diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index b08714a31f12..57e7cd547ef5 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index 6366f666de13..024ced4688a7 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -46,7 +46,7 @@ jobs:
       # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -56,7 +56,7 @@ jobs:
         run: npm install @actions/artifact bottleneck
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1d3e035bfdc1..46a4b7b4cf3f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -52,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -62,7 +62,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 05cb9fca03f4..9d8be547c7ee 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           path: trusted
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -85,7 +85,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         continue-on-error: true
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index d09df6956c8c..5f6941f7daed 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -23,14 +23,14 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
             ci/github-script
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/edited.yml b/.github/workflows/edited.yml
index 058c6181e2a6..8e9d471eaa13 100644
--- a/.github/workflows/edited.yml
+++ b/.github/workflows/edited.yml
@@ -36,7 +36,7 @@ jobs:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
       # We only need Pull Requests: write here, but the app is also used for backports.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 63144133467c..e1b0ae973f9e 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -37,7 +37,7 @@ jobs:
     outputs:
       versions: ${{ steps.versions.outputs.versions }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           path: trusted
@@ -45,7 +45,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -54,7 +54,7 @@ jobs:
             ci/pinned.json
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+        uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
 
       - name: Load supported versions
         id: versions
@@ -89,7 +89,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -100,7 +100,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+        uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         continue-on-error: true
@@ -171,7 +171,7 @@ jobs:
       statuses: write
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -189,7 +189,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+        uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
 
       - name: Combine all output paths and eval stats
         run: |
@@ -342,7 +342,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -352,7 +352,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+        uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
 
       - name: Run misc eval tasks in parallel
         run: |
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d9de58a5f028..06e04c57499c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         continue-on-error: true
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@7ec16f2c061ab07b235a7245e06ed46fe9a1cab6 # v31
+      - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         continue-on-error: true
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index d84cb3318423..8473ebf30735 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index 606c03866e6f..d29f34e643c0 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pull-request-target.yml b/.github/workflows/pull-request-target.yml
index 1f6424cbc527..ea0a887888e3 100644
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -31,7 +31,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index 44ac3f0088d4..a6ced7d29059 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -20,14 +20,14 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
             ci/github-script
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
index cca0ca1f65da..5a1cb51f3ddf 100644
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered and to
       # request team member lists.
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -64,7 +64,7 @@ jobs:
           echo "git-string=$name <$email>" >> "$GITHUB_OUTPUT"
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
         with:
           token: ${{ steps.app-token.outputs.token }}
           add-paths: maintainers/github-teams.json
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cb8956ae71dc..57f8ba83d2c8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
diff --git a/ci/OWNERS b/ci/OWNERS
index fae2544f3bc0..51888466bd1a 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -139,7 +139,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 /nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
 
 # Limine
-/nixos/modules/system/boot/loader/limine        @lzcunt @phip1611 @programmerlexi @johnrtitor
+/nixos/modules/system/boot/loader/limine        @lzcunt @programmerlexi @johnrtitor
 /nixos/tests/limine                             @johnrtitor
 
 # Images and installer media
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a602732ce4eb..74cd657e6148 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3442,6 +3442,11 @@
     githubId = 10164833;
     name = "Birk Bohne";
   };
+  bitbloxhub = {
+    name = "bitbloxhub";
+    github = "bitbloxhub";
+    githubId = 45184892;
+  };
   bizmyth = {
     email = "andrew.p.council@gmail.com";
     github = "bizmythy";
@@ -23396,6 +23401,13 @@
     githubId = 72168352;
     matrix = "@schrobingus:matrix.org";
   };
+  schromp = {
+    email = "schromp@echsen.club";
+    github = "schromp";
+    githubId = 103186360;
+    matrix = "@schromp:echsen.club";
+    name = "schromp";
+  };
   Schweber = {
     github = "Schweber";
     githubId = 64630479;
diff --git a/nixos/tests/limine/bios.nix b/nixos/tests/limine/bios.nix
index 5d367934b660..0dfcfd105825 100644
--- a/nixos/tests/limine/bios.nix
+++ b/nixos/tests/limine/bios.nix
@@ -3,7 +3,6 @@
   name = "bios";
   meta.maintainers = with lib.maintainers; [
     lzcunt
-    phip1611
     programmerlexi
   ];
   meta.platforms = [
diff --git a/pkgs/applications/networking/p2p/jesec-rtorrent/avoid-stack-overflow-for-lockfile-buf.patch b/pkgs/applications/networking/p2p/jesec-rtorrent/avoid-stack-overflow-for-lockfile-buf.patch
deleted file mode 100644
index 2a20b157a2fc..000000000000
--- a/pkgs/applications/networking/p2p/jesec-rtorrent/avoid-stack-overflow-for-lockfile-buf.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From dd4a96073d4a60ca8fff55be6ea6b17018de96a8 Mon Sep 17 00:00:00 2001
-From: Varun Madiath <git@madiathv.com>
-Date: Wed, 19 Jul 2023 15:30:57 -0400
-Subject: [PATCH] utils: lockfile: avoid stack overflow for lockfile buffer
-
-Original patch by @cyphar was submitted to rakshasa/rtorrent at
-https://github.com/rakshasa/rtorrent/pull/1169.
-
-Observed the segfault on nixos-unstable.
----
- src/utils/lockfile.cc | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/utils/lockfile.cc b/src/utils/lockfile.cc
-index 76e4b8f..441f5c8 100644
---- a/src/utils/lockfile.cc
-+++ b/src/utils/lockfile.cc
-@@ -75,7 +75,8 @@ Lockfile::try_lock() {
-   int  pos = ::gethostname(buf, 255);
- 
-   if (pos == 0) {
--    ::snprintf(buf + std::strlen(buf), 255, ":+%i\n", ::getpid());
-+    ssize_t len = std::strlen(buf);
-+    ::snprintf(buf + len, 255 - len, ":+%i\n", ::getpid());
-     ssize_t __attribute__((unused)) result = ::write(fd, buf, std::strlen(buf));
-   }
- 
--- 
-2.41.0
-
diff --git a/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix b/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix
deleted file mode 100644
index ecc0ff81ad70..000000000000
--- a/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  curl,
-  gtest,
-  libtorrent,
-  ncurses,
-  jsonRpcSupport ? true,
-  nlohmann_json,
-  xmlRpcSupport ? true,
-  xmlrpc_c,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "jesec-rtorrent";
-  version = "0.9.8-r16";
-
-  src = fetchFromGitHub {
-    owner = "jesec";
-    repo = "rtorrent";
-    rev = "v${version}";
-    hash = "sha256-i7c1jSawHshj1kaXl8tdpelIKU24okeg9K5/+ht6t2k=";
-  };
-
-  patches = [
-    ./avoid-stack-overflow-for-lockfile-buf.patch
-  ];
-
-  passthru = {
-    inherit libtorrent;
-  };
-
-  nativeBuildInputs = [
-    cmake
-  ];
-
-  buildInputs = [
-    curl
-    libtorrent
-    ncurses
-  ]
-  ++ lib.optional jsonRpcSupport nlohmann_json
-  ++ lib.optional xmlRpcSupport xmlrpc_c;
-
-  cmakeFlags = [
-    "-DUSE_RUNTIME_CA_DETECTION=NO"
-  ]
-  ++ lib.optional (!jsonRpcSupport) "-DUSE_JSONRPC=NO"
-  ++ lib.optional (!xmlRpcSupport) "-DUSE_XMLRPC=NO";
-
-  doCheck = true;
-
-  nativeCheckInputs = [
-    gtest
-  ];
-
-  prePatch = ''
-    substituteInPlace src/main.cc \
-      --replace "/etc/rtorrent/rtorrent.rc" "${placeholder "out"}/etc/rtorrent/rtorrent.rc"
-  '';
-
-  postFixup = ''
-    mkdir -p $out/etc/rtorrent
-    cp $src/doc/rtorrent.rc $out/etc/rtorrent/rtorrent.rc
-  '';
-
-  meta = with lib; {
-    description = "Ncurses client for libtorrent, ideal for use with screen, tmux, or dtach (jesec's fork)";
-    homepage = "https://github.com/jesec/rtorrent";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ winter ];
-    platforms = platforms.linux;
-    mainProgram = "rtorrent";
-  };
-}
diff --git a/pkgs/applications/networking/p2p/jesec-rtorrent/libtorrent.nix b/pkgs/applications/networking/p2p/jesec-rtorrent/libtorrent.nix
deleted file mode 100644
index 50d250e7efe3..000000000000
--- a/pkgs/applications/networking/p2p/jesec-rtorrent/libtorrent.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  gtest,
-  openssl,
-  zlib,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "jesec-libtorrent";
-  version = "0.13.8-r4";
-
-  src = fetchFromGitHub {
-    owner = "jesec";
-    repo = "libtorrent";
-    rev = "v${version}";
-    hash = "sha256-jC/hgGSi2qy+ToZgdxl1PhASLYbUL0O8trX0th2v5H0=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-  ];
-
-  buildInputs = [
-    openssl
-    zlib
-  ];
-
-  # Disabled because a test is flaky; see https://github.com/jesec/libtorrent/issues/4.
-  # doCheck = true;
-
-  preCheck = ''
-    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD
-  '';
-
-  nativeCheckInputs = [
-    gtest
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/jesec/libtorrent";
-    description = "BitTorrent library written in C++ for *nix, with focus on high performance and good code (jesec's fork)";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ winter ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix
index 16cdee665d0d..67ee1bb1ef09 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -195,5 +195,8 @@ in
     substitutions = {
       jq = lib.getExe jq;
     };
+    meta = {
+      description = "Prune yarn dependencies and install files for packages using Yarn 1";
+    };
   } ./yarn-install-hook.sh;
 }
diff --git a/pkgs/by-name/af/affine/package.nix b/pkgs/by-name/af/affine/package.nix
index addcc46a57d9..057f3729ff63 100644
--- a/pkgs/by-name/af/affine/package.nix
+++ b/pkgs/by-name/af/affine/package.nix
@@ -32,6 +32,16 @@ let
   yarn-berry = yarn-berry_4.override { inherit nodejs; };
   productName = if buildType != "stable" then "AFFiNE-${buildType}" else "AFFiNE";
   binName = lib.toLower productName;
+  electron-dist-zip = stdenvNoCC.mkDerivation {
+    pname = "electron-dist-zip";
+    version = electron.version;
+    src = electron.dist;
+    nativeBuildInputs = [ zip ];
+    buildPhase = ''
+      zip --recurse-paths - . > $out
+    '';
+    dontInstall = true;
+  };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = binName;
@@ -48,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     hash = "sha256-tdg0Ti+QWsIx64+WV0fPoyE/t3GlsUxXzU9qFHYfpt0=";
   };
+
+  # keep yarnOfflineCache same output style with offlineCache = yarn-berry.fetchYarnBerryDeps { inherit (finalAttrs) src missingHashes; hash = "" };
   yarnOfflineCache = stdenvNoCC.mkDerivation {
     name = "yarn-offline-cache";
     inherit (finalAttrs) src;
@@ -79,19 +91,22 @@ stdenv.mkDerivation (finalAttrs: {
       ''
         runHook preBuild
 
-        mkdir -p $out
+        mkdir -p $out/cache
+
         yarn config set enableTelemetry false
-        yarn config set cacheFolder $out
+        yarn config set cacheFolder $out/cache
         yarn config set enableGlobalCache false
         yarn config set supportedArchitectures --json '${supportedArchitectures}'
 
         yarn install --immutable --mode=skip-build
 
+        cp yarn.lock $out/yarn.lock
+
         runHook postBuild
       '';
     dontInstall = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-wMfjlxHs1pS8QEnIgn9IZTNShKkLeVVpGFkZ2ICtiNA=";
+    outputHash = "sha256-iULgio5zpmJhKofkUxA98Ze7Qy+kRfbbi5oEHYw5vzY=";
   };
 
   buildInputs = lib.optionals hostPlatform.isDarwin [
@@ -133,6 +148,7 @@ stdenv.mkDerivation (finalAttrs: {
     echo "$BACKEND_SERVER_PACKAGE_JSON" > packages/backend/server/package.json
   '';
 
+  # FIXME: use `yarn config set cacheFolder $offlineCache/cache`
   configurePhase = ''
     runHook preConfigure
 
@@ -144,14 +160,13 @@ stdenv.mkDerivation (finalAttrs: {
     # yarn config
     yarn config set enableTelemetry false
     yarn config set enableGlobalCache false
-    yarn config set cacheFolder $yarnOfflineCache
+    yarn config set cacheFolder $yarnOfflineCache/cache
 
     # electron config
     ELECTRON_VERSION_IN_LOCKFILE=$(yarn why electron --json | tail --lines 1 | jq --raw-output '.children | to_entries | first | .key ' | cut -d : -f 2)
-    rsync --archive --chmod=u+w "${electron.dist}/" $HOME/.electron-prebuilt-zip-tmp
     export ELECTRON_FORGE_ELECTRON_ZIP_DIR=$PWD/.electron_zip_dir
     mkdir -p $ELECTRON_FORGE_ELECTRON_ZIP_DIR
-    (cd $HOME/.electron-prebuilt-zip-tmp && zip --recurse-paths - .) > $ELECTRON_FORGE_ELECTRON_ZIP_DIR/electron-v$ELECTRON_VERSION_IN_LOCKFILE-${nodePlatform}-${nodeArch}.zip
+    cp ${electron-dist-zip} $ELECTRON_FORGE_ELECTRON_ZIP_DIR/electron-v$ELECTRON_VERSION_IN_LOCKFILE-${nodePlatform}-${nodeArch}.zip
     export ELECTRON_SKIP_BINARY_DOWNLOAD=1
 
     runHook postConfigure
diff --git a/pkgs/by-name/al/aldente/package.nix b/pkgs/by-name/al/aldente/package.nix
index 73d5447f7d54..8058f86d8305 100644
--- a/pkgs/by-name/al/aldente/package.nix
+++ b/pkgs/by-name/al/aldente/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aldente";
-  version = "1.35.1";
+  version = "1.36.1";
 
   src = fetchurl {
     url = "https://github.com/AppHouseKitchen/AlDente-Battery_Care_and_Monitoring/releases/download/${finalAttrs.version}/AlDente.dmg";
-    hash = "sha256-OjajT9goWbK3dKmkvt/qbcjlytg/xOPxNEZWE7h24Uc=";
+    hash = "sha256-iouXZv6dfLGawWtDH+/wGOogDjUoqp55BE2ADAAos0o=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/as/asciidoctor-with-extensions/Gemfile.lock b/pkgs/by-name/as/asciidoctor-with-extensions/Gemfile.lock
index cc72aec9ea67..8983362c91ec 100644
--- a/pkgs/by-name/as/asciidoctor-with-extensions/Gemfile.lock
+++ b/pkgs/by-name/as/asciidoctor-with-extensions/Gemfile.lock
@@ -1,29 +1,23 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    Ascii85 (1.1.1)
+    Ascii85 (2.0.1)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
-    afm (0.2.2)
-    asciidoctor (2.0.23)
+    afm (1.0.0)
+    asciidoctor (2.0.26)
     asciidoctor-bibtex (0.9.0)
       asciidoctor (~> 2.0)
       bibtex-ruby (~> 6.1)
       citeproc-ruby (~> 1)
       csl-styles (~> 1)
       latex-decode (~> 0.2)
-    asciidoctor-diagram (2.3.1)
+    asciidoctor-diagram (3.1.0)
       asciidoctor (>= 1.5.7, < 3.x)
-      asciidoctor-diagram-ditaamini (~> 1.0)
-      asciidoctor-diagram-plantuml (~> 1.2021)
       rexml
-    asciidoctor-diagram-batik (1.17)
-    asciidoctor-diagram-ditaamini (1.0.3)
-    asciidoctor-diagram-plantuml (1.2024.6)
-      asciidoctor-diagram-batik (~> 1.17)
-    asciidoctor-epub3 (2.1.3)
+    asciidoctor-epub3 (2.3.0)
       asciidoctor (~> 2.0)
-      gepub (>= 1.0.0, <= 1.0.15)
+      gepub (~> 1.0.0)
       mime-types (~> 3.0)
       sass
     asciidoctor-html5s (0.5.1)
@@ -31,9 +25,9 @@ GEM
       thread_safe (~> 0.3.4)
     asciidoctor-multipage (0.0.19)
       asciidoctor (>= 2.0.11, < 2.1)
-    asciidoctor-pdf (2.3.19)
+    asciidoctor-pdf (2.3.24)
       asciidoctor (~> 2.0)
-      concurrent-ruby (~> 1.1)
+      concurrent-ruby (~> 1.3)
       matrix (~> 0.4)
       prawn (~> 2.4.0)
       prawn-icon (~> 3.0.0)
@@ -42,49 +36,63 @@ GEM
       prawn-templates (~> 0.1.0)
       treetop (~> 1.6.0)
       ttfunk (~> 1.7.0)
-    asciidoctor-reducer (1.0.6)
+    asciidoctor-reducer (1.1.2)
       asciidoctor (~> 2.0)
-    asciidoctor-revealjs (5.1.0)
+    asciidoctor-revealjs (5.2.0)
       asciidoctor (>= 2.0.0, < 3.0.0)
-    bibtex-ruby (6.1.0)
+    bibtex-ruby (6.2.0)
       latex-decode (~> 0.0)
+      logger (~> 1.7)
       racc (~> 1.7)
-    citeproc (1.0.10)
+    citeproc (1.1.0)
+      date
+      forwardable
+      json
       namae (~> 1.0)
+      observer (< 1.0)
+      open-uri (< 1.0)
     citeproc-ruby (1.1.14)
       citeproc (~> 1.0, >= 1.0.9)
       csl (~> 1.6)
     coderay (1.1.3)
-    concurrent-ruby (1.3.4)
+    concurrent-ruby (1.3.5)
     csl (1.6.0)
       namae (~> 1.0)
       rexml
     csl-styles (1.0.1.11)
       csl (~> 1.0)
-    css_parser (1.19.1)
+    css_parser (1.21.1)
       addressable
-    ffi (1.17.0)
-    gepub (1.0.15)
+    date (3.5.0)
+    ffi (1.17.2)
+    forwardable (1.3.3)
+    gepub (1.0.17)
       nokogiri (>= 1.8.2, < 2.0)
       rubyzip (> 1.1.1, < 2.4)
     hashery (2.1.2)
+    json (2.16.0)
     latex-decode (0.4.0)
-    logger (1.6.1)
-    matrix (0.4.2)
-    mime-types (3.6.0)
+    logger (1.7.0)
+    matrix (0.4.3)
+    mime-types (3.7.0)
       logger
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2024.1001)
-    mini_portile2 (2.8.7)
+      mime-types-data (~> 3.2025, >= 3.2025.0507)
+    mime-types-data (3.2025.0924)
+    mini_portile2 (2.8.9)
     namae (1.2.0)
       racc (~> 1.7)
-    nokogiri (1.16.7)
+    nokogiri (1.18.10)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
+    observer (0.1.2)
+    open-uri (0.5.0)
+      stringio
+      time
+      uri
     pdf-core (0.9.0)
-    pdf-reader (2.12.0)
-      Ascii85 (~> 1.0)
-      afm (~> 0.2.1)
+    pdf-reader (2.15.0)
+      Ascii85 (>= 1.0, < 3.0, != 2.0.0)
+      afm (>= 0.2.1, < 2)
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
@@ -104,14 +112,14 @@ GEM
     prawn-templates (0.1.2)
       pdf-reader (~> 2.0)
       prawn (~> 2.2)
-    public_suffix (6.0.1)
-    pygments.rb (3.0.0)
+    public_suffix (6.0.2)
+    pygments.rb (4.0.0)
     racc (1.8.1)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rexml (3.3.9)
-    rouge (4.4.0)
+    rexml (3.4.4)
+    rouge (4.6.1)
     ruby-rc4 (0.1.5)
     rubyzip (2.3.2)
     sass (3.7.4)
@@ -119,10 +127,14 @@ GEM
     sass-listen (4.0.0)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
+    stringio (3.1.8)
     thread_safe (0.3.6)
-    treetop (1.6.12)
+    time (0.4.1)
+      date
+    treetop (1.6.18)
       polyglot (~> 0.3)
     ttfunk (1.7.0)
+    uri (1.1.1)
 
 PLATFORMS
   ruby
@@ -142,4 +154,4 @@ DEPENDENCIES
   rouge
 
 BUNDLED WITH
-   2.5.22
+   2.7.2
diff --git a/pkgs/by-name/as/asciidoctor-with-extensions/gemset.nix b/pkgs/by-name/as/asciidoctor-with-extensions/gemset.nix
index 6eae05955d11..a1f70de4e910 100644
--- a/pkgs/by-name/as/asciidoctor-with-extensions/gemset.nix
+++ b/pkgs/by-name/as/asciidoctor-with-extensions/gemset.nix
@@ -15,30 +15,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06kj9hgd0z8pj27bxp2diwqh6fv7qhwwm17z64rhdc4sfn76jgn8";
+      sha256 = "0ia5iw9xvvy1igaxsa08vvv4b5ry9ipyr18917pi8w0y4kvddm2v";
       type = "gem";
     };
-    version = "0.2.2";
+    version = "1.0.0";
   };
   Ascii85 = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1c62cx96r0v265mywnlik43qx0wf6bjbzl54qa47x6dzjg861mvk";
+      sha256 = "0nmyxpngg5rycyryhq9l9hapz1y3iqyflskyksxkqm0832a5vjqm";
       type = "gem";
     };
-    version = "1.1.1";
+    version = "2.0.1";
   };
   asciidoctor = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1wyxgwmnz9bw377r3lba26b090hbsq9qnbw8575a1prpy83qh82j";
+      sha256 = "1hbin3j8wynl2fpqa3d6vb932pyngyfn8j2q6gbbn1n23z7srqqn";
       type = "gem";
     };
-    version = "2.0.23";
+    version = "2.0.26";
   };
   asciidoctor-bibtex = {
     dependencies = [
@@ -60,49 +60,16 @@
   asciidoctor-diagram = {
     dependencies = [
       "asciidoctor"
-      "asciidoctor-diagram-ditaamini"
-      "asciidoctor-diagram-plantuml"
       "rexml"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1214scxm36k409gfy3wilfqx3akrm52r530zmra6cmmf6d22c5q4";
+      sha256 = "15sc6yb4qyxy4v3bki26xn0j4k8rgjjiz3nwrxsprn6f0y6ysbp3";
       type = "gem";
     };
-    version = "2.3.1";
-  };
-  asciidoctor-diagram-batik = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0220xqxmkmimxmhsqhlbr0hslijvnhzdds3s6h6fxbxqrrmm0jrl";
-      type = "gem";
-    };
-    version = "1.17";
-  };
-  asciidoctor-diagram-ditaamini = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "13h65bfbq7hc7z3kqn0m28w9c6ap7fikpjcvsdga6jg01slb4c56";
-      type = "gem";
-    };
-    version = "1.0.3";
-  };
-  asciidoctor-diagram-plantuml = {
-    dependencies = [ "asciidoctor-diagram-batik" ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "173mp5vnzvn3yv9fw0p66rsbxaip9lhphw22yn19l62d1drlmhia";
-      type = "gem";
-    };
-    version = "1.2024.6";
+    version = "3.1.0";
   };
   asciidoctor-epub3 = {
     dependencies = [
@@ -115,10 +82,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1yn2nhr7fr5rx7fn0nhw44gf7iampiy53bw59agpfl7h2dyazjll";
+      sha256 = "0n4c7silsc37gapsvkzm2l7fwa9gi28cif7mzd27lkzbkdsv4k0i";
       type = "gem";
     };
-    version = "2.1.3";
+    version = "2.3.0";
   };
   asciidoctor-html5s = {
     dependencies = [
@@ -162,10 +129,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ybkw3xjv75xsc0wbwg76bk83sfspr50k2phshpvh9ynchli8jh3";
+      sha256 = "0ldh43ps15dpnrgqaybyq2py9cn1m14q2z6djgg22fyl698yaxih";
       type = "gem";
     };
-    version = "2.3.19";
+    version = "2.3.24";
   };
   asciidoctor-reducer = {
     dependencies = [ "asciidoctor" ];
@@ -173,10 +140,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1fbrk97mdn26zk118dav2ckyiw6kgrlbkkhdcasawsl42hj16slw";
+      sha256 = "0d0zz9qksbxfzc73jv20rzkhy5qkfkp4fr017k06r4al79y3lvcd";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.1.2";
   };
   asciidoctor-revealjs = {
     dependencies = [ "asciidoctor" ];
@@ -184,35 +151,43 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jgazcfzn577xlichfj0rvci0fayp63xcng11ss9mmwqgk48ri53";
+      sha256 = "1qkapy8nck52r7aldmnrvaabzrmizwa9664ngziivjgjxbksa11m";
       type = "gem";
     };
-    version = "5.1.0";
+    version = "5.2.0";
   };
   bibtex-ruby = {
     dependencies = [
       "latex-decode"
+      "logger"
       "racc"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ggx2j1gi46f1a6p45l1abk3nryfg1pj0cdlyrnilnqqpr1cfc96";
+      sha256 = "16n6szgybyk7mglpajizgi7b77s48i319brxhhx51pvainkyn46n";
       type = "gem";
     };
-    version = "6.1.0";
+    version = "6.2.0";
   };
   citeproc = {
-    dependencies = [ "namae" ];
+    dependencies = [
+      "date"
+      "forwardable"
+      "json"
+      "namae"
+      "observer"
+      "open-uri"
+    ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "13vl5sjmksk5a8kjcqnjxh7kn9gn1n4f9p1rvqfgsfhs54p0m6l2";
+      sha256 = "159vnp84r3rywwzji6jbfjldlynai0gll868y6z84ghk924np3i7";
       type = "gem";
     };
-    version = "1.0.10";
+    version = "1.1.0";
   };
   citeproc-ruby = {
     dependencies = [
@@ -243,10 +218,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0chwfdq2a6kbj6xz9l6zrdfnyghnh32si82la1dnpa5h75ir5anl";
+      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
       type = "gem";
     };
-    version = "1.3.4";
+    version = "1.3.5";
   };
   csl = {
     dependencies = [
@@ -279,20 +254,40 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "17i0fn99kswvfps8r698zw2cr16rc98xdrl0d26y36rv3vhdqh0r";
+      sha256 = "1izp5vna86s7xivqzml4nviy01bv76arrd5is8wkncwp1by3zzbc";
       type = "gem";
     };
-    version = "1.19.1";
+    version = "1.21.1";
+  };
+  date = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1rbfqkzr6i8b6538z16chvrkgywf5p5vafsgmnbmvrmh0ingsx2y";
+      type = "gem";
+    };
+    version = "3.5.0";
   };
   ffi = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "07139870npj59jnl8vmk39ja3gdk3fb5z9vc0lf32y2h891hwqsi";
+      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
       type = "gem";
     };
-    version = "1.17.0";
+    version = "1.17.2";
+  };
+  forwardable = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b5g1i3xdvmxxpq4qp0z4v78ivqnazz26w110fh4cvzsdayz8zgi";
+      type = "gem";
+    };
+    version = "1.3.3";
   };
   gepub = {
     dependencies = [
@@ -303,10 +298,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08fny807zd4700f263ckc76bladjipsniyk3clv8a7x76x3fqshx";
+      sha256 = "0fiwnfgvyrhgywnqvfvr3ird8p4xda6nvvqwvvfpnhvsyhrxswlc";
       type = "gem";
     };
-    version = "1.0.15";
+    version = "1.0.17";
   };
   hashery = {
     groups = [ "default" ];
@@ -318,6 +313,16 @@
     };
     version = "2.1.2";
   };
+  json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "098m3q2jrx4xbf0knrbmflsynmmb5x9q9b0bzpmj7jmm1cr30mna";
+      type = "gem";
+    };
+    version = "2.16.0";
+  };
   latex-decode = {
     groups = [ "default" ];
     platforms = [ ];
@@ -333,20 +338,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.1";
+    version = "1.7.0";
   };
   matrix = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1h2cgkpzkh3dd0flnnwfq6f3nl2b1zff9lvqz8xs853ssv5kq23i";
+      sha256 = "0nscas3a4mmrp1rc07cdjlbbpb2rydkindmbj3v3z5y1viyspmd0";
       type = "gem";
     };
-    version = "0.4.2";
+    version = "0.4.3";
   };
   mime-types = {
     dependencies = [
@@ -357,30 +362,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0r34mc3n7sxsbm9mzyzy8m3dvq7pwbryyc8m452axkj0g2axnwbg";
+      sha256 = "0mjyxl7c0xzyqdqa8r45hqg7jcw2prp3hkp39mdf223g4hfgdsyw";
       type = "gem";
     };
-    version = "3.6.0";
+    version = "3.7.0";
   };
   mime-types-data = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06dbn0j13jwdrmlvrjd50mxqrjlkh3lvxp0afh4glyzbliqvqpsd";
+      sha256 = "0a27k4jcrx7pvb0p59fn1frh14iy087c2aygrdkmgwsrbshvqxpj";
       type = "gem";
     };
-    version = "3.2024.1001";
+    version = "3.2025.0924";
   };
   mini_portile2 = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q1f2sdw3y3y9mnym9dhjgsjr72sq975cfg5c4yx7gwv8nmzbvhk";
+      sha256 = "12f2830x7pq3kj0v8nz0zjvaw02sv01bqs1zwdrc04704kwcgmqc";
       type = "gem";
     };
-    version = "2.8.7";
+    version = "2.8.9";
   };
   namae = {
     dependencies = [ "racc" ];
@@ -402,10 +407,35 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15gysw8rassqgdq3kwgl4mhqmrgh7nk2qvrcqp4ijyqazgywn6gq";
+      sha256 = "1hcwwr2h8jnqqxmf8mfb52b0dchr7pm064ingflb78wa00qhgk6m";
       type = "gem";
     };
-    version = "1.16.7";
+    version = "1.18.10";
+  };
+  observer = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b2h1642jy1xrgyakyzz6bkq43gwp8yvxrs8sww12rms65qi18yq";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
+  open-uri = {
+    dependencies = [
+      "stringio"
+      "time"
+      "uri"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jl7i0w0vhxpvj54707cpcpqi00maf1dma0mxmm99rirmkyhckvv";
+      type = "gem";
+    };
+    version = "0.5.0";
   };
   pdf-core = {
     groups = [ "default" ];
@@ -429,10 +459,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0n0pp7blk3np3fqsb54l34fsamrww80cp3dhlhskfayg7542mrv1";
+      sha256 = "11h8dhhd2c8mxssibk9q6qn7ilj4p71crlfirw8pppn8pr85f0n5";
       type = "gem";
     };
-    version = "2.12.0";
+    version = "2.15.0";
   };
   polyglot = {
     groups = [ "default" ];
@@ -515,20 +545,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0vqcw3iwby3yc6avs1vb3gfd0vcp2v7q310665dvxfswmcf4xm31";
+      sha256 = "1543ap9w3ydhx39ljcd675cdz9cr948x9mp00ab8qvq6118wv9xz";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.2";
   };
   "pygments.rb" = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14xhvfnj188pypy6pxj29hrn60pznv6dc4ycdgyd6jv2d769wwj1";
+      sha256 = "0mzfxkzvgyrj9g6471mxa6d1jy59fsds9mfkx1balpng50xb12zl";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "4.0.0";
   };
   racc = {
     groups = [ "default" ];
@@ -566,20 +596,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1j9p66pmfgxnzp76ksssyfyqqrg7281dyi3xyknl3wwraaw7a66p";
+      sha256 = "0hninnbvqd2pn40h863lbrn9p11gvdxp928izkag5ysx8b1s5q0r";
       type = "gem";
     };
-    version = "3.3.9";
+    version = "3.4.4";
   };
   rouge = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0r0b48945hakgy0y7lg6h1bb7pkfz8jqd0r6777f80ij3sansvbs";
+      sha256 = "1pkp5icgm7s10b2n6b2pzbdsfiv0l5sxqyizx55qdmlpaxnk8xah";
       type = "gem";
     };
-    version = "4.4.0";
+    version = "4.6.1";
   };
   ruby-rc4 = {
     groups = [ "default" ];
@@ -626,6 +656,16 @@
     };
     version = "4.0.0";
   };
+  stringio = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1v74k5yw7ndikr53wgbjn6j51p83qnzqbn9z4b53r102jcx3ri4r";
+      type = "gem";
+    };
+    version = "3.1.8";
+  };
   thread_safe = {
     groups = [ "default" ];
     platforms = [ ];
@@ -636,16 +676,27 @@
     };
     version = "0.3.6";
   };
+  time = {
+    dependencies = [ "date" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0qgarmdyqypzsaanf4w9vqrd9axrcrjqilxwrfmxp954102kcpq3";
+      type = "gem";
+    };
+    version = "0.4.1";
+  };
   treetop = {
     dependencies = [ "polyglot" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0adc8qblz8ii668r3rksjx83p675iryh52rvdvysimx2hkbasj7d";
+      sha256 = "1nl3q5ai7ikaa5sjdbspfa4njbrdvf7898zkplmalln6y4r3y153";
       type = "gem";
     };
-    version = "1.6.12";
+    version = "1.6.18";
   };
   ttfunk = {
     groups = [ "default" ];
@@ -657,4 +708,14 @@
     };
     version = "1.7.0";
   };
+  uri = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ijpbj7mdrq7rhpq2kb51yykhrs2s54wfs6sm9z3icgz4y6sb7rp";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
 }
diff --git a/pkgs/by-name/aw/await/package.nix b/pkgs/by-name/aw/await/package.nix
index 836d04605c63..989f78b7f187 100644
--- a/pkgs/by-name/aw/await/package.nix
+++ b/pkgs/by-name/aw/await/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "await";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "slavaGanzin";
     repo = "await";
     tag = version;
-    hash = "sha256-UfEjcf8NuLRzu/57aS738Do/lXzYX5lrus1xgZ7dask=";
+    hash = "sha256-MpdP4OJvxjF8zbKQ1YGVrtcC8RKxDNHDA90tWvLDQbU=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/br/browsers/package.nix b/pkgs/by-name/br/browsers/package.nix
index 00315961502c..ad0227477728 100644
--- a/pkgs/by-name/br/browsers/package.nix
+++ b/pkgs/by-name/br/browsers/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "browsers";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "Browsers-software";
     repo = "browsers";
     tag = finalAttrs.version;
-    hash = "sha256-1RWGAEiSJWDoScKuUB5LL1tQyTw5NRnld7Fi93vP0BA=";
+    hash = "sha256-QrIE9buG46JDxGFI6tjxzMizic82Az61MgMhKU854bY=";
   };
 
-  cargoHash = "sha256-M1KAZPjNu4j5b5Ml2J9OHpD+/jeF8WRP6EzfmLnb0hY=";
+  cargoHash = "sha256-JZoc5EwOXgv50LblYjEW8tsD4roJ6uZYuCbVzXdaKSY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/bu/budgie-media-player-applet/package.nix b/pkgs/by-name/bu/budgie-media-player-applet/package.nix
index 4e42ee0e6482..7315b6065be6 100644
--- a/pkgs/by-name/bu/budgie-media-player-applet/package.nix
+++ b/pkgs/by-name/bu/budgie-media-player-applet/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "budgie-media-player-applet";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "zalesyc";
     repo = "budgie-media-player-applet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FTc/cl4qjVYx45SuZPizOGC09JERIuifCo86+Tqu5hk=";
+    hash = "sha256-Ekt6OXSjqKF4d6a9lmZyUa06pqz1uYkCHbzvLM7Z+W8=";
   };
 
   strictDeps = true;
@@ -44,17 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    # The meson option actually enables libpeas2 support
-    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/749
-    "-Dfor-wayland=true"
+    "-Dbudgie-api-v2=true"
   ];
 
   postPatch = ''
     substituteInPlace meson.build --replace-fail "/usr" "$out"
-
-    # https://github.com/zalesyc/budgie-media-player-applet/issues/25
-    substituteInPlace src/{applet,testWin,Popover,BudgieMediaPlayer}.py \
-      --replace-fail "gi.require_version('Budgie', '1.0')" "gi.require_version('Budgie', '2.0')"
   '';
 
   postFixup = ''
diff --git a/pkgs/by-name/bu/burpsuite/package.nix b/pkgs/by-name/bu/burpsuite/package.nix
index 66909bb23fcc..7e3e869b3b5d 100644
--- a/pkgs/by-name/bu/burpsuite/package.nix
+++ b/pkgs/by-name/bu/burpsuite/package.nix
@@ -9,20 +9,20 @@
 }:
 
 let
-  version = "2025.11.1";
+  version = "2025.11.2";
 
   product =
     if proEdition then
       {
         productName = "pro";
         productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-vtei5zzfbsfO3W6IIs15y4Ef+mLK9BlaNl+4wT8wEmw=";
+        hash = "sha256-uI3xjh1z4g9+ZjjbXi4CLoKT+9y2rbu8u8rqD9+aOFA=";
       }
     else
       {
         productName = "community";
         productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-WzURPRMr8EgBMqxp9w10gHDEyqAVcejUif0TKdxDZr4=";
+        hash = "sha256-XZgG6BfA2O4gZfy+dYuc5yzpe+sHPjthzvexBb4YWcQ=";
       };
 
   src = fetchurl {
diff --git a/pkgs/by-name/cl/cloud-hypervisor/package.nix b/pkgs/by-name/cl/cloud-hypervisor/package.nix
index 61934b2a2bb4..86b9a1aabd0c 100644
--- a/pkgs/by-name/cl/cloud-hypervisor/package.nix
+++ b/pkgs/by-name/cl/cloud-hypervisor/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   rustPlatform,
   pkg-config,
   dtc,
@@ -19,6 +20,19 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-bPPs/4XMcvOH4BGfQrjQdvgjGWae4UEZjzPKjalDN3w=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "vsock-seccomp-Rust-1.90.patch";
+      url = "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/ec57aade1563075e37b8e9ccc0b85fe2c04a54b8.patch";
+      hash = "sha256-M+I+ZbiNDV1a8Y46+/mPTyDlQgQS7G6ytvPgli0NhJ0=";
+    })
+    (fetchpatch {
+      name = "vfio-user-seccomp-Rust-1.90.patch";
+      url = "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/95b8c6afdd6eec9810243f92ec1956dccfe305da.patch";
+      hash = "sha256-kCP/Fu0Dg+GdnwyFQLqZWKlbqO9w4KRJcbV4sReSDYM=";
+    })
+  ];
+
   cargoHash = "sha256-5EK9V9yiF/UjmlYSKBIJgQOA1YU33ezicLikWYnKFAo=";
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/co/converseen/package.nix b/pkgs/by-name/co/converseen/package.nix
index 036047bc1e61..12837bf02e0c 100644
--- a/pkgs/by-name/co/converseen/package.nix
+++ b/pkgs/by-name/co/converseen/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "converseen";
-  version = "0.15.1.0";
+  version = "0.15.1.2";
 
   src = fetchFromGitHub {
     owner = "Faster3ck";
     repo = "Converseen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-loWwwleiBgwV/6t33HgIqEHU9y/pqyocmwBn0Qg01RY=";
+    hash = "sha256-GHx3mMDhPT3RCcJxu+v63m7Orn6G01hENvWzP/Aqxho=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/de/deadlock-mod-manager/disable-update-notice.patch b/pkgs/by-name/de/deadlock-mod-manager/disable-update-notice.patch
new file mode 100644
index 000000000000..c1eeed4555eb
--- /dev/null
+++ b/pkgs/by-name/de/deadlock-mod-manager/disable-update-notice.patch
@@ -0,0 +1,20 @@
+diff --git a/apps/desktop/src/app.tsx b/apps/desktop/src/app.tsx
+index 70dcbe5ff5..91ac4deb73 100644
+--- a/apps/desktop/src/app.tsx
++++ b/apps/desktop/src/app.tsx
+@@ -68,14 +68,6 @@
+                     <Outlet />
+                   </Layout>
+                   <GlobalPluginRenderer />
+-                  <UpdateDialog
+-                    downloadProgress={downloadProgress}
+-                    isDownloading={isDownloading}
+-                    onOpenChange={handleDismiss}
+-                    onUpdate={handleUpdate}
+-                    open={showUpdateDialog}
+-                    update={update}
+-                  />
+                   <OnboardingWizard
+                     open={showOnboarding}
+                     onComplete={completeOnboarding}
+
diff --git a/pkgs/by-name/de/deadlock-mod-manager/no-updater-artifacts.patch b/pkgs/by-name/de/deadlock-mod-manager/no-updater-artifacts.patch
new file mode 100644
index 000000000000..dd28c3a93fa8
--- /dev/null
+++ b/pkgs/by-name/de/deadlock-mod-manager/no-updater-artifacts.patch
@@ -0,0 +1,12 @@
+diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
+index ed05fce..e1649e0 100644
+--- a/apps/desktop/src-tauri/tauri.conf.json
++++ b/apps/desktop/src-tauri/tauri.conf.json
+@@ -31,7 +31,6 @@
+       }
+     },
+     "active": true,
+-    "createUpdaterArtifacts": true,
+     "targets": "all",
+     "icon": [
+       "icons/32x32.png",
\ No newline at end of file
diff --git a/pkgs/by-name/de/deadlock-mod-manager/package.nix b/pkgs/by-name/de/deadlock-mod-manager/package.nix
new file mode 100644
index 000000000000..9cd54269c38c
--- /dev/null
+++ b/pkgs/by-name/de/deadlock-mod-manager/package.nix
@@ -0,0 +1,136 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  cargo-tauri,
+  nodejs,
+  pnpm_9,
+  pkg-config,
+  wrapGAppsHook3,
+  desktop-file-utils,
+  webkitgtk_4_1,
+  cairo,
+  gdk-pixbuf,
+  glib,
+  glib-networking,
+  gtk3,
+  libsoup_3,
+  pango,
+  openssl,
+  bzip2,
+  gst_all_1,
+  makeDesktopItem,
+  fontconfig,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "deadlock-mod-manager";
+  version = "0.10.1";
+
+  src = fetchFromGitHub {
+    owner = "deadlock-mod-manager";
+    repo = "deadlock-mod-manager";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/84P9ONG25Ia1BnRcbzQuJKt8HwstCzf0bkx1Xc9VgU=";
+  };
+
+  cargoRoot = "apps/desktop";
+  buildAndTestSubdir = finalAttrs.cargoRoot;
+
+  cargoHash = "sha256-wVsr6GwCGuuveTDT6oS1keejx+y+oSuE6dGAjvNRrdE=";
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    cargo-tauri.hook
+    nodejs
+    pnpm_9.configHook
+    pkg-config
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    webkitgtk_4_1
+    cairo
+    gdk-pixbuf
+    glib
+    glib-networking
+    gtk3
+    libsoup_3
+    pango
+    openssl
+    bzip2
+    desktop-file-utils
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+  ];
+
+  pnpmRoot = ".";
+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      ;
+    fetcherVersion = 2;
+    sourceRoot = "source";
+    hash = "sha256-7HhMW28hl2hHi8epcKMTbfuVjKYj+U1N/d2tMcu4aQg=";
+  };
+
+  patches = [
+    ./no-updater-artifacts.patch
+    ./disable-update-notice.patch
+  ];
+
+  VITE_API_URL = "https://api.deadlockmods.app";
+
+  # Skip tests that require network access
+  checkFlags = [
+    "--skip=download_manager::downloader::tests::test_download_file"
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --set FONTCONFIG_FILE "${fontconfig.out}/etc/fonts/fonts.conf"
+      --set TAURI_DIST_DIR "$out/share/deadlock-modmanager/dist"
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1
+      --set WEBKIT_DISABLE_DMABUF_RENDERER 1
+      --set DISABLE_UPDATE_DESKTOP_DATABASE 1
+      --prefix PATH : ${lib.makeBinPath [ desktop-file-utils ]}
+    )
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      desktopName = "deadlock-mod-manager";
+      name = "Deadlock Mod Manager";
+      exec = "deadlock-mod-manager %u";
+      terminal = false;
+      type = "Application";
+      icon = "deadlock-mod-manager";
+      mimeTypes = [ "x-scheme-handler/deadlock-mod-manager" ];
+      categories = [
+        "Utility"
+        "Game"
+      ];
+    })
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Mod manager for the Valve game Deadlock";
+    homepage = "https://github.com/deadlock-mod-manager/deadlock-mod-manager";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      mistyttm
+      schromp
+    ];
+    platforms = lib.platforms.linux;
+    mainProgram = "deadlock-mod-manager";
+  };
+})
diff --git a/pkgs/by-name/do/dopamine/package.nix b/pkgs/by-name/do/dopamine/package.nix
index 50a0011e28d2..dfe44b9574d4 100644
--- a/pkgs/by-name/do/dopamine/package.nix
+++ b/pkgs/by-name/do/dopamine/package.nix
@@ -3,6 +3,7 @@
   fetchurl,
   appimageTools,
   nix-update-script,
+  makeWrapper,
 }:
 appimageTools.wrapType2 rec {
   pname = "dopamine";
@@ -13,11 +14,16 @@ appimageTools.wrapType2 rec {
     hash = "sha256-kvXan5J+rxJ/ugcEz9xytq3eQG0saWrYZjF7O1d6rTA=";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   extraInstallCommands =
     let
       contents = appimageTools.extract { inherit pname version src; };
     in
     ''
+      wrapProgram $out/bin/${pname} \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
+
       install -Dm644 ${contents}/dopamine.desktop $out/share/applications/dopamine.desktop
       substituteInPlace $out/share/applications/dopamine.desktop \
         --replace-fail 'Exec=AppRun' 'Exec=dopamine'
diff --git a/pkgs/by-name/dr/dracula-theme/package.nix b/pkgs/by-name/dr/dracula-theme/package.nix
index 2f7d4fb39e6d..a2e4bbc048fc 100644
--- a/pkgs/by-name/dr/dracula-theme/package.nix
+++ b/pkgs/by-name/dr/dracula-theme/package.nix
@@ -8,7 +8,7 @@
 
 let
   themeName = "Dracula";
-  version = "4.0.0-unstable-2025-11-11";
+  version = "4.0.0-unstable-2025-11-20";
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "4d8e487dd47ad388b0bd1d9b019a8b70b72f4f78";
-    hash = "sha256-ZE1P883H1o0Gq+3a0w/eRkYajz7GQfjl1BX9Q67hfuE=";
+    rev = "c04b3531f8db463cbc0481546f4477e455908473";
+    hash = "sha256-eT0j//ALSqyhHMOBqTYtr9z/erov8IKHDd697vybMAo=";
   };
 
   propagatedUserEnvPkgs = [
diff --git a/pkgs/by-name/dr/draupnir/hashes.json b/pkgs/by-name/dr/draupnir/hashes.json
index 33fee0206f5a..124552236d9f 100644
--- a/pkgs/by-name/dr/draupnir/hashes.json
+++ b/pkgs/by-name/dr/draupnir/hashes.json
@@ -1,3 +1,3 @@
 {
-  "yarn_offline_cache_hash": "sha256-EZ8dVRfzAFr8wepLuS90YHvAi9BA+4etVz+Vji+bQVA="
+  "yarn_offline_cache_hash": "sha256-kTdJ6zKNjH5CxcM9EvXzbz2Phrp5xI0+pvNwMLRmLgQ="
 }
diff --git a/pkgs/by-name/dr/draupnir/package.json b/pkgs/by-name/dr/draupnir/package.json
index 6df29ee41a44..e5610787dbb7 100644
--- a/pkgs/by-name/dr/draupnir/package.json
+++ b/pkgs/by-name/dr/draupnir/package.json
@@ -1,6 +1,6 @@
 {
   "name": "draupnir",
-  "version": "2.7.1",
+  "version": "2.8.0",
   "description": "A moderation tool for Matrix",
   "main": "lib/index.js",
   "repository": "https://github.com/the-draupnir-project/Draupnir.git",
@@ -64,7 +64,7 @@
     "jsdom": "^24.0.0",
     "matrix-appservice-bridge": "^10.3.1",
     "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.7.1-element.6",
-    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@4.1.0",
+    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@5.1.0",
     "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@4.0.2",
     "pg": "^8.8.0",
     "yaml": "^2.3.2"
diff --git a/pkgs/by-name/dr/draupnir/package.nix b/pkgs/by-name/dr/draupnir/package.nix
index 5d0a5b02e3de..7d4c113cd481 100644
--- a/pkgs/by-name/dr/draupnir/package.nix
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -22,13 +22,13 @@ let
 in
 mkYarnPackage rec {
   pname = "draupnir";
-  version = "2.7.1";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "the-draupnir-project";
     repo = "Draupnir";
     tag = "v${version}";
-    hash = "sha256-PJg+ybWe7mtLgqrBZP0xKeKWc2FPv7koyjsHyK5uRKs=";
+    hash = "sha256-I9DYiNxD95pzHVsgZ/hJwHfrsVqE/eBALNiePVNDpy0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/drawio/headless.nix b/pkgs/by-name/dr/drawio-headless/package.nix
similarity index 94%
rename from pkgs/applications/graphics/drawio/headless.nix
rename to pkgs/by-name/dr/drawio-headless/package.nix
index 42dac38fe048..6fd3ff4a93a5 100644
--- a/pkgs/applications/graphics/drawio/headless.nix
+++ b/pkgs/by-name/dr/drawio-headless/package.nix
@@ -30,14 +30,14 @@ writeTextFile {
     XDG_CONFIG_HOME="$tmpdir" ${xvfb-run}/bin/xvfb-run --auto-display ${drawio}/bin/drawio $@
   '';
 
-  meta = with lib; {
+  meta = {
     description = "xvfb wrapper around drawio";
     longDescription = ''
       A wrapper around drawio (draw.io) for running in headless environments.
       Runs drawio under xvfb-run, with configuration going to a temporary
       directory.
     '';
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       qyliss
       tfc
     ];
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/by-name/dr/drawio/package.nix
similarity index 88%
rename from pkgs/applications/graphics/drawio/default.nix
rename to pkgs/by-name/dr/drawio/package.nix
index 974c5869b55c..f34850f7c99b 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/by-name/dr/drawio/package.nix
@@ -7,32 +7,33 @@
   copyDesktopItems,
   fixup-yarn-lock,
   makeWrapper,
-  autoSignDarwinBinariesHook,
+  darwin,
   nodejs,
   yarn,
   electron,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "drawio";
-  version = "26.1.1";
+  version = "29.0.3";
 
   src = fetchFromGitHub {
     owner = "jgraph";
     repo = "drawio-desktop";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-h9APkOtH7s31r89hqqH12zYqkVMrR2ZxMyc+Zwq21+A=";
+    hash = "sha256-YVkGt096Vy1s/ZjvuWUWVE2eiaI7Wg/YdWSueTsKzEg=";
   };
 
   # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
   postPatch = ''
-    sed -i -e 's/resetAdHocDarwinSignature:.*/resetAdHocDarwinSignature: false,/' build/fuses.cjs
+    substituteInPlace ./build/fuses.cjs \
+      --replace-fail "resetAdHocDarwinSignature:" "// resetAdHocDarwinSignature:"
   '';
 
   offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
-    hash = "sha256-kmA0z/vmWH+yD2OQ6VVSE0yPxInTAGjjG+QfcoZHlQ0=";
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-/CzHvGUKhB2RBaz+LVXaHr5q6KLkQR0asFZRruOUmqU=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +46,7 @@ stdenv.mkDerivation rec {
     copyDesktopItems
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    autoSignDarwinBinariesHook
+    darwin.autoSignDarwinBinariesHook
   ];
 
   ELECTRON_SKIP_BINARY_DOWNLOAD = true;
@@ -77,7 +78,7 @@ stdenv.mkDerivation rec {
   ''
   + ''
     yarn --offline run electron-builder --dir \
-      ${lib.optionalString stdenv.hostPlatform.isDarwin "--config electron-builder-linux-mac.json"} \
+      ${lib.optionalString stdenv.hostPlatform.isDarwin "--config electron-builder-linux-mac.json --config.mac.identity=null"} \
       -c.electronDist=${if stdenv.hostPlatform.isDarwin then "." else electron.dist} \
       -c.electronVersion=${electron.version}
 
@@ -137,9 +138,9 @@ stdenv.mkDerivation rec {
       # The minified code authored by us in this repo is licensed under an Apache v2 license, but the sources to build those files are not in this repo. This is not an open source project.
       unfreeRedistributable
     ];
-    changelog = "https://github.com/jgraph/drawio-desktop/releases/tag/v${version}";
+    changelog = "https://github.com/jgraph/drawio-desktop/releases/tag/v${finalAttrs.version}";
     maintainers = with lib.maintainers; [ darkonion0 ];
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
     mainProgram = "drawio";
   };
-}
+})
diff --git a/pkgs/by-name/ef/efmt/package.nix b/pkgs/by-name/ef/efmt/package.nix
index e9c2c1489829..8707cd65a18e 100644
--- a/pkgs/by-name/ef/efmt/package.nix
+++ b/pkgs/by-name/ef/efmt/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "efmt";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "sile";
     repo = "efmt";
     rev = version;
-    hash = "sha256-l+DiOMUTEF6btsgkfgDtY45fH6GyqKBqHjuTfCF/ybA=";
+    hash = "sha256-cRiYOJiBIRHm9s3EFhRNTvLXw66Svu1vc4ipWYKDo1s=";
   };
 
-  cargoHash = "sha256-NJ49DqJW0qgM1dPOzlwMP9+JEfa1/YxvgMm4WmJ0mFA=";
+  cargoHash = "sha256-Wb8SNPsubhVyfIzcPjkqauforLmhNlfas4KwD/l40sI=";
 
   meta = {
     description = "Erlang code formatter";
diff --git a/pkgs/by-name/ex/exfatprogs/package.nix b/pkgs/by-name/ex/exfatprogs/package.nix
index dec77d11b738..b58605e751de 100644
--- a/pkgs/by-name/ex/exfatprogs/package.nix
+++ b/pkgs/by-name/ex/exfatprogs/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     description = "exFAT filesystem userspace utilities";
     homepage = "https://github.com/exfatprogs/exfatprogs";
     license = licenses.gpl2Plus;
-    maintainers = [ ];
+    maintainers = with maintainers; [ yuannan ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/fc/fcitx5-pinyin-zhwiki/package.nix b/pkgs/by-name/fc/fcitx5-pinyin-zhwiki/package.nix
index 809f255647ad..d0107a5a725c 100644
--- a/pkgs/by-name/fc/fcitx5-pinyin-zhwiki/package.nix
+++ b/pkgs/by-name/fc/fcitx5-pinyin-zhwiki/package.nix
@@ -5,20 +5,36 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fcitx5-pinyin-zhwiki";
-  version = "0.2.5";
-  date = "20250823";
+  version = "0.3.0";
+  date = "20251104";
 
-  src = fetchurl {
-    url = "https://github.com/felixonmars/fcitx5-pinyin-zhwiki/releases/download/${finalAttrs.version}/zhwiki-${finalAttrs.date}.dict";
-    hash = "sha256-cD0FKxPvdQfcrfR/Fh4aNb+pK/IFiFLyvg8LhnYI+vs=";
-  };
+  srcs = [
+    (fetchurl {
+      url = "https://github.com/felixonmars/fcitx5-pinyin-zhwiki/releases/download/${finalAttrs.version}/web-slang-${finalAttrs.date}.dict";
+      hash = "sha256-MI0gqLxtgV5gnSFI5nqFTKt0UTQec/VNKgfhptOTBo8=";
+    })
+    (fetchurl {
+      url = "https://github.com/felixonmars/fcitx5-pinyin-zhwiki/releases/download/${finalAttrs.version}/zhwiki-${finalAttrs.date}.dict";
+      hash = "sha256-bYp4HRUeXMUO7bkjmhp9nfotnBvyVRIROSeT7VapAKc=";
+    })
+    (fetchurl {
+      url = "https://github.com/felixonmars/fcitx5-pinyin-zhwiki/releases/download/${finalAttrs.version}/zhwikisource-${finalAttrs.date}.dict";
+      hash = "sha256-oxNebop+zFPMkk9swunPCl3XZG4smMw0p9ytaSdEFVE=";
+    })
+    (fetchurl {
+      url = "https://github.com/felixonmars/fcitx5-pinyin-zhwiki/releases/download/${finalAttrs.version}/zhwiktionary-${finalAttrs.date}.dict";
+      hash = "sha256-xizpn53RPXlQYnB7Eyqg0mOOO8DAZTWZzDHT3wrboPE=";
+    })
+  ];
 
   dontUnpack = true;
 
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 $src $out/share/fcitx5/pinyin/dictionaries/zhwiki.dict
+    for dict in $srcs; do
+      install -D $dict $out/share/fcitx5/pinyin/dictionaries/$(basename $(stripHash $dict) | sed 's/-[0-9]\{8\}//')
+    done
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/fr/free42/package.nix b/pkgs/by-name/fr/free42/package.nix
index acf6e0a7355e..87335369dc90 100644
--- a/pkgs/by-name/fr/free42/package.nix
+++ b/pkgs/by-name/fr/free42/package.nix
@@ -1,24 +1,21 @@
 {
   lib,
   stdenv,
-  fetchFromGitea,
+  fetchurl,
   alsa-lib,
   copyDesktopItems,
   wrapGAppsHook3,
   makeDesktopItem,
   pkg-config,
+  nix-update-script,
 }:
-
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "free42";
-  version = "3.3.8";
+  version = "3.3.10";
 
-  src = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "thomasokken";
-    repo = "free42";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-L6WZM5/+ujM6hv85ppt9YiqHLkd0vYFx3nFVcJwzEBM=";
+  src = fetchurl {
+    url = "https://thomasokken.com/free42/upstream/free42-nologo-${version}.tgz";
+    hash = "sha256-Vh+Sh3oX1ICy0R6R4zu9Df2+ba2mM33qHtifINNpn7Y=";
   };
 
   nativeBuildInputs = [
@@ -30,19 +27,20 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [ alsa-lib ];
 
   postPatch = ''
-    sed -i -e "s|/bin/ls|ls|" gtk/Makefile
+    substituteInPlace gtk/Makefile \
+      --replace-fail /bin/ls ls
   '';
 
   dontConfigure = true;
 
   desktopItems = [
     (makeDesktopItem {
-      name = "com.thomasokken.free42bin";
+      name = "free42bin";
       desktopName = "Free42Bin";
       genericName = "Calculator";
       exec = "free42bin";
       type = "Application";
-      comment = "A software clone of HP-42S Calculator";
+      comment = "Software clone of the HP-42S calculator";
       icon = "free42";
       categories = [
         "Utility"
@@ -50,12 +48,12 @@ stdenv.mkDerivation (finalAttrs: {
       ];
     })
     (makeDesktopItem {
-      name = "com.thomasokken.free42dec";
+      name = "free42dec";
       desktopName = "Free42Dec";
       genericName = "Calculator";
       exec = "free42dec";
       type = "Application";
-      comment = "A software clone of HP-42S Calculator";
+      comment = "Software clone of the HP-42S calculator";
       icon = "free42";
       categories = [
         "Utility"
@@ -68,9 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preBuild
 
     make -C gtk cleaner
-    make --jobs=$NIX_BUILD_CORES -C gtk
+    make --jobs=$NIX_BUILD_CORES -C gtk AUDIO_ALSA=1
     make -C gtk clean
-    make --jobs=$NIX_BUILD_CORES -C gtk BCD_MATH=1
+    make --jobs=$NIX_BUILD_CORES -C gtk AUDIO_ALSA=1 BCD_MATH=1
 
     runHook postBuild
   '';
@@ -87,20 +85,36 @@ stdenv.mkDerivation (finalAttrs: {
     install -m755 gtk/free42dec gtk/free42bin $out/bin
     install -m644 README $out/share/doc/free42/README
 
-    install -m644 gtk/icon-48x48.xpm $out/share/icons/hicolor/48x48/apps/free42.xpm
-    install -m644 gtk/icon-128x128.xpm $out/share/icons/hicolor/128x128/apps/free42.xpm
+    install -m644 gtk/icon-48x48.png $out/share/icons/hicolor/48x48/apps/free42.png
+    install -m644 gtk/icon-128x128.png $out/share/icons/hicolor/128x128/apps/free42.png
     install -m644 skins/* $out/share/free42/skins
 
     runHook postInstall
   '';
 
+  dontWrapGApps = true;
+
+  postFixup = ''
+    wrapProgram $out/bin/free42dec \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ alsa-lib ]} \
+      "''${gappsWrapperArgs[@]}"
+
+    wrapProgram $out/bin/free42bin \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ alsa-lib ]} \
+      "''${gappsWrapperArgs[@]}"
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--url=https://codeberg.org/thomasokken/free42" ];
+  };
+
   meta = {
     homepage = "https://thomasokken.com/free42/";
     changelog = "https://thomasokken.com/free42/history.html";
-    description = "Software clone of HP-42S Calculator";
+    description = "Software clone of the HP-42S calculator";
     license = with lib.licenses; [ gpl2Only ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ elfenermarcell ];
     mainProgram = "free42dec";
     platforms = with lib.platforms; unix;
   };
-})
+}
diff --git a/pkgs/by-name/gh/ghalint/package.nix b/pkgs/by-name/gh/ghalint/package.nix
new file mode 100644
index 000000000000..d03de74a3625
--- /dev/null
+++ b/pkgs/by-name/gh/ghalint/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "ghalint";
+  version = "1.5.3";
+
+  src = fetchFromGitHub {
+    owner = "suzuki-shunsuke";
+    repo = "ghalint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zll71vSqSKIij/TUi4LnGtVqmLhK9UViFDkpnuEvmz8=";
+  };
+
+  vendorHash = "sha256-pCrVBgS7eLCYlfY6FyAGAeEhpV2dYQowtE/BoRUju0o=";
+
+  subPackages = [ "cmd/ghalint" ];
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=v${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd 'ghalint' \
+      --bash <("$out/bin/ghalint" completion bash) \
+      --zsh <("$out/bin/ghalint" completion zsh) \
+      --fish <("$out/bin/ghalint" completion fish)
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";
+
+  meta = {
+    homepage = "https://github.com/suzuki-shunsuke/ghalint";
+    description = "GitHub Actions linter for security best practice";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ryota2357 ];
+    mainProgram = "ghalint";
+  };
+})
diff --git a/pkgs/by-name/gi/git-credential-email/git-credential-aol/default.nix b/pkgs/by-name/gi/git-credential-email/git-credential-aol/default.nix
new file mode 100644
index 000000000000..3a5409093f6b
--- /dev/null
+++ b/pkgs/by-name/gi/git-credential-email/git-credential-aol/default.nix
@@ -0,0 +1,11 @@
+{
+  lib,
+  callPackage,
+}:
+
+callPackage ../package.nix {
+  pname = "git-credential-aol";
+  scripts = [ "git-credential-aol" ];
+  description = "Git credential helper for AOL accounts";
+  license = lib.licenses.asl20;
+}
diff --git a/pkgs/by-name/gi/git-credential-email/git-credential-gmail/default.nix b/pkgs/by-name/gi/git-credential-email/git-credential-gmail/default.nix
new file mode 100644
index 000000000000..1ceedb5bc7c6
--- /dev/null
+++ b/pkgs/by-name/gi/git-credential-email/git-credential-gmail/default.nix
@@ -0,0 +1,11 @@
+{
+  lib,
+  callPackage,
+}:
+
+callPackage ../package.nix {
+  pname = "git-credential-gmail";
+  scripts = [ "git-credential-gmail" ];
+  description = "Git credential helper for Gmail accounts";
+  license = lib.licenses.asl20;
+}
diff --git a/pkgs/by-name/gi/git-credential-email/git-credential-outlook/default.nix b/pkgs/by-name/gi/git-credential-email/git-credential-outlook/default.nix
new file mode 100644
index 000000000000..a73a1001a0e3
--- /dev/null
+++ b/pkgs/by-name/gi/git-credential-email/git-credential-outlook/default.nix
@@ -0,0 +1,11 @@
+{
+  lib,
+  callPackage,
+}:
+
+callPackage ../package.nix {
+  pname = "git-credential-outlook";
+  scripts = [ "git-credential-outlook" ];
+  description = "Git credential helper for Microsoft Outlook accounts";
+  license = lib.licenses.asl20;
+}
diff --git a/pkgs/by-name/gi/git-credential-email/git-credential-yahoo/default.nix b/pkgs/by-name/gi/git-credential-email/git-credential-yahoo/default.nix
new file mode 100644
index 000000000000..038edad27a18
--- /dev/null
+++ b/pkgs/by-name/gi/git-credential-email/git-credential-yahoo/default.nix
@@ -0,0 +1,11 @@
+{
+  lib,
+  callPackage,
+}:
+
+callPackage ../package.nix {
+  pname = "git-credential-yahoo";
+  scripts = [ "git-credential-yahoo" ];
+  description = "Git credential helper for Yahoo accounts";
+  license = lib.licenses.asl20;
+}
diff --git a/pkgs/by-name/gi/git-credential-email/git-msgraph/default.nix b/pkgs/by-name/gi/git-credential-email/git-msgraph/default.nix
new file mode 100644
index 000000000000..2de1cd6ee85b
--- /dev/null
+++ b/pkgs/by-name/gi/git-credential-email/git-msgraph/default.nix
@@ -0,0 +1,11 @@
+{
+  lib,
+  callPackage,
+}:
+
+callPackage ../package.nix {
+  pname = "git-msgraph";
+  scripts = [ "git-msgraph" ];
+  description = "Git helper to use Microsoft Graph API instead of SMTP to send emails";
+  license = lib.licenses.asl20;
+}
diff --git a/pkgs/by-name/gi/git-credential-email/git-protonmail/default.nix b/pkgs/by-name/gi/git-credential-email/git-protonmail/default.nix
new file mode 100644
index 000000000000..0e2b53f496d1
--- /dev/null
+++ b/pkgs/by-name/gi/git-credential-email/git-protonmail/default.nix
@@ -0,0 +1,11 @@
+{
+  lib,
+  callPackage,
+}:
+
+callPackage ../package.nix {
+  pname = "git-protonmail";
+  scripts = [ "git-protonmail" ];
+  description = "Git helper to use ProtonMail API to send emails";
+  license = lib.licenses.gpl3Only;
+}
diff --git a/pkgs/by-name/gi/git-credential-email/package.nix b/pkgs/by-name/gi/git-credential-email/package.nix
new file mode 100644
index 000000000000..0e853cd058d0
--- /dev/null
+++ b/pkgs/by-name/gi/git-credential-email/package.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  withOpencv ? false,
+  withPyqt6 ? builtins.elem "git-protonmail" scripts,
+  withQrcode ? true,
+  pname ? "git-credential-email",
+  scripts ? [
+    "git-credential-aol"
+    "git-credential-gmail"
+    "git-credential-outlook"
+    "git-credential-yahoo"
+    "git-msgraph"
+    "git-protonmail"
+  ],
+  description ? "Git credential helpers for Microsoft Outlook, Gmail, Yahoo, AOL and Proton Mail accounts",
+  license ? with lib.licenses; [
+    asl20
+    gpl3Only
+  ],
+}:
+
+let
+  withProtonmail = builtins.elem "git-protonmail" scripts;
+in
+python3Packages.buildPythonApplication rec {
+  inherit pname;
+  version = "5.5.2";
+
+  src = fetchFromGitHub {
+    owner = "AdityaGarg8";
+    repo = "git-credential-email";
+    tag = "v${version}";
+    hash = "sha256-N4w339MvIOronA4MKS4ipLpQt+0xo+JVbgKWFYP2zP0=";
+  };
+
+  dependencies =
+    with python3Packages;
+    [
+      keyring
+      requests
+    ]
+    ++ lib.optionals withPyqt6 [ pyqt6 ]
+    ++ lib.optionals withQrcode [ qrcode ]
+    ++ lib.optionals withProtonmail [
+      bcrypt
+      cryptography
+      pgpy
+      requests-toolbelt
+      typing-extensions
+    ]
+    ++ lib.optionals (withProtonmail && withOpencv) [ opencv4 ];
+
+  pyproject = false;
+
+  installPhase = ''
+    install -D -t $out/bin ${lib.concatStringsSep " " scripts}
+  '';
+
+  meta = {
+    inherit description license;
+    homepage = "https://github.com/AdityaGarg8/git-credential-email";
+    changelog = "https://github.com/AdityaGarg8/git-credential-email/releases/tag/${src.tag}";
+    maintainers = with lib.maintainers; [ sephalon ];
+  };
+}
diff --git a/pkgs/by-name/gi/git-spice/package.nix b/pkgs/by-name/gi/git-spice/package.nix
index 7a6e9e4dcbc7..5d154c1cd570 100644
--- a/pkgs/by-name/gi/git-spice/package.nix
+++ b/pkgs/by-name/gi/git-spice/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-spice";
-  version = "0.20.1";
+  version = "0.20.2";
 
   src = fetchFromGitHub {
     owner = "abhinav";
     repo = "git-spice";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1kZJM1XNlpJetfJ73fbhVuav8vG9EMQs618P4ftY3eg=";
+    hash = "sha256-YC6nLDOBvLEw07UdgmGgFX3w91/qqK+CiDw2K+eMk7Q=";
   };
 
   vendorHash = "sha256-CXCp61iBBhANFjmFybRWQ5cj/JKOfzHX2xjLzJ4IQTc=";
diff --git a/pkgs/by-name/gn/gnome-secrets/package.nix b/pkgs/by-name/gn/gnome-secrets/package.nix
index 97f30f26bc83..31406b14275b 100644
--- a/pkgs/by-name/gn/gnome-secrets/package.nix
+++ b/pkgs/by-name/gn/gnome-secrets/package.nix
@@ -7,29 +7,40 @@
   fetchFromGitLab,
   python3Packages,
   wrapGAppsHook4,
+  opensc,
   gtk4,
   glib,
   gdk-pixbuf,
   gobject-introspection,
   desktop-file-utils,
+  shared-mime-info,
   appstream-glib,
   libadwaita,
+  gtksourceview5,
+  xvfb-run,
   nix-update-script,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "gnome-secrets";
-  version = "10.4";
-  format = "other";
+  version = "12.0";
+  pyproject = false;
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "secrets";
-    rev = version;
-    hash = "sha256-FyBtw7Gkvd5XONkM7OVGxE+S5FpuUIl7KWLFHoQeoN4=";
+    tag = version;
+    hash = "sha256-U+ez/rhaXROcLdXhFY992YzIRBCkR05hxkAYbWIpa/A=";
   };
 
+  postPatch = ''
+    substituteInPlace gsecrets/meson.build \
+      --replace-fail \
+        "join_paths(get_option('prefix'), get_option('libdir'), 'opensc-pkcs11.so')" \
+        "'${lib.getLib opensc}/lib/opensc-pkcs11.so'"
+  '';
+
   nativeBuildInputs = [
     meson
     ninja
@@ -37,6 +48,7 @@ python3Packages.buildPythonApplication rec {
     pkg-config
     wrapGAppsHook4
     desktop-file-utils
+    shared-mime-info
     appstream-glib
     gobject-introspection
   ];
@@ -46,11 +58,13 @@ python3Packages.buildPythonApplication rec {
     glib
     gdk-pixbuf
     libadwaita
+    gtksourceview5
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
     pygobject3
     construct
+    pyhibp
     pykcs11
     pykeepass
     pyotp
@@ -59,24 +73,40 @@ python3Packages.buildPythonApplication rec {
     zxcvbn-rs-py
   ];
 
+  doCheck = true;
+
+  nativeCheckInputs = [
+    python3Packages.pytest
+    xvfb-run
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    env \
+      GTK_A11Y=none \
+      PYTHONPATH="$out/${python3Packages.python.sitePackages}:$PYTHONPATH" \
+      XDG_DATA_DIRS="$out/share/gsettings-schemas/$name:$XDG_DATA_DIRS" \
+      xvfb-run meson test --print-errorlogs
+    runHook postCheck
+  '';
+
   # Prevent double wrapping, let the Python wrapper use the args in preFixup.
   dontWrapGApps = true;
 
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
 
   passthru = {
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Password manager for GNOME which makes use of the KeePass v.4 format";
     homepage = "https://gitlab.gnome.org/World/secrets";
-    license = licenses.gpl3Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ mvnetbiz ];
-    teams = [ teams.gnome-circle ];
+    changelog = "https://gitlab.gnome.org/World/secrets/-/releases/${version}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ mvnetbiz ];
+    teams = [ lib.teams.gnome-circle ];
     mainProgram = "secrets";
   };
 }
diff --git a/pkgs/by-name/go/golden-cheetah/package.nix b/pkgs/by-name/go/golden-cheetah/package.nix
index 021f016f8245..700d2c3b7621 100644
--- a/pkgs/by-name/go/golden-cheetah/package.nix
+++ b/pkgs/by-name/go/golden-cheetah/package.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "golden-cheetah";
-  version = "3.7";
+  version = "3.7-SP1";
 
   src = fetchFromGitHub {
     owner = "GoldenCheetah";
     repo = "GoldenCheetah";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-INlkFWugIoln7wrmgLZUC/Ye8eV+mlT6BZ0ZdP7CiqE=";
+    hash = "sha256-NsXTe4Ht4TFDu7/nK3/hdCk/K2mPm59I9GHkVOTDc74=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/gp/gpsd/package.nix b/pkgs/by-name/gp/gpsd/package.nix
index da79ea9da304..5713a9bea696 100644
--- a/pkgs/by-name/gp/gpsd/package.nix
+++ b/pkgs/by-name/gp/gpsd/package.nix
@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gpsd";
-  version = "3.26.1";
+  version = "3.27";
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-3H5GWWjBVA5hvFfHWG1qV6AEchKgFO/a00j5B7wuCZA=";
+    sha256 = "sha256-YZUpLdeRC+aMtwGNRRZig+rv0/nbl3P81umnjUnqyZk=";
   };
 
   # TODO: render & install HTML documentation using asciidoctor
diff --git a/pkgs/by-name/gr/grandperspective/package.nix b/pkgs/by-name/gr/grandperspective/package.nix
index 6a9f812a12fe..f5edd1ca13b4 100644
--- a/pkgs/by-name/gr/grandperspective/package.nix
+++ b/pkgs/by-name/gr/grandperspective/package.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "3.5.1";
+  version = "3.6";
   pname = "grandperspective";
 
   src = fetchurl {
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     url = "mirror://sourceforge/grandperspectiv/GrandPerspective-${
       lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version
     }.dmg";
-    hash = "sha256-ZD6XUtsbwxHe3MYdCH9I/pYBCGgilPhhbYQChr0wCj4=";
+    hash = "sha256-DSdtaf5GN1PSIt8GTGrMUuaVI2C+ANKi78E1cxVrYTE=";
   };
 
   sourceRoot = "GrandPerspective.app";
diff --git a/pkgs/by-name/hl/hl-log-viewer/package.nix b/pkgs/by-name/hl/hl-log-viewer/package.nix
index aefbaea2efde..bc187ac8c427 100644
--- a/pkgs/by-name/hl/hl-log-viewer/package.nix
+++ b/pkgs/by-name/hl/hl-log-viewer/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hl-log-viewer";
-  version = "0.31.2";
+  version = "0.32.2";
 
   src = fetchFromGitHub {
     owner = "pamburus";
     repo = "hl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SYPzYdbrXltBk/A5T/yZo3IJXdowsHk38yL86BreF0k=";
+    hash = "sha256-JG5+RpUc8UGYxSlEX0c+dcUU2fFuVEwz/duK94XYkOc=";
   };
 
-  cargoHash = "sha256-1iBpzoTyNB6ECDuGW26JMdu2YolrPmIT040V35Pi+C4=";
+  cargoHash = "sha256-dIUQVLjjlQGHrMgWUeFc3R/QJbddRG8wmZklUHQTaas=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -31,6 +31,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installManPage hl.1
   '';
 
+  checkFlags = [
+    # test broken on zero-width TTY, see https://github.com/pamburus/hl/issues/1140
+    "--skip=help::tests::test_formatter_new"
+  ];
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ho/homebridge/package.nix b/pkgs/by-name/ho/homebridge/package.nix
index 950cc87a715c..c57be458bbf2 100644
--- a/pkgs/by-name/ho/homebridge/package.nix
+++ b/pkgs/by-name/ho/homebridge/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "homebridge";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "homebridge";
     repo = "homebridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-95wd3pVumz/KGZNjOHrSOUtI4vipeHRWK7D8e9Nzpyo=";
+    hash = "sha256-E21HowCRD78MZW3+um6vN5/NLncF/bt9v/Tw+RYe5xM=";
   };
 
-  npmDepsHash = "sha256-fcahrKJXvEMosLbcZY6x/hklmAy4Dyf65xNfFPa4OpU=";
+  npmDepsHash = "sha256-Da64zHwvX0W1viNhy4afr60onlWqbizaVox9Un6c65Y=";
 
   # Homebridge's clean phase attempts to install rimraf directly, which fails in nix builds
   # rimraf is already in the declared dependencies, so we just don't need to do it.
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index 1ad8b0db102c..4f93a29d7d5b 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -38,18 +38,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-03am9z381UozNsmWZefopMp8/tLycXJyiZ5BUGaV1kY=";
   };
 
-  # This patch ensures that the cache implementation respects the env
-  # variable `NIXPKGS_HOMEPAGE_CACHE_DIR`, which is set by default in the
-  # wrapper below.
-  # The patch is automatically generated by the `update.sh` script.
-  patches = [ ./prerender_cache_path.patch ];
-
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs)
       pname
       version
       src
-      patches
       ;
     fetcherVersion = 1;
     hash = "sha256-svkqmRFwZpcExFWtAbLL0lpHhzsI2s7RiLfQajIqjck=";
@@ -68,6 +61,26 @@ stdenv.mkDerivation (finalAttrs: {
 
   env.PYTHON = "${python3}/bin/python";
 
+  preBuild = ''
+    # patch next.js file-system-cache to use NIXPKGS_HOMEPAGE_CACHE_DIR
+    # related:
+    # * https://github.com/NixOS/nixpkgs/issues/328621 ("homepage-dashboard: Failed to update prerender cache")
+    # * https://github.com/NixOS/nixpkgs/pull/337902 ("nixos/homepage-dashboard: set an explicit cache dir")
+    # * https://github.com/NixOS/nixpkgs/issues/458494 ("homepage-dashboard: Dashboard styles are destroyed after a server restart")
+
+    # source file
+    substituteInPlace node_modules/next/dist/server/lib/incremental-cache/file-system-cache.js \
+      --replace-fail 'this.serverDistDir = ctx.serverDistDir;' \
+                     'this.serverDistDir = require("path").join((process.env.NIXPKGS_HOMEPAGE_CACHE_DIR || "/var/cache/homepage-dashboard"), "homepage");'
+
+    # bundled runtimes
+    for bundle in node_modules/next/dist/compiled/next-server/*.runtime.prod.js; do
+      substituteInPlace "$bundle" \
+        --replace-fail 'this.serverDistDir=e.serverDistDir' \
+                       'this.serverDistDir=(process.env.NIXPKGS_HOMEPAGE_CACHE_DIR||"/var/cache/homepage-dashboard")+"/homepage"'
+    done
+  '';
+
   buildPhase = ''
     runHook preBuild
     mkdir -p config
diff --git a/pkgs/by-name/ho/homepage-dashboard/prerender_cache_path.patch b/pkgs/by-name/ho/homepage-dashboard/prerender_cache_path.patch
deleted file mode 100644
index 4601e59ec3f6..000000000000
--- a/pkgs/by-name/ho/homepage-dashboard/prerender_cache_path.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-diff --git a/package.json b/package.json
-index 927674f3..e7d45ae6 100644
---- a/package.json
-+++ b/package.json
-@@ -67,6 +67,9 @@
-     "onlyBuiltDependencies": [
-       "osx-temperature-sensor",
-       "sharp"
--    ]
-+    ],
-+    "patchedDependencies": {
-+      "next": "patches/next.patch"
-+    }
-   }
- }
-diff --git a/patches/next.patch b/patches/next.patch
-new file mode 100644
-index 00000000..39b17f16
---- /dev/null
-+++ b/patches/next.patch
-@@ -0,0 +1,13 @@
-+diff --git a/dist/server/lib/incremental-cache/file-system-cache.js b/dist/server/lib/incremental-cache/file-system-cache.js
-+index cc2cc2506668435d817eaa9f0aa32b568b6aa331..26f0321efcadb4f4255dbd660825759721e799eb 100644
-+--- a/dist/server/lib/incremental-cache/file-system-cache.js
-++++ b/dist/server/lib/incremental-cache/file-system-cache.js
-+@@ -24,7 +24,7 @@ class FileSystemCache {
-+     constructor(ctx){
-+         this.fs = ctx.fs;
-+         this.flushToDisk = ctx.flushToDisk;
-+-        this.serverDistDir = ctx.serverDistDir;
-++        this.serverDistDir = require("path").join((process.env.NIXPKGS_HOMEPAGE_CACHE_DIR || "/var/cache/homepage-dashboard"), "homepage");
-+         this.revalidatedTags = ctx.revalidatedTags;
-+         if (ctx.maxMemoryCacheSize) {
-+             if (!FileSystemCache.memoryCache) {
-diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index 2765fe04..11dc6a81 100644
---- a/pnpm-lock.yaml
-+++ b/pnpm-lock.yaml
-@@ -4,6 +4,11 @@ settings:
-   autoInstallPeers: true
-   excludeLinksFromLockfile: false
- 
-+patchedDependencies:
-+  next:
-+    hash: 9fc5fd5a09692f0ba1ffb8a979978da9595ed6c3f9bcb0a01205f20fdc39b68c
-+    path: patches/next.patch
-+
- importers:
- 
-   .:
-@@ -52,10 +57,10 @@ importers:
-         version: 1.2.2
-       next:
-         specifier: ^15.5.2
--        version: 15.5.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-+        version: 15.5.2(patch_hash=9fc5fd5a09692f0ba1ffb8a979978da9595ed6c3f9bcb0a01205f20fdc39b68c)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-       next-i18next:
-         specifier: ^12.1.0
--        version: 12.1.0(next@15.5.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-+        version: 12.1.0(next@15.5.2(patch_hash=9fc5fd5a09692f0ba1ffb8a979978da9595ed6c3f9bcb0a01205f20fdc39b68c)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-       ping:
-         specifier: ^0.4.4
-         version: 0.4.4
-@@ -5243,7 +5248,7 @@ snapshots:
- 
-   net@1.0.2: {}
- 
--  next-i18next@12.1.0(next@15.5.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
-+  next-i18next@12.1.0(next@15.5.2(patch_hash=9fc5fd5a09692f0ba1ffb8a979978da9595ed6c3f9bcb0a01205f20fdc39b68c)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
-     dependencies:
-       '@babel/runtime': 7.26.9
-       '@types/hoist-non-react-statics': 3.3.6
-@@ -5251,14 +5256,14 @@ snapshots:
-       hoist-non-react-statics: 3.3.2
-       i18next: 21.10.0
-       i18next-fs-backend: 1.2.0
--      next: 15.5.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-+      next: 15.5.2(patch_hash=9fc5fd5a09692f0ba1ffb8a979978da9595ed6c3f9bcb0a01205f20fdc39b68c)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-       react: 18.3.1
-       react-i18next: 11.18.6(i18next@21.10.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
-     transitivePeerDependencies:
-       - react-dom
-       - react-native
- 
--  next@15.5.2(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
-+  next@15.5.2(patch_hash=9fc5fd5a09692f0ba1ffb8a979978da9595ed6c3f9bcb0a01205f20fdc39b68c)(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
-     dependencies:
-       '@next/env': 15.5.2
-       '@swc/helpers': 0.5.15
diff --git a/pkgs/by-name/ho/homepage-dashboard/update.sh b/pkgs/by-name/ho/homepage-dashboard/update.sh
index b18faed937bb..ddef0cf3b193 100755
--- a/pkgs/by-name/ho/homepage-dashboard/update.sh
+++ b/pkgs/by-name/ho/homepage-dashboard/update.sh
@@ -1,34 +1,10 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl jq git nodejs pnpm sd
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq git
 # shellcheck shell=bash
 set -euo pipefail
 nixpkgs="$(pwd)"
 cd $(readlink -e $(dirname "${BASH_SOURCE[0]}"))
 
-# Generate the patch file that makes homepage-dashboard aware of the NIXPKGS_HOMEPAGE_CACHE_DIR environment variable.
-# Generating the patch this way ensures that both the patch is included, and the lock file is updated.
-generate_patch() {
-    local version; version="$1"
-    echo "Generating homepage-dashboard patch"
-
-    git clone -b "v$version" https://github.com/gethomepage/homepage.git src
-    pushd src
-
-    pnpm install
-    pnpm patch next
-    sd \
-      'this.serverDistDir = ctx.serverDistDir;' \
-      'this.serverDistDir = require("path").join((process.env.NIXPKGS_HOMEPAGE_CACHE_DIR || "/var/cache/homepage-dashboard"), "homepage");' \
-      node_modules/.pnpm_patches/next*/dist/server/lib/incremental-cache/file-system-cache.js
-    pnpm patch-commit node_modules/.pnpm_patches/next*
-
-    git add -A .
-    git diff -p --staged --no-ext-diff > ../prerender_cache_path.patch
-
-    popd
-    rm -rf src
-}
-
 # Update the hash of the homepage-dashboard source code in the Nix expression.
 update_homepage_dashboard_source() {
     local version; version="$1"
@@ -62,5 +38,4 @@ if [[ "$CURRENT_VERSION" == "$LATEST_VERSION" ]]; then
 fi
 
 update_homepage_dashboard_source "$LATEST_VERSION"
-generate_patch "$LATEST_VERSION"
 update_pnpm_deps_hash
diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index 7d9b1fc37905..f43f4beb1a7f 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inputplumber";
-  version = "0.67.1";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${version}";
-    hash = "sha256-6eoZhW6gPpVUcTbZ8wGPIDJHs8rVcjo42y9RGVeckag=";
+    hash = "sha256-nnHRdqX5q9WSu8d/jwTgelncCVs1UnV8Z0aae42KUls=";
   };
 
-  cargoHash = "sha256-nquIe596MFg0JU6xpyBJzXKrXfakuQ1iLMnqDKa0DKk=";
+  cargoHash = "sha256-yfZzkVALrD/dgANS4O/JCJPgepzMmqYMQ087Fmtlw68=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/io/iotas/package.nix b/pkgs/by-name/io/iotas/package.nix
index eb3c7776c320..84e6817f3cf5 100644
--- a/pkgs/by-name/io/iotas/package.nix
+++ b/pkgs/by-name/io/iotas/package.nix
@@ -20,7 +20,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "iotas";
-  version = "0.11.2";
+  version = "0.12.5";
   pyproject = false;
 
   src = fetchFromGitLab {
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "World";
     repo = "iotas";
     tag = version;
-    hash = "sha256-nDmofssoaB3BKh6X3Lpi5xftyo9Zw3IUoD3wte0wPM4=";
+    hash = "sha256-qbUI2hkW3rRiiBWFADuB9KFMf6Maw+WAkdy6dTE+Yo0=";
   };
 
   nativeBuildInputs = [
@@ -59,7 +59,6 @@ python3.pkgs.buildPythonApplication rec {
     linkify-it-py
     mdit-py-plugins
     pypandoc
-    strenum
     packaging
   ];
 
diff --git a/pkgs/by-name/ko/korrect/package.nix b/pkgs/by-name/ko/korrect/package.nix
index 40a66a0fc3ba..5b8e4004afe9 100644
--- a/pkgs/by-name/ko/korrect/package.nix
+++ b/pkgs/by-name/ko/korrect/package.nix
@@ -9,13 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "korrect";
-  version = "0.2.1";
+  version = "0.3.3";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-/tFrHTZ6YHnN9OvoHBJWEnwX780DYrs0f5wV1dPyAcc=";
+    hash = "sha256-iEbzYcWxDAumGLsr7MlqOrTEj3SwGFmdvw15M5Fz9cs=";
   };
-  cargoHash = "sha256-bG31pqI/eB+J0FUq/lWak6Ekf+00JiCfuKZdyUkIAAw=";
+  cargoHash = "sha256-RIa1rn74I/DQktjtY4BTWiYIBO1aLpXcKtXMBOAogvE=";
+
+  # Tests create a local http server to check the download functionality
+  __darwinAllowLocalNetworking = true;
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/li/libmnl/package.nix b/pkgs/by-name/li/libmnl/package.nix
index 4c6502e617c0..d43676f1af15 100644
--- a/pkgs/by-name/li/libmnl/package.nix
+++ b/pkgs/by-name/li/libmnl/package.nix
@@ -4,13 +4,13 @@
   fetchurl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libmnl";
   version = "1.0.5";
 
   src = fetchurl {
-    url = "https://netfilter.org/projects/libmnl/files/${pname}-${version}.tar.bz2";
-    sha256 = "09851ns07399rbz0y8slrlmnw3fn1nakr8d37pxjn5gkks8rnjr7";
+    url = "https://netfilter.org/projects/libmnl/files/libmnl-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-J0ubkZ7zFSv7PaOhPJUN1g1uK81UIw/+yimNA7QNBSU=";
   };
 
   meta = {
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
       libmnl is a minimalistic user-space library oriented to Netlink developers.
       There are a lot of common tasks in parsing, validating, constructing of both the Netlink
       header and TLVs that are repetitive and easy to get wrong.
-      This library aims to provide simple helpers that allows you to re-use code and to avoid
+      This library aims to provide simple helpers that allow you to re-use code and avoid
       re-inventing the wheel.
     '';
     homepage = "https://netfilter.org/projects/libmnl/index.html";
     license = lib.licenses.lgpl21Plus;
-
     platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ azey7f ];
   };
-}
+})
diff --git a/pkgs/by-name/li/librime/package.nix b/pkgs/by-name/li/librime/package.nix
index 0fe02f722c0f..00247f4005e8 100644
--- a/pkgs/by-name/li/librime/package.nix
+++ b/pkgs/by-name/li/librime/package.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "librime";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "rime";
     repo = "librime";
     rev = version;
-    sha256 = "sha256-dks8Ab2YQ8t4hZRneMP9aU0VFZgIg+meh8RI0pp0lR0=";
+    sha256 = "sha256-B3mhHv8fk8TGXu+jJSYJ2R8QW+nG5RJx6kFtP5ILhYY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 4ac2e7aef289..9dd5841c6298 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -114,7 +114,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       johnrtitor
       lzcunt
-      phip1611
       prince213
       programmerlexi
       surfaceflinger
diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index a16ded48d771..949549975b71 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.700";
+  version = "0.701";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-tZbpSKwiXLk6Aw5VusPnPT+4pGyURqC9hmr0jiiKMg4=";
+    hash = "sha256-8Zla+iPARPPbNN3l7Bc96KguhxboPYj21yVYC0u6LlY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/lx/lxgw-neoxihei/package.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
index 8a261b6c1ab5..a332f253b8c2 100644
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.227";
+  version = "1.228";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-7EJlMgY++YrUQ9BKZLOft1isc8EHuOLVoORMLMPngTI=";
+    hash = "sha256-1RCcvlgbOE06DIgBALq2PJxipGVFonhQJcFr03dOEzc=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index fa44e80bc787..188f8dcbed29 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -119,10 +119,9 @@ rustPlatform.buildRustPackage rec {
           ''
             export HOME=$(mktemp -d)
 
-            spec="$(mise usage)"
             for shl in bash fish zsh; do
               echo "testing $shl"
-              usage complete-word --shell $shl --spec "$spec"
+              usage complete-word --shell $shl --file <(mise usage)
             done
 
             touch $out
diff --git a/pkgs/by-name/mo/moor/package.nix b/pkgs/by-name/mo/moor/package.nix
index db72b4c94bd2..00cafbae722c 100644
--- a/pkgs/by-name/mo/moor/package.nix
+++ b/pkgs/by-name/mo/moor/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vnK/Lo/CK39gsX2FyXoB0Q7FpJ5+5AZrpVxCBkuupOQ=";
+    hash = "sha256-+gNM/yqoEZ0JUieRsdGCpO5MG+Jtaxwi114PQEhaMiY=";
   };
 
-  vendorHash = "sha256-FNkXrmNV8Gj2gAJX9a3wXiJ36/9edQFMIc6eAR9AYRU=";
+  vendorHash = "sha256-KTAckjrOZVwl6UBFmbqqMjUyYJDQxySxWiV46QNTfuY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/mp/mprisence/package.nix b/pkgs/by-name/mp/mprisence/package.nix
index 3b0e73538034..0a2c4d9797c5 100644
--- a/pkgs/by-name/mp/mprisence/package.nix
+++ b/pkgs/by-name/mp/mprisence/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mprisence";
-  version = "1.2.13";
+  version = "1.2.14";
 
   src = fetchFromGitHub {
     owner = "lazykern";
     repo = "mprisence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZOkgBwph0BQVbDhKCTMd0/On2Hti2FleRVhDx1HlwVk=";
+    hash = "sha256-prRnDQvBewgeaHZGonwnRHoVgbSgo9FINsUu4LoI078=";
   };
 
-  cargoHash = "sha256-SocWijJA2Io7AzOyM2miUCFG5rD2zCfYJrON/Q7yTaw=";
+  cargoHash = "sha256-yL6b6X7OHuiILDowTsWdvTvftO2p6KmfmFQ1UxHjsAg=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/mu/mutt/package.nix b/pkgs/by-name/mu/mutt/package.nix
index 49d75313f582..bd51921ae338 100644
--- a/pkgs/by-name/mu/mutt/package.nix
+++ b/pkgs/by-name/mu/mutt/package.nix
@@ -31,7 +31,7 @@ assert gpgmeSupport -> sslSupport;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.2.15";
+  version = "2.2.16";
   outputs = [
     "out"
     "doc"
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    hash = "sha256-pRaGEE5CA/TCo7F2UnvjuV0I6AjpT9LcrbfDBWa/iU0=";
+    hash = "sha256-HTEJp0OtiyXu+XEJsr20Zdt4N9Co0hHNOIvhtvqsPzI=";
   };
 
   patches = [
diff --git a/pkgs/by-name/nb/nbstripout/package.nix b/pkgs/by-name/nb/nbstripout/package.nix
index bf20d661f371..ba1d39cc1e0f 100644
--- a/pkgs/by-name/nb/nbstripout/package.nix
+++ b/pkgs/by-name/nb/nbstripout/package.nix
@@ -9,13 +9,13 @@
 }:
 
 python3.pkgs.buildPythonApplication rec {
-  version = "0.8.1";
+  version = "0.8.2";
   pyproject = true;
   pname = "nbstripout";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6qyLa05yno3+Hl3ywPi6RKvFoXplRI8EgBQfgL4jC7E=";
+    hash = "sha256-KHZTDraEv5OltI/m2SshY/eNBAchx2s31bnhUU04/Gk=";
   };
 
   testAssets = fetchFromGitHub {
diff --git a/pkgs/by-name/ne/net-news-wire/package.nix b/pkgs/by-name/ne/net-news-wire/package.nix
index 4534554b77ef..b0e0ed97afb2 100644
--- a/pkgs/by-name/ne/net-news-wire/package.nix
+++ b/pkgs/by-name/ne/net-news-wire/package.nix
@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "net-news-wire";
-  version = "6.1.9";
+  version = "6.2";
 
   src = fetchurl {
     url = "https://github.com/Ranchero-Software/NetNewsWire/releases/download/mac-${version}/NetNewsWire${version}.zip";
-    hash = "sha256-wG1/EpsK1CMXDTM/WlNFBBUVq6IUSj0GEkqY5Azf/ls=";
+    hash = "sha256-DXpC2bXgFRKYULXlrkDkwxtU77iChh5SITAIEQC5exQ=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/ne/netbootxyz-efi/package.nix b/pkgs/by-name/ne/netbootxyz-efi/package.nix
index 8da395b55f74..28af5219a34e 100644
--- a/pkgs/by-name/ne/netbootxyz-efi/package.nix
+++ b/pkgs/by-name/ne/netbootxyz-efi/package.nix
@@ -2,16 +2,32 @@
   lib,
   stdenv,
   fetchurl,
-  nix-update-script,
 }:
-
+let
+  version = "2.0.88";
+  platformMap = {
+    aarch64-linux = {
+      url = "https://github.com/netbootxyz/netboot.xyz/releases/download/${version}/netboot.xyz-arm64.efi";
+      hash = "sha256-AeW92FU65XVJKGPi+A/iz7Jvtb7wKIO3xG3Cx7v4kRg=";
+    };
+    x86_64-linux = {
+      url = "https://github.com/netbootxyz/netboot.xyz/releases/download/${version}/netboot.xyz.efi";
+      hash = "sha256-ipbZJ0mPCuwzb/TDtXXUBTuWOcSsKGAJ1GEGIgB2G7E=";
+    };
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "netboot.xyz-efi";
-  version = "2.0.88";
+  inherit version;
 
   src = fetchurl {
-    url = "https://github.com/netbootxyz/netboot.xyz/releases/download/${finalAttrs.version}/netboot.xyz.efi";
-    hash = "sha256-ipbZJ0mPCuwzb/TDtXXUBTuWOcSsKGAJ1GEGIgB2G7E=";
+    inherit
+      (platformMap.${stdenv.hostPlatform.system}
+        or (throw "Unsupported system: ${stdenv.hostPlatform.system}")
+      )
+      url
+      hash
+      ;
   };
 
   dontUnpack = true;
@@ -20,12 +36,14 @@ stdenv.mkDerivation (finalAttrs: {
     cp $src $out
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = ./update.sh;
 
   meta = {
     homepage = "https://netboot.xyz/";
     description = "Tool to boot OS installers and utilities over the network, to be run from a bootloader";
     license = lib.licenses.asl20;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    platforms = builtins.attrNames platformMap;
     maintainers = with lib.maintainers; [ pinpox ];
   };
 })
diff --git a/pkgs/by-name/ne/netbootxyz-efi/update.sh b/pkgs/by-name/ne/netbootxyz-efi/update.sh
new file mode 100755
index 000000000000..9d7dbe4779e5
--- /dev/null
+++ b/pkgs/by-name/ne/netbootxyz-efi/update.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-update
+
+set -eou pipefail
+
+version="$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location "https://api.github.com/repos/netbootxyz/netboot.xyz/releases/latest" | jq --raw-output .tag_name)"
+
+nix-update --version "$version" --system x86_64-linux netbootxyz-efi
+nix-update --version skip --system aarch64-linux netbootxyz-efi
diff --git a/pkgs/by-name/ni/nixbit/package.nix b/pkgs/by-name/ni/nixbit/package.nix
index e769c7f247b1..59b5100cad3c 100644
--- a/pkgs/by-name/ni/nixbit/package.nix
+++ b/pkgs/by-name/ni/nixbit/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nixbit";
-  version = "0.2.3";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "pbek";
     repo = "nixbit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mraZeNl3EegOCgRrhp3p1D0hUJ4RNJpDW37/4BasLNM=";
+    hash = "sha256-EaL+ekvvnKZM7fdfuzNz9Ddq7k0HN3ZGW8JpyVyNV9c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/no/nomachine-client/package.nix b/pkgs/by-name/no/nomachine-client/package.nix
index a99a102f6170..810019694abf 100644
--- a/pkgs/by-name/no/nomachine-client/package.nix
+++ b/pkgs/by-name/no/nomachine-client/package.nix
@@ -9,10 +9,10 @@
   libpulseaudio,
 }:
 let
-  versionMajor = "8.13";
-  versionMinor = "1";
-  versionBuild_x86_64 = "1";
-  versionBuild_i686 = "1";
+  versionMajor = "9.2";
+  versionMinor = "18";
+  versionBuild_x86_64 = "3";
+  versionBuild_i686 = "3";
 in
 stdenv.mkDerivation rec {
   pname = "nomachine-client";
@@ -22,12 +22,12 @@ stdenv.mkDerivation rec {
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_x86_64}_x86_64.tar.gz";
-        sha256 = "sha256-8rxlxdtGU8avpvYJr+bpnsy5v91sqtlij/MCGWrcanY=";
+        sha256 = "sha256-/ElNG6zIOdE3Qwf/si9fKXMLxM81ZmRZmvbc6rw/M0c=";
       }
     else if stdenv.hostPlatform.system == "i686-linux" then
       fetchurl {
         url = "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_i686}_i686.tar.gz";
-        sha256 = "sha256-Ekyxc4wODjqWhp0aINhaPGLy9lh6Rt9AmxIt1ulE8Go=";
+        sha256 = "sha256-uLkBprPjYyWN0jwB6rJwG1sLbIg/jAjx57joLBhVwr0=";
       }
     else
       throw "NoMachine client is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/by-name/no/nova-password/package.nix b/pkgs/by-name/no/nova-password/package.nix
index ab7e136c73ed..fe972300a888 100644
--- a/pkgs/by-name/no/nova-password/package.nix
+++ b/pkgs/by-name/no/nova-password/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "nova-password";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchFromGitHub {
     owner = "sapcc";
     repo = "nova-password";
     tag = "v${version}";
-    hash = "sha256-+RW+uJ9mLEiNMGYio+FcAJHvga8uzDLmgcylwoUJIho=";
+    hash = "sha256-73o/dSS/cmLnie4Rbc3FOzRS2clw17GI7gk2nW1u3/I=";
   };
 
-  vendorHash = "sha256-7Hg5s3yZezLVwoUoeF4125QtjeLSCcsjnCD6+zbMz8I=";
+  vendorHash = "sha256-8eBS4kczObQZksK/bS/guv8nBNY0DInJ4Dk1Hlr2B7A=";
 
   meta = {
     description = "Decrypt the admin password generated for the VM in OpenStack";
diff --git a/pkgs/by-name/op/openrct2/package.nix b/pkgs/by-name/op/openrct2/package.nix
index 5285de166ca2..1fd52f89940f 100644
--- a/pkgs/by-name/op/openrct2/package.nix
+++ b/pkgs/by-name/op/openrct2/package.nix
@@ -34,18 +34,18 @@
 }:
 
 let
-  openrct2-version = "0.4.28";
+  openrct2-version = "0.4.29";
 
   # Those versions MUST match the pinned versions within the CMakeLists.txt
   # file. The REPLAYS repository from the CMakeLists.txt is not necessary.
-  objects-version = "1.7.3";
+  objects-version = "1.7.5";
   openmsx-version = "1.6.1";
   opensfx-version = "1.0.6";
   title-sequences-version = "0.4.26";
 
   objects = fetchurl {
     url = "https://github.com/OpenRCT2/objects/releases/download/v${objects-version}/objects.zip";
-    hash = "sha256-yBApJkV4cG7R24hmXhKnClg+cdxNPrTbJiU10vBYnqs=";
+    hash = "sha256-yLnTA5qSD2fK8VsJ6DEsxPgNWe1/4CiGJbnM7e9gZ5c=";
   };
   openmsx = fetchurl {
     url = "https://github.com/OpenRCT2/OpenMusic/releases/download/v${openmsx-version}/openmusic.zip";
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenRCT2";
     repo = "OpenRCT2";
     tag = "v${openrct2-version}";
-    hash = "sha256-/sgvlfJ3aMqpv5hJNzmnpOq7Bx0BTtGzLOMKGA543O8=";
+    hash = "sha256-Udwqn8RFXaUmgbA3rXH/WZTK88HbHEQucsbDP51Oe7g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openvi/package.nix b/pkgs/by-name/op/openvi/package.nix
index db796fed81cc..cad4277a4777 100644
--- a/pkgs/by-name/op/openvi/package.nix
+++ b/pkgs/by-name/op/openvi/package.nix
@@ -2,24 +2,29 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  pkg-config,
   ncurses,
   perl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "openvi";
-  version = "7.6.31";
+  version = "7.7.32";
 
   src = fetchFromGitHub {
     owner = "johnsonjh";
     repo = "OpenVi";
-    rev = version;
-    hash = "sha256-RqmulYHQFZmTHQAYgZmB8tAG6mSquNODmssfKB8YqDU=";
+    tag = finalAttrs.version;
+    hash = "sha256-kLULaKEefMpNLANnVdWAZeH+2KY5gEWGce6vJ/R7HAI=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
-    ncurses
     perl
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    ncurses
   ];
 
   makeFlags = [
@@ -30,6 +35,12 @@ stdenv.mkDerivation rec {
     "IUSGR=$(USER)"
   ];
 
+  # Don't include ncurses header, but link against ncurses
+  # openvi requires GNU ncurses symbols, but ncurses headers
+  # is incompatible with macOS wchar.h, resulting in
+  # "error: expected function body after function declarator"
+  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-L${lib.getLib ncurses}/lib -lncursesw";
+
   enableParallelBuilding = true;
 
   meta = {
@@ -40,4 +51,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ aleksana ];
     mainProgram = "ovi";
   };
-}
+})
diff --git a/pkgs/by-name/pg/pg-schema-diff/package.nix b/pkgs/by-name/pg/pg-schema-diff/package.nix
new file mode 100644
index 000000000000..f4848d0857ff
--- /dev/null
+++ b/pkgs/by-name/pg/pg-schema-diff/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  postgresql,
+}:
+buildGoModule (finalAttrs: {
+  pname = "pg-schema-diff";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner = "stripe";
+    repo = "pg-schema-diff";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-u0niTTqrzsI4u0OGY5qkgbitadcbEK/ElFGnPJsEMwo=";
+  };
+
+  nativeCheckInputs = [
+    postgresql
+  ];
+
+  vendorHash = "sha256-Hs3xrGP8eJwW3rQ9nViB9sqC8spjHV6rCoy1u/SYHak=";
+
+  meta = {
+    description = "Go library for diffing Postgres schemas and generating SQL migrations";
+    homepage = "https://github.com/stripe/pg-schema-diff";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.bitbloxhub ];
+    mainProgram = "pg-schema-diff";
+  };
+})
diff --git a/pkgs/by-name/pi/pinact/package.nix b/pkgs/by-name/pi/pinact/package.nix
index c6dda5fc0f3a..41c837a8e432 100644
--- a/pkgs/by-name/pi/pinact/package.nix
+++ b/pkgs/by-name/pi/pinact/package.nix
@@ -13,16 +13,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "pinact";
-  version = "3.4.2";
+  version = "3.4.4";
 
   src = fetchFromGitHub {
     owner = "suzuki-shunsuke";
     repo = "pinact";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-O+yLhvkF84uCrgb5MPvk8i/YJ4tLR7YQvBAYbpnxwEM=";
+    hash = "sha256-UHKlj85TGMaiS3/nHA72KevmwoDhiULFaJonHSEFzpQ=";
   };
 
-  vendorHash = "sha256-A9bMAGaNvCKfSozBwhrJLgQUrCLN78Og3eCmezsJ6c8=";
+  vendorHash = "sha256-GN/RiXNjwBwsA/ai5j550RAWOI7x0pv1cM/Q0AfIOyk=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/pl/plasma-panel-spacer-extended/package.nix b/pkgs/by-name/pl/plasma-panel-spacer-extended/package.nix
index 45799ab80eba..046ea2f3b06d 100644
--- a/pkgs/by-name/pl/plasma-panel-spacer-extended/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-spacer-extended/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-spacer-extended";
-  version = "1.11.3";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-spacer-extended";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FJbRKL/jALKxS97uVftyKwjSUhADtHv/hgOJA5VvGNQ=";
+    hash = "sha256-Tg+HvGuPCgnCkW/biY/zFuuLCokK3WaobAjNVLw9Qf0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/plus42/package.nix b/pkgs/by-name/pl/plus42/package.nix
new file mode 100644
index 000000000000..b17df6a77af1
--- /dev/null
+++ b/pkgs/by-name/pl/plus42/package.nix
@@ -0,0 +1,120 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  alsa-lib,
+  copyDesktopItems,
+  wrapGAppsHook3,
+  makeDesktopItem,
+  pkg-config,
+  nix-update-script,
+}:
+stdenv.mkDerivation rec {
+  pname = "plus42";
+  version = "1.3.12";
+
+  src = fetchurl {
+    url = "https://thomasokken.com/plus42/upstream/plus42-upstream-${version}.tgz";
+    hash = "sha256-IBXQu1hI0bJZISL9wInAzf2z8zbynXXP15oG/od+MC8=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    pkg-config
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [ alsa-lib ];
+
+  postPatch = ''
+    substituteInPlace gtk/Makefile \
+      --replace-fail /bin/ls ls
+  '';
+
+  dontConfigure = true;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "plus42bin";
+      desktopName = "Plus42Bin";
+      genericName = "Calculator";
+      exec = "plus42bin";
+      type = "Application";
+      comment = "Software clone of the HP-42S calculator (enhanced version)";
+      icon = "plus42";
+      categories = [
+        "Utility"
+        "Calculator"
+      ];
+    })
+    (makeDesktopItem {
+      name = "plus42dec";
+      desktopName = "Plus42Dec";
+      genericName = "Calculator";
+      exec = "plus42dec";
+      type = "Application";
+      comment = "Software clone of the HP-42S calculator (enhanced version)";
+      icon = "plus42";
+      categories = [
+        "Utility"
+        "Calculator"
+      ];
+    })
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    make -C gtk cleaner
+    make --jobs=$NIX_BUILD_CORES -C gtk AUDIO_ALSA=1
+    make -C gtk clean
+    make --jobs=$NIX_BUILD_CORES -C gtk AUDIO_ALSA=1 BCD_MATH=1
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install --directory $out/bin \
+                        $out/share/doc/plus42 \
+                        $out/share/plus42/skins \
+                        $out/share/icons/hicolor/48x48/apps \
+                        $out/share/icons/hicolor/128x128/apps
+
+    install -m755 gtk/plus42dec gtk/plus42bin $out/bin
+    install -m644 README $out/share/doc/plus42/README
+
+    install -m644 gtk/icon-48x48.png $out/share/icons/hicolor/48x48/apps/plus42.png
+    install -m644 gtk/icon-128x128.png $out/share/icons/hicolor/128x128/apps/plus42.png
+    install -m644 skins/* $out/share/plus42/skins
+
+    runHook postInstall
+  '';
+
+  dontWrapGApps = true;
+
+  postFixup = ''
+    wrapProgram $out/bin/plus42dec \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ alsa-lib ]} \
+      "''${gappsWrapperArgs[@]}"
+
+    wrapProgram $out/bin/plus42bin \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ alsa-lib ]} \
+      "''${gappsWrapperArgs[@]}"
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--url=https://codeberg.org/thomasokken/plus42desktop" ];
+  };
+
+  meta = {
+    homepage = "https://thomasokken.com/plus42/";
+    changelog = "https://thomasokken.com/plus42/history.html";
+    description = "Software clone of the HP-42S calculator (enhanced version)";
+    license = with lib.licenses; [ gpl2Only ];
+    maintainers = with lib.maintainers; [ elfenermarcell ];
+    mainProgram = "plus42dec";
+    platforms = with lib.platforms; unix;
+  };
+}
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index 4b71a8464bae..74d743260233 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -15,7 +15,7 @@
   go-md2man,
   nixosTests,
   python3,
-  makeWrapper,
+  makeBinaryWrapper,
   symlinkJoin,
   replaceVars,
   extraPackages ? [ ],
@@ -39,55 +39,20 @@
   coreutils,
   runtimeShell,
 }:
-let
-  # do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
-
-  binPath = lib.makeBinPath (
-    lib.optionals stdenv.hostPlatform.isLinux [
-      fuse-overlayfs
-      util-linuxMinimal
-      iptables
-      iproute2
-      nftables
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      vfkit
-    ]
-    ++ extraPackages
-  );
-
-  helpersBin = symlinkJoin {
-    name = "podman-helper-binary-wrapper";
-
-    # this only works for some binaries, others may need to be added to `binPath` or in the modules
-    paths = [
-      gvproxy
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      aardvark-dns
-      catatonit # added here for the pause image and also set in `containersConf` for `init_path`
-      netavark
-      passt
-      conmon
-      crun
-    ]
-    ++ extraRuntimes;
-  };
-in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "podman";
   version = "5.7.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-SHIWfY8eKdimwpLfB1NtpF1DBh6qaR5KCDTU4vWAMFw=";
   };
 
   patches = [
     (replaceVars ./hardcode-paths.patch {
-      bin_path = helpersBin;
+      bin_path = finalAttrs.passthru.helpersBin;
     })
 
     # we intentionally don't build and install the helper so we shouldn't display messages to users about it
@@ -107,7 +72,7 @@ buildGoModule rec {
     pkg-config
     go-md2man
     installShellFiles
-    makeWrapper
+    makeBinaryWrapper
     python3
   ];
 
@@ -121,11 +86,14 @@ buildGoModule rec {
     systemd
   ];
 
-  HELPER_BINARIES_DIR = "${PREFIX}/libexec/podman"; # used in buildPhase & installPhase
-  PREFIX = "${placeholder "out"}";
+  env = {
+    HELPER_BINARIES_DIR = "${placeholder "out"}/libexec/podman"; # used in buildPhase & installPhase
+    PREFIX = "${placeholder "out"}";
+  };
 
   buildPhase = ''
     runHook preBuild
+
     patchShebangs .
     ${
       if stdenv.hostPlatform.isDarwin then
@@ -138,11 +106,13 @@ buildGoModule rec {
         ''
     }
     make docs
+
     runHook postBuild
   '';
 
   installPhase = ''
     runHook preInstall
+
     ${
       if stdenv.hostPlatform.isDarwin then
         ''
@@ -154,10 +124,11 @@ buildGoModule rec {
         ''
     }
     make install.completions install.man
-    mkdir -p ${HELPER_BINARIES_DIR}
-    ln -s ${helpersBin}/bin/* ${HELPER_BINARIES_DIR}
+    mkdir -p ${finalAttrs.env.HELPER_BINARIES_DIR}
+    ln -s ${finalAttrs.passthru.helpersBin}/bin/* ${finalAttrs.env.HELPER_BINARIES_DIR}
     wrapProgram $out/bin/podman \
-      --prefix PATH : ${lib.escapeShellArg binPath}
+      --prefix PATH : ${lib.escapeShellArg finalAttrs.passthru.binPath}
+
     runHook postInstall
   '';
 
@@ -177,13 +148,47 @@ buildGoModule rec {
   versionCheckKeepEnvironment = [ "HOME" ];
   versionCheckProgramArg = "--version";
 
-  passthru.tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
-    inherit (nixosTests) podman;
-    # related modules
-    inherit (nixosTests)
-      podman-tls-ghostunnel
-      ;
-    oci-containers-podman = nixosTests.oci-containers.podman;
+  passthru = {
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      inherit (nixosTests) podman;
+      # related modules
+      inherit (nixosTests)
+        podman-tls-ghostunnel
+        ;
+      oci-containers-podman = nixosTests.oci-containers.podman;
+    };
+    # do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
+    binPath = lib.makeBinPath (
+      lib.optionals stdenv.hostPlatform.isLinux [
+        fuse-overlayfs
+        util-linuxMinimal
+        iptables
+        iproute2
+        nftables
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        vfkit
+      ]
+      ++ extraPackages
+    );
+
+    helpersBin = symlinkJoin {
+      name = "podman-helper-binary-wrapper";
+
+      # this only works for some binaries, others may need to be added to `binPath` or in the modules
+      paths = [
+        gvproxy
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        aardvark-dns
+        catatonit # added here for the pause image and also set in `containersConf` for `init_path`
+        netavark
+        passt
+        conmon
+        crun
+      ]
+      ++ extraRuntimes;
+    };
   };
 
   meta = {
@@ -194,9 +199,9 @@ buildGoModule rec {
 
       To install on NixOS, please use the option `virtualisation.podman.enable = true`.
     '';
-    changelog = "https://github.com/containers/podman/blob/v${version}/RELEASE_NOTES.md";
+    changelog = "https://github.com/containers/podman/blob/v${finalAttrs.version}/RELEASE_NOTES.md";
     license = lib.licenses.asl20;
     teams = [ lib.teams.podman ];
     mainProgram = "podman";
   };
-}
+})
diff --git a/pkgs/tools/package-management/protontricks/default.nix b/pkgs/by-name/pr/protontricks/package.nix
similarity index 76%
rename from pkgs/tools/package-management/protontricks/default.nix
rename to pkgs/by-name/pr/protontricks/package.nix
index 0d09dbff1778..212bdc22eb86 100644
--- a/pkgs/tools/package-management/protontricks/default.nix
+++ b/pkgs/by-name/pr/protontricks/package.nix
@@ -1,39 +1,35 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   replaceVars,
   writeShellScript,
-  steam-run,
+  steam-run-free,
   fetchpatch2,
-  setuptools-scm,
-  vdf,
-  pillow,
   winetricks,
   yad,
-  pytestCheckHook,
   nix-update-script,
   extraCompatPaths ? "",
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "protontricks";
-  version = "1.13.0";
+  version = "1.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Matoking";
     repo = "protontricks";
     tag = version;
-    hash = "sha256-6z6J31EBXf0FU3fWjjg3dX7OAOiN9Z3ONdKIweJiZBY=";
+    hash = "sha256-YJUNp+8n1LPlD7lCAy6AMNxToloPBn8ZaRfREiwS9ls=";
   };
 
   patches = [
     # Use steam-run to run Proton binaries
     (replaceVars ./steam-run.patch {
-      steamRun = lib.getExe steam-run;
+      steamRun = lib.getExe steam-run-free;
       bash = writeShellScript "steam-run-bash" ''
-        exec ${lib.getExe steam-run} bash "$@"
+        exec ${lib.getExe steam-run-free} bash "$@"
       '';
     })
 
@@ -45,9 +41,9 @@ buildPythonApplication rec {
     })
   ];
 
-  build-system = [ setuptools-scm ];
+  build-system = with python3Packages; [ setuptools-scm ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     vdf
     pillow
   ];
@@ -64,7 +60,7 @@ buildPythonApplication rec {
   ]
   ++ lib.optional (extraCompatPaths != "") "--set STEAM_EXTRA_COMPAT_TOOLS_PATHS ${extraCompatPaths}";
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
 
   # From 1.6.0 release notes (https://github.com/Matoking/protontricks/releases/tag/1.6.0):
   # In most cases the script is unnecessary and should be removed as part of the packaging process.
@@ -76,12 +72,12 @@ buildPythonApplication rec {
 
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Simple wrapper for running Winetricks commands for Proton-enabled games";
     homepage = "https://github.com/Matoking/protontricks";
     changelog = "https://github.com/Matoking/protontricks/blob/${src.tag}/CHANGELOG.md";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ kira-bruneau ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ kira-bruneau ];
     platforms = [
       "x86_64-linux"
       "i686-linux"
diff --git a/pkgs/tools/package-management/protontricks/steam-run.patch b/pkgs/by-name/pr/protontricks/steam-run.patch
similarity index 100%
rename from pkgs/tools/package-management/protontricks/steam-run.patch
rename to pkgs/by-name/pr/protontricks/steam-run.patch
diff --git a/pkgs/by-name/ps/ps3-disc-dumper/deps.json b/pkgs/by-name/ps/ps3-disc-dumper/deps.json
index a24d6e42bd38..136abb3d1a3e 100644
--- a/pkgs/by-name/ps/ps3-disc-dumper/deps.json
+++ b/pkgs/by-name/ps/ps3-disc-dumper/deps.json
@@ -1,8 +1,8 @@
 [
   {
     "pname": "Avalonia",
-    "version": "11.3.1",
-    "hash": "sha256-732wl4/JmvYFS26NLvPD7T/V3J3JZUDy6Xwj5p1TNyE="
+    "version": "11.3.8",
+    "hash": "sha256-0cM3VVudDUELNE/fWehuCplPKLITjw1hbg9IGtIm20g="
   },
   {
     "pname": "Avalonia.Angle.Windows.Natives",
@@ -11,53 +11,53 @@
   },
   {
     "pname": "Avalonia.BuildServices",
-    "version": "0.0.31",
-    "hash": "sha256-wgtodGf644CsUZEBIpFKcUjYHTbnu7mZmlr8uHIxeKA="
+    "version": "11.3.1",
+    "hash": "sha256-JYcA/DgTHRJ02/FcURqtJnXYhhdzki8DGECLkZ4zONg="
   },
   {
     "pname": "Avalonia.Desktop",
-    "version": "11.3.1",
-    "hash": "sha256-H6SLCi3by9bFF1YR12PnNZSmtC44UQPKr+5+8LvqC90="
+    "version": "11.3.8",
+    "hash": "sha256-X/ggsRzsN7o3O4Iw4uvjgOdlW58Xbe8Jpv4llRuFcoA="
   },
   {
     "pname": "Avalonia.Fonts.Inter",
-    "version": "11.3.1",
-    "hash": "sha256-LfNYF+SywrIzUw4T+GRE/Mr8E7GQskQQTTfK3Kc5YVQ="
+    "version": "11.3.8",
+    "hash": "sha256-EaUjJZ+K+5HaSJ1hmLgwuH4HGp1N2s1TNJogZulpVT8="
   },
   {
     "pname": "Avalonia.FreeDesktop",
-    "version": "11.3.1",
-    "hash": "sha256-Iph1SQazNNr9liox0LR7ITidAEEWhp8Mg9Zn4MZVkRQ="
+    "version": "11.3.8",
+    "hash": "sha256-XJogaWo4ZNg/PvckA6D5EEuyQneYUKDePnT9snNwaHs="
   },
   {
     "pname": "Avalonia.Native",
-    "version": "11.3.1",
-    "hash": "sha256-jNzqmHm58bbPGs/ogp6gFvinbN81Psg+sg+Z5UsbcDs="
+    "version": "11.3.8",
+    "hash": "sha256-Hm4uneEN3rQVmSp1Ai4cDSTJpixYDzYJzEkAesvwxPw="
   },
   {
     "pname": "Avalonia.Remote.Protocol",
-    "version": "11.3.1",
-    "hash": "sha256-evkhJOxKjsR+jNLrXRcrhqjFdlrxYMMMRBJ6FK08vMM="
+    "version": "11.3.8",
+    "hash": "sha256-pCIcQuTTcpik4xg5x8Y/QuXaW/GmNny/5ZBVr0bhmNU="
   },
   {
     "pname": "Avalonia.Skia",
-    "version": "11.3.1",
-    "hash": "sha256-zN09CcuSqtLcQrTCQOoPJrhLd4LioZqt/Qi4sDp/cJI="
+    "version": "11.3.8",
+    "hash": "sha256-FeJ6tdgeGKHkv0JKPOq2eHTxaDTT0t2yJ7wavBKnr68="
   },
   {
     "pname": "Avalonia.Themes.Fluent",
-    "version": "11.3.1",
-    "hash": "sha256-PApWHwIoLzbzrnyXJQLVy85Rbxag7NFEKMXOs2iVVaA="
+    "version": "11.3.8",
+    "hash": "sha256-fVXc8+WPRa3YkX4EIt/Wjz9hnI7y6pv3P1cCBhEPgOg="
   },
   {
     "pname": "Avalonia.Win32",
-    "version": "11.3.1",
-    "hash": "sha256-w3+8luJByeIchiVQ0wsq0olDabX/DndigyBEuK8Ty04="
+    "version": "11.3.8",
+    "hash": "sha256-YwzyF4YJtCzcLpGxDe6U3Tpxjcqft8mcYjUNnL2Ockg="
   },
   {
     "pname": "Avalonia.X11",
-    "version": "11.3.1",
-    "hash": "sha256-0iUFrDM+10T3OiOeGSEiqQ6EzEucQL3shZUNqOiqkyQ="
+    "version": "11.3.8",
+    "hash": "sha256-SlAWkiaGYc+Ynq4QcO3/xorz2EIWWyrZcHXIk7F68i0="
   },
   {
     "pname": "CommunityToolkit.Mvvm",
@@ -91,33 +91,33 @@
   },
   {
     "pname": "LTRData.DiscUtils.Core",
-    "version": "1.0.57",
-    "hash": "sha256-W3MWde/i+/AjEnVrddhcBiuyHmujVAxq+NpJudgoIpc="
+    "version": "1.0.70",
+    "hash": "sha256-JkhbjVxQRipBp83zj2c5UyDHwEj/ubVi3r3GZ42onbI="
   },
   {
     "pname": "LTRData.DiscUtils.Iso9660",
-    "version": "1.0.57",
-    "hash": "sha256-h1LEAyKcrLB/QY77HH2eLAPtdFQccVeycwkVPr7x9/U="
+    "version": "1.0.70",
+    "hash": "sha256-HU15n+1yxQdgxPtEXNZ9FRhX6TMa9YevrI+gkODdMco="
   },
   {
     "pname": "LTRData.DiscUtils.OpticalDisk",
-    "version": "1.0.57",
-    "hash": "sha256-SD26HhU4622oUBWU+iK2yTj025RQh+P8ZJybJsZyUSs="
+    "version": "1.0.70",
+    "hash": "sha256-lRof+dic1S/M8Llxy34NAbPkipYm9RRwNBl2oywS9KY="
   },
   {
     "pname": "LTRData.DiscUtils.Streams",
-    "version": "1.0.57",
-    "hash": "sha256-00o7vHJGU0yNzFp9FlKBH+gCHVie4VBcx2PnTdW5XZQ="
+    "version": "1.0.70",
+    "hash": "sha256-wM3hkrr3nv1vzgkzVw/e4m/VwMGvwzSTm8jnN/Tt4I4="
   },
   {
     "pname": "LTRData.DiscUtils.Udf",
-    "version": "1.0.57",
-    "hash": "sha256-HHCfCaW7SUpOiYBXARnXeAq0yKfPLudVL8HwLrmhL0g="
+    "version": "1.0.70",
+    "hash": "sha256-cmv6YkU/tS94w8/QZwrdJkDtxicXjhqyZ3GsdJYxjLQ="
   },
   {
     "pname": "LTRData.Extensions",
-    "version": "1.0.18",
-    "hash": "sha256-BUmv97cIUDNtjPj7IKW1iZHhqx9iyidb4xwAGXbRyvM="
+    "version": "1.0.20",
+    "hash": "sha256-K/y4fOHXQ3HbgwisjVbKmCz0lHEPilG+Icdj5choJg8="
   },
   {
     "pname": "MicroCom.Runtime",
@@ -129,21 +129,6 @@
     "version": "6.0.0",
     "hash": "sha256-lNL5C4W7/p8homWooO/3ZKDZQ2M0FUTDixJwqWBPVbo="
   },
-  {
-    "pname": "Microsoft.Bcl.HashCode",
-    "version": "6.0.0",
-    "hash": "sha256-87myurC/jMcX1f32167j7FTjbZ6FvUE0esrhYTGcvWs="
-  },
-  {
-    "pname": "Microsoft.NETCore.Platforms",
-    "version": "1.1.0",
-    "hash": "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="
-  },
-  {
-    "pname": "Microsoft.NETCore.Targets",
-    "version": "1.1.0",
-    "hash": "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="
-  },
   {
     "pname": "Newtonsoft.Json",
     "version": "12.0.1",
@@ -159,156 +144,6 @@
     "version": "1.0.2",
     "hash": "sha256-ZUj6YFSMZp5CZtXiamw49eZmbp1iYBuNsIKNnjxcRzA="
   },
-  {
-    "pname": "runtime.any.System.Collections",
-    "version": "4.3.0",
-    "hash": "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="
-  },
-  {
-    "pname": "runtime.any.System.Diagnostics.Tracing",
-    "version": "4.3.0",
-    "hash": "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="
-  },
-  {
-    "pname": "runtime.any.System.Globalization",
-    "version": "4.3.0",
-    "hash": "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="
-  },
-  {
-    "pname": "runtime.any.System.IO",
-    "version": "4.3.0",
-    "hash": "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="
-  },
-  {
-    "pname": "runtime.any.System.Reflection",
-    "version": "4.3.0",
-    "hash": "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="
-  },
-  {
-    "pname": "runtime.any.System.Reflection.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="
-  },
-  {
-    "pname": "runtime.any.System.Resources.ResourceManager",
-    "version": "4.3.0",
-    "hash": "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="
-  },
-  {
-    "pname": "runtime.any.System.Runtime",
-    "version": "4.3.0",
-    "hash": "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="
-  },
-  {
-    "pname": "runtime.any.System.Runtime.Handles",
-    "version": "4.3.0",
-    "hash": "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="
-  },
-  {
-    "pname": "runtime.any.System.Runtime.InteropServices",
-    "version": "4.3.0",
-    "hash": "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="
-  },
-  {
-    "pname": "runtime.any.System.Text.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="
-  },
-  {
-    "pname": "runtime.any.System.Threading.Tasks",
-    "version": "4.3.0",
-    "hash": "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="
-  },
-  {
-    "pname": "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-EbnOqPOrAgI9eNheXLR++VnY4pHzMsEKw1dFPJ/Fl2c="
-  },
-  {
-    "pname": "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-mVg02TNvJc1BuHU03q3fH3M6cMgkKaQPBxraSHl/Btg="
-  },
-  {
-    "pname": "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-g9Uiikrl+M40hYe0JMlGHe/lrR0+nN05YF64wzLmBBA="
-  },
-  {
-    "pname": "runtime.native.System",
-    "version": "4.3.0",
-    "hash": "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography.Apple",
-    "version": "4.3.1",
-    "hash": "sha256-Mt2QAjNH5nKnwpbyoUe2O+En97CP84EQFoS3CkmYXAM="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-xqF6LbbtpzNC9n1Ua16PnYgXHU0LvblEROTfK4vIxX8="
-  },
-  {
-    "pname": "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-aJBu6Frcg6webvzVcKNoUP1b462OAqReF2giTSyBzCQ="
-  },
-  {
-    "pname": "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-Mpt7KN2Kq51QYOEVesEjhWcCGTqWckuPf8HlQ110qLY="
-  },
-  {
-    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple",
-    "version": "4.3.1",
-    "hash": "sha256-J5RHzSIfUs001NsY82+ZXn0ZIqux+aLvY7uDuXjRd8U="
-  },
-  {
-    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-JvMltmfVC53mCZtKDHE69G3RT6Id28hnskntP9MMP9U="
-  },
-  {
-    "pname": "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-QfFxWTVRNBhN4Dm1XRbCf+soNQpy81PsZed3x6op/bI="
-  },
-  {
-    "pname": "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-EaJHVc9aDZ6F7ltM2JwlIuiJvqM67CKRq682iVSo+pU="
-  },
-  {
-    "pname": "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-PHR0+6rIjJswn89eoiWYY1DuU8u6xRJLrtjykAMuFmA="
-  },
-  {
-    "pname": "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.2",
-    "hash": "sha256-LFkh7ua7R4rI5w2KGjcHlGXLecsncCy6kDXLuy4qD/Q="
-  },
-  {
-    "pname": "runtime.unix.System.Diagnostics.Debug",
-    "version": "4.3.0",
-    "hash": "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="
-  },
-  {
-    "pname": "runtime.unix.System.Private.Uri",
-    "version": "4.3.0",
-    "hash": "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="
-  },
-  {
-    "pname": "runtime.unix.System.Runtime.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="
-  },
   {
     "pname": "SkiaSharp",
     "version": "2.88.9",
@@ -334,150 +169,10 @@
     "version": "2.88.9",
     "hash": "sha256-kP5XM5GgwHGfNJfe4T2yO5NIZtiF71Ddp0pd1vG5V/4="
   },
-  {
-    "pname": "System.Collections",
-    "version": "4.3.0",
-    "hash": "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="
-  },
-  {
-    "pname": "System.Collections.Concurrent",
-    "version": "4.3.0",
-    "hash": "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="
-  },
-  {
-    "pname": "System.Diagnostics.Debug",
-    "version": "4.3.0",
-    "hash": "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="
-  },
-  {
-    "pname": "System.Diagnostics.Tracing",
-    "version": "4.3.0",
-    "hash": "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="
-  },
-  {
-    "pname": "System.Globalization",
-    "version": "4.3.0",
-    "hash": "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="
-  },
-  {
-    "pname": "System.IO",
-    "version": "4.3.0",
-    "hash": "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="
-  },
   {
     "pname": "System.IO.Hashing",
-    "version": "9.0.6",
-    "hash": "sha256-QhOlqpeQsqJ2Lly8xV0lzSaNBmkGPEgtyTe9xSvkyAw="
-  },
-  {
-    "pname": "System.IO.Pipelines",
-    "version": "8.0.0",
-    "hash": "sha256-LdpB1s4vQzsOODaxiKstLks57X9DTD5D6cPx8DE1wwE="
-  },
-  {
-    "pname": "System.Linq",
-    "version": "4.3.0",
-    "hash": "sha256-R5uiSL3l6a3XrXSSL6jz+q/PcyVQzEAByiuXZNSqD/A="
-  },
-  {
-    "pname": "System.Memory",
-    "version": "4.5.5",
-    "hash": "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="
-  },
-  {
-    "pname": "System.Memory",
-    "version": "4.6.3",
-    "hash": "sha256-JgeK63WMmumF6L+FH5cwJgYdpqXrSDcgTQwtIgTHKVU="
-  },
-  {
-    "pname": "System.Private.Uri",
-    "version": "4.3.0",
-    "hash": "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="
-  },
-  {
-    "pname": "System.Reflection",
-    "version": "4.3.0",
-    "hash": "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="
-  },
-  {
-    "pname": "System.Reflection.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="
-  },
-  {
-    "pname": "System.Resources.ResourceManager",
-    "version": "4.3.0",
-    "hash": "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="
-  },
-  {
-    "pname": "System.Runtime",
-    "version": "4.3.0",
-    "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
-  },
-  {
-    "pname": "System.Runtime.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="
-  },
-  {
-    "pname": "System.Runtime.Handles",
-    "version": "4.3.0",
-    "hash": "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="
-  },
-  {
-    "pname": "System.Runtime.InteropServices",
-    "version": "4.3.0",
-    "hash": "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="
-  },
-  {
-    "pname": "System.Runtime.Numerics",
-    "version": "4.3.0",
-    "hash": "sha256-P5jHCgMbgFMYiONvzmaKFeOqcAIDPu/U8bOVrNPYKqc="
-  },
-  {
-    "pname": "System.Security.Cryptography.Algorithms",
-    "version": "4.3.1",
-    "hash": "sha256-QlO/ppRk/OyDYHCimD867RAlKIOakidD0ICNOt63XNQ="
-  },
-  {
-    "pname": "System.Security.Cryptography.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-Yuge89N6M+NcblcvXMeyHZ6kZDfwBv3LPMDiF8HhJss="
-  },
-  {
-    "pname": "System.Security.Cryptography.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-fnFi7B3SnVj5a+BbgXnbjnGNvWrCEU6Hp/wjsjWz318="
-  },
-  {
-    "pname": "System.Text.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="
-  },
-  {
-    "pname": "System.Text.Encoding.CodePages",
-    "version": "9.0.5",
-    "hash": "sha256-trMfhFwGMnM60+UUqud7gFLL2YF5pCdhleKSonkkd84="
-  },
-  {
-    "pname": "System.Threading",
-    "version": "4.3.0",
-    "hash": "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="
-  },
-  {
-    "pname": "System.Threading.Tasks",
-    "version": "4.3.0",
-    "hash": "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="
-  },
-  {
-    "pname": "System.Threading.Tasks.Extensions",
-    "version": "4.5.4",
-    "hash": "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="
-  },
-  {
-    "pname": "System.Threading.Tasks.Extensions",
-    "version": "4.6.3",
-    "hash": "sha256-GrySx1F6Ah6tfnnQt/PHC+dbzg+sfP47OOFX0yJF/xo="
+    "version": "10.0.0",
+    "hash": "sha256-zq3baIIsQ1kaY4CVl0vpkDcZb2ZNwT7wC0wDqzEN5oI="
   },
   {
     "pname": "Tmds.DBus.Protocol",
@@ -486,7 +181,7 @@
   },
   {
     "pname": "WmiLight",
-    "version": "6.14.0",
-    "hash": "sha256-MmfXmWsLonyTKNXqmszFbvyaDjPexgH5UoCGI8h2JlA="
+    "version": "6.16.0",
+    "hash": "sha256-R2L7HLEkGEWFtiLDVqXNHyszPUlLdP/jm4hX8iAmHkk="
   }
 ]
diff --git a/pkgs/by-name/ps/ps3-disc-dumper/package.nix b/pkgs/by-name/ps/ps3-disc-dumper/package.nix
index 061b16f2f411..7868cd8726f4 100644
--- a/pkgs/by-name/ps/ps3-disc-dumper/package.nix
+++ b/pkgs/by-name/ps/ps3-disc-dumper/package.nix
@@ -10,18 +10,17 @@
 
 buildDotnetModule rec {
   pname = "ps3-disc-dumper";
-  version = "4.3.9";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "13xforever";
     repo = "ps3-disc-dumper";
     tag = "v${version}";
-    hash = "sha256-F+FyCuxzg7oTF2iRxWygXeGnspHrZ3Za8HhCSKNgoR4=";
+    hash = "sha256-urIeR6iVL5DDqzOUfI291WYArrEpLzNg7pnvjACUuk8=";
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_9_0;
-  dotnet-runtime = dotnetCorePackages.sdk_9_0;
-  dotnetFlags = [ "-p:TargetFramework=net9.0" ];
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = dotnetCorePackages.sdk_10_0;
   dotnetRestoreFlags = [ "-p:Configuration=${buildType}" ];
   buildType = "Linux";
   projectFile = "UI.Avalonia/UI.Avalonia.csproj";
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index 7ca69a5dbdf0..ff7ca8eae73b 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.28.5";
+  version = "3.29.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-uXDZIFqH+PgI0MSZb3SYFpQm2XMFdXBdPZrjb7DT1Bg=";
+    hash = "sha256-ApMv7nHYBaW/L0Gvs6M8rJc3n/9yhSRtSAnWda06iak=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index 9e91d442af42..b253e2556263 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -12,19 +12,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.103.2";
+  version = "1.103.7";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-i8wMyuHIgKztklBcr5AZjsaf+C1N7QGnF2E3VUNwh5A=";
+        hash = "sha256-wsFjjBYF8yQE7y/WyTPX2OM5euqYK2PBcxbUFLB3XY0=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-2/+/TQz7AIeR6mTZXEPKXE8K10r4Qw0hIRop9kysGpc=";
+        hash = "sha256-+btAHctDvsOLUG/v7c3PGxJTWAxj28laQu72Wq2pl/M=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/rc/rclone/package.nix b/pkgs/by-name/rc/rclone/package.nix
index 1f54edecca42..e3e5bd72d8dd 100644
--- a/pkgs/by-name/rc/rclone/package.nix
+++ b/pkgs/by-name/rc/rclone/package.nix
@@ -17,7 +17,7 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.71.2";
+  version = "1.72.0";
 
   outputs = [
     "out"
@@ -28,10 +28,10 @@ buildGoModule rec {
     owner = "rclone";
     repo = "rclone";
     tag = "v${version}";
-    hash = "sha256-fmqIjwWhWj8ucw/OP6B9dCGKaF8eiVQdJEtK0a6G9E4=";
+    hash = "sha256-zZFjGkxQLkYNYpSRrVVsLFK6CvpVSJEvLn6FDdufxqA=";
   };
 
-  vendorHash = "sha256-0RK2gc3InPZZnAEgv01fgG19cWeKCsBP6JN2OCVY8O4=";
+  vendorHash = "sha256-tNeL43WGWeX88vXJwQzxubUPIyejl3PPHXLc8oNeno4=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ru/rumdl/package.nix b/pkgs/by-name/ru/rumdl/package.nix
index b056bef021d4..accdc2f670d9 100644
--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rumdl";
-  version = "0.0.169";
+  version = "0.0.181";
 
   src = fetchFromGitHub {
     owner = "rvben";
     repo = "rumdl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1ly0bAA8NGGqdF6U/BYGvr+aR6OU0ArbK7A0vAMdtlQ=";
+    hash = "sha256-qwsZ4S0F9JEpVP05RbvUQT8mBemtJQwJ6DRMp+r2TM0=";
   };
 
-  cargoHash = "sha256-qnNm69SM3pt0LAIOvu0xhnTFft+SCD2LmY3hNoturmo=";
+  cargoHash = "sha256-DwCzpyoJcnD/j3umEJGMaMlt0WgPtK3HaztDieuWo90=";
 
   cargoBuildFlags = [
     "--bin=rumdl"
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index b7cd56b9e5c1..04fc003611a1 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.16.34";
+  version = "3.16.36";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-8bMy/zGjf42QG5c/6v99dZQiLNsUI68+ij4l5RC8L7s=";
+    hash = "sha256-7sOoxpT65O3Mks9+xfISuRgx55E6eRdbsDpdMafTq98=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/su/subunit/package.nix b/pkgs/by-name/su/subunit/package.nix
index a40e846e4fd3..3342e4d58b46 100644
--- a/pkgs/by-name/su/subunit/package.nix
+++ b/pkgs/by-name/su/subunit/package.nix
@@ -9,23 +9,26 @@
   python3Packages,
 }:
 
-# NOTE: for subunit python library see pkgs/top-level/python-packages.nix
+# NOTE: for the subunit python library see pkgs/top-level/python-packages.nix
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "subunit";
   version = "1.4.2";
 
   src = fetchurl {
-    url = "https://launchpad.net/subunit/trunk/${version}/+download/${pname}-${version}.tar.gz";
+    url = "https://launchpad.net/subunit/trunk/${finalAttrs.version}/+download/subunit-${finalAttrs.version}.tar.gz";
     hash = "sha256-hlOOv6kIC97w7ICVsuXeWrsUbVu3tCSzEVKUHXYG2dI=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    perl
+    python3Packages.wrapPython
+    python3Packages.testscenarios
+  ];
   buildInputs = [
     check
     cppunit
-    perl
-    python3Packages.wrapPython
   ];
 
   propagatedBuildInputs = with python3Packages; [
@@ -33,13 +36,16 @@ stdenv.mkDerivation rec {
     testscenarios
   ];
 
+  strictDeps = true;
+
   postFixup = "wrapPythonPrograms";
 
-  meta = with lib; {
+  meta = {
     description = "Streaming protocol for test results";
     mainProgram = "subunit-diff";
     homepage = "https://launchpad.net/subunit";
-    license = licenses.asl20;
-    platforms = platforms.all;
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ azey7f ];
   };
-}
+})
diff --git a/pkgs/by-name/sy/symfony-cli/package.nix b/pkgs/by-name/sy/symfony-cli/package.nix
index 4c35cfbe4f2f..1f72fad96812 100644
--- a/pkgs/by-name/sy/symfony-cli/package.nix
+++ b/pkgs/by-name/sy/symfony-cli/package.nix
@@ -12,14 +12,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "symfony-cli";
-  version = "5.15.1";
-  vendorHash = "sha256-tAaTgcZMvpw1a6sSu86gbgP66Wzkvga1FIIGZHCFSQA=";
+  version = "5.16.0";
+  vendorHash = "sha256-StRdOTEuijjnDWvXNjAVzvDL3zXQJ4LZOioart1CFPw=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sjiGHIwCI2W/hN/+b3SPiSANtZyOnv110E9Dgi0qr70=";
+    hash = "sha256-rPiqvlRygwernra/NyoLxpUfD8eAKeHQzt09VMvvi0U=";
     leaveDotGit = true;
     postFetch = ''
       git --git-dir $out/.git log -1 --pretty=%cd --date=format:'%Y-%m-%dT%H:%M:%SZ' > $out/SOURCE_DATE
diff --git a/pkgs/by-name/te/terminus_font/package.nix b/pkgs/by-name/te/terminus_font/package.nix
index 05a7ff355f3d..93edf50f5087 100644
--- a/pkgs/by-name/te/terminus_font/package.nix
+++ b/pkgs/by-name/te/terminus_font/package.nix
@@ -7,13 +7,13 @@
   xorg,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "terminus-font";
   version = "4.49.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/${pname}/${pname}-${lib.versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "0yggffiplk22lgqklfmd2c0rw8gwchynjh5kz4bz8yv2h6vw2qfr";
+    url = "mirror://sourceforge/project/terminus-font/terminus-font-${lib.versions.majorMinor finalAttrs.version}/terminus-font-${finalAttrs.version}.tar.gz";
+    hash = "sha256-2WHBt4Fie/QX+bNAaT1k/CGeAROtOjrxo0JMeqNz73k=";
   };
 
   patches = [ ./SOURCE_DATE_EPOCH-for-otb.patch ];
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     xorg.mkfontscale
   ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   postPatch = ''
@@ -40,7 +42,7 @@ stdenv.mkDerivation rec {
   # to make, so we need to disable parallelism:
   enableParallelInstalling = false;
 
-  meta = with lib; {
+  meta = {
     description = "Clean fixed width font";
     longDescription = ''
       Terminus Font is designed for long (8 and more hours per day) work
@@ -55,6 +57,7 @@ stdenv.mkDerivation rec {
       EGA/VGA-bold for 8x14 and 8x16.
     '';
     homepage = "https://terminus-font.sourceforge.net/";
-    license = licenses.ofl;
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ azey7f ];
   };
-}
+})
diff --git a/pkgs/by-name/te/terminus_font_ttf/package.nix b/pkgs/by-name/te/terminus_font_ttf/package.nix
index a68c7952c114..e79b4be6883a 100644
--- a/pkgs/by-name/te/terminus_font_ttf/package.nix
+++ b/pkgs/by-name/te/terminus_font_ttf/package.nix
@@ -4,12 +4,12 @@
   fetchzip,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "terminus-font-ttf";
   version = "4.49.3";
 
   src = fetchzip {
-    url = "https://files.ax86.net/terminus-ttf/files/${version}/terminus-ttf-${version}.zip";
+    url = "https://files.ax86.net/terminus-ttf/files/${finalAttrs.version}/terminus-ttf-${finalAttrs.version}.zip";
     hash = "sha256-dK7MH4I1RhsIGzcnRA+7f3P5oi9B63RA+uASVDNtxNI=";
   };
 
@@ -26,14 +26,14 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Clean fixed width TTF font";
     longDescription = ''
       Monospaced bitmap font designed for long work with computers
       (TTF version, mainly for Java applications)
     '';
     homepage = "https://files.ax86.net/terminus-ttf";
-    license = licenses.ofl;
-    maintainers = [ ];
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ azey7f ];
   };
-}
+})
diff --git a/pkgs/by-name/te/terracotta/0001-nix-read-timestamp-from-SOURCE_DATE_EPOCH.patch b/pkgs/by-name/te/terracotta/0001-nix-read-timestamp-from-SOURCE_DATE_EPOCH.patch
index 853db4d5176b..c167dd39df5a 100644
--- a/pkgs/by-name/te/terracotta/0001-nix-read-timestamp-from-SOURCE_DATE_EPOCH.patch
+++ b/pkgs/by-name/te/terracotta/0001-nix-read-timestamp-from-SOURCE_DATE_EPOCH.patch
@@ -1,6 +1,6 @@
-From d5680fd01964755c39c0fd5c128c972d9bd9a044 Mon Sep 17 00:00:00 2001
+From f89d1d20a773cff73dd5856af4c84bccaea549ac Mon Sep 17 00:00:00 2001
 From: Moraxyc <i@qaq.li>
-Date: Tue, 28 Oct 2025 16:57:58 +0800
+Date: Sat, 8 Nov 2025 15:18:44 +0800
 Subject: [PATCH 1/2] nix: read timestamp from SOURCE_DATE_EPOCH
 
 ---
diff --git a/pkgs/by-name/te/terracotta/0002-nix-use-easytier-from-nix-input.patch b/pkgs/by-name/te/terracotta/0002-nix-use-easytier-from-nix-input.patch
index 6b95c3f6d2cd..29cb9c7c6d68 100644
--- a/pkgs/by-name/te/terracotta/0002-nix-use-easytier-from-nix-input.patch
+++ b/pkgs/by-name/te/terracotta/0002-nix-use-easytier-from-nix-input.patch
@@ -1,11 +1,11 @@
-From 8c8ef3bcdbebb11999a6a229de2d537c9a0110a9 Mon Sep 17 00:00:00 2001
+From cbf623903a0efdbd9b105f24aae6ac9ce0a4d21e Mon Sep 17 00:00:00 2001
 From: Moraxyc <i@qaq.li>
-Date: Tue, 28 Oct 2025 17:01:29 +0800
+Date: Sat, 8 Nov 2025 15:22:08 +0800
 Subject: [PATCH 2/2] nix: use easytier from nix input
 
 ---
- build.rs        |  3 ++-
- src/easytier.rs | 31 +++----------------------------
+ build.rs                        |  3 ++-
+ src/easytier/executable_impl.rs | 31 +++----------------------------
  2 files changed, 5 insertions(+), 29 deletions(-)
 
 diff --git a/build.rs b/build.rs
@@ -22,59 +22,59 @@ index dc6e117..df454d9 100644
  
      sevenz_rust2::compress_to_path(
          "web",
-diff --git a/src/easytier.rs b/src/easytier.rs
-index c657a08..38e6abd 100644
---- a/src/easytier.rs
-+++ b/src/easytier.rs
-@@ -14,12 +14,6 @@ use std::{
-     time::Duration,
- };
- 
--static EASYTIER_ARCHIVE: (&str, &str, &[u8]) = (
--    include_str!(env!("TERRACOTTA_ET_ENTRY_CONF")),
--    include_str!(env!("TERRACOTTA_ET_CLI_CONF")),
--    include_bytes!(env!("TERRACOTTA_ET_ARCHIVE")),
--);
--
- lazy_static::lazy_static! {
-     pub static ref FACTORY: EasytierFactory = create();
- }
-@@ -36,32 +30,13 @@ pub struct Easytier {
- }
- 
- fn create() -> EasytierFactory {
--    let _ = fs::create_dir_all(&*EASYTIER_DIR);
--
-     logging!(
-         "Easytier",
--        "Releasing easytier to {}",
--        &*EASYTIER_DIR.to_string_lossy()
-+        "Using path @TERRACOTTA_ET_PATH@ (Nix)."
-     );
- 
--    sevenz_rust2::decompress(Cursor::new(EASYTIER_ARCHIVE.2.to_vec()), &*EASYTIER_DIR)
--        .map_err(|e| Error::other(e.to_string()))
--        .unwrap();
--
--    let exe: PathBuf = Path::join(&EASYTIER_DIR, EASYTIER_ARCHIVE.0);
--    let cli: PathBuf = Path::join(&EASYTIER_DIR, EASYTIER_ARCHIVE.1);
--    #[cfg(target_family = "unix")]
--    {
--        use std::os::unix::fs::PermissionsExt;
--
--        let mut permissions = fs::metadata(exe.clone()).unwrap().permissions();
--        permissions.set_mode(permissions.mode() | 0o100);
--        fs::set_permissions(exe.clone(), permissions).unwrap();
--
--        let mut permissions = fs::metadata(cli.clone()).unwrap().permissions();
--        permissions.set_mode(permissions.mode() | 0o100);
--        fs::set_permissions(cli.clone(), permissions).unwrap();
--    }
-+    let exe: PathBuf = PathBuf::from("@TERRACOTTA_ET_EXE@");
-+    let cli: PathBuf = PathBuf::from("@TERRACOTTA_ET_CLI@");
-     EasytierFactory { exe, cli }
- }
- 
+diff --git a/src/easytier/executable_impl.rs b/src/easytier/executable_impl.rs
+index 4444060..c534360 100644
+--- a/src/easytier/executable_impl.rs
++++ b/src/easytier/executable_impl.rs
+@@ -16,12 +16,6 @@ use std::{
+     time::Duration,
+ };
+ 
+-static EASYTIER_ARCHIVE: (&str, &str, &[u8]) = (
+-    include_str!(env!("TERRACOTTA_ET_ENTRY_CONF")),
+-    include_str!(env!("TERRACOTTA_ET_CLI_CONF")),
+-    include_bytes!(env!("TERRACOTTA_ET_ARCHIVE")),
+-);
+-
+ lazy_static::lazy_static! {
+     pub static ref FACTORY: EasytierFactory = create();
+ }
+@@ -38,32 +32,13 @@ pub struct Easytier {
+ }
+ 
+ fn create() -> EasytierFactory {
+-    let _ = fs::create_dir_all(&*EASYTIER_DIR);
+-
+     logging!(
+         "Easytier",
+-        "Releasing easytier to {}",
+-        &*EASYTIER_DIR.to_string_lossy()
++        "Using path @TERRACOTTA_ET_PATH@ (Nix)."
+     );
+ 
+-    sevenz_rust2::decompress(Cursor::new(EASYTIER_ARCHIVE.2.to_vec()), &*EASYTIER_DIR)
+-        .map_err(|e| Error::other(e.to_string()))
+-        .unwrap();
+-
+-    let exe: PathBuf = Path::join(&EASYTIER_DIR, EASYTIER_ARCHIVE.0);
+-    let cli: PathBuf = Path::join(&EASYTIER_DIR, EASYTIER_ARCHIVE.1);
+-    #[cfg(target_family = "unix")]
+-    {
+-        use std::os::unix::fs::PermissionsExt;
+-
+-        let mut permissions = fs::metadata(exe.clone()).unwrap().permissions();
+-        permissions.set_mode(permissions.mode() | 0o100);
+-        fs::set_permissions(exe.clone(), permissions).unwrap();
+-
+-        let mut permissions = fs::metadata(cli.clone()).unwrap().permissions();
+-        permissions.set_mode(permissions.mode() | 0o100);
+-        fs::set_permissions(cli.clone(), permissions).unwrap();
+-    }
++    let exe: PathBuf = PathBuf::from("@TERRACOTTA_ET_EXE@");
++    let cli: PathBuf = PathBuf::from("@TERRACOTTA_ET_CLI@");
+     EasytierFactory { exe, cli }
+ }
+ 
 -- 
 2.51.0
 
diff --git a/pkgs/by-name/te/terracotta/Cargo.lock b/pkgs/by-name/te/terracotta/Cargo.lock
index b318ad3409ef..3fd3cb651b49 100644
--- a/pkgs/by-name/te/terracotta/Cargo.lock
+++ b/pkgs/by-name/te/terracotta/Cargo.lock
@@ -54,9 +54,9 @@ checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
 
 [[package]]
 name = "async-compression"
-version = "0.4.32"
+version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a89bce6054c720275ac2432fbba080a66a2106a44a1b804553930ca6909f4e0"
+checksum = "93c1f86859c1af3d514fa19e8323147ff10ea98684e6c7b307912509f50e67b2"
 dependencies = [
  "compression-codecs",
  "compression-core",
@@ -84,7 +84,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -95,7 +95,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -181,9 +181,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
 
 [[package]]
 name = "bzip2"
@@ -196,9 +196,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.44"
+version = "1.2.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37521ac7aabe3d13122dc382493e20c9416f299d2ccd5b3a5340a2570cdeb0f3"
+checksum = "b97463e1064cb1b1c1384ad0a0b9c8abd0988e2a91f52606c80ef14aadb63e36"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -226,7 +226,7 @@ checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
 dependencies = [
  "iana-time-zone",
  "num-traits",
- "windows-link 0.2.1",
+ "windows-link",
 ]
 
 [[package]]
@@ -241,9 +241,9 @@ dependencies = [
 
 [[package]]
 name = "compression-codecs"
-version = "0.4.31"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef8a506ec4b81c460798f572caead636d57d3d7e940f998160f52bd254bf2d23"
+checksum = "680dc087785c5230f8e8843e2e57ac7c1c90488b6a91b88caa265410568f441b"
 dependencies = [
  "compression-core",
  "flate2",
@@ -253,9 +253,9 @@ dependencies = [
 
 [[package]]
 name = "compression-core"
-version = "0.4.29"
+version = "0.4.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e47641d3deaf41fb1538ac1f54735925e275eaf3bf4d55c81b137fba797e5cbb"
+checksum = "3a9b614a5787ef0c8802a55766480563cb3a93b435898c422ed2a359cf811582"
 
 [[package]]
 name = "constant_time_eq"
@@ -310,9 +310,9 @@ dependencies = [
 
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
  "typenum",
@@ -341,7 +341,7 @@ checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -374,7 +374,7 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -429,7 +429,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -491,9 +491,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52051878f80a721bb68ebfbc930e07b65ba72f2da88968ea5c06fd6ca3d3a127"
+checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
 
 [[package]]
 name = "flate2"
@@ -607,9 +607,9 @@ dependencies = [
 
 [[package]]
 name = "generic-array"
-version = "0.14.9"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
@@ -787,9 +787,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.7.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -814,7 +814,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
 dependencies = [
  "http 1.3.1",
- "hyper 1.7.0",
+ "hyper 1.8.1",
  "hyper-util",
  "rustls",
  "rustls-pki-types",
@@ -826,9 +826,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c6995591a8f1380fcb4ba966a252a4b29188d51d2b89e3a252f5305be65aea8"
+checksum = "52e9a2a24dc5c6821e71a7030e1e14b7b632acac55c40e9d2e082c621261bb56"
 dependencies = [
  "base64",
  "bytes",
@@ -837,7 +837,7 @@ dependencies = [
  "futures-util",
  "http 1.3.1",
  "http-body 1.0.1",
- "hyper 1.7.0",
+ "hyper 1.8.1",
  "ipnet",
  "libc",
  "percent-encoding",
@@ -1011,9 +1011,9 @@ checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
 
 [[package]]
 name = "iri-string"
-version = "0.7.8"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
+checksum = "4f867b9d1d896b67beb18518eda36fdb77a32ea590de864f1325b294a6d14397"
 dependencies = [
  "memchr",
  "serde",
@@ -1270,9 +1270,9 @@ dependencies = [
 
 [[package]]
 name = "native-dialog"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1657b63bf0e60ee0eca886b5df70269240b6197b6ee46ec37da9a7d28d8e8e24"
+checksum = "454a816a8fed70bb5ba4ae90901073173dd5142f5df5ee503acde1ebcfaa4c4b"
 dependencies = [
  "ascii",
  "block2",
@@ -1611,7 +1611,7 @@ dependencies = [
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-link 0.2.1",
+ "windows-link",
 ]
 
 [[package]]
@@ -1650,7 +1650,7 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -1694,9 +1694,9 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppmd-rust"
-version = "1.2.1"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c834641d8ad1b348c9ee86dec3b9840d805acd5f24daa5f90c788951a52ff59b"
+checksum = "d558c559f0450f16f2a27a1f017ef38468c1090c9ce63c8e51366232d53717b4"
 
 [[package]]
 name = "ppv-lite86"
@@ -1724,7 +1724,7 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
  "version_check",
  "yansi",
 ]
@@ -1786,9 +1786,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.41"
+version = "1.0.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
+checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
 dependencies = [
  "proc-macro2",
 ]
@@ -1901,7 +1901,7 @@ checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -1938,7 +1938,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.8.1",
  "hyper-rustls",
  "hyper-util",
  "js-sys",
@@ -2030,7 +2030,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rocket_http",
- "syn 2.0.108",
+ "syn 2.0.110",
  "unicode-xid",
  "version_check",
 ]
@@ -2083,9 +2083,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.34"
+version = "0.23.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a9586e9ee2b4f8fab52a0048ca7334d7024eef48e2cb9407e3497bb7cab7fa7"
+checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
 dependencies = [
  "once_cell",
  "ring",
@@ -2167,7 +2167,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -2348,9 +2348,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.108"
+version = "2.0.110"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da58917d35242480a05c2897064da0a80589a2a0476c9a3f2fdc83b53502e917"
+checksum = "a99801b5bd34ede4cf3fc688c5919368fea4e4814a4664359503e6015b280aea"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2374,7 +2374,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -2461,7 +2461,7 @@ checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -2560,7 +2560,7 @@ checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -2586,9 +2586,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.16"
+version = "0.7.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14307c986784f72ef81c89db7d9e28d6ac26d16213b109ea501696195e6e3ce5"
+checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
 dependencies = [
  "bytes",
  "futures-core",
@@ -2741,7 +2741,7 @@ checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -2941,7 +2941,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
  "wasm-bindgen-shared",
 ]
 
@@ -3044,9 +3044,9 @@ checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link 0.2.1",
- "windows-result 0.4.1",
- "windows-strings 0.5.1",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
 ]
 
 [[package]]
@@ -3057,7 +3057,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -3068,15 +3068,9 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
-[[package]]
-name = "windows-link"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
-
 [[package]]
 name = "windows-link"
 version = "0.2.1"
@@ -3085,22 +3079,13 @@ checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
 name = "windows-registry"
-version = "0.5.3"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b8a9ed28765efc97bbc954883f4e6796c33a06546ebafacbabee9696967499e"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
 dependencies = [
- "windows-link 0.1.3",
- "windows-result 0.3.4",
- "windows-strings 0.4.2",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
-dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
 ]
 
 [[package]]
@@ -3109,16 +3094,7 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
- "windows-link 0.2.1",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
-dependencies = [
- "windows-link 0.1.3",
+ "windows-link",
 ]
 
 [[package]]
@@ -3127,7 +3103,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
- "windows-link 0.2.1",
+ "windows-link",
 ]
 
 [[package]]
@@ -3163,7 +3139,7 @@ version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "windows-link 0.2.1",
+ "windows-link",
 ]
 
 [[package]]
@@ -3203,7 +3179,7 @@ version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
- "windows-link 0.2.1",
+ "windows-link",
  "windows_aarch64_gnullvm 0.53.1",
  "windows_aarch64_msvc 0.53.1",
  "windows_i686_gnu 0.53.1",
@@ -3363,9 +3339,9 @@ dependencies = [
 
 [[package]]
 name = "winresource"
-version = "0.1.25"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f882b1d5b5ab0c26bdd08afa85da4b829a982772088d1da911698e08976daf9b"
+checksum = "f1ef04dd590e94ff7431a8eda99d5ca659e688d60e930bd0a330062acea4608f"
 dependencies = [
  "toml 0.9.8",
  "version_check",
@@ -3417,7 +3393,7 @@ checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
  "synstructure",
 ]
 
@@ -3438,7 +3414,7 @@ checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -3458,7 +3434,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
  "synstructure",
 ]
 
@@ -3479,7 +3455,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
@@ -3512,7 +3488,7 @@ checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.110",
 ]
 
 [[package]]
diff --git a/pkgs/by-name/te/terracotta/package.nix b/pkgs/by-name/te/terracotta/package.nix
index 69400580d8f3..ff574808e251 100644
--- a/pkgs/by-name/te/terracotta/package.nix
+++ b/pkgs/by-name/te/terracotta/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "terracotta";
-  version = "0.3.13";
+  version = "0.3.14";
 
   src = fetchFromGitHub {
     owner = "burningtnt";
     repo = "Terracotta";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2Ghn/f0EaWOLhabxY7WBEesB/28fojreXs1ve1PvpdM=";
+    hash = "sha256-zp3Ax0A7Vc6LnZiWu2pWzQTWvYH9NRmqSfmxK756qA8=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/to/todoist-electron/package.nix b/pkgs/by-name/to/todoist-electron/package.nix
index c0e39da0f103..9edcaebe2efe 100644
--- a/pkgs/by-name/to/todoist-electron/package.nix
+++ b/pkgs/by-name/to/todoist-electron/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   appimageTools,
   fetchurl,
   asar,
@@ -7,13 +8,14 @@
 }:
 
 let
-  pname = "todoist-electron";
-  version = "9.18.0";
+  sources = import ./sources.nix;
 
-  src = fetchurl {
-    url = "https://electron-dl.todoist.net/linux/Todoist-linux-${version}-x86_64-latest.AppImage";
-    hash = "sha256-2X//beSpQ1rCqU4Wn5ELoxgfi2knFAJ2w1rn41TNP6g=";
-  };
+  pname = "todoist-electron";
+  version = sources.version;
+  src =
+    fetchurl
+      sources.${stdenv.hostPlatform.system}
+        or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   appimageContents = appimageTools.extract {
     inherit pname version src;
@@ -54,6 +56,6 @@ appimageTools.wrapAppImage {
       kylesferrazza
       pokon548
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.attrNames sources;
   };
 }
diff --git a/pkgs/by-name/to/todoist-electron/sources.nix b/pkgs/by-name/to/todoist-electron/sources.nix
new file mode 100644
index 000000000000..221730a6b483
--- /dev/null
+++ b/pkgs/by-name/to/todoist-electron/sources.nix
@@ -0,0 +1,13 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2025-09-25
+{
+  version = "9.20.0";
+  x86_64-linux = {
+    url = "https://electron-dl.todoist.net/linux/Todoist-linux-9.20.0-x86_64-latest.AppImage";
+    hash = "sha256-Rpn7cobgYQt06d+t5XDYUZTOc/pnpRJIEXZeDAiJIH8=";
+  };
+  aarch64-linux = {
+    url = "https://electron-dl.todoist.net/linux/Todoist-linux-9.20.0-arm64-latest.AppImage";
+    hash = "sha256-0oyJXgu7BYjnKak3Gxo8XtI0kmGvPvAfNAB4fRnZsoE=";
+  };
+}
diff --git a/pkgs/by-name/to/todoist-electron/update.sh b/pkgs/by-name/to/todoist-electron/update.sh
new file mode 100644
index 000000000000..fe5afc3034d9
--- /dev/null
+++ b/pkgs/by-name/to/todoist-electron/update.sh
@@ -0,0 +1,31 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash --pure --keep GITHUB_TOKEN -p nix git curl cacert nix-prefetch-git gnugrep
+
+base_url=$(curl -Ls -o /dev/null -w %{url_effective} https://todoist.com/linux_app/appimage)
+version=$(echo $base_url | grep -oP '(?<=Todoist-linux-)(\d+\.\d+\.\d+)')
+
+url=()
+hash=()
+
+for i in x86_64 arm64
+do
+    current_url=$(echo $base_url | sed "s/x86_64/$i/")
+    url+=($current_url)
+    hash+=("$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url $current_url))")
+done
+
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{
+  version = "$version";
+  x86_64-linux = {
+    url = "${url[0]}";
+    hash = "${hash[0]}";
+  };
+  aarch64-linux = {
+    url = "${url[1]}";
+    hash = "${hash[1]}";
+  };
+}
+EOF
diff --git a/pkgs/by-name/to/toolhive/package.nix b/pkgs/by-name/to/toolhive/package.nix
index 3271d421732c..a905ad847ee8 100644
--- a/pkgs/by-name/to/toolhive/package.nix
+++ b/pkgs/by-name/to/toolhive/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "toolhive";
-  version = "0.0.47";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "stacklok";
     repo = "toolhive";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FXJUEEyCw7ChuzmSAzwXd2LoJXT6vpH+j3muXx5TjPI=";
+    hash = "sha256-zCkKS573MzqiZ4Zr3ztlM7Jd0XHWAOEXUT+dF/nIiZ8=";
   };
 
-  vendorHash = "sha256-aP923ezK4/2zTaU9QQLUmNN6KIddOaTlpsYMT2flRaE=";
+  vendorHash = "sha256-gEPIbMpbCg+6Li3F3H7J5++Cnun8/kMJ4s8bTtGecqI=";
 
   # Build only the main CLI and operator binaries
   subPackages = [
diff --git a/pkgs/by-name/tt/tts-mod-vault/package.nix b/pkgs/by-name/tt/tts-mod-vault/package.nix
index 4f0e5c19a2ac..6464ce2ed4e8 100644
--- a/pkgs/by-name/tt/tts-mod-vault/package.nix
+++ b/pkgs/by-name/tt/tts-mod-vault/package.nix
@@ -21,9 +21,9 @@ flutter329.buildFlutterApplication rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = "tts-mod-vault";
-      exec = "tts-mod-vault";
-      icon = "tts-mod-vault";
+      name = "tts_mod_vault";
+      exec = "tts_mod_vault";
+      icon = "tts_mod_vault";
       comment = "Tabletop Simulator Mod Vault";
       desktopName = "TTS Mod Vault";
       categories = [ "Utility" ];
@@ -33,7 +33,7 @@ flutter329.buildFlutterApplication rec {
   nativeBuildInputs = [ copyDesktopItems ];
 
   postInstall = ''
-    install -m 444 -D assets/icon/tts_mod_vault_icon.png $out/share/icons/hicolor/1024x1024/apps/tts-mod-vault.png
+    install -m 444 -D assets/icon/tts_mod_vault_icon.png $out/share/icons/hicolor/1024x1024/apps/tts_mod_vault.png
   '';
 
   meta = {
@@ -41,7 +41,7 @@ flutter329.buildFlutterApplication rec {
     homepage = "https://github.com/markomijic/TTS-Mod-Vault";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ esch ];
-    mainProgram = "tts-mod-vault";
+    mainProgram = "tts_mod_vault";
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/us/ustreamer/package.nix b/pkgs/by-name/us/ustreamer/package.nix
index 1231dec2ad76..e9402ec14d9c 100644
--- a/pkgs/by-name/us/ustreamer/package.nix
+++ b/pkgs/by-name/us/ustreamer/package.nix
@@ -16,8 +16,10 @@
   nixosTests,
   systemdLibs,
   which,
+  python3Packages,
   withSystemd ? true,
   withJanus ? true,
+  withPython ? true,
 }:
 stdenv.mkDerivation rec {
   pname = "ustreamer";
@@ -36,6 +38,15 @@ stdenv.mkDerivation rec {
     libjpeg
     libdrm
   ]
+  ++ lib.optionals withPython (
+    with python3Packages;
+    [
+      python
+      setuptools
+      build
+      pip
+    ]
+  )
   ++ lib.optionals withSystemd [
     systemdLibs
   ]
@@ -57,6 +68,9 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder "out"}"
     "WITH_V4P=1"
   ]
+  ++ lib.optionals withPython [
+    "WITH_PYTHON=1"
+  ]
   ++ lib.optionals withSystemd [
     "WITH_SYSTEMD=1"
   ]
diff --git a/pkgs/by-name/wh/why3find/package.nix b/pkgs/by-name/wh/why3find/package.nix
index 95458e0deb5b..8382d6c93395 100644
--- a/pkgs/by-name/wh/why3find/package.nix
+++ b/pkgs/by-name/wh/why3find/package.nix
@@ -1,21 +1,30 @@
 {
   lib,
-  fetchurl,
+  stdenv,
+  fetchFromGitLab,
   ocamlPackages,
+  alt-ergo,
+  darwin,
   why3,
 }:
 
-with ocamlPackages;
-buildDunePackage {
+ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "why3find";
   version = "1.2.0";
 
-  src = fetchurl {
-    url = "https://git.frama-c.com/-/project/1056/uploads/043312a7a70961338479016ac535c706/why3find-1.2.0.tbz";
-    hash = "sha256-eslkMBo0i0+Oy8jW9eRNuyGXuwkV6eeYcxZm5MfgA6w=";
+  src = fetchFromGitLab {
+    domain = "git.frama-c.com";
+    owner = "pub";
+    repo = "why3find";
+    tag = finalAttrs.version;
+    hash = "sha256-fqB6VrJ79E6KSAnq8TZGNFlvWbDaBNh+gbuRf0CFFy8=";
   };
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.sigtool # codesign
+  ];
+
+  propagatedBuildInputs = with ocamlPackages; [
     dune-site
     terminal_size
     why3
@@ -23,10 +32,18 @@ buildDunePackage {
     zmq
   ];
 
+  doCheck = true;
+
+  nativeCheckInputs = [
+    alt-ergo.bin
+    why3
+  ];
+
   meta = {
     description = "Why3 Package Manager";
     homepage = "https://git.frama-c.com/pub/why3find";
     license = lib.licenses.lgpl21Only;
     maintainers = [ lib.maintainers.vbgl ];
+    mainProgram = "why3find";
   };
-}
+})
diff --git a/pkgs/by-name/ws/wsl2-ssh-agent/package.nix b/pkgs/by-name/ws/wsl2-ssh-agent/package.nix
new file mode 100644
index 000000000000..9814b2a4c651
--- /dev/null
+++ b/pkgs/by-name/ws/wsl2-ssh-agent/package.nix
@@ -0,0 +1,35 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "wsl2-ssh-agent";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "mame";
+    repo = "wsl2-ssh-agent";
+    tag = "v${version}";
+    hash = "sha256-oFlp6EIh32tuqBuLlSjURpl85bzw1HymJplXoGJAM8k=";
+  };
+
+  vendorHash = "sha256-YnqpP+JkbdkCtmuhqHnKqRfKogl+tGdCG11uIbyHtlI=";
+
+  # Need to disable some tests that require Windows to pass
+  checkFlags = [ "-skip=^Test(RepeaterNormal|ServerNormal|ServerMultipleAccess|ServerRestart)$" ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Bridge from WSL2 ssh client to Windows ssh-agent.exe service";
+    homepage = "https://github.com/mame/wsl2-ssh-agent";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "wsl2-ssh-agent";
+    maintainers = with lib.maintainers; [ eymeric ];
+  };
+}
diff --git a/pkgs/by-name/xf/xf86_input_wacom/package.nix b/pkgs/by-name/xf/xf86_input_wacom/package.nix
index abd62e5ca57e..42b5a9799d2c 100644
--- a/pkgs/by-name/xf/xf86_input_wacom/package.nix
+++ b/pkgs/by-name/xf/xf86_input_wacom/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xf86-input-wacom";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "linuxwacom";
     repo = "xf86-input-wacom";
     rev = "xf86-input-wacom-${version}";
-    sha256 = "sha256-0eDik4fhsg1HAL6lCZMll/0VAghpzMSHY0RoKxSOIbc=";
+    sha256 = "sha256-12m9PL28NnqIwNpGHOFqjJaNrzBaagdG3Sp/jSLpgkE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xr/xreader/package.nix b/pkgs/by-name/xr/xreader/package.nix
index 4eb7b30e5d7d..fc71837b0a01 100644
--- a/pkgs/by-name/xr/xreader/package.nix
+++ b/pkgs/by-name/xr/xreader/package.nix
@@ -11,6 +11,7 @@
   libarchive,
   libxml2,
   xapp,
+  xapp-symbolic-icons,
   meson,
   pkg-config,
   cairo,
@@ -36,13 +37,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xreader";
-  version = "4.4.0";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xreader";
     rev = version;
-    hash = "sha256-56G+UmYTNEp9lMU56Nm+OIuPwXwhDt92ANkaC0NWZZQ=";
+    hash = "sha256-cp/pZ42AS98AD78BVMeY3SHQHkYA2h4o0kddr/H+kUA=";
   };
 
   nativeBuildInputs = [
@@ -77,6 +78,12 @@ stdenv.mkDerivation rec {
     djvulibre
   ];
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}"
+    )
+  '';
+
   meta = with lib; {
     description = "Document viewer capable of displaying multiple and single page
 document formats like PDF and Postscript";
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 526a96d59fc3..24d363c906f0 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -577,6 +577,26 @@ builtins.intersectAttrs super {
   # Disable tests because they require a running dbus session
   xmonad-dbus = dontCheck super.xmonad-dbus;
 
+  taffybar = lib.pipe super.taffybar [
+    (overrideCabal (drv: {
+      testDepends =
+        drv.testDepends or [ ]
+        ++ map lib.getBin [
+          pkgs.xorg.xorgserver
+          pkgs.xorg.xprop
+          pkgs.xorg.xrandr
+          pkgs.xdummy
+          pkgs.xterm
+          pkgs.dbus
+        ];
+      testFlags = drv.testFlags or [ ] ++ [
+        # TODO(@rvl): figure out why this doesn't work in Nixpkgs
+        "--skip=/python-dbusmock System services/"
+      ];
+    }))
+    (self.generateOptparseApplicativeCompletions [ "taffybar" ])
+  ];
+
   # Test suite requires running a docker container via testcontainers
   amqp-streamly = dontCheck super.amqp-streamly;
 
diff --git a/pkgs/development/ocaml-modules/color/default.nix b/pkgs/development/ocaml-modules/color/default.nix
index 53a1c5273f8c..ba658e9f2aeb 100644
--- a/pkgs/development/ocaml-modules/color/default.nix
+++ b/pkgs/development/ocaml-modules/color/default.nix
@@ -5,26 +5,23 @@
   gg,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "color";
   version = "0.2.0";
 
-  useDune2 = true;
-  minimalOCamlVersion = "4.05";
-
   src = fetchurl {
-    url = "https://github.com/anuragsoni/color/releases/download/${version}/color-${version}.tbz";
-    sha256 = "0wg3a36i1a7fnz5pf57qzbdghwr6dzp7nnxyrz9m9765lxsn65ph";
+    url = "https://github.com/anuragsoni/color/releases/download/${finalAttrs.version}/color-${finalAttrs.version}.tbz";
+    hash = "sha256-8BZjdafFnFTTz75be+5vJnP42vr4FHfLt+6oEM1Q43E=";
   };
 
   propagatedBuildInputs = [
     gg
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Converts between different color formats";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fgaz ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fgaz ];
     homepage = "https://github.com/anuragsoni/color";
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/conan/cli.nix b/pkgs/development/ocaml-modules/conan/cli.nix
index 16fca5832331..93b3a6856dc8 100644
--- a/pkgs/development/ocaml-modules/conan/cli.nix
+++ b/pkgs/development/ocaml-modules/conan/cli.nix
@@ -1,5 +1,8 @@
 {
+  lib,
+  stdenv,
   buildDunePackage,
+  darwin,
   conan-unix,
   dune-site,
   alcotest,
@@ -24,7 +27,12 @@ buildDunePackage {
     export DUNE_CACHE=disabled
   '';
 
-  nativeCheckInputs = [ conan-database ];
+  nativeCheckInputs = [
+    conan-database
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.sigtool # codesign
+  ];
 
   checkInputs = [
     alcotest
diff --git a/pkgs/development/ocaml-modules/cpu/default.nix b/pkgs/development/ocaml-modules/cpu/default.nix
index a93826b34496..aca3d1a2143a 100644
--- a/pkgs/development/ocaml-modules/cpu/default.nix
+++ b/pkgs/development/ocaml-modules/cpu/default.nix
@@ -6,17 +6,15 @@
   autoconf,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "cpu";
   version = "2.0.0";
 
-  useDune2 = true;
-
   src = fetchFromGitHub {
     owner = "UnixJunkie";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "1vir6gh1bhvxgj2fcn69c38yhw3jgk7dyikmw789m5ld2csnyjiv";
+    repo = "cpu";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-O0pvNRONlprQ4XVG3858cnDo0WDJWOaEfH3DFeAzOe4=";
   };
 
   preConfigure = ''
@@ -28,10 +26,10 @@ buildDunePackage rec {
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isDarwin "strictoverflow";
 
-  meta = with lib; {
-    inherit (src.meta) homepage;
+  meta = {
+    homepage = "https://github.com/UnixJunkie/cpu";
     description = "Core pinning library";
-    maintainers = [ maintainers.bcdarwin ];
-    license = licenses.lgpl2;
+    maintainers = [ lib.maintainers.bcdarwin ];
+    license = lib.licenses.lgpl2;
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/cpuid/default.nix b/pkgs/development/ocaml-modules/cpuid/default.nix
index eccb5aa9f026..b08fa94e19e8 100644
--- a/pkgs/development/ocaml-modules/cpuid/default.nix
+++ b/pkgs/development/ocaml-modules/cpuid/default.nix
@@ -4,17 +4,13 @@
   buildDunePackage,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "cpuid";
   version = "0.1.2";
 
-  useDune2 = true;
-
-  minimalOCamlVersion = "4.03";
-
   src = fetchurl {
-    url = "https://github.com/pqwy/cpuid/releases/download/v${version}/cpuid-v${version}.tbz";
-    sha256 = "08ng4mva6qblb5ipkrxbr0my7ndkc4qwcbswkqgbgir864s74m93";
+    url = "https://github.com/pqwy/cpuid/releases/download/v${finalAttrs.version}/cpuid-v${finalAttrs.version}.tbz";
+    hash = "sha256-I1VyNDEox7cenlwvxjFhs9njK8ir53ljWXRho3YlzyI=";
   };
 
   meta = {
@@ -23,4 +19,4 @@ buildDunePackage rec {
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.vbgl ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/dssi/default.nix b/pkgs/development/ocaml-modules/dssi/default.nix
index 58427339a480..0ac36e950564 100644
--- a/pkgs/development/ocaml-modules/dssi/default.nix
+++ b/pkgs/development/ocaml-modules/dssi/default.nix
@@ -7,17 +7,15 @@
   alsa-lib,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "dssi";
   version = "0.1.5";
 
-  useDune2 = true;
-
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-dssi";
-    rev = "v${version}";
-    sha256 = "1frbmx1aznwp60r6bkx1whqyr6mkflvd9ysmjg7s7b80mh0s4ix6";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pkeiAawAraPPk1X71DZ1s5rsMeShz2UyMJfbr0KvK7s=";
   };
 
   buildInputs = [ dune-configurator ];
@@ -26,10 +24,10 @@ buildDunePackage rec {
     alsa-lib
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/savonet/ocaml-dssi";
     description = "Bindings for the DSSI API which provides audio synthesizers";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ dandellion ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ dandellion ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/lwt_react/default.nix b/pkgs/development/ocaml-modules/lwt_react/default.nix
index c9d7bed9f6ae..b33f98fb80e8 100644
--- a/pkgs/development/ocaml-modules/lwt_react/default.nix
+++ b/pkgs/development/ocaml-modules/lwt_react/default.nix
@@ -8,15 +8,13 @@
 
 buildDunePackage {
   pname = "lwt_react";
-  version = "1.1.5";
-
-  useDune2 = true;
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "lwt";
-    rev = "5.5.0";
-    sha256 = "sha256:1jbjz2rsz3j56k8vh5qlmm87hhkr250bs2m3dvpy9vsri8rkzj9z";
+    tag = "5.6.0";
+    hash = "sha256-DLQupCkZ14kOuSQatbb7j07I+jvvDCKpdlaR3rijT4s=";
   };
 
   nativeBuildInputs = [ cppo ];
diff --git a/pkgs/development/python-modules/apeye/default.nix b/pkgs/development/python-modules/apeye/default.nix
new file mode 100644
index 000000000000..e35db7a04ab5
--- /dev/null
+++ b/pkgs/development/python-modules/apeye/default.nix
@@ -0,0 +1,39 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  flit-core,
+  apeye-core,
+  domdf-python-tools,
+  platformdirs,
+  requests,
+  lib,
+}:
+buildPythonPackage rec {
+  pname = "apeye";
+  version = "1.4.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "apeye";
+    hash = "sha256-FOpUL61onjv9vaIYmjVKSQjpCu5L+EwVq3XWhFPXajY=";
+  };
+
+  build-system = [ flit-core ];
+
+  dependencies = [
+    apeye-core
+    domdf-python-tools
+    platformdirs
+    requests
+  ];
+
+  pythonImportsCheck = [ "apeye" ];
+
+  meta = {
+    description = "Handy tools for working with URLs and APIs";
+    homepage = "https://github.com/domdfcoding/apeye";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/autodocsumm/default.nix b/pkgs/development/python-modules/autodocsumm/default.nix
new file mode 100644
index 000000000000..0b576f6bc422
--- /dev/null
+++ b/pkgs/development/python-modules/autodocsumm/default.nix
@@ -0,0 +1,35 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  versioneer,
+  sphinx,
+  lib,
+}:
+buildPythonPackage rec {
+  pname = "autodocsumm";
+  version = "0.2.14";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "autodocsumm";
+    hash = "sha256-KDmp1PrMPE7M0wbAhpVUCREEK0bur83DID5tC6tAvHc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    versioneer
+    sphinx
+  ];
+
+  pythonImportsCheck = [ "autodocsumm" ];
+
+  meta = {
+    description = "Extended sphinx autodoc including automatic autosummaries";
+    homepage = "https://github.com/Chilipp/autodocsumm";
+    license = lib.licenses.asl20;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/busylight-core/default.nix b/pkgs/development/python-modules/busylight-core/default.nix
index def730c0f6b9..8f312fd3b540 100644
--- a/pkgs/development/python-modules/busylight-core/default.nix
+++ b/pkgs/development/python-modules/busylight-core/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "busylight-core";
-  version = "0.15.2";
+  version = "0.15.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JnyJny";
     repo = "busylight-core";
     tag = "v${version}";
-    hash = "sha256-r7mAKD/uodY5RRklYL6u2HTdcU+rt6taTpBkTB/Sv9Y=";
+    hash = "sha256-4T6FARygtHzY1diLbOcl812pyw5qloV4bNVe1Oj2pHY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dict2css/default.nix b/pkgs/development/python-modules/dict2css/default.nix
new file mode 100644
index 000000000000..17689e20acf0
--- /dev/null
+++ b/pkgs/development/python-modules/dict2css/default.nix
@@ -0,0 +1,31 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  whey,
+  cssutils,
+  lib,
+}:
+buildPythonPackage rec {
+  pname = "dict2css";
+  version = "0.3.0.post1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "dict2css";
+    hash = "sha256-icVEwhxMp0csP/+50309km9gYymv23Udwd5npBG3Bxk=";
+  };
+
+  build-system = [ whey ];
+
+  dependencies = [ cssutils ];
+
+  pythonImportsCheck = [ "dict2css" ];
+
+  meta = {
+    description = "μ-library for constructing cascading style sheets from Python dictionaries";
+    homepage = "https://github.com/sphinx-toolbox/dict2css";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/django-cache-memoize/default.nix b/pkgs/development/python-modules/django-cache-memoize/default.nix
new file mode 100644
index 000000000000..440bad6c27da
--- /dev/null
+++ b/pkgs/development/python-modules/django-cache-memoize/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+  pytestCheckHook,
+  pytest-cov-stub,
+  pytest-django,
+  nix-update-script,
+}:
+
+buildPythonPackage rec {
+  pname = "django-cache-memoize";
+  version = "0.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "peterbe";
+    repo = "django-cache-memoize";
+    # No tags. See <https://github.com/peterbe/django-cache-memoize/issues/60>.
+    rev = "9a0dc28315b9bd2848973d38b6f63a400a0e0526";
+    hash = "sha256-oORTN53s9GVHiY9tbx5FKb7ygkYUKWgPRJusdB0RfcA=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    django
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+    pytest-django
+  ];
+
+  pythonImportsCheck = [ "cache_memoize" ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Django utility for a memoization decorator that uses the Django cache framework";
+    homepage = "https://github.com/peterbe/django-cache-memoize";
+    changelog = "https://github.com/peterbe/django-cache-memoize/blob/${src.rev}/CHANGELOG.rst";
+    license = lib.licenses.mpl20;
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/development/python-modules/django-tables2/default.nix b/pkgs/development/python-modules/django-tables2/default.nix
index bbf25cf4020f..54c1082c4aba 100644
--- a/pkgs/development/python-modules/django-tables2/default.nix
+++ b/pkgs/development/python-modules/django-tables2/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "django-tables2";
-  version = "2.7.5";
+  version = "2.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jieter";
     repo = "django-tables2";
     tag = "v${version}";
-    hash = "sha256-Cb8XhCLqhc2Dx/5uAHnN9zTVL6/1+WekC4qTloBurzM=";
+    hash = "sha256-gEURC3LUBdqebd4+TAJcbgn4SpY1oTI+tg9p2GGKClE=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/echo/default.nix b/pkgs/development/python-modules/echo/default.nix
index eed34a6e10fe..79dbf6d91a88 100644
--- a/pkgs/development/python-modules/echo/default.nix
+++ b/pkgs/development/python-modules/echo/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "echo";
-  version = "0.11.0";
+  version = "0.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "glue-viz";
     repo = "echo";
     tag = "v${version}";
-    sha256 = "sha256-Uikzn9vbLctiZ6W0uA6hNvr7IB/FhCcHk+JxBW7yrA4=";
+    sha256 = "sha256-aeewirt3jNZLZUkM0Gis6nhUS/ezlKHlk6wlwgtoC4w=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fontmake/default.nix b/pkgs/development/python-modules/fontmake/default.nix
index 9cbb2ba902c2..0a30a49d05c5 100644
--- a/pkgs/development/python-modules/fontmake/default.nix
+++ b/pkgs/development/python-modules/fontmake/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "fontmake";
-  version = "3.11.0";
+  version = "3.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "fontmake";
     tag = "v${version}";
-    hash = "sha256-H3r5G+lEoIlS7mmQ1abQeZ1cD/aGskphm5X0rAshX+U=";
+    hash = "sha256-tiZpuucEzqizgzM8Ry/srwjfYMUL3256HZA1l18vRsI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/heudiconv/default.nix b/pkgs/development/python-modules/heudiconv/default.nix
index 574361a93c78..78429686aa7e 100644
--- a/pkgs/development/python-modules/heudiconv/default.nix
+++ b/pkgs/development/python-modules/heudiconv/default.nix
@@ -13,21 +13,18 @@
   nipype,
   pydicom,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
   versioningit,
 }:
 
 buildPythonPackage rec {
   pname = "heudiconv";
-  version = "1.3.3";
+  version = "1.3.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SnYysTsQUagXH8CCPgNoca2ls47XUguE/pJD2wc1tro=";
+    hash = "sha256-zT/xy9f0GBmhGJm4Gd0ZEKNSifBBjx0RmTOqq6qN4ao=";
   };
 
   postPatch = ''
@@ -66,13 +63,16 @@ buildPythonPackage rec {
   disabledTests = [
     # No such file or directory
     "test_bvals_are_zero"
+
+    # tries to access internet
+    "test_partial_xa_conversion"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Flexible DICOM converter for organizing imaging data";
     homepage = "https://heudiconv.readthedocs.io";
     changelog = "https://github.com/nipy/heudiconv/releases/tag/v${version}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ bcdarwin ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bcdarwin ];
   };
 }
diff --git a/pkgs/development/python-modules/lb-matching-tools/default.nix b/pkgs/development/python-modules/lb-matching-tools/default.nix
new file mode 100644
index 000000000000..856a641689ec
--- /dev/null
+++ b/pkgs/development/python-modules/lb-matching-tools/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  regex,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "lb-matching-tools";
+  version = "2024.01.30.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "metabrainz";
+    repo = "listenbrainz-matching-tools";
+    tag = "v${version}";
+    hash = "sha256-RQ4X6DKigQsNxaAWXB1meATKP+ddMUgkoAIyX8iIisU=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [ regex ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "lb_matching_tools" ];
+
+  meta = {
+    description = "ListenBrainz tools for matching metadata to and from MusicBrainz";
+    homepage = "https://github.com/metabrainz/listenbrainz-matching-tools";
+    changelog = "https://github.com/metabrainz/listenbrainz-matching-tools/releases/tag/${src.tag}";
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/development/python-modules/liblistenbrainz/default.nix b/pkgs/development/python-modules/liblistenbrainz/default.nix
new file mode 100644
index 000000000000..efa5e20e6892
--- /dev/null
+++ b/pkgs/development/python-modules/liblistenbrainz/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  requests,
+  pytestCheckHook,
+  requests-mock,
+}:
+
+buildPythonPackage rec {
+  pname = "liblistenbrainz";
+  version = "0.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "metabrainz";
+    repo = "liblistenbrainz";
+    tag = "v${version}";
+    hash = "sha256-mUw+x9SEHrPocZRdtazqInMGLBDv1KUR5/mmfF3CbVg=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [ requests ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    requests-mock
+  ];
+
+  pythonImportsCheck = [ "liblistenbrainz" ];
+
+  meta = {
+    description = "Simple ListenBrainz client library for Python";
+    homepage = "https://github.com/metabrainz/liblistenbrainz";
+    changelog = "https://github.com/metabrainz/liblistenbrainz/releases/tag/${src.tag}";
+    license = lib.licenses.gpl3Plus;
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/development/python-modules/pluralizer/default.nix b/pkgs/development/python-modules/pluralizer/default.nix
new file mode 100644
index 000000000000..b798c810ac7e
--- /dev/null
+++ b/pkgs/development/python-modules/pluralizer/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pluralizer";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "weixu365";
+    repo = "pluralizer-py";
+    tag = "v${version}";
+    hash = "sha256-2m7E4cwAdmny/5R5FqaCzk8mu9so/ZCgNPBckTdIc/0=";
+  };
+
+  build-system = [ hatchling ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pluralizer" ];
+
+  meta = {
+    description = "Singularize or pluralize a given word using a pre-defined list of rules";
+    homepage = "https://github.com/weixu365/pluralizer-py";
+    changelog = "https://github.com/weixu365/pluralizer-py/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyhibp/default.nix b/pkgs/development/python-modules/pyhibp/default.nix
new file mode 100644
index 000000000000..7b60f7b7d6f0
--- /dev/null
+++ b/pkgs/development/python-modules/pyhibp/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  setuptools,
+  requests,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "pyhibp";
+  version = "4.2.0";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    group = "kitsunix";
+    owner = "pyHIBP";
+    repo = "pyHIBP";
+    tag = "v${version}";
+    hash = "sha256-2LJA989hpG5X6o+zCTSU0RRd0Z4zd29RAtp/jBW8Clo=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  disabledTests = [
+    # All require internet access
+    "TestIsPasswordBreached"
+    "TestSuffixSearch"
+    "TestGetAllBreaches"
+    "TestGetSingleBreach"
+    "TestGetDataClasses"
+  ];
+
+  pythonImportsCheck = [ "pyhibp" ];
+
+  meta = {
+    description = "Python interface to Troy Hunt's 'Have I Been Pwned?' public API";
+    homepage = "https://gitlab.com/kitsunix/pyHIBP/pyHIBP";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ aleksana ];
+  };
+}
diff --git a/pkgs/development/python-modules/python-ffmpeg/default.nix b/pkgs/development/python-modules/python-ffmpeg/default.nix
index 1991f7492667..0641ab386b5f 100644
--- a/pkgs/development/python-modules/python-ffmpeg/default.nix
+++ b/pkgs/development/python-modules/python-ffmpeg/default.nix
@@ -1,24 +1,46 @@
 {
   lib,
   buildPythonPackage,
+  fetchFromGitHub,
+  ffmpeg-headless,
+  setuptools,
   pyee,
-  fetchPypi,
-  setuptools-scm,
+  pytestCheckHook,
+  pytest-asyncio,
 }:
 
 buildPythonPackage rec {
-  pname = "python_ffmpeg";
+  pname = "python-ffmpeg";
   version = "2.0.12";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "GayAr1oGSi9TwkWvGpCbLXZI6gRVANltO81Qe4jUPcc=";
+  src = fetchFromGitHub {
+    owner = "jonghwanhyeon";
+    repo = "python-ffmpeg";
+    tag = "v${version}";
+    hash = "sha256-1dhkjrg7QUtYSyEV9c88HphdcFuSCSaGJqVAQmMF/5E=";
   };
 
-  propagatedBuildInputs = [ pyee ];
+  postPatch = ''
+    substituteInPlace ffmpeg/{ffmpeg.py,asyncio/ffmpeg.py,protocol.py} \
+      --replace-fail 'executable: str = "ffmpeg"' 'executable: str = "${lib.getExe ffmpeg-headless}"'
+    substituteInPlace tests/helpers.py \
+      --replace-fail '"ffprobe"' '"${lib.getExe' ffmpeg-headless "ffprobe"}"'
+
+    # Some systems can finish before the `0.1` timeout.
+    substituteInPlace tests/test_{,asyncio_}timeout.py \
+      --replace-fail 'ffmpeg.execute(timeout=0.1)' 'ffmpeg.execute(timeout=0.01)'
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [ pyee ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
-  nativeBuildInputs = [ setuptools-scm ];
   pythonImportsCheck = [ "ffmpeg" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/requests-http-message-signatures/default.nix b/pkgs/development/python-modules/requests-http-message-signatures/default.nix
new file mode 100644
index 000000000000..94662782c827
--- /dev/null
+++ b/pkgs/development/python-modules/requests-http-message-signatures/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  poetry-core,
+  cryptography,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "requests-http-message-signatures";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    domain = "dev.funkwhale.audio";
+    owner = "funkwhale";
+    repo = "requests-http-message-signatures";
+    tag = version;
+    hash = "sha256-1GObY+bF5wwgjDORUlO61bmIadK+EpZtyYGMgS9Bqzg=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    cryptography
+    requests
+  ];
+
+  # Tests require network access.
+  doCheck = false;
+
+  pythonImportsCheck = [ "requests_http_message_signatures" ];
+
+  meta = {
+    description = "Request authentication plugin implementing IETF HTTP Message Signatures";
+    homepage = "https://dev.funkwhale.audio/funkwhale/requests-http-message-signatures";
+    changelog = "https://dev.funkwhale.audio/funkwhale/requests-http-message-signatures/-/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-jinja2-compat/default.nix b/pkgs/development/python-modules/sphinx-jinja2-compat/default.nix
new file mode 100644
index 000000000000..11f8c0b6b587
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-jinja2-compat/default.nix
@@ -0,0 +1,47 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  whey,
+  whey-pth,
+  jinja2,
+  markupsafe,
+  standard-imghdr,
+  lib,
+}:
+buildPythonPackage rec {
+  pname = "sphinx-jinja2-compat";
+  version = "0.4.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "sphinx_jinja2_compat";
+    hash = "sha256-AYjwgC1Cw9pymXUztVoAgVZZp40/gdS0dHsfsVpXKOY=";
+  };
+
+  postPatch = ''
+    substituteInPlace \
+      requirements.txt PKG-INFO pyproject.toml \
+      --replace-fail "standard-imghdr==3.10.14" "standard-imghdr"
+  '';
+
+  build-system = [
+    whey
+    whey-pth
+  ];
+
+  dependencies = [
+    jinja2
+    markupsafe
+    standard-imghdr
+  ];
+
+  pythonImportsCheck = [ "sphinx_jinja2_compat" ];
+
+  meta = {
+    description = "Patches Jinja2 v3 to restore compatibility with earlier Sphinx versions";
+    homepage = "https://github.com/sphinx-toolbox/sphinx-jinja2-compat";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinx-toolbox/default.nix b/pkgs/development/python-modules/sphinx-toolbox/default.nix
new file mode 100644
index 000000000000..6635261717a8
--- /dev/null
+++ b/pkgs/development/python-modules/sphinx-toolbox/default.nix
@@ -0,0 +1,69 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  lib,
+  whey,
+  sphinx,
+  apeye,
+  autodocsumm,
+  beautifulsoup4,
+  cachecontrol,
+  dict2css,
+  filelock,
+  html5lib,
+  ruamel-yaml,
+  sphinx-autodoc-typehints,
+  sphinx-jinja2-compat,
+  sphinx-prompt,
+  sphinx-tabs,
+  tabulate,
+  python,
+}:
+buildPythonPackage rec {
+  pname = "sphinx-toolbox";
+  version = "4.0.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "sphinx_toolbox";
+    hash = "sha256-SMMUUdsuLYxxwDk55yoZ73vJLKeFCmLbY/x7uDlbZ4U=";
+  };
+
+  postPatch = ''
+    substituteInPlace \
+      requirements.txt PKG-INFO pyproject.toml \
+      --replace-fail "sphinx-tabs<3.4.7,>=1.2.1" "sphinx-tabs<=3.4.7,>=1.2.1"
+  '';
+
+  build-system = [ whey ];
+
+  dependencies = [
+    sphinx
+    apeye
+    autodocsumm
+    beautifulsoup4
+    cachecontrol
+    dict2css
+    filelock
+    html5lib
+    ruamel-yaml
+    sphinx-autodoc-typehints
+    sphinx-jinja2-compat
+    sphinx-prompt
+    sphinx-tabs
+    tabulate
+  ];
+
+  # Not PEP420 compliant, some variables are imported from within the package.
+  postFixup = ''
+    echo '__version__: str = "${version}"' > $out/${python.sitePackages}/sphinx_toolbox/__init__.py
+  '';
+
+  meta = {
+    description = "Box of handy tools for Sphinx";
+    homepage = "https://github.com/sphinx-toolbox/sphinx-toolbox";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/sphinxcontrib-mermaid/default.nix b/pkgs/development/python-modules/sphinxcontrib-mermaid/default.nix
new file mode 100644
index 000000000000..3cd42a0b9ebb
--- /dev/null
+++ b/pkgs/development/python-modules/sphinxcontrib-mermaid/default.nix
@@ -0,0 +1,37 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  sphinx,
+  pyyaml,
+  rst2pdf,
+  lib,
+}:
+buildPythonPackage rec {
+  pname = "sphinxcontrib-mermaid";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "sphinxcontrib_mermaid";
+    hash = "sha256-Loq2fT4eKBZmP5NH0Cao3uSoWKzdStMt0cgIiT24gUY=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    sphinx
+    pyyaml
+    rst2pdf
+  ];
+
+  pythonImportsCheck = [ "sphinxcontrib.mermaid" ];
+
+  meta = {
+    description = "Mermaid diagrams in yours sphinx powered docs";
+    homepage = "https://github.com/mgaitan/sphinxcontrib-mermaid";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/symbex/default.nix b/pkgs/development/python-modules/symbex/default.nix
index 94cb8baf6d0b..efb20406e642 100644
--- a/pkgs/development/python-modules/symbex/default.nix
+++ b/pkgs/development/python-modules/symbex/default.nix
@@ -36,12 +36,11 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # Broken due to click 8.2.0 update
+    # Fails with `TypeError: CliRunner.__init__() got an unexpected keyword argument 'mix_std...`
     # https://github.com/simonw/symbex/issues/48
-    "test_output"
-    "test_replace"
-    "test_replace_errors"
     "test_errors"
+    # Fails with AssertionError (SystemExit(1).stdout is '' not the expected message)
+    "test_output"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/troi/default.nix b/pkgs/development/python-modules/troi/default.nix
new file mode 100644
index 000000000000..32367c46f539
--- /dev/null
+++ b/pkgs/development/python-modules/troi/default.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  click,
+  lb-matching-tools,
+  liblistenbrainz,
+  more-itertools,
+  mutagen,
+  peewee,
+  psycopg2-binary,
+  py-sonic,
+  python-dateutil,
+  regex,
+  requests,
+  scikit-learn,
+  spotipy,
+  tqdm,
+  ujson,
+  unidecode,
+  pytestCheckHook,
+  requests-mock,
+}:
+
+buildPythonPackage rec {
+  pname = "troi";
+  version = "2025.08.06.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "metabrainz";
+    repo = "troi-recommendation-playground";
+    tag = "v${version}";
+    hash = "sha256-qLnXaNb1Kon+XPJYCPe31EgXpukIfzTa+LADOzFjE9Q=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  pythonRelaxDeps = [ "mutagen" ];
+  pythonRemoveDeps = [
+    # It's not used anywhere in the code.
+    # TODO: Remove in next update. See <https://github.com/metabrainz/troi-recommendation-playground/pull/179>
+    "countryinfo"
+  ];
+
+  dependencies = [
+    click
+    lb-matching-tools
+    liblistenbrainz
+    more-itertools
+    mutagen
+    peewee
+    psycopg2-binary
+    py-sonic
+    python-dateutil
+    regex
+    requests
+    scikit-learn
+    spotipy
+    tqdm
+    ujson
+    unidecode
+  ];
+
+  optional-dependencies = {
+    # Not packaged yet.
+    # nmslib = [ "nmslib-metabrainz" ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    requests-mock
+  ];
+
+  pythonImportsCheck = [ "troi" ];
+
+  meta = {
+    description = "ListenBrainz' empathic music recommendation/playlisting engine";
+    homepage = "https://github.com/metabrainz/troi-recommendation-playground";
+    changelog = "https://github.com/metabrainz/troi-recommendation-playground/releases/tag/${src.tag}";
+    license = lib.licenses.gpl2Only;
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/development/python-modules/typesense/default.nix b/pkgs/development/python-modules/typesense/default.nix
new file mode 100644
index 000000000000..78441621aa8d
--- /dev/null
+++ b/pkgs/development/python-modules/typesense/default.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  requests,
+  pytestCheckHook,
+  typesense,
+  curl,
+  pytest-mock,
+  requests-mock,
+  python-dotenv,
+  faker,
+  isort,
+}:
+
+buildPythonPackage rec {
+  pname = "typesense";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "typesense";
+    repo = "typesense-python";
+    tag = "v${version}";
+    hash = "sha256-vo9DW4kinb00zWW4yX8ibyelQxW3eVabn+oMddPEd18=";
+  };
+
+  patches = [
+    # See <https://github.com/typesense/typesense-python/pull/103>.
+    ./linux-only-metrics.patch
+    ./generated-temp-path.patch
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    typesense
+    curl
+    pytest-mock
+    requests-mock
+    python-dotenv
+    faker
+    isort
+  ];
+  disabledTestMarks = [ "open_ai" ];
+  disabledTests = [ "import_typing_extensions" ];
+
+  __darwinAllowLocalNetworking = true;
+
+  preCheck = ''
+    TYPESENSE_API_KEY="xyz" \
+    TYPESENSE_DATA_DIR="$(mktemp -d)" \
+    typesense-server &
+
+    typesense_pid=$!
+
+    # Wait for typesense to finish starting.
+    timeout 20 bash -c '
+      while ! curl -s --fail localhost:8108/health; do sleep 1; done
+    ' || false
+  '';
+  postCheck = ''
+    kill $typesense_pid
+  '';
+
+  pythonImportsCheck = [ "typesense" ];
+
+  meta = {
+    description = "Python client for Typesense, an open source and typo tolerant search engine";
+    homepage = "https://github.com/typesense/typesense-python";
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.ngi ];
+  };
+}
diff --git a/pkgs/development/python-modules/typesense/generated-temp-path.patch b/pkgs/development/python-modules/typesense/generated-temp-path.patch
new file mode 100644
index 000000000000..ddb15e2ea64d
--- /dev/null
+++ b/pkgs/development/python-modules/typesense/generated-temp-path.patch
@@ -0,0 +1,18 @@
+diff --git a/tests/operations_test.py b/tests/operations_test.py
+index 34bb74c..39f9265 100644
+--- a/tests/operations_test.py
++++ b/tests/operations_test.py
+@@ -51,11 +51,11 @@ def test_cache_clear(actual_operations: Operations) -> None:
+     assert response["success"]
+
+
+-def test_snapshot(actual_operations: Operations) -> None:
++def test_snapshot(actual_operations: Operations, tmp_path) -> None:
+     """Test that the Operations object can perform the snapshot operation."""
+     response = actual_operations.perform(
+         "snapshot",
+-        {"snapshot_path": "/tmp"},  # noqa: S108
++        {"snapshot_path": str(tmp_path)},  # noqa: S108
+     )
+
+     assert response["success"]
diff --git a/pkgs/development/python-modules/typesense/linux-only-metrics.patch b/pkgs/development/python-modules/typesense/linux-only-metrics.patch
new file mode 100644
index 000000000000..ac667a3e42f1
--- /dev/null
+++ b/pkgs/development/python-modules/typesense/linux-only-metrics.patch
@@ -0,0 +1,48 @@
+From 9f0024ae3a0377d15788256c72af7a692d250afc Mon Sep 17 00:00:00 2001
+From: dotlambda <github@dotlambda.de>
+Date: Thu, 23 Oct 2025 13:40:33 -0700
+Subject: [PATCH] test(metrics): some metrics only exists on Linux
+
+---
+ tests/metrics_test.py | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/tests/metrics_test.py b/tests/metrics_test.py
+index 1e1ea47..fecf3c0 100644
+--- a/tests/metrics_test.py
++++ b/tests/metrics_test.py
+@@ -2,6 +2,8 @@
+
+ from __future__ import annotations
+
++import platform
++
+ from typesense.metrics import Metrics
+
+
+@@ -9,13 +11,15 @@ def test_actual_retrieve(actual_metrics: Metrics) -> None:
+     """Test that the Debug object can retrieve a debug on Typesense server and verify response structure."""
+     response = actual_metrics.retrieve()
+
+-    assert "system_cpu_active_percentage" in response
++    if platform.system() == "Linux":
++        assert "system_cpu_active_percentage" in response
++        assert "system_network_received_bytes" in response
++        assert "system_network_sent_bytes" in response
++
+     assert "system_disk_total_bytes" in response
+     assert "system_disk_used_bytes" in response
+     assert "system_memory_total_bytes" in response
+     assert "system_memory_used_bytes" in response
+-    assert "system_network_received_bytes" in response
+-    assert "system_network_sent_bytes" in response
+     assert "typesense_memory_active_bytes" in response
+     assert "typesense_memory_allocated_bytes" in response
+     assert "typesense_memory_fragmentation_ratio" in response
+@@ -23,4 +27,4 @@ def test_actual_retrieve(actual_metrics: Metrics) -> None:
+     assert "typesense_memory_mapped_bytes" in response
+     assert "typesense_memory_metadata_bytes" in response
+     assert "typesense_memory_resident_bytes" in response
+-    assert "typesense_memory_retained_bytes" in response
+\ No newline at end of file
++    assert "typesense_memory_retained_bytes" in response
diff --git a/pkgs/games/dwarf-fortress/df.lock.json b/pkgs/games/dwarf-fortress/df.lock.json
index edc7c2755a7a..a7c577be9824 100644
--- a/pkgs/games/dwarf-fortress/df.lock.json
+++ b/pkgs/games/dwarf-fortress/df.lock.json
@@ -1,28 +1,28 @@
 {
   "game": {
     "latest": {
-      "linux": "53.03",
+      "linux": "53.05",
       "darwin": "0.47.05"
     },
     "versions": {
-      "53.03": {
+      "53.05": {
         "df": {
-          "version": "53.03",
+          "version": "53.05",
           "urls": {
             "linux": {
-              "url": "https://www.bay12games.com/dwarves/df_53_03_linux.tar.bz2",
-              "outputHash": "sha256-xvpgkUjZzAeayWEK6KFLHoikDZLwh3PnTmosqjlL3m8="
+              "url": "https://www.bay12games.com/dwarves/df_53_05_linux.tar.bz2",
+              "outputHash": "sha256-9x08aZHZJbH2JUTqFTPY7gkfqjgXHAnYJ0dZ0NimzsA="
             }
           }
         },
         "hack": {
-          "version": "53.03-r1",
+          "version": "53.05-r1",
           "git": {
             "url": "https://github.com/DFHack/dfhack.git",
-            "revision": "53.03-r1",
-            "outputHash": "sha256-q0IWKUGfpFdA8VyXmmsZvx7v9S2kD7pI0fUr74sj4pU="
+            "revision": "53.05-r1",
+            "outputHash": "sha256-PTDP+UxLHG4VzrHDDwVaerEasSg9m8ut8ZYgN0LO/C4="
           },
-          "xmlRev": "145f317340ac9327854318c7ba758ee2af5e1928"
+          "xmlRev": "2bd33eba052f6ea3f65f4a22670029f2311b07b4"
         }
       },
       "52.05": {
diff --git a/pkgs/kde/gear/elisa/default.nix b/pkgs/kde/gear/elisa/default.nix
index ee280ae93198..8eb318cfc0d5 100644
--- a/pkgs/kde/gear/elisa/default.nix
+++ b/pkgs/kde/gear/elisa/default.nix
@@ -1,14 +1,14 @@
 {
+  lib,
   mkKdeDerivation,
   qtmultimedia,
   libvlc,
+
+  withVLC ? true,
 }:
 mkKdeDerivation {
   pname = "elisa";
 
-  extraBuildInputs = [
-    qtmultimedia
-    libvlc
-  ];
+  extraBuildInputs = [ qtmultimedia ] ++ lib.optional withVLC libvlc;
   meta.mainProgram = "elisa";
 }
diff --git a/pkgs/os-specific/linux/netatop/default.nix b/pkgs/os-specific/linux/netatop/default.nix
index 4dc26015f0b8..a683c84567f4 100644
--- a/pkgs/os-specific/linux/netatop/default.nix
+++ b/pkgs/os-specific/linux/netatop/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   kernel,
   kernelModuleMakeFlags,
   kmod,
@@ -9,15 +10,17 @@
 }:
 
 let
-  version = "3.1";
+  version = "3.2.2";
 in
 
 stdenv.mkDerivation {
+  pname = "netatop";
+  inherit version;
   name = "netatop-${kernel.version}-${version}";
 
   src = fetchurl {
-    url = "http://www.atoptool.nl/download/netatop-${version}.tar.gz";
-    sha256 = "0qjw8glfdmngfvbn1w63q128vxdz2jlabw13y140ga9i5ibl6vvk";
+    url = "https://www.atoptool.nl/download/netatop-${version}.tar.gz";
+    hash = "sha256-UIqJd809HN1nWHoTwl46QUZHtI+S0c44/BOLWRSuo/Y=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -27,34 +30,30 @@ stdenv.mkDerivation {
   ];
 
   hardeningDisable = [ "pic" ];
-  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" ];
 
   patches = [
     # fix paths in netatop.service
     ./fix-paths.patch
-    # Specify PIDFile in /run, not /var/run to silence systemd warning
-    ./netatop.service.patch
+    # fix install paths and install the .ko instead of trying to invoke dkms
+    ./fix-makefile-install.patch
+    # replace init_module as needed by Linux 6.15 and above (backwards compatible)
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/netatop_kernel_6.15.patch?h=netatop-dkms&id=e5da6fa4fee5499c3e437cdd34281dd2b200508f";
+      hash = "sha256-JyNQNyDJQkM/hLpb/hp3Sw2tMA8XnYogduGDFqTQ3nQ=";
+    })
   ];
   preConfigure = ''
     patchShebangs mkversion
-    sed -i -e 's,^KERNDIR.*,KERNDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build,' \
-        */Makefile
-    sed -i -e 's,/lib/modules.*extra,'$out'/lib/modules/${kernel.modDirVersion}/extra,' \
-        -e s,/usr,$out, \
-        -e /init.d/d \
-        -e /depmod/d \
-        -e s,/lib/systemd,$out/lib/systemd, \
-        Makefile
-
     kmod=${kmod} substituteAllInPlace netatop.service
   '';
 
-  makeFlags = kernelModuleMakeFlags;
-
-  preInstall = ''
-    mkdir -p $out/lib/systemd/system $out/bin $out/sbin $out/share/man/man{4,8}
-    mkdir -p $out/lib/modules/${kernel.modDirVersion}/extra
-  '';
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "KMODDIRVERSION=${kernel.modDirVersion}"
+    # netatop builds both the module and daemon at once, and the daemon needs a wrapped cc to build
+    # pkgs/os-specific/linux/kernel/common-flags.nix unwraps the cc for kernel build, but we need the wrapped one
+    "CC=${stdenv.cc}/bin/cc"
+  ];
 
   meta = {
     description = "Network monitoring module for atop";
diff --git a/pkgs/os-specific/linux/netatop/fix-makefile-install.patch b/pkgs/os-specific/linux/netatop/fix-makefile-install.patch
new file mode 100644
index 000000000000..ee998b977ee5
--- /dev/null
+++ b/pkgs/os-specific/linux/netatop/fix-makefile-install.patch
@@ -0,0 +1,23 @@
+diff --color -ruN netatop-3.2.2.orig/Makefile netatop-3.2.2/Makefile
+--- netatop-3.2.2.orig/Makefile	2025-11-07 13:09:10.106363095 -0500
++++ netatop-3.2.2/Makefile	2025-11-07 16:25:35.251434714 -0500
+@@ -20,14 +20,12 @@
+ 
+ 
+ install:		netatop.ko netatopd
+-			cd /usr/src; dkms add -m netatop -v $(CURVERS)
+-			dkms build   -m netatop -v $(CURVERS)
+-			dkms install -m netatop -v $(CURVERS)
++			install -m 0644 netatop.ko -Dt $(out)/lib/modules/$(KMODDIRVERSION)/extra
+ 			#
+-			install netatopd -t /usr/sbin
+-			install -m 0644 netatop.service -t /lib/systemd/system
+-			install man/netatop.4 -t /usr/share/man/man4
+-			install man/netatopd.8 -t /usr/share/man/man8
++			install netatopd -Dt $(out)/sbin
++			install -m 0644 netatop.service -Dt $(out)/lib/systemd/system
++			install man/netatop.4 -Dt $(out)/share/man/man4
++			install man/netatopd.8 -Dt $(out)/share/man/man8
+ 
+ clean:
+ 			rm -f *.o *.ko
diff --git a/pkgs/os-specific/linux/netatop/netatop.service.patch b/pkgs/os-specific/linux/netatop/netatop.service.patch
deleted file mode 100644
index c7c798ee06bc..000000000000
--- a/pkgs/os-specific/linux/netatop/netatop.service.patch
+++ /dev/null
@@ -1,7 +0,0 @@
---- a/netatop.service
-+++ b/netatop.service
-@@ -11,3 +11,3 @@
- ExecStopPost=@kmod@/bin/rmmod netatop
--PIDFile=/var/run/netatop.pid
-+PIDFile=/run/netatop.pid
- RemainAfterExit=yes
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 85236e87a113..4c04fe4c3211 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -748,6 +748,7 @@ mapAliases {
   jdk23_headless = throw "OpenJDK 23 was removed as it has reached its end of life"; # Added 2025-11-04
   jdk24 = throw "OpenJDK 24 was removed as it has reached its end of life"; # Added 2025-10-04
   jdk24_headless = throw "OpenJDK 24 was removed as it has reached its end of life"; # Added 2025-10-04
+  jesec-rtorrent = throw "'jesec-rtorrent' has been removed due to lack of maintenance upstream."; # Added 2025-11-20
   jikespg = throw "'jikespg' has been removed due to lack of maintenance upstream."; # Added 2025-06-10
   jing = jing-trang; # Added 2025-09-18
   joplin = joplin-cli; # Added 2025-11-03
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ac55d2e9af23..22ae8800e998 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1224,6 +1224,18 @@ with pkgs;
 
   git-credential-manager = callPackage ../applications/version-management/git-credential-manager { };
 
+  git-credential-aol = callPackage ../by-name/gi/git-credential-email/git-credential-aol { };
+
+  git-credential-gmail = callPackage ../by-name/gi/git-credential-email/git-credential-gmail { };
+
+  git-credential-outlook = callPackage ../by-name/gi/git-credential-email/git-credential-outlook { };
+
+  git-credential-yahoo = callPackage ../by-name/gi/git-credential-email/git-credential-yahoo { };
+
+  git-msgraph = callPackage ../by-name/gi/git-credential-email/git-msgraph { };
+
+  git-protonmail = callPackage ../by-name/gi/git-credential-email/git-protonmail { };
+
   gitRepo = git-repo;
 
   merge-fmt = callPackage ../applications/version-management/merge-fmt {
@@ -3321,10 +3333,6 @@ with pkgs;
   libportal-qt5 = libportal.override { variant = "qt5"; };
   libportal-qt6 = libportal.override { variant = "qt6"; };
 
-  jesec-rtorrent = callPackage ../applications/networking/p2p/jesec-rtorrent {
-    libtorrent = callPackage ../applications/networking/p2p/jesec-rtorrent/libtorrent.nix { };
-  };
-
   librest = callPackage ../development/libraries/librest { };
 
   librest_1_0 = callPackage ../development/libraries/librest/1.0.nix { };
@@ -10805,11 +10813,6 @@ with pkgs;
   docker-compose = callPackage ../applications/virtualization/docker/compose.nix { };
   docker-sbom = callPackage ../applications/virtualization/docker/sbom.nix { };
 
-  drawio = callPackage ../applications/graphics/drawio {
-    inherit (darwin) autoSignDarwinBinariesHook;
-  };
-  drawio-headless = callPackage ../applications/graphics/drawio/headless.nix { };
-
   drawpile-server-headless = drawpile.override {
     buildClient = false;
     buildServerGui = false;
@@ -13182,11 +13185,6 @@ with pkgs;
 
   steamback = python3.pkgs.callPackage ../tools/games/steamback { };
 
-  protontricks = python3Packages.callPackage ../tools/package-management/protontricks {
-    steam-run = steam-run-free;
-    inherit winetricks yad;
-  };
-
   protonup-ng = with python3Packages; toPythonApplication protonup-ng;
 
   stuntrally = callPackage ../games/stuntrally { boost = boost183; };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 52102aced862..e707d545e034 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -780,6 +780,8 @@ self: super: with self; {
 
   apcaccess = callPackage ../development/python-modules/apcaccess { };
 
+  apeye = callPackage ../development/python-modules/apeye { };
+
   apeye-core = callPackage ../development/python-modules/apeye-core { };
 
   apipkg = callPackage ../development/python-modules/apipkg { };
@@ -1180,6 +1182,8 @@ self: super: with self; {
 
   autocommand = callPackage ../development/python-modules/autocommand { };
 
+  autodocsumm = callPackage ../development/python-modules/autodocsumm { };
+
   autofaiss = callPackage ../development/python-modules/autofaiss { };
 
   autoflake = callPackage ../development/python-modules/autoflake { };
@@ -3749,6 +3753,8 @@ self: super: with self; {
 
   dicomweb-client = callPackage ../development/python-modules/dicomweb-client { };
 
+  dict2css = callPackage ../development/python-modules/dict2css { };
+
   dict2xml = callPackage ../development/python-modules/dict2xml { };
 
   dictdiffer = callPackage ../development/python-modules/dictdiffer { };
@@ -3949,6 +3955,8 @@ self: super: with self; {
 
   django-cachalot = callPackage ../development/python-modules/django-cachalot { };
 
+  django-cache-memoize = callPackage ../development/python-modules/django-cache-memoize { };
+
   django-cache-url = callPackage ../development/python-modules/django-cache-url { };
 
   django-cacheops = callPackage ../development/python-modules/django-cacheops { };
@@ -8214,6 +8222,8 @@ self: super: with self; {
 
   lazy-object-proxy = callPackage ../development/python-modules/lazy-object-proxy { };
 
+  lb-matching-tools = callPackage ../development/python-modules/lb-matching-tools { };
+
   lc7001 = callPackage ../development/python-modules/lc7001 { };
 
   lcd-i2c = callPackage ../development/python-modules/lcd-i2c { };
@@ -8394,6 +8404,8 @@ self: super: with self; {
 
   liblarch = callPackage ../development/python-modules/liblarch { };
 
+  liblistenbrainz = callPackage ../development/python-modules/liblistenbrainz { };
+
   liblp = callPackage ../development/python-modules/liblp { };
 
   liblzfse = callPackage ../development/python-modules/liblzfse { inherit (pkgs) lzfse; };
@@ -12168,6 +12180,8 @@ self: super: with self; {
 
   plumbum = callPackage ../development/python-modules/plumbum { };
 
+  pluralizer = callPackage ../development/python-modules/pluralizer { };
+
   pluthon = callPackage ../development/python-modules/pluthon { };
 
   plux = callPackage ../development/python-modules/plux { };
@@ -13390,6 +13404,8 @@ self: super: with self; {
 
   pyhepmc = callPackage ../development/python-modules/pyhepmc { };
 
+  pyhibp = callPackage ../development/python-modules/pyhibp { };
+
   pyhidra = callPackage ../development/python-modules/pyhidra { };
 
   pyhik = callPackage ../development/python-modules/pyhik { };
@@ -16166,6 +16182,10 @@ self: super: with self; {
 
   requests-hawk = callPackage ../development/python-modules/requests-hawk { };
 
+  requests-http-message-signatures =
+    callPackage ../development/python-modules/requests-http-message-signatures
+      { };
+
   requests-http-signature = callPackage ../development/python-modules/requests-http-signature { };
 
   requests-kerberos = callPackage ../development/python-modules/requests-kerberos { };
@@ -17551,6 +17571,8 @@ self: super: with self; {
 
   sphinx-jinja = callPackage ../development/python-modules/sphinx-jinja { };
 
+  sphinx-jinja2-compat = callPackage ../development/python-modules/sphinx-jinja2-compat { };
+
   sphinx-jupyterbook-latex = callPackage ../development/python-modules/sphinx-jupyterbook-latex { };
 
   sphinx-last-updated-by-git =
@@ -17601,6 +17623,8 @@ self: super: with self; {
 
   sphinx-togglebutton = callPackage ../development/python-modules/sphinx-togglebutton { };
 
+  sphinx-toolbox = callPackage ../development/python-modules/sphinx-toolbox { };
+
   sphinx-version-warning = callPackage ../development/python-modules/sphinx-version-warning { };
 
   sphinx-versions = callPackage ../development/python-modules/sphinx-versions { };
@@ -17649,6 +17673,8 @@ self: super: with self; {
 
   sphinxcontrib-log-cabinet = callPackage ../development/python-modules/sphinxcontrib-log-cabinet { };
 
+  sphinxcontrib-mermaid = callPackage ../development/python-modules/sphinxcontrib-mermaid { };
+
   sphinxcontrib-moderncmakedomain =
     callPackage ../development/python-modules/sphinxcontrib-moderncmakedomain
       { };
@@ -19063,6 +19089,8 @@ self: super: with self; {
     }
   );
 
+  troi = callPackage ../development/python-modules/troi { };
+
   troposphere = callPackage ../development/python-modules/troposphere { };
 
   trove-classifiers = callPackage ../development/python-modules/trove-classifiers { };
@@ -19653,6 +19681,10 @@ self: super: with self; {
 
   types-xxhash = callPackage ../development/python-modules/types-xxhash { };
 
+  typesense = callPackage ../development/python-modules/typesense {
+    inherit (pkgs) typesense curl;
+  };
+
   typesentry = callPackage ../development/python-modules/typesentry { };
 
   typeshed-client = callPackage ../development/python-modules/typeshed-client { };