diff --git a/nixos/modules/config/power-management.nix b/nixos/modules/config/power-management.nix
index 47b3ad908f0a..202ecdb7cffb 100644
--- a/nixos/modules/config/power-management.nix
+++ b/nixos/modules/config/power-management.nix
@@ -104,7 +104,12 @@ in
         description = "Pre-Sleep Actions";
         wantedBy = [ "sleep.target" ];
         before = [ "sleep.target" ];
-        script = cfg.powerDownCommands;
+        script = ''
+          # NixOS pre-sleep script
+
+          # config.powerManagement.powerDownCommands
+          ${cfg.powerDownCommands}
+        '';
         serviceConfig.Type = "oneshot";
       };
 
@@ -114,8 +119,14 @@ in
         # Pulled in by post-resume.service above
         after = [ "sleep.target" ];
         script = ''
+          # NixOS pre-resume script
+
           /run/current-system/systemd/bin/systemctl try-restart --no-block post-resume.target
+
+          # config.powerManagement.resumeCommands
           ${cfg.resumeCommands}
+
+          # config.powerManagement.powerUpCommands
           ${cfg.powerUpCommands}
         '';
         serviceConfig.Type = "oneshot";
@@ -130,7 +141,12 @@ in
         before = [
           "shutdown.target"
         ];
-        script = cfg.powerDownCommands;
+        script = ''
+          # NixOS pre-shutdown script
+
+          # config.powerManagement.powerDownCommands
+          ${cfg.powerDownCommands}
+        '';
         serviceConfig.Type = "oneshot";
         unitConfig.DefaultDependencies = false;
       };
@@ -143,7 +159,12 @@ in
         wantedBy = [ "multi-user.target" ];
         restartIfChanged = false;
         script = ''
+          # NixOS post-boot script
+
+          # config.powerManagement.bootCommands
           ${cfg.bootCommands}
+
+          # config.powerManagement.powerUpCommands
           ${cfg.powerUpCommands}
         '';
         serviceConfig = {
diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index cf632fad3c67..a718daaf9514 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -340,7 +340,6 @@ in
                         substitute ${cfg.ui.package}/share/applications/netbird.desktop \
                             "$out/share/applications/${mkBin "netbird"}.desktop" \
                           --replace-fail 'Name=Netbird' "Name=NetBird @ ${client.service.name}" \
-                          --replace-fail '${lib.getExe cfg.ui.package}' "$out/bin/${mkBin "netbird-ui"}" \
                           --replace-fail 'Icon=netbird' "Icon=${cfg.ui.package}/share/pixmaps/netbird.png"
                       '')
                     ];
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index c5e6b28ae78d..38cd5a24d7e2 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -852,6 +852,16 @@ in
       };
     };
 
+    # Remove with systemd 259.4
+    security.polkit.extraConfig = mkIf config.security.polkit.enable ''
+      polkit.addRule(function(action, subject) {
+          if (action.id == "org.freedesktop.machine1.register-machine" &&
+              subject.user != "root") {
+              return polkit.Result.AUTH_ADMIN_KEEP;
+          }
+      });
+    '';
+
     # run0 is supposed to authenticate the user via polkit and then run a command. Without this next
     # part, run0 would fail to run the command even if authentication is successful and the user has
     # permission to run the command. This next part is only enabled if polkit is enabled because the
diff --git a/nixos/tests/netbird.nix b/nixos/tests/netbird.nix
index 962b5377cc9d..2dae10e77017 100644
--- a/nixos/tests/netbird.nix
+++ b/nixos/tests/netbird.nix
@@ -7,12 +7,13 @@
   ];
 
   nodes = {
-    node =
-      { ... }:
-      {
-        services.netbird.enable = true;
-        services.netbird.clients.custom.port = 51819;
+    node = {
+      services.netbird = {
+        enable = true;
+        clients.custom.port = 51819;
+        ui.enable = true;
       };
+    };
   };
 
   /*
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index fed532fc1649..68ec5189177e 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -403,8 +403,8 @@ let
         ];
         origArgs = args;
         origBuilder = builder;
-        QEMU_OPTS = "${QEMU_OPTS} -m ${toString memSize} -object memory-backend-memfd,id=mem,size=${toString memSize}M,share=on -machine memory-backend=mem";
-        passAsFile = [ ]; # HACK fix - see https://github.com/NixOS/nixpkgs/issues/16742
+        env.QEMU_OPTS = "${QEMU_OPTS} -m ${toString memSize} -object memory-backend-memfd,id=mem,size=${toString memSize}M,share=on -machine memory-backend=mem";
+        __structuredAttrs = true;
       }
     );
 
diff --git a/pkgs/by-name/at/atuin-desktop/package.nix b/pkgs/by-name/at/atuin-desktop/package.nix
index 2e3de7995a0b..411a27bbd67f 100644
--- a/pkgs/by-name/at/atuin-desktop/package.nix
+++ b/pkgs/by-name/at/atuin-desktop/package.nix
@@ -125,8 +125,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   # Otherwise tauri will look for a private key we don't have.
   tauriConf = builtins.toJSON { bundle.createUpdaterArtifacts = false; };
-  passAsFile = [ "tauriConf" ];
   preBuild = ''
+    tauriConfPath="tauriConf"
+    printf "%s" "$tauriConf" > "$tauriConfPath"
     tauriBuildFlags+=(
       "--config"
       "$tauriConfPath"
@@ -164,6 +165,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
   doCheck = !stdenv.isDarwin;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Local-first, executable runbook editor";
     homepage = "https://atuin.sh";
diff --git a/pkgs/by-name/db/dbus/package.nix b/pkgs/by-name/db/dbus/package.nix
index 09631d16f05c..b754f292c7c3 100644
--- a/pkgs/by-name/db/dbus/package.nix
+++ b/pkgs/by-name/db/dbus/package.nix
@@ -95,6 +95,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   __darwinAllowLocalNetworking = true;
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isStatic {
+    NIX_LDFLAGS = "-lcap-ng";
+  };
+
   mesonFlags = [
     "--libexecdir=${placeholder "out"}/libexec"
     # datadir from which dbus will load files will be managed by the NixOS module:
diff --git a/pkgs/by-name/dd/ddcutil/package.nix b/pkgs/by-name/dd/ddcutil/package.nix
index 80795c41efa9..36dfaaef23f3 100644
--- a/pkgs/by-name/dd/ddcutil/package.nix
+++ b/pkgs/by-name/dd/ddcutil/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ddcutil";
-  version = "2.2.3";
+  version = "2.2.6";
 
   src = fetchurl {
     url = "https://www.ddcutil.com/tarballs/ddcutil-${finalAttrs.version}.tar.gz";
-    hash = "sha256-4XvAUqYvnqhS2eOLpPHtfnNmVnoOGdvhpDnuca2+BqA=";
+    hash = "sha256-5LaRkcC0UK6iOjSlks88WPAn/hRiAgF5BwzJLV7K7Yg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index d00a52ada07f..d76760555644 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -23,7 +23,7 @@
 }:
 
 let
-  version = "2.0.3";
+  version = "2.0.4";
   devenvNixVersion = "2.32";
   devenvNixRev = "41eee9d3b1f611b1b90d51caa858b6d83834c44a";
 
@@ -48,10 +48,10 @@ rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     tag = "v${version}";
-    hash = "sha256-1DpF5F7zgOZ7QrRjz23315pUoF532dHnsU/V4UQithk=";
+    hash = "sha256-wPH6q2PSP64doUXHqdEAmY68X4IAeC2UjSIyqzoUYwE=";
   };
 
-  cargoHash = "sha256-gZFRbTDPQNKf2msBv9wOavaH1iB1Tk3shYf0/4TSZBQ=";
+  cargoHash = "sha256-CzhdUrNAAhCVnXZCk06djnBv1cczhj7tIG/JRmaBX5c=";
 
   env = {
     RUSTFLAGS = "--cfg tracing_unstable";
@@ -78,7 +78,6 @@ rustPlatform.buildRustPackage {
     openssl
     sqlite
     dbus
-    boehmgc
     llvmPackages.clang-unwrapped
     nix_components.nix-expr-c
     nix_components.nix-store-c
diff --git a/pkgs/by-name/gr/grafana/package.nix b/pkgs/by-name/gr/grafana/package.nix
index 550d3566677f..fa8064cf3cc8 100644
--- a/pkgs/by-name/gr/grafana/package.nix
+++ b/pkgs/by-name/gr/grafana/package.nix
@@ -21,7 +21,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana";
-  version = "12.4.0";
+  version = "12.4.1";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
     owner = "grafana";
     repo = "grafana";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HvQqMMU6UeL7wCew0cUG03/cXsnh5sh2/DmgcU8cJ1M=";
+    hash = "sha256-xzQMDIlvhzO8Cn6pav631T1NxIBDO7Qh71Jj/k8LSsE=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@@ -49,7 +49,7 @@ buildGoModule (finalAttrs: {
   # Since this is not a dependency attribute the buildPackages has to be specified.
   offlineCache = buildPackages.yarn-berry_4-fetcher.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-47Al3NqQQm5YVhaRyd5Gk0UaJz1+irKGY7BiZh2jO94=";
+    hash = "sha256-odT+qMGpeWlXG5jUGwM1PcqbaSR0FUiSUr3mq2mJFDw=";
   };
 
   disallowedRequisites = [ finalAttrs.offlineCache ];
diff --git a/pkgs/by-name/is/isle-portable/package.nix b/pkgs/by-name/is/isle-portable/package.nix
index 28b6638c7553..fc8ee37eb859 100644
--- a/pkgs/by-name/is/isle-portable/package.nix
+++ b/pkgs/by-name/is/isle-portable/package.nix
@@ -3,6 +3,7 @@
   callPackage,
   requireFile,
   runCommand,
+  writeText,
   makeBinaryWrapper,
   symlinkJoin,
   isle-portable-unwrapped ? callPackage ./unwrapped.nix { },
@@ -37,17 +38,7 @@ symlinkJoin (
     ) iniWithDisk;
 
     # Make a config ini file
-    iniFile =
-      runCommand "isle.ini"
-        {
-          passAsFile = [ "iniFile" ];
-
-          # Set the ISO path.
-          iniFile = lib.generators.toINI { } quotedIni;
-        }
-        ''
-          cp "$iniFilePath" "$out"
-        '';
+    iniFile = writeText "isle.ini" (lib.generators.toINI { } quotedIni);
   in
   {
     inherit (isle-portable-unwrapped) version;
diff --git a/pkgs/by-name/ki/kitty/package.nix b/pkgs/by-name/ki/kitty/package.nix
index 6760f22d1633..5a13478faa70 100644
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -39,8 +39,8 @@
   zsh,
   fish,
   nixosTests,
-  go,
-  buildGoModule,
+  go_1_26,
+  buildGo126Module,
   nix-update-script,
   makeBinaryWrapper,
   darwin,
@@ -51,21 +51,21 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.45.0";
+  version = "0.46.0";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     tag = "v${version}";
-    hash = "sha256-3XQWmLd8F0ndzzLOcV/7144M9enqc/7FULVLeM2Kpts=";
+    hash = "sha256-YkJtiJQd7V/OhR45rE1qNgu1RmhAwFmgu3YVpCLrGa4=";
   };
 
   goModules =
-    (buildGoModule {
+    (buildGo126Module {
       pname = "kitty-go-modules";
       inherit src version;
-      vendorHash = "sha256-aLl9hPfRmUE8VARwkwXhxjzDPKUGNGD+yzxY5pUIcgs=";
+      vendorHash = "sha256-DEaMBblHpfcrySuMqM6SGFPyEyVd8SiXYiftHQBnYdE=";
     }).goModules;
 
   buildInputs = [
@@ -110,7 +110,7 @@ buildPythonApplication rec {
     sphinx-copybutton
     sphinxext-opengraph
     sphinx-inline-tabs
-    go
+    go_1_26
     fontconfig
     makeBinaryWrapper
   ]
diff --git a/pkgs/by-name/ko/koules/package.nix b/pkgs/by-name/ko/koules/package.nix
index 39e73b91e6bd..02f7ba6ddb04 100644
--- a/pkgs/by-name/ko/koules/package.nix
+++ b/pkgs/by-name/ko/koules/package.nix
@@ -10,12 +10,13 @@
   libx11,
   libxext,
   makeDesktopItem,
+  imagemagick,
 }:
 
 let
   debian-extras = fetchzip {
-    url = "mirror://debian/pool/main/k/koules/koules_1.4-27.debian.tar.xz";
-    hash = "sha256-g0Z6C1YSZL6N2eYUuZgXkPDoOLc4e9jAFL3ivk3OAS8=";
+    url = "mirror://debian/pool/main/k/koules/koules_1.4-29.debian.tar.xz";
+    hash = "sha256-8AQGU3uAu1nCKeu4nqCDOL7FcSJeYvD1pmidEPLLekY=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -32,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     gccmakedep
     installShellFiles
     copyDesktopItems
+    imagemagick
   ];
   buildInputs = [
     libx11
@@ -60,7 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm755 xkoules $out/bin/xkoules
     install -Dm755 koules.sndsrv.linux $out/lib/koules.sndsrv.linux
     install -m644 sounds/* $out/lib/
-    install -Dm644 Koules.xpm $out/share/pixmaps/koules.xpm
+    mkdir -p $out/share/icons/hicolor/32x32/apps
+    magick Koules.xpm -background none -extent 32x32-1 -gravity center $out/share/icons/hicolor/32x32/apps/koules.png
     installManPage xkoules.6
     runHook postInstall
   '';
diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index ccbe6862a525..f21357f2091e 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -3,32 +3,22 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  runCommand,
   xcodebuild,
   protobuf,
   boringssl,
 }:
-let
-  # boring-sys expects the static libraries in build/ instead of lib/
-  boringssl-wrapper = runCommand "boringssl-wrapper" { } ''
-    mkdir $out
-    cd $out
-    ln -s ${boringssl.out}/lib build
-    ln -s ${boringssl.dev}/include include
-  '';
-in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.87.1";
+  version = "0.87.5";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yr2+yM7RmUQ7mNDMCcaM5cCpudof14JuO5J6D944k0U=";
+    hash = "sha256-xffBXvq1ikesIjw6cXfphnTIiyuMiUcY8h0pzSgfD8U=";
   };
 
   nativeBuildInputs = [
@@ -37,10 +27,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcodebuild ];
 
-  env.BORING_BSSL_PATH = "${boringssl-wrapper}";
-  env.NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
+  env = {
+    BORING_BSSL_INCLUDE_PATH = boringssl.dev + "/include";
+    BORING_BSSL_PATH = boringssl;
+    NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
+  };
 
-  cargoHash = "sha256-rqxp+RZuuT+nFudNeCgA8g04C9KT1Qi59K4b2avL5u4=";
+  cargoHash = "sha256-MwAtUrLoSi/pjsBWOAd9JoepAueq17hkZCH21q72O3w=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ll/llmfit/package.nix b/pkgs/by-name/ll/llmfit/package.nix
index 1cf00c82daf1..02029798f24c 100644
--- a/pkgs/by-name/ll/llmfit/package.nix
+++ b/pkgs/by-name/ll/llmfit/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "llmfit";
-  version = "0.6.7";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "AlexsJones";
     repo = "llmfit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kmpdbdfiKgfapIpfFAo1RnLy/DC1Rn0waRKCCLnyYVc=";
+    hash = "sha256-qrdumfjdzjZPhlubc9R4ila59nvNKVCH6HmeXhVcf0g=";
   };
 
-  cargoHash = "sha256-mvWlexpYK0kTycBG2I1sG/Kql9SqaZlYDpcM8nvLyJg=";
+  cargoHash = "sha256-1M4E9cFSYaKU41FO8lyFvkB+2GnNxUjxifk6ibmVd5I=";
 
   meta = {
     description = "Find what runs on your hardware";
diff --git a/pkgs/by-name/lu/lux-cli/package.nix b/pkgs/by-name/lu/lux-cli/package.nix
index 8bec3412c96b..a59849b54613 100644
--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -18,18 +18,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lux-cli";
 
-  version = "0.25.3";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "lumen-oss";
     repo = "lux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RpkgWcfc52tEYTPvqNvuD+JWrvLVaqX2f+Irem8E3IQ=";
+    hash = "sha256-AJ0HgUZXK+JsdOykZhr+snONMakfZbBmJrkY/HfpSoI=";
   };
 
   buildAndTestSubdir = "lux-cli";
 
-  cargoHash = "sha256-MfVC4vW5iV4HkfHA1N8UhgB53y5RVImnImI5C7CxVDA=";
+  cargoHash = "sha256-VNJPOIArmqiQ2LUNej9U0PGkjRr6gjo1DJn6XTDKNaA=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
index edded182be56..1db410c55b1f 100644
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -14,19 +14,19 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.148.0";
+  version = "1.149.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-MQOjuVBxwOKO11wc/FafqndI0QgZT3jaigpjRsJXxRA=";
+    hash = "sha256-A780cOls5/Xb3rmgOWUZj27Q4MtfTLhBoCPOw5ZOE/4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-LKO4Qa81AeUxEcUdvm43Bc8ANJJqtYEv5ucV0743yy0=";
+    hash = "sha256-rF1hCPUnsSpo/9+2oG4z2+qCqSSd5VQ5I3mRHz0uJ2w=";
   };
 
   build-system =
diff --git a/pkgs/by-name/ma/mautrix-signal/package.nix b/pkgs/by-name/ma/mautrix-signal/package.nix
index fbdb9cf03a8e..f87029a79b62 100644
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "26.02";
-  tag = "v0.2602.0";
+  version = "26.02.2";
+  tag = "v0.2602.2";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     inherit tag;
-    hash = "sha256-FWFAH+jtPdLG9vJS4QXpFjsGWUzILW17WRFyfdnFlAE=";
+    hash = "sha256-+VhplU/7FR8itvjqsn4wwfUlDiIQZmhXgh8rNm/mjS8=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/mc/mcp-grafana/package.nix b/pkgs/by-name/mc/mcp-grafana/package.nix
index 52c12dd1ade4..b46bfb5e18ae 100644
--- a/pkgs/by-name/mc/mcp-grafana/package.nix
+++ b/pkgs/by-name/mc/mcp-grafana/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HqNKbpmZCrEST2wesUo/swkT5wcnV2ZOpwYmqq+2EzA=";
+    hash = "sha256-rHUoHtJoZXDwXU7/fTAymmQGLwAFDRHwqMSbnZvsoUc=";
   };
 
   vendorHash = "sha256-w4v1/RqnNfGFzapmWd96UTT4Sc18lSVX5HvsXWWmhSY=";
diff --git a/pkgs/by-name/mp/mpd/package.nix b/pkgs/by-name/mp/mpd/package.nix
index 51df5dbb4064..ac8d482f472c 100644
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -197,13 +197,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mpd";
-  version = "0.24.8";
+  version = "0.24.9";
 
   src = fetchFromGitHub {
     owner = "MusicPlayerDaemon";
     repo = "MPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nVa4cNXr1lTcHQYoz1TVqgu/Ly6O3CL+2iHm92KOX3g=";
+    sha256 = "sha256-WBIPGdn8Hg/YH236epiNuenp8XwHoBcmgJa+CApIjBE=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 03c9e9fe5b7b..aa97b952519a 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -193,13 +193,7 @@ def copy_closure(
     Also supports copying a closure from a remote to another remote."""
 
     sshopts = os.getenv("NIX_SSHOPTS", "")
-    # This command is always run locally and needs to keep its own environent
-    # while merging NIX_SSHOPTS and SSH_DEFAULT_OPTS together.
-    # E.g.: to preserve SSH_AUTH_SOCK
-    env = {
-        **os.environ,
-        "NIX_SSHOPTS": " ".join(filter(lambda x: x, [sshopts, *SSH_DEFAULT_OPTS])),
-    }
+    env = {"NIX_SSHOPTS": " ".join(filter(lambda x: x, [sshopts, *SSH_DEFAULT_OPTS]))}
 
     def nix_copy_closure(host: Remote, to: bool) -> None:
         run_wrapper(
@@ -210,7 +204,7 @@ def copy_closure(
                 host.host,
                 closure,
             ],
-            env=env,
+            append_local_env=env,
         )
 
     def nix_copy(to_host: Remote, from_host: Remote) -> None:
@@ -226,7 +220,7 @@ def copy_closure(
                 f"ssh://{to_host.host}",
                 closure,
             ],
-            env=env,
+            append_local_env=env,
         )
 
     match (to_host, from_host):
@@ -724,11 +718,11 @@ def _run_action_with_systemd(
 
     try:
         _run_action(
-            action,
-            path_to_config,
-            install_bootloader,
-            target_host,
-            sudo,
+            action=action,
+            path_to_config=path_to_config,
+            install_bootloader=install_bootloader,
+            target_host=target_host,
+            sudo=sudo,
             prefix=[*SYSTEMD_RUN_CMD_PREFIX, f"--unit={unique_unit_name}"],
         )
     except KeyboardInterrupt:
@@ -767,11 +761,11 @@ def switch_to_configuration(
 
     if _has_systemd(target_host):
         _run_action_with_systemd(
-            action,
-            path_to_config,
-            install_bootloader,
-            target_host,
-            sudo,
+            action=action,
+            path_to_config=path_to_config,
+            install_bootloader=install_bootloader,
+            target_host=target_host,
+            sudo=sudo,
         )
     else:
         logger.debug(
@@ -779,11 +773,11 @@ def switch_to_configuration(
             "not working in target host"
         )
         _run_action(
-            action,
-            path_to_config,
-            install_bootloader,
-            target_host,
-            sudo,
+            action=action,
+            path_to_config=path_to_config,
+            install_bootloader=install_bootloader,
+            target_host=target_host,
+            sudo=sudo,
         )
 
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index aa32a20a7fac..2a24eca5baad 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -235,6 +235,7 @@ def run_wrapper(
     *,
     check: bool = True,
     env: Mapping[str, EnvValue] | None = None,
+    append_local_env: Mapping[str, str] | None = None,
     remote: Remote | None = None,
     sudo: bool = False,
     **kwargs: Unpack[RunKwargs],
@@ -245,12 +246,17 @@ def run_wrapper(
     )
 
     logger.debug(
-        "calling run with args=%r, kwargs=%r, env=%r",
+        "calling run with args=%r, kwargs=%r, env=%r, append_local_env=%r",
         _sanitize_env_run_args(list(final_args)),
         kwargs,
         env,
+        append_local_env,
     )
 
+    if append_local_env:
+        popen_env = dict(os.environ) if popen_env is None else dict(popen_env)
+        popen_env.update(append_local_env)
+
     try:
         r = subprocess.run(
             final_args,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
index 757067db9f06..efe8da7ffd6a 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
@@ -13,6 +13,7 @@ nixos-rebuild = "nixos_rebuild:main"
 nixos_rebuild = ["*.nix.template"]
 
 [tool.mypy]
+files = ["nixos_rebuild", "tests"]
 # `--strict` config, but explicit options to avoid breaking build when mypy is
 # updated
 warn_unused_configs = true
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 7a369ab9023f..4978be181ee0 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -1,4 +1,3 @@
-import os
 import sys
 import textwrap
 import uuid
@@ -79,11 +78,6 @@ def test_build_flake(mock_run: Mock, monkeypatch: MonkeyPatch, tmpdir: Path) ->
     )
 
 
-@patch.dict(
-    os.environ,
-    {"NIX_SSHOPTS": "--ssh opts", "SSH_ASKPASS": "/run/user/1000/ssh-agent"},
-    clear=True,
-)
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 @patch("uuid.uuid4", autospec=True)
 def test_build_remote(
@@ -140,8 +134,7 @@ def test_build_remote(
                     "user@host",
                     Path("/path/to/file"),
                 ],
-                env={
-                    "SSH_ASKPASS": "/run/user/1000/ssh-agent",
+                append_local_env={
                     "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
                 },
             ),
@@ -172,11 +165,6 @@ def test_build_remote(
     )
 
 
-@patch.dict(
-    os.environ,
-    {"NIX_SSHOPTS": "--ssh opts", "SSH_ASKPASS": "/run/user/1000/ssh-agent"},
-    clear=True,
-)
 @patch(
     get_qualified_name(n.run_wrapper, n),
     autospec=True,
@@ -190,6 +178,7 @@ def test_build_remote_flake(
     monkeypatch.chdir(tmpdir)
     flake = m.Flake.parse("/flake.nix#hostname")
     build_host = m.Remote("user@host", [], None)
+    monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
 
     assert n.build_remote_flake(
         "config.system.build.toplevel",
@@ -221,8 +210,7 @@ def test_build_remote_flake(
                     "user@host",
                     Path("/path/to/file"),
                 ],
-                env={
-                    "SSH_ASKPASS": "/run/user/1000/ssh-agent",
+                append_local_env={
                     "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
                 },
             ),
@@ -243,7 +231,6 @@ def test_build_remote_flake(
     )
 
 
-@patch.dict(os.environ, {}, clear=True)
 def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
     closure = Path("/path/to/closure")
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
@@ -256,7 +243,7 @@ def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
         n.copy_closure(closure, target_host)
         mock_run.assert_called_with(
             ["nix-copy-closure", "--to", "user@target.host", closure],
-            env={"NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS)},
+            append_local_env={"NIX_SSHOPTS": " ".join(p.SSH_DEFAULT_OPTS)},
         )
 
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-opt")
@@ -264,7 +251,9 @@ def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
         n.copy_closure(closure, None, build_host, {"copy_flag": True})
         mock_run.assert_called_with(
             ["nix-copy-closure", "--copy-flag", "--from", "user@build.host", closure],
-            env={"NIX_SSHOPTS": " ".join(["--ssh build-opt", *p.SSH_DEFAULT_OPTS])},
+            append_local_env={
+                "NIX_SSHOPTS": " ".join(["--ssh build-opt", *p.SSH_DEFAULT_OPTS])
+            },
         )
 
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-target-opt")
@@ -284,7 +273,7 @@ def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
                 "ssh://user@target.host",
                 closure,
             ],
-            env=env,
+            append_local_env=env,
         )
 
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
index a3c31d65c69d..9374e9d1620e 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
@@ -29,7 +29,7 @@ def test_remote_shell_script() -> None:
 
 @patch.dict(p.os.environ, {"PATH": "/path/to/bin"}, clear=True)
 @patch("subprocess.run", autospec=True)
-def test_run(mock_run: Any) -> None:
+def test_run_wrapper(mock_run: Any) -> None:
     p.run_wrapper(["test", "--with", "flags"], check=True)
     mock_run.assert_called_with(
         ["test", "--with", "flags"],
@@ -64,6 +64,51 @@ def test_run(mock_run: Any) -> None:
         input=None,
     )
 
+    p.run_wrapper(
+        ["test", "--with", "flags"],
+        check=False,
+        sudo=False,
+        append_local_env={"FOO": "bar"},
+    )
+    mock_run.assert_called_with(
+        [
+            "test",
+            "--with",
+            "flags",
+        ],
+        check=False,
+        text=True,
+        errors="surrogateescape",
+        env={
+            "FOO": "bar",
+            "PATH": "/path/to/bin",
+        },
+        input=None,
+    )
+
+    p.run_wrapper(
+        ["test", "--with", "flags"],
+        check=False,
+        sudo=False,
+        env={"PATH": "/"},
+        append_local_env={"FOO": "bar"},
+    )
+    mock_run.assert_called_with(
+        [
+            "test",
+            "--with",
+            "flags",
+        ],
+        check=False,
+        text=True,
+        errors="surrogateescape",
+        env={
+            "FOO": "bar",
+            "PATH": "/",
+        },
+        input=None,
+    )
+
     p.run_wrapper(
         ["test", "--with", "some flags"],
         check=True,
diff --git a/pkgs/by-name/pa/packcc/package.nix b/pkgs/by-name/pa/packcc/package.nix
index 72727a6468be..f23577fcc853 100644
--- a/pkgs/by-name/pa/packcc/package.nix
+++ b/pkgs/by-name/pa/packcc/package.nix
@@ -1,65 +1,47 @@
 {
   bats,
+  cmake,
   fetchFromGitHub,
   lib,
+  ninja,
   python3,
   stdenv,
-  testers,
   uncrustify,
+  versionCheckHook,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "packcc";
-  version = "2.2.0";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "arithy";
     repo = "packcc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fmZL34UL7epFFGo0gCsj8TcyhBt5uCfnLCLCQugXF6U=";
+    hash = "sha256-uRvZr6mw9eI0a4JxFwDNyPBIrwTHgq3KmarDP/NmrEs=";
   };
 
   postPatch = ''
-    patchShebangs tests
+    # Remove broken tests.
+    rm -rf \
+      tests/ast-calc.v3.d \
+      tests/style.d
   '';
 
-  dontConfigure = true;
-
-  preBuild = ''
-    cd build/${
-      if stdenv.cc.isGNU then
-        "gcc"
-      else if stdenv.cc.isClang then
-        "clang"
-      else
-        throw "Unsupported C compiler"
-    }
-  '';
-
-  doCheck = true;
-
-  nativeCheckInputs = [
-    bats
-    uncrustify
-    python3
+  nativeBuildInputs = [
+    cmake
+    ninja
   ];
 
-  preCheck = ''
-    # Style tests will always fail because upstream uses an older version of
-    # uncrustify.
-    rm -rf ../../tests/style.d
-  ''
-  + lib.optionalString stdenv.cc.isClang ''
-    export NIX_CFLAGS_COMPILE+=' -Wno-error=strict-prototypes -Wno-error=int-conversion'
-  '';
+  doCheck = true;
+  checkTarget = "check";
+  nativeCheckInputs = [
+    bats
+    python3
+    uncrustify
+  ];
 
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 release/bin/packcc $out/bin/packcc
-    runHook postInstall
-  '';
-
-  passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
+  doInstallCheck = true;
+  installCheckInputs = [ versionCheckHook ];
 
   meta = {
     description = "Parser generator for C";
diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 9e3465e813f0..2747b2a1c5f6 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BwoeeWb+g4w29V85MqhoPT9B16zJtrsgzxMwjUa4zLI=";
+    hash = "sha256-XWUotVd6DGk8IfE5UT2NjgSB6FL/HDEBr/wBFqOMe0I=";
   };
 
-  cargoHash = "sha256-7XbqXUvTyIKVE94vE/uRPYdtv8Ol05quPXVWlnCpeZg=";
+  cargoHash = "sha256-ZIkbA6rfS+8YhfP0YE4v9Me9FeRvLVLGRBUZnoA9ids=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/pr/process-cpp/package.nix b/pkgs/by-name/pr/process-cpp/package.nix
index 15c2c99e85ef..3efcfea94f99 100644
--- a/pkgs/by-name/pr/process-cpp/package.nix
+++ b/pkgs/by-name/pr/process-cpp/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "process-cpp";
-  version = "3.0.3";
+  version = "3.1.0";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lib-cpp/process-cpp";
     rev = finalAttrs.version;
-    hash = "sha256-PmlgzCEvBPC0k/pU6xneKINOGAas+hDWIrWUEkj+rDU=";
+    hash = "sha256-hS9V1SLO1eaIFz6ppF87c0kXHHQq6ZPOxfr00XuvWhQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/pr/prusa-slicer/package.nix b/pkgs/by-name/pr/prusa-slicer/package.nix
index ef23c31a461b..39e2840dcf07 100644
--- a/pkgs/by-name/pr/prusa-slicer/package.nix
+++ b/pkgs/by-name/pr/prusa-slicer/package.nix
@@ -203,10 +203,6 @@ clangStdenv.mkDerivation (finalAttrs: {
     mkdir -p "$out/lib"
     mv -v $out/bin/*.* $out/lib/
 
-    mkdir -p "$out/share/pixmaps/"
-    ln -s "$out/share/PrusaSlicer/icons/PrusaSlicer.png" "$out/share/pixmaps/PrusaSlicer.png"
-    ln -s "$out/share/PrusaSlicer/icons/PrusaSlicer-gcodeviewer_192px.png" "$out/share/pixmaps/PrusaSlicer-gcodeviewer.png"
-
     mkdir -p "$out"/share/mime/packages
     cat << EOF > "$out"/share/mime/packages/prusa-gcode-viewer.xml
     <?xml version="1.0" encoding="UTF-8"?>
diff --git a/pkgs/by-name/ps/psysh/package.nix b/pkgs/by-name/ps/psysh/package.nix
index c5c0260536ef..6f63caefc693 100644
--- a/pkgs/by-name/ps/psysh/package.nix
+++ b/pkgs/by-name/ps/psysh/package.nix
@@ -6,13 +6,13 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "psysh";
-  version = "0.12.20";
+  version = "0.12.21";
 
   src = fetchFromGitHub {
     owner = "bobthecow";
     repo = "psysh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YTKViaWBCUxerYklo22mNzrFp8M/RE3VLHrqhXuYkes=";
+    hash = "sha256-/qY7o7gsO0SdDzf9sfWFDpO/fjX3tSAoKsTeSGQ65HM=";
     forceFetchGit = true;
     postFetch = ''
       cp $out/build/composer.json $out/
@@ -20,7 +20,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-u3aCYxYblnbM7m1GXnhBqSlgohmGAT9jfieLFnaAx0g=";
+  vendorHash = "sha256-gYFix4QRVuUne+brU/Vfa1sS6tiUPAu8NRE7c4WUBPU=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index 86fbc1aceba0..954f3ac95397 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -16,14 +16,14 @@
 
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "06.02.04";
+  version = "06.02.05";
 
   src = fetchFromGitea {
     domain = "git.skoll.ca";
     owner = "Skollsoft-Public";
     repo = "Remind";
     rev = version;
-    hash = "sha256-7fNc/BiXliyLYif291G83ET2NtiU/dLgbhwut+JbjP0=";
+    hash = "sha256-7zjQMnC4OwfwaqMlH9IABkwUw7RUKIQj2gl3rXKiRLI=";
   };
 
   propagatedBuildInputs = lib.optionals withGui [
diff --git a/pkgs/by-name/sl/slurm/package.nix b/pkgs/by-name/sl/slurm/package.nix
index 47ef000f1494..974657f170e0 100644
--- a/pkgs/by-name/sl/slurm/package.nix
+++ b/pkgs/by-name/sl/slurm/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slurm";
-  version = "25-11-3-1";
+  version = "25-11-4-1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "slurm-${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-wG94g5fb39A/JqJgdKn8EuXTg1xtGNQw9vJn4jAF3z0=";
+    hash = "sha256-5axewcMS7+S9R7aQUlQH24M8+AeqO1/qNv+WZMkVDUc=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/so/somo/package.nix b/pkgs/by-name/so/somo/package.nix
index 676fae36822e..44749dc532f7 100644
--- a/pkgs/by-name/so/somo/package.nix
+++ b/pkgs/by-name/so/somo/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "somo";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "theopfr";
     repo = "somo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LURaGG0S3qE7lK4CgDEoNfJJOzZT3/FAQB6Bgt3/a3Y=";
+    hash = "sha256-EFU2JuNAWtlyS8UI4wnxgQEWVGSRu+02wPqUsWkQD9A=";
   };
 
-  cargoHash = "sha256-KZxEHwmLTFs0RqjvM8DbropsbiYEMNmsOOgFUNKE8Ls=";
+  cargoHash = "sha256-/l8nHbJWqSvJ/u1K/S+icHOdXfWe/aR9sJndGvKEOyM=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/up/uptime-kuma/package.nix b/pkgs/by-name/up/uptime-kuma/package.nix
index 1754472d87c6..6b31a0f17ff0 100644
--- a/pkgs/by-name/up/uptime-kuma/package.nix
+++ b/pkgs/by-name/up/uptime-kuma/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "uptime-kuma";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "louislam";
     repo = "uptime-kuma";
     tag = finalAttrs.version;
-    hash = "sha256-L1YDh5yBEoqjIeHkuLZe0uo6xMRuMh2Eu15wS6yhLDQ=";
+    hash = "sha256-pofxivhITkYezxjZkCY5jgOkoyEnmbzTrGZRKF5jAqQ=";
   };
 
-  npmDepsHash = "sha256-E8lPxLYn74BOgfIW8wPoiUGYXbnFnSanY45wQUxPHd4=";
+  npmDepsHash = "sha256-jg8NUnQlH/7Pw2at4beTbzA+WbGu21aWAHQ4cLJGXNc=";
 
   patches = [
     # Fixes the permissions of the database being not set correctly
diff --git a/pkgs/by-name/vc/vcmi/package.nix b/pkgs/by-name/vc/vcmi/package.nix
index 2b3c90d73850..a805655ac767 100644
--- a/pkgs/by-name/vc/vcmi/package.nix
+++ b/pkgs/by-name/vc/vcmi/package.nix
@@ -24,6 +24,7 @@
   versionCheckHook,
   xz,
   zlib,
+  enableMMAI ? true,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vcmi";
@@ -62,7 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qttools
     xz
     zlib
-  ];
+  ]
+  ++ lib.optional enableMMAI onnxruntime;
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_CLIENT" true)
@@ -72,6 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "ENABLE_TEST" false) # Requires nonfree data files.
     (lib.cmakeBool "ENABLE_PCH" false)
     (lib.cmakeBool "ENABLE_DISCORD" false)
+    (lib.cmakeBool "ENABLE_MMAI" enableMMAI)
     (lib.cmakeFeature "CMAKE_INSTALL_RPATH" "$out/lib/vcmi")
     (lib.cmakeFeature "CMAKE_INSTALL_BINDIR" "bin")
     (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index 65f5c8a1a324..f48fb10a3768 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,29 +10,25 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.56.2";
+  version = "2.62.2";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xf7S3hpJ/+ZmmBdGWOsyshF+FI5X9M3yOvjrxpNgy+Y=";
+    hash = "sha256-DRztwFKP3G5NyonyHtEMmHLDYgd0GAomEv3Kk1ANDsk=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-YNcff8KwSWfiILBuSVS7BFokMgsErQ1AhrXJGrhztDM=";
-
-  subPackages = [ "cmd/werf" ];
-
-  nativeBuildInputs = [
-    installShellFiles
-    versionCheckHook
-  ];
+  vendorHash = "sha256-DLDwZEKFOgzFvPOwJ99h/a7QVRHGgRHmWFue1JvmRh8=";
 
+  nativeBuildInputs = [ installShellFiles ];
   buildInputs =
     lib.optionals stdenv.hostPlatform.isLinux [ btrfs-progs ]
     ++ lib.optionals stdenv.hostPlatform.isGnu [ stdenv.cc.libc.static ];
 
+  subPackages = [ "cmd/werf" ];
+
   env.CGO_ENABLED = if stdenv.hostPlatform.isLinux then 1 else 0;
 
   ldflags = [
@@ -62,7 +58,6 @@ buildGoModule (finalAttrs: {
   ];
 
   nativeCheckInputs = [ writableTmpDirAsHomeHook ];
-
   preCheck = ''
     # Test all packages.
     unset subPackages
@@ -72,7 +67,8 @@ buildGoModule (finalAttrs: {
       integration/suites \
       pkg/true_git/*_test.go \
       pkg/werf/exec/*_test.go \
-      test/e2e
+      test/e2e \
+      test/legacy_e2e
   ''
   + lib.optionalString (finalAttrs.env.CGO_ENABLED == 0) ''
     # A workaround for osusergo.
@@ -80,7 +76,7 @@ buildGoModule (finalAttrs: {
   '';
 
   doInstallCheck = true;
-
+  nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "version";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
index b356591dbf67..fe0a9a2e6e02 100644
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "28.4";
-  hash = "sha256-1WqxypHs2/a0x+uyo0YxMIlH0YRGo/UZHptHcrPK1c4=";
+  version = "28.4.1";
+  hash = "sha256-0J4bNyLwZdP4ac/TzPIQUch0NeNGbcDKaRSnH83C5Lk=";
 }
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index c4325a4494f5..e674de90810f 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -165,21 +165,55 @@ let
         );
       }
       // __splices;
+      # When we override the interpreter we also need to override the spliced
+      # versions of the interpreter. NOTE: In lua-5/interpreter.nix, this
+      # filter is different - we take every attribute from @inputs, besides
+      # derivations. That filter causes cross compilations issues for Python
+      # See e.g:
+      #
+      # pkgsCross.armv7l-hf-multiplatform.buildPackages.python3Packages.bcrypt
+      #
+      # And the following Nixpkgs issues/PRs:
+      #
+      # - https://github.com/NixOS/nixpkgs/issues/48046
+      # - https://github.com/NixOS/nixpkgs/pull/480005 (Wrong PR)
+      # - https://github.com/NixOS/nixpkgs/pull/482866 (Correct fix)
+      # - https://github.com/NixOS/nixpkgs/pull/498251 (Re-adds this @inputs filter)
+      inputs' = lib.filterAttrs (
+        n: v:
+        (builtins.elem (builtins.typeOf v) [
+          "int"
+          "bool"
+          "string"
+          "path"
+          "null"
+        ])
+        || n == "packageOverrides"
+      ) inputs;
       override =
         attr:
         let
-          python = attr.override {
-            self = python;
-          };
+          python = attr.override (
+            inputs'
+            // {
+              self = python;
+            }
+          );
         in
         python;
-    in
-    passthruFun rec {
-      inherit self sourceVersion packageOverrides;
-      implementation = "cpython";
-      libPrefix = "python${pythonVersion}${lib.optionalString (!enableGIL) "t"}";
-      executable = libPrefix;
       pythonVersion = with sourceVersion; "${major}.${minor}";
+      libPrefix = "python${pythonVersion}${lib.optionalString (!enableGIL) "t"}";
+    in
+    passthruFun {
+      inherit
+        self
+        sourceVersion
+        packageOverrides
+        libPrefix
+        pythonVersion
+        ;
+      implementation = "cpython";
+      executable = libPrefix;
       sitePackages = "lib/${libPrefix}/site-packages";
       inherit hasDistutilsCxxPatch pythonAttr;
       inherit (splices)
diff --git a/pkgs/development/python-modules/modelscope/default.nix b/pkgs/development/python-modules/modelscope/default.nix
index 4b16aa46e833..4aa33cbb5faf 100644
--- a/pkgs/development/python-modules/modelscope/default.nix
+++ b/pkgs/development/python-modules/modelscope/default.nix
@@ -8,19 +8,16 @@
   tqdm,
 }:
 
-let
-  version = "1.34.0";
-in
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "modelscope";
-  inherit version;
+  version = "1.35";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "modelscope";
     repo = "modelscope";
-    tag = "v${version}";
-    hash = "sha256-Uq8qmU8ZmNRegaWHn1hlDDpRjWjgfecBvJklmhW36eM=";
+    tag = finalAttrs.version;
+    hash = "sha256-CPiiVJDY8KjwYXW5oTZcaLjozSZrQ5JwQGT8Xitum3E=";
   };
 
   build-system = [ setuptools ];
@@ -46,4 +43,4 @@ buildPythonPackage {
       doronbehar
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/plopp/default.nix b/pkgs/development/python-modules/plopp/default.nix
index 74d4d9ff8617..c9d83bceb510 100644
--- a/pkgs/development/python-modules/plopp/default.nix
+++ b/pkgs/development/python-modules/plopp/default.nix
@@ -36,14 +36,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plopp";
-  version = "26.2.1";
+  version = "26.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipp";
     repo = "plopp";
     tag = finalAttrs.version;
-    hash = "sha256-31F6hVrVRNdvzAEifdeNsa5B52D/VtNWn4F9qUcSKJ0=";
+    hash = "sha256-A8F2Gd0HmHRlusScFoFulsFaqaXA/HxmtT8ODdRLA+U=";
   };
 
   build-system = [
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index eb6bfae41550..7a4822b139c8 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.0-rc2",
-        "hash": "sha256:11zw5rck5hg1w8jjjgc8hjmswzdv4k1wqnkg4zmzxg0ds447cd0b",
+        "version": "7.0-rc3",
+        "hash": "sha256:1f9rkk1h1m84yglxgicasmdgywim7zc2ndn0ya7wm27kc8f3whw5",
         "lts": false
     },
     "6.1": {
@@ -30,13 +30,13 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.16",
-        "hash": "sha256:1qwfsbr315c6qh3hnqmyjwjcj0h8j3w56hbrxnrx3h849lgw08ag",
+        "version": "6.18.17",
+        "hash": "sha256:03gqbb33lbh6ip4dvsr645kjhj1jxzaqc8mqsp6mrg4h0nmrgzrb",
         "lts": true
     },
     "6.19": {
-        "version": "6.19.6",
-        "hash": "sha256:051fq8mkb7sf3m24a45cacr73fmpljfdn0pgjh0qrxhl6bvkz7sd",
+        "version": "6.19.7",
+        "hash": "sha256:0blmc3gmqyg1fj390gjz3brjznyn7s9m4f6w107ypygmhf5qgh82",
         "lts": false
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/update-zen.py b/pkgs/os-specific/linux/kernel/update-zen.py
index 5fe19ef8cb84..9b852b164b99 100755
--- a/pkgs/os-specific/linux/kernel/update-zen.py
+++ b/pkgs/os-specific/linux/kernel/update-zen.py
@@ -58,30 +58,30 @@ def nix_prefetch_url(url, unpack=False):
     return out.decode('utf-8').rstrip()
 
 
-def update_file(relpath, variant, version, suffix, sha256):
+def update_file(relpath, version, suffix, sha256):
     file_path = os.path.join(DIR, relpath)
     with fileinput.FileInput(file_path, inplace=True) as f:
         for line in f:
             result = line
             result = re.sub(
-                fr'^      version = ".+"; # {variant}',
-                f'      version = "{version}"; # {variant}',
+                fr'^  version = ".+";',
+                f'  version = "{version}";',
                 result)
             result = re.sub(
-                fr'^      suffix = ".+"; # {variant}',
-                f'      suffix = "{suffix}"; # {variant}',
+                fr'^  suffix = ".+";',
+                f'  suffix = "{suffix}";',
                 result)
             result = re.sub(
-                fr'^      sha256 = ".+"; # {variant}',
-                f'      sha256 = "{sha256}"; # {variant}',
+                fr'^    sha256 = ".+";',
+                f'    sha256 = "{sha256}";',
                 result)
             print(result, end='')
 
 
-def read_file(relpath, variant):
+def read_file(relpath):
     file_path = os.path.join(DIR, relpath)
-    re_version = re.compile(fr'^\s*version = "(.+)"; # {variant}')
-    re_suffix = re.compile(fr'^\s*suffix = "(.+)"; # {variant}')
+    re_version = re.compile(fr'^\s*version = "(.+)";')
+    re_suffix = re.compile(fr'^\s*suffix = "(.+)";')
     version = None
     suffix = None
     with fileinput.FileInput(file_path, mode='r') as f:
@@ -102,12 +102,7 @@ def read_file(relpath, variant):
 
 
 if __name__ == "__main__":
-    if len(sys.argv) == 1:
-        panic("Update variant expected")
-    variant = sys.argv[1]
-    if variant not in ("zen", "lqx"):
-        panic(f"Unexepected variant instead of 'zen' or 'lqx': {sys.argv[1]}")
-    pattern = re.compile(fr"v(\d+\.\d+\.?\d*)-({variant}\d+)")
+    pattern = re.compile(fr"v(\d+\.\d+\.?\d*)-(zen\d+)")
     zen_tags = github_api_request('repos/zen-kernel/zen-kernel/releases')
     for tag in zen_tags:
         zen_match = pattern.match(tag['tag_name'])
@@ -116,7 +111,7 @@ if __name__ == "__main__":
             zen_version = zen_match.group(1)
             zen_suffix = zen_match.group(2)
             break
-    old_version, old_suffix = read_file('zen-kernels.nix', variant)
+    old_version, old_suffix = read_file('zen-kernels.nix')
     if old_version != zen_version or old_suffix != zen_suffix:
         zen_hash = nix_prefetch_git('https://github.com/zen-kernel/zen-kernel.git', zen_tag)
-        update_file('zen-kernels.nix', variant, zen_version, zen_suffix, zen_hash)
+        update_file('zen-kernels.nix', zen_version, zen_suffix, zen_hash)
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 6e5d5d9d4df6..67f5d56715db 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.16";
-      hash = "sha256-qBcYKjVEg2DnGk9ywmDUCVCryyPZYnR7d4Y3QbiEa/c=";
+      version = "6.18.17";
+      hash = "sha256-REUiyKNRDhpE0vRJb+PyBpOQem0oZrV+rbeLtkkJSTo=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.19.6";
-      hash = "sha256-6b0N9Q8Z3d5pElXHZHJlb2lALCsd3vCWhXA9kBYhyLk=";
+      version = "6.19.7";
+      hash = "sha256-I0bv4r08pUuhjJR1ksti2vDqzq2tZdNcaD24kDBLssk=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 5ba540e4a996..a403b0be58b0 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   buildLinux,
-  variant,
   ...
 }@args:
 
@@ -12,160 +11,92 @@ let
   # file), we need something lower to override them, but we still want users to
   # override options if they need using lib.mkForce (that has 50 priority)
   mkKernelOverride = lib.mkOverride 90;
-  # Comments with variant added for update script
-  variants = {
-    # ./update-zen.py zen
-    zen = {
-      version = "6.18.13"; # zen
-      suffix = "zen1"; # zen
-      sha256 = "0x6s3pa7c6zlvr3w2fv6i15v54cy1pschvgk7b4vrzx1bcrjdxf7"; # zen
-      isLqx = false;
-    };
-    # ./update-zen.py lqx
-    lqx = {
-      version = "6.19.6"; # lqx
-      suffix = "lqx1"; # lqx
-      sha256 = "19ayfp9wiax25ji81dk7ylrdjjgzyahb9d27hcvhgbbr1irlg3w6"; # lqx
-      isLqx = true;
-    };
-  };
-  zenKernelsFor =
-    {
-      version,
-      suffix,
-      sha256,
-      isLqx,
-    }:
-    buildLinux (
-      args
-      // {
-        inherit version;
-        pname = "linux-${if isLqx then "lqx" else "zen"}";
-        modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
-        isZen = true;
 
-        src = fetchFromGitHub {
-          owner = "zen-kernel";
-          repo = "zen-kernel";
-          rev = "v${version}-${suffix}";
-          inherit sha256;
-        };
-
-        # This is based on the following sources:
-        # - zen: https://gitlab.archlinux.org/archlinux/packaging/packages/linux-zen/-/blob/main/config
-        # - lqx: https://github.com/damentz/liquorix-package/blob/6.13/master/linux-liquorix/debian/config/kernelarch-x86/config-arch-64
-        # - Liquorix features: https://liquorix.net/
-        # The list below is not exhaustive, so the kernels probably doesn't match
-        # the upstream, but should bring most of the improvements that will be
-        # expected by users
-        structuredExtraConfig =
-          with lib.kernel;
-          {
-            # Zen Interactive tuning
-            ZEN_INTERACTIVE = yes;
-
-            # FQ-Codel Packet Scheduling
-            NET_SCH_DEFAULT = yes;
-            DEFAULT_FQ_CODEL = yes;
-
-            # Preempt (low-latency)
-            PREEMPT = mkKernelOverride yes;
-            PREEMPT_VOLUNTARY = mkKernelOverride no;
-
-            # Preemptible tree-based hierarchical RCU
-            TREE_RCU = yes;
-            PREEMPT_RCU = yes;
-            RCU_EXPERT = yes;
-            TREE_SRCU = yes;
-            TASKS_RCU_GENERIC = yes;
-            TASKS_RCU = yes;
-            TASKS_RUDE_RCU = yes;
-            TASKS_TRACE_RCU = yes;
-            RCU_STALL_COMMON = yes;
-            RCU_NEED_SEGCBLIST = yes;
-            RCU_FANOUT = freeform "64";
-            RCU_FANOUT_LEAF = freeform "16";
-            RCU_BOOST = yes;
-            RCU_BOOST_DELAY = option (freeform "500");
-            RCU_NOCB_CPU = yes;
-            RCU_LAZY = yes;
-            RCU_DOUBLE_CHECK_CB_TIME = yes;
-
-            # BFQ I/O scheduler
-            IOSCHED_BFQ = mkKernelOverride yes;
-
-            # Futex WAIT_MULTIPLE implementation for Wine / Proton Fsync.
-            FUTEX = yes;
-            FUTEX_PI = yes;
-
-            # NT synchronization primitive emulation
-            NTSYNC = yes;
-
-            # Preemptive Full Tickless Kernel at 1000Hz
-            HZ = freeform "1000";
-            HZ_1000 = yes;
-
-          }
-          // lib.optionalAttrs isLqx {
-            # https://github.com/damentz/liquorix-package/commit/07b176edc002f2a7825ae181613e1f79a3650fd2
-            CMDLINE_BOOL = yes;
-            CMDLINE = freeform "audit=0 intel_pstate=disable amd_pstate=disable ";
-
-            # Google's BBRv3 TCP congestion Control
-            TCP_CONG_BBR = yes;
-            DEFAULT_BBR = yes;
-
-            # PDS Process Scheduler
-            SCHED_ALT = yes;
-            SCHED_PDS = yes;
-
-            # https://github.com/damentz/liquorix-package/commit/a7055b936c0f4edb8f6afd5263fe1d2f8a5cd877
-            RCU_BOOST = no;
-            RCU_LAZY = mkKernelOverride no;
-
-            # Swap storage is compressed with LZ4 using zswap
-            ZSWAP_COMPRESSOR_DEFAULT_LZ4 = yes;
-            ZSWAP_COMPRESSOR_DEFAULT_ZSTD = mkKernelOverride no;
-
-            # https://github.com/damentz/liquorix-package/commit/3a82381a4db3452599e2b2a607046a379c72ad27
-            SLAB_BUCKETS = mkKernelOverride (option no);
-            # https://github.com/damentz/liquorix-package/commit/ca7efe07abd478f3f4cbe0725a3383fd235aa5be
-            ENERGY_MODE = mkKernelOverride (option no);
-            # https://github.com/damentz/liquorix-package/commit/fdc93f5633d22c26f0994fba751a26de0cb51a17
-            WQ_POWER_EFFICIENT_DEFAULT = mkKernelOverride (option no);
-
-            # Fix error: unused option: XXX.
-            CFS_BANDWIDTH = mkKernelOverride (option no);
-            PSI = mkKernelOverride (option no);
-            RT_GROUP_SCHED = mkKernelOverride (option no);
-            SCHED_AUTOGROUP = mkKernelOverride (option no);
-            SCHED_CLASS_EXT = mkKernelOverride (option no);
-            SCHED_CORE = mkKernelOverride (option no);
-            UCLAMP_TASK = mkKernelOverride (option no);
-            UCLAMP_TASK_GROUP = mkKernelOverride (option no);
-          };
-
-        extraPassthru.updateScript = [
-          ./update-zen.py
-          (if isLqx then "lqx" else "zen")
-        ];
-
-        extraMeta = {
-          branch = lib.versions.majorMinor version + "/master";
-          maintainers = with lib.maintainers; [
-            thiagokokada
-            jerrysm64
-            axertheaxe
-          ];
-          teams = [ ];
-          description =
-            "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads."
-            + lib.optionalString isLqx " (Same as linux_zen, but less aggressive release schedule and additional extra config)";
-          broken = stdenv.hostPlatform.isAarch64;
-        };
-
-      }
-      // (args.argsOverride or { })
-    );
+  suffix = "zen1"; # zen
 in
-zenKernelsFor variants.${variant}
+
+buildLinux (
+  args
+  // rec {
+    version = "6.18.13";
+    pname = "linux-zen";
+    modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
+    isZen = true;
+
+    src = fetchFromGitHub {
+      owner = "zen-kernel";
+      repo = "zen-kernel";
+      rev = "v${version}-${suffix}";
+      sha256 = "0x6s3pa7c6zlvr3w2fv6i15v54cy1pschvgk7b4vrzx1bcrjdxf7";
+    };
+
+    # This is based on the following source:
+    # https://gitlab.archlinux.org/archlinux/packaging/packages/linux-zen/-/blob/main/config
+    # The list below is not exhaustive, so the kernel probably doesn't match
+    # the upstream, but should bring most of the improvements that will be
+    # expected by users
+    structuredExtraConfig = with lib.kernel; {
+      # Zen Interactive tuning
+      ZEN_INTERACTIVE = yes;
+
+      # FQ-Codel Packet Scheduling
+      NET_SCH_DEFAULT = yes;
+      DEFAULT_FQ_CODEL = yes;
+
+      # Preempt (low-latency)
+      PREEMPT = mkKernelOverride yes;
+      PREEMPT_VOLUNTARY = mkKernelOverride no;
+
+      # Preemptible tree-based hierarchical RCU
+      TREE_RCU = yes;
+      PREEMPT_RCU = yes;
+      RCU_EXPERT = yes;
+      TREE_SRCU = yes;
+      TASKS_RCU_GENERIC = yes;
+      TASKS_RCU = yes;
+      TASKS_RUDE_RCU = yes;
+      TASKS_TRACE_RCU = yes;
+      RCU_STALL_COMMON = yes;
+      RCU_NEED_SEGCBLIST = yes;
+      RCU_FANOUT = freeform "64";
+      RCU_FANOUT_LEAF = freeform "16";
+      RCU_BOOST = yes;
+      RCU_BOOST_DELAY = option (freeform "500");
+      RCU_NOCB_CPU = yes;
+      RCU_LAZY = yes;
+      RCU_DOUBLE_CHECK_CB_TIME = yes;
+
+      # BFQ I/O scheduler
+      IOSCHED_BFQ = mkKernelOverride yes;
+
+      # Futex WAIT_MULTIPLE implementation for Wine / Proton Fsync.
+      FUTEX = yes;
+      FUTEX_PI = yes;
+
+      # NT synchronization primitive emulation
+      NTSYNC = yes;
+
+      # Preemptive Full Tickless Kernel at 1000Hz
+      HZ = freeform "1000";
+      HZ_1000 = yes;
+    };
+
+    extraPassthru.updateScript = [
+      ./update-zen.py
+    ];
+
+    extraMeta = {
+      branch = lib.versions.majorMinor version + "/master";
+      maintainers = with lib.maintainers; [
+        thiagokokada
+        jerrysm64
+        axertheaxe
+      ];
+      teams = [ ];
+      description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads.";
+      broken = stdenv.hostPlatform.isAarch64;
+    };
+
+  }
+  // (args.argsOverride or { })
+)
diff --git a/pkgs/servers/apache-kafka/3_9.nix b/pkgs/servers/apache-kafka/3_9.nix
new file mode 100644
index 000000000000..ecd0ed75f784
--- /dev/null
+++ b/pkgs/servers/apache-kafka/3_9.nix
@@ -0,0 +1,5 @@
+import ./generic.nix {
+  kafkaVersion = "3.9.1";
+  scalaVersion = "2.13";
+  hash = "sha256-3UOZgW5niUbKt2470WhhA1VeabyPKrhobNpxqhW8MaM=";
+}
diff --git a/pkgs/servers/apache-kafka/4_0.nix b/pkgs/servers/apache-kafka/4_0.nix
new file mode 100644
index 000000000000..a35c9610c12b
--- /dev/null
+++ b/pkgs/servers/apache-kafka/4_0.nix
@@ -0,0 +1,5 @@
+import ./generic.nix {
+  kafkaVersion = "4.0.1";
+  scalaVersion = "2.13";
+  hash = "sha256-M8xc04WE6w9yYWxMLwX7SINKVvoKnNn+AKxzIMNM9SQ=";
+}
diff --git a/pkgs/servers/apache-kafka/4_1.nix b/pkgs/servers/apache-kafka/4_1.nix
new file mode 100644
index 000000000000..933054416127
--- /dev/null
+++ b/pkgs/servers/apache-kafka/4_1.nix
@@ -0,0 +1,5 @@
+import ./generic.nix {
+  kafkaVersion = "4.1.1";
+  scalaVersion = "2.13";
+  hash = "sha256-eR6O5plpgtgFWCk2eoA5H5TBvKcymy+7ZYv8IRp3Ry4=";
+}
diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix
index d6eacbe3d130..039c829f9bbc 100644
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@@ -1,102 +1,6 @@
+{ callPackage }:
 {
-  lib,
-  stdenv,
-  fetchurl,
-  jdk17_headless,
-  makeWrapper,
-  bash,
-  coreutils,
-  gnugrep,
-  gnused,
-  ps,
-  nixosTests,
-}:
-
-let
-  versionMap = {
-    "4_1" = {
-      kafkaVersion = "4.1.1";
-      scalaVersion = "2.13";
-      sha256 = "sha256-eR6O5plpgtgFWCk2eoA5H5TBvKcymy+7ZYv8IRp3Ry4=";
-      jre = jdk17_headless;
-      nixosTest = nixosTests.kafka.base.kafka_4_1;
-    };
-    "4_0" = {
-      kafkaVersion = "4.0.1";
-      scalaVersion = "2.13";
-      sha256 = "sha256-M8xc04WE6w9yYWxMLwX7SINKVvoKnNn+AKxzIMNM9SQ=";
-      jre = jdk17_headless;
-      nixosTest = nixosTests.kafka.base.kafka_4_0;
-    };
-    "3_9" = {
-      kafkaVersion = "3.9.1";
-      scalaVersion = "2.13";
-      sha256 = "sha256-3UOZgW5niUbKt2470WhhA1VeabyPKrhobNpxqhW8MaM=";
-      jre = jdk17_headless;
-      nixosTest = nixosTests.kafka.base.kafka_3_9;
-    };
-  };
-
-  build =
-    versionInfo:
-    stdenv.mkDerivation rec {
-      version = "${versionInfo.scalaVersion}-${versionInfo.kafkaVersion}";
-      pname = "apache-kafka";
-
-      src = fetchurl {
-        url = "mirror://apache/kafka/${versionInfo.kafkaVersion}/kafka_${version}.tgz";
-        inherit (versionInfo) sha256;
-      };
-
-      nativeBuildInputs = [ makeWrapper ];
-      buildInputs = [
-        versionInfo.jre
-        bash
-        gnugrep
-        gnused
-        coreutils
-        ps
-      ];
-
-      installPhase = ''
-        mkdir -p $out
-        cp -R config libs $out
-
-        mkdir -p $out/bin
-        cp bin/kafka* $out/bin
-        cp bin/connect* $out/bin
-
-        # allow us the specify logging directory using env
-        substituteInPlace $out/bin/kafka-run-class.sh \
-          --replace 'LOG_DIR="$base_dir/logs"' 'LOG_DIR="$KAFKA_LOG_DIR"'
-
-        substituteInPlace $out/bin/kafka-server-stop.sh \
-          --replace 'ps' '${ps}/bin/ps'
-
-        for p in $out/bin\/*.sh; do
-          wrapProgram $p \
-            --set JAVA_HOME "${versionInfo.jre}" \
-            --set KAFKA_LOG_DIR "/tmp/apache-kafka-logs" \
-            --prefix PATH : "${bash}/bin:${coreutils}/bin:${gnugrep}/bin:${gnused}/bin"
-        done
-        chmod +x $out/bin\/*
-      '';
-
-      passthru = {
-        inherit (versionInfo) jre; # Used by the NixOS module to select the supported JRE
-        tests.nixos = versionInfo.nixosTest;
-      };
-
-      meta = {
-        homepage = "https://kafka.apache.org";
-        description = "High-throughput distributed messaging system";
-        license = lib.licenses.asl20;
-        sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
-        maintainers = [ lib.maintainers.ragge ];
-        platforms = lib.platforms.unix;
-      };
-    };
-in
-lib.mapAttrs' (
-  majorVersion: versionInfo: lib.nameValuePair "apacheKafka_${majorVersion}" (build versionInfo)
-) versionMap
+  apacheKafka_4_1 = callPackage ./4_1.nix { };
+  apacheKafka_4_0 = callPackage ./4_0.nix { };
+  apacheKafka_3_9 = callPackage ./3_9.nix { };
+}
diff --git a/pkgs/servers/apache-kafka/generic.nix b/pkgs/servers/apache-kafka/generic.nix
new file mode 100644
index 000000000000..caed500306f3
--- /dev/null
+++ b/pkgs/servers/apache-kafka/generic.nix
@@ -0,0 +1,86 @@
+{
+  kafkaVersion,
+  scalaVersion,
+  hash,
+}:
+
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jdk17_headless,
+  makeWrapper,
+  bash,
+  coreutils,
+  gnugrep,
+  gnused,
+  ps,
+  nixosTests,
+}:
+
+let
+  jre = jdk17_headless;
+  series = lib.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor kafkaVersion);
+  seriesFile = ./. + "/${series}.nix";
+in
+stdenv.mkDerivation rec {
+  version = "${scalaVersion}-${kafkaVersion}";
+  pname = "apache-kafka";
+
+  src = fetchurl {
+    url = "mirror://apache/kafka/${kafkaVersion}/kafka_${version}.tgz";
+    inherit hash;
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [
+    jre
+    bash
+    gnugrep
+    gnused
+    coreutils
+    ps
+  ];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -R config libs $out
+
+    mkdir -p $out/bin
+    cp bin/kafka* $out/bin
+    cp bin/connect* $out/bin
+
+    # allow us the specify logging directory using env
+    substituteInPlace $out/bin/kafka-run-class.sh \
+      --replace 'LOG_DIR="$base_dir/logs"' 'LOG_DIR="$KAFKA_LOG_DIR"'
+
+    substituteInPlace $out/bin/kafka-server-stop.sh \
+      --replace 'ps' '${ps}/bin/ps'
+
+    for p in $out/bin\/*.sh; do
+      wrapProgram $p \
+        --set JAVA_HOME "${jre}" \
+        --set KAFKA_LOG_DIR "/tmp/apache-kafka-logs" \
+        --prefix PATH : "${bash}/bin:${coreutils}/bin:${gnugrep}/bin:${gnused}/bin"
+    done
+    chmod +x $out/bin\/*
+  '';
+
+  passthru = {
+    inherit jre; # Used by the NixOS module to select the supported JRE
+    tests.nixos = nixosTests.kafka.base.${"kafka_" + series};
+    updateScript = [
+      ./update.sh
+      seriesFile
+    ];
+  };
+
+  meta = {
+    homepage = "https://kafka.apache.org";
+    description = "High-throughput distributed messaging system";
+    license = lib.licenses.asl20;
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    maintainers = [ lib.maintainers.ragge ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/servers/apache-kafka/update.sh b/pkgs/servers/apache-kafka/update.sh
new file mode 100755
index 000000000000..37fd33e5ae6d
--- /dev/null
+++ b/pkgs/servers/apache-kafka/update.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix
+
+set -euo pipefail
+echoerr() { echo "$@" 1>&2; }
+
+fname="$1"
+echoerr "Working on $fname"
+
+# Extract series from filename: 4_1.nix → 4.1
+series=$(basename "$fname" .nix | tr '_' '.')
+echoerr "Series: $series"
+
+# Read current values from the nix file.
+current_kafka_version=$(sed -n 's/.*kafkaVersion = "\(.*\)";/\1/p' "$fname")
+scala_version=$(sed -n 's/.*scalaVersion = "\(.*\)";/\1/p' "$fname")
+echoerr "Current: kafkaVersion=$current_kafka_version scalaVersion=$scala_version"
+
+# Build a regex that matches e.g. "4.1.0", "4.1.1", but not "4.1.0-rc1".
+series_re="^$(echo "$series" | sed 's/\./\\./g')\\.[0-9]+$"
+
+# Fetch tags from the Apache Kafka GitHub repo.
+# Tags are plain semver (no "v" prefix); filter out release candidates.
+latest_version=$(
+  { for page in 1 2 3; do
+      curl -fsSL ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} \
+        "https://api.github.com/repos/apache/kafka/tags?per_page=100&page=$page"
+    done; } \
+  | jq -r '.[].name' \
+  | grep -E "$series_re" \
+  | sort -V \
+  | tail -1
+)
+
+if [[ -z "$latest_version" ]]; then
+  echoerr "Error: no tags found for series $series"
+  exit 1
+fi
+
+echoerr "Latest version for series $series: $latest_version"
+
+if [[ "$latest_version" == "$current_kafka_version" ]]; then
+  echoerr "Already at latest version $latest_version, nothing to do"
+  exit 0
+fi
+
+# Update kafkaVersion in the nix file.
+sed -i -E "s|(kafkaVersion = \").*(\";)|\1$latest_version\2|" "$fname"
+grep -q "kafkaVersion = \"$latest_version\"" "$fname"
+
+# Compute new SRI hash for the Apache mirror tarball.
+tarball_url="https://archive.apache.org/dist/kafka/${latest_version}/kafka_${scala_version}-${latest_version}.tgz"
+echoerr "Fetching hash for: $tarball_url"
+
+new_hash=$(nix-prefetch-url --type sha256 "$tarball_url" 2>/dev/null)
+if [[ -z "$new_hash" ]]; then
+  echoerr "Error: failed to fetch hash for $tarball_url"
+  exit 1
+fi
+new_hash=$(nix hash convert --hash-algo sha256 --to sri "$new_hash")
+
+echoerr "New hash: $new_hash"
+sed -i -E "s|(hash = \").*(\";)|\1$new_hash\2|" "$fname"
+grep -q "$new_hash" "$fname"
+
+echoerr "Done. Updated $fname from $current_kafka_version to $latest_version"
diff --git a/pkgs/servers/sql/postgresql/ext/pg_partman.nix b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
index d6e3c2654d25..c395f6c3def6 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_partman.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_partman";
-  version = "5.4.2";
+  version = "5.4.3";
 
   src = fetchFromGitHub {
     owner = "pgpartman";
     repo = "pg_partman";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H4RhswglzLG89wm4QKA+H0HLMb21gzorV1pOURkpqt0=";
+    hash = "sha256-oZiwU0cZkHViQ6aiOeJCroXAGFKN3krDOYc/bnyTEAw=";
   };
 
   meta = {
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 7f79dffe6fd8..661d243aed66 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -53,13 +53,13 @@
 }:
 
 let
-  version = "2025.12.1";
+  version = "2025.12.2";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-1s6ixKLlNd9osdG+qGIpo6kjEv3c/yDfJ6+APj6QQvM=";
+    sha256 = "sha256-lovpaG5K+avTC9W2rFN21JZQXCT8b0HBXLMgWEIz9fs=";
   };
 
   ruby = ruby_3_3;
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index 6f1cb47caecf..1a03e260dab6 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -143,7 +143,7 @@ GEM
     discourse-seed-fu (2.3.12)
       activerecord (>= 3.1)
       activesupport (>= 3.1)
-    discourse_ai-tokenizers (0.4)
+    discourse_ai-tokenizers (0.4.2)
       activesupport (>= 6.0)
       tiktoken_ruby (~> 0.0.15)
       tokenizers (~> 0.6.3)
@@ -973,7 +973,7 @@ CHECKSUMS
   discourse-emojis (1.0.44) sha256=63425a32379fb471d58f5eac9a1e931fc5a94efb7d327f71f1580af4dfe4edb3
   discourse-fonts (0.0.19) sha256=78d4ddd671615908303a675427039d8d787c935e6deae184c6e143c18c6e0033
   discourse-seed-fu (2.3.12) sha256=4f61d95c11ed54609046cd04eb3a51b531c5fa863fa86d1bea7d74264e5c75e4
-  discourse_ai-tokenizers (0.4) sha256=54d7ddcc5479f3bb3057b90f4a85106b4602a07336b51d372c1a1dd8f08104c5
+  discourse_ai-tokenizers (0.4.2) sha256=61c2f254582a3ae69255115b2b072904361003612b5b0f52aa64773817aae413
   discourse_dev_assets (0.0.6) sha256=4dfe7946927aa3d61a4ba89b5aef39d6daaeb70e35d7125dc481806a5c0aea4e
   docile (1.4.1) sha256=96159be799bfa73cdb721b840e9802126e4e03dfc26863db73647204c727f21e
   drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
index 1fe4333dd9b9..5d2512d63def 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
@@ -808,10 +808,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1i84h7qdh78s5hvivd9nffh04ikb222ll3xrawqbpwvrak6dvmsl";
+      sha256 = "04z4m8bkhxv4m990ynrbc41i0dh4543jnnqian9fcfiab1ag5hk1";
       type = "gem";
     };
-    version = "0.4";
+    version = "0.4.2";
   };
   discourse_dev_assets = {
     dependencies = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 70f14133b976..e79d25b30e80 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1155,6 +1155,7 @@ mapAliases {
   linux_ham = throw "linux_ham has been removed in favour of the standard kernel packages"; # Added 2025-06-24
   linux_hardened = linuxPackages_hardened.kernel; # Added 2025-08-10
   linux_latest-libre = throw "linux_latest_libre has been removed due to lack of maintenance"; # Added 2025-10-01
+  linux_lqx = throw "linux_lqx has been removed due to lack of maintenance"; # Added 2026-03-13
   linux_rpi0 = linuxKernel.kernels.linux_rpi1;
   linux_rpi1 = linuxKernel.kernels.linux_rpi1;
   linux_rpi2 = linuxKernel.kernels.linux_rpi2;
@@ -1187,6 +1188,7 @@ mapAliases {
   linuxPackages_hardened = linuxKernel.packages.linux_hardened; # Added 2025-08-10
   linuxPackages_latest-libre = throw "linux_latest_libre has been removed due to lack of maintenance"; # Added 2025-10-01
   linuxPackages_latest_xen_dom0 = throw "'linuxPackages_latest_xen_dom0' has been renamed to/replaced by 'linuxPackages_latest'"; # Converted to throw 2025-10-27
+  linuxPackages_lqx = throw "linuxPackages_lqx has been removed due to lack of maintenance"; # Added 2026-03-13
   linuxPackages_rpi0 = linuxKernel.packages.linux_rpi1;
   linuxPackages_rpi1 = linuxKernel.packages.linux_rpi1;
   linuxPackages_rpi2 = linuxKernel.packages.linux_rpi2;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fff8d0f0256b..7ee66c0cb83d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8648,8 +8648,6 @@ with pkgs;
   # zen-kernel
   linuxPackages_zen = linuxKernel.packages.linux_zen;
   linux_zen = linuxPackages_zen.kernel;
-  linuxPackages_lqx = linuxKernel.packages.linux_lqx;
-  linux_lqx = linuxPackages_lqx.kernel;
 
   # XanMod kernel
   linuxPackages_xanmod = linuxKernel.packages.linux_xanmod;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index d9e5703a25cf..757d7ebb8dfa 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -231,20 +231,7 @@ in
 
         linux_latest = packageAliases.linux_latest.kernel;
 
-        # Using zenKernels like this due lqx&zen came from one source, but may have different base kernel version
-        # https://github.com/NixOS/nixpkgs/pull/161773#discussion_r820134708
-        zenKernels = callPackage ../os-specific/linux/kernel/zen-kernels.nix;
-
-        linux_zen = zenKernels {
-          variant = "zen";
-          kernelPatches = [
-            kernelPatches.bridge_stp_helper
-            kernelPatches.request_key_helper
-          ];
-        };
-
-        linux_lqx = zenKernels {
-          variant = "lqx";
+        linux_zen = callPackage ../os-specific/linux/kernel/zen-kernels.nix {
           kernelPatches = [
             kernelPatches.bridge_stp_helper
             kernelPatches.request_key_helper
@@ -281,6 +268,7 @@ in
         linux_hardened = linux_6_12_hardened;
       }
       // lib.optionalAttrs config.allowAliases {
+        linux_lqx = throw "linux_lqx has been removed due to lack of maintenance";
         linux_libre = throw "linux_libre has been removed due to lack of maintenance";
         linux_latest_libre = throw "linux_latest_libre has been removed due to lack of maintenance";
 
@@ -785,12 +773,12 @@ in
       linux_6_12_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_12_hardened);
 
       linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
-      linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);
       linux_xanmod = recurseIntoAttrs (packagesFor kernels.linux_xanmod);
       linux_xanmod_stable = recurseIntoAttrs (packagesFor kernels.linux_xanmod_stable);
       linux_xanmod_latest = recurseIntoAttrs (packagesFor kernels.linux_xanmod_latest);
     }
     // lib.optionalAttrs config.allowAliases {
+      linux_lqx = throw "linux_lqx has been removed due to lack of maintenance";
       linux_libre = throw "linux_libre has been removed due to lack of maintenance";
       linux_latest_libre = throw "linux_latest_libre has been removed due to lack of maintenance";