrapProgram $out/bin/lzbt-unwrapped \
-      --set PATH ${
-        lib.makeBinPath [
-          binutils-unwrapped
-          sbsigntool
-        ]
-      }
-  '';
-
-  nativeCheckInputs = [
-    binutils-unwrapped
-    sbsigntool
-  ];
-
-  meta = with lib; {
-    description = "Lanzaboote UEFI tooling for SecureBoot enablement on NixOS systems (unwrapped; does not contain the required stub)";
-    homepage = "https://github.com/nix-community/lanzaboote";
-    license = licenses.gpl3Only;
-    mainProgram = "lzbt-unwrapped";
-    maintainers = with maintainers; [
-      raitobezarius
-      nikstur
-    ];
-    # Broken on aarch64-linux and any other architecture for now.
-    # Wait for 0.4.0.
-    platforms = [
-      "x86_64-linux"
-      "i686-linux"
-    ];
-  };
-}
diff --git a/pkgs/by-name/li/libstaden-read/package.nix b/pkgs/by-name/li/libstaden-read/package.nix
index 877c5042ff84..bf431ad89e0b 100644
--- a/pkgs/by-name/li/libstaden-read/package.nix
+++ b/pkgs/by-name/li/libstaden-read/package.nix
@@ -11,14 +11,14 @@
 stdenv.mkDerivation (finalAttrs: {
   # Same name as the Debian library
   pname = "libstaden-read";
-  version = "1.15.0";
+  version = "1-15-1";
 
   src = fetchFromGitHub {
     owner = "jkbonfield";
     repo = "io_lib";
     rev = "io_lib-" + builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-2Dlx+MXmqar81/Xmf0oE+6lWX461EDYijiZsZf/VD28=";
+    hash = "sha256-X96gFrefH2NAp4+fvVLXHP9FbF04gQOWLm/tAFJPgR8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix
index d68e66f62a93..1364545c2b76 100644
--- a/pkgs/by-name/lo/lockbook-desktop/package.nix
+++ b/pkgs/by-name/lo/lockbook-desktop/package.nix
@@ -18,17 +18,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "lockbook-desktop";
-  version = "0.9.24";
+  version = "0.9.25";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-NEKmZlBw1OkikHHeohZH01/+E6bslQ6+EK0lhleI9UA=";
+    hash = "sha256-8zkEVdvoM0PDqGyqY16ZRgyY8G0LplmhAb0THwqTVig=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UDidgvZlFkUrNpnwJijEQ8ib2kiou0cHKOuBnk0u704=";
+  cargoHash = "sha256-2NGb4a/Ak8DlaxHVElJg8Vhrt4W4XPZdDE283TH19C4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/lo/lockbook/package.nix b/pkgs/by-name/lo/lockbook/package.nix
index d4d5da794911..6b2fe18cf051 100644
--- a/pkgs/by-name/lo/lockbook/package.nix
+++ b/pkgs/by-name/lo/lockbook/package.nix
@@ -7,22 +7,22 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lockbook";
-  version = "0.9.22";
+  version = "0.9.25";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-akCtnPLJupoo7n3Vfyl37fjCmK4dHB0bt92rie6k0dQ=";
+    hash = "sha256-8zkEVdvoM0PDqGyqY16ZRgyY8G0LplmhAb0THwqTVig=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xH3GIwh3zaLbpZqvzM+KM+K14fWj241RTwUM7dWRCKA=";
+  cargoHash = "sha256-2NGb4a/Ak8DlaxHVElJg8Vhrt4W4XPZdDE283TH19C4=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [
     "--package"
-    "lockbook-cli"
+    "lockbook"
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/mc/mcaimi-st/package.nix b/pkgs/by-name/mc/mcaimi-st/package.nix
new file mode 100644
index 000000000000..daf38a1f725e
--- /dev/null
+++ b/pkgs/by-name/mc/mcaimi-st/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fontconfig,
+  libX11,
+  libXext,
+  libXft,
+  ncurses,
+  pkg-config,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation {
+  pname = "mcaimi-st";
+  version = "0-unstable-2025-03-12";
+
+  src = fetchFromGitHub {
+    owner = "mcaimi";
+    repo = "st";
+    rev = "f1ae5cdafadceaf622e1c0ff56da04803bf658b3";
+    hash = "sha256-rGru0LqbuJQ4QOts6xYDztAST0K5HCys2gUPZg2w4SE=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+  buildInputs = [
+    fontconfig
+    libX11
+    libXext
+    libXft
+    ncurses
+  ];
+
+  installFlags = [
+    "TERMINFO=$(out)/share/terminfo"
+    "PREFIX=$(out)"
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    homepage = "https://github.com/mcaimi/st";
+    description = "Suckless Terminal fork";
+    mainProgram = "st";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 0062f142dec5..20cf8161869d 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-07-16";
+  version = "0-unstable-2025-07-23";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "a0eedfb30fb449322deaff0b349b3a194608789e";
-    hash = "sha256-+0FZmLxWz75wU5NIxjpX+H0oNa3gGgYCjoK8JdP7sOg=";
+    rev = "affbfa8012d0dbc0eba81ea51ec32069c71af417";
+    hash = "sha256-JPcurldPuaFPfwqiWQR83x1uDcL0Dy79kx2TAOiNnyQ=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
index 028a70fe6c14..92d10debd1cd 100644
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "14.5.4";
+  version = "14.5.5";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-DJEc+2GJHxG49euVpwH8h/yLoR6DVn0a0ZUFS429XaA=";
+      hash = "sha256-PwqxYylW602XAKBvEJk4Rl8q6nWBGH3pFvTOuAYtr/w=";
     };
   };
 
diff --git a/pkgs/by-name/ne/netbeans/package.nix b/pkgs/by-name/ne/netbeans/package.nix
index 2f8be3be2c30..364ee5feebd8 100644
--- a/pkgs/by-name/ne/netbeans/package.nix
+++ b/pkgs/by-name/ne/netbeans/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
       } \
       --prefix JAVA_HOME : ${jdk21.home} \
       --add-flags "--jdkhome ${jdk21.home} \
-      -J-Dawt.useSystemAAFontSettings=on -J-Dswing.aatext=true"
+      -J-Dawt.useSystemAAFontSettings=gasp -J-Dswing.aatext=true"
 
     # Extract pngs from the Apple icon image and create
     # the missing ones from the 1024x1024 image.
diff --git a/pkgs/by-name/ni/nix-init/package.nix b/pkgs/by-name/ni/nix-init/package.nix
index 0f996a78bf6b..f11d31556646 100644
--- a/pkgs/by-name/ni/nix-init/package.nix
+++ b/pkgs/by-name/ni/nix-init/package.nix
@@ -11,12 +11,11 @@
   openssl,
   zlib,
   zstd,
-  stdenv,
   spdx-license-list-data,
   nix,
   nurl,
-  testers,
-  nix-init,
+  versionCheckHook,
+  nix-update-script,
 }:
 
 let
@@ -25,14 +24,14 @@ let
   };
 in
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nix-init";
   version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-init";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-0RLEPVtYnwYH+pMnpO0/Evbp7x9d0RMobOVAqwgMJz4=";
   };
 
@@ -87,16 +86,18 @@ rustPlatform.buildRustPackage rec {
     ZSTD_SYS_USE_PKG_CONFIG = true;
   };
 
-  passthru.tests.version = testers.testVersion {
-    package = nix-init;
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Command line tool to generate Nix packages from URLs";
     mainProgram = "nix-init";
     homepage = "https://github.com/nix-community/nix-init";
-    changelog = "https://github.com/nix-community/nix-init/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ figsoda ];
+    changelog = "https://github.com/nix-community/nix-init/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ figsoda ];
   };
-}
+})
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 93fa9982f5ed..210e778c3b36 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -12,10 +12,10 @@
 
 let
   opencode-node-modules-hash = {
-    "aarch64-darwin" = "sha256-TAeFDsHGFJnUyp20ec+Rxp4t1FrWKfbtnxsE8PnLS0o=";
-    "aarch64-linux" = "sha256-F056MWf2dNAO21ezEvWg689WUibtz4Q4mcSuDuSY5EM=";
-    "x86_64-darwin" = "sha256-AN1Ha/les1ByJGfVkLDibfxjPouC0tAZ//EN3vDi1Hc=";
-    "x86_64-linux" = "sha256-XIRV1QrgRHnpJyrgK9ITxH61dve7nWfVoCPs3Tc8nuU=";
+    "aarch64-darwin" = "sha256-so+KiAo8C7olbJaCH1rIVxs/tq/g9l5pKPaU8D+Zm28=";
+    "aarch64-linux" = "sha256-JNf8g0z6oH2OXJLAmCSP0W4WX+GGyald5DAFOYCBNP0=";
+    "x86_64-darwin" = "sha256-jwmH4gEcyRNgeMvYz2SyWRagFkYN1O3ULEQIPPgqhwg=";
+    "x86_64-linux" = "sha256-ZMz7vfndYrpjUvhX8L9qv/lXcWKqXZwvfahGAE5EKYo=";
   };
   bun-target = {
     "aarch64-darwin" = "bun-darwin-arm64";
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.3.51";
+  version = "0.3.58";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lvosTLb9HI5IjE6Z1yEGNQn1M84zq23epgEhXGEuteQ=";
+    hash = "sha256-Zm3ydijaduPcIw5Np1+5CzNMoaASQwOT2R72/pdyUwM=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-MZAKEXA34dHiH4XYUlLq6zo8ppG8JD3nj7fhZMrr+TI=";
+    vendorHash = "sha256-8OIPFa+bl1If55YZtacyOZOqMLslbMyO9Hx0HOzmrA0=";
 
     subPackages = [ "cmd/opencode" ];
 
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index 05924132cef8..2f85633231a3 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = "orchard";
     rev = version;
-    hash = "sha256-1i62fKxuLYtLIUSbUZ4nu3I1r9V6PUhaWpspH/H7k+Q=";
+    hash = "sha256-V5pBiF1IIfyyZIAoHnAccZ6YNddA4MosEJROJVEpwoo=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-dWx4Ivw25H07rd0pNC3VecS7QcIc9ikEwjjUS53SefU=";
+  vendorHash = "sha256-VHEj4y7XSfdbSeBo9+ZwBZXUj/ur0w6gPrxCt2xNQMM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ow/owi/package.nix b/pkgs/by-name/ow/owi/package.nix
index 0a3ea664efb3..4b306120a697 100644
--- a/pkgs/by-name/ow/owi/package.nix
+++ b/pkgs/by-name/ow/owi/package.nix
@@ -7,6 +7,7 @@
   zig,
   makeWrapper,
   unstableGitUpdater,
+  nixosTests,
 }:
 
 let
@@ -75,7 +76,10 @@ ocamlPackages.buildDunePackage rec {
 
   doCheck = false;
 
-  passthru.updateScript = unstableGitUpdater { };
+  passthru = {
+    updateScript = unstableGitUpdater { };
+    tests = { inherit (nixosTests) owi; };
+  };
 
   meta = {
     description = "Symbolic execution for Wasm, C, C++, Rust and Zig";
diff --git a/pkgs/by-name/p4/p4est-sc/package.nix b/pkgs/by-name/p4/p4est-sc/package.nix
new file mode 100644
index 000000000000..1cf4510c4071
--- /dev/null
+++ b/pkgs/by-name/p4/p4est-sc/package.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  mpi,
+  zlib,
+  jansson,
+  mpiCheckPhaseHook,
+  debug ? false,
+  mpiSupport ? true,
+
+  # passthru.tests
+  testers,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "p4est-sc";
+  version = "2.8.7";
+
+  src = fetchFromGitHub {
+    owner = "cburstedde";
+    repo = "libsc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oeEYNaYx1IdEWefctgUZVUa6wnb8K3z5Il2Y9MtQwBc=";
+  };
+
+  strictDeps = true;
+
+  postPatch = ''
+    echo $version > .tarball-version
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ] ++ lib.optional mpiSupport mpi;
+
+  propagatedBuildInputs = [
+    zlib
+    jansson
+  ];
+
+  configureFlags =
+    [
+      "LDFLAGS=-lm"
+    ]
+    ++ lib.optionals mpiSupport [
+      "--enable-mpi"
+      "CC=mpicc"
+    ]
+    ++ lib.optional debug "--enable-debug";
+
+  __darwinAllowLocalNetworking = mpiSupport;
+
+  nativeCheckInputs = lib.optionals mpiSupport [
+    mpiCheckPhaseHook
+  ];
+
+  doCheck = true;
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    description = "Support for parallel scientific applications";
+    longDescription = ''
+      The SC library provides support for parallel scientific applications.
+      Its main purpose is to support the p4est software library, hence
+      this package is called p4est-sc, but it works standalone, too.
+    '';
+    homepage = "https://www.p4est.org/";
+    downloadPage = "https://github.com/cburstedde/libsc.git";
+    pkgConfigModules = [ "libsc" ];
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ qbisi ];
+  };
+})
diff --git a/pkgs/by-name/p4/p4est/package.nix b/pkgs/by-name/p4/p4est/package.nix
new file mode 100644
index 000000000000..996422b56194
--- /dev/null
+++ b/pkgs/by-name/p4/p4est/package.nix
@@ -0,0 +1,88 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  metis,
+  p4est-sc,
+  mpi,
+  mpiCheckPhaseHook,
+  debug ? false,
+  withMetis ? true,
+  mpiSupport ? true,
+
+  # passthru.tests
+  testers,
+}:
+let
+  p4est-sc' = p4est-sc.override { inherit mpi mpiSupport debug; };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "p4est";
+  version = "2.8.7";
+
+  src = fetchFromGitHub {
+    owner = "cburstedde";
+    repo = "p4est";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8JvKaYOP4IO1Xmim74KNHvMLOV3y9VRoT76RBCaRyhI=";
+  };
+
+  strictDeps = true;
+
+  postPatch = ''
+    echo $version > .tarball-version
+
+    substituteInPlace Makefile.am \
+      --replace-fail "@P4EST_SC_AMFLAGS@" "-I ${p4est-sc}/share/aclocal"
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ] ++ lib.optional mpiSupport mpi;
+
+  buildInputs = [
+    metis
+  ];
+
+  propagatedBuildInputs = [ p4est-sc' ];
+
+  configureFlags =
+    [
+      "--with-sc=${p4est-sc'}"
+      "--with-metis"
+      "--enable-p6est"
+      "LDFLAGS=-lm"
+    ]
+    ++ lib.optionals mpiSupport [
+      "--enable-mpi"
+      "CC=mpicc"
+    ]
+    ++ lib.optional debug "--enable-debug";
+
+  doCheck = true;
+
+  __darwinAllowLocalNetworking = mpiSupport;
+
+  nativeCheckInputs = lib.optionals mpiSupport [
+    mpiCheckPhaseHook
+  ];
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    description = "Parallel AMR on Forests of Octrees";
+    longDescription = ''
+      The p4est software library provides algorithms for parallel AMR.
+      AMR refers to Adaptive Mesh Refinement, a technique in scientific
+      computing to cover the domain of a simulation with an adaptive mesh.
+    '';
+    homepage = "https://www.p4est.org/";
+    downloadPage = "https://github.com/cburstedde/p4est.git";
+    pkgConfigModules = [ "p4est" ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ qbisi ];
+  };
+})
diff --git a/pkgs/by-name/pa/particle-cli/package.nix b/pkgs/by-name/pa/particle-cli/package.nix
index 6edda5e002b4..6b3d6f59cb9f 100644
--- a/pkgs/by-name/pa/particle-cli/package.nix
+++ b/pkgs/by-name/pa/particle-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "particle-cli";
-  version = "3.38.1";
+  version = "3.38.2";
 
   src = fetchFromGitHub {
     owner = "particle-iot";
     repo = "particle-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B01aoCzcesvz6EjOQf9wTkONhByhf3YqJ18hDVNxEY4=";
+    hash = "sha256-/MfT7+g3l+5Y3mRGl0yiDMRXL2heWZzVNm+LfTmy9SA=";
   };
 
-  npmDepsHash = "sha256-rxGo5L37GnJfvDxURlSxWqm+/HfxMLNkEFceaPdvL4c=";
+  npmDepsHash = "sha256-L/DfZWvJRZzHvf9pP7bHEJt85KT0s46+KErkTNRgH04=";
 
   buildInputs = [
     udev
diff --git a/pkgs/by-name/po/pocketbase/package.nix b/pkgs/by-name/po/pocketbase/package.nix
index 959bc9369b35..e61156eb7db5 100644
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.28.4";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-LMkyz8Eu5W9TGZva7bPiAoN21ymKvAO6oSZcvX6rX+s=";
+    hash = "sha256-yNz/bwjOPcj4N4yXi1pckz/rGNSJeCs8xeZHj+W/+2E=";
   };
 
-  vendorHash = "sha256-hOB8MOfG+RHDJEP5DSDvSiphb+c86QySNEmRr8633cM=";
+  vendorHash = "sha256-XfHU2E2VEcQEQtcGmZqEPjdy7wxvOEdcysSYYD5oLNM=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/by-name/qu/quantlib/package.nix b/pkgs/by-name/qu/quantlib/package.nix
index fc8555fc7cb8..978bd6a8ecd1 100644
--- a/pkgs/by-name/qu/quantlib/package.nix
+++ b/pkgs/by-name/qu/quantlib/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quantlib";
-  version = "1.38";
+  version = "1.39";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "lballabio";
     repo = "QuantLib";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4a86sGUOz/B5IQHE41r5+OTvR9es4FgXeufy3bKRWAc=";
+    hash = "sha256-UrFamEIeFTR0finNGESlDYbvrmD8jtv73tDUJ17P7WA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/r1/r10k/Gemfile.lock b/pkgs/by-name/r1/r10k/Gemfile.lock
index e82d217dbf37..e19552009e23 100644
--- a/pkgs/by-name/r1/r10k/Gemfile.lock
+++ b/pkgs/by-name/r1/r10k/Gemfile.lock
@@ -2,20 +2,21 @@ GEM
   remote: https://rubygems.org/
   specs:
     base64 (0.2.0)
-    colored2 (3.1.2)
+    colored2 (4.0.3)
     cri (2.15.12)
-    erubi (1.13.0)
-    faraday (2.10.1)
-      faraday-net_http (>= 2.0, < 3.2)
+    erubi (1.13.1)
+    faraday (2.13.1)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
       logger
     faraday-follow_redirects (0.3.0)
       faraday (>= 1, < 3)
-    faraday-net_http (3.1.1)
-      net-http
+    faraday-net_http (3.4.0)
+      net-http (>= 0.5.0)
     fast_gettext (2.4.0)
       prime
     forwardable (1.3.3)
-    gettext (3.4.9)
+    gettext (3.5.1)
       erubi
       locale (>= 2.0.5)
       prime
@@ -25,37 +26,38 @@ GEM
       fast_gettext (~> 2.1)
       gettext (~> 3.4)
       locale
-    jwt (2.8.2)
+    json (2.12.2)
+    jwt (2.10.1)
       base64
     locale (2.1.4)
     log4r (1.1.10)
-    logger (1.6.0)
-    minitar (0.12.1)
+    logger (1.7.0)
+    minitar (1.0.2)
     multi_json (1.15.0)
-    net-http (0.4.1)
+    net-http (0.6.0)
       uri
-    prime (0.1.2)
+    prime (0.1.3)
       forwardable
       singleton
-    puppet_forge (5.0.4)
+    puppet_forge (6.0.0)
       faraday (~> 2.0)
       faraday-follow_redirects (~> 0.3.0)
-      minitar (< 1.0.0)
+      minitar (~> 1.0, >= 1.0.2)
       semantic_puppet (~> 1.0)
-    r10k (4.1.0)
-      colored2 (= 3.1.2)
+    r10k (5.0.0)
+      colored2 (~> 4.0)
       cri (>= 2.15.10)
       gettext-setup (>= 0.24, < 2.0)
       jwt (>= 2.2.3, < 3)
       log4r (= 1.1.10)
-      minitar (~> 0.9)
+      minitar (>= 0.9, < 2)
       multi_json (~> 1.10)
-      puppet_forge (>= 4.1, < 6)
+      puppet_forge (>= 4.1.0, < 7)
     racc (1.8.1)
-    semantic_puppet (1.1.0)
-    singleton (0.2.0)
+    semantic_puppet (1.1.1)
+    singleton (0.3.0)
     text (1.3.1)
-    uri (0.13.0)
+    uri (1.0.3)
 
 PLATFORMS
   ruby
@@ -64,4 +66,4 @@ DEPENDENCIES
   r10k
 
 BUNDLED WITH
-   2.5.16
+   2.6.6
diff --git a/pkgs/by-name/r1/r10k/gemset.nix b/pkgs/by-name/r1/r10k/gemset.nix
index 47ddb6a768ba..1de7b337aef9 100644
--- a/pkgs/by-name/r1/r10k/gemset.nix
+++ b/pkgs/by-name/r1/r10k/gemset.nix
@@ -14,10 +14,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jlbqa9q4mvrm73aw9mxh23ygzbjiqwisl32d8szfb5fxvbjng5i";
+      sha256 = "0drbrv5m3l3qpal7s87gvss81cbzl76gad1hqkpqfqlphf0h7qb3";
       type = "gem";
     };
-    version = "3.1.2";
+    version = "4.0.3";
   };
   cri = {
     groups = [ "default" ];
@@ -34,24 +34,25 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qnd6ff4az22ysnmni3730c41b979xinilahzg86bn7gv93ip9pw";
+      sha256 = "1naaxsqkv5b3vklab5sbb9sdpszrjzlfsbqpy7ncbnw510xi10m0";
       type = "gem";
     };
-    version = "1.13.0";
+    version = "1.13.1";
   };
   faraday = {
     dependencies = [
       "faraday-net_http"
+      "json"
       "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "104s7n9505488p923cs0pl3jlgn4naam28clkm2885hrysizpjbb";
+      sha256 = "0xbv450qj2bx0qz9l2pjrd3kc057y6bglc3na7a78zby8ssiwlyc";
       type = "gem";
     };
-    version = "2.10.1";
+    version = "2.13.1";
   };
   faraday-follow_redirects = {
     dependencies = [ "faraday" ];
@@ -70,10 +71,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f49frpfdr8czwm2mjkfny4pini6fy49b6hamw4jrppl4vsg14ys";
+      sha256 = "0jp5ci6g40d6i50bsywp35l97nc2fpi9a592r2cibwicdb6y9wd1";
       type = "gem";
     };
-    version = "3.1.1";
+    version = "3.4.0";
   };
   fast_gettext = {
     dependencies = [ "prime" ];
@@ -108,10 +109,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16h0kda5z4s4zqygyk0f52xzs9mlz9r4lnhjwk729hhmdbz68a19";
+      sha256 = "0aji3873pxn6gc5qkvnv5y9025mqk0p6h22yrpyz2b3yx9qpzv03";
       type = "gem";
     };
-    version = "3.4.9";
+    version = "3.5.1";
   };
   gettext-setup = {
     dependencies = [
@@ -128,16 +129,26 @@
     };
     version = "1.1.0";
   };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1x5b8ipv6g0z44wgc45039k04smsyf95h2m5m67mqq35sa5a955s";
+      type = "gem";
+    };
+    version = "2.12.2";
+  };
   jwt = {
     dependencies = [ "base64" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04mw326i9vsdcqwm4bf0zvnqw237f8l7022nhlbmak92bqqpg62s";
+      sha256 = "1i8wmzgb5nfhvkx1f6bhdwfm7v772172imh439v3xxhkv3hllhp6";
       type = "gem";
     };
-    version = "2.8.2";
+    version = "2.10.1";
   };
   locale = {
     groups = [ "default" ];
@@ -164,20 +175,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gpg8gzi0xwymw4aaq2iafcbx31i3xzkg3fb30mdxn1d4qhc3dqa";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.7.0";
   };
   minitar = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f307mpj4j0gp7iq77xj4p149f4krcvbll9rismng3jcijpbn79s";
+      sha256 = "0wj6cgvzbnc8qvdb5rai4hf9z10a2f422gc5agnhcab7lwmyp4mi";
       type = "gem";
     };
-    version = "0.12.1";
+    version = "1.0.2";
   };
   multi_json = {
     groups = [ "default" ];
@@ -195,10 +206,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "10n2n9aq00ih8v881af88l1zyrqgs5cl3njdw8argjwbl5ggqvm9";
+      sha256 = "1ysrwaabhf0sn24jrp0nnp51cdv0jf688mh5i6fsz63q2c6b48cn";
       type = "gem";
     };
-    version = "0.4.1";
+    version = "0.6.0";
   };
   prime = {
     dependencies = [
@@ -209,10 +220,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1973kz8lbck6ga5v42f55jk8b8pnbgwp9p67dl1xw15gvz55dsfl";
+      sha256 = "1qsk9q2n4yb80f5mwslxzfzm2ckar25grghk95cj7sbc1p2k3w5s";
       type = "gem";
     };
-    version = "0.1.2";
+    version = "0.1.3";
   };
   puppet_forge = {
     dependencies = [
@@ -225,10 +236,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0d65zri1nmpph8iki5iigdzfqd6rfyc1mlgdfhg69q3566rcff06";
+      sha256 = "1pwd5x0vyf04qzzdw6v98m6f6rb110g14sv6h6yj2nwz3kbbww07";
       type = "gem";
     };
-    version = "5.0.4";
+    version = "6.0.0";
   };
   r10k = {
     dependencies = [
@@ -245,10 +256,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k3fr2f0pwyrabs12wqig31f37sqrqs8qza7jrn01d6blvhvkrb4";
+      sha256 = "0m0k0aqf9gaakgkmfcx86324qx6mvs2p0ja1rrs36ifq1l70lgsf";
       type = "gem";
     };
-    version = "4.1.0";
+    version = "5.0.0";
   };
   racc = {
     groups = [ "default" ];
@@ -265,20 +276,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ndqm3jnpdlwkk1jwqdyyb7yw7gv6r4kmjs30g09ap8siv80ilaj";
+      sha256 = "15ksbizvakfx0zfdgjbh34hqnrnkjj47m4kbnsg58mpqsx45pzqm";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.1.1";
   };
   singleton = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qq54imvbksnckzf9hrq9bjzcdb0n8wfv6l5jc0di10n88277jx6";
+      sha256 = "0y2pc7lr979pab5n5lvk3jhsi99fhskl5f2s6004v8sabz51psl3";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "0.3.0";
   };
   text = {
     groups = [ "default" ];
@@ -295,9 +306,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "094gk72ckazf495qc76gk09b5i318d5l9m7bicg2wxlrjcm3qm96";
+      sha256 = "04bhfvc25b07jaiaf62yrach7khhr5jlr5bx6nygg8pf11329wp9";
       type = "gem";
     };
-    version = "0.13.0";
+    version = "1.0.3";
   };
 }
diff --git a/pkgs/by-name/r1/r10k/package.nix b/pkgs/by-name/r1/r10k/package.nix
index 864f1ea79733..529c1709861b 100644
--- a/pkgs/by-name/r1/r10k/package.nix
+++ b/pkgs/by-name/r1/r10k/package.nix
@@ -10,7 +10,7 @@
   testers,
 }:
 
-bundlerApp {
+bundlerApp rec {
   pname = "r10k";
   gemdir = ./.;
   exes = [ "r10k" ];
@@ -33,7 +33,7 @@ bundlerApp {
       package = r10k;
       version = (import ./gemset.nix).r10k.version;
     };
-    updateScript = bundlerUpdateScript "r10k";
+    updateScript = bundlerUpdateScript pname;
   };
 
   meta = {
@@ -47,6 +47,6 @@ bundlerApp {
       anthonyroussel
     ];
     platforms = lib.platforms.unix;
-    mainProgram = "r10k";
+    mainProgram = pname;
   };
 }
diff --git a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
index e3df4161d946..dcfa2604ef00 100644
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2025-07-10";
+  version = "0-unstable-2025-07-18";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "0f63b5ea2932d1af560fcd874b9b8562b5c69403";
-    hash = "sha256-AZkLkSxdNbybf5AJTPHsBd0BQmZ+/1YWg2mSSlUlZTs=";
+    rev = "dce2d3593c6a96a57716d13d58aa3b1d4965fe6f";
+    hash = "sha256-a1466lU8pCQJcJSIe3cEplUcbVnYoABvnm/QQhwsuDw=";
   };
 
   dontBuild = true;
diff --git a/pkgs/applications/terminal-emulators/st/default.nix b/pkgs/by-name/st/st/package.nix
similarity index 80%
rename from pkgs/applications/terminal-emulators/st/default.nix
rename to pkgs/by-name/st/st/package.nix
index 7657895061d7..c9ce15bbca56 100644
--- a/pkgs/applications/terminal-emulators/st/default.nix
+++ b/pkgs/by-name/st/st/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchzip,
   pkg-config,
   fontconfig,
   freetype,
@@ -9,9 +9,10 @@
   libXft,
   ncurses,
   writeText,
-  conf ? null,
-  patches ? [ ],
-  extraLibs ? [ ],
+  config,
+  conf ? config.st.conf or null,
+  patches ? config.st.patches or [ ],
+  extraLibs ? config.st.extraLibs or [ ],
   nixosTests,
   # update script dependencies
   gitUpdater,
@@ -21,9 +22,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "st";
   version = "0.9.2";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://dl.suckless.org/st/st-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ayFdT0crIdYjLzDyIRF6d34kvP7miVXd77dCZGf5SUs=";
+    hash = "sha256-pFyK4XvV5Z4gBja8J996zF6wkdgQCNVccqUJ5+ejB/w=";
   };
 
   outputs = [
@@ -73,12 +74,12 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://st.suckless.org/";
     description = "Simple Terminal for X from Suckless.org Community";
-    license = licenses.mit;
-    maintainers = with maintainers; [ qusic ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ qusic ];
+    platforms = lib.platforms.unix;
     mainProgram = "st";
   };
 })
diff --git a/pkgs/by-name/st/structorizer/package.nix b/pkgs/by-name/st/structorizer/package.nix
index ebd9169f469a..830dd992f156 100644
--- a/pkgs/by-name/st/structorizer/package.nix
+++ b/pkgs/by-name/st/structorizer/package.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
     install -D ${pname}.jar -t $out/share/java/
       makeWrapper ${jdk11}/bin/java $out/bin/${pname} \
       --add-flags "-jar $out/share/java/${pname}.jar" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=lcd'
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     cat << EOF > $out/share/mime/packages/structorizer.xml
     <?xml version="1.0" encoding="UTF-8"?>
diff --git a/pkgs/by-name/ti/tigerjython/package.nix b/pkgs/by-name/ti/tigerjython/package.nix
index d58af72e1a87..b64b5b6efaef 100644
--- a/pkgs/by-name/ti/tigerjython/package.nix
+++ b/pkgs/by-name/ti/tigerjython/package.nix
@@ -87,7 +87,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --add-flags "-Duser.dir=$CUSTOM_LIBS/" \
       --add-flags "-Xmx512M" \
       --add-flags "-jar $JAR" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=lcd'
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index d185f91634f7..aed15b05cb18 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
         ++ lib.optionals mediaSupport [ ffmpeg ]
       );
 
-      version = "14.5.4";
+      version = "14.5.5";
 
       sources = {
         x86_64-linux = fetchurl {
@@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
             "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
             "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
           ];
-          hash = "sha256-27Wq9VwFB85swQZIRQMKZgeUeb/SgQ04aaWmZtlpY9s=";
+          hash = "sha256-rJGhgSSktaeH7KSOtf1KjJbrl/m4sdz+9UdjUN9ovz0=";
         };
 
         i686-linux = fetchurl {
@@ -131,7 +131,7 @@ lib.warnIf (useHardenedMalloc != null)
             "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
             "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
           ];
-          hash = "sha256-OgexrnQWGYSf9g3Le/LyBcpGo3xFqpCMq1NUHF5fi9M=";
+          hash = "sha256-mvlx817/vLi4QyA0aSPyAuWSBfMLjfkFG9Zse9rmSzw=";
         };
       };
 
diff --git a/pkgs/by-name/up/uppaal/package.nix b/pkgs/by-name/up/uppaal/package.nix
index f61425fbad55..f3770437f843 100644
--- a/pkgs/by-name/up/uppaal/package.nix
+++ b/pkgs/by-name/up/uppaal/package.nix
@@ -64,7 +64,7 @@ stdenvNoCC.mkDerivation rec {
     makeWrapper $out/lib/uppaal/uppaal $out/bin/uppaal \
       --set JAVA_HOME ${jdk17} \
       --set PATH $out/lib/uppaal:$PATH \
-      --prefix _JAVA_OPTIONS " " -Dawt.useSystemAAFontSettings=lcd
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 3bb9de8cb72f..aae37eecd725 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.12.6";
+  version = "1.12.7";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7JT8BMKUhIwYMkIwr2mD8IQLDpldcDtAKh6R1tbAKMw=";
+    hash = "sha256-MS88KCH8ZdLyKoR0K45CSJutZSKUhz4FAE2VtrSx0ic=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
diff --git a/pkgs/by-name/wa/wait4x/package.nix b/pkgs/by-name/wa/wait4x/package.nix
index 8f14b034ef5d..a87ce1601148 100644
--- a/pkgs/by-name/wa/wait4x/package.nix
+++ b/pkgs/by-name/wa/wait4x/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "wait4x";
-  version = "3.4.0";
+  version = "3.5.0";
 in
 buildGoModule {
   inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
     owner = "wait4x";
     repo = "wait4x";
     rev = "v${version}";
-    hash = "sha256-Pb2Klupm6cNYUQ3bWBHwr3NW1HCdit2NFFISn9/c860=";
+    hash = "sha256-iHhUimAREKN3o36vi1Ggj8PrhXCHRllxv4yiQ2xcNig=";
   };
 
-  vendorHash = "sha256-6gRiYQYtkADBAMNqma4PfuzIttseyE/bHnlkpOgsVjI=";
+  vendorHash = "sha256-N3HYbeBoDuLvWYX+7mrCTYi38hTdK8BP9uY56fOmuls=";
 
   # Tests make network access
   doCheck = false;
diff --git a/pkgs/by-name/wo/wofi/package.nix b/pkgs/by-name/wo/wofi/package.nix
index 587ac8d03732..b7bf125930d3 100644
--- a/pkgs/by-name/wo/wofi/package.nix
+++ b/pkgs/by-name/wo/wofi/package.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
   pname = "wofi";
   version = "1.4.1";
 
+  outputs = [
+    "out"
+    "dev"
+  ];
+
   src = fetchFromSourcehut {
     repo = "wofi";
     owner = "~scoopta";
diff --git a/pkgs/by-name/wo/workcraft/package.nix b/pkgs/by-name/wo/workcraft/package.nix
index 582d0750e82f..8fe9325a45a6 100644
--- a/pkgs/by-name/wo/workcraft/package.nix
+++ b/pkgs/by-name/wo/workcraft/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     mkdir $out/bin
     makeWrapper $out/share/workcraft $out/bin/workcraft \
       --set JAVA_HOME "${jre}" \
-      --set _JAVA_OPTIONS '-Dawt.useSystemAAFontSettings=gasp';
+      --prefix _JAVA_OPTIONS " " "-Dawt.useSystemAAFontSettings=gasp";
   '';
 
   meta = {
diff --git a/pkgs/by-name/wp/wpcleaner/package.nix b/pkgs/by-name/wp/wpcleaner/package.nix
index 3797140b0e0b..f618a5af836d 100644
--- a/pkgs/by-name/wp/wpcleaner/package.nix
+++ b/pkgs/by-name/wp/wpcleaner/package.nix
@@ -17,7 +17,7 @@ let
   botScript = "$out/bin/wpcleaner-bot";
   runTaskScript = "$out/bin/wpcleaner-run-task";
   extraJavaArgs = [
-    "-Dawt.useSystemAAFontSettings=lcd"
+    "-Dawt.useSystemAAFontSettings=gasp"
     "-Xms1g"
     "-Xmx8g"
   ];
diff --git a/pkgs/applications/terminal-emulators/st/xst.nix b/pkgs/by-name/xs/xst/package.nix
similarity index 53%
rename from pkgs/applications/terminal-emulators/st/xst.nix
rename to pkgs/by-name/xs/xst/package.nix
index 904f939c6b8e..8a089ac6ee85 100644
--- a/pkgs/applications/terminal-emulators/st/xst.nix
+++ b/pkgs/by-name/xs/xst/package.nix
@@ -8,17 +8,18 @@
   libXft,
   ncurses,
   pkg-config,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xst";
   version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "gnotclub";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-2pXR9U2tTBd0lyeQ3BjnXW+Ne9aUQg/+rnpmYPPG06A=";
+    repo = "xst";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2pXR9U2tTBd0lyeQ3BjnXW+Ne9aUQg/+rnpmYPPG06A=";
   };
 
   nativeBuildInputs = [
@@ -32,20 +33,19 @@ stdenv.mkDerivation rec {
     ncurses
   ];
 
-  installPhase = ''
-    runHook preInstall
+  installFlags = [
+    "TERMINFO=$(out)/share/terminfo"
+    "PREFIX=$(out)"
+  ];
 
-    TERMINFO=$out/share/terminfo make install PREFIX=$out
+  passthru.updateScript = nix-update-script { };
 
-    runHook postInstall
-  '';
-
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/gnotclub/xst";
     description = "Simple terminal fork that can load config from Xresources";
     mainProgram = "xst";
-    license = licenses.mit;
-    maintainers = [ maintainers.vyp ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vyp ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/science/math/p4est-sc/default.nix b/pkgs/development/libraries/science/math/p4est-sc/default.nix
deleted file mode 100644
index 559742f678e2..000000000000
--- a/pkgs/development/libraries/science/math/p4est-sc/default.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  mpiCheckPhaseHook,
-  autoreconfHook,
-  pkg-config,
-  p4est-sc-debugEnable ? true,
-  p4est-sc-mpiSupport ? true,
-  mpi,
-  zlib,
-}:
-
-let
-  dbg = lib.optionalString debugEnable "-dbg";
-  debugEnable = p4est-sc-debugEnable;
-  mpiSupport = p4est-sc-mpiSupport;
-in
-stdenv.mkDerivation {
-  pname = "p4est-sc${dbg}";
-  version = "unstable-2021-06-14";
-
-  # fetch an untagged snapshot of the prev3-develop branch
-  src = fetchFromGitHub {
-    owner = "cburstedde";
-    repo = "libsc";
-    rev = "1ae814e3fb1cc5456652e0d77550386842cb9bfb";
-    sha256 = "14vm0b162jh8399pgpsikbwq4z5lkrw9vfzy3drqykw09n6nc53z";
-  };
-
-  strictDeps = true;
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-  propagatedNativeBuildInputs = lib.optional mpiSupport mpi;
-  propagatedBuildInputs = [ zlib ];
-  inherit debugEnable mpiSupport;
-
-  postPatch = ''
-    echo "dist_scaclocal_DATA += config/sc_v4l2.m4" >> Makefile.am
-  '';
-  preConfigure = ''
-    echo "2.8.0" > .tarball-version
-    ${lib.optionalString mpiSupport "unset CC"}
-  '';
-
-  configureFlags =
-    [ "--enable-pthread=-pthread" ]
-    ++ lib.optional debugEnable "--enable-debug"
-    ++ lib.optional mpiSupport "--enable-mpi";
-
-  dontDisableStatic = true;
-  enableParallelBuilding = true;
-  makeFlags = [ "V=0" ];
-
-  nativeCheckInputs = lib.optionals mpiSupport [
-    mpiCheckPhaseHook
-  ];
-
-  # disallow Darwin checks due to prototype incompatibility of qsort_r
-  # to be fixed in a future version of the source code
-  doCheck = !stdenv.hostPlatform.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform;
-
-  meta = {
-    branch = "prev3-develop";
-    description = "Support for parallel scientific applications";
-    longDescription = ''
-      The SC library provides support for parallel scientific applications.
-      Its main purpose is to support the p4est software library, hence
-      this package is called p4est-sc, but it works standalone, too.
-    '';
-    homepage = "https://www.p4est.org/";
-    downloadPage = "https://github.com/cburstedde/libsc.git";
-    license = lib.licenses.lgpl21Plus;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/libraries/science/math/p4est/default.nix b/pkgs/development/libraries/science/math/p4est/default.nix
deleted file mode 100644
index 31613dd64259..000000000000
--- a/pkgs/development/libraries/science/math/p4est/default.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoreconfHook,
-  pkg-config,
-  p4est-withMetis ? true,
-  metis,
-  p4est-sc,
-  mpiCheckPhaseHook,
-}:
-
-let
-  inherit (p4est-sc) debugEnable mpiSupport;
-  dbg = lib.optionalString debugEnable "-dbg";
-  withMetis = p4est-withMetis;
-in
-stdenv.mkDerivation {
-  pname = "p4est${dbg}";
-  version = "unstable-2021-06-22";
-
-  # fetch an untagged snapshot of the prev3-develop branch
-  src = fetchFromGitHub {
-    owner = "cburstedde";
-    repo = "p4est";
-    rev = "7423ac5f2b2b64490a7a92e5ddcbd251053c4dee";
-    sha256 = "0vffnf48rzw6d0as4c3x1f31b4kapmdzr1hfj5rz5ngah72gqrph";
-  };
-
-  strictDeps = true;
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-  propagatedBuildInputs = [ p4est-sc ];
-  buildInputs = lib.optional withMetis metis;
-  inherit debugEnable mpiSupport withMetis;
-
-  patches = [ ./p4est-metis.patch ];
-  postPatch = ''
-    sed -i -e "s:\(^\s*ACLOCAL_AMFLAGS.*\)\s@P4EST_SC_AMFLAGS@\s*$:\1 -I ${p4est-sc}/share/aclocal:" Makefile.am
-  '';
-  preAutoreconf = ''
-    echo "2.8.0" > .tarball-version
-  '';
-  preConfigure = lib.optionalString mpiSupport ''
-    unset CC
-  '';
-
-  configureFlags =
-    p4est-sc.configureFlags ++ [ "--with-sc=${p4est-sc}" ] ++ lib.optional withMetis "--with-metis";
-
-  inherit (p4est-sc)
-    makeFlags
-    dontDisableStatic
-    enableParallelBuilding
-    doCheck
-    ;
-
-  nativeCheckInputs = lib.optionals mpiSupport [
-    mpiCheckPhaseHook
-  ];
-
-  meta = {
-    branch = "prev3-develop";
-    description = "Parallel AMR on Forests of Octrees";
-    longDescription = ''
-      The p4est software library provides algorithms for parallel AMR.
-      AMR refers to Adaptive Mesh Refinement, a technique in scientific
-      computing to cover the domain of a simulation with an adaptive mesh.
-    '';
-    homepage = "https://www.p4est.org/";
-    downloadPage = "https://github.com/cburstedde/p4est.git";
-    license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/libraries/science/math/p4est/p4est-metis.patch b/pkgs/development/libraries/science/math/p4est/p4est-metis.patch
deleted file mode 100644
index 46b8dc8af08c..000000000000
--- a/pkgs/development/libraries/science/math/p4est/p4est-metis.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/p4est_connectivity.c b/src/p4est_connectivity.c
-index 95339136..c93528f2 100644
---- a/src/p4est_connectivity.c
-+++ b/src/p4est_connectivity.c
-@@ -3715,6 +3715,7 @@ p4est_connectivity_reorder_newid (sc_MPI_Comm comm, int k,
-                                   sc_array_t * newid)
- {
-   const int           n = (int) conn->num_trees;
-+  int                 metis_n;
-   int                *xadj;
-   int                *adjncy;
-   int                *part;
-@@ -3862,10 +3863,12 @@ p4est_connectivity_reorder_newid (sc_MPI_Comm comm, int k,
- 
-     P4EST_GLOBAL_INFO ("Entering metis\n");
-     /* now call metis */
-+    metis_n = n;
-     P4EST_EXECUTE_ASSERT_INT
--      (METIS_PartGraphRecursive (&n, &ncon, xadj, adjncy, NULL, NULL,
-+      (METIS_PartGraphRecursive (&metis_n, &ncon, xadj, adjncy, NULL, NULL,
-                                  NULL, &k, NULL, NULL, NULL, &volume, part),
-        METIS_OK);
-+    P4EST_ASSERT (metis_n == n);
-     P4EST_GLOBAL_INFO ("Done metis\n");
- 
-     P4EST_GLOBAL_STATISTICSF ("metis volume %d\n", volume);
diff --git a/pkgs/development/mobile/fdroidcl/go_mod_version_update.patch b/pkgs/development/mobile/fdroidcl/go_mod_version_update.patch
deleted file mode 100644
index 079ea02c0a15..000000000000
--- a/pkgs/development/mobile/fdroidcl/go_mod_version_update.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-diff --git a/go.mod b/go.mod
-index a482585..5c836dd 100644
---- a/go.mod
-+++ b/go.mod
-@@ -1,10 +1,19 @@
- module mvdan.cc/fdroidcl
- 
--go 1.16
-+go 1.18
- 
- require (
- 	github.com/kr/pretty v0.3.0
- 	github.com/rogpeppe/go-internal v1.9.0
- 	github.com/schollz/progressbar/v3 v3.13.0
--	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
-+)
-+
-+require (
-+	github.com/kr/text v0.2.0 // indirect
-+	github.com/mattn/go-runewidth v0.0.14 // indirect
-+	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
-+	github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e // indirect
-+	github.com/rivo/uniseg v0.4.3 // indirect
-+	golang.org/x/sys v0.4.0 // indirect
-+	golang.org/x/term v0.4.0 // indirect
- )
-diff --git a/go.sum b/go.sum
-index 7befc16..d8523cb 100644
---- a/go.sum
-+++ b/go.sum
-@@ -23,8 +23,6 @@ github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJ
- github.com/rivo/uniseg v0.4.3 h1:utMvzDsuh3suAEnhH0RdHmoPbU648o6CvXxTx4SBMOw=
- github.com/rivo/uniseg v0.4.3/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
- github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
--github.com/rogpeppe/go-internal v1.8.1 h1:geMPLpDpQOgVyCg5z5GoRwLHepNdb71NXb67XFkP+Eg=
--github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
- github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
- github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
- github.com/schollz/progressbar/v3 v3.13.0 h1:9TeeWRcjW2qd05I8Kf9knPkW4vLM/hYoa6z9ABvxje8=
-@@ -38,7 +36,4 @@ golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
- golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg=
- golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
- gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
--gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
--gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
--gopkg.in/errgo.v2 v2.1.0 h1:0vLT13EuvQ0hNvakwLuFZ/jYrLp5F3kcWHXdRggjCE8=
- gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
diff --git a/pkgs/development/python-modules/aioairzone-cloud/default.nix b/pkgs/development/python-modules/aioairzone-cloud/default.nix
index 30446b44d993..03c369b1e88b 100644
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.6.12";
+  version = "0.6.16";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     tag = version;
-    hash = "sha256-maSYT1sd1GTe0Av0NvOUinI/GBYFzjUAemRLx7sDPUk=";
+    hash = "sha256-EPj6tql05ZUImMAeeUTyNms1NdwJgtdCJmJ+O8HXP3I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fenics-dolfinx/default.nix b/pkgs/development/python-modules/fenics-dolfinx/default.nix
index 158cf7dec173..7aa04a253fe5 100644
--- a/pkgs/development/python-modules/fenics-dolfinx/default.nix
+++ b/pkgs/development/python-modules/fenics-dolfinx/default.nix
@@ -32,7 +32,6 @@
   # nativeCheckInputs
   scipy,
   matplotlib,
-  pytest-xdist,
   pytestCheckHook,
   writableTmpDirAsHomeHook,
   mpiCheckPhaseHook,
@@ -108,7 +107,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     scipy
     matplotlib
-    pytest-xdist
     pytestCheckHook
     writableTmpDirAsHomeHook
     mpiCheckPhaseHook
diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index 1690d8e1f37a..3341cd7559eb 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "model-checker";
-  version = "0.9.26";
+  version = "0.9.28";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "model_checker";
     inherit version;
-    hash = "sha256-UPqTdKhXDb1D8Ig1dMk8QIiLuyZPQxMp/P1pAKqJ+Bs=";
+    hash = "sha256-mRJpkJkSA8wNTCs3YhNm+W3OQnRVUXhCYz5CJhmqpmA=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
diff --git a/pkgs/development/python-modules/nitransforms/default.nix b/pkgs/development/python-modules/nitransforms/default.nix
index f7509287253c..4a43c19b92eb 100644
--- a/pkgs/development/python-modules/nitransforms/default.nix
+++ b/pkgs/development/python-modules/nitransforms/default.nix
@@ -7,25 +7,25 @@
   nibabel,
   numpy,
   scipy,
+  setuptools,
   setuptools-scm,
-  toml,
 }:
 
 buildPythonPackage rec {
   pname = "nitransforms";
-  version = "24.1.2";
+  version = "25.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JKlKM9bd3pTTBp/xVj9Ywd/+Ok7lxo05AF01eeOBeoE=";
+    hash = "sha256-bGyrFyB8pjE3zLymQTWXdPAUxDopFQdJ00aQszlOp5g=";
   };
 
   build-system = [
+    setuptools
     setuptools-scm
-    toml
   ];
 
   dependencies = [
@@ -49,12 +49,12 @@ buildPythonPackage rec {
     "nitransforms.patched"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://nitransforms.readthedocs.io";
     description = "Geometric transformations for images and surfaces";
     mainProgram = "nb-transform";
     changelog = "https://github.com/nipy/nitransforms/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ bcdarwin ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ bcdarwin ];
   };
 }
diff --git a/pkgs/development/python-modules/pyshp/default.nix b/pkgs/development/python-modules/pyshp/default.nix
index 361252eaee7c..05ebc0c376d7 100644
--- a/pkgs/development/python-modules/pyshp/default.nix
+++ b/pkgs/development/python-modules/pyshp/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyshp";
-  version = "2.3.1";
+  version = "2.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "GeospatialPython";
     repo = "pyshp";
-    rev = version;
-    hash = "sha256-yfxhgk8a1rdpGVkE1sjJqT6tiFLimhu2m2SjGxLI6wo=";
+    tag = version;
+    hash = "sha256-q1++2pifLZWc562m5cKoL2jLWM4lOnIwEAOqzKArh+w=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/python-novaclient/default.nix b/pkgs/development/python-modules/python-novaclient/default.nix
index 9876da3d82b0..9ebb841c651b 100644
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "python-novaclient";
-  version = "18.9.0";
+  version = "18.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "python_novaclient";
     inherit version;
-    hash = "sha256-z2pLjwHsVD1adcAcIYR0upsGO9n9N0OCH+3GioRcq04=";
+    hash = "sha256-LwZqAQYe6t0c6G+/4CZ6HQ0Yi2TBZBNh9yXEJ39nqWs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvips/default.nix b/pkgs/development/python-modules/pyvips/default.nix
index dbcdadc33f2e..3db7c77b9103 100644
--- a/pkgs/development/python-modules/pyvips/default.nix
+++ b/pkgs/development/python-modules/pyvips/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pyvips";
-  version = "2.2.3";
+  version = "3.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "libvips";
     repo = "pyvips";
     tag = "v${version}";
-    hash = "sha256-EGB1cOR1pVCXGjRj1NLj4Mk3kIy8luRqk3gGJqVNs7U=";
+    hash = "sha256-dyous0EahUR7pkr2siBBJwzcoC4TOsnsbRo+rVE8/QQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index 6093778bd751..143314a61700 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -6,7 +6,6 @@
   boto3,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   moto,
   pytest-asyncio,
   pytestCheckHook,
@@ -19,24 +18,16 @@
 
 buildPythonPackage rec {
   pname = "slack-sdk";
-  version = "3.35.0";
+  version = "3.36.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "python-slack-sdk";
     tag = "v${version}";
-    hash = "sha256-yjYpALyHSTLQSuwd6xth7nqfi3m1C9tqnWrrVRmI220=";
+    hash = "sha256-Y6w4osSpirBjxPdZRlODwEAWd4Z+sPHrr7alVl/6mPA=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-aiohttp-test_init_with_loop.patch";
-      url = "https://github.com/slackapi/python-slack-sdk/pull/1697.patch";
-      hash = "sha256-rHaJBH/Yxm3Sz/jmzc4G1pVJJXz0PL2880bz5n7w3ck=";
-    })
-  ];
-
   build-system = [ setuptools ];
 
   optional-dependencies.optional = [
diff --git a/pkgs/development/python-modules/symfc/default.nix b/pkgs/development/python-modules/symfc/default.nix
index ce8f4cd947bb..085305c84711 100644
--- a/pkgs/development/python-modules/symfc/default.nix
+++ b/pkgs/development/python-modules/symfc/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "symfc";
-  version = "1.3.3";
+  version = "1.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "symfc";
     repo = "symfc";
     tag = "v${version}";
-    hash = "sha256-ec/HFs3txVtu46llTmcfDF8j0+mTkozdu7+RsZXaAGE=";
+    hash = "sha256-SGFKbOVi5cVw+8trXrSnO0v2obpJBZrj+7yXk7hK+1s=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index a9ec7bfa71eb..b9040a77c1d7 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1425";
+  version = "3.0.1427";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-w4pvIWkMjFgn+v7Si8DwzSFhKobrz8EeRSiEmqyn1Ok=";
+    hash = "sha256-OuQQr9ptcTL6YjeUWIa2ak3i1NMO1uhql+dR+cIJUQU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/torchmetrics/default.nix b/pkgs/development/python-modules/torchmetrics/default.nix
index 4277f559c276..ddc59e0bc060 100644
--- a/pkgs/development/python-modules/torchmetrics/default.nix
+++ b/pkgs/development/python-modules/torchmetrics/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "torchmetrics";
-  version = "1.7.4";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "torchmetrics";
     tag = "v${version}";
-    hash = "sha256-MpqpzfsT9cxyKHvcw2ue67gaqQfdsLARov50ivGYO98=";
+    hash = "sha256-zoKULi12vIKMzPRE6I4Rtq4dVQL/GfNFjHR+BId1ADg=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 32db7801aa3a..84a7bb32024c 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -60,8 +60,8 @@ let
 in
 {
   tomcat9 = common {
-    version = "9.0.106";
-    hash = "sha256-EBMxGWDLyIvm2H75RsaF4WBSoNnRp24109GsQZG44n0=";
+    version = "9.0.107";
+    hash = "sha256-08qgrQpltJMafTrsok5VQc90O6X6nlGr2ls6MdC0hX0=";
   };
 
   tomcat10 = common {
@@ -70,7 +70,7 @@ in
   };
 
   tomcat11 = common {
-    version = "11.0.8";
-    hash = "sha256-BGT3ORiCetG5hdhwpehW1ldfEJ0MrWEKSho9sPqadXI=";
+    version = "11.0.9";
+    hash = "sha256-YsVio60p26PqBPWK4x6/yGXPISAzUWP88PwD1CbtOoc=";
   };
 }
diff --git a/pkgs/servers/irc/solanum/default.nix b/pkgs/servers/irc/solanum/default.nix
index 6cadf2dc57eb..2dbd9ab7f6ce 100644
--- a/pkgs/servers/irc/solanum/default.nix
+++ b/pkgs/servers/irc/solanum/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation {
   pname = "solanum";
-  version = "0-unstable-2025-06-11";
+  version = "0-unstable-2025-07-20";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "70d491d8a4ad9fa02ce5394d9007baf5f23ca61c";
-    hash = "sha256-+AYEfG0MJE7LnoS1saA1zSSKNxAvxMppobYUK+sP4fw=";
+    rev = "7feda92636c9d5b5e7decceee1273dd18b6cc31b";
+    hash = "sha256-cfDwdE2CA69dSg59Sn1TKk3OWxvoTIm/KCiKfgzokVU=";
   };
 
   patches = [
diff --git a/pkgs/servers/mastodon/gemset.nix b/pkgs/servers/mastodon/gemset.nix
index 2782bfaa1a8f..c08b5d054499 100644
--- a/pkgs/servers/mastodon/gemset.nix
+++ b/pkgs/servers/mastodon/gemset.nix
@@ -2411,10 +2411,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rb306hbky6cxfyc8vrwpvl40fdapjvhsk62h08gg9wwbn3n8x4c";
+      sha256 = "0czsh9d738kj0bmpkjnczq9j924hg103gc00i0wfyg0fzn9psnmc";
       type = "gem";
     };
-    version = "1.18.8";
+    version = "1.18.9";
   };
   oj = {
     dependencies = [
@@ -4484,10 +4484,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nmymd86a0vb39pzj2cwv57avdrl6pl3lf5bsz58q594kqxjkw7f";
+      sha256 = "0gcarlmpfbmqnjvwfz44gdjhcmm634di7plcx2zdgwdhrhifhqw7";
       type = "gem";
     };
-    version = "1.3.2";
+    version = "1.4.0";
   };
   tilt = {
     groups = [
diff --git a/pkgs/servers/mastodon/source.nix b/pkgs/servers/mastodon/source.nix
index fb3b5482abb7..a5a782e1c372 100644
--- a/pkgs/servers/mastodon/source.nix
+++ b/pkgs/servers/mastodon/source.nix
@@ -5,17 +5,17 @@
   patches ? [ ],
 }:
 let
-  version = "4.4.1";
+  version = "4.4.2";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-hu6AmR0CvI3lVixJ2UmWY3KAlWbqYULCQAjRGJcuIhc=";
+    hash = "sha256-BzSN48IamwDrhBtw2TFVPJpRaWaQg96rWOlolBBJ5Fs=";
     passthru = {
       inherit version;
-      yarnHash = "sha256-Qh2jli99rxrT10KVGKnePxP6RXYIjtehDCJB5PfOngM=";
+      yarnHash = "sha256-jqiPxkbD0MmnUPK/P0zaYEB6rMRK20ito+o98+FHZdE=";
       yarnMissingHashes = ./missing-hashes.json;
     };
   };
diff --git a/pkgs/servers/varnish/dynamic.nix b/pkgs/servers/varnish/dynamic.nix
index c98d9f0fb0b2..3c5d6c17f688 100644
--- a/pkgs/servers/varnish/dynamic.nix
+++ b/pkgs/servers/varnish/dynamic.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  autoreconfHook269,
+  autoreconfHook,
   pkg-config,
   varnish,
   docutils,
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     pkg-config
     docutils
-    autoreconfHook269
+    autoreconfHook
     varnish.python
   ];
   buildInputs = [ varnish ];
diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index 962f5bb20c7b..fc3422913324 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -6,7 +6,7 @@ builtins.mapAttrs (_: callPackage ./generic.nix) rec {
     hash = "sha256-z9nIPPqd2gNRiY6ptz9YmVyBeZSlQkvhh3f4PohqPPY=";
   };
   wordpress_6_8 = {
-    version = "6.8.1";
-    hash = "sha256-PGVNB5vELE6C/yCmlIxFYpPhBLZ2L/fJ/JSAcbMxAyg=";
+    version = "6.8.2";
+    hash = "sha256-2Fpy45K/6GaBazwuvGpEaZByqlDMOmIPHE7S8TtkXis=";
   };
 }
diff --git a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
index 6ab563ac960f..dd900babd171 100644
--- a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
+++ b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
@@ -6,13 +6,13 @@
 }:
 buildFishPlugin {
   pname = "exercism-cli-fish-wrapper";
-  version = "0-unstable-2025-06-27";
+  version = "0-unstable-2025-07-14";
 
   src = fetchFromGitHub {
     owner = "glennj";
     repo = "exercism-cli-fish-wrapper";
-    rev = "ab03e0a670d07ccaa4e72be7c1f3da1d1092ce3e";
-    hash = "sha256-wtxddxEob8L2tavoaZaM/AaEgDzMVkAo3Z1oEtIHxYU=";
+    rev = "bb03e058d4e9c5d5918e27ae7e046fff2c91adb0";
+    hash = "sha256-taIZSyaObVmnjp6ME/QgGKlWZoeOmgRVRLYC0bb8XWk=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
index db5c894189ed..29bceca18dc2 100644
--- a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
+++ b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "steampipe-plugin-aws";
-  version = "1.17.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe-plugin-aws";
     tag = "v${version}";
-    hash = "sha256-fjxT3nG28CKdkvJSq/PJTqrttH0M96WlP1lWyh0sZtk=";
+    hash = "sha256-LbaW6a2eR1U8y82CCm0pXbzl0YyqIAqdrjraFgiNsW8=";
   };
 
-  vendorHash = "sha256-pKgt1KWVHwdVgHHNwL/FO+hLHFsCbtUepiNFItLyIlo=";
+  vendorHash = "sha256-qRTcntW+CaDlBjcBWCocey8bAgCrar6ityuaK2AgTbY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index 2bc4f17978ee..227dc6d4053e 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "flannel";
-  version = "0.27.1";
+  version = "0.27.2";
   rev = "v${version}";
 
-  vendorHash = "sha256-FR9jeHVZS87Tlv1jtO4h5ZDqKIRLfa4xGlpCj1IWoXU=";
+  vendorHash = "sha256-48/BYhVWS/Tp1UKgpGX31/gdMC1xpWr06+Y+WoXPAs4=";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "flannel-io";
     repo = "flannel";
-    sha256 = "sha256-xmKXemr/qSLsBOwLhJIewF7Iu/ERpZX8kUFgotz4Yyw=";
+    sha256 = "sha256-d92kv1cWwZr4BzrFaI3t/JBvYERaClqFSRzrAUFkqRc=";
   };
 
   ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 0f4efec3312e..c95c989ffdae 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1021,6 +1021,7 @@ mapAliases {
   larynx = piper-tts; # Added 2023-05-09
   LASzip = laszip; # Added 2024-06-12
   LASzip2 = laszip_2; # Added 2024-06-12
+  lanzaboote-tool = throw "lanzaboote-tool has been removed due to lack of integration maintenance with nixpkgs. Consider using the Nix expressions provided by https://github.com/nix-community/lanzaboote"; # Added 2025-07-23
   latencytop = throw "'latencytop' has been removed due to lack of maintenance upstream."; # Added 2024-12-04
   latinmodern-math = lmmath;
   lazarus-qt = lazarus-qt5; # Added 2024-12-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 448821390be4..11b562fc39d4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1541,14 +1541,6 @@ with pkgs;
     emojiSupport = true;
   };
 
-  st = callPackage ../applications/terminal-emulators/st {
-    conf = config.st.conf or null;
-    patches = config.st.patches or [ ];
-    extraLibs = config.st.extraLibs or [ ];
-  };
-  xst = callPackage ../applications/terminal-emulators/st/xst.nix { };
-  mcaimi-st = callPackage ../applications/terminal-emulators/st/mcaimi-st.nix { };
-
   termite = callPackage ../applications/terminal-emulators/termite/wrapper.nix {
     termite = termite-unwrapped;
   };
@@ -2129,8 +2121,6 @@ with pkgs;
 
   fast-cli = nodePackages.fast-cli;
 
-  fdroidcl = pkgs.callPackage ../development/mobile/fdroidcl { };
-
   ### TOOLS/TYPESETTING/TEX
 
   advi = callPackage ../tools/typesetting/tex/advi {
@@ -2842,9 +2832,7 @@ with pkgs;
     dub-to-nix
     ;
 
-  duff = callPackage ../tools/filesystems/duff {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  duff = callPackage ../tools/filesystems/duff { };
 
   dvtm = callPackage ../tools/misc/dvtm {
     # if you prefer a custom config, write the config.h in dvtm.config.h
@@ -2854,9 +2842,7 @@ with pkgs;
 
   dvtm-unstable = callPackage ../tools/misc/dvtm/unstable.nix { };
 
-  eid-mw = callPackage ../tools/security/eid-mw {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  eid-mw = callPackage ../tools/security/eid-mw { };
 
   engauge-digitizer = libsForQt5.callPackage ../applications/science/math/engauge-digitizer { };
 
@@ -3212,9 +3198,7 @@ with pkgs;
 
   gruut-ipa = with python3.pkgs; toPythonApplication gruut-ipa;
 
-  gsmlib = callPackage ../development/libraries/gsmlib {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  gsmlib = callPackage ../development/libraries/gsmlib { };
 
   gssdp = callPackage ../development/libraries/gssdp { };
 
@@ -7289,9 +7273,7 @@ with pkgs;
 
   flow = callPackage ../development/tools/analysis/flow { };
 
-  fswatch = callPackage ../development/tools/misc/fswatch {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  fswatch = callPackage ../development/tools/misc/fswatch { };
 
   gede = libsForQt5.callPackage ../development/tools/misc/gede { };
 
@@ -8402,9 +8384,7 @@ with pkgs;
   hamlib_3 = callPackage ../development/libraries/hamlib { };
   hamlib_4 = callPackage ../development/libraries/hamlib/4.nix { };
 
-  heimdal = callPackage ../development/libraries/kerberos/heimdal.nix {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  heimdal = callPackage ../development/libraries/kerberos/heimdal.nix { };
 
   harfbuzzFull = harfbuzz.override {
     withGraphite2 = true;
@@ -12019,9 +11999,6 @@ with pkgs;
 
   djview4 = djview;
 
-  dmenu = callPackage ../applications/misc/dmenu { };
-  dmenu-wayland = callPackage ../applications/misc/dmenu/wayland.nix { };
-
   dmenu-rs-enable-plugins = dmenu-rs.override { enablePlugins = true; };
 
   dmensamenu = callPackage ../applications/misc/dmensamenu {
@@ -12064,14 +12041,6 @@ with pkgs;
     wlroots = wlroots_0_18;
   };
 
-  dwm = callPackage ../applications/window-managers/dwm {
-    # dwm is configured entirely through source modification. Allow users to
-    # specify patches through nixpkgs.config.dwm.patches
-    patches = config.dwm.patches or [ ];
-  };
-
-  dwm-status = callPackage ../applications/window-managers/dwm/dwm-status.nix { };
-
   evilwm = callPackage ../applications/window-managers/evilwm {
     patches = config.evilwm.patches or [ ];
   };
@@ -12156,8 +12125,6 @@ with pkgs;
     hamlib = hamlib_4;
   };
 
-  fmit = libsForQt5.callPackage ../applications/audio/fmit { };
-
   focuswriter = qt6Packages.callPackage ../applications/editors/focuswriter { };
 
   fossil = callPackage ../applications/version-management/fossil {
@@ -12178,8 +12145,6 @@ with pkgs;
 
   gauche = callPackage ../development/interpreters/gauche { };
 
-  gazelle-origin = python3Packages.callPackage ../tools/misc/gazelle-origin { };
-
   geany = callPackage ../applications/editors/geany { };
   geany-with-vte = callPackage ../applications/editors/geany/with-vte.nix { };
 
@@ -12550,8 +12515,6 @@ with pkgs;
       haskellPackages.hledger-web;
   hledger-utils = with python3.pkgs; toPythonApplication hledger-utils;
 
-  hovercraft = python3Packages.callPackage ../applications/misc/hovercraft { };
-
   hpack = haskell.lib.compose.justStaticExecutables haskellPackages.hpack;
 
   hpmyroom = libsForQt5.callPackage ../applications/networking/hpmyroom { };
@@ -14780,8 +14743,6 @@ with pkgs;
 
   ibmcloud-cli = callPackage ../tools/admin/ibmcloud-cli { stdenv = stdenvNoCC; };
 
-  instaloader = python3Packages.callPackage ../tools/misc/instaloader { };
-
   iortcw = callPackage ../games/iortcw { };
   # used as base package for iortcw forks
   iortcw_sp = callPackage ../games/iortcw/sp.nix { };
@@ -15390,17 +15351,9 @@ with pkgs;
     nodejs = nodejs_20;
   };
 
-  p4est-sc = callPackage ../development/libraries/science/math/p4est-sc {
-    p4est-sc-debugEnable = false;
-  };
+  p4est-sc-dbg = p4est-sc.override { debug = true; };
 
-  p4est-sc-dbg = callPackage ../development/libraries/science/math/p4est-sc { };
-
-  p4est = callPackage ../development/libraries/science/math/p4est { };
-
-  p4est-dbg = callPackage ../development/libraries/science/math/p4est {
-    p4est-sc = p4est-sc-dbg;
-  };
+  p4est-dbg = p4est.override { debug = true; };
 
   sageWithDoc = sage.override { withDoc = true; };