diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 83cf0511fc5e..3421ef77da5e 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -17,18 +17,12 @@ on:
       NIXPKGS_CI_APP_PRIVATE_KEY:
         required: true
   workflow_dispatch:
-    inputs:
-      updatedWithin:
-        description: 'Updated within [hours]'
-        type: number
-        required: false
-        default: 0 # everything since last run
 
 concurrency:
   # This explicitly avoids using `run_id` for the concurrency key to make sure that only
-  # *one* non-PR run can run at a time.
+  # *one* scheduled run can run at a time.
   group: labels-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number }}
-  # PR- and manually-triggered runs will be cancelled, but scheduled runs will be queued.
+  # PR-triggered runs will be cancelled, but scheduled runs will be queued.
   cancel-in-progress: ${{ github.event_name != 'schedule' }}
 
 # This is used as fallback without app only.
@@ -69,8 +63,6 @@ jobs:
 
       - name: Labels from API data and Eval results
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        env:
-          UPDATED_WITHIN: ${{ inputs.updatedWithin }}
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
@@ -101,6 +93,9 @@ jobs:
             github.hook.wrap('request', async (request, options) => {
               // Requests to the /rate_limit endpoint do not count against the rate limit.
               if (options.url == '/rate_limit') return request(options)
+              // Search requests are in a different resource group, which allows 30 requests / minute.
+              // We do less than a handful each run, so not implementing throttling for now.
+              if (options.url.startsWith('/search/')) return request(options)
               stats.requests++
               if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
                 return writeLimits.schedule(request.bind(null, options))
@@ -126,104 +121,66 @@ jobs:
             await updateReservoir()
             // Update remaining requests every minute to account for other jobs running in parallel.
             const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
-            process.on('uncaughtException', () => clearInterval(reservoirUpdater))
 
-            if (process.env.UPDATED_WITHIN && !/^\d+$/.test(process.env.UPDATED_WITHIN))
-              throw new Error('Please enter "updated within" as integer in hours.')
+            async function handle(item) {
+              try {
+                const log = (k,v,skip) => {
+                  core.info(`#${item.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
+                  return skip
+                }
 
-            const cutoff = new Date(await (async () => {
-              // Always run for Pull Request triggers, no cutoff since there will be a single
-              // response only anyway. 0 is the Unix epoch, so always smaller.
-              if (context.payload.pull_request?.number) return 0
+                log('Last updated at', item.updated_at)
+                stats.prs++
+                log('URL', item.html_url)
 
-              // Manually triggered via UI when updatedWithin is set. Will fallthrough to the last
-              // option if the updatedWithin parameter is set to 0, which is the default.
-              const updatedWithin = Number.parseInt(process.env.UPDATED_WITHIN, 10)
-              if (updatedWithin) return new Date().getTime() - updatedWithin * 60 * 60 * 1000
+                const pull_number = item.number
+                const issue_number = item.number
 
-              // Normally a scheduled run, but could be workflow_dispatch, see above. Go back as far
-              // as the last successful run of this workflow to make sure we are not leaving anyone
-              // behind on GHA failures.
-              // Defaults to go back 1 hour on the first run.
-              return (await github.rest.actions.listWorkflowRuns({
-                ...context.repo,
-                workflow_id: 'labels.yml',
-                event: 'schedule',
-                status: 'success',
-                exclude_pull_requests: true
-              })).data.workflow_runs[0]?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000
-            })())
-            core.info('cutoff timestamp: ' + cutoff.toISOString())
+                // This API request is important for the merge-conflict label, because it triggers the
+                // creation of a new test merge commit. This is needed to actually determine the state of a PR.
+                const pull_request = (await github.rest.pulls.get({
+                  ...context.repo,
+                  pull_number
+                })).data
 
-            // To simplify this action's logic we fetch the pull_request data again below, even if
-            // we are already in a pull_request event's context and would have the data readily
-            // available. We do this by filtering the list of pull requests with head and base
-            // branch - there can only be a single open Pull Request for any such combination.
-            const prEventCondition = !context.payload.pull_request ? undefined : {
-              // "label" is in the format of `user:branch` or `org:branch`
-              head: context.payload.pull_request.head.label,
-              base: context.payload.pull_request.base.ref
-            }
-
-            const prs = await github.paginate(
-              github.rest.pulls.list,
-              {
-                ...context.repo,
-                state: 'open',
-                sort: 'updated',
-                direction: 'desc',
-                ...prEventCondition
-              },
-              (response, done) => response.data.map(async (pull_request) => {
-                try {
-                  const log = (k,v,skip) => {
-                    core.info(`PR #${pull_request.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
-                    return skip
-                  }
-
-                  if (log('Last updated at', pull_request.updated_at, new Date(pull_request.updated_at) < cutoff))
-                    return done()
-                  stats.prs++
-                  log('URL', pull_request.html_url)
-
-                  const run_id = (await github.rest.actions.listWorkflowRuns({
+                const run_id = (await github.rest.actions.listWorkflowRuns({
+                  ...context.repo,
+                  workflow_id: 'pr.yml',
+                  event: 'pull_request_target',
+                  // In pull_request contexts the workflow is still running.
+                  status: context.payload.pull_request ? undefined : 'success',
+                  exclude_pull_requests: true,
+                  head_sha: pull_request.head.sha
+                })).data.workflow_runs[0]?.id ??
+                  // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
+                  (await github.rest.actions.listWorkflowRuns({
                     ...context.repo,
-                    workflow_id: 'pr.yml',
+                    // In older PRs, we need eval.yml instead of pr.yml.
+                    workflow_id: 'eval.yml',
                     event: 'pull_request_target',
-                    // For PR events, the workflow run is still in progress with this job itself.
-                    status: prEventCondition ? 'in_progress' : 'success',
+                    status: 'success',
                     exclude_pull_requests: true,
                     head_sha: pull_request.head.sha
-                  })).data.workflow_runs[0]?.id ??
-                    // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
-                    (await github.rest.actions.listWorkflowRuns({
-                      ...context.repo,
-                      // In older PRs, we need eval.yml instead of pr.yml.
-                      workflow_id: 'eval.yml',
-                      event: 'pull_request_target',
-                      status: 'success',
-                      exclude_pull_requests: true,
-                      head_sha: pull_request.head.sha
-                    })).data.workflow_runs[0]?.id
+                  })).data.workflow_runs[0]?.id
 
-                  // Newer PRs might not have run Eval to completion, yet. We can skip them, because this
-                  // job will be run as part of that Eval run anyway.
-                  if (log('Last eval run', run_id ?? '<pending>', !run_id))
-                    return;
+                // Newer PRs might not have run Eval to completion, yet.
+                // Older PRs might not have an eval.yml workflow, yet.
+                // In either case we continue without fetching an artifact on a best-effort basis.
+                log('Last eval run', run_id ?? '<n/a>')
 
-                  const artifact = (await github.rest.actions.listWorkflowRunArtifacts({
-                    ...context.repo,
-                    run_id,
-                    name: 'comparison'
-                  })).data.artifacts[0]
+                const artifact = run_id && (await github.rest.actions.listWorkflowRunArtifacts({
+                  ...context.repo,
+                  run_id,
+                  name: 'comparison'
+                })).data.artifacts[0]
 
-                  // Instead of checking the boolean artifact.expired, we will give us a minute to
-                  // actually download the artifact in the next step and avoid that race condition.
-                  // Older PRs, where the workflow run was already eval.yml, but the artifact was not
-                  // called "comparison", yet, will be skipped as well.
-                  const expired = new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000)
-                  if (log('Artifact expires at', artifact?.expires_at ?? '<not found>', expired))
-                    return;
+                // Instead of checking the boolean artifact.expired, we will give us a minute to
+                // actually download the artifact in the next step and avoid that race condition.
+                // Older PRs, where the workflow run was already eval.yml, but the artifact was not
+                // called "comparison", yet, will skip the download.
+                const expired = !artifact || new Date(artifact?.expires_at ?? 0) < new Date(new Date().getTime() + 60 * 1000)
+                log('Artifact expires at', artifact?.expires_at ?? '<n/a>')
+                if (!expired) {
                   stats.artifacts++
 
                   await artifactClient.downloadArtifact(artifact.id, {
@@ -232,39 +189,110 @@ jobs:
                       repositoryOwner: context.repo.owner,
                       token: core.getInput('github-token')
                     },
-                    path: path.resolve(pull_request.number.toString()),
+                    path: path.resolve(pull_number.toString()),
                     expectedHash: artifact.digest
                   })
+                }
 
-                  // Create a map (Label -> Boolean) of all currently set labels.
-                  // Each label is set to True and can be disabled later.
-                  const before = Object.fromEntries(
-                    (await github.paginate(github.rest.issues.listLabelsOnIssue, {
+                // Create a map (Label -> Boolean) of all currently set labels.
+                // Each label is set to True and can be disabled later.
+                const before = Object.fromEntries(
+                  (await github.paginate(github.rest.issues.listLabelsOnIssue, {
+                    ...context.repo,
+                    issue_number
+                  }))
+                  .map(({ name }) => [name, true])
+                )
+
+                const approvals = new Set(
+                  (await github.paginate(github.rest.pulls.listReviews, {
+                    ...context.repo,
+                    pull_number
+                  }))
+                  .filter(review => review.state == 'APPROVED')
+                  .map(review => review.user?.id)
+                )
+
+                const latest_event_at = new Date(
+                  (await github.paginate(
+                    github.rest.issues.listEventsForTimeline,
+                    {
                       ...context.repo,
-                      issue_number: pull_request.number
-                    }))
-                    .map(({ name }) => [name, true])
-                  )
+                      issue_number,
+                      per_page: 100
+                    }
+                  ))
+                  .filter(({ event }) => [
+                    // These events are hand-picked from:
+                    //   https://docs.github.com/en/rest/using-the-rest-api/issue-event-types?apiVersion=2022-11-28
+                    // Each of those causes a PR/issue to *not* be considered as stale anymore.
+                    // Most of these use created_at.
+                    'assigned',
+                    'commented', // uses updated_at, because that could be > created_at
+                    'committed', // uses committer.date
+                    'head_ref_force_pushed',
+                    'milestoned',
+                    'pinned',
+                    'ready_for_review',
+                    'renamed',
+                    'reopened',
+                    'review_dismissed',
+                    'review_requested',
+                    'reviewed', // uses submitted_at
+                    'unlocked',
+                    'unmarked_as_duplicate',
+                  ].includes(event))
+                  .map(({ created_at, updated_at, committer, submitted_at }) => new Date(updated_at ?? created_at ?? submitted_at ?? committer.date))
+                  // Reverse sort by date value. The default sort() sorts by string representation, which is bad for dates.
+                  .sort((a,b) => b-a)
+                  .at(0) ?? item.created_at
+                )
 
-                  const approvals = new Set(
-                    (await github.paginate(github.rest.pulls.listReviews, {
-                      ...context.repo,
-                      pull_number: pull_request.number
-                    }))
-                    .filter(review => review.state == 'APPROVED')
-                    .map(review => review.user?.id)
-                  )
+                const stale_at = new Date(new Date().setDate(new Date().getDate() - 180))
 
+                // After creation of a Pull Request, `merge_commit_sha` will be null initially:
+                // The very first merge commit will only be calculated after a little while.
+                // To avoid labeling the PR as conflicted before that, we wait a few minutes.
+                // This is intentionally less than the time that Eval takes, so that the label job
+                // running after Eval can indeed label the PR as conflicted if that is the case.
+                const merge_commit_sha_valid = new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000
+
+                // Manage most of the labels, without eval results
+                const after = Object.assign(
+                  {},
+                  before,
+                  {
+                    // We intentionally don't use the mergeable or mergeable_state attributes.
+                    // Those have an intermediate state while the test merge commit is created.
+                    // This doesn't work well for us, because we might have just triggered another
+                    // test merge commit creation by request the pull request via API at the start
+                    // of this function.
+                    // The attribute merge_commit_sha keeps the old value of null or the hash *until*
+                    // the new test merge commit has either successfully been created or failed so.
+                    // This essentially means we are updating the merge conflict label in two steps:
+                    // On the first pass of the day, we just fetch the pull request, which triggers
+                    // the creation. At this stage, the label is likely not updated, yet.
+                    // The second pass will then read the result from the first pass and set the label.
+                    '2.status: merge conflict': merge_commit_sha_valid && !pull_request.merge_commit_sha,
+                    '2.status: stale': !before['1.severity: security'] && latest_event_at < stale_at,
+                    '12.approvals: 1': approvals.size == 1,
+                    '12.approvals: 2': approvals.size == 2,
+                    '12.approvals: 3+': approvals.size >= 3,
+                    '12.first-time contribution':
+                      [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association),
+                  }
+                )
+
+                // Manage labels based on eval results
+                if (!expired) {
                   const maintainers = new Set(Object.keys(
-                    JSON.parse(await readFile(`${pull_request.number}/maintainers.json`, 'utf-8'))
+                    JSON.parse(await readFile(`${pull_number}/maintainers.json`, 'utf-8'))
                   ).map(m => Number.parseInt(m, 10)))
 
-                  const evalLabels = JSON.parse(await readFile(`${pull_request.number}/changed-paths.json`, 'utf-8')).labels
+                  const evalLabels = JSON.parse(await readFile(`${pull_number}/changed-paths.json`, 'utf-8')).labels
 
-                  // Manage the labels
-                  const after = Object.assign(
-                    {},
-                    before,
+                  Object.assign(
+                    after,
                     // Ignore `evalLabels` if it's an array.
                     // This can happen for older eval runs, before we switched to objects.
                     // The old eval labels would have been set by the eval run,
@@ -272,42 +300,112 @@ jobs:
                     // TODO: Simplify once old eval results have expired (~2025-10)
                     (Array.isArray(evalLabels) ? undefined : evalLabels),
                     {
-                      '12.approvals: 1': approvals.size == 1,
-                      '12.approvals: 2': approvals.size == 2,
-                      '12.approvals: 3+': approvals.size >= 3,
                       '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)),
-                      '12.first-time contribution':
-                        [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association),
                     }
                   )
-
-                  // No need for an API request, if all labels are the same.
-                  const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name])
-                  if (log('Has changes', hasChanges, !hasChanges))
-                    return;
-
-                  // Skipping labeling on a pull_request event, because we have no privileges.
-                  const labels = Object.entries(after).filter(([,value]) => value).map(([name]) => name)
-                  if (log('Set labels', labels, context.eventName == 'pull_request'))
-                    return;
-
-                  await github.rest.issues.setLabels({
-                    ...context.repo,
-                    issue_number: pull_request.number,
-                    labels
-                  })
-                } catch (cause) {
-                  throw new Error(`Labeling PR #${pull_request.number} failed.`, { cause })
                 }
-              })
-            );
 
-            (await Promise.allSettled(prs.flat()))
-              .filter(({ status }) => status == 'rejected')
-              .map(({ reason }) => core.setFailed(`${reason.message}\n${reason.cause.stack}`))
+                // No need for an API request, if all labels are the same.
+                const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name])
+                if (log('Has changes', hasChanges, !hasChanges))
+                  return;
 
-            core.notice(`Processed ${stats.prs} PRs, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`)
-            clearInterval(reservoirUpdater)
+                // Skipping labeling on a pull_request event, because we have no privileges.
+                const labels = Object.entries(after).filter(([,value]) => value).map(([name]) => name)
+                if (log('Set labels', labels, context.eventName == 'pull_request'))
+                  return;
+
+                await github.rest.issues.setLabels({
+                  ...context.repo,
+                  issue_number,
+                  labels
+                })
+              } catch (cause) {
+                throw new Error(`Labeling #${item.number} failed.`, { cause })
+              }
+            }
+
+            try {
+              if (context.payload.pull_request) {
+                await handle(context.payload.pull_request)
+              } else {
+                const workflowData = (await github.rest.actions.listWorkflowRuns({
+                  ...context.repo,
+                  workflow_id: 'labels.yml',
+                  event: 'schedule',
+                  status: 'success',
+                  exclude_pull_requests: true,
+                  per_page: 1
+                })).data
+
+                // Go back as far as the last successful run of this workflow to make sure
+                // we are not leaving anyone behind on GHA failures.
+                // Defaults to go back 1 hour on the first run.
+                const cutoff = new Date(workflowData.workflow_runs[0]?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000)
+                core.info('cutoff timestamp: ' + cutoff.toISOString())
+
+                const updatedItems = await github.paginate(
+                  github.rest.search.issuesAndPullRequests,
+                  {
+                    q: [
+                      `repo:"${process.env.GITHUB_REPOSITORY}"`,
+                      'type:pr',
+                      'is:open',
+                      `updated:>=${cutoff.toISOString()}`
+                    ].join(' AND '),
+                    // TODO: Remove in 2025-10, when it becomes the default.
+                    advanced_search: true
+                  }
+                )
+
+                // The search endpoint only allows fetching the first 1000 records, but the
+                // pull request list endpoint does not support counting the total number
+                // of results.
+                // Thus, we use /search for counting and /pulls for reading the response.
+                const { total_count: total_pulls } = (await github.rest.search.issuesAndPullRequests({
+                  q: [
+                    `repo:"${process.env.GITHUB_REPOSITORY}"`,
+                    'type:pr',
+                    'is:open'
+                  ].join(' AND '),
+                  sort: 'created',
+                  direction: 'asc',
+                  // TODO: Remove in 2025-10, when it becomes the default.
+                  advanced_search: true,
+                  per_page: 1
+                })).data
+                const { total_count: total_runs } = workflowData
+
+                const allPulls = (await github.rest.pulls.list({
+                  ...context.repo,
+                  state: 'open',
+                  sort: 'created',
+                  direction: 'asc',
+                  per_page: 100,
+                  // We iterate through pages of 100 items across scheduled runs. With currently ~7000 open PRs and
+                  // up to 6*24=144 scheduled runs per day, we hit every PR twice each day.
+                  // We might not hit every PR on one iteration, because the pages will shift slightly when
+                  // PRs are closed or merged. We assume this to be OK on the bigger scale, because a PR which was
+                  // missed once, would have to move through the whole page to be missed again. This is very unlikely,
+                  // so it should certainly be hit on the next iteration.
+                  // TODO: Evaluate after a while, whether the above holds still true and potentially implement
+                  // an overlap between runs.
+                  page: total_runs % Math.ceil(total_pulls / 100)
+                })).data
+
+                // Some items might be in both search results, so filtering out duplicates as well.
+                const items = [].concat(updatedItems, allPulls)
+                  .filter((thisItem, idx, arr) => idx == arr.findIndex(firstItem => firstItem.number == thisItem.number))
+
+                ;(await Promise.allSettled(items.map(handle)))
+                  .filter(({ status }) => status == 'rejected')
+                  .map(({ reason }) => core.setFailed(`${reason.message}\n${reason.cause.stack}`))
+
+                core.notice(`Processed ${stats.prs} PRs, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`)
+              }
+            } finally {
+              clearInterval(reservoirUpdater)
+            }
 
       - name: Log current API rate limits
         env:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 8636219cc9ad..3b3e9b4bdb1f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -313,7 +313,7 @@ Container system, boot system and library changes are some examples of the pull
 
 To streamline automated updates, leverage the nixpkgs-merge-bot by simply commenting `@NixOS/nixpkgs-merge-bot merge`. The bot will verify if the following conditions are met, refusing to merge otherwise:
 
-- the PR author should be @r-ryantm;
+- the PR author should be @r-ryantm or a Nixpkgs committer;
 - the commenter that issued the command should be among the package maintainers;
 - the package should reside in `pkgs/by-name`.
 
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 3e906b17836b..13a690ad5eb7 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -31,12 +31,18 @@
 - `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatable due to major api changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`.
   Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md.
 
+- NetBox was updated to `>= 4.3.0`. Have a look at the breaking changes
+  of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration.
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 - Added `rewriteURL` attribute to the nixpkgs `config`, to allow for rewriting the URLs downloaded by `fetchurl`.
 
+- The systemd initrd will now respect `x-systemd.wants` and `x-systemd.requires` for reliably unlocking multi-disk bcachefs volumes.
+
 - New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.
 
 - `gramps` has been updated to 6.0.0
diff --git a/maintainers/README.md b/maintainers/README.md
index 2759b0aa7dc1..91da7847fdbc 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -178,7 +178,7 @@ are available under `./scripts/`.  See its [README](./scripts/README.md)
 for further information.
 
 # nixpkgs-merge-bot
-To streamline autoupdates, leverage the nixpkgs-merge-bot by commenting `@NixOS/nixpkgs-merge-bot merge` if the package resides in pkgs-by-name and the commenter is among the package maintainers. The bot ensures that all ofborg checks, except for darwin, are successfully completed before merging the pull request. Should the checks still be underway, the bot patiently waits for ofborg to finish before attempting the merge again.
+To streamline autoupdates, leverage the nixpkgs-merge-bot by commenting `@NixOS/nixpkgs-merge-bot merge` if the package resides in pkgs-by-name, the commenter is among the package maintainers, and the pull request author is @r-ryantm or a Nixpkgs committer. The bot ensures that all ofborg checks, except for darwin, are successfully completed before merging the pull request. Should the checks still be underway, the bot patiently waits for ofborg to finish before attempting the merge again.
 
 # Guidelines for Committers
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 25f340886351..940d7a59b496 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1600,6 +1600,12 @@
     githubId = 962885;
     name = "Andrew Chambers";
   };
+  andrewfield = {
+    email = "andrew_field@hotmail.co.uk";
+    github = "andrew-field";
+    githubId = 27866671;
+    name = "Andrew Field";
+  };
   andrewgazelka = {
     email = "andrew@gazelka.com";
     github = "andrewgazelka";
@@ -5103,6 +5109,12 @@
     name = "Changsheng Wu";
     githubId = 2083950;
   };
+  connerohnesorge = {
+    email = "conneroisu@outlook.com";
+    github = "conneroisu";
+    githubId = 88785126;
+    name = "Conner Ohnesorge";
+  };
   conni2461 = {
     email = "simon-hauser@outlook.com";
     github = "Conni2461";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 0696cca7818b..d2c113d2402a 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -759,6 +759,20 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
+  loongarch64 = {
+    members = [
+      aleksana
+      Cryolitia
+      darkyzhou
+      dramforever
+      wegank
+    ];
+    githubTeams = [ "loongarch64" ];
+    scope = "Maintain LoongArch64 related packages and code";
+    shortName = "LoongArch64";
+    enableFeatureFreezePing = true;
+  };
+
   lumiguide = {
     # Verify additions by approval of an already existing member of the team.
     members = [
diff --git a/nixos/modules/image/repart-image.nix b/nixos/modules/image/repart-image.nix
index e62db75caf8f..49087d4786c5 100644
--- a/nixos/modules/image/repart-image.nix
+++ b/nixos/modules/image/repart-image.nix
@@ -173,11 +173,13 @@ stdenvNoCC.mkDerivation (
         "--architecture=${systemdArch}"
         "--dry-run=no"
         "--size=auto"
-        "--seed=${seed}"
         "--definitions=${finalAttrs.finalRepartDefinitions}"
         "--split=${lib.boolToString split}"
         "--json=pretty"
       ]
+      ++ lib.optionals (seed != null) [
+        "--seed=${seed}"
+      ]
       ++ lib.optionals createEmpty [
         "--empty=create"
       ]
diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index 13c90aa9ab7a..a44a2e5f9ea3 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -161,8 +161,9 @@ in
       # Generated with `uuidgen`. Random but fixed to improve reproducibility.
       default = "0867da16-f251-457d-a9e8-c31f9a3c220b";
       description = ''
-        A UUID to use as a seed. You can set this to `null` to explicitly
+        A UUID to use as a seed. You can set this to `random` to explicitly
         randomize the partition UUIDs.
+        See {manpage}`systemd-repart(8)` for more information.
       '';
     };
 
diff --git a/nixos/modules/programs/winbox.nix b/nixos/modules/programs/winbox.nix
index d4be0a08d871..e0643030166b 100644
--- a/nixos/modules/programs/winbox.nix
+++ b/nixos/modules/programs/winbox.nix
@@ -24,6 +24,14 @@ in
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    networking.firewall.allowedUDPPorts = lib.optionals cfg.openFirewall [ 5678 ];
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedUDPPorts = [ 5678 ];
+      allowedUDPPortRanges = [
+        {
+          from = 40000;
+          to = 50000;
+        }
+      ];
+    };
   };
 }
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index 73581b56d62c..eefa274cc5fd 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -102,20 +102,18 @@ in
     package = lib.mkOption {
       type = lib.types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "25.05" then
+        if lib.versionAtLeast config.system.stateVersion "25.11" then
+          pkgs.netbox_4_3
+        else if lib.versionAtLeast config.system.stateVersion "25.05" then
           pkgs.netbox_4_2
-        else if lib.versionAtLeast config.system.stateVersion "24.11" then
-          pkgs.netbox_4_1
-        else if lib.versionAtLeast config.system.stateVersion "24.05" then
-          pkgs.netbox_3_7
         else
-          pkgs.netbox_3_6;
+          pkgs.netbox_4_1;
       defaultText = lib.literalExpression ''
-        if lib.versionAtLeast config.system.stateVersion "24.11"
-        then pkgs.netbox_4_1
-        else if lib.versionAtLeast config.system.stateVersion "24.05"
-        then pkgs.netbox_3_7
-        else pkgs.netbox_3_6;
+        if lib.versionAtLeast config.system.stateVersion "25.11"
+        then pkgs.netbox_4_3
+        else if lib.versionAtLeast config.system.stateVersion "25.05"
+        then pkgs.netbox_4_2
+        else pkgs.netbox_4_1;
       '';
       description = ''
         NetBox package to use.
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index b0f6f916d74e..6128b5d1e68f 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -93,19 +93,35 @@ let
     let
       mountUnit = "${utils.escapeSystemdPath (prefix + (lib.removeSuffix "/" fs.mountPoint))}.mount";
       device = firstDevice fs;
-      deviceUnit = "${utils.escapeSystemdPath device}.device";
+      mkDeviceUnit = device: "${utils.escapeSystemdPath device}.device";
+      deviceUnit = mkDeviceUnit device;
+      extractProperty =
+        prop: options: (map (lib.removePrefix "${prop}=") (builtins.filter (lib.hasPrefix prop) options));
+      mkMountUnit = path: "${utils.escapeSystemdPath path}.mount";
+      normalizeUnits =
+        unit:
+        if lib.hasPrefix "/dev/" unit then
+          mkDeviceUnit unit
+        else if lib.hasPrefix "/" unit then
+          mkMountUnit unit
+        else
+          unit;
+      requiredUnits = map normalizeUnits (extractProperty "x-systemd.requires" fs.options);
+      wantedUnits = map normalizeUnits (extractProperty "x-systemd.wants" fs.options);
     in
     {
       name = "unlock-bcachefs-${utils.escapeSystemdPath fs.mountPoint}";
       value = {
         description = "Unlock bcachefs for ${fs.mountPoint}";
         requiredBy = [ mountUnit ];
-        after = [ deviceUnit ];
+        after = [ deviceUnit ] ++ requiredUnits ++ wantedUnits;
         before = [
           mountUnit
           "shutdown.target"
         ];
         bindsTo = [ deviceUnit ];
+        requires = requiredUnits;
+        wants = wantedUnits;
         conflicts = [ "shutdown.target" ];
         unitConfig.DefaultDependencies = false;
         serviceConfig = {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b112daf17b07..840b1714ff96 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -913,9 +913,9 @@ in
   networking.scripted = handleTest ./networking/networkd-and-scripted.nix { networkd = false; };
   networking.networkd = handleTest ./networking/networkd-and-scripted.nix { networkd = true; };
   networking.networkmanager = handleTest ./networking/networkmanager.nix { };
-  netbox_3_7 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_3_7; };
   netbox_4_1 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_1; };
   netbox_4_2 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_2; };
+  netbox_4_3 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_3; };
   netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix;
   # TODO: put in networking.nix after the test becomes more complete
   networkingProxy = runTest ./networking-proxy.nix;
diff --git a/nixos/tests/web-apps/netbox-upgrade.nix b/nixos/tests/web-apps/netbox-upgrade.nix
index 1a8c9599206d..29b553829dcb 100644
--- a/nixos/tests/web-apps/netbox-upgrade.nix
+++ b/nixos/tests/web-apps/netbox-upgrade.nix
@@ -1,7 +1,7 @@
 { lib, pkgs, ... }:
 let
-  oldNetbox = "netbox_4_1";
-  newNetbox = "netbox_4_2";
+  oldNetbox = "netbox_4_2";
+  newNetbox = "netbox_4_3";
 
   apiVersion =
     version:
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 7e0eb9ee3f45..cd683c6d1d58 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -1114,6 +1114,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  auto-fix-return-nvim = buildVimPlugin {
+    pname = "auto-fix-return.nvim";
+    version = "2025-06-23";
+    src = fetchFromGitHub {
+      owner = "Jay-Madden";
+      repo = "auto-fix-return.nvim";
+      rev = "01ccaa47e286f1627b730b9cc58e7ebb2a622fd1";
+      sha256 = "06as097zfdvrzx7ajdmib3czsbmh7r5l5szvlmj8lf8wfk7d35bq";
+    };
+    meta.homepage = "https://github.com/Jay-Madden/auto-fix-return.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   auto-git-diff = buildVimPlugin {
     pname = "auto-git-diff";
     version = "2022-10-29";
@@ -5933,6 +5946,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  helm-ls-nvim = buildVimPlugin {
+    pname = "helm-ls.nvim";
+    version = "2025-06-07";
+    src = fetchFromGitHub {
+      owner = "qvalentin";
+      repo = "helm-ls.nvim";
+      rev = "2bf45466c26a24e05b5266f82a3abead13e32c16";
+      sha256 = "0h0mp3qf57s4byr37rg1ynbr3bha1wa9fswnv3ypb0n9n9igr5ys";
+    };
+    meta.homepage = "https://github.com/qvalentin/helm-ls.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   helpview-nvim = buildVimPlugin {
     pname = "helpview.nvim";
     version = "2025-04-26";
@@ -6886,6 +6912,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  lazydocker-nvim = buildVimPlugin {
+    pname = "lazydocker.nvim";
+    version = "2025-06-05";
+    src = fetchFromGitHub {
+      owner = "crnvl96";
+      repo = "lazydocker.nvim";
+      rev = "d5878defd757a193fbd73f12ec54faee9a6b19e1";
+      sha256 = "0vwx3yvy4lqppjgwz5gkqxrbr5m6b6kplh5z0nh5s7i7xqahqm1r";
+    };
+    meta.homepage = "https://github.com/crnvl96/lazydocker.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   lazygit-nvim = buildVimPlugin {
     pname = "lazygit.nvim";
     version = "2025-06-13";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 821a7be77646..97d59706fd25 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -23,6 +23,7 @@
   direnv,
   fzf,
   gawk,
+  helm-ls,
   himalaya,
   htop,
   jq,
@@ -118,6 +119,8 @@
   # typst-preview dependencies
   tinymist,
   websocat,
+  # lazydocker.nvim dependencies
+  lazydocker,
   # luau-lsp-nvim dependencies
   luau-lsp,
   # uv.nvim dependencies
@@ -1403,6 +1406,12 @@ in
     luaAttr = luaPackages.haskell-tools-nvim;
   };
 
+  helm-ls-nvim = super.helm-ls-nvim.overrideAttrs {
+    runtimeDeps = [
+      helm-ls
+    ];
+  };
+
   helpview-nvim = super.helpview-nvim.overrideAttrs {
     nvimSkipModules = [ "definitions.__vimdoc" ];
   };
@@ -1533,6 +1542,12 @@ in
     ];
   };
 
+  lazydocker-nvim = super.lazydocker-nvim.overrideAttrs {
+    runtimeDeps = [
+      lazydocker
+    ];
+  };
+
   LazyVim = super.LazyVim.overrideAttrs {
     # Any other dependency is optional
     dependencies = [ self.lazy-nvim ];
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index b0d7453038b2..8b9296b0f093 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -84,6 +84,7 @@ https://github.com/skywind3000/asynctasks.vim/,,
 https://github.com/vmchale/ats-vim/,,
 https://github.com/augmentcode/augment.vim/,HEAD,
 https://github.com/ray-x/aurora/,,
+https://github.com/Jay-Madden/auto-fix-return.nvim/,HEAD,
 https://github.com/hotwatermorning/auto-git-diff/,,
 https://github.com/asiryk/auto-hlsearch.nvim/,HEAD,
 https://github.com/jiangmiao/auto-pairs/,,
@@ -454,6 +455,7 @@ https://github.com/wenzel-hoffman/haskell-with-unicode.vim/,HEAD,
 https://github.com/travitch/hasksyn/,,
 https://github.com/lukas-reineke/headlines.nvim/,HEAD,
 https://github.com/rebelot/heirline.nvim/,,
+https://github.com/qvalentin/helm-ls.nvim/,HEAD,
 https://github.com/OXY2DEV/helpview.nvim/,HEAD,
 https://github.com/RaafatTurki/hex.nvim/,HEAD,
 https://github.com/Yggdroot/hiPairs/,,
@@ -528,6 +530,7 @@ https://github.com/latex-box-team/latex-box/,,
 https://github.com/dundalek/lazy-lsp.nvim/,HEAD,
 https://github.com/folke/lazy.nvim/,HEAD,
 https://github.com/folke/lazydev.nvim/,,
+https://github.com/crnvl96/lazydocker.nvim/,HEAD,
 https://github.com/kdheepak/lazygit.nvim/,,
 https://github.com/Julian/lean.nvim/,,
 https://github.com/leanprover/lean.vim/,,
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index abc4d61c02cd..2fc9e6ee146f 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -566,11 +566,12 @@ let
         # exact version or even running a newer version.
         ./patches/chromium-136-nodejs-assert-minimal-version-instead-of-exact-match.patch
       ]
-      ++ lib.optionals (chromiumVersionAtLeast "137") [
+      ++ lib.optionals (versionRange "137" "138") [
         (fetchpatch {
           # Partial revert of upstream clang+llvm bump revert to fix the following error when building with LLVM < 21:
           #  clang++: error: unknown argument: '-fextend-variable-liveness=none'
           # https://chromium-review.googlesource.com/c/chromium/src/+/6514242
+          # Upstream relanded this in M138+ with <https://chromium-review.googlesource.com/c/chromium/src/+/6541127>.
           name = "chromium-137-llvm-19.patch";
           url = "https://chromium.googlesource.com/chromium/src/+/ddf8f8a465be2779bd826db57f1299ccd2f3aa25^!?format=TEXT";
           includes = [ "build/config/compiler/BUILD.gn" ];
@@ -579,11 +580,12 @@ let
           hash = "sha256-wAR8E4WKMvdkW8DzdKpyNpp4dynIsYAbnJ2MqE8V2o8=";
         })
       ]
-      ++ lib.optionals (chromiumVersionAtLeast "137") [
+      ++ lib.optionals (versionRange "137" "138") [
         (fetchpatch {
           # Backport "Fix build with system libpng" that fixes a typo in core/fxcodec/png/png_decoder.cpp that causes
           # the build to fail at the final linking step.
           # https://pdfium-review.googlesource.com/c/pdfium/+/132130
+          # Started shipping with M138+.
           name = "pdfium-Fix-build-with-system-libpng.patch";
           url = "https://pdfium.googlesource.com/pdfium.git/+/83f11d630aa1cb6d5ceb292364412f7b0585a201^!?format=TEXT";
           extraPrefix = "third_party/pdfium/";
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index ae3334e23ce0..330623ce8247 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,27 +1,27 @@
 {
   "chromium": {
-    "version": "137.0.7151.119",
+    "version": "138.0.7204.49",
     "chromedriver": {
-      "version": "137.0.7151.120",
-      "hash_darwin": "sha256-3NECoMlK57ZlCUPra20rJrZcx9FnMWvTXlcdksn8FUc=",
-      "hash_darwin_aarch64": "sha256-P1trGStKjTD/h+avjAXE5N6nqvAra9RDsSvrR/pTRUA="
+      "version": "138.0.7204.50",
+      "hash_darwin": "sha256-JqEH04dZxqyUKou8QkwtJa0+4AXWPm0p3NJlYM2fnqw=",
+      "hash_darwin_aarch64": "sha256-WojmEFRIqFDMfay3UA0pzSwH9FRno+nHxzR47x4o7gA="
     },
     "deps": {
       "depot_tools": {
-        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
-        "hash": "sha256-7HJyJARZPes5MmKgXd3TV1uRjk0bH/pkPm+F4scg+Tc="
+        "rev": "a8900cc0f023d6a662eb66b317e8ddceeb113490",
+        "hash": "sha256-1avxBlK0WLHTru5wUecbiGpSEYv8Epobsl4EfCaWX9A="
       },
       "gn": {
-        "rev": "85cc21e94af590a267c1c7a47020d9b420f8a033",
-        "hash": "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI="
+        "rev": "ebc8f16ca7b0d36a3e532ee90896f9eb48e5423b",
+        "hash": "sha256-UB9a7Fr1W0yYld6WbXyRR8dFqWsj/zx4KumDZ5JQKSM="
       },
-      "npmHash": "sha256-I6MsfAhrLRmgiRJ13LSejfy2N63C3Oug5tOOXA622j4="
+      "npmHash": "sha256-8d5VTHutv51libabhxv7SqPRcHfhVmGDSOvTSv013rE="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "e0ac9d12dff5f2d33c935958b06bf1ded7f1c08c",
-        "hash": "sha256-+3C2n/7bbIOpXGvBrFnSMNlgLVRMoPtOF14CDROVClI=",
+        "rev": "d2b48fd5f7813ed477a2d68fa232b8178fa4fb1e",
+        "hash": "sha256-n2jSVXpV0mqdTdLpE+N3yJhutJTOE1fez0BleU0+VSU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -31,28 +31,28 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "d0e4db9fcea15a392aaada986cbe33658afc0454",
-        "hash": "sha256-P/uDeqalafY1S7AqZkL1Pz7Jc+iWrkfiACxEtgTRqdU="
+        "rev": "57196dd146582915c955f6d388e31aea93220c51",
+        "hash": "sha256-FVdcKGwRuno3AzS6FUvI8OTj3mBMRfFR2A8GzYcwIU4="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "9d0cba76be7399399d3a499ff3a52c264db3b104",
-        "hash": "sha256-wpMma142NBqyrSbaReQr5yOYhvQIZ06j6S2EUnXmZ2I="
+        "rev": "a01c02c9d4acbdae3b7e8a2f3ee58579a9c29f96",
+        "hash": "sha256-36ulJk/YTfP5k1sDeA/WQyIO8xaplRKK4cQhfTZdpko="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
-        "rev": "f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e",
-        "hash": "sha256-X9cAbyd8ZPSwqOGhPYwIZ6b9E3tVwAuAYZKMgbZQxgk="
+        "rev": "9810fb23f6ba666f017c2b67c67de2bcac2b44bd",
+        "hash": "sha256-DkCvfFjMztFTzKf081XyiefW6tMBSZ1AdzcPzXAVPnk="
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "81e2cb40a70de2b6978e6d8658891ded9a77f7e3",
-        "hash": "sha256-XdFKn+cGOxA0fHkVMG9UAhCmpML44ocoyHB7XnumX7o="
+        "rev": "8575f4ae4fcf8892938bd9766cf1a5c90a0ed04e",
+        "hash": "sha256-O1S3ijnoVrTHmZDGmgQQe0MVGsSZL7usXAPflGFmMXY="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "cc59264cf9b2ecab0cfc8b51f6f1878372416d36",
-        "hash": "sha256-wQMUL5uAaR8sA1V0FHTZv3jVVaF3NxiHfNnlMq3YImY="
+        "rev": "9c3ae3120fe83b998d0498dcc9ad3a56c29fad0c",
+        "hash": "sha256-BsoHIvdqgYzBUkd23++enEHIhq5GeVWrWdVdhXrHh9A="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -71,8 +71,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "e157e12d99cfc729a970b474344673c44e2d2c9c",
-        "hash": "sha256-fowwJbXOR4OIN4+1bJEWv9VP/TLHb9+H1Vt3apVLwkk="
+        "rev": "d21d90790d8ea421b317c4cb52a0d94133422796",
+        "hash": "sha256-X9GIZkPokZ8ojNVDScDQL8D0tJGsaQMg8ncenuBzFHk="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -81,8 +81,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "faec206356fe384c522f34982ae2e92f2f111242",
-        "hash": "sha256-8SuRhYAD3RWMiqD/a8usrRnYKd6prAK5jdwJVXRI+Q0="
+        "rev": "3b42119c3e4be5d4720c3c1b384106fa43e9b5e3",
+        "hash": "sha256-UYyBMjv6ATIwBXYngGof85pBCHXb/jYXetVo0oBrHf8="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -96,8 +96,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "df9c59dcacff7d186d00e3263a1aa68f8059137c",
-        "hash": "sha256-ybi/DwOQ10I+MK9buKpdNcUlFAI9RA3NfyoB3Udpfyo="
+        "rev": "df15136b959fc60c230265f75ee7fc75c96e8250",
+        "hash": "sha256-b4bGxhtrsfmVdJo/5QT4/mtQ6hqxmfpmcrieqaT9/ls="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -111,8 +111,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "dd7e71367795e2dc4d46effda5378f22e9000d16",
-        "hash": "sha256-EZoSoDLFWRR2xkHOKNaNVQvubFp8in0p7/CHN8CFaVI="
+        "rev": "c9d2e24d1a6da00165a0b5908ea4ba05c2e5f0b2",
+        "hash": "sha256-EFhi4dELfyq6FcB+YFlzKfoXz44i5ieFK1KUlFzqE1I="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -131,8 +131,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "fbe707f88ccabca01031e47bf165bd9d499878dd",
-        "hash": "sha256-8tmDR3l7eHWUfVRU90Kg76N/moU6Lb5b3FySJOckl8U="
+        "rev": "86772f20cca54b46f62b65ece1ef61224aef09db",
+        "hash": "sha256-N9DVbQE56WWBmJ/PJlYhU+pr8I+PFf/7FzMLCNqx3hg="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -141,8 +141,8 @@
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "8209d53f0ef0257e5b8c78d22057086403946cca",
-        "hash": "sha256-2yM8Fct7Ru8ZSFr+Qm1Bv52K2/geAwmOpWc/X7yxLQY="
+        "rev": "d72e2b1a15d22fc825e2f3c939f1baac43281ae9",
+        "hash": "sha256-0LfNcR1FXy5GcL2yHHA6A7EJIWtZU1U/2xSq/eysUa0="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -161,8 +161,13 @@
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "3df76734dc695c4d1c51276b5d9eb63078362972",
-        "hash": "sha256-4jCsCt2rcUpUk2xeL3tZx/jTnuJ+COG+xsDtR+sK1oQ="
+        "rev": "905c7cbfeaac1cf3feb4c6056dd6f3dbaa06b074",
+        "hash": "sha256-eMDb0nG9HDiesd8KPajbMej8JTll4JkIf17KMnKvW1s="
+      },
+      "src/third_party/dawn/third_party/webgpu-headers/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
+        "rev": "60cd9020309b87a30cd7240aad32accd24262a5e",
+        "hash": "sha256-+Kf4yPBhM6y2kYTZud9vCavT/BBOzDBsph5+/bUuwkM="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -176,13 +181,13 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "918cf66ed841930fe1554ae8d78974b95e989596",
-        "hash": "sha256-gzcXse/emv9JBMiInUV5KTeyMQ0igUdFpzUJR4vCUu4="
+        "rev": "9295969e1dad2c31d0d99481734c1c68dcbc6403",
+        "hash": "sha256-+Gs+efB1ZizjMYRSRTQrMDPZsDC+dgNJ9+yHXkzm/ZM="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "232a723f5096ab02d53d87931efa485fa77d3b03",
-        "hash": "sha256-0ynZuxIqBIpNkfD3Y9XdPFQr7HeQcsUO3lhnqvH+k8c="
+        "rev": "2625edb085169e92cf036c236ac79ab594a7b1cc",
+        "hash": "sha256-+Z7KphmQYCeN0aJkqyMrJ4tIi3BhqN16KoPNLb/bMGo="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -191,8 +196,8 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "000f47cfa393d7f9557025a252862e2a61a60d44",
-        "hash": "sha256-FIJZE1Qu1MLZA4qxB68k1NjhgSbFTjf57YF85JicVZw="
+        "rev": "5477c6dfde1132b685c73edc16e1bc71449a691d",
+        "hash": "sha256-xHe9WoAq1FElMSnu5mlEzrH+EzKiwWXeXMCH69KL5a0="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -226,23 +231,23 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "68114875ad35b573034a2ab1f5cdf3dbb0e59468",
-        "hash": "sha256-cGpteAnjGcxJUcrdLRFfQN7ruTEdNvNCbOH6EC+a39s="
+        "rev": "fe88d943e5f328b34e38b91296db39650f6ec6f3",
+        "hash": "sha256-WlSxI1J+HjAD2UaQjW3oOQpZDnMn/ROpTLYTP4efTi4="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "d91cc488cd651b00009e5d6c70f222362598bec9",
-        "hash": "sha256-o/sw1P+mZOSb6XIVFivC02hTPu++x+xJy2SRP2I9yGE="
+        "rev": "feff46a3cd49eb39667205cdfa2b490bcffc9ba1",
+        "hash": "sha256-YomhvLtDFkGWyivN81gRxtOh9U32Zt6+/obTwccJuRo="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "1fcc527019d786502b02f71b8b764ee674a40953",
-        "hash": "sha256-7HJyJARZPes5MmKgXd3TV1uRjk0bH/pkPm+F4scg+Tc="
+        "rev": "a8900cc0f023d6a662eb66b317e8ddceeb113490",
+        "hash": "sha256-1avxBlK0WLHTru5wUecbiGpSEYv8Epobsl4EfCaWX9A="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "afc8e923a37090445d6d97ca23fea49d9eb7b9cf",
-        "hash": "sha256-io0J6tt0RXumjjSklZyJpALV5IikPbROd40xcrX4iBs="
+        "rev": "f8dfe8b36e516cef8a5a169e88d16480d8abdc68",
+        "hash": "sha256-7ygnGBAeiLxwbTx5s7LRs9+ZOe06tr8VFcSY5cVHnS4="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -256,8 +261,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "464c1d097891a1462ab28bf8bb763c1683883892",
-        "hash": "sha256-OJyfUyiR8PFSaWltx6Ig0RCB+LxPxrPtc0GUfu2dKrk="
+        "rev": "ae3aba99db4c829b4cc4d9fdd54321dedd814dc4",
+        "hash": "sha256-dWWjpQ6M7udOQqUV6P9go3R3O4J2XYpvkngJjRDY4v8="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -271,8 +276,8 @@
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "01f23648c6b84de6c0f717fa4e1816f53b9ee72e",
-        "hash": "sha256-hNzQZQxaa2Wtl7GWWF852cFmmXy4pc15Pp0d59TTfnI="
+        "rev": "dcdd0fa51b65a0b1688ff6b8f0cc81908f09ded2",
+        "hash": "sha256-noc3iZ1yCEgkwWyznx48rXC8JuKxla9QgC/CIjRL/y8="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -286,8 +291,8 @@
       },
       "src/third_party/fontconfig/src": {
         "url": "https://chromium.googlesource.com/external/fontconfig.git",
-        "rev": "14d466b30a8ab4a9d789977ed94f2c30e7209267",
-        "hash": "sha256-W5WIgC6A52kY4fNkbsDEa0o+dfd97Rl5NKfgnIRpI00="
+        "rev": "8cf0ce700a8abe0d97ace4bf7efc7f9534b729ba",
+        "hash": "sha256-Kz7KY+evfOciKFHIBLG1JxIRgHRTzuBLgxXHv3m/Y1Y="
       },
       "src/third_party/fp16/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FP16.git",
@@ -301,8 +306,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "2d1abd3bbb4d2396ed63b3e5accd66724cf62307",
-        "hash": "sha256-MAVHzILj9f+/HfVjZXyJkSQM3WBwzg7IDpAwiYHfA88="
+        "rev": "738905b34bd1f5a8ff51bd2bc8e38a2d8be9bfd6",
+        "hash": "sha256-j5FPldhIOzsOsFBAMyNh44FTeOD8Gm3scoi3B3hhgKQ="
       },
       "src/third_party/freetype-testing/src": {
         "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git",
@@ -351,8 +356,8 @@
       },
       "src/third_party/googletest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git",
-        "rev": "cd430b47a54841ec45d64d2377d7cabaf0eba610",
-        "hash": "sha256-QT9PQ9bF+eCPfRLkcHpH4jc0UZfGPc98fHf8QDV5bZg="
+        "rev": "09ffd0015395354774c059a17d9f5bee36177ff9",
+        "hash": "sha256-md/jPkFrs/0p0BYGyquh57Zxh+1dKaK26PDtUN1+Ce0="
       },
       "src/third_party/hunspell_dictionaries": {
         "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git",
@@ -361,8 +366,8 @@
       },
       "src/third_party/icu": {
         "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "4c8cc4b365a505ce35be1e0bd488476c5f79805d",
-        "hash": "sha256-eGI/6wk6IOUPvX7pRTm4VJk1CqkkxalTu84L36i/D6k="
+        "rev": "b929596baebf0ab4ac7ec07f38365db4c50a559d",
+        "hash": "sha256-/T7uyzwTCDaamLwSvutvbn6BJuoG1RqeR+xhXI5jmJw="
       },
       "src/third_party/jsoncpp/source": {
         "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git",
@@ -381,8 +386,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "b10387fdbbca18192f85eaa5323a59f44bf9c468",
-        "hash": "sha256-L2QG0pUmGjGdtdlivxYfxSqO9YaVHpIT6lvJwBMTxMw="
+        "rev": "f03aafb7516050ea73f617bf969f03eac641aefc",
+        "hash": "sha256-MHli8sadgC3OMesBGhkjPM/yW49KFOtdFuBII1bcFas="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -396,18 +401,18 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "719f60edc51b6141a2434bf1b5110c2fb075b246",
-        "hash": "sha256-W62uXVbQiq6Ef3bar2NsCXJoz5KKUK8Y/9n2vK7Vf3Q="
+        "rev": "2cca4aba034f99842c2e6cdc173f83801d289764",
+        "hash": "sha256-pyLKjLG83Jlx6I+0M8Ah94ku4NIFcrHNYswfVHMvdrc="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "02d0fad2c512380b7270d6e704c86521075d7d54",
-        "hash": "sha256-T9ibgp0glfY5EhwMiwlvXKZat0InDu7PoqE1H8/lS5A="
+        "rev": "eb883022a5886739f07f0241f918e2be97d65ff0",
+        "hash": "sha256-IxtMAqN3O/s1GrVKzcge9cQ+DVtJtFvHYvsfjmflwVQ="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
-        "rev": "e71de0e0c312caf8d2fa22f132619c6a68496444",
-        "hash": "sha256-dzJtRhoPA1FWeu0xjd7kJ1Q2nT5gIkKpIgQmywsRlPY="
+        "rev": "959322177f40f2e0f1ecacd8a1aea2805e67b62b",
+        "hash": "sha256-qFLs3gMV0v6c0gjyn29D6pRxSAKumpzAWVgHabPFWRw="
       },
       "src/third_party/securemessage/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/securemessage.git",
@@ -416,8 +421,8 @@
       },
       "src/third_party/jetstream/main": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
-        "rev": "0976ddeae0863ef5fb3f9ad09906224b0989f9ad",
-        "hash": "sha256-NyXGd7SwsECGBJ2qodGYB3os+UBgIOg/I8mnrsZJuTg="
+        "rev": "539ab943598b505832a25a2222aa8957f1a20d6f",
+        "hash": "sha256-mE6IoHpLV0LUWEeeiWycXtOhIbhkPvVdLvsPSyv4xPk="
       },
       "src/third_party/jetstream/v2.2": {
         "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git",
@@ -511,13 +516,13 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "40ec928b3fadcf8edd836445bb5842a11aeb7a2d",
-        "hash": "sha256-aUHvIv78KTiyN/cOYNuhW4UCOD55s8l8VLu4oP0Pk1s="
+        "rev": "b84ca9b63730e7d4563573a56a66317eb0087ebf",
+        "hash": "sha256-SFdYF8vnwNHQbZ1N/ZHr4kxfi9o+BAtuqbak80m9uP4="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
-        "rev": "e79a98159fdf6d1aa37b3500e32c6410a2cbe268",
-        "hash": "sha256-t7An0vYzukel0poLaU4t2k78k3tTR5didbcV47cGWxQ="
+        "rev": "c4522d6cd68582d66f1adfd24debfa9bee202afa",
+        "hash": "sha256-tfji0yPV7v/DETViEp2T7AO6P5xCjPYScTlV3eWFV0w="
       },
       "src/third_party/libwebp/src": {
         "url": "https://chromium.googlesource.com/webm/libwebp.git",
@@ -526,8 +531,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "9f9b5cf660dcfa0d3fdee41cf4ffbe4bb6e95114",
-        "hash": "sha256-OYmsMPz7nJwkVSpsDW7SbqrCU5raC1k3Mh/UkonCujM="
+        "rev": "61bdaee13a701d2b52c6dc943ccc5c888077a591",
+        "hash": "sha256-J9Wi3aCc6OjtQCP8JnrY7PYrY587dKLaa1KGAMWmE0c="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -561,13 +566,13 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "40fe10467c27b6536e5d3241e5881b6e9f243216",
-        "hash": "sha256-fKXCuGzNVcN8l/2VNR5c9lwUjmSDb7MuEAVF5h8VXQU="
+        "rev": "8cc5a0e8f6695263d44206cf5930641979cb3179",
+        "hash": "sha256-YlcvSDSCHHqDA43+hd5hpajZrIGqpn3KxhMJD8Wf+rs="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
-        "rev": "00459762409cb29cecf398a23cdb0cae918b7515",
-        "hash": "sha256-QXGJRGyyuN0EPDAF7CAzcTSbjHkz8FRjhqd1JEFF/1o="
+        "rev": "077a66f30fcf281b066fafb6dfc60818c238efb6",
+        "hash": "sha256-WnbgaCzZ/BJli6M60kP9e4mVPFDx0yu3eCac5wmQ7iM="
       },
       "src/third_party/openscreen/src/third_party/tinycbor/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/tinycbor.git",
@@ -576,23 +581,23 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "c82c611f105c0df064cc8c76363578caf9eafb75",
-        "hash": "sha256-kcrWcvbbGgQTfGypJ2EaLunYtSipJJRAin2jHunZoCU="
+        "rev": "cf433ae5520d061db56391155b59b34e67484f39",
+        "hash": "sha256-FF0iXahVfqbi4OOdH9PPgCTAIQT/q0nlT/H70pubCMQ="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "f35ae1939989c58c29df43f9c2d8610f5b932715",
-        "hash": "sha256-SyYTZnNar6F6/k6PGrkRan3l9hAikEVRciDQQaR7Jvs="
+        "rev": "dd35b295cd359ba094404218414955f961a0d6ae",
+        "hash": "sha256-kzVsti2tygOMgT61TmCz26AByMd3gIXA6xz8RE0iCz4="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
-        "rev": "eb785a9363664a402b6336dfe96aad27fb33ffa8",
-        "hash": "sha256-zq86SrDASl6aYPFPijRZp03hJqXUFz2Al/KkiNq7i0M="
+        "rev": "28bf5df73ef2f345a936d9cc95d64ba8ed426a53",
+        "hash": "sha256-c/aC+LZQtedL5oouUXw2eTF6xD7LN3J3C0q3D0wl+W0="
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "290ee6fff0c36614702d6b297c148e3fa08e056a",
-        "hash": "sha256-jRHF7vZPmh70jNFVukfWzVnA2dBLSDSnMWVyZ9e08n4="
+        "rev": "dcc9f28589066af0dbd4555579281230abbf74dd",
+        "hash": "sha256-qogacGPNy6SKQaK8CZvGC8YZbVjhDTXuhDqGopB0Eps="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -621,13 +626,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "be408bdc2c1501ef25206145a49dcebb98db34b5",
-        "hash": "sha256-XlAE782PsEysPVIBM/Q8VdE9XnvoYUVaeMmUUoYFgvM="
+        "rev": "09fd22f3a4fb77ab03b7734e0c03ff7d7f97ef88",
+        "hash": "sha256-x7zGPqha12Og/AjQp1mkO0MNydM4xXvIcaapNziW0Kw="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "0dfd95a49aed617f242c8b06dd5b255d1cb07776",
-        "hash": "sha256-HBqkqEoyQo3KuRCwP5NW9kuY9maaBYSpjA1lcBdFjxk="
+        "rev": "a46d5732d9fca93eaec23e502e2eef814b707e6b",
+        "hash": "sha256-k0vE2K9KfeYsTVZchvKEA8M7GJQcekbuO5wHJeycBZo="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -641,13 +646,13 @@
       },
       "src/third_party/sqlite/src": {
         "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "8a22b25ad7244abaf07e372cc6dc97e041d663a9",
-        "hash": "sha256-1vAGAF3idxgHGaqb5gT5k3KIGC2H3gqC3RTVU2ZRf4A="
+        "rev": "0a1397d274701c5d39e661e948160da2b9a8db1e",
+        "hash": "sha256-jqelU2bFZ4XwI5dpkusvgUobmRyYo/41ZKqbEmOdpis="
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "7905fa19e456df5aa8e2233a7ec5832c9c6c287b",
-        "hash": "sha256-Wi8mttxM1fuLqrL2q6qPnpmyAfmDqJGA8Wub+yexFLA="
+        "rev": "a8133cbb3c8969e3c1e6b3cea2c02ec8312ef9ca",
+        "hash": "sha256-Fd6T9zFJVPJaF2sbBy+uK0Ia0C6AIZsDbNvPSkbuTJM="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -656,18 +661,18 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "42d6877b1aa1cf324eb03ccf9b13511400341deb",
-        "hash": "sha256-KummGT7CUoGd3lCGXvtSFcFD1FhSlJXDcEi1WKUza70="
+        "rev": "151774faba661a5985a8264653f4457c70a56dea",
+        "hash": "sha256-qpwF2+/dw1u24O5+4bW74R43AgGN//NZwzEmlkyHlr0="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "96793fb0ff6fb5d4328cc6f71d84f5cb2d835daf",
-        "hash": "sha256-rAtsw8JV8EwrNzjK5p7JbWQa6fHfpByvZcP71hHC8uM="
+        "rev": "5912cbdd295c2bacb5798432a7b1cac9d20c0725",
+        "hash": "sha256-kIj8sncNg6dJzg1fgORev/o164G3kMXCGHzlzb09n0U="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "fc9889c889561c5882e83819dcaffef5ed45529b",
-        "hash": "sha256-HwFP4KJuA+BMQVvBWV0BCRj9U5I3CLEU+5bBtde2f6w="
+        "rev": "93231001597dad1149a5d035af30eda50b9e6b6c",
+        "hash": "sha256-0PocroQj02mdpmFVXr6XB7mVVNzQOaBXm/2GNacZLF0="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -676,38 +681,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "bab63ff679c41eb75fc67dac76e1dc44426101e1",
-        "hash": "sha256-hi4vCwdCnwuYodUYq75niCZt2t9lERQH6529/R+7nH8="
+        "rev": "c9aad99f9276817f18f72a4696239237c83cb775",
+        "hash": "sha256-/KfUxWDczLQ/0DOiFC4Z66o+gtoF/7vgvAvKyv9Z9OA="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "8e9165a3d162967a424dcf2ff645a98b50381cce",
-        "hash": "sha256-GsoaeO3FMzMtMStg1Wp0KUHU3Xxmmr7t3lDyu0ervNk="
+        "rev": "01021466b5e71deaac9054f56082566c782bfd51",
+        "hash": "sha256-04CWBDu4Q+H7EtVTealNyGx0Hml7OjIf0FfK0IuzisY="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "e2e53a724677f6eba8ff0ce1ccb64ee321785cbd",
-        "hash": "sha256-lIuJ50zi9UIMrP/FePI8jHFhJ5LsKhthDY4gIHeZNpo="
+        "rev": "75ad707a587e1469fb53a901b9b68fe9f6fbc11f",
+        "hash": "sha256-vB49bFCx9VVEtpwIFcxdqYT+Pk4DgjoPz4rzPfmuRps="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "fb78607414e154c7a5c01b23177ba719c8a44909",
-        "hash": "sha256-CeIjyW90Ri0MvhyFfYgss5Rjh5fHKhQf7CgBEcB/nPk="
+        "rev": "c913466fdc5004584890f89ff91121bdb2ffd4ba",
+        "hash": "sha256-D5S1xQbsJ4Ov+3u84Mxj3L/3elyW78jpKRbYo8FpD28="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "0b8196724e4ad28cc7459b82a9b75f252c08cb3e",
-        "hash": "sha256-oL4lyUH26eO6eJy7EQmuXdt4oy3eQ65fribfMSOZV+8="
+        "rev": "60b640cb931814fcc6dabe4fc61f4738c56579f6",
+        "hash": "sha256-snLYtiXK1eBZYsc7X18/wk4TnhmkSqquWxyjmw9IF2A="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "4e246c56ec5afb5ad66b9b04374d39ac04675c8e",
-        "hash": "sha256-MmC4UVa9P/0h7r8IBp1LhP9EztwyZv/ASWKKj8Gk1T8="
+        "rev": "49ac28931f28bffaa3cd73dc4ad997284d574962",
+        "hash": "sha256-2mi5gtacSDxtZB8a3oGZqgLhwntSLXlEzDq6W14RHp4="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "cea6ec1cdd37494c1f0fc5619c6c356ac33372fb",
-        "hash": "sha256-iXQZ6Qpe0li+QeThxMUCn45OufZ8W/qJcejpMb4/gWc="
+        "rev": "f7ceb1d01a292846db77ec87786be84d6fd568d9",
+        "hash": "sha256-K0KZ8wXTCVRBBN9AWy63ukmE6QkQHKcRgo+YluOhjyc="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -751,18 +756,18 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "168536ad91bff176bbe31ae692d97f8bfe9fb86d",
-        "hash": "sha256-HB16HM4Gj+2F26tyN393VmHbGxvKOZ+M949059odN/4="
+        "rev": "905c7cbfeaac1cf3feb4c6056dd6f3dbaa06b074",
+        "hash": "sha256-eMDb0nG9HDiesd8KPajbMej8JTll4JkIf17KMnKvW1s="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "2c5049abfc2cf36ece82f7f84ebdcb786659eaf7",
-        "hash": "sha256-lMqCZ27TJ4aXKWDuN22VtceXh0jNH4Ll1234xCbEOro="
+        "rev": "18172a359f6dab8e3f70b6c5c8c7c55d3e97537a",
+        "hash": "sha256-qJnO3fFJhaQA77v1lTJ4B7cbXivquTcSvx/m+OcI3No="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "cec4daea7ed5da94fc38d790bd12694c86865447",
-        "hash": "sha256-mxRckkiBIpQp2Qxj6fcer3jDftp3wlg+aO4BoUHhyiY="
+        "rev": "e4445e46a910eb407571ec0b0b8b7043562678cf",
+        "hash": "sha256-72NbtdYbyMxSGULvOGsZqLj4kvT79pu+TKcnEmcj/Pc="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -781,18 +786,18 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "474d7e58d4b8f4bd1a98ee74bc57858769f7d925",
-        "hash": "sha256-UO+nOh7R+3xTSxF2u8dIrv7qn/QmhnDr2J5Ciumj93M="
+        "rev": "f82ad65ca52cb4d39b73088468a5fe00f56fb47c",
+        "hash": "sha256-aavq+i8EpQmIMPaym6JxwBFjbpqKtHshXUkdBIXDtpw="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "d654fca78690fa15cceb8058ac47454d914a0e63",
-        "hash": "sha256-Ginvak0y1CjURT3mQZzdLn3MW9vXxC7T0KLsM6SHDV0="
+        "rev": "f9938c217da17ec3e9dcd2a2d99c5cf39536aeb9",
+        "hash": "sha256-emmJF7XLq5CxXFd0KUrtUtw1YGOHDSiz39vtgVoEPd0="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "075234cf3d7622d9d588a6f748fc4501aa23080c",
-        "hash": "sha256-wrLxRuJ3rq1yC0PIUGPsuDB/YNee1x3J/i6ZSLk70HM="
+        "rev": "0ea9b0813581826a94b45324e746f9ab57f0f843",
+        "hash": "sha256-jGx1jafKyh9BrrJwWKU78sKlwkX9KYHzhggx6TzRel4="
       }
     }
   },
diff --git a/pkgs/by-name/al/alterware-launcher/package.nix b/pkgs/by-name/al/alterware-launcher/package.nix
new file mode 100644
index 000000000000..5d7132d0fe13
--- /dev/null
+++ b/pkgs/by-name/al/alterware-launcher/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  perl,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "alterware-launcher";
+  version = "0.11.2";
+
+  src = fetchFromGitHub {
+    owner = "alterware";
+    repo = "alterware-launcher";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DFIiVNYom3LvU9IFA9w9FvXwm9gqfACDs8KaFKQR9Qs=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-/2i6GyBTKLf2oNFkizaBUHcLcCPgsy3g0p31D6cO+xg=";
+
+  nativeBuildInputs = [ perl ];
+
+  meta = {
+    description = "Official launcher for AlterWare Call of Duty mods";
+    longDescription = "Our clients are designed to restore missing features that have been removed by the developers, as well as enhance the capabilities of the games";
+    homepage = "https://alterware.dev";
+    changelog = "https://github.com/alterware/alterware-launcher/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ andrewfield ];
+    mainProgram = "alterware-launcher";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/ar/arrow/package.nix b/pkgs/by-name/ar/arrow/package.nix
new file mode 100644
index 000000000000..f798956d6d9f
--- /dev/null
+++ b/pkgs/by-name/ar/arrow/package.nix
@@ -0,0 +1,102 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  godot_4_4,
+  alsa-lib,
+  libGL,
+  libpulseaudio,
+  libX11,
+  libXcursor,
+  libXext,
+  libXi,
+  libXrandr,
+  udev,
+  vulkan-loader,
+  autoPatchelfHook,
+  writableTmpDirAsHomeHook,
+  makeDesktopItem,
+  copyDesktopItems,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arrow";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "mhgolkar";
+    repo = "Arrow";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oodW6XvesBWic0yK1Se/tycjqblE4qUSuAk+3MY3x8I=";
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      type = "Application";
+      name = "Arrow";
+      exec = "Arrow";
+      icon = "Arrow";
+      terminal = false;
+      comment = "Game Narrative Design Tool";
+      desktopName = "Arrow";
+      categories = [ "Application" ];
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    writableTmpDirAsHomeHook
+    godot_4_4
+    copyDesktopItems
+  ];
+
+  runtimeDependencies = map lib.getLib [
+    alsa-lib
+    libGL
+    libpulseaudio
+    libX11
+    libXcursor
+    libXext
+    libXi
+    libXrandr
+    udev
+    vulkan-loader
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  buildPhase = ''
+    runHook preBuild
+
+    ln -s "${godot_4_4.export-templates-bin}" $HOME/.local
+
+    mkdir -p build
+    godot4 --headless --export-release Linux ./build/Arrow
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m 755 -t $out/libexec ./build/Arrow
+    install -D -m 644 -t $out/libexec ./build/Arrow.pck
+
+    install -d -m 755 $out/bin
+    ln -s $out/libexec/Arrow $out/bin/Arrow
+
+    install -vD icon.svg $out/share/icons/hicolor/scalable/apps/Arrow.svg
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://mhgolkar.github.io/Arrow/";
+    description = "Game Narrative Design Tool";
+    license = lib.licenses.mit;
+    mainProgram = "Arrow";
+    maintainers = with lib.maintainers; [ miampf ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/bf/bfs/package.nix b/pkgs/by-name/bf/bfs/package.nix
index 681a4db2e52d..f2327395e4f1 100644
--- a/pkgs/by-name/bf/bfs/package.nix
+++ b/pkgs/by-name/bf/bfs/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bfs";
-  version = "4.0.6";
+  version = "4.0.8";
 
   src = fetchFromGitHub {
     repo = "bfs";
     owner = "tavianator";
     rev = version;
-    hash = "sha256-TXnoy+VWkS5ilW6QEtE6vd80FaJ/nIWGaeBJ/cjvquM=";
+    hash = "sha256-yZoyDa8um3UA8K9Ty17xaGUvQmJA/agZPBsNo+/6weI=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/bo/bochs/fix-darwin-build.patch b/pkgs/by-name/bo/bochs/fix-darwin-build.patch
new file mode 100644
index 000000000000..f3a2b01b5ca9
--- /dev/null
+++ b/pkgs/by-name/bo/bochs/fix-darwin-build.patch
@@ -0,0 +1,15 @@
+diff --git a/gui/keymap.cc b/gui/keymap.cc
+index 3426b6b..7bf76d8 100644
+--- a/gui/keymap.cc
++++ b/gui/keymap.cc
+@@ -30,6 +30,10 @@
+ #include "gui.h"
+ #include "keymap.h"
+
++#if defined(__APPLE__)
++#include <libgen.h>
++#endif
++
+ // Table of bochs "BX_KEY_*" symbols
+ // the table must be in BX_KEY_* order
+ const char *bx_key_symbol[BX_KEY_NBKEYS] = {
diff --git a/pkgs/by-name/bo/bochs/package.nix b/pkgs/by-name/bo/bochs/package.nix
index a28522dce7dd..843452c8126f 100644
--- a/pkgs/by-name/bo/bochs/package.nix
+++ b/pkgs/by-name/bo/bochs/package.nix
@@ -32,6 +32,9 @@ stdenv.mkDerivation (finalAttrs: {
     url = "mirror://sourceforge/project/bochs/bochs/${finalAttrs.version}/bochs-${finalAttrs.version}.tar.gz";
     hash = "sha256-y29UK1HzWizJIGsqmA21YCt80bfPLk7U8Ras1VB3gao=";
   };
+  # Fix build on darwin, remove on next version
+  # https://sourceforge.net/p/bochs/bugs/1466/
+  patches = lib.optional stdenv.hostPlatform.isDarwin ./fix-darwin-build.patch;
 
   nativeBuildInputs = [
     docbook_xml_dtd_45
@@ -82,11 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
 
       (lib.enableFeature false "docbook") # Broken - it requires docbook2html
 
-      # Dangerous options - they are marked as "incomplete/experimental" on Bochs documentation
-      (lib.enableFeature false "3dnow")
-      (lib.enableFeature false "monitor-mwait")
-      (lib.enableFeature false "raw-serial")
-
       # These are completely configurable, and they don't depend of external tools
       (lib.enableFeature true "a20-pin")
       (lib.enableFeature true "avx")
@@ -153,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
       Intel x86 CPU, common I/O devices, and a custom BIOS.
     '';
     license = lib.licenses.lgpl2Plus;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ patrickdag ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/bu/buildbox/package.nix b/pkgs/by-name/bu/buildbox/package.nix
index 1a370c55d8c8..e848f28b9170 100644
--- a/pkgs/by-name/bu/buildbox/package.nix
+++ b/pkgs/by-name/bu/buildbox/package.nix
@@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "buildbox";
-  version = "1.3.11";
+  version = "1.3.21";
 
   src = fetchFromGitLab {
     owner = "BuildGrid";
     repo = "buildbox/buildbox";
     tag = finalAttrs.version;
-    hash = "sha256-lIRYwZLjYCpA4TMO3GF/yykVKn7LDyNHW9zItZmS9vM=";
+    hash = "sha256-gZ4PnaIiMPh18Yy2120yIEaQaFpzGNnWXzS7Uw+n/+k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/clickhouse/package.nix b/pkgs/by-name/cl/clickhouse/package.nix
index cb8903eae19c..5157b6eec435 100644
--- a/pkgs/by-name/cl/clickhouse/package.nix
+++ b/pkgs/by-name/cl/clickhouse/package.nix
@@ -21,7 +21,7 @@
 
 llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
   pname = "clickhouse";
-  version = "25.3.3.42";
+  version = "25.3.4.190";
 
   src = fetchFromGitHub rec {
     owner = "ClickHouse";
@@ -29,7 +29,7 @@ llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
     tag = "v${finalAttrs.version}-lts";
     fetchSubmodules = true;
     name = "clickhouse-${tag}.tar.gz";
-    hash = "sha256-VYT6Rnq7LaV9fZc4LJ9YtbWQDgEARYok8MjVfg8itIg=";
+    hash = "sha256-8KH0mziVlayu9g4EwW+hpSV97P72CYDKwGCZ5ycDUwE=";
     postFetch = ''
       # delete files that make the source too big
       rm -rf $out/contrib/llvm-project/llvm/test
diff --git a/pkgs/by-name/co/confy/package.nix b/pkgs/by-name/co/confy/package.nix
index 1f2a8ab4f067..46a658e3db5d 100644
--- a/pkgs/by-name/co/confy/package.nix
+++ b/pkgs/by-name/co/confy/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "confy";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromSourcehut {
     owner = "~fabrixxm";
     repo = "confy";
     rev = finalAttrs.version;
-    hash = "sha256-lQZ9joLK6w+sIjCVOEHstnnQomUl2E4F8FXCZukMUkI=";
+    hash = "sha256-rkVem9bPjp68Pk8fVPMDZLFFQsqeeRsynWciCk6xWhU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cu/cue/package.nix b/pkgs/by-name/cu/cue/package.nix
index 5edb98cec8d6..d4eb8729b1a1 100644
--- a/pkgs/by-name/cu/cue/package.nix
+++ b/pkgs/by-name/cu/cue/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cue";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "cue-lang";
     repo = "cue";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3cTRewUn9Ykb/BoqOdM7LYTQTAqAuW4w06XkBWhZWrY=";
+    hash = "sha256-g8CG37sN5KdmZwdAdQS2HL4YPGNIkO3d817PHKcIDeA=";
   };
 
   vendorHash = "sha256-J9Ox9Yt64PmL2AE+GRdWDHlBtpfmDtxgUbEPaka5JSo=";
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index a9388f6ad64e..c71faf3ea674 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -3,7 +3,6 @@
   lib,
   callPackage,
   fetchFromGitHub,
-  fetchpatch,
   rustPlatform,
   cmake,
   yq,
@@ -30,26 +29,18 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.3.6";
+  version = "2.3.7";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-l3cWnv2cEmoeecYj38eMIlgqlRjDbtQuc6Q3DmOJoqE=";
+    hash = "sha256-xrGEEtYOjQmKniDsPnWJSbiTRG0uBFqRbUbrvgrMyHg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-alvn+d7XTYrw8KXw+k+++J3CsBwAUbQQlh24/EOEzwY=";
-  cargoPatches = [
-    (fetchpatch {
-      name = "fix-sigsegv-on-x86_64-unknown-linux-gnu-targets";
-      url = "https://github.com/denoland/deno/commit/400a9565c335b51d78c8909f4dbf1dbd4fb5e5d8.patch";
-      hash = "sha256-dTIw7P6sB6Esf+lSe/gc3cX54GkzLWF5X55yxP/QYoo=";
-      includes = [ "cli/Cargo.toml" ];
-    })
-  ];
+  cargoHash = "sha256-1RhVg5fjzA9zKzpkjOyV1KITlTtW41VVqc2Cbe4pfdY=";
 
   patches = [
     ./tests-replace-hardcoded-paths.patch
diff --git a/pkgs/by-name/de/deno/update/src.ts b/pkgs/by-name/de/deno/update/src.ts
index 77266e55964b..11c215b44645 100644
--- a/pkgs/by-name/de/deno/update/src.ts
+++ b/pkgs/by-name/de/deno/update/src.ts
@@ -16,7 +16,7 @@ interface Replacer {
 const log = logger("src");
 
 const prefetchHash = (nixpkgs: string, version: string) =>
-  run("nurl", ["https://github.com/denoland/deno", version, "-H", "-n", nixpkgs]);
+  run("nurl", ["https://github.com/denoland/deno", version, "-H", "-n", nixpkgs, "-S"]);
 const prefetchCargoHash = (nixpkgs: string) =>
   run(
     "nurl",
diff --git a/pkgs/by-name/dn/dnf5/package.nix b/pkgs/by-name/dn/dnf5/package.nix
index 8cdc78b5fd87..373191c04721 100644
--- a/pkgs/by-name/dn/dnf5/package.nix
+++ b/pkgs/by-name/dn/dnf5/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   appstream,
   cmake,
   createrepo_c,
@@ -34,7 +33,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.2.13.1";
+  version = "5.2.14.0";
 
   outputs = [
     "out"
@@ -45,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rpm-software-management";
     repo = "dnf5";
     tag = finalAttrs.version;
-    hash = "sha256-Qt3G4jsJNk7iMOWliGjyR2dOGpWANVtZFeYwlsYbFrw=";
+    hash = "sha256-dCeTOJrOjnGvRhY8u8mMOgm/mbUoTbYqzjiAkbIlSo0=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix
index d33a4a32311c..e1ff4f1e365c 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Markdown code formatter.";
-  hash = "sha256-fBy+G+DkJqhrCyyaMjmXRe1VeSeCYO+XmJ8ogwAoptA=";
+  hash = "sha256-2lpgVMExOjMVRTvX6hGRWuufwh2AIkiXaOzkN8LhZgw=";
   initConfig = {
     configExcludes = [ ];
     configKey = "markdown";
@@ -9,6 +9,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-markdown";
   updateUrl = "https://plugins.dprint.dev/dprint/markdown/latest.json";
-  url = "https://plugins.dprint.dev/markdown-0.18.0.wasm";
-  version = "0.18.0";
+  url = "https://plugins.dprint.dev/markdown-0.19.0.wasm";
+  version = "0.19.0";
 }
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
index b67fd0559b34..9f86d13aa122 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TypeScript/JavaScript code formatter.";
-  hash = "sha256-mAePVUsjHVo9okkozXZmwvz456YeO36ghyU4gxKJdyw=";
+  hash = "sha256-u6DpQWhPyERphKmlXOTE6NW/08YzBDWgzWTJ4JLLAjE=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "typescript";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-typescript";
   updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.95.7.wasm";
-  version = "0.95.7";
+  url = "https://plugins.dprint.dev/typescript-0.95.8.wasm";
+  version = "0.95.8";
 }
diff --git a/pkgs/by-name/ep/epson-escpr2/package.nix b/pkgs/by-name/ep/epson-escpr2/package.nix
index 7861ad96ceb3..179b82113ff6 100644
--- a/pkgs/by-name/ep/epson-escpr2/package.nix
+++ b/pkgs/by-name/ep/epson-escpr2/package.nix
@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.28";
+  version = "1.2.34";
 
   src = fetchurl {
     # To find the most recent version go to
     # https://support.epson.net/linux/Printer/LSB_distribution_pages/en/escpr2.php
     # and retrieve the download link for source package for arm CPU for the tar.gz (the x86 link targets to rpm source files)
-    url = "https://download3.ebz.epson.net/dsc/f/03/00/16/80/15/8bd63ccd14a1966e9c3658d374686c5bb104bb04/epson-inkjet-printer-escpr2-1.2.28-1.tar.gz";
-    hash = "sha256-lv8Hgo7JzT4igY8ek7EXdyFO34l735dpMC+gWkO5rvY=";
+    url = "https://download3.ebz.epson.net/dsc/f/03/00/17/17/88/53f956e8d0a0dfc9cb7d0c35907183deb028a8b7/epson-inkjet-printer-escpr2-1.2.34-1.tar.gz";
+    hash = "sha256-7EpK/EI9MHTX2z+JtMB2Urt/e893cwNX5DAGSbjDyj4=";
   };
 
   buildInputs = [ cups ];
@@ -27,8 +27,8 @@ stdenv.mkDerivation {
     # Fixes "implicit declaration of function" errors
     # source of patch: https://aur.archlinux.org/packages/epson-inkjet-printer-escpr2
     (fetchurl {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/bug_x86_64.patch?h=epson-inkjet-printer-escpr2&id=575d1b959063044f233cca099caceec8e6d5c02f";
-      sha256 = "sha256-G6/3oj25FUT+xv9aJ7qP5PBZWLfy+V8MCHUYucDhtzM=";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/bug_x86_64.patch?h=epson-inkjet-printer-escpr2&id=8fbca325d6d39fa3ffe001f90a432380bdeacc2f";
+      sha256 = "sha256-V8ejK33qyHPX4x8EOgR+XWW44KR8DQwHx2w+O71gQwo=";
     })
   ];
 
diff --git a/pkgs/by-name/gi/gitea-mcp-server/package.nix b/pkgs/by-name/gi/gitea-mcp-server/package.nix
new file mode 100644
index 000000000000..4313000fdb78
--- /dev/null
+++ b/pkgs/by-name/gi/gitea-mcp-server/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitea,
+}:
+buildGoModule (finalAttrs: {
+  pname = "gitea-mcp-server";
+  version = "0.2.0";
+
+  src = fetchFromGitea {
+    domain = "gitea.com";
+    owner = "gitea";
+    repo = "gitea-mcp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZUnpE25XIYzSwdEilzXnhqGR676iBQcR2yiT3jhJApc=";
+  };
+
+  vendorHash = "sha256-u9jIjrbDUhnaaeBET+pKQTKhaQLUeQvKOXSBfS0vMJM=";
+
+  subPackages = [ "." ];
+
+  doCheck = false; # no test
+
+  postInstall = ''
+    install -Dm644 README.md LICENSE -t $out/share/doc/gitea-mcp-server
+  '';
+
+  meta = {
+    description = "Gitea Model Context Protocol (MCP) Server";
+    longDescription = ''
+      The Gitea MCP Server is a Model Context Protocol (MCP) server that provides
+      seamless integration with Gitea APIs, enabling advanced automation and
+      interaction capabilities for developers and tools.
+
+      This server allows LLMs to interact with Gitea repositories, issues, pull
+      requests, and other Gitea features through structured API interactions.
+    '';
+    homepage = "https://gitea.com/gitea/gitea-mcp";
+    license = lib.licenses.mit;
+    mainProgram = "gitea-mcp";
+    maintainers = with lib.maintainers; [ connerohnesorge ];
+  };
+})
diff --git a/pkgs/by-name/gu/guix/missing-cstdint-include.patch b/pkgs/by-name/gu/guix/missing-cstdint-include.patch
new file mode 100644
index 000000000000..4799744d1043
--- /dev/null
+++ b/pkgs/by-name/gu/guix/missing-cstdint-include.patch
@@ -0,0 +1,24 @@
+From bdf4159dd5c1cf925512c0eb8490846c084e3c8c Mon Sep 17 00:00:00 2001
+From: Reepca Russelstein
+Date: Tue, 24 Jun 2025 22:35:04 -0500
+Subject: [PATCH] nix: libutil: add <cstdint> include to seccomp.hh.
+
+* nix/libutil/seccomp.hh (<cstdint>): add include of header.
+
+Change-Id: I0a0b2892d81dbab662eda1ba80f4736178d70c65
+---
+ nix/libutil/seccomp.hh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/nix/libutil/seccomp.hh b/nix/libutil/seccomp.hh
+index 634dfad5f8..a4b449fc66 100644
+--- a/nix/libutil/seccomp.hh
++++ b/nix/libutil/seccomp.hh
+@@ -4,6 +4,7 @@
+ #include <linux/audit.h> /* For AUDIT_ARCH_* */
+ #include <linux/seccomp.h>
+ #include <linux/filter.h>
++#include <cstdint>
+ 
+ 
+ /* This file provides two preprocessor macros (among other things):
diff --git a/pkgs/by-name/gu/guix/package.nix b/pkgs/by-name/gu/guix/package.nix
index e72bc7ef46cf..3451676d931b 100644
--- a/pkgs/by-name/gu/guix/package.nix
+++ b/pkgs/by-name/gu/guix/package.nix
@@ -1,9 +1,9 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchpatch,
-  fetchDebianPatch,
+  fetchgit,
+  graphviz,
+  gettext,
   autoreconfHook,
   disarchive,
   git,
@@ -27,6 +27,7 @@
   pkg-config,
   po4a,
   scheme-bytestructures,
+  slirp4netns,
   texinfo,
   bzip2,
   libgcrypt,
@@ -37,45 +38,21 @@
   storeDir ? "/gnu/store",
   confDir ? "/etc",
 }:
-
+let
+  rev = "30a5d140aa5a789a362749d057754783fea83dde";
+in
 stdenv.mkDerivation rec {
   pname = "guix";
-  version = "1.4.0";
+  version = "1.4.0-unstable-2025-06-24";
 
-  src = fetchurl {
-    url = "mirror://gnu/guix/guix-${version}.tar.gz";
-    hash = "sha256-Q8dpy/Yy7wVEmsH6SMG6FSwzSUxqvH5HE3u6eyFJ+KQ=";
+  src = fetchgit {
+    url = "https://codeberg.org/guix/guix.git";
+    inherit rev;
+    hash = "sha256-QsOYApnwA2hb1keSv6p3EpMT09xCs9uyoSeIdXzftF0=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "CVE-2024-27297_1.patch";
-      url = "https://git.savannah.gnu.org/cgit/guix.git/patch/?id=8f4ffb3fae133bb21d7991e97c2f19a7108b1143";
-      hash = "sha256-xKo1h2uckC2pYHt+memekagfL6dWcF8gOnTOOW/wJUU=";
-    })
-    (fetchpatch {
-      name = "CVE-2024-27297_2.patch";
-      url = "https://git.savannah.gnu.org/cgit/guix.git/patch/?id=ff1251de0bc327ec478fc66a562430fbf35aef42";
-      hash = "sha256-f4KWDVrvO/oI+4SCUHU5GandkGtHrlaM1BWygM/Qlao=";
-    })
-    # see https://guix.gnu.org/en/blog/2024/build-user-takeover-vulnerability
-    (fetchDebianPatch {
-      inherit pname version;
-      debianRevision = "8";
-      patch = "security/0101-daemon-Sanitize-failed-build-outputs-prior-to-exposi.patch";
-      hash = "sha256-cbra/+K8+xHUJrCKRgzJCuhMBpzCSjgjosKAkJx7QIo=";
-    })
-    (fetchDebianPatch {
-      inherit pname version;
-      debianRevision = "8";
-      patch = "security/0102-daemon-Sanitize-successful-build-outputs-prior-to-ex.patch";
-      hash = "sha256-mOnlYtpIuYL+kDvSNuXuoDLJP03AA9aI2ALhap+0NOM=";
-    })
-    (fetchpatch {
-      name = "fix-guile-ssh-detection.patch";
-      url = "https://git.savannah.gnu.org/cgit/guix.git/patch/?id=b8a45bd0473ab2ba9b96b7ef429a557ece9bf06c";
-      hash = "sha256-oYkgM694qPK8kqgxatkr4fj/GL73ozTNQADNyDeU6WY=";
-    })
+    ./missing-cstdint-include.patch
   ];
 
   postPatch = ''
@@ -90,6 +67,8 @@ stdenv.mkDerivation rec {
     autoreconfHook
     disarchive
     git
+    graphviz
+    gettext
     glibcLocales
     guile
     guile-avahi
@@ -110,6 +89,7 @@ stdenv.mkDerivation rec {
     pkg-config
     po4a
     scheme-bytestructures
+    slirp4netns
     texinfo
   ];
 
@@ -136,6 +116,7 @@ stdenv.mkDerivation rec {
     guile-zlib
     guile-zstd
     scheme-bytestructures
+    slirp4netns
   ];
 
   configureFlags = [
@@ -145,6 +126,11 @@ stdenv.mkDerivation rec {
     "--with-bash-completion-dir=$(out)/etc/bash_completion.d"
   ];
 
+  preAutoreconf = ''
+    echo ${version} > .tarball-version
+    ./bootstrap
+  '';
+
   enableParallelBuilding = true;
 
   postInstall = ''
@@ -174,8 +160,8 @@ stdenv.mkDerivation rec {
       Guix.
       Guix is based on the Nix package manager.
     '';
-    homepage = "http://www.gnu.org/software/guix";
-    changelog = "https://git.savannah.gnu.org/cgit/guix.git/plain/NEWS?h=v${version}";
+    homepage = "https://guix.gnu.org/";
+    changelog = "https://codeberg.org/guix/guix/raw/commit/${rev}/NEWS";
     license = lib.licenses.gpl3Plus;
     mainProgram = "guix";
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ic/icbm3d/package.nix b/pkgs/by-name/ic/icbm3d/package.nix
index 22a2fc0cc044..270e57c3045d 100644
--- a/pkgs/by-name/ic/icbm3d/package.nix
+++ b/pkgs/by-name/ic/icbm3d/package.nix
@@ -16,11 +16,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ libX11 ];
 
+  buildFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ]; # fix darwin and cross-compiled builds
+
   # Function are declared after they are used in the file, this is error since gcc-14.
   #   randnum.c:25:3: warning: implicit declaration of function 'srand' [-Wimplicit-function-declaration]
   #   randnum.c:33:7: warning: implicit declaration of function 'rand'; did you mean 'randnum'? [-Wimplicit-function-declaration]
   #   text.c:34:50: warning: implicit declaration of function 'strlen' [-Wimplicit-function-declaration]
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  postPatch = ''
+    substituteInPlace randnum.c --replace-fail 'stdio.h' 'stdlib.h'
+    sed -i '1i\
+    #include <string.h>' text.c
+
+    # The Makefile tries to install icbm3d immediately after building it, and
+    # ends up trying to copy it to /icbm3d. Normally this just gets an error
+    # and moves on, but it's probably better to not try it in the first place.
+    sed -i '/INSTALLROOT/d' makefile
+  '';
 
   installPhase = ''
     runHook preInstall
@@ -35,6 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
     description = "3D vector-based clone of the atari game Missile Command";
     mainProgram = "icbm3d";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/ki/kitty-img/package.nix b/pkgs/by-name/ki/kitty-img/package.nix
index bc31236a27c6..d445350d957f 100644
--- a/pkgs/by-name/ki/kitty-img/package.nix
+++ b/pkgs/by-name/ki/kitty-img/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kitty-img";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromSourcehut {
     owner = "~zethra";
     repo = "kitty-img";
     rev = version;
-    hash = "sha256-5thx4ADmJE29bxN+ZO3hF0jhgXK+boqt8oj4Sygl5SU=";
+    hash = "sha256-liqLocNIIOmkVWI8H9WU7T352sK7sceVtOX+R0BQ/uk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-KSNl/SpqcgMaKbkBfNtR7M8+B1clPauYi7NlP+f5Pd0=";
+  cargoHash = "sha256-50M1TUGvjELARt/gvtyAPNL0hG1ekKwdefI9nMEsTo0=";
 
   meta = {
     description = "Print images inline in kitty";
diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix
index 329a7c7bef86..07be13a7ed67 100644
--- a/pkgs/by-name/li/libgcrypt/package.nix
+++ b/pkgs/by-name/li/libgcrypt/package.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
 
   # TODO: figure out why this is even necessary and why the missing dylib only crashes
   # random instead of every test
-  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+  preCheck = lib.optionalString (stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isStatic) ''
     mkdir -p $lib/lib
     cp src/.libs/libgcrypt.20.dylib $lib/lib
   '';
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index cad3b85fb214..8b64bbc7ad7b 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.144.0",
+  "version": "3.146.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.144.0/mirrord_linux_x86_64",
-      "hash": "sha256-XbveB71EIChiuPVfqOshEhPZHnTGd7xJt48/zuyq5TA="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.146.0/mirrord_linux_x86_64",
+      "hash": "sha256-hyLB5r2YJ32jd64xueIFGET+FiGMCJInHcOu/YyHCbI="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.144.0/mirrord_linux_aarch64",
-      "hash": "sha256-4Tw68aWpNsjfi6d7qgBhbVvAMsHwUsttfVSpx3Kv2Nk="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.146.0/mirrord_linux_aarch64",
+      "hash": "sha256-6Yi0FeXweDPbYI+c/XsCGetCkz1Ab4u4LAaGu6msJwc="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.144.0/mirrord_mac_universal",
-      "hash": "sha256-FhRgopH7QRH+30Bofoiwdx3Vlne6D/ftaqhGuUnyH0g="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.146.0/mirrord_mac_universal",
+      "hash": "sha256-qvF6JTfeXvwNniNBn+/eGD6RBesbVeLgPo9HcDVBtKA="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.144.0/mirrord_mac_universal",
-      "hash": "sha256-FhRgopH7QRH+30Bofoiwdx3Vlne6D/ftaqhGuUnyH0g="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.146.0/mirrord_mac_universal",
+      "hash": "sha256-qvF6JTfeXvwNniNBn+/eGD6RBesbVeLgPo9HcDVBtKA="
     }
   }
 }
diff --git a/pkgs/by-name/mo/morewaita-icon-theme/fix-broken-symlinks.patch b/pkgs/by-name/mo/morewaita-icon-theme/fix-broken-symlinks.patch
new file mode 100644
index 000000000000..4c7e42f4afb6
--- /dev/null
+++ b/pkgs/by-name/mo/morewaita-icon-theme/fix-broken-symlinks.patch
@@ -0,0 +1,48 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Kenichi Kamiya <kachick1@gmail.com>
+Date: Sun, 15 Jun 2025 10:35:51 +0900
+Subject: [PATCH] Fix broken symlinks
+
+---
+ scalable/apps/gnome-character-map.svg    | 2 +-
+ symbolic/apps/pamac-manager-symbolic.svg | 2 +-
+ symbolic/apps/pamac-symbolic.svg         | 2 +-
+ symbolic/apps/pamac-updater-symbolic.svg | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/scalable/apps/gnome-character-map.svg b/scalable/apps/gnome-character-map.svg
+index f04d4679adb66b897b42396e75896f4c46199c24..d400f7677eefaa10db958bb324247825d8c3578e 120000
+--- a/scalable/apps/gnome-character-map.svg
++++ b/scalable/apps/gnome-character-map.svg
+@@ -1 +1 @@
+-accessories-character-map.svg
+\ No newline at end of file
++../legacy/accessories-character-map.svg
+\ No newline at end of file
+diff --git a/symbolic/apps/pamac-manager-symbolic.svg b/symbolic/apps/pamac-manager-symbolic.svg
+index 758557a5c791b43de172d29f466fe6b6cb9d5207..106458e72401668bca4b9457cd6c2eff9ea7e4e2 120000
+--- a/symbolic/apps/pamac-manager-symbolic.svg
++++ b/symbolic/apps/pamac-manager-symbolic.svg
+@@ -1 +1 @@
+-system-software-install-symbolic.svg
+\ No newline at end of file
++../legacy/system-software-install-symbolic.svg
+\ No newline at end of file
+diff --git a/symbolic/apps/pamac-symbolic.svg b/symbolic/apps/pamac-symbolic.svg
+index 758557a5c791b43de172d29f466fe6b6cb9d5207..106458e72401668bca4b9457cd6c2eff9ea7e4e2 120000
+--- a/symbolic/apps/pamac-symbolic.svg
++++ b/symbolic/apps/pamac-symbolic.svg
+@@ -1 +1 @@
+-system-software-install-symbolic.svg
+\ No newline at end of file
++../legacy/system-software-install-symbolic.svg
+\ No newline at end of file
+diff --git a/symbolic/apps/pamac-updater-symbolic.svg b/symbolic/apps/pamac-updater-symbolic.svg
+index 758557a5c791b43de172d29f466fe6b6cb9d5207..106458e72401668bca4b9457cd6c2eff9ea7e4e2 120000
+--- a/symbolic/apps/pamac-updater-symbolic.svg
++++ b/symbolic/apps/pamac-updater-symbolic.svg
+@@ -1 +1 @@
+-system-software-install-symbolic.svg
+\ No newline at end of file
++../legacy/system-software-install-symbolic.svg
+\ No newline at end of file
diff --git a/pkgs/by-name/mo/morewaita-icon-theme/package.nix b/pkgs/by-name/mo/morewaita-icon-theme/package.nix
index 205bfd4a2f31..66a8d865ae1a 100644
--- a/pkgs/by-name/mo/morewaita-icon-theme/package.nix
+++ b/pkgs/by-name/mo/morewaita-icon-theme/package.nix
@@ -4,18 +4,32 @@
   fetchFromGitHub,
   gtk3,
   xdg-utils,
+  nix-update-script,
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "morewaita-icon-theme";
-  version = "48.1";
+  version = "48.2";
 
   src = fetchFromGitHub {
     owner = "somepaulo";
     repo = "MoreWaita";
-    tag = "v${version}";
-    hash = "sha256-18jI4hADVHC/WCmMTlA+VBuZ1jNGSxL+lO3GwWDiNoU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eCMU5RNlqHN6tImGd2ur+rSC+kR5xQ8Zh4BaRgjBHVc=";
   };
 
+  patches = [
+    # Avoiding "ERROR: noBrokenSymlinks". ref: https://github.com/somepaulo/MoreWaita/pull/335
+    ./fix-broken-symlinks.patch
+  ];
+
+  postPatch = ''
+    patchShebangs install.sh
+
+    # Replace this workaround if https://github.com/somepaulo/MoreWaita/pull/339 is merged
+    substituteInPlace install.sh \
+      --replace-fail '"''${HOME}/.local/share/' '"$out/share/'
+  '';
+
   nativeBuildInputs = [
     gtk3
     xdg-utils
@@ -24,18 +38,23 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    install -d $out/share/icons/MoreWaita
-    cp -r . $out/share/icons/MoreWaita
-    gtk-update-icon-cache -f -t $out/share/icons/MoreWaita && xdg-desktop-menu forceupdate
+    ./install.sh
 
     runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     description = "Adwaita style extra icons theme for Gnome Shell";
     homepage = "https://github.com/somepaulo/MoreWaita";
-    license = with licenses; [ gpl3Only ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ pkosel ];
+    license = with lib.licenses; [ gpl3Only ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      pkosel
+      kachick
+    ];
   };
-}
+})
diff --git a/pkgs/by-name/mp/mpdcron/Gemfile.lock b/pkgs/by-name/mp/mpdcron/Gemfile.lock
index 81db47feff53..2b450246fec8 100644
--- a/pkgs/by-name/mp/mpdcron/Gemfile.lock
+++ b/pkgs/by-name/mp/mpdcron/Gemfile.lock
@@ -1,41 +1,17 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    mini_portile2 (2.8.8)
-    nokogiri (1.18.3)
+    mini_portile2 (2.8.9)
+    nokogiri (1.18.8)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.18.3-aarch64-linux-gnu)
-      racc (~> 1.4)
-    nokogiri (1.18.3-aarch64-linux-musl)
-      racc (~> 1.4)
-    nokogiri (1.18.3-arm-linux-gnu)
-      racc (~> 1.4)
-    nokogiri (1.18.3-arm-linux-musl)
-      racc (~> 1.4)
-    nokogiri (1.18.3-arm64-darwin)
-      racc (~> 1.4)
-    nokogiri (1.18.3-x86_64-darwin)
-      racc (~> 1.4)
-    nokogiri (1.18.3-x86_64-linux-gnu)
-      racc (~> 1.4)
-    nokogiri (1.18.3-x86_64-linux-musl)
-      racc (~> 1.4)
     racc (1.8.1)
 
 PLATFORMS
-  aarch64-linux-gnu
-  aarch64-linux-musl
-  arm-linux-gnu
-  arm-linux-musl
-  arm64-darwin
   ruby
-  x86_64-darwin
-  x86_64-linux-gnu
-  x86_64-linux-musl
 
 DEPENDENCIES
   nokogiri
 
 BUNDLED WITH
-   2.6.2
+   2.6.9
diff --git a/pkgs/by-name/mp/mpdcron/gemset.nix b/pkgs/by-name/mp/mpdcron/gemset.nix
index b5949dd22930..137e87c1a529 100644
--- a/pkgs/by-name/mp/mpdcron/gemset.nix
+++ b/pkgs/by-name/mp/mpdcron/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0x8asxl83msn815lwmb2d7q5p29p7drhjv5va0byhk60v9n16iwf";
+      sha256 = "12f2830x7pq3kj0v8nz0zjvaw02sv01bqs1zwdrc04704kwcgmqc";
       type = "gem";
     };
-    version = "2.8.8";
+    version = "2.8.9";
   };
   nokogiri = {
     dependencies = [
@@ -18,10 +18,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0npx535cs8qc33n0lpbbwl0p9fi3a5bczn6ayqhxvknh9yqw77vb";
+      sha256 = "0rb306hbky6cxfyc8vrwpvl40fdapjvhsk62h08gg9wwbn3n8x4c";
       type = "gem";
     };
-    version = "1.18.3";
+    version = "1.18.8";
   };
   racc = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/mp/mpdcron/package.nix b/pkgs/by-name/mp/mpdcron/package.nix
index b3c22a7b80ee..91a535aec1f1 100644
--- a/pkgs/by-name/mp/mpdcron/package.nix
+++ b/pkgs/by-name/mp/mpdcron/package.nix
@@ -14,6 +14,8 @@
   bundlerEnv,
   libnotify,
   pandoc,
+  autoreconfHook,
+  bundlerUpdateScript,
 }:
 
 let
@@ -34,8 +36,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [
-    autoconf
-    automake
+    autoreconfHook
     pkg-config
   ];
   buildInputs = [
@@ -50,25 +51,21 @@ stdenv.mkDerivation {
     libnotify
   ];
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
-
   configureFlags = [
     "--enable-gmodule"
     "--with-standard-modules=all"
   ];
 
-  meta = with lib; {
+  passthru.updateScript = bundlerUpdateScript "mpdcron";
+
+  meta = {
     description = "Cron like daemon for mpd";
     homepage = "http://alip.github.io/mpdcron/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
       lovek323
       manveru
     ];
-    broken = stdenv.hostPlatform.isDarwin; # fails due to old nokogiri https://github.com/sparklemotion/nokogiri/discussions/3152#discussioncomment-8806607
   };
 }
-# TODO: autoreconfHook this
diff --git a/pkgs/by-name/ne/netbox_4_2/package.nix b/pkgs/by-name/ne/netbox_4_2/package.nix
index 371a07b361ff..e17cd2c629c8 100644
--- a/pkgs/by-name/ne/netbox_4_2/package.nix
+++ b/pkgs/by-name/ne/netbox_4_2/package.nix
@@ -121,6 +121,9 @@ py.pkgs.buildPythonApplication rec {
     description = "IP address management (IPAM) and data center infrastructure management (DCIM) tool";
     mainProgram = "netbox";
     license = lib.licenses.asl20;
+    knownVulnerabilities = [
+      "Netbox Version ${version} is EOL; please upgrade by following the current release notes instructions"
+    ];
     maintainers = with lib.maintainers; [
       minijackson
       raitobezarius
diff --git a/pkgs/by-name/ne/netbox_4_3/custom-static-root.patch b/pkgs/by-name/ne/netbox_4_3/custom-static-root.patch
new file mode 100644
index 000000000000..c9219fa2b871
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_3/custom-static-root.patch
@@ -0,0 +1,13 @@
+diff --git a/netbox/netbox/settings.py b/netbox/netbox/settings.py
+index 2de06dd10..00406af48 100644
+--- a/netbox/netbox/settings.py
++++ b/netbox/netbox/settings.py
+@@ -410,7 +412,7 @@ USE_X_FORWARDED_HOST = True
+ X_FRAME_OPTIONS = 'SAMEORIGIN'
+ 
+ # Static files (CSS, JavaScript, Images)
+-STATIC_ROOT = BASE_DIR + '/static'
++STATIC_ROOT = getattr(configuration, 'STATIC_ROOT', os.path.join(BASE_DIR, 'static')).rstrip('/')
+ STATIC_URL = f'/{BASE_PATH}static/'
+ STATICFILES_DIRS = (
+     os.path.join(BASE_DIR, 'project-static', 'dist'),
diff --git a/pkgs/by-name/ne/netbox_4_3/package.nix b/pkgs/by-name/ne/netbox_4_3/package.nix
new file mode 100644
index 000000000000..878cfd3315e6
--- /dev/null
+++ b/pkgs/by-name/ne/netbox_4_3/package.nix
@@ -0,0 +1,130 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+  plugins ? _ps: [ ],
+  nixosTests,
+  nix-update-script,
+}:
+let
+  py = python3.override {
+    self = py;
+    packageOverrides = _final: prev: { django = prev.django_5_2; };
+  };
+
+  extraBuildInputs = plugins py.pkgs;
+in
+py.pkgs.buildPythonApplication rec {
+  pname = "netbox";
+  version = "4.3.2";
+  pyproject = false;
+
+  src = fetchFromGitHub {
+    owner = "netbox-community";
+    repo = "netbox";
+    tag = "v${version}";
+    hash = "sha256-20X/0k60q2cPsWuz+qpgcfXGkg+A2k5qaWx6zHkmpWc=";
+  };
+
+  patches = [
+    ./custom-static-root.patch
+  ];
+
+  dependencies =
+    (
+      with py.pkgs;
+      [
+        django
+        django-cors-headers
+        django-debug-toolbar
+        django-filter
+        django-graphiql-debug-toolbar
+        django-htmx
+        django-mptt
+        django-pglocks
+        django-prometheus
+        django-redis
+        django-rq
+        django-storages
+        django-tables2
+        django-taggit
+        django-timezone-field
+        djangorestframework
+        drf-spectacular
+        drf-spectacular-sidecar
+        feedparser
+        jinja2
+        markdown
+        netaddr
+        nh3
+        pillow
+        psycopg
+        pyyaml
+        requests
+        social-auth-core
+        social-auth-app-django
+        strawberry-graphql
+        strawberry-django
+        svgwrite
+        tablib
+
+        # Optional dependencies, kept here for backward compatibility
+
+        # for the S3 data source backend
+        boto3
+        # for Git data source backend
+        dulwich
+        # for error reporting
+        sentry-sdk
+      ]
+      ++ psycopg.optional-dependencies.c
+      ++ psycopg.optional-dependencies.pool
+      ++ social-auth-core.optional-dependencies.openidconnect
+    )
+    ++ extraBuildInputs;
+
+  nativeBuildInputs = with py.pkgs; [
+    mkdocs-material
+    mkdocs-material-extensions
+    mkdocstrings
+    mkdocstrings-python
+  ];
+
+  postBuild = ''
+    PYTHONPATH=$PYTHONPATH:netbox/
+    ${py.interpreter} -m mkdocs build
+  '';
+
+  installPhase = ''
+    mkdir -p $out/opt/netbox
+    cp -r . $out/opt/netbox
+    chmod +x $out/opt/netbox/netbox/manage.py
+    makeWrapper $out/opt/netbox/netbox/manage.py $out/bin/netbox \
+      --prefix PYTHONPATH : "$PYTHONPATH"
+  '';
+
+  passthru = {
+    python = py;
+    # PYTHONPATH of all dependencies used by the package
+    pythonPath = py.pkgs.makePythonPath dependencies;
+    inherit (py.pkgs) gunicorn;
+    tests = {
+      netbox = nixosTests.netbox_4_3;
+      inherit (nixosTests) netbox-upgrade;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    homepage = "https://github.com/netbox-community/netbox";
+    changelog = "https://github.com/netbox-community/netbox/blob/${src.tag}/docs/release-notes/version-${lib.versions.majorMinor version}.md";
+    description = "IP address management (IPAM) and data center infrastructure management (DCIM) tool";
+    mainProgram = "netbox";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      minijackson
+      raitobezarius
+      transcaffeine
+    ];
+  };
+}
diff --git a/pkgs/by-name/ne/netgen/package.nix b/pkgs/by-name/ne/netgen/package.nix
index c12f445798ec..99882939612c 100644
--- a/pkgs/by-name/ne/netgen/package.nix
+++ b/pkgs/by-name/ne/netgen/package.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "netgen";
-  version = "6.2.2501";
+  version = "6.2.2504";
 
   src = fetchFromGitHub {
     owner = "ngsolve";
     repo = "netgen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IzYulT3bo7XZiEEy8vNCct0zqHCnbQaH+y4fHMorzZw=";
+    hash = "sha256-N4mmh2H2qvc+3Pa9CHm38arViI76Qvwp8fOVGZbMv1M=";
   };
 
   patches = [
@@ -100,6 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
     imagemagick
     cmake
     python3Packages.pybind11-stubgen
+    python3Packages.pythonImportsCheckHook
   ] ++ lib.optional stdenv.hostPlatform.isLinux copyDesktopItems;
 
   buildInputs = [
@@ -163,7 +164,7 @@ stdenv.mkDerivation (finalAttrs: {
       mkdir -p $out/Applications/netgen.app/Contents/{MacOS,Resouces}
       substituteInPlace $out/Info.plist --replace-fail "Netgen1" "netgen"
       mv $out/Info.plist $out/Applications/netgen.app/Contents
-      mv $out/Netgen.icns $out/Applications/netgen.app/Contents/Resouces
+      mv $out/Netgen.icns $out/Applications/netgen.app/Contents/Resources
       ln -s $out/bin/netgen $out/Applications/netgen.app/Contents/MacOS/netgen
     ''
     + lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -194,7 +195,6 @@ stdenv.mkDerivation (finalAttrs: {
     python3Packages.pytest
     python3Packages.pytest-check
     python3Packages.pytest-mpi
-    python3Packages.pythonImportsCheckHook
     mpiCheckPhaseHook
   ];
 
diff --git a/pkgs/by-name/no/nominatim/nominatim-api.nix b/pkgs/by-name/no/nominatim/nominatim-api.nix
new file mode 100644
index 000000000000..6cda6ae63662
--- /dev/null
+++ b/pkgs/by-name/no/nominatim/nominatim-api.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  hatchling,
+  psycopg,
+  pyicu,
+  python-dotenv,
+  pyyaml,
+  sqlalchemy,
+}:
+
+buildPythonPackage rec {
+  pname = "nominatim";
+  version = "5.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "osm-search";
+    repo = "Nominatim";
+    tag = "v${version}";
+    hash = "sha256-eMCXXPrUZvM4ju0mi1+f+LXhThCCCEH+HDz6lurw+Jo=";
+  };
+
+  postPatch = ''
+    # pyproject.toml tool.hatch.build.targets.sdist.exclude is not properly
+    # excluding config.py file.
+    # Fix FileExistsError: File already exists: ... nominatim_api/config.py
+    rm src/nominatim_api/config.py
+
+    # Change to package directory
+    cd packaging/nominatim-api
+  '';
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    psycopg
+    pyicu
+    python-dotenv
+    pyyaml
+    sqlalchemy
+  ];
+
+  # Fails on: ModuleNotFoundError: No module named 'nominatim_db'
+  # pythonImportsCheck = [ "nominatim_api" ];
+
+  meta = {
+    description = "Search engine for OpenStreetMap data (API module)";
+    homepage = "https://nominatim.org/";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ mausch ];
+    teams = with lib.teams; [
+      geospatial
+      ngi
+    ];
+  };
+}
diff --git a/pkgs/by-name/no/nominatim/package.nix b/pkgs/by-name/no/nominatim/package.nix
index afaf7d93b08e..add1001d86ef 100644
--- a/pkgs/by-name/no/nominatim/package.nix
+++ b/pkgs/by-name/no/nominatim/package.nix
@@ -1,89 +1,83 @@
 {
-  stdenv,
   lib,
   fetchFromGitHub,
   fetchurl,
-  clang-tools,
-  cmake,
-  bzip2,
-  zlib,
-  expat,
-  boost,
-  git,
-  pandoc,
-  nlohmann_json,
-  # Nominatim needs to be built with the same postgres version it will target
-  libpq,
-  python3,
-  php,
-  lua,
+
+  osm2pgsql,
+  python3Packages,
+
+  nominatim, # required for testVersion
+  testers,
 }:
 
 let
   countryGrid = fetchurl {
-    # Nominatim docs mention https://www.nominatim.org/data/country_grid.sql.gz but it's not a very good URL for pinning
+    # Nominatim-db needs https://www.nominatim.org/data/country_grid.sql.gz
+    # but it's not a very good URL for pinning
     url = "https://web.archive.org/web/20220323041006/https://nominatim.org/data/country_grid.sql.gz";
-    sha256 = "sha256-/mY5Oq9WF0klXOv0xh0TqEJeMmuM5QQJ2IxANRZd4Ek=";
+    hash = "sha256-/mY5Oq9WF0klXOv0xh0TqEJeMmuM5QQJ2IxANRZd4Ek=";
   };
 in
-stdenv.mkDerivation rec {
+python3Packages.buildPythonApplication rec {
   pname = "nominatim";
-  version = "4.4.0";
+  version = "5.1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "osm-search";
     repo = "Nominatim";
-    rev = "v${version}";
-    fetchSubmodules = true;
-    hash = "sha256-GPMDbvTPl9SLpZi5gyRAPQ84NSTIRoSfGJeqWs1e9Oo=";
+    tag = "v${version}";
+    hash = "sha256-eMCXXPrUZvM4ju0mi1+f+LXhThCCCEH+HDz6lurw+Jo=";
   };
 
-  nativeBuildInputs = [
-    cmake
-    clang-tools
-    git
-    pandoc
-    php
-    lua
-  ];
-
-  buildInputs = [
-    bzip2
-    zlib
-    expat
-    boost
-    nlohmann_json
-    (python3.withPackages (
-      ps: with ps; [
-        pyyaml
-        python-dotenv
-        psycopg2
-        sqlalchemy
-        asyncpg
-        psutil
-        jinja2
-        pyicu
-        datrie
-        pyosmium
-      ]
-    ))
-    # python3Packages.pylint  # We don't want to run pylint because the package could break on pylint bumps which is really annoying.
-    # python3Packages.pytest  # disabled since I can't get it to run tests anyway
-    # python3Packages.behave  # disabled since I can't get it to run tests anyway
-    libpq
-  ];
-
   postPatch = ''
-    mkdir -p ./data
-    ln -s ${countryGrid} ./data/country_osm_grid.sql.gz
+    # Fix: FileExistsError: File already exists: ... nominatim_db/paths.py
+    # pyproject.toml tool.hatch.build.targets.sdist.exclude is not properly
+    # excluding paths.py file.
+    rm src/nominatim_db/paths.py
+
+    # Install country_osm_grid.sql.gz required for data import
+    cp ${countryGrid} ./data/country_osm_grid.sql.gz
+
+    # Change to package directory
+    cd packaging/nominatim-db
   '';
 
-  meta = with lib; {
-    description = "Search engine for OpenStreetMap data";
+  build-system = with python3Packages; [
+    hatchling
+  ];
+
+  dependencies = with python3Packages; [
+    nominatim-api
+
+    jinja2
+    psutil
+    psycopg
+    pyicu
+    python-dotenv
+    pyyaml
+  ];
+
+  propagatedBuildInputs = [
+    osm2pgsql
+  ];
+
+  pythonImportsCheck = [ "nominatim_db" ];
+
+  passthru = {
+    tests.version = testers.testVersion { package = nominatim; };
+  };
+
+  meta = {
+    description = "Search engine for OpenStreetMap data (DB, CLI)";
     homepage = "https://nominatim.org/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = [ maintainers.mausch ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ mausch ];
+    teams = with lib.teams; [
+      geospatial
+      ngi
+    ];
     mainProgram = "nominatim";
   };
 }
diff --git a/pkgs/by-name/nt/ntfy-alertmanager/package.nix b/pkgs/by-name/nt/ntfy-alertmanager/package.nix
index 88edb49f9157..9726dad9784b 100644
--- a/pkgs/by-name/nt/ntfy-alertmanager/package.nix
+++ b/pkgs/by-name/nt/ntfy-alertmanager/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "ntfy-alertmanager";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchurl {
     url = "https://git.xenrox.net/~xenrox/ntfy-alertmanager/refs/download/v${version}/ntfy-alertmanager-${version}.tar.gz";
-    hash = "sha256-5rQzJZ0BaLtfj2MfyZZJ3PEiWnaTjWOMlsJYeYENW7U=";
+    hash = "sha256-Sn2hPt03o4Pi1WY/3d5oWhWUt8x+3P8hoNPS58tj0Kw=";
   };
 
-  vendorHash = "sha256-8a6dvBERegpFYFHQGJppz5tlQioQAudCe3/Q7vro+ZI=";
+  vendorHash = "sha256-NHaLv+Ulzl4ev3a6OjZiacCSmYAtvqFFmbYzAp+4AFU=";
 
   meta = with lib; {
     description = "Bridge between ntfy and Alertmanager";
diff --git a/pkgs/by-name/ov/overpush/package.nix b/pkgs/by-name/ov/overpush/package.nix
new file mode 100644
index 000000000000..08b603d3b0af
--- /dev/null
+++ b/pkgs/by-name/ov/overpush/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  pkg-config,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "overpush";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "mrusme";
+    repo = "overpush";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Bs5Mlpod7bIQxekadU6xBhgC8nchli+BvxEH6NeMOKw=";
+  };
+
+  vendorHash = "sha256-wsuztFwEfluUxL2RjMP7Y+JtxQHr5oLwHkAL8UIHyVQ=";
+
+  env.CGO_ENABLED = "0";
+
+  ldflags = [
+    "-s"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Self-hosted, drop-in replacement for Pushover that can use XMPP";
+    homepage = "https://github.com/mrusme/overpush";
+    changelog = "https://github.com/mrusme/overpush/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ liberodark ];
+    platforms = lib.platforms.linux;
+    mainProgram = "overpush";
+  };
+})
diff --git a/pkgs/by-name/pd/pd-else/package.nix b/pkgs/by-name/pd/pd-else/package.nix
new file mode 100644
index 000000000000..adcd63d80c74
--- /dev/null
+++ b/pkgs/by-name/pd/pd-else/package.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  puredata,
+  pkg-config,
+  cmake,
+  openssl,
+  libogg,
+  libvorbis,
+  opusfile,
+  ffmpeg,
+  zlib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pd-else";
+  version = "1.0-rc13";
+
+  src = fetchFromGitHub {
+    owner = "porres";
+    repo = "pd-else";
+    tag = "v.${version}";
+    hash = "sha256-WebjdozcFup2xk3cS9LPTiA6m0l1sR6sj3hHlt6ScfU=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ];
+
+  buildInputs = [
+    puredata
+    openssl
+    libogg
+    libvorbis
+    opusfile
+    ffmpeg
+    zlib
+  ];
+
+  # Set up Pure Data headers and configure with system libraries
+  preConfigure = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'add_subdirectory(Source/Shared/ffmpeg)' '# add_subdirectory(Source/Shared/ffmpeg) - using system FFmpeg' \
+      --replace-fail 'target_link_libraries(play.file_tilde PRIVATE ffmpeg)' 'target_link_libraries(play.file_tilde PRIVATE avformat avcodec avutil swresample z)' \
+      --replace-fail 'target_link_libraries(sfload PRIVATE ffmpeg)' 'target_link_libraries(sfload PRIVATE avformat avcodec avutil swresample z)' \
+      --replace-fail 'target_link_libraries(sfinfo PRIVATE ffmpeg)' 'target_link_libraries(sfinfo PRIVATE avformat avcodec avutil swresample z)'
+  '';
+
+  cmakeFlags = [
+    "-DCMAKE_C_FLAGS=-I${puredata}/include/pd"
+    "-DCMAKE_CXX_FLAGS=-I${puredata}/include/pd"
+    "-DUSE_LTO=ON"
+    "-DOPENSSL_CRYPTO_LIBRARY=${lib.getLib openssl}/lib/libcrypto.so"
+    "-DOPENSSL_SSL_LIBRARY=${lib.getLib openssl}/lib/libssl.so"
+  ];
+
+  postInstall = ''
+    mv else/ $out/else/
+    rm -rf $out/include/ $out/lib/
+  '';
+
+  postFixup = ''
+    interpreter=$(cat $NIX_CC/nix-support/dynamic-linker)
+    find $out -type f -executable -exec patchelf --set-interpreter "$interpreter" --set-rpath ${lib.makeLibraryPath buildInputs} {} \;
+  '';
+
+  meta = {
+    description = "EL Locus Solus' Externals for Pure Data";
+    longDescription = ''
+      ELSE is a library of externals and abstractions for Pure Data.
+      It provides a comprehensive set of tools for signal processing,
+      MIDI, GUI, and more in Pure Data.
+    '';
+    homepage = "https://github.com/porres/pd-else";
+    license = lib.licenses.wtfpl;
+    platforms = lib.platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
+    maintainers = [ lib.maintainers.kugland ];
+  };
+}
diff --git a/pkgs/by-name/pr/prometheus-slurm-exporter/package.nix b/pkgs/by-name/pr/prometheus-slurm-exporter/package.nix
new file mode 100644
index 000000000000..a3c58246676b
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-slurm-exporter/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "prometheus-slurm-exporter";
+  version = "0.20";
+
+  src = fetchFromGitHub {
+    owner = "vpenso";
+    repo = "prometheus-slurm-exporter";
+    tag = finalAttrs.version;
+    hash = "sha256-KS9LoDuLQFq3KoKpHd8vg1jw20YCNRJNJrnBnu5vxvs=";
+  };
+
+  vendorHash = "sha256-A1dd9T9SIEHDCiVT2UwV6T02BSLh9ej6LC/2l54hgwI=";
+
+  # Needs a working slurm environment during test
+  doCheck = false;
+
+  meta = {
+    description = "Prometheus exporter for performance metrics from Slurm";
+    homepage = "https://github.com/vpenso/prometheus-slurm-exporter";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "prometheus-slurm-exporter";
+  };
+})
diff --git a/pkgs/by-name/pr/proxsuite/package.nix b/pkgs/by-name/pr/proxsuite/package.nix
index 18355cfdf313..f2a0b7446427 100644
--- a/pkgs/by-name/pr/proxsuite/package.nix
+++ b/pkgs/by-name/pr/proxsuite/package.nix
@@ -18,6 +18,9 @@
   jrl-cmakemodules,
   simde,
 
+  # nativeCheckInputs
+  ctestCheckHook,
+
   # checkInputs
   matio,
 
@@ -38,15 +41,11 @@ stdenv.mkDerivation (finalAttrs: {
     "out"
   ];
 
-  cmakeFlags =
-    [
-      (lib.cmakeBool "BUILD_DOCUMENTATION" true)
-      (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
-      (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
-      "-DCMAKE_CTEST_ARGUMENTS=--exclude-regex;ProxQP::dense: test primal infeasibility solving"
-    ];
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_DOCUMENTATION" true)
+    (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+  ];
 
   strictDeps = true;
 
@@ -68,6 +67,8 @@ stdenv.mkDerivation (finalAttrs: {
     simde
   ] ++ lib.optionals pythonSupport [ python3Packages.nanobind ];
 
+  nativeCheckInputs = [ ctestCheckHook ];
+
   checkInputs =
     [ matio ]
     ++ lib.optionals pythonSupport [
@@ -75,6 +76,11 @@ stdenv.mkDerivation (finalAttrs: {
       python3Packages.scipy
     ];
 
+  ctestFlags = lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
+    "--exclude-regex"
+    "sparse maros meszaros using the API"
+  ];
+
   # Fontconfig error: Cannot load default config file: No such file: (null)
   env.FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
 
diff --git a/pkgs/by-name/sp/spiffe-helper/package.nix b/pkgs/by-name/sp/spiffe-helper/package.nix
new file mode 100644
index 000000000000..396566145f57
--- /dev/null
+++ b/pkgs/by-name/sp/spiffe-helper/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "spiffe-helper";
+  version = "0.10.0";
+
+  src = fetchFromGitHub {
+    owner = "spiffe";
+    repo = "spiffe-helper";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nakwTJBE8ICuRCmG+pjh1gZVFIXSOgsxTDjEeBrwufE=";
+  };
+
+  vendorHash = "sha256-sAcmJNry3nuWyzt0Ee05JjROR/pDXxu2NVmltotSD0U=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  preCheck = ''
+    patchShebangs pkg/sidecar/sidecar_test.sh
+  '';
+
+  doInstallCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # no version output
+    $out/bin/${finalAttrs.meta.mainProgram} -h
+
+    runHook postInstallCheck
+  '';
+
+  meta = {
+    description = "Retrieve and manage SVIDs on behalf of a workload";
+    homepage = "https://github.com/spiffe/spiffe-helper";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jk ];
+    mainProgram = "spiffe-helper";
+  };
+})
diff --git a/pkgs/by-name/st/starlark/package.nix b/pkgs/by-name/st/starlark/package.nix
index 9a4ecc6db7c3..6fdbad49f4d4 100644
--- a/pkgs/by-name/st/starlark/package.nix
+++ b/pkgs/by-name/st/starlark/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule {
   pname = "starlark";
-  version = "0-unstable-2025-06-03";
+  version = "0-unstable-2025-06-23";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "starlark-go";
-    rev = "27fdb1d4744d057ceaa6c18d8eca9bf5692e3852";
-    hash = "sha256-iS9v4XRJTclFxc/siuhTGliUAjM4pqju9lD+muFXp4Y=";
+    rev = "8bf495bf4e9a6110b82436cdebbdc3f06ad4f474";
+    hash = "sha256-m8jWFPXYrT0kTbrz6xHi6Q7D5mzoycU+SY3h7SnCYiU=";
   };
 
   vendorHash = "sha256-8drlCBy+KROyqXzm/c+HBe/bMVOyvwRoLHxOApJhMfo=";
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 3b919d9e583e..c6498b649e54 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.12.3";
+  version = "1.12.4";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fOZXgyA61G+D7otNNO8d89ghR/GiYPJ7vSZtj9TeGuU=";
+    hash = "sha256-x5tbLoNGBT3tS+QXn0piFMM8+uqoQt8gfQJap1TyLmQ=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
diff --git a/pkgs/by-name/xe/xenia-canary/package.nix b/pkgs/by-name/xe/xenia-canary/package.nix
index 92f4addf710f..462d73abb5e3 100644
--- a/pkgs/by-name/xe/xenia-canary/package.nix
+++ b/pkgs/by-name/xe/xenia-canary/package.nix
@@ -12,20 +12,20 @@
   wrapGAppsHook3,
   makeDesktopItem,
   copyDesktopItems,
-  llvmPackages_18,
+  llvmPackages_19,
   autoPatchelfHook,
   unstableGitUpdater,
   fetchFromGitHub,
 }:
-llvmPackages_18.stdenv.mkDerivation {
+llvmPackages_19.stdenv.mkDerivation {
   pname = "xenia-canary";
-  version = "0-unstable-2025-06-14";
+  version = "0-unstable-2025-06-21";
 
   src = fetchFromGitHub {
     owner = "xenia-canary";
     repo = "xenia-canary";
     fetchSubmodules = true;
-    rev = "f65f044ee51360de6dd26f5ea0a247e92d8f2275";
+    rev = "fd1abfe6aa66b2348d9f93f8e5065def06b1a11d";
     hash = "sha256-cxwawoCLE0E/HaELfI3FG4yhk4GRtjB9pCs9gkeM+uc=";
   };
 
diff --git a/pkgs/by-name/xg/xgalagapp/package.nix b/pkgs/by-name/xg/xgalagapp/package.nix
index 8afd7f29f069..0611ba0ae8fc 100644
--- a/pkgs/by-name/xg/xgalagapp/package.nix
+++ b/pkgs/by-name/xg/xgalagapp/package.nix
@@ -19,14 +19,20 @@ stdenv.mkDerivation rec {
     libXpm
   ];
 
-  buildPhase = ''
-    make all HIGH_SCORES_FILE=.xgalaga++.scores
-  '';
+  buildFlags = [
+    "all"
+    "HIGH_SCORES_FILE=.xgalaga++.scores"
+    "CXX=${stdenv.cc.targetPrefix}c++" # fix darwin and cross-compiled builds
+  ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin $out/share/man
     mv xgalaga++ $out/bin
     mv xgalaga++.6x $out/share/man
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -34,6 +40,6 @@ stdenv.mkDerivation rec {
     description = "XGalaga++ is a classic single screen vertical shoot ’em up. It is inspired by XGalaga and reuses most of its sprites";
     mainProgram = "xgalaga++";
     license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 9378824b7d87..95d0c46c1972 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.191.7";
+  version = "0.191.9";
 
   outputs =
     [ "out" ]
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kx9VolPqKR0ML7F7ITnp5GPT4ULJvmTsRHKgkKZPGwQ=";
+    hash = "sha256-QdRksW2T8gzyPhqd4jIUfuVmcXh3j7yIah5TGqHNxNM=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-MMQYbhv/6s+9zxP9E5bcCDS9TUYSbapkX5sklVpNHnI=";
+  cargoHash = "sha256-Cvj2fit1nxgbxOLK7wUdqkLJpECVB5uwUKyWmjNFygU=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/development/ocaml-modules/awa/default.nix b/pkgs/development/ocaml-modules/awa/default.nix
index 5f563725ed9b..236661b518a0 100644
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@@ -16,17 +16,16 @@
   cmdliner,
   base64,
   zarith,
+  mirage-mtime,
 }:
 
 buildDunePackage rec {
   pname = "awa";
-  version = "0.5.1";
-
-  minimalOCamlVersion = "4.10";
+  version = "0.5.2";
 
   src = fetchurl {
     url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-${version}.tbz";
-    hash = "sha256-bd6vBgUwJh1MUlrgbdbBVTZMd3gcJGIX8EEJ5872n14=";
+    hash = "sha256-64gloekVN0YsBwUodrJc6QaNU3PGKMIZMPJWvBfzaj0=";
   };
 
   propagatedBuildInputs = [
@@ -48,6 +47,7 @@ buildDunePackage rec {
     cstruct-unix
     cmdliner
     fmt
+    mirage-mtime
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/netbox-attachments/default.nix b/pkgs/development/python-modules/netbox-attachments/default.nix
index 88fbf9a619ba..1464f6ca3be1 100644
--- a/pkgs/development/python-modules/netbox-attachments/default.nix
+++ b/pkgs/development/python-modules/netbox-attachments/default.nix
@@ -1,25 +1,25 @@
 {
   lib,
   buildPythonPackage,
-  pythonAtLeast,
   fetchFromGitHub,
   setuptools,
+  python,
   netbox,
   django,
   netaddr,
 }:
 buildPythonPackage rec {
   pname = "netbox-attachments";
-  version = "7.2.0";
+  version = "8.0.4";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.13";
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
 
   src = fetchFromGitHub {
     owner = "Kani999";
     repo = "netbox-attachments";
     tag = version;
-    hash = "sha256-EYf1PbFIFyCb2fYrnn/T8dnXz3dHmDOLI8Wbnef8V8M=";
+    hash = "sha256-wVTI0FAj6RaEaE6FhvHq4ophnCspobqL2SnTYVynlxs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/netbox-contract/default.nix b/pkgs/development/python-modules/netbox-contract/default.nix
index 4ce0be97692b..6bf331f5f595 100644
--- a/pkgs/development/python-modules/netbox-contract/default.nix
+++ b/pkgs/development/python-modules/netbox-contract/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  pythonAtLeast,
+  python,
   fetchFromGitHub,
   setuptools,
   python-dateutil,
@@ -11,16 +11,16 @@
 }:
 buildPythonPackage rec {
   pname = "netbox-contract";
-  version = "2.3.2";
+  version = "2.4.0";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.13";
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
 
   src = fetchFromGitHub {
     owner = "mlebreuil";
     repo = "netbox-contract";
     tag = "v${version}";
-    hash = "sha256-e3N0m+oj2CMUXwI4dF/tXA+Lz+9+ZlbJAy+zHoRDNtw=";
+    hash = "sha256-duA53cuJ3q6CRp239xNMXQhGZHGn7IBIGNLoxt7hZh8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/netbox-floorplan-plugin/default.nix b/pkgs/development/python-modules/netbox-floorplan-plugin/default.nix
index a8ede465dbcb..f54ed5813342 100644
--- a/pkgs/development/python-modules/netbox-floorplan-plugin/default.nix
+++ b/pkgs/development/python-modules/netbox-floorplan-plugin/default.nix
@@ -4,22 +4,22 @@
   fetchFromGitHub,
   setuptools,
   netbox,
-  pythonAtLeast,
   django,
   netaddr,
+  python,
 }:
 buildPythonPackage rec {
   pname = "netbox-floorplan-plugin";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.13";
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = "netbox-floorplan-plugin";
     tag = version;
-    hash = "sha256-cJrqSXRCBedZh/pIozz/bHyhQosTy8cFYyji3KJva9Q=";
+    hash = "sha256-ecwPdcVuXU6OIVbafYGaY6+pbBHxhh1AlNmDBlUk1Ss=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/netbox-napalm-plugin/default.nix b/pkgs/development/python-modules/netbox-napalm-plugin/default.nix
index 3b06f9abc9a0..1eb1fc6923ee 100644
--- a/pkgs/development/python-modules/netbox-napalm-plugin/default.nix
+++ b/pkgs/development/python-modules/netbox-napalm-plugin/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   setuptools,
   netbox,
-  pythonAtLeast,
+  python,
   napalm,
   django,
 }:
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   version = "0.3.1";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.13";
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
 
   src = fetchFromGitHub {
     owner = "netbox-community";
diff --git a/pkgs/development/python-modules/netbox-topology-views/default.nix b/pkgs/development/python-modules/netbox-topology-views/default.nix
index 8617b16d559c..007a94a6225a 100644
--- a/pkgs/development/python-modules/netbox-topology-views/default.nix
+++ b/pkgs/development/python-modules/netbox-topology-views/default.nix
@@ -4,22 +4,22 @@
   fetchFromGitHub,
   setuptools,
   netbox,
-  pythonAtLeast,
   django,
   netaddr,
+  python,
 }:
 buildPythonPackage rec {
   pname = "netbox-topology-views";
-  version = "4.2.1";
+  version = "4.3.0";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.13";
+  disabled = python.pythonVersion != netbox.python.pythonVersion;
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = "netbox-topology-views";
     tag = "v${version}";
-    hash = "sha256-ysupqyRFOKVa+evNbfSdW2W57apI0jVEU92afz6+AaE=";
+    hash = "sha256-K8hG2M8uWPk9+7u21z+hmedOovievkMNpn3p7I4+6t4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/safetensors/Cargo.lock b/pkgs/development/python-modules/safetensors/Cargo.lock
new file mode 100644
index 000000000000..fcba187c6bff
--- /dev/null
+++ b/pkgs/development/python-modules/safetensors/Cargo.lock
@@ -0,0 +1,234 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "indoc"
+version = "2.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c7245a08504955605670dbf141fceab975f15ca21570696aebe9d2e71576bd"
+
+[[package]]
+name = "itoa"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+
+[[package]]
+name = "libc"
+version = "0.2.174"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
+
+[[package]]
+name = "memchr"
+version = "2.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
+
+[[package]]
+name = "memmap2"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd3f7eed9d3848f8b98834af67102b720745c4ec028fcd0aa0239277e7de374f"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "portable-atomic"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8970a78afe0628a3e3430376fc5fd76b6b45c4d43360ffd6cdd40bdde72b682a"
+dependencies = [
+ "indoc",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "458eb0c55e7ece017adeba38f2248ff3ac615e53660d7c71a238d7d2a01c7598"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7114fe5457c61b276ab77c5055f206295b812608083644a5c5b2640c3102565c"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8725c0a622b374d6cb051d11a0983786448f7785336139c3c94f5aa6bef7e50"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4109984c22491085343c05b0dbc54ddc405c3cf7b4374fc533f5c3313a572ccc"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+
+[[package]]
+name = "safetensors"
+version = "0.6.0-dev.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "safetensors-python"
+version = "0.6.0-dev.0"
+dependencies = [
+ "memmap2",
+ "pyo3",
+ "safetensors",
+ "serde_json",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.219"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.219"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e502f78cdbb8ba4718f566c418c52bc729126ffd16baee5baa718cf25dd5a69a"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+
+[[package]]
+name = "unindent"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"
diff --git a/pkgs/development/python-modules/safetensors/default.nix b/pkgs/development/python-modules/safetensors/default.nix
index e82879ccf563..8239d9ab4247 100644
--- a/pkgs/development/python-modules/safetensors/default.nix
+++ b/pkgs/development/python-modules/safetensors/default.nix
@@ -26,23 +26,26 @@
 
 buildPythonPackage rec {
   pname = "safetensors";
-  version = "0.5.2";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "safetensors";
     tag = "v${version}";
-    hash = "sha256-dtHHLiTgrg/a/SQ/Z1w0BsuFDClgrMsGiSTCpbJasUs=";
+    hash = "sha256-wAr/jvr0w+vOHjjqE7cPcAM/IMz+58YhfoJ2XC4987M=";
   };
 
   sourceRoot = "${src.name}/bindings/python";
 
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname src sourceRoot;
-    hash = "sha256-hjV2cfS/0WFyAnATt+A8X8sQLzQViDzkNI7zN0ltgpU=";
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
   };
 
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
     rustPlatform.maturinBuildHook
@@ -88,6 +91,18 @@ buildPythonPackage rec {
     torch
   ];
   pytestFlagsArray = [ "tests" ];
+  disabledTests = [
+    # AttributeError: module 'torch' has no attribute 'float4_e2m1fn_x2'
+    "test_odd_dtype_fp4"
+
+    # AssertionError: 'No such file or directory: notafile' != 'No such file or directory: "notafile"'
+    "test_file_not_found"
+
+    # AssertionError:
+    #    'Erro[41 chars] 5]: index 20 out of bounds for tensor dimension #1 of size 5'
+    # != 'Erro[41 chars] 5]:  SliceOutOfRange { dim_index: 1, asked: 20, dim_size: 5 }'
+    "test_numpy_slice"
+  ];
   # don't require PaddlePaddle (not in Nixpkgs), Flax, or Tensorflow (onerous) to run tests:
   disabledTestPaths =
     [
diff --git a/pkgs/development/python-modules/strawberry-django/default.nix b/pkgs/development/python-modules/strawberry-django/default.nix
index 939ad2561e93..e9c30e69d7c2 100644
--- a/pkgs/development/python-modules/strawberry-django/default.nix
+++ b/pkgs/development/python-modules/strawberry-django/default.nix
@@ -19,6 +19,7 @@
   # check inputs
   pytestCheckHook,
   django-guardian,
+  django-model-utils,
   django-mptt,
   django-polymorphic,
   django-tree-queries,
@@ -33,14 +34,14 @@
 
 buildPythonPackage rec {
   pname = "strawberry-django";
-  version = "0.57.1";
+  version = "0.60.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "strawberry-graphql";
     repo = "strawberry-django";
     tag = "v${version}";
-    hash = "sha256-nwqb9AVNQNIRdjYcutTaI3YfwuMDLP4mUirSXFq+WnI=";
+    hash = "sha256-mMI/tPdt9XK6Lz7VmI3uDxcCjIuidUeGHjG+6AQLoeQ=";
   };
 
   build-system = [
@@ -64,6 +65,7 @@ buildPythonPackage rec {
       pytestCheckHook
 
       django-guardian
+      django-model-utils
       django-mptt
       django-polymorphic
       django-tree-queries
diff --git a/pkgs/development/python-modules/strawberry-graphql/default.nix b/pkgs/development/python-modules/strawberry-graphql/default.nix
index 760f8ac7f913..dd2390b50a6f 100644
--- a/pkgs/development/python-modules/strawberry-graphql/default.nix
+++ b/pkgs/development/python-modules/strawberry-graphql/default.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "strawberry-graphql";
-  version = "0.263.1";
+  version = "0.271.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "strawberry-graphql";
     repo = "strawberry";
     tag = version;
-    hash = "sha256-w36KY1zl/OguRFs6sM6K4F17bYQcA+bA6XS62VhRgA8=";
+    hash = "sha256-ypGv0ICGqCisOK0xVLWQXIZb5mF6wt3RukcUo0qM2nQ=";
   };
 
   postPatch = ''
@@ -152,6 +152,7 @@ buildPythonPackage rec {
     "tests/schema/extensions/"
     "tests/schema/test_dataloaders.py"
     "tests/schema/test_lazy/"
+    "tests/sanic/test_file_upload.py"
     "tests/test_dataloaders.py"
     "tests/utils/test_pretty_print.py"
     "tests/websockets/test_graphql_transport_ws.py"
diff --git a/pkgs/servers/sql/postgresql/ext/h3-pg.nix b/pkgs/servers/sql/postgresql/ext/h3-pg.nix
index 3defcde5699f..69e67b2e339e 100644
--- a/pkgs/servers/sql/postgresql/ext/h3-pg.nix
+++ b/pkgs/servers/sql/postgresql/ext/h3-pg.nix
@@ -11,13 +11,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "h3-pg";
-  version = "4.2.2";
+  version = "4.2.3";
 
   src = fetchFromGitHub {
     owner = "zachasme";
     repo = "h3-pg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2xp9gssPMTroLT/1Me0VWvtIPyouIk9MW0Rp13uYBEw=";
+    hash = "sha256-kTh0Y0C2pNB5Ul1rp77ets/5VeU1zw1WasGHkOaDMh8=";
   };
 
   postPatch =
diff --git a/pkgs/shells/carapace/default.nix b/pkgs/shells/carapace/default.nix
index e95c6a36b45d..96830ccfcb1d 100644
--- a/pkgs/shells/carapace/default.nix
+++ b/pkgs/shells/carapace/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DgWC3IsuHncJzVfWxIGWDxknTAdHJEijvjhO7q14EYQ=";
+    hash = "sha256-dVM5XFFNXAVoN2xshq5k0Y6vSrfSNS0bIptcloX/uSg=";
   };
 
-  vendorHash = "sha256-oq1hZ2P093zsI+UAGHi5XfRXqGGxWpR5j7x7N7ng3xE=";
+  vendorHash = "sha256-XRbqxL2ANWi2aZbB30tNBxJoBIoDoMxKXMpOx++JJ6M=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/package-management/librepo/default.nix b/pkgs/tools/package-management/librepo/default.nix
index 30d45bb5ba57..399f8b31168c 100644
--- a/pkgs/tools/package-management/librepo/default.nix
+++ b/pkgs/tools/package-management/librepo/default.nix
@@ -17,8 +17,8 @@
   doxygen,
 }:
 
-stdenv.mkDerivation rec {
-  version = "1.19.0";
+stdenv.mkDerivation (finalAttrs: {
+  version = "1.20.0";
   pname = "librepo";
 
   outputs = [
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = "librepo";
-    rev = version;
-    sha256 = "sha256-ws57vFoK5yBMHHNQ9W48Icp4am0/5k3n4ybem1aAzVM=";
+    tag = finalAttrs.version;
+    hash = "sha256-KYBHImdGQgf/IZ5FMhzrbBTeZF76AIP3RjVPT3w0oT8=";
   };
 
   nativeBuildInputs = [
@@ -67,11 +67,12 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Library providing C and Python (libcURL like) API for downloading linux repository metadata and packages";
     homepage = "https://rpm-software-management.github.io/librepo/";
-    license = licenses.lgpl2Plus;
-    platforms = platforms.linux;
+    changelog = "https://github.com/rpm-software-management/dnf5/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.lgpl2Plus;
+    platforms = lib.platforms.linux;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ea05dc632d41..1e3a0cf11f95 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3821,7 +3821,7 @@ with pkgs;
   };
 
   # Not in aliases because it wouldn't get picked up by callPackage
-  netbox = netbox_4_2;
+  netbox = netbox_4_3;
 
   netcap-nodpi = callPackage ../by-name/ne/netcap/package.nix {
     withDpi = false;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 45d0287268fe..46f71ff43fa0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16950,12 +16950,12 @@ with self;
     };
   };
 
-  ImagePNGLibpng = buildPerlPackage {
+  ImagePNGLibpng = buildPerlPackage rec {
     pname = "Image-PNG-Libpng";
-    version = "0.57";
+    version = "0.59";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BK/BKB/Image-PNG-Libpng-0.56.tar.gz";
-      hash = "sha256-+vu/6/9CP3u4XvJ6MEH7YpG1AzbHpYIiSlysQzHDx9k=";
+      url = "mirror://cpan/authors/id/B/BK/BKB/Image-PNG-Libpng-${version}.tar.gz";
+      hash = "sha256-4fn19YqM6YhwUp9WgIQfsz4wQnLzn6rtXC95Kc5vWNc=";
     };
     buildInputs = [ pkgs.libpng ];
     meta = {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7c327b248ad7..a17766a683ad 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10284,6 +10284,8 @@ self: super: with self; {
 
   nominal-api-protos = callPackage ../development/python-modules/nominal-api-protos { };
 
+  nominatim-api = callPackage ../by-name/no/nominatim/nominatim-api.nix { };
+
   nonbloat-db = callPackage ../development/python-modules/nonbloat-db { };
 
   noneprompt = callPackage ../development/python-modules/noneprompt { };