diff --git a/ci/github-script/commits.js b/ci/github-script/commits.js
index d382f0949d36..e5553c59ce7f 100644
--- a/ci/github-script/commits.js
+++ b/ci/github-script/commits.js
@@ -220,14 +220,9 @@ module.exports = async function ({ github, context, core, dry }) {
         }
 
         core.summary.addRaw('<details><summary>Show diff</summary>')
-        core.summary.addCodeBlock(
-          truncated
-            .join('\n')
-            .replace(/&/g, '&amp;')
-            .replace(/</g, '&lt;')
-            .replace(/>/g, '&gt;'),
-          'diff',
-        )
+        core.summary.addRaw('\n\n``````````diff', true)
+        core.summary.addRaw(truncated.join('\n'), true)
+        core.summary.addRaw('``````````', true)
         core.summary.addRaw('</details>')
       }
 
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 1d63a51ce567..588eff3b51b5 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -36,6 +36,8 @@
 
 - [Chhoto URL](https://github.com/SinTan1729/chhoto-url), a simple, blazingly fast, selfhosted URL shortener with no unnecessary features, written in Rust. Available as [services.chhoto-url](#opt-services.chhoto-url.enable).
 
+- [tuwunel](https://matrix-construct.github.io/tuwunel/), a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as [services.matrix-tuwunel](#opt-services.matrix-tuwunel.enable).
+
 - [Broadcast Box](https://github.com/Glimesh/broadcast-box), a WebRTC broadcast server. Available as [services.broadcast-box](options.html#opt-services.broadcast-box.enable).
 
 - Docker now defaults to 28.x, because version 27.x stopped receiving security updates and bug fixes after [May 2, 2025](https://github.com/moby/moby/pull/49910).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e2e04222383f..45b0b5c1fd7c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -781,6 +781,7 @@
   ./services/matrix/pantalaimon.nix
   ./services/matrix/synapse-auto-compressor.nix
   ./services/matrix/synapse.nix
+  ./services/matrix/tuwunel.nix
   ./services/misc/airsonic.nix
   ./services/misc/amazon-ssm-agent.nix
   ./services/misc/ananicy.nix
diff --git a/nixos/modules/services/matrix/tuwunel.nix b/nixos/modules/services/matrix/tuwunel.nix
new file mode 100644
index 000000000000..b3a66017734c
--- /dev/null
+++ b/nixos/modules/services/matrix/tuwunel.nix
@@ -0,0 +1,268 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.matrix-tuwunel;
+  defaultUser = "tuwunel";
+  defaultGroup = "tuwunel";
+
+  format = pkgs.formats.toml { };
+  configFile = format.generate "tuwunel.toml" cfg.settings;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    scvalex
+  ];
+  options.services.matrix-tuwunel = {
+    enable = lib.mkEnableOption "tuwunel";
+
+    package = lib.mkPackageOption pkgs "matrix-tuwunel" { };
+
+    user = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      description = ''
+        The user {command}`tuwunel` is run as.  If left as the default, the user will
+        automatically be created by the service.
+      '';
+      example = "conduit";
+      default = defaultUser;
+    };
+
+    group = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      description = ''
+        The group {command}`tuwunel` is run as.  If left as the default, the group will
+        automatically be created by the service.
+      '';
+      example = "conduit";
+      default = defaultGroup;
+    };
+
+    stateDirectory = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = "tuwunel";
+      example = "matrix-conduit";
+      description = ''
+        The name of the directory under /var/lib/ where the database will be stored.
+
+        Note that `stateDirectory` cannot be changed once created because of the service's reliance on
+        systemd `StateDirectory`.
+      '';
+    };
+
+    extraEnvironment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      description = "Extra Environment variables to pass to the tuwunel server.";
+      default = { };
+      example = {
+        RUST_BACKTRACE = "yes";
+      };
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          global.server_name = lib.mkOption {
+            type = lib.types.nonEmptyStr;
+            example = "example.com";
+            description = "The server_name is the name of this server. It is used as a suffix for user and room ids.";
+          };
+          global.address = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.nonEmptyStr);
+            default = null;
+            example = [
+              "127.0.0.1"
+              "::1"
+            ];
+            description = ''
+              Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator.
+              If set to `null`, tuwunel will listen on IPv4 and IPv6 localhost.
+              Must be `null` if `unix_socket_path` is set.
+            '';
+          };
+          global.port = lib.mkOption {
+            type = lib.types.listOf lib.types.port;
+            default = [ 6167 ];
+            description = ''
+              The port(s) tuwunel will be running on.
+              You need to set up a reverse proxy in your web server (e.g. apache or nginx),
+              so all requests to /_matrix on port 443 and 8448 will be forwarded to the tuwunel
+              instance running on this port.
+            '';
+          };
+          global.unix_socket_path = lib.mkOption {
+            type = lib.types.nullOr lib.types.path;
+            default = null;
+            description = ''
+              Listen on a UNIX socket at the specified path. If listening on a UNIX socket,
+              listening on an address will be disabled. The `address` option must be set to
+              `null` (the default value). The option {option}`services.tuwunel.group` must
+              be set to a group your reverse proxy is part of.
+            '';
+          };
+          global.unix_socket_perms = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 660;
+            description = "The default permissions (in octal) to create the UNIX socket with.";
+          };
+          global.max_request_size = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 20000000;
+            description = "Max request size in bytes. Don't forget to also change it in the proxy.";
+          };
+          global.allow_registration = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Whether new users can register on this server.
+
+              Registration with token requires `registration_token` or `registration_token_file` to be set.
+
+              If set to true without a token configured, and
+              `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
+              is set to true, users can freely register.
+            '';
+          };
+          global.allow_encryption = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
+          };
+          global.allow_federation = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = ''
+              Whether this server federates with other servers.
+            '';
+          };
+          global.trusted_servers = lib.mkOption {
+            type = lib.types.listOf lib.types.nonEmptyStr;
+            default = [ "matrix.org" ];
+            description = ''
+              Servers listed here will be used to gather public keys of other servers
+              (notary trusted key servers).
+
+              Currently, tuwunel doesn't support inbound batched key requests, so
+              this list should only contain other Synapse servers.
+
+              Example: `[ "matrix.org" "constellatory.net" "tchncs.de" ]`
+            '';
+          };
+        };
+      };
+      default = { };
+      # TOML does not allow null values, so we use null to omit those fields
+      apply = lib.filterAttrsRecursive (_: v: v != null);
+      description = ''
+        Generates the tuwunel.toml configuration file. Refer to
+        <https://matrix-construct.github.io/tuwunel/configuration.html>
+        for details on supported values.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? global.unix_socket_path) || !(cfg.settings ? global.address);
+        message = ''
+          In `services.matrix-tuwunel.settings.global`, `unix_socket_path` and `address` cannot be set at the
+          same time.
+          Leave one of the two options unset or explicitly set them to `null`.
+        '';
+      }
+      {
+        assertion = cfg.user != defaultUser -> config ? users.users.${cfg.user};
+        message = "If `services.matrix-tuwunel.user` is changed, the configured user must already exist.";
+      }
+      {
+        assertion = cfg.group != defaultGroup -> config ? users.groups.${cfg.group};
+        message = "If `services.matrix-tuwunel.group` is changed, the configured group must already exist.";
+      }
+      {
+        assertion = "/var/lib/${cfg.settings.global.database_path}" != cfg.stateDirectory;
+        message = "The `services.matrix-tuwunel.stateDirectory` and `services.matrix-tuwunel.settings.global.database_path` options must match.";
+      }
+    ];
+
+    users.users = lib.mkIf (cfg.user == defaultUser) {
+      ${defaultUser} = {
+        group = cfg.group;
+        home = cfg.settings.global.database_path;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == defaultGroup) {
+      ${defaultGroup} = { };
+    };
+
+    services.matrix-tuwunel.settings.global.database_path = "/var/lib/${cfg.stateDirectory}/";
+
+    systemd.services.tuwunel = {
+      description = "Tuwunel Matrix Server";
+      documentation = [ "https://matrix-construct.github.io/tuwunel/" ];
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      environment = lib.mkMerge [
+        { TUWUNEL_CONFIG = configFile; }
+        cfg.extraEnvironment
+      ];
+      startLimitBurst = 5;
+      startLimitIntervalSec = 60;
+      serviceConfig = {
+        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
+
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        PrivateIPC = true;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service @resources"
+          "~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc"
+        ];
+        SystemCallErrorNumber = "EPERM";
+
+        StateDirectory = cfg.stateDirectory;
+        StateDirectoryMode = "0700";
+        RuntimeDirectory = "tuwunel";
+        RuntimeDirectoryMode = "0750";
+
+        ExecStart = lib.getExe cfg.package;
+        Restart = "on-failure";
+        RestartSec = 10;
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 07ddbf27b7d8..166dbbdca2e5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -865,6 +865,7 @@ in
   matrix-continuwuity = runTest ./matrix/continuwuity.nix;
   matrix-synapse = runTest ./matrix/synapse.nix;
   matrix-synapse-workers = runTest ./matrix/synapse-workers.nix;
+  matrix-tuwunel = runTest ./matrix/tuwunel.nix;
   mautrix-discord = runTest ./matrix/mautrix-discord.nix;
   mattermost = handleTest ./mattermost { };
   mautrix-meta-postgres = runTest ./matrix/mautrix-meta-postgres.nix;
diff --git a/nixos/tests/matrix/tuwunel.nix b/nixos/tests/matrix/tuwunel.nix
new file mode 100644
index 000000000000..b3d4e0105cf5
--- /dev/null
+++ b/nixos/tests/matrix/tuwunel.nix
@@ -0,0 +1,135 @@
+{ lib, pkgs, ... }:
+let
+  name = "tuwunel";
+in
+{
+  inherit name;
+
+  nodes = {
+    # Host1 is a fresh install of tuwunel
+    host1 = {
+      services.matrix-tuwunel = {
+        enable = true;
+        settings.global = {
+          server_name = name;
+          address = [ "0.0.0.0" ];
+          allow_registration = true;
+          yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true;
+        };
+        extraEnvironment.RUST_BACKTRACE = "yes";
+      };
+      networking.firewall.allowedTCPPorts = [ 6167 ];
+    };
+
+    # Host2 was upgraded from the matrix-conduit service
+    host2 = {
+      users.users.conduit = {
+        group = "conduit";
+        home = "/var/lib/matrix-conduit";
+        isSystemUser = true;
+      };
+      users.groups.conduit = { };
+      services.matrix-tuwunel = {
+        enable = true;
+        user = "conduit";
+        group = "conduit";
+        stateDirectory = "matrix-conduit";
+        settings.global = {
+          server_name = name;
+          address = [ "0.0.0.0" ];
+          allow_registration = true;
+          yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true;
+        };
+        extraEnvironment.RUST_BACKTRACE = "yes";
+      };
+      networking.firewall.allowedTCPPorts = [ 6167 ];
+    };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
+            import asyncio
+            import nio
+            import sys
+
+
+            async def main(host) -> None:
+                # Connect to server
+                client = nio.AsyncClient(f"http://{host}:6167", "alice")
+
+                # Register as user alice
+                response = await client.register("alice", "my-secret-password")
+
+                # Log in as user alice
+                response = await client.login("my-secret-password")
+
+                # Create a new room
+                response = await client.room_create(federate=False)
+                print("Matrix room create response:", response)
+                assert isinstance(response, nio.RoomCreateResponse)
+                room_id = response.room_id
+
+                # Join the room
+                response = await client.join(room_id)
+                print("Matrix join response:", response)
+                assert isinstance(response, nio.JoinResponse)
+
+                # Send a message to the room
+                response = await client.room_send(
+                    room_id=room_id,
+                    message_type="m.room.message",
+                    content={
+                        "msgtype": "m.text",
+                        "body": "Hello matrix!"
+                    }
+                )
+                print("Matrix room send response:", response)
+                assert isinstance(response, nio.RoomSendResponse)
+
+                # Sync responses
+                response = await client.sync(timeout=30000)
+                print("Matrix sync response:", response)
+                assert isinstance(response, nio.SyncResponse)
+
+                # Check the message was received by server
+                last_message = response.rooms.join[room_id].timeline.events[-1].body
+                assert last_message == "Hello matrix!"
+
+                # Leave the room
+                response = await client.room_leave(room_id)
+                print("Matrix room leave response:", response)
+                assert isinstance(response, nio.RoomLeaveResponse)
+
+                # Close the client
+                await client.close()
+
+
+            if __name__ == "__main__":
+                asyncio.run(main(sys.argv[1]))
+          '')
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("start tuwunel on host1"):
+          host1.wait_for_unit("tuwunel.service")
+          host1.wait_for_open_port(6167)
+
+    with subtest("start tuwunel on host2"):
+          host1.wait_for_unit("tuwunel.service")
+          host1.wait_for_open_port(6167)
+
+    with subtest("ensure messages can be sent to servers"):
+          client.succeed("do_test host1 >&2")
+          client.succeed("do_test host2 >&2")
+  '';
+
+  meta.maintainers = with lib.maintainers; [
+    scvalex
+  ];
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 4c90de6ff853..8d2d915d60e5 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1478,8 +1478,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.24.3";
-          hash = "sha256-OfkZdF5Qz3VketCIjWuwd08EI7e/II9c7G4a3O2mW+s=";
+          version = "2.26.3";
+          hash = "sha256-0kcRegl+TIjAoK3+AwxO07TJ7h64F1eIPAauav2z4vI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -4696,8 +4696,8 @@ let
         mktplcRef = {
           name = "tabnine-vscode";
           publisher = "tabnine";
-          version = "3.296.0";
-          hash = "sha256-LQzVo7NKJvjQ/eUOzXtDEDCSnSIjACPgZFwp87qG/JM=";
+          version = "3.297.0";
+          hash = "sha256-K5XRBefGWG3BGyBCK0QIpZ6Jjm+qNjVEyMucCGs+LKs=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 95333e42627e..03f6d547b6a0 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "140.0.2-1",
+  "packageVersion": "140.0.4-1",
   "source": {
-    "rev": "140.0.2-1",
-    "hash": "sha256-xCKZgnPAoY5y5NmM0/qSeLRvB5ZirnPyxxoNnYA4ZRs="
+    "rev": "140.0.4-1",
+    "hash": "sha256-/7Ynt0mKEu/ms9B5J3xfh6I5nnmdz8xI/7bm9uURE7M="
   },
   "firefox": {
-    "version": "140.0.2",
-    "hash": "sha512-EdMpXIKDVmj0OoiL1araIiSHduAzrsx1WDSObuJmJr9LZbuq4mgPcoWmsrYgnsXUrqRT8eBgNUTNSL9FxzWy6g=="
+    "version": "140.0.4",
+    "hash": "sha512-PefAhxuKRWg/XCJvs+keWX6Pie8VSyCLKlfE0+qfOctcaey9Xso7baaNN3VojSKJwTYMfREMZ7sb4c8m74zzbQ=="
   }
 }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 4cb5f16f744a..ef08f2993c22 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -931,13 +931,13 @@
     "vendorHash": null
   },
   "okta": {
-    "hash": "sha256-JbhL4QP+c8TtTyaUcsmiOESNdKFLml/4H+Ar8VbA/O8=",
+    "hash": "sha256-Up75XRwe7bnns+ahHtQfK7IG2gptDKNIY8pWG5QcjVI=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v5.0.0",
+    "rev": "v5.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-PoANgzaVtd59xBjt02L6bV7Vi6gyT2XgGuWOm8rr+Ng="
+    "vendorHash": "sha256-7zB+ZdrisV+C2kbDWHCaR4uNV3TZAh4EAQcT4jdJpQs="
   },
   "oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",
@@ -1237,13 +1237,13 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "sops": {
-    "hash": "sha256-VuQTJFI4KcSnaog9VTV+zBg0XAORvWzuCFYMB0BM6n4=",
+    "hash": "sha256-SBg46q9kggwXR142MpzwM5R4L2WfM07aJkGSLngAcFk=",
     "homepage": "https://registry.terraform.io/providers/carlpett/sops",
     "owner": "carlpett",
     "repo": "terraform-provider-sops",
-    "rev": "v1.2.0",
+    "rev": "v1.2.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-K/44Jio2a1kKYuyI6o/5wwMNRaZvx9zrNEC85v56xdU="
+    "vendorHash": "sha256-4gtM8U//RXpYc4klCgpZS/3ZRzAHfcbOPTnNqlX4H7M="
   },
   "spacelift": {
     "hash": "sha256-lBt1ZtQ5pxX/t4b264LzQwajXDozE9veYOOV3lhfTZQ=",
@@ -1327,13 +1327,13 @@
     "vendorHash": "sha256-V0dK5G3zheyyqexBud+9Hg9ExYI/9X1wuYx+lEn6pVg="
   },
   "temporalcloud": {
-    "hash": "sha256-nm7YQNoVTy53GpXIu2gQhIblvZMIdCyDcXK9aCL+Xfg=",
+    "hash": "sha256-FTvTp2Mf8uz0e+y7AprAxgMEllGJFbWiPCzDZ8jzdrc=",
     "homepage": "https://registry.terraform.io/providers/temporalio/temporalcloud",
     "owner": "temporalio",
     "repo": "terraform-provider-temporalcloud",
-    "rev": "v0.8.0",
+    "rev": "v0.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Sqi4MLQTF5n3AZyEkaI03KhFvgy34ROqbd8Rx1N6/oY="
+    "vendorHash": "sha256-PVN3oPT3cxsnWH03twbPSIIERGHCp3XAmcqrQAOULZ4="
   },
   "tencentcloud": {
     "hash": "sha256-MMmBhzhD5SPvTJPzuxAPEmE2ydcwVH4cYAx21ze/umk=",
@@ -1345,13 +1345,13 @@
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-O8QNI4lUsw+lY5MThGVR7hwci3XvjvjSN/bzhh9c3mc=",
+    "hash": "sha256-gT5KOJZJG8cZs1Dcn31bfKLC8zvkG62tn4sZuH9ieGk=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.67.1",
+    "rev": "v0.68.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-fw92xhRF60f3QRLBtSvdSwOtXY4QzgJlwb6zgi0OGjw="
+    "vendorHash": "sha256-tf78FT9JD5IVswgDB3Yug1NZQvo8NDqjPEAfF3gg93w="
   },
   "thunder": {
     "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",
@@ -1508,12 +1508,12 @@
     "vendorHash": "sha256-GRnVhGpVgFI83Lg34Zv1xgV5Kp8ioKTFV5uaqS80ATg="
   },
   "yandex": {
-    "hash": "sha256-egxwRkS+RvI6XmEQjugpNg1OSAn63RBw7NHXSJBZ0Q4=",
+    "hash": "sha256-W67wzWkbSaoRbntJhlErhQ5lOIyJdoIZFJUsBnzLP5o=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.145.0",
+    "rev": "v0.146.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-myp9DZQqU7Gf6FHySoPhU3k/JBFMyOjc05nhMigk+fA="
+    "vendorHash": "sha256-DXZi6ncn/X4sx2i8xM7ItxGCuRwLi391LLJ7NlZkxFg="
   }
 }
diff --git a/pkgs/applications/science/electronics/kicad/libraries.nix b/pkgs/applications/science/electronics/kicad/libraries.nix
index 2073b2bd7c16..e26b73c4f04c 100644
--- a/pkgs/applications/science/electronics/kicad/libraries.nix
+++ b/pkgs/applications/science/electronics/kicad/libraries.nix
@@ -24,9 +24,13 @@ let
           zip
         ];
 
-      postInstall = lib.optional (name == "packages3d") ''
-        find $out -type f -name '*.step' | parallel 'stepreduce {} {} && zip -9 {.}.stpZ {} && rm {}'
-      '';
+      postInstall =
+        lib.optionalString (name == "packages3d") ''
+          find $out -type f -name '*.step' | parallel 'stepreduce {} {} && zip -9 {.}.stpZ {} && rm {}'
+        ''
+        + lib.optionalString (name == "footprints") ''
+          grep -rl '\.step' $out | xargs sed -i 's/\.step/.stpZ/g'
+        '';
 
       meta = {
         license = lib.licenses.cc-by-sa-40;
diff --git a/pkgs/applications/science/electronics/openems/default.nix b/pkgs/applications/science/electronics/openems/default.nix
index f251bd34c54b..b286c9234afb 100644
--- a/pkgs/applications/science/electronics/openems/default.nix
+++ b/pkgs/applications/science/electronics/openems/default.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Open Source Electromagnetic Field Solver";
-    homepage = "http://openems.de/index.php/Main_Page.html";
+    homepage = "https://wiki.openems.de/index.php/Main_Page.html";
     license = licenses.gpl3;
     maintainers = with maintainers; [ matthuszagh ];
     platforms = platforms.linux;
diff --git a/pkgs/build-support/fetchsavannah/default.nix b/pkgs/build-support/fetchsavannah/default.nix
index a9d172382b8a..475f2bdb4fd1 100644
--- a/pkgs/build-support/fetchsavannah/default.nix
+++ b/pkgs/build-support/fetchsavannah/default.nix
@@ -19,9 +19,9 @@ lib.makeOverridable (
         let
           repo' = lib.last (lib.strings.splitString "/" repo); # support repo like emacs/elpa
         in
-        "https://git.savannah.gnu.org/cgit/${repo}.git/snapshot/${repo'}-${rev}.tar.gz";
-      meta.homepage = "https://git.savannah.gnu.org/cgit/${repo}.git/";
-      passthru.gitRepoUrl = "https://git.savannah.gnu.org/git/${repo}.git";
+        "https://cgit.git.savannah.gnu.org/cgit/${repo}.git/snapshot/${repo'}-${rev}.tar.gz";
+      meta.homepage = "https://cgit.git.savannah.gnu.org/cgit/${repo}.git/";
+      passthru.gitRepoUrl = "https://cgit.git.savannah.gnu.org/git/${repo}.git";
     }
     // removeAttrs args [
       "repo"
diff --git a/pkgs/by-name/ar/argon/package.nix b/pkgs/by-name/ar/argon/package.nix
index 9807338b4d88..6b7dcd90abb4 100644
--- a/pkgs/by-name/ar/argon/package.nix
+++ b/pkgs/by-name/ar/argon/package.nix
@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "argon";
-  version = "2.0.24";
+  version = "2.0.25";
 
   src = fetchFromGitHub {
     owner = "argon-rbx";
     repo = "argon";
     tag = version;
-    hash = "sha256-2E9vyXTLCqW5zzCal9FjmV3LvLymjfUbzwZJB77FilU=";
+    hash = "sha256-nQdh263qFS3seazdoNxme7SxQ7aJsRmFdoyfsZMDjw0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-j9aSnyc65CeBdgoFevdn1xpJHs4xWMhFDoRiPizceTI=";
+  cargoHash = "sha256-s3/i7RnwadgGBg0lZmttxpLC/hZUba+PGc8WD30aAQI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ar/ariang/package.nix b/pkgs/by-name/ar/ariang/package.nix
index 6636ab31cf36..2197cba1b747 100644
--- a/pkgs/by-name/ar/ariang/package.nix
+++ b/pkgs/by-name/ar/ariang/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "ariang";
-  version = "1.3.10";
+  version = "1.3.11";
 
   src = fetchFromGitHub {
     owner = "mayswind";
     repo = "AriaNg";
     rev = version;
-    hash = "sha256-YABoDBPrxII0uw4Cyy1A4AcLQ3Uo28dJa/F4LTI7f5Y=";
+    hash = "sha256-TisgE5VFOe/1LbDq43AHASMVhC85BglETYFcvsQpwMw=";
   };
 
-  npmDepsHash = "sha256-cNTkdrJuXMhcBbbCYJ9Xs639T0QWUbhRABD2gQ2cfjM=";
+  npmDepsHash = "sha256-wWy9XxwZvUo89kgxApHd3qZ2Bb4NgifQ96WRDsZvTGU=";
 
   makeCacheWritable = true;
 
diff --git a/pkgs/by-name/br/brev-cli/package.nix b/pkgs/by-name/br/brev-cli/package.nix
index 4d8317550801..474f2266a878 100644
--- a/pkgs/by-name/br/brev-cli/package.nix
+++ b/pkgs/by-name/br/brev-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.310";
+  version = "0.6.311";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = "brev-cli";
     rev = "v${version}";
-    sha256 = "sha256-dZY87iUPr1NYZNERAzuxX/en0fgefekpXAi5Um1nTBc=";
+    sha256 = "sha256-XKXIDnqAmWUDiwjvNV/mmGyxkScuz3YJ2DpMcRhwLKU=";
   };
 
   vendorHash = "sha256-7MXZVdpsPHfHk8hNZM2CT0FW8gTKt3oUap7CTVYMNfI=";
diff --git a/pkgs/by-name/ca/cargo-nextest/package.nix b/pkgs/by-name/ca/cargo-nextest/package.nix
index b51e26c09c96..a7e01af2dbf3 100644
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.100";
+  version = "0.9.101";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-MbgX/n6TC5hz66gvRAc7A0xFWbF2Ec68gMxCgPFpeoQ=";
+    hash = "sha256-yaRwHQopkkZ8gLEhuJuzAiY/enWNdL3B+POGV2ykOWA=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-jRBFjJB38JI9whFpImYlMx0znQj1+cdeu4Nc+nYc7OI=";
+  cargoHash = "sha256-F26/IDq3/Il6BBCkKUy59T47sI20DAabeSjt3Kdqu+Y=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ca/cargo-update/package.nix b/pkgs/by-name/ca/cargo-update/package.nix
index 292dcfe5057c..6414969caeb0 100644
--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@@ -16,15 +16,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-update";
-  version = "16.3.2";
+  version = "16.4.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-VKXEbgm3Oc4rq/F2p/kuhhhiyKvLU6KHnKnQMBX17XU=";
+    hash = "sha256-Y0TvzOjkq/9/NG87iGhazLSZFnFCEG/S+lI4AJDAw0M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-AXYcDxKQ9p4deolcZFO5SmfwnQGxl1I03RK6tSTbjlo=";
+  cargoHash = "sha256-PD6HycP6+/tKafirCc2Oj0MffHizLqTmDIrdIOmXY/w=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/by-name/cr/credhub-cli/package.nix b/pkgs/by-name/cr/credhub-cli/package.nix
index 6d65de57c564..3ca85166f9db 100644
--- a/pkgs/by-name/cr/credhub-cli/package.nix
+++ b/pkgs/by-name/cr/credhub-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.47";
+  version = "2.9.48";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-3/CYwgdGOFkiGNsWrIGbHGK/iSJxz6KRneTdaJT6i24=";
+    sha256 = "sha256-jZmnun7EkCWiWq8i+9cgn/2ffxt9VbVf0DxYHKgwNqg=";
   };
 
   # these tests require network access that we're not going to give them
diff --git a/pkgs/by-name/di/direnv/package.nix b/pkgs/by-name/di/direnv/package.nix
index 79b3ab7bcd0b..35cb71b6477a 100644
--- a/pkgs/by-name/di/direnv/package.nix
+++ b/pkgs/by-name/di/direnv/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "direnv";
-  version = "2.37.0";
+  version = "2.37.1";
 
   src = fetchFromGitHub {
     owner = "direnv";
     repo = "direnv";
     rev = "v${version}";
-    hash = "sha256-wMv2ZzAc3GhUhvSnHgxJKPFmEjhujff9/CozYcgKfbk=";
+    hash = "sha256-92xjoCjH5O7wx8U7OFG8Lw9eDOAdeVKNvxBHW+TiniM=";
   };
 
   vendorHash = "sha256-SAIGFQGACTB3Q0KnIdiKKNYY6fVjf/09wGqNr0Hkg+M=";
diff --git a/pkgs/by-name/do/docker-language-server/package.nix b/pkgs/by-name/do/docker-language-server/package.nix
index 0df41d46708e..b8e6f88bca78 100644
--- a/pkgs/by-name/do/docker-language-server/package.nix
+++ b/pkgs/by-name/do/docker-language-server/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "docker-language-server";
-  version = "0.12.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker-language-server";
     tag = "v${version}";
-    hash = "sha256-cMHWdSMPo38Nuvx/K187PJ4tp6F1Fqs73+sIOrAk8Jo=";
+    hash = "sha256-ht63NilujpbDhBjkzCNpY95AAuwqya37qchgqKLlTw8=";
   };
 
-  vendorHash = "sha256-yb/GdwgEwv6ybb1CkBivCC6WKc/DX9FXxz+7WLr3scw=";
+  vendorHash = "sha256-w7CDl27178oe/DpfqSbNbyOsR3D34EpcCMZNQ7i3JE4=";
 
   nativeCheckInputs = [
     docker
diff --git a/pkgs/by-name/ec/ecs-agent/package.nix b/pkgs/by-name/ec/ecs-agent/package.nix
index c94e84423236..55f41773cfaf 100644
--- a/pkgs/by-name/ec/ecs-agent/package.nix
+++ b/pkgs/by-name/ec/ecs-agent/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.95.0";
+  version = "1.96.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = "amazon-ecs-agent";
-    hash = "sha256-HJrio/Hr2ms33g9NM1sytLaig6D1ixYp1W16AE7OlGo=";
+    hash = "sha256-jKqGKSPjHQvRKAxqB81u/i7LeIV8IeiCF9O5dSmebQQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/fa/fake-gcs-server/package.nix b/pkgs/by-name/fa/fake-gcs-server/package.nix
index b0fdb2b1547f..5f5f0db8825a 100644
--- a/pkgs/by-name/fa/fake-gcs-server/package.nix
+++ b/pkgs/by-name/fa/fake-gcs-server/package.nix
@@ -5,14 +5,14 @@
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "fake-gcs-server";
   version = "1.52.2";
 
   src = fetchFromGitHub {
     owner = "fsouza";
     repo = "fake-gcs-server";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-sidMCbJAK3bRGJyyFIUn7e5y0z4O72JWCICHf4JL4yo=";
   };
 
@@ -34,4 +34,4 @@ buildGoModule rec {
     mainProgram = "fake-gcs-server";
     maintainers = with lib.maintainers; [ jpetrucciani ];
   };
-}
+})
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index d2a1b0b3767f..89d20c32e5af 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.15.44";
+  version = "2.15.51";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-+5fGCHRjBbPgX2CdNyBS+cOXJYLK/HPwca0Gg+ZVEx0=";
+    hash = "sha256-BvBbC/okSti4rL886+P6Kh8vAwI1TN688oyrgTch9e8=";
   };
 
-  vendorHash = "sha256-ofI/aaikK2O02XswK5WgDTCgnwDyfq0eR17WWJsOqH8=";
+  vendorHash = "sha256-dCujq1drJ8wgzo7hV4kJ8k5EXzXu3k6Oc6TuOLRsqrY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fr/frankenphp/package.nix b/pkgs/by-name/fr/frankenphp/package.nix
index de5032273ab7..3fd73b786855 100644
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "frankenphp";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "dunglas";
     repo = "frankenphp";
     tag = "v${version}";
-    hash = "sha256-mwS4Y0XBIlAI2UogvlI6DK+oIrqSx8sqnyN+rb0kLjQ=";
+    hash = "sha256-fa9IWIypPAXRDw5KsiJkNGaRP4lH50xb4PVWYa5guwE=";
   };
 
   sourceRoot = "${src.name}/caddy";
@@ -45,7 +45,7 @@ buildGoModule rec {
   # frankenphp requires C code that would be removed with `go mod tidy`
   # https://github.com/golang/go/issues/26366
   proxyVendor = true;
-  vendorHash = "sha256-N5/ytcXhHJlVzV6cyweCRG3HYHeQl3VXlM/9u4L+ThU=";
+  vendorHash = "sha256-vmOlqPhU5sKwRYgZQ0LVE1eMWEtSLTduAeRLEm7gLcI=";
 
   buildInputs = [
     phpUnwrapped
diff --git a/pkgs/by-name/fw/fwup/package.nix b/pkgs/by-name/fw/fwup/package.nix
index 9c4688f119c7..6fd8851f285e 100644
--- a/pkgs/by-name/fw/fwup/package.nix
+++ b/pkgs/by-name/fw/fwup/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fwup";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "fhunleth";
     repo = "fwup";
     rev = "v${version}";
-    sha256 = "sha256-j/UuJf7tDY1ku2vfmh2f8fQVZS7dhmiH6T1zS8IlcDE=";
+    sha256 = "sha256-lf8NCF+K47V55pUC4uNzCh5D454OQl5VruGfC6X5mJw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/he/heptabase/package.nix b/pkgs/by-name/he/heptabase/package.nix
index be965878512d..eb907cd64468 100644
--- a/pkgs/by-name/he/heptabase/package.nix
+++ b/pkgs/by-name/he/heptabase/package.nix
@@ -5,10 +5,10 @@
 }:
 let
   pname = "heptabase";
-  version = "1.61.0";
+  version = "1.64.0";
   src = fetchurl {
     url = "https://github.com/heptameta/project-meta/releases/download/v${version}/Heptabase-${version}.AppImage";
-    hash = "sha256-dvVLygj0saCod6sD6kcFhYO5IWz2iblywL6QNZPVYmk=";
+    hash = "sha256-VBoQgSVpEshmGjEGzSe1sG8nDcrl8nJ+m7+s/7LlAMg=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index 039d6c1489d6..297daadf741b 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-07-11";
+  version = "0-unstable-2025-07-18";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "392ddb642abec771d63688c49fa7bcbb9d2a5717";
-    hash = "sha256-A4nftqiNz2bNihz0bKY94Hq/6ydR6UQOcGioeL7iymY=";
+    rev = "d0300c8808e41da81d6edfc202f3d3833c157daf";
+    hash = "sha256-irfg7lnfEpJY+3Cffkluzp2MTVw1Uq9QGxFp6qadcXI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hydroxide/package.nix b/pkgs/by-name/hy/hydroxide/package.nix
index e9f98021c0dd..226198d7de63 100644
--- a/pkgs/by-name/hy/hydroxide/package.nix
+++ b/pkgs/by-name/hy/hydroxide/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "hydroxide";
-  version = "0.2.29";
+  version = "0.2.30";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "hydroxide";
     rev = "v${version}";
-    sha256 = "sha256-VAbMcON75dTS+1lUqmveN2WruQCCmK3kB86e+vKM64U=";
+    sha256 = "sha256-PjT8kIS2k4e9Xuw6uCXiCtg5Rawvcmslzz9Qa4Wnroo=";
   };
 
-  vendorHash = "sha256-JaYJq8lnZHK75Rwif77A9y9jTUoJFyoSZQgaExnY+rM=";
+  vendorHash = "sha256-NKWUpyS5IHBTPzjfTkov/ypoGQW6inX32Y7lpdIDOUc=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/im/improv-setup/package.nix b/pkgs/by-name/im/improv-setup/package.nix
new file mode 100644
index 000000000000..9e0948754846
--- /dev/null
+++ b/pkgs/by-name/im/improv-setup/package.nix
@@ -0,0 +1,30 @@
+{
+  fetchFromGitea,
+  lib,
+  nix-update-script,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "improv-setup";
+  version = "1.0.0";
+
+  src = fetchFromGitea {
+    domain = "git.clerie.de";
+    owner = "clerie";
+    repo = "improv-setup";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3vF8StD2qk3S87Rw7hphmIW2udlFK9e4YQfHF12yFwI=";
+  };
+
+  cargoHash = "sha256-H2X1hpynOIZOHBx8nZz09Yr4zk/7Ikn6TNhx3cCmOuA=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Configure Wifi credentials on IOT devices using Improv serial protocol";
+    homepage = "https://git.clerie.de/clerie/improv-setup/";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fooker ];
+  };
+})
diff --git a/pkgs/by-name/ka/kazam/package.nix b/pkgs/by-name/ka/kazam/package.nix
index 4936d8305a91..46263afb0a8e 100644
--- a/pkgs/by-name/ka/kazam/package.nix
+++ b/pkgs/by-name/ka/kazam/package.nix
@@ -16,16 +16,16 @@
   libgudev,
 }:
 
-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication rec {
   pname = "kazam";
-  version = "unstable-2021-06-22";
-  format = "pyproject";
+  version = "1.5.5-unstable-2025-01-02";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "niknah";
     repo = "kazam";
-    rev = "13f6ce124e5234348f56358b9134a87121f3438c";
-    sha256 = "1jk6khwgdv3nmagdgp5ivz3156pl0ljhf7b6i4b52w1h5ywsg9ah";
+    rev = "b6c1bddc9ac93aad50476f2c87fec9f0cf204f2a";
+    hash = "sha256-xllpNoKeSXVWZhzlY60ZDnWIKoAW+cd08Tb1413Ldpk=";
   };
 
   nativeBuildInputs = [
@@ -51,6 +51,7 @@ python3Packages.buildPythonApplication {
   ];
 
   dependencies = with python3Packages; [
+    distro
     pygobject3
     pyxdg
     pycairo
@@ -71,11 +72,12 @@ python3Packages.buildPythonApplication {
 
   pythonImportsCheck = [ "kazam" ];
 
-  meta = with lib; {
+  meta = {
     description = "Screencasting program created with design in mind";
     homepage = "https://github.com/niknah/kazam";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
+    changelog = "https://github.com/niknah/kazam/raw/${src.rev}/NEWS";
+    license = lib.licenses.lgpl3;
+    platforms = lib.platforms.linux;
     maintainers = [ ];
     mainProgram = "kazam";
   };
diff --git a/pkgs/by-name/li/libvgm/package.nix b/pkgs/by-name/li/libvgm/package.nix
index 6c95a800020e..746175ac375d 100644
--- a/pkgs/by-name/li/libvgm/package.nix
+++ b/pkgs/by-name/li/libvgm/package.nix
@@ -38,13 +38,13 @@ assert enableTools -> enableAudio && enableEmulation && enableLibplayer;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libvgm";
-  version = "0-unstable-2025-05-30";
+  version = "0-unstable-2025-07-14";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "82ba45d3906a0b54b6de2555468dd9e9598f617d";
-    hash = "sha256-+EMI8hGDE+oiOK4pHRfDJxmGAZ3SBecNhCoPhS95NAk=";
+    rev = "7cad78367fa35c3f7b3ae16a296d31063cd3a7e4";
+    hash = "sha256-8Hnr9VeVkrvRe1mwCUBGhSwYYYXxbby+aQU+KBrSyRM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/lo/lock/package.nix b/pkgs/by-name/lo/lock/package.nix
index 7a127bed79a2..31a853a85ce8 100644
--- a/pkgs/by-name/lo/lock/package.nix
+++ b/pkgs/by-name/lo/lock/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lock";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "konstantintutsch";
     repo = "Lock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SomQYgc3F7w5DB0+j4peYTLSdHsrg9fw3h15gU3DTKU=";
+    hash = "sha256-JAtQxmcLFNj6epk3ipVaa/u7fQ4E2maHZN+7jk+ktmE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ls/lsh/package.nix b/pkgs/by-name/ls/lsh/package.nix
index f0e0b37075bd..06e000e54e6e 100644
--- a/pkgs/by-name/ls/lsh/package.nix
+++ b/pkgs/by-name/ls/lsh/package.nix
@@ -5,12 +5,12 @@
 }:
 buildGoModule rec {
   pname = "lsh";
-  version = "1.4.0";
+  version = "1.4.2";
   src = fetchFromGitHub {
     owner = "latitudesh";
     repo = "lsh";
     rev = "v${version}";
-    sha256 = "sha256-yYjCxH92GyFl4Gf4hH97E3EiMQ6WvWIItVI4U54JdaM=";
+    sha256 = "sha256-TV3ix1W/+rUXgeoVYneAfosa6ikf7e3giwsX4gyp2o0=";
   };
   vendorHash = "sha256-ogdyzfayleka4Y8x74ZtttD7MaeCl1qP/rQi9x0tMto=";
   subPackages = [ "." ];
diff --git a/pkgs/by-name/ma/matrix-tuwunel/package.nix b/pkgs/by-name/ma/matrix-tuwunel/package.nix
new file mode 100644
index 000000000000..2ec0dbb26a2f
--- /dev/null
+++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix
@@ -0,0 +1,168 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  bzip2,
+  zstd,
+  stdenv,
+  rocksdb,
+  nix-update-script,
+  testers,
+  matrix-tuwunel,
+  enableBlurhashing ? true,
+  # upstream tuwunel enables jemalloc by default, so we follow suit
+  enableJemalloc ? true,
+  rust-jemalloc-sys,
+  enableLiburing ? stdenv.hostPlatform.isLinux,
+  liburing,
+  nixosTests,
+}:
+let
+  rust-jemalloc-sys' = rust-jemalloc-sys.override {
+    unprefixed = !stdenv.hostPlatform.isDarwin;
+  };
+  # tuwunel uses a modified version of rocksdb.  The following overrides take a lot from the
+  # official flake:
+  # https://github.com/matrix-construct/tuwunel/blob/main/flake.nix#L54
+  rocksdb' =
+    (rocksdb.override {
+      inherit enableLiburing;
+      # rocksdb does not support prefixed jemalloc, which is required on darwin
+      enableJemalloc = enableJemalloc && !stdenv.hostPlatform.isDarwin;
+      jemalloc = rust-jemalloc-sys';
+    }).overrideAttrs
+      (
+        final: old: {
+          src = fetchFromGitHub {
+            owner = "matrix-construct";
+            repo = "rocksdb";
+            # The commit on the rocksdb fork, tuwunel-changes branch referenced by the upstream
+            # tuwunel flake.lock:
+            # https://github.com/matrix-construct/tuwunel/blob/main/flake.lock#L557C17-L557C57
+            rev = "cf7f65d0b377af019661c240f9165b3ef60640c3";
+            hash = "sha256-ZSjvAZBfZkJrBIpw8ANZMbJVb8AeuogvuAipGVE4Qe4=";
+          };
+          version = "tuwunel-changes";
+          patches = [ ];
+          postPatch = "";
+          cmakeFlags =
+            lib.subtractLists [
+              # no real reason to have snappy or zlib, no one uses this
+              "-DWITH_SNAPPY=1"
+              "-DZLIB=1"
+              "-DWITH_ZLIB=1"
+              # we dont need to use ldb or sst_dump (core_tools)
+              "-DWITH_CORE_TOOLS=1"
+              # we dont need to build rocksdb tests
+              "-DWITH_TESTS=1"
+              # we use rust-rocksdb via C interface and dont need C++ RTTI
+              "-DUSE_RTTI=1"
+              # this doesn't exist in RocksDB, and USE_SSE is deprecated for
+              # PORTABLE=$(march)
+              "-DFORCE_SSE42=1"
+              # PORTABLE will get set in main/default.nix
+              "-DPORTABLE=1"
+            ] old.cmakeFlags
+            ++ [
+              # no real reason to have snappy, no one uses this
+              "-DWITH_SNAPPY=0"
+              "-DZLIB=0"
+              "-DWITH_ZLIB=0"
+              # we dont need to use ldb or sst_dump (core_tools)
+              "-DWITH_CORE_TOOLS=0"
+              # we dont need trace tools
+              "-DWITH_TRACE_TOOLS=0"
+              # we dont need to build rocksdb tests
+              "-DWITH_TESTS=0"
+              # we use rust-rocksdb via C interface and dont need C++ RTTI
+              "-DUSE_RTTI=0"
+            ];
+          outputs = [ "out" ];
+          preInstall = "";
+        }
+      );
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "matrix-tuwunel";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "matrix-construct";
+    repo = "tuwunel";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YiZuCdSs3f4Hlfdzhz/B/u8GLf8VPgaLN8KMPLjFoVk=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-y3JXG/5a9x/KM1PxGW1qmpCeRFvWXWHHplCi+MdjhQ8=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs =
+    [
+      bzip2
+      zstd
+    ]
+    ++ lib.optional enableJemalloc rust-jemalloc-sys'
+    ++ lib.optional enableLiburing liburing;
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+    ROCKSDB_INCLUDE_DIR = "${rocksdb'}/include";
+    ROCKSDB_LIB_DIR = "${rocksdb'}/lib";
+  };
+
+  buildNoDefaultFeatures = true;
+  # See https://github.com/matrix-construct/tuwunel/blob/main/src/main/Cargo.toml
+  # for available features.
+  # We enable all default features except jemalloc, blurhashing, and io_uring, which
+  # we guard behind our own (default-enabled) flags.
+  buildFeatures =
+    [
+      "brotli_compression"
+      "direct_tls"
+      "element_hacks"
+      "gzip_compression"
+      "media_thumbnail"
+      "release_max_log_level"
+      "systemd"
+      "url_preview"
+      "zstd_compression"
+    ]
+    ++ lib.optional enableBlurhashing "blurhashing"
+    ++ lib.optional enableJemalloc [
+      "jemalloc"
+      "jemalloc_conf"
+    ]
+    ++ lib.optional enableLiburing "io_uring";
+
+  passthru = {
+    rocksdb = rocksdb'; # make used rocksdb version available (e.g., for backup scripts)
+    updateScript = nix-update-script { };
+    tests =
+      {
+        version = testers.testVersion {
+          inherit (finalAttrs) version;
+          package = matrix-tuwunel;
+        };
+      }
+      // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+        inherit (nixosTests) matrix-tuwunel;
+      };
+  };
+
+  meta = {
+    description = "Matrix homeserver written in Rust, official successor to conduwuit";
+    homepage = "https://github.com/matrix-construct/tuwunel";
+    changelog = "https://github.com/matrix-construct/tuwunel/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      scvalex
+    ];
+    mainProgram = "tuwunel";
+  };
+})
diff --git a/pkgs/by-name/mc/mcp-k8s-go/package.nix b/pkgs/by-name/mc/mcp-k8s-go/package.nix
index 7ed04e6da1a4..3ee42b813767 100644
--- a/pkgs/by-name/mc/mcp-k8s-go/package.nix
+++ b/pkgs/by-name/mc/mcp-k8s-go/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-k8s-go";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "strowk";
     repo = "mcp-k8s-go";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-13FwrG/eqR9bVrQ3CAIY7cFyj+EScWABnKIBo7Pm1w8=";
+    hash = "sha256-4pS0X1G/wGemBkLC9UFLHxaRLtCDALIRPnOCzAf/6JA=";
   };
 
   vendorHash = "sha256-BPmocRaqqV7p5Yjto3UEbzc2vdlyRSGkdPye3EWXEe4=";
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index d0199b2955ab..092a5a93820d 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -21,17 +21,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.7.4";
+  version = "2025.7.17";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-l1Bce0CFhR5cyBnlNGy4KM8aqVntGkzRsi+Qh6KODQk=";
+    hash = "sha256-lyj5ksasgeQhjsYI+LD5UhXQQHjCviphcMdjEW/AQmM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ujZ6iPwsIlAFCfkZbGLqgLjvJMZE+ehKRw10NnwS7jE=";
+  cargoHash = "sha256-So6ZYIkwxxh8cYaLGyA1LMoRU00jXda/R/fdYN55oVg=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/na/nak/package.nix b/pkgs/by-name/na/nak/package.nix
index 6b1928f580a3..9d5af4fe435f 100644
--- a/pkgs/by-name/na/nak/package.nix
+++ b/pkgs/by-name/na/nak/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nak";
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     owner = "fiatjaf";
     repo = "nak";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0x9fMcB8voV9MFX+XxkXgrb2WdnQONPyLQgG1bJwu2Q=";
+    hash = "sha256-pYSD6pVp4WRbRzv/voiHpgPKbC9J+PLJGGx6hH813FQ=";
   };
 
-  vendorHash = "sha256-5W7uqHT9iP5NbE3EFiFBSdjsINIWv5lIkz3K6yMcgrM=";
+  vendorHash = "sha256-Xoi0sepupJK3pT0egbXRYQkPgwc0G2Xgwiz71Tqj8T4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 02e72c095745..d9a1c2c535d3 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.429";
+  version = "0.0.431";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-O/GS//bEEkqg0Wu2I4pyEPB/lURtfMB0vjam7Uk/mNA=";
+    hash = "sha256-huMJCStwmvPkvAEp0FnC3B4z9KqSRMWUd3KJ61WNREE=";
   };
 
-  vendorHash = "sha256-5cZy89dJbekxba7BTxKtJkicRPUsl4PyLiNZnG564U4=";
+  vendorHash = "sha256-/JFiCflhJsu8Tkkw0Pqj0iOauVXXLaNuPRK524YVN98=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/oe/oelint-adv/package.nix b/pkgs/by-name/oe/oelint-adv/package.nix
index 233316aaf7e8..b21067ed3726 100644
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "oelint-adv";
-  version = "8.1.2";
+  version = "8.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-adv";
     tag = version;
-    hash = "sha256-ucQGXb2dqXQhf2m8TcUPQznfwBrtK7zc6DSajF/GQxU=";
+    hash = "sha256-Ld8PwAWKH1BQTvmIev5e6ZI1xOaaopunKJkTgAFUipI=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/oi/oidc-agent/package.nix b/pkgs/by-name/oi/oidc-agent/package.nix
index 9647f65903cc..6d5ab0b030fa 100644
--- a/pkgs/by-name/oi/oidc-agent/package.nix
+++ b/pkgs/by-name/oi/oidc-agent/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oidc-agent";
-  version = "5.2.3";
+  version = "5.3.2";
 
   src = fetchFromGitHub {
     owner = "indigo-dc";
     repo = "oidc-agent";
     rev = "v${version}";
-    hash = "sha256-Vj/YoZpbiV8psU70i3SIKJM/qPQYuy96ogEhT8cG7RU=";
+    hash = "sha256-G2E6/mMP8d9s6JsIlFwMQ8sm4FCF8Gm8OqrsTPjPUrA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/parlay/package.nix b/pkgs/by-name/pa/parlay/package.nix
index 5f5be4bcef49..f209d51a0c05 100644
--- a/pkgs/by-name/pa/parlay/package.nix
+++ b/pkgs/by-name/pa/parlay/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "parlay";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "snyk";
     repo = "parlay";
     rev = "v${version}";
-    hash = "sha256-i7g0l+Q4VpBINK/HgIsl3wuxT2YoSqK08AJRxeVEzyo=";
+    hash = "sha256-56N8eVsNvaK1gCJWk7h+C0w5DbBaDHH1DpIqmflc2e4=";
   };
 
   vendorHash = "sha256-X/cgNdsUG0Ics/DCk1HOdzez9Ewwm1odFL1EiyFv1Sw=";
diff --git a/pkgs/by-name/pg/pg_activity/package.nix b/pkgs/by-name/pg/pg_activity/package.nix
index 6905a0398bd8..19b6431ce9a7 100644
--- a/pkgs/by-name/pg/pg_activity/package.nix
+++ b/pkgs/by-name/pg/pg_activity/package.nix
@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pg_activity";
-  version = "3.6.0";
+  version = "3.6.1";
   pyproject = true;
   disabled = python3Packages.pythonOlder "3.8";
 
@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
     owner = "dalibo";
     repo = "pg_activity";
     tag = "v${version}";
-    sha256 = "sha256-7nHtJl/b2pZqiJbpWArMS5jh7B8dv8V1esic6uFPV/0=";
+    sha256 = "sha256-TzY+3RE06TxIrhl75wol9CvZDIz25GfgOx11vkREw2c=";
   };
 
   build-system = with python3Packages; [ setuptools ];
diff --git a/pkgs/by-name/ph/phrase-cli/package.nix b/pkgs/by-name/ph/phrase-cli/package.nix
index a897337093a6..49a89e42e19b 100644
--- a/pkgs/by-name/ph/phrase-cli/package.nix
+++ b/pkgs/by-name/ph/phrase-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "phrase-cli";
-  version = "2.42.2";
+  version = "2.43.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = version;
-    sha256 = "sha256-63mlrUmXb0MjQvobghXj63cmSgKPMrtNuoqORCDQPsU=";
+    sha256 = "sha256-myG+V7piegEvjqLYeGg8Q3YgcNeLSZmB+5qwUhZRUik=";
   };
 
-  vendorHash = "sha256-zVIxBZ2zTXk407piA4dXxKfyD7Ke8RIq7lYogr/+rcs=";
+  vendorHash = "sha256-ycjpZBa/6yYChQh+gHrq0V76GR38TnEU73QKJQBlr5o=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${version}" ];
 
diff --git a/pkgs/by-name/qq/qq/sources.nix b/pkgs/by-name/qq/qq/sources.nix
index 275ea446d939..63ad3012a9dd 100644
--- a/pkgs/by-name/qq/qq/sources.nix
+++ b/pkgs/by-name/qq/qq/sources.nix
@@ -1,12 +1,12 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-06-28
+# Last updated: 2025-07-18
 { fetchurl }:
 let
   any-darwin = {
-    version = "6.9.75-2025.6.26";
+    version = "6.9.75-2025-07-10";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.75_250626_01.dmg";
-      hash = "sha256-tWT0R88tXz0ypPQTDzASrh4znvBvq/ohBhpeDv2PlVc=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.75_250710_01.dmg";
+      hash = "sha256-ejplu4I5PRBdwMrgDZ51WS+qN1GKc5qHqMToIvgR6og=";
     };
   };
 in
@@ -14,17 +14,17 @@ in
   aarch64-darwin = any-darwin;
   x86_64-darwin = any-darwin;
   aarch64-linux = {
-    version = "3.2.18-2025.6.26";
+    version = "3.2.18-2025-07-10";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250626_arm64_01.deb";
-      hash = "sha256-7teJWRvvz5baJsaHmOwnkLgBcBxWOUCGpV2+MHH7Tic=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250710_arm64_01.deb";
+      hash = "sha256-37HEXpLyeIjgXsAonNjS3YaIwk4It2LDy6Yj4lqK94Q=";
     };
   };
   x86_64-linux = {
-    version = "3.2.18-2025.6.26";
+    version = "3.2.18-2025-07-10";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250626_amd64_01.deb";
-      hash = "sha256-xEw6tE+qX90XQS3e2MTudeUJNfx25hwgq1YFROHqfng=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.18_250710_amd64_01.deb";
+      hash = "sha256-P023rIalPAgBXZqJvnCgEHqTumWm+dhaUefzuR/4aoU=";
     };
   };
 }
diff --git a/pkgs/by-name/qq/qq/update.sh b/pkgs/by-name/qq/qq/update.sh
index 334f6e9443b8..ecc1c769d0dd 100755
--- a/pkgs/by-name/qq/qq/update.sh
+++ b/pkgs/by-name/qq/qq/update.sh
@@ -7,8 +7,7 @@ cd $(readlink -e $(dirname "${BASH_SOURCE[0]}"))
 
 # darwin
 
-darwin_url=$(curl -s https://im.qq.com/macqq/index.shtml | grep -oP 'var rainbowConfigUrl = "\K.*(?=";)')
-darwin_payload=$(curl "$darwin_url" | grep -oP "var params= \K\{.*\}(?=;)")
+darwin_payload=$(curl https://cdn-go.cn/qq-web/im.qq.com_new/latest/rainbow/macOSConfig.js | grep -oP "var params= \K\{.*\}(?=;)")
 darwin_version=$(jq -r .version <<< "$darwin_payload" | awk -F\  '{print $1}')-$(jq -r .updateDate <<< "$darwin_payload")
 
 darwin_url=$(jq -r .downloadUrl <<< "$darwin_payload")
@@ -20,8 +19,7 @@ darwin_hash=$(nix --extra-experimental-features nix-command hash convert --to sr
 
 # linux
 
-linux_url=$(curl -s https://im.qq.com/linuxqq/index.shtml | grep -oP 'var rainbowConfigUrl = "\K.*(?=";)')
-linux_payload=$(curl "$linux_url" | grep -oP "var params= \K\{.*\}(?=;)")
+linux_payload=$(curl https://cdn-go.cn/qq-web/im.qq.com_new/latest/rainbow/linuxConfig.js | grep -oP "var params= \K\{.*\}(?=;)")
 linux_version=$(jq -r .version <<< "$linux_payload")-$(jq -r .updateDate <<< "$linux_payload")
 
 linux_aarch64_url=$(jq -r .armDownloadUrl.deb <<< "$linux_payload")
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index d7135170aeb6..e7ce53f8eba7 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,19 +16,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.12.3";
+  version = "0.12.4";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-KvTRoiySjLhm5jmYqXZAehRAzkB9CufyNisXkuagOv8=";
+    hash = "sha256-XuHVKxzXYlm3iEhdAVCyd62uNyb3jeJRl3B0hnvUzX0=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-5fK5VQ+UqkHmPdFz3FKAY9TVjvpePiYifrTHsxnkThM=";
+  cargoHash = "sha256-cyjaGI7JoreAmHtUrRKNyiCaE8zveP/dFJROC2iIXr4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ru/rustical/package.nix b/pkgs/by-name/ru/rustical/package.nix
index 8c492caf2331..40f3f31400d1 100644
--- a/pkgs/by-name/ru/rustical/package.nix
+++ b/pkgs/by-name/ru/rustical/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustical";
-  version = "0.4.11";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "lennart-k";
     repo = "rustical";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QWuJKEc6hBA2rdbaqdhrah+WyRwVd91Y8/BIOaKlW28=";
+    hash = "sha256-0QpzJt5Jz1s4Ax9p4AyCwkrqi0HGf65VPbYy17WdYh8=";
   };
 
-  cargoHash = "sha256-dQF+6my+TxZ6niFO5OnLXcPt0LGEymaXE9NqZWU5HJk=";
+  cargoHash = "sha256-Iylek8vY4lvKRQ/4LTalg0WMgopnvNKO7splZDrSjHE=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/si/simplex-chat-desktop/package.nix b/pkgs/by-name/si/simplex-chat-desktop/package.nix
index f93e8a5daacd..f84a48f97409 100644
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@@ -11,7 +11,7 @@ let
 
   src = fetchurl {
     url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-    hash = "sha256-QTq2hBuFfuCvQ9EDcSW5M7bpkBvhYjYXCkKaRqLyblg=";
+    hash = "sha256-DxOq0pimXxvXDi65Hryp7Fv++M6a+V1qYyDSSEgttQs=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/sl/slipshow/package.nix b/pkgs/by-name/sl/slipshow/package.nix
index 4e27e5f73f0f..36ca128938e4 100644
--- a/pkgs/by-name/sl/slipshow/package.nix
+++ b/pkgs/by-name/sl/slipshow/package.nix
@@ -8,13 +8,13 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "slipshow";
-  version = "0.2.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "panglesd";
     repo = "slipshow";
     tag = "v${version}";
-    hash = "sha256-1gjQDkjDxanshvn1fNxwpJFt12uRWnkmRbs0tWdTgtM=";
+    hash = "sha256-VUKh3O2FYsA8gUJQT0LxTV9psp/neYfYEmQS9cgeFW8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/sq/sqlite3-to-mysql/package.nix b/pkgs/by-name/sq/sqlite3-to-mysql/package.nix
index f4993d52c1b5..02633ab531b4 100644
--- a/pkgs/by-name/sq/sqlite3-to-mysql/package.nix
+++ b/pkgs/by-name/sq/sqlite3-to-mysql/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "sqlite3-to-mysql";
-  version = "2.4.0";
+  version = "2.4.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "techouse";
     repo = "sqlite3-to-mysql";
     tag = "v${version}";
-    hash = "sha256-1XYDCHR1GitMr6wgpj+roCzf5q4tMr6eGLMWzZgzpBY=";
+    hash = "sha256-sX70CmNt4mhZSyzh1x/FEovMpjiJMLFIfxgVIS9CuMY=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/su/subxt/package.nix b/pkgs/by-name/su/subxt/package.nix
index 7383d2c9e095..49f1036f1314 100644
--- a/pkgs/by-name/su/subxt/package.nix
+++ b/pkgs/by-name/su/subxt/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "subxt";
-  version = "0.42.1";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "subxt";
     rev = "v${version}";
-    hash = "sha256-wp6gxIpo5MyODB/Gf6oh62iK/VmwjVaJkuysrytHKf4=";
+    hash = "sha256-BV/zP0L0gDmLSuzkp4OkOPfgldXBUiaHL4rciM7lrno=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1jat45mCpivEnKCp/9BfsW4ZXi0HF9PeAvK5gw5+enw=";
+  cargoHash = "sha256-7kmxnlhgNj0hY9FwVrzmdHw73Jf/pSeTHi6sqDg9X24=";
 
   # Only build the command line client
   cargoBuildFlags = [
diff --git a/pkgs/by-name/sv/svtplay-dl/package.nix b/pkgs/by-name/sv/svtplay-dl/package.nix
index 0936ff04a2dd..52fa963efd0b 100644
--- a/pkgs/by-name/sv/svtplay-dl/package.nix
+++ b/pkgs/by-name/sv/svtplay-dl/package.nix
@@ -22,7 +22,7 @@ let
     requests-mock
     ;
 
-  version = "4.127";
+  version = "4.131";
 
 in
 
@@ -35,7 +35,7 @@ buildPythonApplication {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    hash = "sha256-p+Ncd5J0DEuoU+h2ouPNi0s0XQcGpYXb5n7x0nj1NJ8=";
+    hash = "sha256-ZW30KI0R7bn4iESlhsYz1D2LQ4PDg7HBqW4wP1XO8gs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/by-name/te/testkube/package.nix b/pkgs/by-name/te/testkube/package.nix
index 16ea31b15dc4..9a616b7f0fba 100644
--- a/pkgs/by-name/te/testkube/package.nix
+++ b/pkgs/by-name/te/testkube/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "testkube";
-  version = "2.1.162";
+  version = "2.1.163";
 
   src = fetchFromGitHub {
     owner = "kubeshop";
     repo = "testkube";
     rev = "v${version}";
-    hash = "sha256-zLq+lytTwNXLiJPnWP+fb7j5dEXF4OuZ8B9ucN+26/I=";
+    hash = "sha256-g9m3Uyrc8dXeDm5mjmWhcSrlVAqP0/4OCvuZQwW6Pf8=";
   };
 
-  vendorHash = "sha256-m1w8z0d02/NzGkWULAMy9Ktd3rULgiQ8f6eUP/t97Lo=";
+  vendorHash = "sha256-i7GjhW9w6TEHg+PBVsQ8bOuToejiPpuOcSbXO5ffAMs=";
 
   ldflags = [
     "-X main.version=${version}"
diff --git a/pkgs/by-name/tl/tldx/package.nix b/pkgs/by-name/tl/tldx/package.nix
index 4e52c3492d4e..861066eef2c0 100644
--- a/pkgs/by-name/tl/tldx/package.nix
+++ b/pkgs/by-name/tl/tldx/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tldx";
-  version = "1.2.4";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "brandonyoungdev";
     repo = "tldx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-inX/27nzju1ns6fKF3iFmgYOd8KpI/cLX+UM8LjeOVw=";
+    hash = "sha256-JdVngzH6Md7LPV5m8p+C8CW/JRdXlEX19C9+oMTEtDY=";
   };
 
-  vendorHash = "sha256-gNU1YcvRXOvPsniZKE+XEQ7YaJTc5qjTRgCrnNMjfXw=";
+  vendorHash = "sha256-Dzeo4ZvbKUow8IF5Lal1GK7sT71IEBPDitYCvNaK4aI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ty/tygo/package.nix b/pkgs/by-name/ty/tygo/package.nix
index 533737f67456..c1e0773f2bfe 100644
--- a/pkgs/by-name/ty/tygo/package.nix
+++ b/pkgs/by-name/ty/tygo/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "tygo";
-  version = "0.2.18";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "gzuidhof";
     repo = "tygo";
     rev = "v${version}";
-    hash = "sha256-W2PgBcbkreP61QtAuOZ+VHUUZ4Mhe++1SK1p4Tg4Ack=";
+    hash = "sha256-Eyvvqk8D9q8rOODR72kJSg+g7cVjx3FJCPmSog6eP1E=";
   };
 
   vendorHash = "sha256-E73yqGhPzZA/1xTYGvTBy0/b4SE9hzx+gdhjX3ClE/Y=";
diff --git a/pkgs/by-name/v2/v2rayn/deps.json b/pkgs/by-name/v2/v2rayn/deps.json
index ff1266cf0fd2..5b3bb4ce1e3b 100644
--- a/pkgs/by-name/v2/v2rayn/deps.json
+++ b/pkgs/by-name/v2/v2rayn/deps.json
@@ -11,8 +11,8 @@
   },
   {
     "pname": "Avalonia",
-    "version": "11.3.1",
-    "hash": "sha256-732wl4/JmvYFS26NLvPD7T/V3J3JZUDy6Xwj5p1TNyE="
+    "version": "11.3.2",
+    "hash": "sha256-eDptsmrO7QxIvHm5kCs9ZE/N1tAuIBvaJMKiAcsu9yk="
   },
   {
     "pname": "Avalonia.Angle.Windows.Natives",
@@ -31,38 +31,38 @@
   },
   {
     "pname": "Avalonia.Controls.ColorPicker",
-    "version": "11.3.1",
-    "hash": "sha256-95sAkALievpuwLtCl7+6PgwNyxx9DAi/vVvQUFT7Qqs="
+    "version": "11.3.2",
+    "hash": "sha256-Lr943SkpYMZz3+TPA7vc/mtbQH0r/eLewZFNGNf3i2M="
   },
   {
     "pname": "Avalonia.Controls.DataGrid",
-    "version": "11.3.1",
-    "hash": "sha256-UcfsSNYCd9zO75hyLevVe59/esHgNmcjJOproy3nhNM="
+    "version": "11.3.2",
+    "hash": "sha256-PFz2fgrBzXQWPLj9X1wdDKDH2iy/54E4NBa+yO7DTfQ="
   },
   {
     "pname": "Avalonia.Desktop",
-    "version": "11.3.1",
-    "hash": "sha256-H6SLCi3by9bFF1YR12PnNZSmtC44UQPKr+5+8LvqC90="
+    "version": "11.3.2",
+    "hash": "sha256-A3LV30ekjXWdo/pRldL4S68AAA6BTuLU8ZGCinkNrvk="
   },
   {
     "pname": "Avalonia.Diagnostics",
-    "version": "11.3.1",
-    "hash": "sha256-zDX3BfqUFUQ+p1ZWdHuhnV0n5B9RfiEtB8m0Px5AhsI="
+    "version": "11.3.2",
+    "hash": "sha256-fMXY9p16o/wpUXFjRngf96gVwSlX/WCY0fn3nE/TmIY="
   },
   {
     "pname": "Avalonia.FreeDesktop",
-    "version": "11.3.1",
-    "hash": "sha256-Iph1SQazNNr9liox0LR7ITidAEEWhp8Mg9Zn4MZVkRQ="
+    "version": "11.3.2",
+    "hash": "sha256-Mxvpd5JKmIpjQCZmuiSb6IkKfwQhA3o712Ubdx0gP28="
   },
   {
     "pname": "Avalonia.Native",
-    "version": "11.3.1",
-    "hash": "sha256-jNzqmHm58bbPGs/ogp6gFvinbN81Psg+sg+Z5UsbcDs="
+    "version": "11.3.2",
+    "hash": "sha256-HLVKaAVIRnm77lk7LJfrbiEmGWVIim7XMMoZAyGVUFA="
   },
   {
     "pname": "Avalonia.ReactiveUI",
-    "version": "11.3.1",
-    "hash": "sha256-m7AFSxwvfz9LAueu0AFC+C7jHrB+lysBmpBh7bhpmUs="
+    "version": "11.3.2",
+    "hash": "sha256-lYKhqoKqEZB4tttXehK5KoBMkwVeTxAThh87dns4C/c="
   },
   {
     "pname": "Avalonia.Remote.Protocol",
@@ -76,28 +76,28 @@
   },
   {
     "pname": "Avalonia.Remote.Protocol",
-    "version": "11.3.1",
-    "hash": "sha256-evkhJOxKjsR+jNLrXRcrhqjFdlrxYMMMRBJ6FK08vMM="
+    "version": "11.3.2",
+    "hash": "sha256-NIkrj4pMvxVvznexzEXmNI8KXWLSXmVbHHWpwz9h3M8="
   },
   {
     "pname": "Avalonia.Skia",
-    "version": "11.3.1",
-    "hash": "sha256-zN09CcuSqtLcQrTCQOoPJrhLd4LioZqt/Qi4sDp/cJI="
+    "version": "11.3.2",
+    "hash": "sha256-cBJo/tTewA2/LSygJ5aAyPPr11KpLPwS1I6kQxDMy24="
   },
   {
     "pname": "Avalonia.Themes.Simple",
-    "version": "11.3.1",
-    "hash": "sha256-U9btigJeFcuOu7T3ryyJJesffnZo1JBb9pWkF0PFu9s="
+    "version": "11.3.2",
+    "hash": "sha256-c8QtpXv+B1CTkW9ovxOZwjRZAkD4KZzIvhIhI5WJXdo="
   },
   {
     "pname": "Avalonia.Win32",
-    "version": "11.3.1",
-    "hash": "sha256-w3+8luJByeIchiVQ0wsq0olDabX/DndigyBEuK8Ty04="
+    "version": "11.3.2",
+    "hash": "sha256-FNs+O2knXcmUpfDjd/9JcNmpzEi8g3UQ3pQHItnN2U8="
   },
   {
     "pname": "Avalonia.X11",
-    "version": "11.3.1",
-    "hash": "sha256-0iUFrDM+10T3OiOeGSEiqQ6EzEucQL3shZUNqOiqkyQ="
+    "version": "11.3.2",
+    "hash": "sha256-OCH5bwJ7Zje0/L7qtDcFa+yje/uwm2pYNE169J866/I="
   },
   {
     "pname": "CliWrap",
@@ -116,8 +116,8 @@
   },
   {
     "pname": "DynamicData",
-    "version": "9.3.2",
-    "hash": "sha256-00fzA28aU48l52TsrDSJ9ucljYOunmH7s2qPyR3YjRA="
+    "version": "9.4.1",
+    "hash": "sha256-CX4NQj2LTk/8f4xDE5rUVBsqcY74H/1qUHFTrVX+9/0="
   },
   {
     "pname": "Fody",
@@ -176,8 +176,8 @@
   },
   {
     "pname": "NLog",
-    "version": "5.3.4",
-    "hash": "sha256-Cwr1Wu9VbOcRz3GdVKkt7lIpNwC1E4Hdb0g+qEkEr3k="
+    "version": "5.5.0",
+    "hash": "sha256-WkuKGo3iEqJruQuRZXMksqIbAQjZbFIANcm0zZr/fYE="
   },
   {
     "pname": "QRCoder",
@@ -186,8 +186,8 @@
   },
   {
     "pname": "ReactiveUI",
-    "version": "20.3.1",
-    "hash": "sha256-1eCZ5M+zkVmlPYuK1gBDCdyCGlYbXIfX+h6Vz0hu8e4="
+    "version": "20.4.1",
+    "hash": "sha256-YXd4A5akZ/dMOo9IalKPoNMGlBGxk60o3u6pGB4BCXY="
   },
   {
     "pname": "ReactiveUI.Fody",
@@ -196,13 +196,13 @@
   },
   {
     "pname": "Semi.Avalonia",
-    "version": "11.2.1.8",
-    "hash": "sha256-1P3hr634woqLtNrWOiJWzizwh0AMWt9Y7J1SXHIkv5M="
+    "version": "11.2.1.9",
+    "hash": "sha256-4NsQyk70xjD+V0X/0wuWhQshkadbBVs1iyRNEPmExkk="
   },
   {
     "pname": "Semi.Avalonia.DataGrid",
-    "version": "11.2.1.8",
-    "hash": "sha256-OKb+vlKSf9e0vL5mGNzSEr62k1Zy/mS4kXWGHZHcBq0="
+    "version": "11.2.1.9",
+    "hash": "sha256-6V1agOI1KcTXQN1+uab7tSZH1ZdJEQrVfxZ5ha1cvGI="
   },
   {
     "pname": "SkiaSharp",
@@ -249,10 +249,15 @@
     "version": "15.3.1",
     "hash": "sha256-1MlkqywOtLr5TbQ+zAqzw0l92LK9+9h2+sJgmfV32RU="
   },
+  {
+    "pname": "Splat",
+    "version": "15.4.1",
+    "hash": "sha256-qmp9aNmSSGQjrt9womxfC786nxeafH66okaBk0LXnhw="
+  },
   {
     "pname": "Splat.NLog",
-    "version": "15.3.1",
-    "hash": "sha256-u/8nSYE618HHNfJjyiQfuluWx83FDYW2RlorPjxRuxs="
+    "version": "15.4.1",
+    "hash": "sha256-CPgRSGmCtG9hFTFjd9r0Hwr0tO9MHpyttZ4NdKrWYyY="
   },
   {
     "pname": "sqlite-net-pcl",
@@ -316,8 +321,8 @@
   },
   {
     "pname": "TaskScheduler",
-    "version": "2.12.1",
-    "hash": "sha256-eM4vgA+/ukoXCX3y4Ad5WPeIPiwLLDfhh4P0ukWf4lQ="
+    "version": "2.12.2",
+    "hash": "sha256-05yC1ufzZrRQU8PxG1EvDsAh0aD8+f4Cg0eLLt0Ljdk="
   },
   {
     "pname": "Tmds.DBus.Protocol",
diff --git a/pkgs/by-name/v2/v2rayn/package.nix b/pkgs/by-name/v2/v2rayn/package.nix
index 5526d50f5268..dbdfab5cced9 100644
--- a/pkgs/by-name/v2/v2rayn/package.nix
+++ b/pkgs/by-name/v2/v2rayn/package.nix
@@ -21,13 +21,13 @@
 
 buildDotnetModule rec {
   pname = "v2rayn";
-  version = "7.12.7";
+  version = "7.13.1";
 
   src = fetchFromGitHub {
     owner = "2dust";
     repo = "v2rayN";
     tag = version;
-    hash = "sha256-pYkUbctdN3qaGxI5DbreoOGmXyIVrpHqYlN3BFRCcZ8=";
+    hash = "sha256-4lnMT6p32uHeLd85JNWEVg1LsDr99YVsgpxG2MdpYQ0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index b51a1cf70126..f369e7f6d1f4 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.17.5";
+  version = "0.17.6";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QBbpDV/hlzFgrmCsywH5CC43V2Rt0fwPkf6ZCgjqqUc=";
+    hash = "sha256-riTyTOx8SoyIaXtL2qbL7AZO2sPcCIi6DJ64OFMNAWE=";
   };
 
-  vendorHash = "sha256-AjmET86E/xu6DTK07kMySWp5Z8W1RE/QPSe2B/IfDl0=";
+  vendorHash = "sha256-f+frQCCk/9+9dilSt13yk4U3c7D/r5XAwlXznyMhqM4=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/by-name/va/vapoursynth-bestsource/package.nix b/pkgs/by-name/va/vapoursynth-bestsource/package.nix
index 965f7aa071a3..ef90fb7153d4 100644
--- a/pkgs/by-name/va/vapoursynth-bestsource/package.nix
+++ b/pkgs/by-name/va/vapoursynth-bestsource/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vapoursynth-bestsource";
-  version = "11";
+  version = "13";
 
   outputs = [
     "out"
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "vapoursynth";
     repo = "bestsource";
     tag = "R${finalAttrs.version}";
-    hash = "sha256-/hRjo7MQhm/ANUC38p9btOO5ek4Q6IaeKtcSbTzD3BQ=";
+    hash = "sha256-c+FMFWICDS8Plj6GE2vvhWPmf56Vk10j41HUK1q20/U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ve/versitygw/package.nix b/pkgs/by-name/ve/versitygw/package.nix
index c7c37b290350..cc404ffa0043 100644
--- a/pkgs/by-name/ve/versitygw/package.nix
+++ b/pkgs/by-name/ve/versitygw/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "versitygw";
-  version = "1.0.15";
+  version = "1.0.16";
 
   src = fetchFromGitHub {
     owner = "versity";
     repo = "versitygw";
     tag = "v${version}";
-    hash = "sha256-gRVUR1BlGVLS6+OZUvOVgoRNDiHrDSDu2L3iBwZ/zbg=";
+    hash = "sha256-MLM3pjcSV+4cpHcUP4m2YqadOEdwAnnk7IvaF9vXw48=";
   };
 
-  vendorHash = "sha256-7efskc/3bj8/8D5LgQnkC4TYib+73fpDyRKDDcFVRvA=";
+  vendorHash = "sha256-EV2GWfRvYHFosl2NjRkSu1acWKxcCd1I8gVvyXA4O1A=";
 
   doCheck = false; # Require access to online S3 services
 
diff --git a/pkgs/by-name/vs/vscode-solidity-server/package.nix b/pkgs/by-name/vs/vscode-solidity-server/package.nix
new file mode 100644
index 000000000000..d70eb8b90b97
--- /dev/null
+++ b/pkgs/by-name/vs/vscode-solidity-server/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  pkg-config,
+  libsecret,
+}:
+
+buildNpmPackage {
+  pname = "solidity-language-server";
+  version = "0.0.185";
+
+  src = fetchFromGitHub {
+    owner = "juanfranblanco";
+    repo = "vscode-solidity";
+    rev = "5198201a23874e79248e6b09558ca30e5bf5cdcf";
+    hash = "sha256-GHa2VbMyYn0FXEhd1my0851rbtoWtlOGmsAF6JDzLkc=";
+  };
+
+  npmDepsHash = "sha256-zXhWtPuiu+CRk712KskuHP4vglogJmFoCak6qWczPFM=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libsecret ];
+
+  npmBuildScript = "build:cli";
+
+  meta = {
+    description = "Language Server for solidity code";
+    homepage = "https://github.com/juanfranblanco/vscode-solidity";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ rookeur ];
+    mainProgram = "solidity-language-server";
+  };
+}
diff --git a/pkgs/by-name/wa/wakatime-cli/package.nix b/pkgs/by-name/wa/wakatime-cli/package.nix
index 6bb1e23f026d..d8d8ce3a40f2 100644
--- a/pkgs/by-name/wa/wakatime-cli/package.nix
+++ b/pkgs/by-name/wa/wakatime-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "wakatime-cli";
-  version = "1.115.6";
+  version = "1.118.0";
 
   src = fetchFromGitHub {
     owner = "wakatime";
     repo = "wakatime-cli";
     tag = "v${version}";
-    hash = "sha256-kLvYU+mu9vXD0mfgrvpMFeeLTJcp4NxY4Z3n0ks5RC4=";
+    hash = "sha256-f17dSfS+6jF1wsLEP5UdzYbqK6DVD5nflMpz8oQzZ+Q=";
   };
 
   vendorHash = "sha256-jyFUauK+CAuSv+dKUyVtuoTizeGkKnNquZLA96oq1BM=";
diff --git a/pkgs/by-name/wa/wavelog/package.nix b/pkgs/by-name/wa/wavelog/package.nix
index 33b4e2f3df96..780cb09832ea 100644
--- a/pkgs/by-name/wa/wavelog/package.nix
+++ b/pkgs/by-name/wa/wavelog/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "wavelog";
-  version = "2.0.5";
+  version = "2.0.7";
 
   src = fetchFromGitHub {
     owner = "wavelog";
     repo = "wavelog";
     tag = finalAttrs.version;
-    hash = "sha256-FFPg9VSyOeUPH0bV4fY3e7NKH9vW+JdIeYbAAzCEpiA=";
+    hash = "sha256-QgFxvaldTfuimEgRz2T3grllwLpznoHnOi66kXyMiGU=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/we/web-ext/package.nix b/pkgs/by-name/we/web-ext/package.nix
index 9066140c0940..c7dcf99954f1 100644
--- a/pkgs/by-name/we/web-ext/package.nix
+++ b/pkgs/by-name/we/web-ext/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "web-ext";
-  version = "8.8.0";
+  version = "8.9.0";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "web-ext";
     rev = version;
-    hash = "sha256-119LxYhTqzobcwJZ0DSawNUIVMWxWSQp/XtkGEK2L7k=";
+    hash = "sha256-hy/Jt9P0ROXC+00kFbB1Qh9kOPjSvAREXCPI4kpsDMM=";
   };
 
-  npmDepsHash = "sha256-Na0caulpTMMIvsXC04+x8GUWDCyX6f6vVNmlnN694BE=";
+  npmDepsHash = "sha256-4Raak0Jqahc9l48SUctFKT0M1m27X8VcLyC3eJJCX1I=";
 
   npmBuildFlags = [ "--production" ];
 
diff --git a/pkgs/by-name/wl/wlr-which-key/package.nix b/pkgs/by-name/wl/wlr-which-key/package.nix
index 77db14b541aa..bf737b8f4d67 100644
--- a/pkgs/by-name/wl/wlr-which-key/package.nix
+++ b/pkgs/by-name/wl/wlr-which-key/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wlr-which-key";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "MaxVerevkin";
     repo = "wlr-which-key";
     rev = "v${version}";
-    hash = "sha256-P7DtSTyAfgACEfpnxYXhQ+Rvdw4rg2hFllCN1mEGfJQ=";
+    hash = "sha256-2dVTN5aaXeGBUKhsuUyDfELyL4AcKoaPXD0gN7ydL/Y=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yH05tpJiEDP0qEhDY3dpf2cxYeJYVOvOQyfcgg2vPQk=";
+  cargoHash = "sha256-v+4/lD00rjJvrQ2NQqFusZc0zQbM9mBG5T9bNioNGKQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/xk/xk6/package.nix b/pkgs/by-name/xk/xk6/package.nix
index 50d1eb1e3a1b..a83507c16b6f 100644
--- a/pkgs/by-name/xk/xk6/package.nix
+++ b/pkgs/by-name/xk/xk6/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "xk6";
-  version = "1.0.1";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "xk6";
     tag = "v${version}";
-    hash = "sha256-uFW8TogMq0Uo0SXzO7V8xK4UCo+u6CTArIWIwz+kyZc=";
+    hash = "sha256-cypxnBQwVW4gdesRljlT8ATmgojOj5RxU+lScMTj5Ac=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/yo/youki/package.nix b/pkgs/by-name/yo/youki/package.nix
index 8c8d1994fc60..1fdbb3a88a93 100644
--- a/pkgs/by-name/yo/youki/package.nix
+++ b/pkgs/by-name/yo/youki/package.nix
@@ -13,13 +13,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "youki";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "youki";
     rev = "v${version}";
-    hash = "sha256-SFU7v5pefQkh751Ato4xkPqiEc/3++9hpwyNJjXwqMA=";
+    hash = "sha256-tWe5EPodO+slp+K7mn9UTVApNdiDRPMsOa9RfiT9qQw=";
   };
 
   nativeBuildInputs = [
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nRlvvr73glmpFsWb2Pi1icZl7d85/8iX2rHnNXv4ep8=";
+  cargoHash = "sha256-YM4D2DDXc9o4ak2DT36IeXpYykA/9R7PPqmIXkZ9aDs=";
 
   meta = {
     description = "Container runtime written in Rust";
diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index 513ca78f0a97..d66ce006fdb9 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -1,4 +1,5 @@
 {
+  config,
   lib,
   stdenv,
   makeWrapper,
@@ -21,7 +22,7 @@ let
   # some builds need that clarity.
   #
   ndkBuildInfoFun =
-    { config, ... }:
+    fallback:
     {
       x86_64-apple-darwin = {
         double = "darwin-x86_64";
@@ -30,10 +31,10 @@ let
         double = "linux-x86_64";
       };
     }
-    .${config} or (throw "Android NDK doesn't support building on ${config}, as far as we know");
+    .${stdenv.buildPlatform.config} or fallback;
 
   ndkTargetInfoFun =
-    { config, ... }:
+    fallback:
     {
       i686-unknown-linux-android = {
         triple = "i686-linux-android";
@@ -52,10 +53,14 @@ let
         triple = "aarch64-linux-android";
       };
     }
-    .${config} or (throw "Android NDK doesn't support targetting ${config}, as far as we know");
+    .${stdenv.targetPlatform.config} or fallback;
 
-  buildInfo = ndkBuildInfoFun stdenv.buildPlatform;
-  targetInfo = ndkTargetInfoFun stdenv.targetPlatform;
+  buildInfo = ndkBuildInfoFun (
+    throw "Android NDK doesn't support building on ${stdenv.buildPlatform.config}, as far as we know"
+  );
+  targetInfo = ndkTargetInfoFun (
+    throw "Android NDK doesn't support targetting ${stdenv.targetPlatform.config}, as far as we know"
+  );
 
   androidSdkVersion =
     if
@@ -74,119 +79,123 @@ let
   );
 in
 
-lib.recurseIntoAttrs rec {
-  # Misc tools
-  binaries = stdenv.mkDerivation {
-    pname = "${targetPrefix}ndk-toolchain";
-    inherit (androidndk) version;
-    nativeBuildInputs = [
-      makeWrapper
-      autoPatchelfHook
-    ];
-    propagatedBuildInputs = [ androidndk ];
-    passthru = {
-      inherit targetPrefix;
-      isClang = true; # clang based cc, but bintools ld
-      inherit (llvmPackages.clang.cc) hardeningUnsupportedFlagsByTargetPlatform;
-    };
-    dontUnpack = true;
-    dontBuild = true;
-    dontStrip = true;
-    dontConfigure = true;
-    dontPatch = true;
-    autoPatchelfIgnoreMissingDeps = true;
-    installPhase = ''
-      # https://developer.android.com/ndk/guides/other_build_systems
-      mkdir -p $out
-      cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
-      find $out/toolchain -type d -exec chmod 777 {} \;
+if !config.allowAliases && (ndkBuildInfoFun null == null || ndkTargetInfoFun null == null) then
+  # Don't throw without aliases to not break CI.
+  null
+else
+  lib.recurseIntoAttrs rec {
+    # Misc tools
+    binaries = stdenv.mkDerivation {
+      pname = "${targetPrefix}ndk-toolchain";
+      inherit (androidndk) version;
+      nativeBuildInputs = [
+        makeWrapper
+        autoPatchelfHook
+      ];
+      propagatedBuildInputs = [ androidndk ];
+      passthru = {
+        inherit targetPrefix;
+        isClang = true; # clang based cc, but bintools ld
+        inherit (llvmPackages.clang.cc) hardeningUnsupportedFlagsByTargetPlatform;
+      };
+      dontUnpack = true;
+      dontBuild = true;
+      dontStrip = true;
+      dontConfigure = true;
+      dontPatch = true;
+      autoPatchelfIgnoreMissingDeps = true;
+      installPhase = ''
+        # https://developer.android.com/ndk/guides/other_build_systems
+        mkdir -p $out
+        cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
+        find $out/toolchain -type d -exec chmod 777 {} \;
 
-      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion} ]; then
-        echo "NDK does not contain libraries for SDK version ${androidSdkVersion}";
+        if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion} ]; then
+          echo "NDK does not contain libraries for SDK version ${androidSdkVersion}";
+          exit 1
+        fi
+
+        ln -vfs $out/toolchain/sysroot/usr/lib $out/lib
+        ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.so $out/lib/
+        ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.a $out/lib/
+        chmod +w $out/lib/*
+        ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.so $out/lib/
+        ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.o $out/lib/
+
+        echo "INPUT(-lc++_static)" > $out/lib/libc++.a
+
+        ln -s $out/toolchain/bin $out/bin
+        ln -s $out/toolchain/${targetInfo.triple}/bin/* $out/bin/
+        for f in $out/bin/${targetInfo.triple}-*; do
+          ln -s $f ''${f/${targetInfo.triple}-/${targetPrefix}}
+        done
+        for f in $(find $out/toolchain -type d -name ${targetInfo.triple}); do
+          ln -s $f ''${f/${targetInfo.triple}/${targetPrefix}}
+        done
+
+        rm -f $out/bin/${targetPrefix}ld
+        ln -s $out/bin/lld $out/bin/${targetPrefix}ld
+
+        (cd $out/bin;
+          for tool in llvm-*; do
+            ln -sf $tool ${targetPrefix}$(echo $tool | sed 's/llvm-//')
+            ln -sf $tool $(echo $tool | sed 's/llvm-//')
+          done)
+
+        ln -sf $out/bin/yasm $out/bin/${targetPrefix}as
+        ln -sf $out/bin/yasm $out/bin/as
+
+        patchShebangs $out/bin
+      '';
+      meta = {
+        description = "The Android NDK toolchain, tuned for other platforms";
+        license = with lib.licenses; [ unfree ];
+        teams = [ lib.teams.android ];
+      };
+    };
+
+    binutils = wrapBintoolsWith {
+      bintools = binaries;
+      libc = targetAndroidndkPkgs.libraries;
+    };
+
+    clang = wrapCCWith {
+      cc = binaries // {
+        # for packages expecting libcompiler-rt, etc. to come from here (stdenv.cc.cc.lib)
+        lib = targetAndroidndkPkgs.libraries;
+      };
+      bintools = binutils;
+      libc = targetAndroidndkPkgs.libraries;
+      extraBuildCommands = ''
+        echo "-D__ANDROID_API__=${stdenv.targetPlatform.androidSdkVersion}" >> $out/nix-support/cc-cflags
+        # Android needs executables linked with -pie since version 5.0
+        # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
+        echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
+        echo "-z,noexecstack -z,relro -z,now -z,muldefs" >> $out/nix-support/cc-ldflags
+        echo 'expandResponseParams "$@"' >> $out/nix-support/add-flags.sh
+        echo 'if [[ ! (" ''${params[@]} " =~ " -shared ") && ! (" ''${params[@]} " =~ " -no-pie ") ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
+        echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
+        if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
+          # https://android.googlesource.com/platform/external/android-cmake/+/refs/heads/cmake-master-dev/android.toolchain.cmake
+          echo "--fix-cortex-a8" >> $out/nix-support/cc-ldflags
+        fi
+      '';
+    };
+
+    # Bionic lib C and other libraries.
+    #
+    # We use androidndk from the previous stage, else we waste time or get cycles
+    # cross-compiling packages to wrap incorrectly wrap binaries we don't include
+    # anyways.
+    libraries = runCommand "bionic-prebuilt" { } ''
+      lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}
+      if [ ! -d $lpath ]; then
+        echo "NDK does not contain libraries for SDK version ${androidSdkVersion} <$lpath>"
         exit 1
       fi
-
-      ln -vfs $out/toolchain/sysroot/usr/lib $out/lib
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.so $out/lib/
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.a $out/lib/
+      mkdir -p $out/lib
+      cp $lpath/*.so $lpath/*.a $out/lib
       chmod +w $out/lib/*
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.so $out/lib/
-      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}/*.o $out/lib/
-
-      echo "INPUT(-lc++_static)" > $out/lib/libc++.a
-
-      ln -s $out/toolchain/bin $out/bin
-      ln -s $out/toolchain/${targetInfo.triple}/bin/* $out/bin/
-      for f in $out/bin/${targetInfo.triple}-*; do
-        ln -s $f ''${f/${targetInfo.triple}-/${targetPrefix}}
-      done
-      for f in $(find $out/toolchain -type d -name ${targetInfo.triple}); do
-        ln -s $f ''${f/${targetInfo.triple}/${targetPrefix}}
-      done
-
-      rm -f $out/bin/${targetPrefix}ld
-      ln -s $out/bin/lld $out/bin/${targetPrefix}ld
-
-      (cd $out/bin;
-        for tool in llvm-*; do
-          ln -sf $tool ${targetPrefix}$(echo $tool | sed 's/llvm-//')
-          ln -sf $tool $(echo $tool | sed 's/llvm-//')
-        done)
-
-      ln -sf $out/bin/yasm $out/bin/${targetPrefix}as
-      ln -sf $out/bin/yasm $out/bin/as
-
-      patchShebangs $out/bin
+      cp $lpath/* $out/lib
     '';
-    meta = {
-      description = "The Android NDK toolchain, tuned for other platforms";
-      license = with lib.licenses; [ unfree ];
-      teams = [ lib.teams.android ];
-    };
-  };
-
-  binutils = wrapBintoolsWith {
-    bintools = binaries;
-    libc = targetAndroidndkPkgs.libraries;
-  };
-
-  clang = wrapCCWith {
-    cc = binaries // {
-      # for packages expecting libcompiler-rt, etc. to come from here (stdenv.cc.cc.lib)
-      lib = targetAndroidndkPkgs.libraries;
-    };
-    bintools = binutils;
-    libc = targetAndroidndkPkgs.libraries;
-    extraBuildCommands = ''
-      echo "-D__ANDROID_API__=${stdenv.targetPlatform.androidSdkVersion}" >> $out/nix-support/cc-cflags
-      # Android needs executables linked with -pie since version 5.0
-      # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
-      echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
-      echo "-z,noexecstack -z,relro -z,now -z,muldefs" >> $out/nix-support/cc-ldflags
-      echo 'expandResponseParams "$@"' >> $out/nix-support/add-flags.sh
-      echo 'if [[ ! (" ''${params[@]} " =~ " -shared ") && ! (" ''${params[@]} " =~ " -no-pie ") ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
-      echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
-      if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
-        # https://android.googlesource.com/platform/external/android-cmake/+/refs/heads/cmake-master-dev/android.toolchain.cmake
-        echo "--fix-cortex-a8" >> $out/nix-support/cc-ldflags
-      fi
-    '';
-  };
-
-  # Bionic lib C and other libraries.
-  #
-  # We use androidndk from the previous stage, else we waste time or get cycles
-  # cross-compiling packages to wrap incorrectly wrap binaries we don't include
-  # anyways.
-  libraries = runCommand "bionic-prebuilt" { } ''
-    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${androidSdkVersion}
-    if [ ! -d $lpath ]; then
-      echo "NDK does not contain libraries for SDK version ${androidSdkVersion} <$lpath>"
-      exit 1
-    fi
-    mkdir -p $out/lib
-    cp $lpath/*.so $lpath/*.a $out/lib
-    chmod +w $out/lib/*
-    cp $lpath/* $out/lib
-  '';
-}
+  }
diff --git a/pkgs/development/androidndk-pkgs/default.nix b/pkgs/development/androidndk-pkgs/default.nix
index d87facb14e00..24771887f008 100644
--- a/pkgs/development/androidndk-pkgs/default.nix
+++ b/pkgs/development/androidndk-pkgs/default.nix
@@ -24,7 +24,7 @@ let
       majorVersion = lib.versions.major ndkVersion;
     in
     import ./androidndk-pkgs.nix {
-      inherit lib;
+      inherit config lib;
       inherit (buildPackages)
         makeWrapper
         autoPatchelfHook
diff --git a/pkgs/development/compilers/gcl/default.nix b/pkgs/development/compilers/gcl/default.nix
index bcca6cb9d3b7..304d9d3159f5 100644
--- a/pkgs/development/compilers/gcl/default.nix
+++ b/pkgs/development/compilers/gcl/default.nix
@@ -19,11 +19,6 @@
   libXmu,
 }:
 
-assert stdenv ? cc;
-assert stdenv.cc.isGNU;
-assert stdenv.cc ? libc;
-assert stdenv.cc.libc != null;
-
 stdenv.mkDerivation rec {
   pname = "gcl";
   version = "2.6.14";
diff --git a/pkgs/development/interpreters/elixir/generic-builder.nix b/pkgs/development/interpreters/elixir/generic-builder.nix
index f8aff7f01c19..aab69c1db2dc 100644
--- a/pkgs/development/interpreters/elixir/generic-builder.nix
+++ b/pkgs/development/interpreters/elixir/generic-builder.nix
@@ -1,4 +1,5 @@
 {
+  config,
   lib,
   stdenv,
   fetchFromGitHub,
@@ -57,6 +58,8 @@ let
       true
     else
       versionOlder (versions.major (getVersion erlang)) maxShiftMajor;
+  minAssert = versionAtLeast (getVersion erlang) minimumOTPVersion;
+  bothAssert = minAssert && maxAssert;
 
   elixirShebang =
     if stdenv.hostPlatform.isDarwin then
@@ -70,82 +73,84 @@ let
 
   erlc_opts = [ "deterministic" ] ++ optionals debugInfo [ "debug_info" ];
 in
-assert assertMsg (versionAtLeast (getVersion erlang) minimumOTPVersion) compatibilityMsg;
-assert assertMsg maxAssert compatibilityMsg;
+if !config.allowAliases && !bothAssert then
+  # Don't throw without aliases to not break CI.
+  null
+else
+  assert assertMsg bothAssert compatibilityMsg;
+  stdenv.mkDerivation {
+    pname = "${baseName}";
 
-stdenv.mkDerivation {
-  pname = "${baseName}";
+    inherit src version debugInfo;
 
-  inherit src version debugInfo;
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ erlang ];
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ erlang ];
+    env = {
+      LANG = "C.UTF-8";
+      LC_TYPE = "C.UTF-8";
+      DESTDIR = placeholder "out";
+      PREFIX = "/";
+      ERL_COMPILER_OPTIONS = "[${concatStringsSep "," erlc_opts}]";
+    };
 
-  env = {
-    LANG = "C.UTF-8";
-    LC_TYPE = "C.UTF-8";
-    DESTDIR = placeholder "out";
-    PREFIX = "/";
-    ERL_COMPILER_OPTIONS = "[${concatStringsSep "," erlc_opts}]";
-  };
-
-  preBuild = ''
-    patchShebangs ${escriptPath} || true
-  '';
-
-  # copy stdlib source files for LSP access
-  postInstall = ''
-    for d in lib/*; do
-      cp -R "$d/lib" "$out/lib/elixir/$d"
-    done
-  '';
-
-  postFixup = ''
-    # Elixir binaries are shell scripts which run erl. Add some stuff
-    # to PATH so the scripts can run without problems.
-
-    for f in $out/bin/*; do
-      b=$(basename $f)
-      if [ "$b" = mix ]; then continue; fi
-      wrapProgram $f \
-        --prefix PATH ":" "${
-          lib.makeBinPath [
-            erlang
-            coreutils
-            curl
-            bash
-          ]
-        }"
-    done
-
-    substituteInPlace $out/bin/mix \
-      --replace "/usr/bin/env elixir" "${elixirShebang}"
-  '';
-
-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "v(${lib.versions.major version}\\.${lib.versions.minor version}\\.[0-9\\-rc.]+)"
-      "--override-filename"
-      "pkgs/development/interpreters/elixir/${lib.versions.major version}.${lib.versions.minor version}.nix"
-    ];
-  };
-
-  pos = builtins.unsafeGetAttrPos "sha256" args;
-  meta = with lib; {
-    homepage = "https://elixir-lang.org/";
-    description = "Functional, meta-programming aware language built on top of the Erlang VM";
-
-    longDescription = ''
-      Elixir is a functional, meta-programming aware language built on
-      top of the Erlang VM. It is a dynamic language with flexible
-      syntax and macro support that leverages Erlang's abilities to
-      build concurrent, distributed and fault-tolerant applications
-      with hot code upgrades.
+    preBuild = ''
+      patchShebangs ${escriptPath} || true
     '';
 
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    teams = [ teams.beam ];
-  };
-}
+    # copy stdlib source files for LSP access
+    postInstall = ''
+      for d in lib/*; do
+        cp -R "$d/lib" "$out/lib/elixir/$d"
+      done
+    '';
+
+    postFixup = ''
+      # Elixir binaries are shell scripts which run erl. Add some stuff
+      # to PATH so the scripts can run without problems.
+
+      for f in $out/bin/*; do
+        b=$(basename $f)
+        if [ "$b" = mix ]; then continue; fi
+        wrapProgram $f \
+          --prefix PATH ":" "${
+            lib.makeBinPath [
+              erlang
+              coreutils
+              curl
+              bash
+            ]
+          }"
+      done
+
+      substituteInPlace $out/bin/mix \
+        --replace "/usr/bin/env elixir" "${elixirShebang}"
+    '';
+
+    passthru.updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "v(${lib.versions.major version}\\.${lib.versions.minor version}\\.[0-9\\-rc.]+)"
+        "--override-filename"
+        "pkgs/development/interpreters/elixir/${lib.versions.major version}.${lib.versions.minor version}.nix"
+      ];
+    };
+
+    pos = builtins.unsafeGetAttrPos "sha256" args;
+    meta = with lib; {
+      homepage = "https://elixir-lang.org/";
+      description = "Functional, meta-programming aware language built on top of the Erlang VM";
+
+      longDescription = ''
+        Elixir is a functional, meta-programming aware language built on
+        top of the Erlang VM. It is a dynamic language with flexible
+        syntax and macro support that leverages Erlang's abilities to
+        build concurrent, distributed and fault-tolerant applications
+        with hot code upgrades.
+      '';
+
+      license = licenses.asl20;
+      platforms = platforms.unix;
+      teams = [ teams.beam ];
+    };
+  }
diff --git a/pkgs/development/interpreters/lfe/generic-builder.nix b/pkgs/development/interpreters/lfe/generic-builder.nix
index 27d1c6d6c85d..9501d712785d 100644
--- a/pkgs/development/interpreters/lfe/generic-builder.nix
+++ b/pkgs/development/interpreters/lfe/generic-builder.nix
@@ -1,4 +1,5 @@
 {
+  config,
   lib,
   fetchFromGitHub,
   erlang,
@@ -37,6 +38,8 @@ let
 
   mainVersion = versions.major (getVersion erlang);
 
+  maxAssert = versionAtLeast maximumOTPVersion mainVersion;
+
   proper = buildHex {
     name = "proper";
     version = "1.4.0";
@@ -45,82 +48,85 @@ let
   };
 
 in
-assert (assertMsg (versionAtLeast maximumOTPVersion mainVersion)) ''
-  LFE ${version} is supported on OTP <=${maximumOTPVersion}, not ${mainVersion}.
-'';
-
-buildRebar3 {
-  name = baseName;
-
-  inherit src version;
-
-  nativeBuildInputs = [
-    makeWrapper
-    erlang
-  ];
-  beamDeps = [ proper ];
-  patches = [
-    ./fix-rebar-config.patch
-    ./dedup-ebins.patch
-  ] ++ patches;
-  doCheck = true;
-  checkTarget = "travis";
-
-  makeFlags = [
-    "-e"
-    "MANDB=''"
-    "PREFIX=$$out"
-  ];
-
-  # These installPhase tricks are based on Elixir's Makefile.
-  # TODO: Make, upload, and apply a patch.
-  installPhase = optionalString (versionOlder version "1.3") ''
-    local libdir=$out/lib/lfe
-    local ebindir=$libdir/ebin
-    local bindir=$libdir/bin
-
-    rm -Rf $ebindir
-    install -m755 -d $ebindir
-    install -m644 _build/default/lib/lfe/ebin/* $ebindir
-
-    install -m755 -d $bindir
-
-    for bin in bin/lfe{,c,doc,script}; do install -m755 $bin $bindir; done
-
-    install -m755 -d $out/bin
-    for file in $bindir/*; do ln -sf $file $out/bin/; done
+if !config.allowAliases && !maxAssert then
+  # Don't throw without aliases to not break CI.
+  null
+else
+  assert assertMsg maxAssert ''
+    LFE ${version} is supported on OTP <=${maximumOTPVersion}, not ${mainVersion}.
   '';
+  buildRebar3 {
+    name = baseName;
 
-  # Thanks again, Elixir.
-  postFixup = ''
-    # LFE binaries are shell scripts which run erl and lfe.
-    # Add some stuff to PATH so the scripts can run without problems.
-    for f in $out/bin/*; do
-      wrapProgram $f \
-        --prefix PATH ":" "${
-          makeBinPath [
-            erlang
-            coreutils
-            bash
-          ]
-        }:$out/bin"
-      substituteInPlace $f --replace "/usr/bin/env" "${coreutils}/bin/env"
-    done
-  '';
+    inherit src version;
 
-  meta = with lib; {
-    description = "Best of Erlang and of Lisp; at the same time!";
-    longDescription = ''
-      LFE, Lisp Flavoured Erlang, is a lisp syntax front-end to the Erlang
-      compiler. Code produced with it is compatible with "normal" Erlang
-      code. An LFE evaluator and shell is also included.
+    nativeBuildInputs = [
+      makeWrapper
+      erlang
+    ];
+    beamDeps = [ proper ];
+    patches = [
+      ./fix-rebar-config.patch
+      ./dedup-ebins.patch
+    ] ++ patches;
+    doCheck = true;
+    checkTarget = "travis";
+
+    makeFlags = [
+      "-e"
+      "MANDB=''"
+      "PREFIX=$$out"
+    ];
+
+    # These installPhase tricks are based on Elixir's Makefile.
+    # TODO: Make, upload, and apply a patch.
+    installPhase = optionalString (versionOlder version "1.3") ''
+      local libdir=$out/lib/lfe
+      local ebindir=$libdir/ebin
+      local bindir=$libdir/bin
+
+      rm -Rf $ebindir
+      install -m755 -d $ebindir
+      install -m644 _build/default/lib/lfe/ebin/* $ebindir
+
+      install -m755 -d $bindir
+
+      for bin in bin/lfe{,c,doc,script}; do install -m755 $bin $bindir; done
+
+      install -m755 -d $out/bin
+      for file in $bindir/*; do ln -sf $file $out/bin/; done
     '';
 
-    homepage = "https://lfe.io";
-    downloadPage = "https://github.com/rvirding/lfe/releases";
+    # Thanks again, Elixir.
+    postFixup = ''
+      # LFE binaries are shell scripts which run erl and lfe.
+      # Add some stuff to PATH so the scripts can run without problems.
+      for f in $out/bin/*; do
+        wrapProgram $f \
+          --prefix PATH ":" "${
+            makeBinPath [
+              erlang
+              coreutils
+              bash
+            ]
+          }:$out/bin"
+        substituteInPlace $f --replace "/usr/bin/env" "${coreutils}/bin/env"
+      done
+    '';
 
-    license = licenses.asl20;
-    teams = [ teams.beam ];
-    platforms = platforms.unix;
-  };
-}
+    meta = with lib; {
+      description = "Best of Erlang and of Lisp; at the same time!";
+      longDescription = ''
+        LFE, Lisp Flavoured Erlang, is a lisp syntax front-end to the Erlang
+        compiler. Code produced with it is compatible with "normal" Erlang
+        code. An LFE evaluator and shell is also included.
+      '';
+
+      homepage = "https://lfe.io";
+      downloadPage = "https://github.com/rvirding/lfe/releases";
+
+      license = licenses.asl20;
+      teams = [ teams.beam ];
+      platforms = platforms.unix;
+    };
+  }
diff --git a/pkgs/development/libraries/aqbanking/sources.nix b/pkgs/development/libraries/aqbanking/sources.nix
index aff1447c9fdd..bdaa76ced6a5 100644
--- a/pkgs/development/libraries/aqbanking/sources.nix
+++ b/pkgs/development/libraries/aqbanking/sources.nix
@@ -1,9 +1,9 @@
 {
   # https://www.aquamaniac.de/rdm/projects/gwenhywfar/files
   gwenhywfar = {
-    version = "5.11.2beta";
-    hash = "sha256-5/KxLAktb1mPKeJVsLAD2YrBeWyFtzpXCJDb8tzzWyQ=";
-    releaseId = "518";
+    version = "5.12.1";
+    hash = "sha256-0YhEi5w6lwlyFCLuATS50Ld5CrdRQFjZngQ5njlGXdo=";
+    releaseId = "533";
   };
 
   # https://www.aquamaniac.de/rdm/projects/libchipcard/files
@@ -15,8 +15,8 @@
 
   # https://www.aquamaniac.de/rdm/projects/aqbanking/files
   aqbanking = {
-    version = "6.5.12beta";
-    hash = "sha256-TH6+eEiULmOciB1Mqo4vjgF9JbF4BW+llrTjS6BtctY=";
-    releaseId = "526";
+    version = "6.6.0";
+    hash = "sha256-N2NEh7lbrXKxshOXvOCMtLFeE8slOIZ2fJjzFxLkC/s=";
+    releaseId = "531";
   };
 }
diff --git a/pkgs/development/libraries/qtspell/default.nix b/pkgs/development/libraries/qtspell/default.nix
index fafa13d11457..f9275379e29a 100644
--- a/pkgs/development/libraries/qtspell/default.nix
+++ b/pkgs/development/libraries/qtspell/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtspell";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "manisandro";
     repo = "qtspell";
     rev = "${version}";
-    hash = "sha256-yaR3eCUbK2KTpvzO2G5sr+NEJ2mDnzJzzzwlU780zqU=";
+    hash = "sha256-OuEGY+0XJo3EUUcH8xAzlgE6zKPndBvG0arWhG/QO6Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index bd1859099c43..4e04ffa40024 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "6.4.2";
+  version = "6.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AppThreat";
     repo = "vulnerability-db";
     tag = "v${version}";
-    hash = "sha256-PmxlcdAUJjLIc0AWsN/oG11ESdsnln3LALsSnjV0yWM=";
+    hash = "sha256-08/ohfIPM/jb2nuOIj1XoUzWaq7s6CfWFRLHwqK0HAQ=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/eq3btsmart/default.nix b/pkgs/development/python-modules/eq3btsmart/default.nix
index bb1e3ec388fe..3f286274b64b 100644
--- a/pkgs/development/python-modules/eq3btsmart/default.nix
+++ b/pkgs/development/python-modules/eq3btsmart/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "eq3btsmart";
-  version = "2.1.0";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EuleMitKeule";
     repo = "eq3btsmart";
     tag = version;
-    hash = "sha256-JPmIKj8IL3i7QWiMTmGQzqb4h0VqLlhILPAOqMucsuM=";
+    hash = "sha256-/Z/lSZXJ+c+G5iDF/BGacSpxrgJK4NLU7ShIAV4ipLc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/gaphas/default.nix b/pkgs/development/python-modules/gaphas/default.nix
index 2d2dca4708ac..2911711d09df 100644
--- a/pkgs/development/python-modules/gaphas/default.nix
+++ b/pkgs/development/python-modules/gaphas/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "gaphas";
-  version = "5.0.3";
+  version = "5.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Rw7j41S+u5jyYKTJqVI/36aLh/0HIWFsrPCZgY0qtgY=";
+    hash = "sha256-89KGjrA5ncwxK5gVayfhlTddRZj2912L5G4L4ov4YhA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 933332684056..d4b5399b441f 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "gflanguages";
-  version = "0.7.5";
+  version = "0.7.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jc48DKUp3ai6AxcveyvR7TF80wmVLWfG58W2xR/HIsE=";
+    hash = "sha256-8lhD0L3JwmogPFjL+LAdV8ewvIR4IEtuhEYlaTZXFjk=";
   };
 
   # Relax the dependency on protobuf 3. Other packages in the Google Fonts
diff --git a/pkgs/development/python-modules/internetarchive/default.nix b/pkgs/development/python-modules/internetarchive/default.nix
index b13e862d8b5f..205c583381b7 100644
--- a/pkgs/development/python-modules/internetarchive/default.nix
+++ b/pkgs/development/python-modules/internetarchive/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "internetarchive";
-  version = "5.4.0";
+  version = "5.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "jjjake";
     repo = "internetarchive";
     tag = "v${version}";
-    hash = "sha256-2IL4VUt958atKDqCmj6rZ9I74tBRsA42EF1F1YT433E=";
+    hash = "sha256-jGzY/m7FpQPobyUaftsTQ0YX/sc6/s0xCVsMAK10ZSk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mandown/default.nix b/pkgs/development/python-modules/mandown/default.nix
index e5ba64712239..3f18f9a41923 100644
--- a/pkgs/development/python-modules/mandown/default.nix
+++ b/pkgs/development/python-modules/mandown/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "mandown";
-  version = "1.12.1";
+  version = "1.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "potatoeggy";
     repo = "mandown";
     tag = "v${version}";
-    hash = "sha256-dx92a1YI1BW90E2u+v9fggWzrg0mqsV+INNq+2aLmFI=";
+    hash = "sha256-kbzh6qbex3PzdE53rx9Sxff1lhh1yYjehdEJ9Srq5gY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/nominal/default.nix b/pkgs/development/python-modules/nominal/default.nix
index 63d4679dd330..75233a1421d5 100644
--- a/pkgs/development/python-modules/nominal/default.nix
+++ b/pkgs/development/python-modules/nominal/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "nominal";
-  version = "1.65.0";
+  version = "1.66.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nominal-io";
     repo = "nominal-client";
     tag = "v${version}";
-    hash = "sha256-MDIrKDMU4PgCXxaraVYKeRwgn84UXdwxNeyoJvMHiuE=";
+    hash = "sha256-xRt8xRMjjQQ+2IujW//F6Z3xaPz4+YuV0AP4Km8mc04=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/papis/default.nix b/pkgs/development/python-modules/papis/default.nix
index 275ddd452056..bc69dad05eda 100644
--- a/pkgs/development/python-modules/papis/default.nix
+++ b/pkgs/development/python-modules/papis/default.nix
@@ -27,6 +27,16 @@
   requests,
   stevedore,
 
+  # optional dependencies
+  chardet,
+  citeproc-py,
+  jinja2,
+  markdownify,
+  whoosh,
+
+  # switch for optional dependencies
+  withOptDeps ? false,
+
   # tests
   docutils,
   git,
@@ -69,7 +79,17 @@ buildPythonPackage rec {
     pyyaml
     requests
     stevedore
-  ];
+  ] ++ lib.optionals withOptDeps optional-dependencies.complete;
+
+  optional-dependencies = {
+    complete = [
+      chardet
+      citeproc-py
+      jinja2
+      markdownify
+      whoosh
+    ];
+  };
 
   pythonImportsCheck = [ "papis" ];
 
diff --git a/pkgs/development/python-modules/pyorthanc/default.nix b/pkgs/development/python-modules/pyorthanc/default.nix
index d753ed0edb4b..e80113d11a1f 100644
--- a/pkgs/development/python-modules/pyorthanc/default.nix
+++ b/pkgs/development/python-modules/pyorthanc/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyorthanc";
-  version = "1.21.0";
+  version = "1.22.1";
 
   pyproject = true;
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "gacou54";
     repo = "pyorthanc";
     tag = "v${version}";
-    hash = "sha256-293H5hQ+6eknzKNsZpVKoTcrKzbHfJE4C+SyxAOLphY=";
+    hash = "sha256-vdrLWDDEMEh7hg+M4FdxiaCC3IJfvuh8fgq+aLPfVJc=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pysmartthings/default.nix b/pkgs/development/python-modules/pysmartthings/default.nix
index 43ea0bab1ef9..d9a34b383192 100644
--- a/pkgs/development/python-modules/pysmartthings/default.nix
+++ b/pkgs/development/python-modules/pysmartthings/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pysmartthings";
-  version = "3.2.7";
+  version = "3.2.8";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "andrewsayre";
     repo = "pysmartthings";
     tag = "v${version}";
-    hash = "sha256-znaiCZiSGi3J9PhBtOhsh/ISHoa/lyd1lurneLPNHt4=";
+    hash = "sha256-bTE4N2TwrAyi0NZcj/GghLZ7Vq4eoc9mQH2OBeCfHn8=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/python-linkplay/default.nix b/pkgs/development/python-modules/python-linkplay/default.nix
index 6a470b8608c9..78a1bd3638d0 100644
--- a/pkgs/development/python-modules/python-linkplay/default.nix
+++ b/pkgs/development/python-modules/python-linkplay/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "python-linkplay";
-  version = "0.2.12";
+  version = "0.2.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Velleman";
     repo = "python-linkplay";
     tag = "v${version}";
-    hash = "sha256-oE3ILnaUDWMNcN3ZAIQKmGgUTc/tqXYdZTX1bxuHBso=";
+    hash = "sha256-E9KuIHLaA7XQC2XH8a1oeTuQh7Q4YxmswoaVKEJU4VE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/servers/monitoring/nagios-plugins/check_esxi_hardware/default.nix b/pkgs/servers/monitoring/nagios-plugins/check_esxi_hardware/default.nix
index 7e8ebfbb06f9..5337a71a85cc 100644
--- a/pkgs/servers/monitoring/nagios-plugins/check_esxi_hardware/default.nix
+++ b/pkgs/servers/monitoring/nagios-plugins/check_esxi_hardware/default.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "check-esxi-hardware";
-  version = "20250221";
+  version = "20250716";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "Napsty";
     repo = "check_esxi_hardware";
     tag = version;
-    hash = "sha256-80yru0ltioxNc6goiMKZGTFmfcyHw3N01zd91DXq9lQ=";
+    hash = "sha256-tw1b2ZmkEIdlqov4JoEDc8cR2AmAiZWocKjir4AFIv0=";
   };
 
   dontBuild = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0282bdeaaf08..7878098ad2bb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5097,11 +5097,10 @@ with pkgs;
   # The GCC used to build libc for the target platform. Normal gccs will be
   # built with, and use, that cross-compiled libc.
   gccWithoutTargetLibc =
-    assert stdenv.targetPlatform != stdenv.hostPlatform;
     let
       libc1 = binutilsNoLibc.libc;
     in
-    wrapCCWith {
+    (wrapCCWith {
       cc = gccFun {
         # copy-pasted
         inherit noSysDirs;
@@ -5127,7 +5126,14 @@ with pkgs;
       bintools = binutilsNoLibc;
       libc = libc1;
       extraPackages = [ ];
-    };
+    }).overrideAttrs
+      (prevAttrs: {
+        meta = prevAttrs.meta // {
+          badPlatforms =
+            (prevAttrs.meta.badPlatforms or [ ])
+            ++ lib.optionals (stdenv.targetPlatform == stdenv.hostPlatform) [ stdenv.hostPlatform.system ];
+        };
+      });
 
   inherit (callPackage ../development/compilers/gcc/all.nix { inherit noSysDirs; })
     gcc9