diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 3f735f4cbd12..8ec5e77b0f21 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: "Add 'has: port to stable' label"
         if: steps.backport.outputs.created_pull_numbers != ''
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           # Not using the app on purpose to avoid triggering another workflow run after adding this label.
           script: |
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0053774ce714..71ba2b99d6c6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -52,7 +52,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 44ec33382e22..c74932b67e7a 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Check commits
         id: check
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           TARGETS_STABLE: ${{ fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development') }}
         with:
@@ -96,7 +96,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
diff --git a/.github/workflows/dismissed-review.yml b/.github/workflows/dismissed-review.yml
index 224ea0af7249..db5799c80913 100644
--- a/.github/workflows/dismissed-review.yml
+++ b/.github/workflows/dismissed-review.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 2
     steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             // PRs from forks don't have any PRs associated by default.
diff --git a/.github/workflows/edited.yml b/.github/workflows/edited.yml
index 8a38f0eefeff..e944254d19cd 100644
--- a/.github/workflows/edited.yml
+++ b/.github/workflows/edited.yml
@@ -43,7 +43,7 @@ jobs:
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-pull-requests: write
 
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index b2cbdf2b4c54..930426a933c9 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -47,7 +47,7 @@ jobs:
             ci/pinned.json
 
       - name: Install Nix
-        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       - name: Load supported versions
         id: versions
@@ -92,7 +92,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -190,7 +190,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       - name: Combine all output paths and eval stats
         run: |
@@ -222,7 +222,7 @@ jobs:
 
       - name: Add eval summary to commit statuses
         if: ${{ github.event_name == 'pull_request_target' }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { readFile } = require('node:fs/promises')
@@ -263,7 +263,7 @@ jobs:
           path: versions
 
       - name: Add version comparison table to job summary
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           SYSTEMS: ${{ inputs.systems }}
           VERSIONS: ${{ needs.versions.outputs.versions }}
@@ -350,7 +350,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       - name: Run misc eval tasks in parallel
         run: |
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 4dfbe74f02b8..94c68d859e48 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -64,7 +64,7 @@ jobs:
         run: gh api /rate_limit | jq
 
       - name: Labels from API data and Eval results
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
@@ -81,7 +81,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -91,7 +91,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -101,7 +101,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index fc309324db1e..f3d4a8360f1b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -66,7 +66,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -94,7 +94,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index 9af5cf0ebb71..d95c1e5ea22a 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -37,7 +37,7 @@ jobs:
     permissions:
       statuses: write
     steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { serverUrl, repo, runId, payload } = context
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 2ab850094e33..785ebbf9d168 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -40,7 +40,7 @@ jobs:
           sparse-checkout: |
             ci/github-script
       - id: prepare
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             require('./ci/github-script/prepare.js')({
@@ -138,7 +138,7 @@ jobs:
     permissions:
       statuses: write
     steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { serverUrl, repo, runId, payload } = context
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 9f4e4374bb89..0e0aaf04f850 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -33,7 +33,7 @@ jobs:
           sparse-checkout: ci
 
       - name: Install Nix
-        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
+        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
 
       - name: Build the requestReviews derivation
         run: nix-build trusted/ci -A requestReviews
@@ -88,7 +88,7 @@ jobs:
       # In the regular case, this workflow is called via workflow_call from the eval workflow directly.
       # In the more special case, when a PR is undrafted an eval run will have started already.
       - name: Wait for comparison to be done
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: eval
         with:
           script: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b3c2c6c59863..e82719ab205f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,7 +25,7 @@ jobs:
           sparse-checkout: |
             ci/github-script
       - id: prepare
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             require('./ci/github-script/prepare.js')({
@@ -38,7 +38,7 @@ jobs:
 
       - name: Determine changed files
         id: files
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const files = (await github.paginate(github.rest.pulls.listFiles, {
diff --git a/ci/OWNERS b/ci/OWNERS
index dae307afc913..65fca06c3879 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -223,9 +223,9 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 
 # C compilers
 /pkgs/development/compilers/gcc
-/pkgs/development/compilers/llvm @alyssais @RossComputerGuy @NixOS/llvm
+/pkgs/development/compilers/llvm @NixOS/llvm
 /pkgs/development/compilers/emscripten @raitobezarius
-/doc/toolchains/llvm.chapter.md @alyssais @RossComputerGuy @NixOS/llvm
+/doc/toolchains/llvm.chapter.md @NixOS/llvm
 /doc/languages-frameworks/emscripten.section.md @raitobezarius
 
 # Audio
@@ -494,7 +494,8 @@ pkgs/servers/authelia/ @06kellyjac @dit7ya @nicomem
 pkgs/by-name/oc/octodns/ @anthonyroussel
 
 # Teleport
-pkgs/by-name/te/teleport*   @arianvp @justinas @sigma @tomberek @freezeboy @techknowlogick @JuliusFreudenberger
+/pkgs/build-support/teleport  @arianvp @justinas @sigma @tomberek @freezeboy @techknowlogick @JuliusFreudenberger
+pkgs/by-name/te/teleport*     @arianvp @justinas @sigma @tomberek @freezeboy @techknowlogick @JuliusFreudenberger
 
 # Warp-terminal
 pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
diff --git a/ci/eval/README.md b/ci/eval/README.md
index 57cde7c65fe9..2e7ae0d3876b 100644
--- a/ci/eval/README.md
+++ b/ci/eval/README.md
@@ -43,3 +43,6 @@ nix-build ci -A eval.full --arg baseline $BASELINE
 ```
 
 Keep in mind to otherwise pass the same set of arguments for both commands (`evalSystems`, `quickTest`, `chunkSize`).
+Running this command will evaluate the difference between the baseline statistics and the ones at the time of running the command.
+From that difference, it will produce a human-readable report in `$out/step-summary.md`.
+If no packages were added or removed, then performance statistics will also be generated as part of this report.
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index a379594dbc6d..c7310a5052d0 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -267,6 +267,15 @@ let
       chunkSize ? 5000,
       quickTest ? false,
       baseline,
+      # Which maintainer should be considered the author?
+      # Defaults to nixpkgs-ci which is not a maintainer and skips the check.
+      githubAuthorId ? "nixpkgs-ci",
+      # What files have been touched? Defaults to none; use the expression below to calculate it.
+      # ```
+      # git diff --name-only --merge-base master HEAD \
+      #   | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
+      # ```
+      touchedFilesJson ? builtins.toFile "touched-files.json" "[ ]",
     }:
     let
       diffs = symlinkJoin {
@@ -282,10 +291,12 @@ let
           }
         ) evalSystems;
       };
+      comparisonReport = compare {
+        combinedDir = combine { diffDir = diffs; };
+        inherit touchedFilesJson githubAuthorId;
+      };
     in
-    combine {
-      diffDir = diffs;
-    };
+    comparisonReport;
 
 in
 {
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 22a58f7b48c3..68203f51767f 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -164,6 +164,8 @@
 
 - `meta.mainProgram`: Changing this `meta` entry can lead to a package rebuild due to being used to determine the `NIX_MAIN_PROGRAM` environment variable.
 
+- `forgejo-runner`: The upgrade to version 11 brings a license change from MIT to GPLv3-or-later.
+
 - `lisp-modules` were brought in sync with the [June 2025 Quicklisp release](http://blog.quicklisp.org/2025/07/june-2025-quicklisp-dist-now-available.html).
 
 - `ffmpeg_8`, `ffmpeg_8-headless`, and `ffmpeg_8-full` have been added. The default version of FFmpeg remains ffmpeg_7 for now, though this may change before release.
diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index d47e72bb2910..b13a3f6ef637 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -4,7 +4,8 @@
 { lib }:
 
 let
-  inherit (builtins) head length;
+  inherit (builtins) head length typeOf;
+  inherit (lib.asserts) assertMsg;
   inherit (lib.trivial)
     oldestSupportedReleaseIsAtLeast
     mergeAttrs
@@ -1195,6 +1196,125 @@ rec {
     in
     recurse [ ] set;
 
+  /**
+    Apply a function to each leaf (non‐attribute‐set attribute) of a tree of
+    nested attribute sets, returning the results of the function as a list,
+    ordered lexicographically by their attribute paths.
+
+    Like `mapAttrsRecursive`, but concatenates the mapping function results
+    into a list.
+
+    # Inputs
+
+    `f`
+
+    : Mapping function which, given an attribute’s path and value, returns a
+      new value.
+
+      This value will be an element of the list returned by
+      `mapAttrsToListRecursive`.
+
+      The first argument to the mapping function is a list of attribute names
+      forming the path to the leaf attribute. The second argument is the leaf
+      attribute value, which will never be an attribute set.
+
+    `set`
+
+    : Attribute set to map over.
+
+    # Type
+
+    ```
+    mapAttrsToListRecursive :: ([String] -> a -> b) -> AttrSet -> [b]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.attrsets.mapAttrsToListRecursive` usage example
+
+    ```nix
+    mapAttrsToListRecursive (path: value: "${concatStringsSep "." path}=${value}")
+      { n = { a = "A"; m = { b = "B"; c = "C"; }; }; d = "D"; }
+    => [ "n.a=A" "n.m.b=B" "n.m.c=C" "d=D" ]
+    ```
+    :::
+  */
+  mapAttrsToListRecursive = mapAttrsToListRecursiveCond (_: _: true);
+
+  /**
+    Determine the nodes of a tree of nested attribute sets by applying a
+    predicate, then apply a function to the leaves, returning the results
+    as a list, ordered lexicographically by their attribute paths.
+
+    Like `mapAttrsToListRecursive`, but takes an additional predicate to
+    decide whether to recurse into an attribute set.
+
+    Unlike `mapAttrsRecursiveCond` this predicate receives the attribute path
+    as its first argument, in addition to the attribute set.
+
+    # Inputs
+
+    `pred`
+
+    : Predicate to decide whether to recurse into an attribute set.
+
+      If the predicate returns true, `mapAttrsToListRecursiveCond` recurses into
+      the attribute set. If the predicate returns false, it does not recurse
+      but instead applies the mapping function, treating the attribute set as
+      a leaf.
+
+      The first argument to the predicate is a list of attribute names forming
+      the path to the attribute set. The second argument is the attribute set.
+
+    `f`
+
+    : Mapping function which, given an attribute’s path and value, returns a
+      new value.
+
+      This value will be an element of the list returned by
+      `mapAttrsToListRecursiveCond`.
+
+      The first argument to the mapping function is a list of attribute names
+      forming the path to the leaf attribute. The second argument is the leaf
+      attribute value, which may be an attribute set if the predicate returned
+      false.
+
+    `set`
+
+    : Attribute set to map over.
+
+    # Type
+    ```
+    mapAttrsToListRecursiveCond :: ([String] -> AttrSet -> Bool) -> ([String] -> a -> b) -> AttrSet -> [b]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.attrsets.mapAttrsToListRecursiveCond` usage example
+
+    ```nix
+    mapAttrsToListRecursiveCond
+      (path: as: !(lib.isDerivation as))
+      (path: value: "--set=${lib.concatStringsSep "." path}=${toString value}")
+      {
+        rust.optimize = 2;
+        target = {
+          riscv64-unknown-linux-gnu.linker = pkgs.lld;
+        };
+      }
+    => [ "--set=rust.optimize=2" "--set=target.riscv64-unknown-linux-gnu.linker=/nix/store/sjw4h1k…" ]
+    ```
+    :::
+  */
+  mapAttrsToListRecursiveCond =
+    pred: f: set:
+    let
+      mapRecursive =
+        path: value: if isAttrs value && pred path value then recurse path value else [ (f path value) ];
+      recurse = path: set: concatMap (name: mapRecursive (path ++ [ name ]) set.${name}) (attrNames set);
+    in
+    recurse [ ] set;
+
   /**
     Generate an attribute set by mapping a function over a list of
     attribute names.
diff --git a/lib/default.nix b/lib/default.nix
index 009140f23047..1008025d8d18 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -206,6 +206,8 @@ let
         concatMapAttrs
         mapAttrsRecursive
         mapAttrsRecursiveCond
+        mapAttrsToListRecursive
+        mapAttrsToListRecursiveCond
         genAttrs
         genAttrs'
         isDerivation
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index bb5603de75bd..9eb887a7b695 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -77,6 +77,8 @@ let
     makeIncludePath
     makeOverridable
     mapAttrs
+    mapAttrsToListRecursive
+    mapAttrsToListRecursiveCond
     mapCartesianProduct
     matchAttrs
     mergeAttrs
@@ -3567,6 +3569,118 @@ runTests {
     ];
   };
 
+  testMapAttrsToListRecursive = {
+    expr = mapAttrsToListRecursive (p: v: "${concatStringsSep "." p}=${v}") {
+      a = {
+        b = "A";
+      };
+      c = {
+        d = "B";
+        e = {
+          f = "C";
+          g = "D";
+        };
+      };
+      h = {
+        i = {
+          j = {
+            k = "E";
+          };
+        };
+      };
+    };
+    expected = [
+      "a.b=A"
+      "c.d=B"
+      "c.e.f=C"
+      "c.e.g=D"
+      "h.i.j.k=E"
+    ];
+  };
+
+  testMapAttrsToListRecursiveWithLists = {
+    expr = mapAttrsToListRecursive (p: v: v) {
+      a = [ ];
+      b = {
+        c = [ [ ] ];
+      };
+      d = {
+        e = {
+          f = [ [ [ ] ] ];
+        };
+      };
+    };
+    expected = [
+      [ ]
+      [ [ ] ]
+      [ [ [ ] ] ]
+    ];
+  };
+
+  testMapAttrsToListRecursiveCond = {
+    expr = mapAttrsToListRecursiveCond (p: as: !(as ? stop)) (p: v: v) {
+      a = {
+        b = "A";
+      };
+      c = {
+        d = "B";
+        e = {
+          stop = null;
+          f = "C";
+          g = {
+            h = "D";
+          };
+        };
+      };
+    };
+    expected = [
+      "A"
+      "B"
+      {
+        stop = null;
+        f = "C";
+        g = {
+          h = "D";
+        };
+      }
+    ];
+  };
+
+  testMapAttrsToListRecursiveCondPath = {
+    expr = mapAttrsToListRecursiveCond (p: as: length p < 2) (p: v: v) {
+      a = {
+        b = "A";
+      };
+      c = {
+        d = "B";
+        e = {
+          f = "C";
+          g = "D";
+        };
+      };
+      h = {
+        i = {
+          j = {
+            k = "E";
+          };
+        };
+      };
+    };
+    expected = [
+      "A"
+      "B"
+      {
+        f = "C";
+        g = "D";
+      }
+      {
+        j = {
+          k = "E";
+        };
+      }
+    ];
+  };
+
   # The example from the showAttrPath documentation
   testShowAttrPathExample = {
     expr = showAttrPath [
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f36268e46740..7acda00ceae6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21676,12 +21676,6 @@
     githubId = 32239737;
     keys = [ { fingerprint = "91EB E870 1639 1323 642A  6803 B966 009D 57E6 9CC6"; } ];
   };
-  rewine = {
-    email = "lhongxu@outlook.com";
-    github = "wineee";
-    githubId = 22803888;
-    name = "Lu Hongxu";
-  };
   rexxDigital = {
     email = "joellarssonpriv@gmail.com";
     github = "rexxDigital";
@@ -22624,6 +22618,13 @@
     githubId = 766350;
     name = "Richard Zetterberg";
   };
+  S0AndS0 = {
+    name = "S0AndS0";
+    email = "S0AndS0@digital-mercenaries.com";
+    github = "S0AndS0";
+    githubId = 4116150;
+    matrix = "@s0ands0:matrix.org";
+  };
   s0me1newithhand7s = {
     name = "hand7s";
     email = "s0me1newithhand7s@gmail.com";
@@ -24713,9 +24714,9 @@
     name = "Subin Kim";
   };
   sugar700 = {
-    email = "sugar@sylveon.social";
+    email = "sugar@sugar.lgbt";
     github = "sugar700";
-    githubId = 168804988;
+    githubId = 1297598;
     name = "sugar";
   };
   suhr = {
@@ -27681,6 +27682,12 @@
     github = "wilsonehusin";
     githubId = 14004487;
   };
+  wineee = {
+    email = "lhongxu@outlook.com";
+    github = "wineee";
+    githubId = 22803888;
+    name = "Lu Hongxu";
+  };
   winpat = {
     email = "patrickwinter@posteo.ch";
     github = "winpat";
diff --git a/maintainers/scripts/bootstrap-files/refresh-tarballs.bash b/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
index 995b811ec4f9..0fa2c28bb18a 100755
--- a/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
+++ b/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
@@ -92,6 +92,7 @@ CROSS_TARGETS=(
     mips64el-unknown-linux-gnuabi64
     mips64el-unknown-linux-gnuabin32
     mipsel-unknown-linux-gnu
+    powerpc64-unknown-linux-gnuabielfv1
     powerpc64-unknown-linux-gnuabielfv2
     powerpc64le-unknown-linux-gnu
     riscv64-unknown-linux-gnu
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 214e15b709af..979b687370ac 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -316,7 +316,7 @@ with lib.maintainers;
   };
 
   deepin = {
-    members = [ rewine ];
+    members = [ wineee ];
     scope = "Maintain deepin desktop environment and related packages.";
     shortName = "DDE";
     enableFeatureFreezePing = true;
@@ -736,6 +736,7 @@ with lib.maintainers;
   llvm = {
     members = [
       dtzWill
+      emily
       ericson2314
       lovek323
       qyliss
diff --git a/nixos/doc/manual/configuration/user-mgmt.chapter.md b/nixos/doc/manual/configuration/user-mgmt.chapter.md
index 36f4717d2204..0a3c952fc5cf 100644
--- a/nixos/doc/manual/configuration/user-mgmt.chapter.md
+++ b/nixos/doc/manual/configuration/user-mgmt.chapter.md
@@ -152,3 +152,16 @@ original files are by default stored in `/var/lib/nixos`.
 Userborn implements immutable users by re-mounting the password files
 read-only. This means that unlike when using the Perl script, trying to add a
 new user (e.g. via `useradd`) will fail right away.
+
+## Restrict usage time {#sec-restrict-usage-time}
+
+[Timekpr-nExT](https://mjasnik.gitlab.io/timekpr-next/) is a screen time managing application that helps optimizing time spent at computer for your subordinates, children or even for yourself.
+
+You can enable it via:
+
+```nix
+{ services.timekpr.enable = true; }
+```
+
+This will install the `timekpr` package and start the `timekpr` service.
+You can then use the `timekpra` application to configure time limits for users.
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 557cf59aa291..5a56af028e2d 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -338,6 +338,9 @@
   "sec-userborn": [
     "index.html#sec-userborn"
   ],
+  "sec-restrict-usage-time": [
+    "index.html#sec-restrict-usage-time"
+  ],
   "ch-file-systems": [
     "index.html#ch-file-systems"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 7b0ac7d6b231..3e3b8f10a74a 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -100,6 +100,8 @@
 
 - [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).
 
+- [Timekpr-nExT](https://mjasnik.gitlab.io/timekpr-next/), a time managing application that helps optimizing time spent at computer for your subordinates, children or even for yourself. Available as [](#opt-services.timekpr.enable).
+
 - [SuiteNumérique Meet](https://github.com/suitenumerique/meet) is an open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React. Available as [services.lasuite-meet](#opt-services.lasuite-meet.enable).
 
 - [lemurs](https://github.com/coastalwhite/lemurs), a customizable TUI display/login manager. Available at [services.displayManager.lemurs](#opt-services.displayManager.lemurs.enable).
@@ -173,6 +175,20 @@
 
 - `renovate` was updated to v41. See the upstream release notes for [v40](https://github.com/renovatebot/renovate/releases/tag/40.0.0) and [v41](https://github.com/renovatebot/renovate/releases/tag/41.0.0) for breaking changes.
 
+- The "NIXOS_EXTRA_MODULE_PATH" variable from configuration evaluation has been deprecated.
+  We recommend a workflow where you update the expression files instead, but if you wish to continue
+  to use this variable, you may do so with a module like:
+
+  ```nix
+  {
+    imports = [
+      (builtins.getEnv "NIXOS_EXTRA_MODULE_PATH")
+    ];
+  }
+  ```
+
+  This has the benefit that your configuration hints at the non-standard workflow.
+
 - `i18n.inputMethod.fcitx5.plasma6Support` has been removed because qt6 is the only one used for fcitx5-configtool now.
 
 - The `boot.readOnlyNixStore` has been removed. Control over bind mount options on `/nix/store` is now offered by the `boot.nixStoreMountOpts` option.
@@ -281,3 +297,5 @@
 - The `nettools` package (ifconfig, arp, mii-tool, netstat, route) is not installed by default anymore. The suite is unmaintained and users should migrate to `iproute2` and `ethtool` instead.
 
 - `sparkleshare` has been removed as it no longer builds and has been abandoned upstream.
+
+- The `open-webui` package's postgres support have been moved to optional dependencies to comply with upstream changes in 0.6.26.
diff --git a/nixos/lib/eval-config.nix b/nixos/lib/eval-config.nix
index a39bf7599c7d..928c8000d64f 100644
--- a/nixos/lib/eval-config.nix
+++ b/nixos/lib/eval-config.nix
@@ -30,32 +30,7 @@ evalConfigArgs@{
   check ? true,
   prefix ? [ ],
   lib ? import ../../lib,
-  extraModules ?
-    let
-      e = builtins.getEnv "NIXOS_EXTRA_MODULE_PATH";
-    in
-    lib.optional (e != "") (
-      lib.warn
-        ''
-          The NIXOS_EXTRA_MODULE_PATH environment variable is deprecated and will be
-          removed in NixOS 25.05.
-          We recommend a workflow where you update the expression files instead, but
-          if you wish to continue to use this variable, you may do so with a module like:
-
-          {
-            imports = [
-              (builtins.getEnv "NIXOS_EXTRA_MODULE_PATH")
-            ];
-          }
-
-          This has the benefit that your configuration hints at the
-          non-standard workflow.
-        ''
-        # NOTE: this import call is unnecessary and it even removes the file name
-        #       from error messages.
-        import
-        e
-    ),
+  extraModules ? [ ],
 }:
 
 let
diff --git a/nixos/modules/config/nix.nix b/nixos/modules/config/nix.nix
index 48ac45323750..9dfc4a1e664e 100644
--- a/nixos/modules/config/nix.nix
+++ b/nixos/modules/config/nix.nix
@@ -16,40 +16,21 @@
 
 let
   inherit (lib)
-    concatStringsSep
-    boolToString
-    escape
-    filterAttrs
-    floatToString
-    getVersion
-    hasPrefix
-    isBool
-    isDerivation
-    isFloat
-    isInt
-    isList
-    isString
     literalExpression
     mapAttrsToList
     mkAfter
     mkIf
     mkOption
     mkRenamedOptionModuleWith
-    optionalString
     optionals
-    strings
     systems
-    toPretty
     types
-    versionAtLeast
     ;
 
   cfg = config.nix;
 
   nixPackage = cfg.package.out;
 
-  isNixAtLeast = versionAtLeast (getVersion nixPackage);
-
   defaultSystemFeatures = [
     "nixos-test"
     "benchmark"
@@ -98,74 +79,17 @@ let
     attrsOf (either confAtom (listOf confAtom));
 
   nixConf =
-    assert isNixAtLeast "2.2";
-    let
-
-      mkValueString =
-        v:
-        if v == null then
-          ""
-        else if isInt v then
-          toString v
-        else if isBool v then
-          boolToString v
-        else if isFloat v then
-          floatToString v
-        else if isList v then
-          toString v
-        else if isDerivation v then
-          toString v
-        else if builtins.isPath v then
-          toString v
-        else if isString v then
-          v
-        else if strings.isConvertibleWithToString v then
-          toString v
-        else
-          abort "The nix conf value: ${toPretty { } v} can not be encoded";
-
-      mkKeyValue = k: v: "${escape [ "=" ] k} = ${mkValueString v}";
-
-      mkKeyValuePairs = attrs: concatStringsSep "\n" (mapAttrsToList mkKeyValue attrs);
-
-      isExtra = key: hasPrefix "extra-" key;
-
-    in
-    pkgs.writeTextFile {
-      name = "nix.conf";
-      # workaround for https://github.com/NixOS/nix/issues/9487
-      # extra-* settings must come after their non-extra counterpart
-      text = ''
-        # WARNING: this file is generated from the nix.* options in
-        # your NixOS configuration, typically
-        # /etc/nixos/configuration.nix.  Do not edit it!
-        ${mkKeyValuePairs (filterAttrs (key: value: !(isExtra key)) cfg.settings)}
-        ${mkKeyValuePairs (filterAttrs (key: value: isExtra key) cfg.settings)}
-        ${cfg.extraOptions}
-      '';
-      checkPhase = lib.optionalString cfg.checkConfig (
-        if pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform then
-          ''
-            echo "Ignoring validation for cross-compilation"
-          ''
-        else
-          let
-            showCommand = if isNixAtLeast "2.20pre" then "config show" else "show-config";
-          in
-          ''
-            echo "Validating generated nix.conf"
-            ln -s $out ./nix.conf
-            set -e
-            set +o pipefail
-            NIX_CONF_DIR=$PWD \
-              ${cfg.package}/bin/nix ${showCommand} ${optionalString (isNixAtLeast "2.3pre") "--no-net"} \
-                ${optionalString (isNixAtLeast "2.4pre") "--option experimental-features nix-command"} \
-              |& sed -e 's/^warning:/error:/' \
-              | (! grep '${if cfg.checkAllErrors then "^error:" else "^error: unknown setting"}')
-            set -o pipefail
-          ''
-      );
-    };
+    (pkgs.formats.nixConf {
+      inherit (cfg)
+        package
+        checkAllErrors
+        checkConfig
+        extraOptions
+        ;
+      inherit (nixPackage) version;
+    }).generate
+      "nix.conf"
+      cfg.settings;
 
 in
 {
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c463cbc196af..03c880b3705d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1477,6 +1477,7 @@
   ./services/security/sslmate-agent.nix
   ./services/security/step-ca.nix
   ./services/security/tang.nix
+  ./services/security/timekpr.nix
   ./services/security/tor.nix
   ./services/security/torify.nix
   ./services/security/torsocks.nix
diff --git a/nixos/modules/programs/wayland/wayfire.nix b/nixos/modules/programs/wayland/wayfire.nix
index 1c3950bff47d..2d8c6a8c5456 100644
--- a/nixos/modules/programs/wayland/wayfire.nix
+++ b/nixos/modules/programs/wayland/wayfire.nix
@@ -8,7 +8,7 @@ let
   cfg = config.programs.wayfire;
 in
 {
-  meta.maintainers = with lib.maintainers; [ rewine ];
+  meta.maintainers = with lib.maintainers; [ wineee ];
 
   options.programs.wayfire = {
     enable = lib.mkEnableOption "Wayfire, a wayland compositor based on wlroots";
diff --git a/nixos/modules/services/cluster/hadoop/hbase.nix b/nixos/modules/services/cluster/hadoop/hbase.nix
index 06af0a21811e..fc5261a7268e 100644
--- a/nixos/modules/services/cluster/hadoop/hbase.nix
+++ b/nixos/modules/services/cluster/hadoop/hbase.nix
@@ -178,12 +178,12 @@ in
       let
         ports = port: infoPort: {
           port = lib.mkOption {
-            type = lib.types.int;
+            type = lib.types.port;
             default = port;
             description = "RPC port";
           };
           infoPort = lib.mkOption {
-            type = lib.types.int;
+            type = lib.types.port;
             default = infoPort;
             description = "web UI port";
           };
diff --git a/nixos/modules/services/databases/monetdb.nix b/nixos/modules/services/databases/monetdb.nix
index 9fc79e495678..530acc504f90 100644
--- a/nixos/modules/services/databases/monetdb.nix
+++ b/nixos/modules/services/databases/monetdb.nix
@@ -38,7 +38,7 @@ in
       };
 
       port = lib.mkOption {
-        type = lib.types.ints.u16;
+        type = lib.types.port;
         default = 50000;
         description = "Port to listen on.";
       };
diff --git a/nixos/modules/services/development/athens.nix b/nixos/modules/services/development/athens.nix
index bd770293e4c7..1f41a269e11b 100644
--- a/nixos/modules/services/development/athens.nix
+++ b/nixos/modules/services/development/athens.nix
@@ -861,7 +861,7 @@ in
           default = "localhost";
         };
         port = lib.mkOption {
-          type = lib.types.int;
+          type = lib.types.port;
           description = "Port for the MySQL database.";
           default = 3306;
         };
@@ -901,7 +901,7 @@ in
           default = "localhost";
         };
         port = lib.mkOption {
-          type = lib.types.int;
+          type = lib.types.port;
           description = "Port for the Postgres database.";
           default = 5432;
         };
diff --git a/nixos/modules/services/games/minetest-server.nix b/nixos/modules/services/games/minetest-server.nix
index 5b9fe630a729..d1718d3bca9d 100644
--- a/nixos/modules/services/games/minetest-server.nix
+++ b/nixos/modules/services/games/minetest-server.nix
@@ -135,7 +135,7 @@ in
       };
 
       port = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
+        type = lib.types.nullOr lib.types.port;
         default = null;
         description = ''
           Port number to bind to.
diff --git a/nixos/modules/services/mail/postgrey.nix b/nixos/modules/services/mail/postgrey.nix
index d655839162b1..53c54c15c5d0 100644
--- a/nixos/modules/services/mail/postgrey.nix
+++ b/nixos/modules/services/mail/postgrey.nix
@@ -26,7 +26,7 @@ let
         description = "The address to bind to. Localhost if null";
       };
       port = mkOption {
-        type = natural';
+        type = port;
         default = 10030;
         description = "Tcp port to bind to";
       };
diff --git a/nixos/modules/services/misc/headphones.nix b/nixos/modules/services/misc/headphones.nix
index 8440c114ca72..d637acb292bd 100644
--- a/nixos/modules/services/misc/headphones.nix
+++ b/nixos/modules/services/misc/headphones.nix
@@ -42,7 +42,7 @@ in
         description = "Host to listen on.";
       };
       port = lib.mkOption {
-        type = lib.types.ints.u16;
+        type = lib.types.port;
         default = 8181;
         description = "Port to bind to.";
       };
diff --git a/nixos/modules/services/misc/moonraker.nix b/nixos/modules/services/misc/moonraker.nix
index f1fcc255704b..53b69a729f27 100644
--- a/nixos/modules/services/misc/moonraker.nix
+++ b/nixos/modules/services/misc/moonraker.nix
@@ -75,7 +75,7 @@ in
       };
 
       port = lib.mkOption {
-        type = lib.types.ints.unsigned;
+        type = lib.types.port;
         default = 7125;
         description = "The port to listen on.";
       };
diff --git a/nixos/modules/services/misc/servarr/settings-options.nix b/nixos/modules/services/misc/servarr/settings-options.nix
index 007deba75425..0dc39b9d4c06 100644
--- a/nixos/modules/services/misc/servarr/settings-options.nix
+++ b/nixos/modules/services/misc/servarr/settings-options.nix
@@ -26,7 +26,7 @@
           };
           server = {
             port = lib.mkOption {
-              type = lib.types.int;
+              type = lib.types.port;
               description = "Port Number";
               default = port;
             };
diff --git a/nixos/modules/services/misc/sickbeard.nix b/nixos/modules/services/misc/sickbeard.nix
index 7c6205c7793a..7eaa04d7068e 100644
--- a/nixos/modules/services/misc/sickbeard.nix
+++ b/nixos/modules/services/misc/sickbeard.nix
@@ -44,7 +44,7 @@ in
         description = "Path to config file.";
       };
       port = lib.mkOption {
-        type = lib.types.ints.u16;
+        type = lib.types.port;
         default = 8081;
         description = "Port to bind to.";
       };
diff --git a/nixos/modules/services/monitoring/statsd.nix b/nixos/modules/services/monitoring/statsd.nix
index 43462a95ccae..5eb0517d4fc5 100644
--- a/nixos/modules/services/monitoring/statsd.nix
+++ b/nixos/modules/services/monitoring/statsd.nix
@@ -73,7 +73,7 @@ in
     port = lib.mkOption {
       description = "Port that stats listens for messages on over UDP";
       default = 8125;
-      type = lib.types.int;
+      type = lib.types.port;
     };
 
     mgmt_address = lib.mkOption {
@@ -85,7 +85,7 @@ in
     mgmt_port = lib.mkOption {
       description = "Port to run the management TCP interface on";
       default = 8126;
-      type = lib.types.int;
+      type = lib.types.port;
     };
 
     backends = lib.mkOption {
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
index d93f8c61629e..1f9c9dcac4a0 100644
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -417,7 +417,7 @@ in
       };
 
       port = mkOption {
-        type = with types; nullOr int;
+        type = with types; nullOr port;
         default = null;
         description = ''
           I2P listen port. If no one is given the router will pick between 9111 and 30777.
diff --git a/nixos/modules/services/networking/iperf3.nix b/nixos/modules/services/networking/iperf3.nix
index 6bcf17306e1d..173d3e6d962b 100644
--- a/nixos/modules/services/networking/iperf3.nix
+++ b/nixos/modules/services/networking/iperf3.nix
@@ -12,7 +12,7 @@ let
     enable = mkEnableOption "iperf3 network throughput testing server";
     package = mkPackageOption pkgs "iperf3" { };
     port = mkOption {
-      type = types.ints.u16;
+      type = types.port;
       default = 5201;
       description = "Server port to listen on for iperf3 client requests.";
     };
diff --git a/nixos/modules/services/networking/nghttpx/server-options.nix b/nixos/modules/services/networking/nghttpx/server-options.nix
index 19e03cac557d..ebff829e8412 100644
--- a/nixos/modules/services/networking/nghttpx/server-options.nix
+++ b/nixos/modules/services/networking/nghttpx/server-options.nix
@@ -9,7 +9,7 @@
       '';
     };
     port = lib.mkOption {
-      type = lib.types.int;
+      type = lib.types.port;
       example = 5088;
       description = ''
         Server host port.
diff --git a/nixos/modules/services/networking/pihole-ftl-setup-script.nix b/nixos/modules/services/networking/pihole-ftl-setup-script.nix
index e5d0644c2f82..96c0c224aeb1 100644
--- a/nixos/modules/services/networking/pihole-ftl-setup-script.nix
+++ b/nixos/modules/services/networking/pihole-ftl-setup-script.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  pihole = pkgs.pihole;
+  pihole = cfg.piholePackage;
   makePayload =
     list:
     builtins.toJSON {
@@ -29,8 +29,8 @@ in
     ${lib.getExe' pkgs.procps "kill"} -s SIGRTMIN $(systemctl show --property MainPID --value ${config.systemd.services.pihole-ftl.name})
   fi
 
-  source ${pihole}/usr/share/pihole/advanced/Scripts/api.sh
-  source ${pihole}/usr/share/pihole/advanced/Scripts/utils.sh
+  source ${pihole}/share/pihole/advanced/Scripts/api.sh
+  source ${pihole}/share/pihole/advanced/Scripts/utils.sh
 
   any_failed=0
 
diff --git a/nixos/modules/services/networking/pihole-ftl.nix b/nixos/modules/services/networking/pihole-ftl.nix
index f170da405e70..f1abffc9ea22 100644
--- a/nixos/modules/services/networking/pihole-ftl.nix
+++ b/nixos/modules/services/networking/pihole-ftl.nix
@@ -198,6 +198,19 @@ in
         '';
       };
     };
+
+    webserverEnabled = mkOption {
+      type = types.bool;
+      default = (
+        (hasAttrByPath [ "webserver" "port" ] cfg.settings)
+        && !builtins.elem cfg.settings.webserver.port [
+          ""
+          null
+        ]
+      );
+      internal = true;
+      description = "Whether the webserver is enabled.";
+    };
   };
 
   config = mkIf cfg.enable {
@@ -208,15 +221,7 @@ in
       }
 
       {
-        assertion =
-          builtins.length cfg.lists == 0
-          || (
-            (hasAttrByPath [ "webserver" "port" ] cfg.settings)
-            && !builtins.elem cfg.settings.webserver.port [
-              ""
-              null
-            ]
-          );
+        assertion = builtins.length cfg.lists == 0 || cfg.webserverEnabled;
         message = ''
           The Pi-hole webserver must be enabled for lists set in services.pihole-ftl.lists to be automatically loaded on startup via the web API.
           services.pihole-ftl.settings.port must be defined, e.g. by enabling services.pihole-web.enable and defining services.pihole-web.port.
@@ -348,6 +353,8 @@ in
 
       pihole-ftl-setup = {
         description = "Pi-hole FTL setup";
+        enable = builtins.length cfg.lists > 0;
+
         # Wait for network so lists can be downloaded
         after = [ "network-online.target" ];
         requires = [ "network-online.target" ];
@@ -415,11 +422,16 @@ in
         script =
           let
             days = toString cfg.queryLogDeleter.age;
-            database = "${cfg.stateDirectory}/pihole-FTL.db";
+            database = cfg.settings.files.database;
           in
           ''
             set -euo pipefail
 
+            # Avoid creating an empty database file if it doesn't yet exist
+            if [ ! -f "${database}" ]; then
+              exit 0;
+            fi
+
             echo "Deleting query logs older than ${days} days"
             ${getExe cfg.package} sqlite3 "${database}" "DELETE FROM query_storage WHERE timestamp <= CAST(strftime('%s', date('now', '-${days} day')) AS INT); select changes() from query_storage limit 1"
           '';
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 76198d6337c8..4b3ab053be7d 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -319,7 +319,7 @@ in
                 '';
               };
               port = lib.mkOption {
-                type = lib.types.nullOr lib.types.int;
+                type = lib.types.nullOr lib.types.port;
                 default = null;
                 description = ''
                   Port to listen to.
diff --git a/nixos/modules/services/networking/tinyproxy.nix b/nixos/modules/services/networking/tinyproxy.nix
index 5712f7949ef0..4b3d1e425f4c 100644
--- a/nixos/modules/services/networking/tinyproxy.nix
+++ b/nixos/modules/services/networking/tinyproxy.nix
@@ -70,7 +70,7 @@ in
                 '';
               };
               Port = mkOption {
-                type = types.int;
+                type = types.port;
                 default = 8888;
                 description = ''
                   Specify which port to listen to.
diff --git a/nixos/modules/services/security/timekpr.nix b/nixos/modules/services/security/timekpr.nix
new file mode 100644
index 000000000000..cbf7866ea2b9
--- /dev/null
+++ b/nixos/modules/services/security/timekpr.nix
@@ -0,0 +1,65 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.timekpr;
+  targetBaseDir = "/var/lib/timekpr";
+  daemonUser = "root";
+  daemonGroup = "root";
+in
+{
+  options = {
+    services.timekpr = {
+      package = lib.mkPackageOption pkgs "timekpr" { };
+      enable = lib.mkEnableOption "Timekpr-nExT, a screen time managing application that helps optimizing time spent at computer for your subordinates, children or even for yourself";
+      adminUsers = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [
+          "alice"
+          "bob"
+        ];
+        description = ''
+          All listed users will become part of the `timekpr` group so they can manage timekpr settings without requiring sudo.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups.timekpr = {
+      gid = 2000;
+      members = cfg.adminUsers;
+    };
+
+    environment.systemPackages = [
+      # Add timekpr to system packages so that polkit can find it
+      cfg.package
+    ];
+    services.dbus.enable = true;
+    services.dbus.packages = [
+      cfg.package
+    ];
+    environment.etc."timekpr" = {
+      source = "${cfg.package}/etc/timekpr";
+    };
+    systemd.packages = [
+      cfg.package
+    ];
+    systemd.services.timekpr = {
+      enable = true;
+      wantedBy = [ "multi-user.target" ];
+    };
+    security.polkit.enable = true;
+    systemd.tmpfiles.rules = [
+      "d ${targetBaseDir} 0755 ${daemonUser} ${daemonGroup} -"
+      "d ${targetBaseDir}/config 0755 ${daemonUser} ${daemonGroup} -"
+      "d ${targetBaseDir}/work 0755 ${daemonUser} ${daemonGroup} -"
+    ];
+  };
+
+  meta.maintainers = [ lib.maintainers.atry ];
+}
diff --git a/nixos/modules/services/torrent/flood.nix b/nixos/modules/services/torrent/flood.nix
index a623c62b4400..658ce55939f6 100644
--- a/nixos/modules/services/torrent/flood.nix
+++ b/nixos/modules/services/torrent/flood.nix
@@ -19,7 +19,7 @@ in
       description = "Whether to open the firewall for the port in {option}`services.flood.port`.";
     };
     port = lib.mkOption {
-      type = lib.types.int;
+      type = lib.types.port;
       description = "Port to bind webserver.";
       default = 3000;
       example = 3001;
diff --git a/nixos/modules/services/web-apps/selfoss.nix b/nixos/modules/services/web-apps/selfoss.nix
index 47ca75f00794..c3dceb859fea 100644
--- a/nixos/modules/services/web-apps/selfoss.nix
+++ b/nixos/modules/services/web-apps/selfoss.nix
@@ -100,7 +100,7 @@ in
         };
 
         port = mkOption {
-          type = types.nullOr types.int;
+          type = types.nullOr types.port;
           default = null;
           description = ''
             The database's port. If not set, the default ports will be
diff --git a/nixos/modules/services/web-servers/varnish/default.nix b/nixos/modules/services/web-servers/varnish/default.nix
index f42ed39ece80..0f1217fa9b35 100644
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@@ -80,7 +80,7 @@ let
       port = mkOption {
         description = "The port to use for IP sockets. If port is not specified, port 80 (http) is used.";
         default = null;
-        type = with types; nullOr int;
+        type = with types; nullOr port;
       };
       proto = mkOption {
         description = "PROTO can be 'HTTP' (the default) or 'PROXY'.  Both version 1 and 2 of the proxy protocol can be used.";
diff --git a/nixos/modules/virtualisation/waagent.nix b/nixos/modules/virtualisation/waagent.nix
index bb63506efa08..407aa261b764 100644
--- a/nixos/modules/virtualisation/waagent.nix
+++ b/nixos/modules/virtualisation/waagent.nix
@@ -220,7 +220,7 @@ let
         };
 
         Port = lib.mkOption {
-          type = types.nullOr types.int;
+          type = types.nullOr types.port;
           default = null;
           description = ''
             If you set http proxy, waagent will use this proxy to access the Internet.
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 398fa4157388..cf347fc92061 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1193,6 +1193,7 @@ in
   pict-rs = runTest ./pict-rs.nix;
   pingvin-share = runTest ./pingvin-share.nix;
   pinnwand = runTest ./pinnwand.nix;
+  pihole-ftl = import ./pihole-ftl { inherit runTest; };
   plantuml-server = runTest ./plantuml-server.nix;
   plasma6 = runTest ./plasma6.nix;
   plausible = runTest ./plausible.nix;
diff --git a/nixos/tests/kafka/base.nix b/nixos/tests/kafka/base.nix
index 961511525cdd..e2d9c9edfa8a 100644
--- a/nixos/tests/kafka/base.nix
+++ b/nixos/tests/kafka/base.nix
@@ -131,5 +131,6 @@ with pkgs;
     mode = "zookeeper";
   };
   kafka_4_0 = makeKafkaTest "kafka_4_0" { kafkaPackage = apacheKafka_4_0; };
+  kafka_4_1 = makeKafkaTest "kafka_4_1" { kafkaPackage = apacheKafka_4_1; };
   kafka = makeKafkaTest "kafka" { kafkaPackage = apacheKafka; };
 }
diff --git a/nixos/tests/libresprite.nix b/nixos/tests/libresprite.nix
index 76417b80ee2e..7fb3378e7910 100644
--- a/nixos/tests/libresprite.nix
+++ b/nixos/tests/libresprite.nix
@@ -23,10 +23,10 @@
 
   testScript = ''
     machine.wait_for_x()
-    machine.succeed("convert -font DejaVu-Sans +antialias label:'IT WORKS' image.png")
+    machine.succeed("convert -font DejaVu-Sans -pointsize 48 +antialias label:'WORKS' image.png")
     machine.execute("libresprite image.png >&2 &")
     machine.wait_for_window("LibreSprite ${pkgs.libresprite.version}-dev")
-    machine.wait_for_text("IT WORKS")
+    machine.wait_for_text("WORKS")
     machine.screenshot("screen")
   '';
 }
diff --git a/nixos/tests/pihole-ftl/basic.nix b/nixos/tests/pihole-ftl/basic.nix
new file mode 100644
index 000000000000..2d1a867b0938
--- /dev/null
+++ b/nixos/tests/pihole-ftl/basic.nix
@@ -0,0 +1,47 @@
+# A basic test with no webserver, no API, just checking DNS functionality
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+rec {
+  name = "pihole-ftl-basic";
+  meta.maintainers = with lib.maintainers; [ averyvigolo ];
+
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      services.pihole-ftl = {
+        enable = true;
+        openFirewallDNS = true;
+      };
+      environment.systemPackages = with pkgs; [ dig ];
+    };
+
+  nodes.client =
+    { pkgs, lib, ... }:
+    {
+      environment.systemPackages = with pkgs; [ dig ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      machine.wait_for_unit("pihole-ftl.service")
+      machine.wait_for_open_port(53)
+      client.wait_for_unit("network.target")
+
+      with subtest("the pi-hole machine resolves properly"):
+        ret, out = machine.execute("dig @localhost +short pi.hole")
+        assert ret == 0, "pi.hole should resolve on the local machine"
+        assert out.rstrip() == "127.0.0.1", "pi.hole should resolve to localhost on the local machine"
+
+      machine_address = "${(builtins.head nodes.machine.networking.interfaces.eth1.ipv4.addresses).address}"
+
+      with subtest("a client machine resolves properly"):
+        ret, out = client.execute(f"dig @{machine_address} +short pi.hole")
+        assert ret == 0, "pi.hole should resolve on a client machine"
+        assert out.rstrip() == machine_address, "pi.hole should resolve to the machine's address"
+    '';
+}
diff --git a/nixos/tests/pihole-ftl/default.nix b/nixos/tests/pihole-ftl/default.nix
new file mode 100644
index 000000000000..71c971174dca
--- /dev/null
+++ b/nixos/tests/pihole-ftl/default.nix
@@ -0,0 +1,5 @@
+{ runTest }:
+
+{
+  basic = runTest ./basic.nix;
+}
diff --git a/nixos/tests/timekpr.nix b/nixos/tests/timekpr.nix
new file mode 100644
index 000000000000..1ae793d8f70e
--- /dev/null
+++ b/nixos/tests/timekpr.nix
@@ -0,0 +1,17 @@
+{ pkgs, lib, ... }:
+{
+  name = "timekpr";
+  meta.maintainers = [ lib.maintainers.atry ];
+
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      services.timekpr.enable = true;
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_file("/etc/timekpr/timekpr.conf")
+    machine.wait_for_unit("timekpr.service")
+  '';
+}
diff --git a/nixos/tests/tlsrpt.nix b/nixos/tests/tlsrpt.nix
index 92a7d0cda78e..0c2ea2b67a44 100644
--- a/nixos/tests/tlsrpt.nix
+++ b/nixos/tests/tlsrpt.nix
@@ -34,7 +34,7 @@
     machine.wait_until_succeeds("journalctl -o cat -u tlsrpt-reportd | grep -Pq 'Fetcher .* finished'")
 
     # Enabling postfix should put sendmail as the sendmail setting
-    machine.succeed("grep -q sendmail_script=sendmail /etc/tlsrpt/reportd.cfg")
+    machine.succeed("grep -q sendmail_script=/run/wrappers/bin/sendmail /etc/tlsrpt/reportd.cfg")
     machine.succeed("getent group tlsrpt | grep -q postfix")
 
     machine.log(machine.succeed("systemd-analyze security tlsrpt-collectd.service tlsrpt-reportd.service | grep -v ✓"))
diff --git a/nixos/tests/varnish.nix b/nixos/tests/varnish.nix
index 10946fcdff65..e90420d1334e 100644
--- a/nixos/tests/varnish.nix
+++ b/nixos/tests/varnish.nix
@@ -1,6 +1,14 @@
 { pkgs, package, ... }:
 let
   testPath = pkgs.hello;
+
+  # Same stateDir logic as in nixos/modules/services/web-servers/varnish/default.nix
+  stateDir =
+    hostName:
+    if (pkgs.lib.versionOlder package.version "7") then
+      "/var/run/varnish/${hostName}"
+    else
+      "/var/run/varnishd";
 in
 {
   name = "varnish";
@@ -37,13 +45,16 @@ in
               port = 8080;
               proto = "PROXY";
             }
-            { address = "@asdf"; }
             {
-              address = "/run/varnishd/client.http.sock";
+              address = "${stateDir config.networking.hostName}/client.http.sock";
               user = "varnish";
               group = "varnish";
               mode = "660";
             }
+          ]
+          ++ lib.optionals (lib.versionAtLeast package.version "7.3") [
+            # Support added in 7.3.0
+            { address = "@asdf"; }
           ];
           config = ''
             vcl 4.1;
@@ -59,24 +70,25 @@ in
         system.extraDependencies = [ testPath ];
 
         assertions =
+          let
+            cmdline = config.systemd.services.varnish.serviceConfig.ExecStart;
+          in
           map
+            (pattern: {
+              assertion = lib.hasInfix pattern cmdline;
+              message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
+            })
             (
-              pattern:
-              let
-                cmdline = config.systemd.services.varnish.serviceConfig.ExecStart;
-              in
-              {
-                assertion = lib.hasInfix pattern cmdline;
-                message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
-              }
-            )
-            [
-              " -a 0.0.0.0:80,HTTP "
-              " -a proxyport=0.0.0.0:8080,PROXY "
-              " -a @asdf,HTTP "
-              " -a /run/varnishd/client.http.sock,HTTP,user=varnish,group=varnish,mode=660 "
-              " -a 0.0.0.0:81 "
-            ];
+              [
+                " -a 0.0.0.0:80,HTTP "
+                " -a proxyport=0.0.0.0:8080,PROXY "
+                " -a ${stateDir config.networking.hostName}/client.http.sock,HTTP,user=varnish,group=varnish,mode=660 "
+                " -a 0.0.0.0:81 "
+              ]
+              ++ lib.optionals (lib.versionAtLeast package.version "7.3") [
+                " -a @asdf,HTTP "
+              ]
+            );
       };
 
     client =
diff --git a/pkgs/README.md b/pkgs/README.md
index 1d8d62e640db..694de2858e43 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -125,7 +125,7 @@ To add a package to Nixpkgs:
    - Apache HTTPD: [`pkgs/servers/http/apache-httpd/2.4.nix`](servers/http/apache-httpd/2.4.nix).
      A bunch of optional features, variable substitutions in the configure flags, a post-install hook, and miscellaneous hackery.
 
-   - buildMozillaMach: [`pkgs/applications/networking/browser/firefox/common.nix`](applications/networking/browsers/firefox/common.nix).
+   - buildMozillaMach: [`pkgs/build-support/build-mozilla-mach/default.nix`](./build-support/build-mozilla-mach/default.nix).
      A reusable build function for Firefox, Thunderbird and Librewolf.
 
    - JDiskReport, a Java utility: [`pkgs/by-name/jd/jdiskreport/package.nix`](./by-name/jd/jdiskreport/package.nix).
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index 1e58db10f011..eba658a1435a 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clementine";
-  version = "1.4.1-50-ge281c4508";
+  version = "1.4.1-51-gea6466943";
 
   src = fetchFromGitHub {
     owner = "clementine-player";
     repo = "Clementine";
     tag = finalAttrs.version;
-    hash = "sha256-MsOVCAKhOvJlQepvT32+ffJdMzx+sYlNM/HeUTaeC2Y=";
+    hash = "sha256-aTsu8yYvvLWMZhAN0jYVlrlMtQ2+hTZOxFv8gmC2ZDs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/jamesdsp/default.nix b/pkgs/applications/audio/jamesdsp/default.nix
index 330b3a4ec78a..a3917e48f509 100644
--- a/pkgs/applications/audio/jamesdsp/default.nix
+++ b/pkgs/applications/audio/jamesdsp/default.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       pasqui23
-      rewine
+      wineee
     ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 1c63e4293929..2a1b52daceb7 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -45,14 +45,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin" else "bitcoind";
-  version = "29.0";
+  version = "29.1";
 
   src = fetchurl {
     urls = [
       "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz"
     ];
     # hash retrieved from signed SHA256SUMS
-    sha256 = "882c782c34a3bf2eacd1fae5cdc58b35b869883512f197f7d6dc8f195decfdaa";
+    sha256 = "067f624ae273b0d85a1554ffd7c098923351a647204e67034df6cc1dfacfa06b";
   };
 
   nativeBuildInputs = [
@@ -93,12 +93,12 @@ stdenv.mkDerivation (finalAttrs: {
 
       checksums = fetchurl {
         url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
-        hash = "sha256-lOwVH0UqIhOT0I9rAvswuqy+tZ8ZRhH0kGnn9VCbRv4=";
+        hash = "sha256-teQ02vm875Isks9sBC2HV3Zo78W+UkXGH9zgyNhOnQs=";
       };
 
       signatures = fetchurl {
         url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-s05cRmZ9aoPdSZTaz6D6qmVwX6OprqxynPn5vZQ7bbw=";
+        hash = "sha256-hyk57QyGJnrjuuGRmvfOhVAx9Nru93e8bfah5fSVcmg=";
       };
 
       verifyBuilderKeys =
@@ -121,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
       ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
       gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
       ${verifyBuilderKeys}
+      echo "Checking ${checksums} for bitcoin-${finalAttrs.version}.tar.gz..."
       grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
       echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
       sha256sum -c SHA256SUMS.filtered
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3900df43fb75..23a0c8ab7897 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1985,8 +1985,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.38.1";
-          hash = "sha256-OxzjqafPYOe6qMSI0cW3qAU6xbBrIpx47cDz8lJ9ZG0=";
+          version = "6.40.1";
+          hash = "sha256-FFuYM15NGqpS2efijAXCvXhvV2A87lshquEDPdGT9qk=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index 9736068c643d..730888167763 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -82,14 +82,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.40.9";
+  version = "3.40.10";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-R2qj6PnCq4uuZP/iFiJh8bFcyPHG7bix9Oc6Re4ixU4=";
+    hash = "sha256-3FvHAoVeTwBvFNUxSCSumjiPg1hK3oRS1zMzWLXoSTc=";
   };
 
   passthru = {
diff --git a/pkgs/applications/graphics/pineapple-pictures/default.nix b/pkgs/applications/graphics/pineapple-pictures/default.nix
index 6840b8406b1a..ace0f10ce009 100644
--- a/pkgs/applications/graphics/pineapple-pictures/default.nix
+++ b/pkgs/applications/graphics/pineapple-pictures/default.nix
@@ -39,6 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     mainProgram = "ppic";
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
   };
 })
diff --git a/pkgs/applications/misc/digitalbitbox/default.nix b/pkgs/applications/misc/digitalbitbox/default.nix
index bc923b7c2ce2..be81fe704dca 100644
--- a/pkgs/applications/misc/digitalbitbox/default.nix
+++ b/pkgs/applications/misc/digitalbitbox/default.nix
@@ -60,6 +60,11 @@ mkDerivation rec {
     sha256 = "ig3+TdYv277D9GVnkRSX6nc6D6qruUOw/IQdQCK6FoA=";
   };
 
+  # configure.ac:23: error: AC_CONFIG_MACRO_DIR can only be used once
+  postPatch = ''
+    sed -i "23d" src/hidapi/configure.ac
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
     curl
diff --git a/pkgs/applications/misc/kiwix/default.nix b/pkgs/applications/misc/kiwix/default.nix
index bb52de44c15d..4f05aa627d64 100644
--- a/pkgs/applications/misc/kiwix/default.nix
+++ b/pkgs/applications/misc/kiwix/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
   fetchFromGitHub,
   nix-update-script,
   libkiwix,
@@ -10,10 +10,11 @@
   qtwebengine,
   qtsvg,
   qtimageformats,
+  wrapQtAppsHook,
   aria2,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "kiwix";
   version = "2.4.1";
 
@@ -27,6 +28,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     qmake
     pkg-config
+    wrapQtAppsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 92f7e39110f8..2c9b618e9fdd 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -335,13 +335,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-Zfsxcfi55RjG5Jq/MnDZ8yfOjg78ORrUMhK300EFxes=",
+    "hash": "sha256-0ewJLIrKCdTAb3+up7xdbxXscr3hmcIWWcAEGp2TaG4=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.72.0",
+    "rev": "v3.73.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Zi1SyC2SdYBMO0r7QVYS51XOodRG1JHcuIrMu0JRkn0="
+    "vendorHash": "sha256-RsIuWBhiziUeil/buqOKNH5tPuuWcMoGbKKQUMH17sc="
   },
   "deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -633,11 +633,11 @@
     "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
   },
   "huaweicloud": {
-    "hash": "sha256-HDB4hUajFRyVCMZ3KAF0mSICsxdkFF2wNXGau3ggMQA=",
+    "hash": "sha256-GHwwOk8ehMICu024vcJKEs1ruO7KZqIq+tvQIgPnbjg=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.77.6",
+    "rev": "v1.78.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -831,13 +831,13 @@
     "vendorHash": "sha256-QxbZv6YMa5/I4bTeQBNdmG3EKtLEmstnH7HMiZzFJrI="
   },
   "migadu": {
-    "hash": "sha256-lXt+MswcRy6ztxVciTQKc4oA5tfO3JlDO6xDo6SxlcQ=",
+    "hash": "sha256-4nNOcRM3iOtEs7HVCXKhhERankS1DKUY7cApWcfnHLY=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2025.8.21",
+    "rev": "2025.8.28",
     "spdx": "0BSD",
-    "vendorHash": "sha256-GN1h8DXFeAQpg4v7S95VJs17HY4twFGoZKN1modJSRI="
+    "vendorHash": "sha256-33hZ+MB96pFkHCG3UkKcnPp8wpE8POEHLz12OSF8ujI="
   },
   "minio": {
     "hash": "sha256-XYo+nn9rgK9OtwdowqcTyuMir+7KPPjVeMLwFeWvdEQ=",
@@ -994,13 +994,13 @@
     "vendorHash": "sha256-AlB9tC3KejgUAjjT2pY7Q2mTS/AV4QRusSnyPiOheXE="
   },
   "opentelekomcloud": {
-    "hash": "sha256-B5Rp3C343Doq48dO+sid5P9Z0vXN6THdhEGdHnHvKD0=",
+    "hash": "sha256-eZHDzF7029QKzvVegQnVVNe/BaG4m53tydcQlKeE57o=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.45",
+    "rev": "v1.36.47",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CWQRfXZuD4MrP8qvrZb98HMN9cRY3Gt4nF0cc+c7hnc="
+    "vendorHash": "sha256-yTkPnoyOwp+eL8xDf4WISphw5IrGi3gL7WuLvG02rUE="
   },
   "openwrt": {
     "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@@ -1436,13 +1436,13 @@
     "vendorHash": "sha256-iqwdSzyVZE5CitzXc8rWn2zO3v+VvuDNeS0ll0V6MtU="
   },
   "utils": {
-    "hash": "sha256-vCdPG8cZUdFhs1OmqDlgCDqBdyFiL99p6I8JhL8C6lY=",
+    "hash": "sha256-TcCDv6IB6Z4llvogKWasAK4u2NFsOG4UKAUERDH6SXg=",
     "homepage": "https://registry.terraform.io/providers/cloudposse/utils",
     "owner": "cloudposse",
     "repo": "terraform-provider-utils",
-    "rev": "v1.30.0",
+    "rev": "v1.31.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-giqZi1CmuyANNwzW+y9BUUUEfBhFZKkVGAvIPVvZnzE="
+    "vendorHash": "sha256-djz3kNV+13Sz9prRPhWaWi50hvYXq3I3cp4neLexeEs="
   },
   "vault": {
     "hash": "sha256-nY8NOE3VJCHkDeisWgxIHG6T1fQ8Jt6Nom2ELexuld0=",
@@ -1463,13 +1463,13 @@
     "vendorHash": "sha256-eCIJ2w8DjmUCGp0VbliLaQ6C29mJhl6Spya06Xyiqd4="
   },
   "venafi": {
-    "hash": "sha256-7JKsSAiZufOLVMpWVWI+lyWucJ/eqO7OWdSTkQC6VEc=",
+    "hash": "sha256-VrGObs4l2MhawPe7KjUFgxRBiojfulX1cl1Wo7e4Ehg=",
     "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
     "owner": "Venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.22.4",
+    "rev": "v0.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-3fuH/8dqf4jzORN6/ajapj/WclbwD65Nojs+cEdgJ7I="
+    "vendorHash": "sha256-iaGvkHPBUrcca4Z3oPrX6qrtkitpnoiBnIpZPg54Z48="
   },
   "vinyldns": {
     "hash": "sha256-ow+o9fRw/t2i4N65zuVFbfPb68ZUcJfNB5ARYqRTsIs=",
diff --git a/pkgs/applications/networking/gns3/server.nix b/pkgs/applications/networking/gns3/server.nix
index e580cdd43390..7d8e993551e7 100644
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@@ -87,6 +87,7 @@ python3Packages.buildPythonApplication {
   disabledTestPaths = [
     # fails on ofborg because of lack of cpu vendor information
     "tests/controller/gns3vm/test_virtualbox_gns3_vm.py::test_cpu_vendor_id"
+    "tests/controller/test_project.py"
   ];
 
   passthru.tests = {
diff --git a/pkgs/applications/networking/instant-messengers/profanity/default.nix b/pkgs/applications/networking/instant-messengers/profanity/default.nix
index 82f4dafc83d5..6f0c7267417a 100644
--- a/pkgs/applications/networking/instant-messengers/profanity/default.nix
+++ b/pkgs/applications/networking/instant-messengers/profanity/default.nix
@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "profanity";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "profanity-im";
     repo = "profanity";
     rev = finalAttrs.version;
-    hash = "sha256-3TmnbTnL8SPSd3seThavOOJVELi8kWLSlZlAub24KZ4=";
+    hash = "sha256-h+R+hasc45NZOneuqZ+z+yjfpsPm317OXq0LYe3t+cQ=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/ktailctl/default.nix b/pkgs/applications/networking/ktailctl/default.nix
index 5d04b6101d1e..0460c77c8963 100644
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@@ -26,13 +26,13 @@
 }:
 
 let
-  version = "0.21.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-mKkHp6ZRTTepg/wo/1jeWBERRezT6hz0EL3ZDlS7nGk=";
+    hash = "sha256-8k8TRJdfvlYkp3lfGRm8LeWhRuZnSHFZ7UwICRMjwds=";
   };
 
   goDeps =
@@ -40,7 +40,7 @@ let
       pname = "ktailctl-go-wrapper";
       inherit src version;
       modRoot = "src/wrapper";
-      vendorHash = "sha256-RBjWTNbKS/nzD1tF28BZrBJPbx0s6t7Bi1eRFgtHYwk=";
+      vendorHash = "sha256-/D06cfLWJ0T0FKXMFV7mPi13ag3tX2Pq9eELuERKHtY=";
     }).goModules;
 in
 stdenv.mkDerivation {
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index fcf77335fd20..cad55acb80a7 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -115,8 +115,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.2.0esr";
-    sha512 = "6a10f95b805f00a0820c822ae07bc52ac39d0a55f084c319d27f01710d8a1d809b7b224da966632ae0a22658bf14e76c8fd7cec022718316c306c43809a4997d";
+    version = "140.2.1esr";
+    sha512 = "fccef5b8d60cd1aace585f253f52587cb3ff9384bcca2e150d4b52c8106dcd19e4d911f0ac634c0adef2da5034169c81667a5634ee14a5f5fd7cf194f6b86576";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";
diff --git a/pkgs/applications/video/vdr/plugins.nix b/pkgs/applications/video/vdr/plugins.nix
index 05f1b637f101..c86fead10a56 100644
--- a/pkgs/applications/video/vdr/plugins.nix
+++ b/pkgs/applications/video/vdr/plugins.nix
@@ -38,18 +38,6 @@ in
     buildInputs = oldAttr.buildInputs ++ [ ncurses ];
   });
 
-  inherit
-    (lib.genAttrs [
-      "epgtableid0"
-      "hello"
-      "osddemo"
-      "pictures"
-      "servicedemo"
-      "status"
-      "svdrpdemo"
-    ] mkPlugin)
-    ;
-
   femon = stdenv.mkDerivation rec {
     pname = "vdr-femon";
     version = "2.4.0";
@@ -170,3 +158,12 @@ in
     };
   };
 }
+// (lib.genAttrs [
+  "epgtableid0"
+  "hello"
+  "osddemo"
+  "pictures"
+  "servicedemo"
+  "status"
+  "svdrpdemo"
+] mkPlugin)
diff --git a/pkgs/applications/window-managers/wayfire/default.nix b/pkgs/applications/window-managers/wayfire/default.nix
index be4dff33036d..d03bed7e7a49 100644
--- a/pkgs/applications/window-managers/wayfire/default.nix
+++ b/pkgs/applications/window-managers/wayfire/default.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       wucke13
-      rewine
+      wineee
     ];
     platforms = lib.platforms.unix;
     mainProgram = "wayfire";
diff --git a/pkgs/applications/window-managers/wayfire/focus-request.nix b/pkgs/applications/window-managers/wayfire/focus-request.nix
index cae7bc39f065..2b7bd6fad686 100644
--- a/pkgs/applications/window-managers/wayfire/focus-request.nix
+++ b/pkgs/applications/window-managers/wayfire/focus-request.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gitlab.com/wayfireplugins/focus-request";
     description = "Wayfire plugin provides a mechanism to grant focus to views that make a focus self-request";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     inherit (wayfire.meta) platforms;
   };
 })
diff --git a/pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix b/pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix
index 3d86c62fd4b0..8a5801ec2237 100644
--- a/pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix
+++ b/pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/WayfireWM/wayfire-plugins-extra";
     description = "Additional plugins for Wayfire";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     inherit (wayfire.meta) platforms;
   };
 })
diff --git a/pkgs/applications/window-managers/wayfire/wayfire-shadows.nix b/pkgs/applications/window-managers/wayfire/wayfire-shadows.nix
index 0abd91739be7..9aef4a60e18f 100644
--- a/pkgs/applications/window-managers/wayfire/wayfire-shadows.nix
+++ b/pkgs/applications/window-managers/wayfire/wayfire-shadows.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/timgott/wayfire-shadows";
     description = "Wayfire plugin that adds window shadows";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     inherit (wayfire.meta) platforms;
   };
 })
diff --git a/pkgs/applications/window-managers/wayfire/wcm.nix b/pkgs/applications/window-managers/wayfire/wcm.nix
index 01b1d64f252f..bd23d4faea00 100644
--- a/pkgs/applications/window-managers/wayfire/wcm.nix
+++ b/pkgs/applications/window-managers/wayfire/wcm.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       wucke13
-      rewine
+      wineee
     ];
     platforms = lib.platforms.unix;
     mainProgram = "wcm";
diff --git a/pkgs/applications/window-managers/wayfire/wf-config.nix b/pkgs/applications/window-managers/wayfire/wf-config.nix
index 80511e5abb67..995a71c6a3f5 100644
--- a/pkgs/applications/window-managers/wayfire/wf-config.nix
+++ b/pkgs/applications/window-managers/wayfire/wf-config.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       wucke13
-      rewine
+      wineee
     ];
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/applications/window-managers/wayfire/wf-shell.nix b/pkgs/applications/window-managers/wayfire/wf-shell.nix
index 737fb83fca50..2405290947e5 100644
--- a/pkgs/applications/window-managers/wayfire/wf-shell.nix
+++ b/pkgs/applications/window-managers/wayfire/wf-shell.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       wucke13
-      rewine
+      wineee
     ];
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/applications/window-managers/wayfire/windecor.nix b/pkgs/applications/window-managers/wayfire/windecor.nix
index 7c80aa9ab345..efe72b855df0 100644
--- a/pkgs/applications/window-managers/wayfire/windecor.nix
+++ b/pkgs/applications/window-managers/wayfire/windecor.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gitlab.com/wayfireplugins/windecor";
     description = "Window decoration plugin for wayfire";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     inherit (wayfire.meta) platforms;
   };
 })
diff --git a/pkgs/applications/window-managers/wayfire/wwp-switcher.nix b/pkgs/applications/window-managers/wayfire/wwp-switcher.nix
index 109ecc6e06e5..afe50faba5b5 100644
--- a/pkgs/applications/window-managers/wayfire/wwp-switcher.nix
+++ b/pkgs/applications/window-managers/wayfire/wwp-switcher.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/wb9688/wwp-switcher";
     description = "Plugin to switch active window";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     inherit (wayfire.meta) platforms;
   };
 })
diff --git a/pkgs/build-support/rust/build-rust-crate/lib.sh b/pkgs/build-support/rust/build-rust-crate/lib.sh
index 36ddc9ac23c4..8082c3e92dc0 100644
--- a/pkgs/build-support/rust/build-rust-crate/lib.sh
+++ b/pkgs/build-support/rust/build-rust-crate/lib.sh
@@ -60,7 +60,11 @@ build_bin() {
     --color ${colors} \
 
   if [ "$crate_name_" != "$crate_name" ]; then
-    mv target/bin/$crate_name_ target/bin/$crate_name
+    if [ -f "target/bin/$crate_name_.wasm" ]; then
+      mv target/bin/$crate_name_.wasm target/bin/$crate_name.wasm
+    else
+      mv target/bin/$crate_name_ target/bin/$crate_name
+    fi
   fi
 }
 
diff --git a/pkgs/build-support/rust/build-rust-crate/test/default.nix b/pkgs/build-support/rust/build-rust-crate/test/default.nix
index b0551c314638..e2e89d1fa338 100644
--- a/pkgs/build-support/rust/build-rust-crate/test/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix
@@ -838,6 +838,19 @@ rec {
         ];
       };
 
+      crateWasm32BinHyphens = assertOutputs {
+        name = "wasm32-crate-bin-hyphens";
+        mkCrate = mkCrate pkgsCross.wasm32-unknown-none.buildRustCrate;
+        crateArgs = {
+          crateName = "wasm32-crate-bin-hyphens";
+          crateBin = [ { name = "wasm32-crate-bin-hyphens"; } ];
+          src = mkBin "src/main.rs";
+        };
+        expectedFiles = [
+          "./bin/wasm32-crate-bin-hyphens.wasm"
+        ];
+      };
+
       brotliTest =
         let
           pkg = brotliCrates.brotli_2_5_0 { };
diff --git a/pkgs/build-support/teleport/default.nix b/pkgs/build-support/teleport/default.nix
index c44c320addee..afe2af40f91a 100644
--- a/pkgs/build-support/teleport/default.nix
+++ b/pkgs/build-support/teleport/default.nix
@@ -60,7 +60,7 @@ let
 
     postInstall = ''
       mkdir -p $out/include
-      cp ${finalAttrs.buildAndTestSubdir}/librdprs.h $out/include/
+      cp ${finalAttrs.buildAndTestSubdir}/librdpclient.h $out/include/
     '';
   });
 
diff --git a/pkgs/build-support/teleport/rdpclient.patch b/pkgs/build-support/teleport/rdpclient.patch
index 4f35cd184ab5..ad97288acec5 100644
--- a/pkgs/build-support/teleport/rdpclient.patch
+++ b/pkgs/build-support/teleport/rdpclient.patch
@@ -17,6 +17,6 @@ index 4357d7aa1..7e21a0076 100644
 +#cgo LDFLAGS: -L${SRCDIR}/../../../../../lib -lpthread -ldl -lm -lssl -lcrypto
 +#cgo linux LDFLAGS: -l:librdp_client.a
 +#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client
- #include <librdprs.h>
+ #include <librdpclient.h>
  */
  import "C"
diff --git a/pkgs/by-name/ac/acct/package.nix b/pkgs/by-name/ac/acct/package.nix
index ec7b5c10f6ce..8fb0cb755837 100644
--- a/pkgs/by-name/ac/acct/package.nix
+++ b/pkgs/by-name/ac/acct/package.nix
@@ -2,6 +2,7 @@
   fetchurl,
   lib,
   stdenv,
+  fetchpatch2,
 }:
 
 stdenv.mkDerivation rec {
@@ -15,6 +16,13 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://src.fedoraproject.org/rpms/psacct/raw/rawhide/f/psacct-6.6.4-sprintf-buffer-overflow.patch";
+      hash = "sha256-l74tLIuhpXj+dIA7uAY9L0qMjQ2SbDdc+vjHMyVouFc=";
+    })
+  ];
+
   meta = {
     description = "GNU Accounting Utilities, login and process accounting utilities";
 
diff --git a/pkgs/by-name/al/all-the-package-names/package.nix b/pkgs/by-name/al/all-the-package-names/package.nix
index 170e67c17390..dd9a3f52eaa6 100644
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2186";
+  version = "2.0.2197";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-q35e9y2c5SBfpyjpkA/yuaJzmMx4OOnvhBCMX56KbQ4=";
+    hash = "sha256-NuNgEsjB/5QDvfqfR22BUsVmwlSnmnCMwKAV/Oiz0Ww=";
   };
 
-  npmDepsHash = "sha256-2dwKIW5ZRoLqn8JR3UygO1IAXPd+DPznJIlKJanzWxg=";
+  npmDepsHash = "sha256-DdE2870xe7ut0A+1/Rx/Xb3KOsNjB0heC8gkUZ0TGJ4=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/an/anytype-heart/package.nix b/pkgs/by-name/an/anytype-heart/package.nix
index e3f4bde83b1c..0c04e43d1f03 100644
--- a/pkgs/by-name/an/anytype-heart/package.nix
+++ b/pkgs/by-name/an/anytype-heart/package.nix
@@ -13,12 +13,12 @@ let
   pname = "anytype-heart";
   # Use only versions specified in anytype-ts middleware.version file:
   #  https://github.com/anyproto/anytype-ts/blob/v<anytype-ts-version>/middleware.version
-  version = "0.40.21";
+  version = "0.43.0-rc02";
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-heart";
     tag = "v${version}";
-    hash = "sha256-53LSaETzxwhKkI9is6N6G1+f5Cnf7KStvHA9qeaWUNo=";
+    hash = "sha256-hqDwzW1Tl44ipL1EAwlXUoKaQ0Wvfa2rtZMQy4pgQ8k=";
   };
 
   arch =
@@ -36,7 +36,7 @@ in
 buildGoModule {
   inherit pname version src;
 
-  vendorHash = "sha256-WsYRkAIYDkKWkQpq843dD7Rqc993eHSgee2IX6PomcU=";
+  vendorHash = "sha256-Rs+CusvMksyXUplGk09J4CiFgl/D4KtsI9C15dSCjOI=";
 
   subPackages = [ "cmd/grpcserver" ];
   tags = [
diff --git a/pkgs/by-name/an/anytype/0001-fix-single-instance-detection-when-not-packaged.patch b/pkgs/by-name/an/anytype/0001-fix-single-instance-detection-when-not-packaged.patch
deleted file mode 100644
index 6e09070d72eb..000000000000
--- a/pkgs/by-name/an/anytype/0001-fix-single-instance-detection-when-not-packaged.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 0622b4b5497d8bd923eb0d6dd3f917dfcbda9d53 Mon Sep 17 00:00:00 2001
-From: Axel Karjalainen <axel@axka.fi>
-Date: Thu, 22 May 2025 22:38:14 +0300
-Subject: [PATCH] fix: single instance detection when not packaged
-
----
- electron.js | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/electron.js b/electron.js
-index d70f20f..158bb93 100644
---- a/electron.js
-+++ b/electron.js
-@@ -76,7 +76,7 @@ if (is.development && !port) {
- 	return;
- };
- 
--if (app.isPackaged && !app.requestSingleInstanceLock()) {
-+if (!is.development && !app.requestSingleInstanceLock()) {
- 	Api.exit(mainWindow, '' ,false);
- 	return;
- };
--- 
-2.49.0
-
diff --git a/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch b/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch
new file mode 100644
index 000000000000..b0dad3b73d7b
--- /dev/null
+++ b/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch
@@ -0,0 +1,12 @@
+diff --git a/electron.js b/electron.js
+index c5d6760882..17afc05e26 100644
+--- a/electron.js
++++ b/electron.js
+@@ -15,7 +15,6 @@ const store = new Store({ name: [ 'localStorage', suffix ].join('-') });
+ 
+ // gRPC DevTools extension ID
+ const GRPC_DEVTOOLS_ID = 'fohdnlaeecihjiendkfhifhlgldpeopm';
+-const { installExtension } = require('@tomjs/electron-devtools-installer');
+ 
+ // Fix notifications app name
+ if (is.windows) {
diff --git a/pkgs/by-name/an/anytype/package.nix b/pkgs/by-name/an/anytype/package.nix
index 268e3734b812..f2132ac89cd5 100644
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildNpmPackage,
   pkg-config,
@@ -13,27 +14,27 @@
 
 let
   pname = "anytype";
-  version = "0.46.5";
+  version = "0.49.2";
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-ts";
     tag = "v${version}";
-    hash = "sha256-gDlxyHxBLWVBLnaI6rFclfjwqkw9gneBEC7ssmWDKYU=";
+    hash = "sha256-8+x2FmyR5x9Zrm3t71RSyxAKcJCvnR98+fqHXjBE7aU=";
   };
   description = "P2P note-taking tool";
 
   locales = fetchFromGitHub {
     owner = "anyproto";
     repo = "l10n-anytype-ts";
-    rev = "1d7ca0073bdd02d0145b8da3b1b956ca0652a108";
-    hash = "sha256-aL79DOIFH3CocbcLW0SJ472mYPZJXrPJyRKy8zXiF4o=";
+    rev = "873b42df7320ebbbc80d7e2477914dac70363ef7";
+    hash = "sha256-Mr0KfXn9NO86QqgBhVjSs2przN/GtjuhJHJ9djo8Feg=";
   };
 in
 buildNpmPackage {
   inherit pname version src;
 
-  npmDepsHash = "sha256-WEw3RCi7dWs2eMYxLH7DcmWBrN4T8T6beIyplcXgJAA=";
+  npmDepsHash = "sha256-fuNTSZl+4DG/YL34f/+bYK26ruRFAc1hyHVAm256LiE=";
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -52,7 +53,7 @@ buildNpmPackage {
 
   patches = [
     ./0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
-    ./0001-fix-single-instance-detection-when-not-packaged.patch
+    ./0002-remove-grpc-devtools.patch
   ];
 
   buildPhase = ''
@@ -132,5 +133,6 @@ buildNpmPackage {
       "x86_64-darwin"
       "aarch64-darwin"
     ];
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/ar/arandr/package.nix b/pkgs/by-name/ar/arandr/package.nix
index 363816540a5b..2f10c9a42c2b 100644
--- a/pkgs/by-name/ar/arandr/package.nix
+++ b/pkgs/by-name/ar/arandr/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  fetchurl,
   fetchFromGitLab,
   python3Packages,
   gobject-introspection,
@@ -8,6 +7,7 @@
   gtk3,
   wrapGAppsHook3,
   xrandr,
+  nix-update-script,
 }:
 
 let
@@ -29,6 +29,22 @@ buildPythonApplication rec {
   patches = [ ./gzip-timestamp-fix.patch ];
   patchFlags = [ "-p0" ];
 
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    docutils
+    gsettings-desktop-schemas
+    gtk3
+  ];
+
+  propagatedBuildInputs = [
+    xrandr
+    pygobject3
+  ];
+
   preBuild = ''
     rm -rf data/po/*
   '';
@@ -36,25 +52,20 @@ buildPythonApplication rec {
   # no tests
   doCheck = false;
 
-  buildInputs = [
-    docutils
-    gsettings-desktop-schemas
-    gtk3
-  ];
-  nativeBuildInputs = [
-    gobject-introspection
-    wrapGAppsHook3
-  ];
-  propagatedBuildInputs = [
-    xrandr
-    pygobject3
-  ];
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex=(\\d.*)"
+    ];
+  };
 
-  meta = with lib; {
-    homepage = "https://christian.amsuess.com/tools/arandr/";
+  meta = {
+    changelog = "https://gitlab.com/arandr/arandr/-/blob/${src.tag}/ChangeLog";
     description = "Simple visual front end for XRandR";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ gepbird ];
+    homepage = "https://christian.amsuess.com/tools/arandr/";
+    license = lib.licenses.gpl3;
     mainProgram = "arandr";
+    maintainers = with lib.maintainers; [
+      gepbird
+    ];
   };
 }
diff --git a/pkgs/by-name/ar/ariang/package.nix b/pkgs/by-name/ar/ariang/package.nix
index 2197cba1b747..06dab7c14e24 100644
--- a/pkgs/by-name/ar/ariang/package.nix
+++ b/pkgs/by-name/ar/ariang/package.nix
@@ -2,6 +2,10 @@
   lib,
   fetchFromGitHub,
   buildNpmPackage,
+  copyDesktopItems,
+  imagemagick,
+  xdg-utils,
+  makeDesktopItem,
   nix-update-script,
 }:
 
@@ -20,22 +24,54 @@ buildNpmPackage rec {
 
   makeCacheWritable = true;
 
+  nativeBuildInputs = [
+    copyDesktopItems
+    imagemagick
+  ];
+
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/share
-    cp -r dist $out/share/ariang
+    cp -r dist $out/share/${pname}
+
+    for size in 16 24 36 48 72; do
+      mkdir -p $out/share/icons/hicolor/''${size}x''${size}/apps
+      magick $out/share/${pname}/tileicon.png -resize ''${size}x''${size} \
+        $out/share/icons/hicolor/''${size}x''${size}/apps/${pname}.png
+    done
+
+    mkdir -p $out/bin
+    makeWrapper ${xdg-utils}/bin/xdg-open $out/bin/${pname} \
+      --add-flags "file://$out/share/${pname}/index.html"
 
     runHook postInstall
   '';
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "AriaNg";
+      genericName = meta.description;
+      comment = meta.description;
+      exec = pname;
+      icon = pname;
+      terminal = false;
+      type = "Application";
+      categories = [
+        "Network"
+        "WebBrowser"
+      ];
+    })
+  ];
+
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Modern web frontend making aria2 easier to use";
     homepage = "http://ariang.mayswind.net/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ stunkymonkey ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ stunkymonkey ];
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/by-name/au/audacious-bare/package.nix b/pkgs/by-name/au/audacious-bare/package.nix
index 8397e3797c4a..1facef24df22 100644
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.5";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "audacious-media-player";
     repo = "audacious";
     rev = "${pname}-${version}";
-    hash = "sha256-oYssIeVAvz2nx/3GRxgmsUjp2mnEFMem0WNPJG9l14E=";
+    hash = "sha256-1+RyGMUrotFdNCNpxzKpXGafKn9kNtzEyRVefUmJexU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/audacious-plugins/package.nix b/pkgs/by-name/au/audacious-plugins/package.nix
index b19410494acc..b954bcdef991 100644
--- a/pkgs/by-name/au/audacious-plugins/package.nix
+++ b/pkgs/by-name/au/audacious-plugins/package.nix
@@ -45,13 +45,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious-plugins";
-  version = "4.5";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "audacious-media-player";
     repo = "audacious-plugins";
     rev = "${pname}-${version}";
-    hash = "sha256-2GsNIkvrjZ1EOXi6H5jagdawxXp0kVg7C4FaEZkMHwM=";
+    hash = "sha256-HfO59DOIYsEpBzUyaLYh/gXfz+zvH8lIY2yBVCn3wks=";
   };
 
   patches = [ ./0001-Set-plugindir-to-PREFIX-lib-audacious.patch ];
diff --git a/pkgs/by-name/au/automatic-timezoned/package.nix b/pkgs/by-name/au/automatic-timezoned/package.nix
index 4fc4bffc6cda..4c6e809c649d 100644
--- a/pkgs/by-name/au/automatic-timezoned/package.nix
+++ b/pkgs/by-name/au/automatic-timezoned/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "2.0.86";
+  version = "2.0.88";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = "automatic-timezoned";
     rev = "v${version}";
-    sha256 = "sha256-LUfRylbu5bium8zXYFMs+hP7cKr3UMEhn0evwhQqiz8=";
+    sha256 = "sha256-YaSbXMY/MT8GznQtjG9MoC6fi6WV3QHV9UwsjGWaAFQ=";
   };
 
-  cargoHash = "sha256-aFVLuJLy3Dxe66yAQbnpCy5Bqnzn5jVIlzTOrkJ4jC0=";
+  cargoHash = "sha256-DKcQ3O9Db0CRjHZVrceMPFSqkIwgFO7z5AmFd88rr1U=";
 
   meta = {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 971a6f5bbe9f..cb2f7bf294b7 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.31.3";
+  version = "1.31.4";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-sk/jqTVWLnE0qP7iSZFTegOkfz8s0TenUlctDmAEVW4=";
+    hash = "sha256-Lv2wNqS32482jFThJ5dIqlyv/m8QzEHDdlCYs6wd9nY=";
   };
 
-  npmDepsHash = "sha256-O7OypjSMxMEajJZOHOt1AJXChQQbGZ4u63g8agU95Qw=";
+  npmDepsHash = "sha256-D1/6H+7GXWeL3dWeXB4Ho5mzCCVzCQPVIPMJ+btF0k4=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''
diff --git a/pkgs/by-name/be/better-commits/package.nix b/pkgs/by-name/be/better-commits/package.nix
index 1a46afc4bf6d..87a4cea1de02 100644
--- a/pkgs/by-name/be/better-commits/package.nix
+++ b/pkgs/by-name/be/better-commits/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "better-commits";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "Everduin94";
     repo = "better-commits";
     tag = "v${version}";
-    hash = "sha256-dalCpupefZT1VDOo+U2MvqeWh1whi8w/697VOFJyuDw=";
+    hash = "sha256-eAxtec1T1kwIMhzKYpy4rkYScjXVaclu3bOUbANz6b8=";
   };
 
-  npmDepsHash = "sha256-g34UutgT5315BpsQSuGGLIU6Ga+hpEz74HNLKKOB+ec=";
+  npmDepsHash = "sha256-lPJ50DYnANJZ3IowE3kOCyAx9peq7Donh72jk1eQnBs=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/bi/biome/package.nix b/pkgs/by-name/bi/biome/package.nix
index b50f2725e0d4..06761ccf3665 100644
--- a/pkgs/by-name/bi/biome/package.nix
+++ b/pkgs/by-name/bi/biome/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-YmDHAsNGN5lsCgiciASdMUM6InbbjaGwyfyEX+XNOxs=";
+    hash = "sha256-xfaF9wg8nWXFWfJCp25sIi65RjZJaRlNSEAboYl3zKI=";
   };
 
-  cargoHash = "sha256-l3BQMG/cCxzQizeFGwAEDP8mzLtf/21ojyd+7gzhbtU=";
+  cargoHash = "sha256-8oN+eSR/+b0MRnN0/nYsAikhGahPH5imV5M2OKso9Bg=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/br/brotab/package.nix b/pkgs/by-name/br/brotab/package.nix
index 3e86cba1efc2..d7f5ae7a76c3 100644
--- a/pkgs/by-name/br/brotab/package.nix
+++ b/pkgs/by-name/br/brotab/package.nix
@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "balta2ar";
-    repo = pname;
+    repo = "brotab";
     rev = version;
     hash = "sha256-HKKjiW++FwjdorqquSCIdi1InE6KbMbFKZFYHBxzg8Q=";
   };
diff --git a/pkgs/by-name/bu/buck2/package.nix b/pkgs/by-name/bu/buck2/package.nix
index 49a25b6a6baa..5220019a57bb 100644
--- a/pkgs/by-name/bu/buck2/package.nix
+++ b/pkgs/by-name/bu/buck2/package.nix
@@ -81,8 +81,10 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
   nativeBuildInputs = [
     installShellFiles
-    autoPatchelfHook
     zstd
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    autoPatchelfHook
   ];
 
   buildInputs = [
diff --git a/pkgs/by-name/bu/buf/package.nix b/pkgs/by-name/bu/buf/package.nix
index d9079a7e0036..6fee36fe5b2e 100644
--- a/pkgs/by-name/bu/buf/package.nix
+++ b/pkgs/by-name/bu/buf/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.56.0";
+  version = "1.57.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a2yU8KgMRNEz5fgFx/e0U6Hrtw53neeO5PWsTU8AV14=";
+    hash = "sha256-D1/VMlvaaYNKyd8Uh5BZot/NABYzEvdjxtVFeKF4+6o=";
   };
 
-  vendorHash = "sha256-lWcqXMkOpa+bh40zH8LQ86mIbTAqB2mk8naN1oY7Xuc=";
+  vendorHash = "sha256-6DRuSHZnQZTDiVvPNKgAnEaG4Zb70EPdNr2N13BVJQ0=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/by-name/ca/cargo-expand/package.nix b/pkgs/by-name/ca/cargo-expand/package.nix
index a27367ee35f8..6ca4d6fccbe5 100644
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.115";
+  version = "1.0.116";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     rev = version;
-    hash = "sha256-seTprpfPzjlDgzjZIrTkhPlcB9kwA3XBXg5SBSwuUq8=";
+    hash = "sha256-tMM0XTSDby8cuNCQhb0+OwTbr0nSnOueQjrRu1qNgpk=";
   };
 
-  cargoHash = "sha256-8VQn1syFpbXdXK5xsL24VHnMqAVqUUGgRxvzXrKNs7U=";
+  cargoHash = "sha256-NOR6Lv4aqqk6c2ZtcPYPuWv5y0mghG+3zMlFTKe7bi8=";
 
   meta = {
     description = "Cargo subcommand to show result of macro expansion";
diff --git a/pkgs/by-name/ca/cargo-update/package.nix b/pkgs/by-name/ca/cargo-update/package.nix
index 60926ec7c778..624f19bfb122 100644
--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-update";
-  version = "17.0.0";
+  version = "18.0.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-CMsvkASFVqmvIxvixoXYwvyAgp4Vq9rj17o50M8Fw1Q=";
+    hash = "sha256-G2x5ZSNF/IqTThnM+iD7U5XHxS5zC5AfHt8wu2jQBLE=";
   };
 
-  cargoHash = "sha256-kp9liu8ZGL9Q+rH9XKWMgsA9hvkYEim90RdMp2+dVPg=";
+  cargoHash = "sha256-1hshZ6+JFVLSzgy/Hvch2Xu1o8OPGwShWuZ56YyXjZo=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/ca/catppuccin-fcitx5/package.nix b/pkgs/by-name/ca/catppuccin-fcitx5/package.nix
index bc719eb21095..93b0e4e660bd 100644
--- a/pkgs/by-name/ca/catppuccin-fcitx5/package.nix
+++ b/pkgs/by-name/ca/catppuccin-fcitx5/package.nix
@@ -24,7 +24,7 @@ stdenvNoCC.mkDerivation {
     runHook preInstall
   ''
   + lib.optionalString withRoundedCorners ''
-    find src -name theme.conf -exec sed -iE 's/^# (Image=(panel|highlight).svg)/\1/' {} +
+    find src -name theme.conf -exec sed -i -E 's/^# (Image=(panel|highlight).svg)/\1/' {} +
   ''
   + ''
     mkdir -p $out/share/fcitx5
diff --git a/pkgs/by-name/ca/catppuccin-sddm/package.nix b/pkgs/by-name/ca/catppuccin-sddm/package.nix
index 9af2b6d7ac3e..132dd25c84bf 100644
--- a/pkgs/by-name/ca/catppuccin-sddm/package.nix
+++ b/pkgs/by-name/ca/catppuccin-sddm/package.nix
@@ -64,7 +64,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     ${lib.optionalString (background != null) ''
       substituteInPlace $configFile \
-        --replace-fail 'Background="backgrounds/wall.jpg"' 'Background="${background}"' \
+        --replace-fail 'Background="backgrounds/wall.png"' 'Background="${background}"' \
         --replace-fail 'CustomBackground="false"' 'CustomBackground="true"'
     ''}
 
diff --git a/pkgs/by-name/ch/chglog/package.nix b/pkgs/by-name/ch/chglog/package.nix
index d087af98b801..f850b28d45ae 100644
--- a/pkgs/by-name/ch/chglog/package.nix
+++ b/pkgs/by-name/ch/chglog/package.nix
@@ -30,7 +30,7 @@ buildGoModule rec {
     changelog = "https://github.com/goreleaser/chglog/releases/tag/v${version}";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     mainProgram = "chglog";
   };
 }
diff --git a/pkgs/by-name/ci/cinnamon-control-center/package.nix b/pkgs/by-name/ci/cinnamon-control-center/package.nix
index 64fc0d1f8f3b..96f1e1a38059 100644
--- a/pkgs/by-name/ci/cinnamon-control-center/package.nix
+++ b/pkgs/by-name/ci/cinnamon-control-center/package.nix
@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-control-center";
-  version = "6.4.1";
+  version = "6.4.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon-control-center";
     rev = version;
-    hash = "sha256-1Z+kXvBmENNXIqdZgPDx7ZSwJMFAm2oMih6eFFAsA/A=";
+    hash = "sha256-nw70sbiz3+dp40WP957hOVo/mQOg2MJknZNN5Kw/Q/0=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ci/cinnamon-desktop/package.nix b/pkgs/by-name/ci/cinnamon-desktop/package.nix
index ece170d57a4c..df1c5ad8f513 100644
--- a/pkgs/by-name/ci/cinnamon-desktop/package.nix
+++ b/pkgs/by-name/ci/cinnamon-desktop/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-desktop";
-  version = "6.4.1";
+  version = "6.4.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon-desktop";
     rev = version;
-    hash = "sha256-YKGVuT28MLcLO9T8ZJqbHqMN0SAn1P1l8JTDBo4n838=";
+    hash = "sha256-kNxVdPtCQtz4TSyCc6uKHmAGWm2nlWnLwC3Cm0E42Jc=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ci/cinnamon-session/package.nix b/pkgs/by-name/ci/cinnamon-session/package.nix
index b9b27f88c3c4..a17ef8e7c3b4 100644
--- a/pkgs/by-name/ci/cinnamon-session/package.nix
+++ b/pkgs/by-name/ci/cinnamon-session/package.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon-session";
-  version = "6.4.0";
+  version = "6.4.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon-session";
     rev = version;
-    hash = "sha256-4uTKcmwfEytoAy4CFiOedYJqmPtBFBHk0P1gEGgm6pU=";
+    hash = "sha256-xmKreYrdN22bz5JRkpocf+dfK7BY1Ic4F+mTax0lM3Y=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/cl/clash-verge-rev/package.nix b/pkgs/by-name/cl/clash-verge-rev/package.nix
index d78c414b27d2..28d6cb31b733 100644
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@@ -12,25 +12,25 @@
 }:
 let
   pname = "clash-verge-rev";
-  version = "2.4.1";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-rev";
     tag = "v${version}";
-    hash = "sha256-mTtHgH+Qf9OaQz7I5IT8SUpXOZVObwEGdKRKq107rLU=";
+    hash = "sha256-HBWvk6bX0GjU/yvUejYgTQM8/IP5dYVrf30wNzgWv0s=";
   };
 
   src-service = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-service";
-    rev = "cccf77a22ac78fe2188fd3bf519d368a2549b941"; # no meaningful tags in this repo. The only way is updating manully every time.
-    hash = "sha256-ADtY3h69JiRw43H+V6mzyDr/XsnAVwXXRZGBSRNA4TY=";
+    rev = "396150683e01e79740563561ae2fe2db28fb8904"; # no meaningful tags in this repo. The only way is updating manully every time.
+    hash = "sha256-D6U22+tJ6vxn8/BTj/PV+4SF5fvGv6KAWtu5+PNJ1SQ=";
   };
 
-  service-cargo-hash = "sha256-a6jp3v/AdcWvBCzEfdtfbHUdqh3a1gNN9D8hRdU1RTc=";
-  pnpm-hash = "sha256-WrJ5iWuPoXe220ZPAbo4Z9Zlk2B9Cob0KOL6Q+xSVys=";
-  vendor-hash = "sha256-aOXBk3RZfelqdeKwP992rjBJ6Ps2GdEGBqzMBudCqKw=";
+  service-cargo-hash = "sha256-54nmhQjtPLMPoRML/3rG1jipT1VC5EDgRXnKDYuLVmM=";
+  pnpm-hash = "sha256-neRjVL29xxbQu/XxsQjdAka71oJww40LeDusjsgsY00=";
+  vendor-hash = "sha256-XszXDajAdYKEUoyrHZDxxp8ICReMnSdEeKVx7JHiaU4=";
 
   service = callPackage ./service.nix {
     inherit
diff --git a/pkgs/by-name/cl/clerk/package.nix b/pkgs/by-name/cl/clerk/package.nix
index 5230fa1ef975..fac71dda786c 100644
--- a/pkgs/by-name/cl/clerk/package.nix
+++ b/pkgs/by-name/cl/clerk/package.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation {
     mainProgram = "clerk";
     maintainers = with lib.maintainers; [
       anderspapitto
-      rewine
+      wineee
     ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/co/copybara/package.nix b/pkgs/by-name/co/copybara/package.nix
index 81478c4e2a4e..c24a641eac9e 100644
--- a/pkgs/by-name/co/copybara/package.nix
+++ b/pkgs/by-name/co/copybara/package.nix
@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20250825";
+  version = "20250901";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-CfmH4fktb05/jGFFhRdbYyPfA6A95+zidOvgvAJ79b0=";
+    hash = "sha256-yewUQIfQIMQMX92l2Cth76zfsMErpfhSa3/pZ8FZEYA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cp/cpeditor/package.nix b/pkgs/by-name/cp/cpeditor/package.nix
index b2bccbd997fb..d8465995cb24 100644
--- a/pkgs/by-name/cp/cpeditor/package.nix
+++ b/pkgs/by-name/cp/cpeditor/package.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://cpeditor.org";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.rewine ];
+    maintainers = [ lib.maintainers.wineee ];
     mainProgram = "cpeditor";
   };
 })
diff --git a/pkgs/by-name/cu/cursor-cli/package.nix b/pkgs/by-name/cu/cursor-cli/package.nix
index 2c8cec75cc57..4226a3b42bd5 100644
--- a/pkgs/by-name/cu/cursor-cli/package.nix
+++ b/pkgs/by-name/cu/cursor-cli/package.nix
@@ -9,26 +9,26 @@ let
   inherit (stdenv) hostPlatform;
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.08.27-24c29c1/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-046NAHLckWOvIG5WJ8p3SNiUTbelEw2eTZ+/1DvTpNY=";
+      url = "https://downloads.cursor.com/lab/2025.09.04-fc40cd1/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-Y1ynrrHfhbmMKkbZ1C3Xl+uZy3AWnmAXwTC+OkMcquc=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.08.27-24c29c1/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-Ft/7AivBm3VWsgtYAE0a9SqDLzuiFnGUTdEjsBZjUDA=";
+      url = "https://downloads.cursor.com/lab/2025.09.04-fc40cd1/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-EeeHCWFDCayFGpSKkeHxZe2JSHsQ+hJYAwepTm6i8Bo=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.08.27-24c29c1/darwin/x64/agent-cli-package.tar.gz";
-      hash = "sha256-lgn7gaiItLzvhh7ePtUcDCqPuZFUWE3WDSzn5TY3Taw=";
+      url = "https://downloads.cursor.com/lab/2025.09.04-fc40cd1/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-yzu0Ea5/X38RGyaFx0VR1O2aXzWs/XHopDyQzouFXP8=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.08.27-24c29c1/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-+zC4rTzTCj1MSCYA///6Br82SffTRdICHuhnhaXsAWg=";
+      url = "https://downloads.cursor.com/lab/2025.09.04-fc40cd1/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-C2av4foh8XcXi+CYzFEz6jeFIR7sTjZFi1fk2s0I46I=";
     };
   };
 in
 stdenv.mkDerivation {
   pname = "cursor-cli";
-  version = "0-unstable-2025-08-27";
+  version = "0-unstable-2025-09-04";
 
   src = sources.${hostPlatform.system};
 
diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index bd7f5feea375..5f6ca2df1b69 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "0.266.0";
+  version = "0.267.0";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9Hmqm9eIdUHNpTZoGyxP6viStA2Dzg74a+8sIvbQiv4=";
+    hash = "sha256-VQc7UYyrc5eVl/3ETswUj5vYsRnAGi6QqJwBe950biQ=";
   };
 
   # Otherwise these tests fail asserting that the version is 0.0.0-dev
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
       --replace-fail "cli/0.0.0-dev" "cli/${finalAttrs.version}"
   '';
 
-  vendorHash = "sha256-4z03eDHjlGI2oUX56ZJeB2rxnsF6WPze5P/I5qJDp+U=";
+  vendorHash = "sha256-B87LXkYLjPgabroRLj8LqGw2x8En9Wvytsac6s0RjiI=";
 
   excludedPackages = [
     "bundle/internal"
diff --git a/pkgs/by-name/di/distribution/package.nix b/pkgs/by-name/di/distribution/package.nix
index 95872ce78de1..438b99c542ed 100644
--- a/pkgs/by-name/di/distribution/package.nix
+++ b/pkgs/by-name/di/distribution/package.nix
@@ -20,11 +20,15 @@ buildGoModule (finalAttrs: {
 
   vendorHash = null;
 
-  checkFlags = [
-    # TestHTTPChecker: requires internet access.
-    # TestInMemoryDriverSuite: timeout after 10 minutes, looks like a deadlock.
-    "-skip=^TestHTTPChecker$|^TestInMemoryDriverSuite$"
-  ];
+  checkFlags =
+    let
+      skippedTests = [
+        "TestHTTPChecker" # requires internet access
+        "TestInMemoryDriverSuite" # timeout after 10 minutes, looks like a deadlock
+        "TestGracefulShutdown" # fails on trace export, see https://github.com/distribution/distribution/issues/4696
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
   __darwinAllowLocalNetworking = true;
 
   passthru = {
diff --git a/pkgs/by-name/di/dix/package.nix b/pkgs/by-name/di/dix/package.nix
index ab2625bde291..367176abc9db 100644
--- a/pkgs/by-name/di/dix/package.nix
+++ b/pkgs/by-name/di/dix/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "faukah";
     repo = "dix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Gq5Nr6xVGpAf1XnYrmoeyvqVgffAi8R6QETJU3xv22M=";
+    hash = "sha256-X+yFRLorfq9jvyMCvVCYUCh1pVN207XqTDr2FM1C+QE=";
   };
 
-  cargoHash = "sha256-IEsZNuLXKa+MInuortG4ifHTZ0Ngs0ugm02BK6shzHA=";
+  cargoHash = "sha256-Y9cTncgTfv+mr5izioLF3wb6ZRBWe0eKAZ2iqcsf/Tk=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/dm/dmenu-wayland/package.nix b/pkgs/by-name/dm/dmenu-wayland/package.nix
index 0c5fbb9a360a..7a2ae1fadf0b 100644
--- a/pkgs/by-name/dm/dmenu-wayland/package.nix
+++ b/pkgs/by-name/dm/dmenu-wayland/package.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation {
     platforms = lib.platforms.linux;
     description = "Efficient dynamic menu for wayland (wlroots)";
     homepage = "https://github.com/nyyManni/dmenu-wayland";
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     mainProgram = "dmenu-wl";
   };
 }
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index 5aed586fdfc5..20f9cae11f7d 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -3,7 +3,7 @@
   fetchFromGitHub,
   makeWrapper,
   nix-update-script,
-  nodePackages,
+  serve,
   stdenv,
   xsel,
   yarn-berry_4,
@@ -42,15 +42,11 @@ stdenv.mkDerivation (finalAttrs: {
     yarn-berry.yarnBerryConfigHook
   ];
 
-  postFixup =
-    let
-      serve = lib.getExe' nodePackages.serve "serve";
-    in
-    ''
-      makeWrapper ${serve} $out/bin/dokieli \
-        --prefix PATH : ${lib.makeBinPath [ xsel ]} \
-        --chdir $out
-    '';
+  postFixup = ''
+    makeWrapper ${lib.getExe serve} $out/bin/dokieli \
+      --prefix PATH : ${lib.makeBinPath [ xsel ]} \
+      --chdir $out
+  '';
 
   passthru.updateScript = nix-update-script {
     extraArgs = [ "--version=branch" ];
diff --git a/pkgs/by-name/du/duf/package.nix b/pkgs/by-name/du/duf/package.nix
index 20ee29563a94..22a898f7ae87 100644
--- a/pkgs/by-name/du/duf/package.nix
+++ b/pkgs/by-name/du/duf/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "duf";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "muesli";
     repo = "duf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bVuqX88KY+ky+fd1FU9GWP78jQc4fRDk9yRSeIesHyI=";
+    hash = "sha256-cIHFWFSsfS5UG2QKkFEEB34Q1l0pjuICxQlGfgWnLeY=";
   };
 
-  vendorHash = "sha256-oihi7E67VQmym9U1gdD802AYxWRrSowhzBiKg0CBDPc=";
+  vendorHash = "sha256-Br2jagMynnzH77GNA7NeWbM5qSHbhfW5Bo7X2b6OX28=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/e-/e-imzo-manager/package.nix b/pkgs/by-name/e-/e-imzo-manager/package.nix
index 8b1497ae8d24..12468eda42dc 100644
--- a/pkgs/by-name/e-/e-imzo-manager/package.nix
+++ b/pkgs/by-name/e-/e-imzo-manager/package.nix
@@ -22,18 +22,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "e-imzo-manager";
-  version = "0.1.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "xinux-org";
     repo = "e-imzo";
     tag = finalAttrs.version;
-    hash = "sha256-uDaqkz2VDvqTgi+k8EGGKjLkjoH93xXHQcgUc1NVo30=";
+    hash = "sha256-JXALTSgxIULDHdw90RjxlNQiLT+GKrzpkqPlMY0h+8c=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-rulWG4L/uN6+JBk+SzC0y57Pdw5N0Q1dJlpXGVo+vbQ=";
+    hash = "sha256-x9V0FHrSpM1pIWjDjcTuhPz4p0blXxKDJVvT0I0Op9M=";
   };
 
   strictDeps = true;
@@ -75,10 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/xinux-org/e-imzo";
     mainProgram = "E-IMZO-Manager";
     description = "GTK application for managing E-IMZO keys";
-    license = with lib.licenses; [
-      asl20
-      mit
-    ];
+    license = with lib.licenses; [ agpl3Plus ];
     platforms = lib.platforms.linux;
     teams = [ lib.teams.uzinfocom ];
   };
diff --git a/pkgs/by-name/ed/ed-odyssey-materials-helper/deps.json b/pkgs/by-name/ed/ed-odyssey-materials-helper/deps.json
index 95c248cc7a85..512ac87790e5 100644
--- a/pkgs/by-name/ed/ed-odyssey-materials-helper/deps.json
+++ b/pkgs/by-name/ed/ed-odyssey-materials-helper/deps.json
@@ -37,16 +37,16 @@
    "jar": "sha256-a9QQVOJuuuiLDaWNxj7BEKcO+tXxLYcESTRwx8VJcZA=",
    "pom": "sha256-uFQ5wq04pYG40n+nWy+zC3HN4dT8A8ZE4yMvhN8kWqE="
   },
-  "io/freefair/gradle#lombok-plugin/8.14": {
-   "jar": "sha256-NiigQcRX+SJZnyy+9Gq7OitAUmqBQ5FurJFe756wnCY=",
-   "module": "sha256-a+nB6Xh7bS68ZrkwgSw5s1zAshuxOhMbgmqt2j9r+cI=",
-   "pom": "sha256-/LTz+DpyuyF6VjWEfAWzWzjgHufzS6gV28PFiuGV5Zo="
+  "io/freefair/gradle#lombok-plugin/8.14.2": {
+   "jar": "sha256-RIQV1/8vImNj813kxhix6Tr78NdFBRUUu0cbIvm1jy4=",
+   "module": "sha256-QIzhHR3PUEV4oli/obkCfo0zRgScjdqxQ6wtebqKAJE=",
+   "pom": "sha256-l7zUYFZjH9+YzMEwgxFkf71USZWWLXAoZLGmJn9/0XQ="
   },
   "io/freefair/jsass-java#io.freefair.jsass-java.gradle.plugin/6.5.0.2": {
    "pom": "sha256-hoEYwHzaHj3q/o0bF3HzOgyN0lEIEAu/pjFl3hzTvmg="
   },
-  "io/freefair/lombok#io.freefair.lombok.gradle.plugin/8.14": {
-   "pom": "sha256-x7YYhUGNcUl2rj2dKku2ETagfKgg3N/9MjXMUT+NtJg="
+  "io/freefair/lombok#io.freefair.lombok.gradle.plugin/8.14.2": {
+   "pom": "sha256-OKIER1//te7+8mJmN+ZtdKjo5reqEZ3SRXpwcZ3oVvU="
   },
   "jakarta/platform#jakarta.jakartaee-bom/9.1.0": {
    "pom": "sha256-35jgJmIZ/buCVigm15o6IHdqi6Aqp4fw8HZaU4ZUyKQ="
@@ -153,18 +153,21 @@
    "pom": "sha256-D3mEND0EU+Y5uoyNTXwNGFLfA8ye4UkoQgi/5KPnH44="
   },
   "org/bouncycastle#bcprov-lts8on/2.73.7": {
-   "jar": "sha256-LIzWo/7zyhSubiig3gDBbWJ2d9KML/AqAFE/rrK3/7E=",
    "pom": "sha256-4MwaYuJQsJ+WbzbXnGUU82JXnb+cNy8t3qlXrd7C+qw="
   },
-  "org/bouncycastle#bcutil-lts8on/2.73.7": {
-   "jar": "sha256-03ALDCPuKZzSRYYhZyIGpfNIlR84t+iOk7IaHxu+Zxg=",
-   "pom": "sha256-J4GHqnKeqbOMnpcHM5JeJNCsqT+j3yQ1iZ4SZKUDVrU="
+  "org/bouncycastle#bcprov-lts8on/2.73.8": {
+   "jar": "sha256-SSBJuSj4uqtTWvAYW7q4c00U4cdkiuKiA31YSGyvtnY=",
+   "pom": "sha256-6PCmhF6WFe84gsLRU+ODBMGPpssc4+dC6O2Z+5dnOYs="
+  },
+  "org/bouncycastle#bcutil-lts8on/2.73.8": {
+   "jar": "sha256-6e94GRbugMR9GTYV2oXHvf7baNDeStqHEpPlDVgBWvc=",
+   "pom": "sha256-LDElCcPBJdLgHviCmBxFFuq+dgozRleHz7cVi+UbTLQ="
   },
   "org/bouncycastle/bcutil-lts8on/maven-metadata": {
    "xml": {
     "groupId": "org.bouncycastle",
-    "lastUpdated": "20241107225957",
-    "release": "2.73.7"
+    "lastUpdated": "20250827055500",
+    "release": "2.73.8"
    }
   },
   "org/eclipse/ee4j#project/1.0.7": {
@@ -488,16 +491,16 @@
    "module": "sha256-iNmRuo7VjChtey18CPn2Mg/5novWYXPDaDkhAEb8f2I=",
    "pom": "sha256-oYHFieNi4sRp6IRc/PIKFaiQ9ISUoPny4T9ZSglq0Kk="
   },
-  "io/freefair/gradle#lombok-plugin/8.14": {
-   "jar": "sha256-NiigQcRX+SJZnyy+9Gq7OitAUmqBQ5FurJFe756wnCY=",
-   "module": "sha256-a+nB6Xh7bS68ZrkwgSw5s1zAshuxOhMbgmqt2j9r+cI=",
-   "pom": "sha256-/LTz+DpyuyF6VjWEfAWzWzjgHufzS6gV28PFiuGV5Zo="
+  "io/freefair/gradle#lombok-plugin/8.14.2": {
+   "jar": "sha256-RIQV1/8vImNj813kxhix6Tr78NdFBRUUu0cbIvm1jy4=",
+   "module": "sha256-QIzhHR3PUEV4oli/obkCfo0zRgScjdqxQ6wtebqKAJE=",
+   "pom": "sha256-l7zUYFZjH9+YzMEwgxFkf71USZWWLXAoZLGmJn9/0XQ="
   },
   "io/freefair/jsass-java#io.freefair.jsass-java.gradle.plugin/6.5.0.2": {
    "pom": "sha256-1C1ePfUKHTe6qhRrpb0ai7I5YZksPt9Fw6M5zqCTLd8="
   },
-  "io/freefair/lombok#io.freefair.lombok.gradle.plugin/8.14": {
-   "pom": "sha256-m4nw9rMWc+4eiHy6RoAkO/fHKv7Gs4tg0Osy6vfp7uM="
+  "io/freefair/lombok#io.freefair.lombok.gradle.plugin/8.14.2": {
+   "pom": "sha256-KVgYYy7l/xiWwKYPuI2ghuPXyFHGxIUcQU/VSETWfYI="
   },
   "io/github/classgraph#classgraph/4.8.181": {
    "jar": "sha256-YqZDbWlxDvX6tuwkN4HOTFspkEftGEG1+SdGroUs5UU=",
diff --git a/pkgs/by-name/ed/ed-odyssey-materials-helper/package.nix b/pkgs/by-name/ed/ed-odyssey-materials-helper/package.nix
index 7df53e5d63c4..f86b15fdea5e 100644
--- a/pkgs/by-name/ed/ed-odyssey-materials-helper/package.nix
+++ b/pkgs/by-name/ed/ed-odyssey-materials-helper/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "ed-odyssey-materials-helper";
-  version = "2.243";
+  version = "2.247";
 
   src = fetchFromGitHub {
     owner = "jixxed";
     repo = "ed-odyssey-materials-helper";
     tag = version;
-    hash = "sha256-aeoU34U8DMdtSiNqnAPuzmRoDhgf9CIJRwB4A3Qw/EU=";
+    hash = "sha256-rngE5GUAzbpaIPgl0DpCboLLTXFk2zYSM53YPOVWRyg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ed/eddy/package.nix b/pkgs/by-name/ed/eddy/package.nix
index 99d62182a20f..12ce7e3cd560 100644
--- a/pkgs/by-name/ed/eddy/package.nix
+++ b/pkgs/by-name/ed/eddy/package.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "obdasystems";
-    repo = pname;
+    repo = "eddy";
     tag = "v${version}";
     sha256 = "sha256-K8yd7A4D1LAgwuaJvxdF0oqACuMxX/CZ6yKbR7D+uEQ=";
   };
diff --git a/pkgs/by-name/en/ente-web/package.nix b/pkgs/by-name/en/ente-web/package.nix
index 13280d36642d..65b71e8b74a8 100644
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-web";
-  version = "1.2.0";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "ente-io";
@@ -20,13 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
     sparseCheckout = [ "web" ];
     tag = "photos-v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-SZSzPEA+/fEYbhjoulT4xnaTCqljsRJyqDVmY2QxGBM=";
+    hash = "sha256-KCRwQmYmf2DXe3WQS8Rc8h397F0xEth4x36Yz4Ke4Y0=";
   };
   sourceRoot = "${finalAttrs.src.name}/web";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-FnLMXOpIVNOhaM7VjNEDlwpew9T/5Ch5eFed9tLpDsI=";
+    hash = "sha256-vm1pQrS4yWvSeTo++964kM+OK0JED8et/dHqLG6lJH0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index a787c2829e08..ba1087404b22 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.207.5";
+  version = "0.207.6";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-THgW9+y634THKS1Co3e4kIkeS6Lmg7mTg9YYeuLyrZI=";
+    hash = "sha256-BbX3SXvf6JtWdC5S6jDqBVawMEPtwHBA2IfR5G5ybqA=";
   };
 
-  vendorHash = "sha256-1+5SNgYblHRDpL+O1GGtvPR7pJ6lsEM/At7RMbzB5sA=";
+  vendorHash = "sha256-ieaDJZmYPxG79Pz/9NRTEhtAQZOqAwwDMa0FAs+PWEA=";
 
   commonMeta = with lib; {
     license = licenses.mit;
diff --git a/pkgs/by-name/fe/feh/package.nix b/pkgs/by-name/fe/feh/package.nix
index e7395f815523..aaf23528de7f 100644
--- a/pkgs/by-name/fe/feh/package.nix
+++ b/pkgs/by-name/fe/feh/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "feh";
-  version = "3.11";
+  version = "3.11.1";
 
   src = fetchFromGitHub {
     owner = "derf";
     repo = "feh";
     rev = finalAttrs.version;
-    hash = "sha256-3QKKXgwrDXVn8ahIG+NfP60GezFrZiHWOFoM2T0OoqU=";
+    hash = "sha256-gzMlPyuQft39U1hNs9PojohESqsjVxcPGuUbNRFMQBU=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fi/filebeat8/package.nix b/pkgs/by-name/fi/filebeat8/package.nix
index e39c1a6da7db..89d3b95ec2ec 100644
--- a/pkgs/by-name/fi/filebeat8/package.nix
+++ b/pkgs/by-name/fi/filebeat8/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "filebeat";
-  version = "8.19.2";
+  version = "8.19.3";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${version}";
-    hash = "sha256-3SW4SHUbEhdsKh3zd9VlVC8ZAxaR52Mfm1K/btjtB/4=";
+    hash = "sha256-bw/qWsNT4tG+hUjeb+DXaTxDY6HEL/A9iANFLdbyi5E=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-y8oAeH6RBD45+NEhl9EF4tPL1Ox4qHlLi+jSetjgKRE=";
+  vendorHash = "sha256-t+rCXm2eIG2a5xW1E8SjRAb/w9OuFKC/PyCGpJP8Szc=";
 
   subPackages = [ "filebeat" ];
 
diff --git a/pkgs/by-name/fi/filius/package.nix b/pkgs/by-name/fi/filius/package.nix
index 0affead69df3..b3fe6f99b635 100644
--- a/pkgs/by-name/fi/filius/package.nix
+++ b/pkgs/by-name/fi/filius/package.nix
@@ -14,7 +14,7 @@ maven.buildMavenPackage rec {
 
   src = fetchFromGitLab {
     owner = "filius1";
-    repo = pname;
+    repo = "filius";
     # they seem to have stopped using the "v" prefix since 2.9.3
     tag = version;
     hash = "sha256-nQyDPLDQe5kFH3PhCmLqAt8kVnitPwX5K3xLnyntF5k=";
diff --git a/pkgs/by-name/fi/finamp/package.nix b/pkgs/by-name/fi/finamp/package.nix
index 56a43997013e..059501278184 100644
--- a/pkgs/by-name/fi/finamp/package.nix
+++ b/pkgs/by-name/fi/finamp/package.nix
@@ -9,7 +9,7 @@
   makeDesktopItem,
 }:
 let
-  version = "0.9.18-beta";
+  version = "0.9.19-beta";
 in
 flutter332.buildFlutterApplication {
   inherit version;
@@ -18,7 +18,7 @@ flutter332.buildFlutterApplication {
     owner = "jmshrv";
     repo = "finamp";
     rev = version;
-    hash = "sha256-ea3+L6M2iaT1Rfy7tH1+3VpnjV+T8S86ZWc9l7pwW/4=";
+    hash = "sha256-gvVKiaQ6qqMcE90B8T2FJKoViRxmIGsABmcXq+fO5hs=";
   };
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
@@ -35,10 +35,11 @@ flutter332.buildFlutterApplication {
     media_kit_libs_windows_audio = "sha256-p3hRq79whLFJLNUgL9atXyTGvOIqCbTRKVk1ie0Euqs=";
     palette_generator = "sha256-mnRJf3asu1mm9HYU8U0di+qRk3SpNFwN3S5QxChpIA0=";
     split_view = "sha256-unTJQDXUUPVDudlk0ReOPNYrsyEpbd/UMg1tHZsmg+k=";
+    flutter_user_certificates_android = "sha256-HL1Qd0D3CLYJysWLX2jqWt1FJRGm/BE8EjVFPztOIPo=";
   };
 
   postFixup = ''
-    patchelf $out/app/$pname/finamp --add-needed libisar.so --add-needed libmpv.so --add-rpath ${
+    patchelf $out/app/$pname/finamp --add-needed libisar.so --add-needed libmpv.so --add-needed libflutter_discord_rpc.so --add-rpath ${
       lib.makeLibraryPath [ mpv-unwrapped ]
     }
   '';
diff --git a/pkgs/by-name/fi/finamp/pubspec.lock.json b/pkgs/by-name/fi/finamp/pubspec.lock.json
index 251c6a266800..e5bf7270afc9 100644
--- a/pkgs/by-name/fi/finamp/pubspec.lock.json
+++ b/pkgs/by-name/fi/finamp/pubspec.lock.json
@@ -30,6 +30,46 @@
       "source": "hosted",
       "version": "0.13.0"
     },
+    "app_links": {
+      "dependency": "direct main",
+      "description": {
+        "name": "app_links",
+        "sha256": "85ed8fc1d25a76475914fff28cc994653bd900bc2c26e4b57a49e097febb54ba",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.4.0"
+    },
+    "app_links_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "app_links_linux",
+        "sha256": "f5f7173a78609f3dfd4c2ff2c95bd559ab43c80a87dc6a095921d96c05688c81",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.3"
+    },
+    "app_links_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "app_links_platform_interface",
+        "sha256": "05f5379577c513b534a29ddea68176a4d4802c46180ee8e2e966257158772a3f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.2"
+    },
+    "app_links_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "app_links_web",
+        "sha256": "af060ed76183f9e2b87510a9480e56a5352b6c249778d07bd2c95fc35632a555",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.4"
+    },
     "app_set_id": {
       "dependency": "direct main",
       "description": {
@@ -134,11 +174,11 @@
       "dependency": "direct main",
       "description": {
         "name": "background_downloader",
-        "sha256": "c3814aa0466368a4c1c32d24bc73ded752edacf06731ead43857a3ac992ed52d",
+        "sha256": "c59bff0b66a6704bed8bfb09c67571df88167906e0f5543a722373b3d180a743",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.9.5"
+      "version": "9.2.3"
     },
     "balanced_text": {
       "dependency": "direct main",
@@ -155,11 +195,11 @@
       "dependency": "direct main",
       "description": {
         "name": "battery_plus",
-        "sha256": "a0409fe7d21905987eb1348ad57c634f913166f14f0c8936b73d3f5940fac551",
+        "sha256": "fb794c34cee2e4ea31005fb17ff15e1d904951ec7f15eedead741021870ee834",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.2.1"
+      "version": "6.2.2"
     },
     "battery_plus_platform_interface": {
       "dependency": "transitive",
@@ -185,11 +225,11 @@
       "dependency": "direct main",
       "description": {
         "name": "build",
-        "sha256": "cef23f1eda9b57566c81e2133d196f8e3df48f244b317368d65c5943d91148f0",
+        "sha256": "51dc711996cbf609b90cbe5b335bbce83143875a9d58e4b5c6d3c4f684d3dda7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.5.4"
     },
     "build_cli_annotations": {
       "dependency": "transitive",
@@ -225,31 +265,31 @@
       "dependency": "transitive",
       "description": {
         "name": "build_resolvers",
-        "sha256": "b9e4fda21d846e192628e7a4f6deda6888c36b5b69ba02ff291a01fd529140f0",
+        "sha256": "ee4257b3f20c0c90e72ed2b57ad637f694ccba48839a821e87db762548c22a62",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.4"
+      "version": "2.5.4"
     },
     "build_runner": {
       "dependency": "direct dev",
       "description": {
         "name": "build_runner",
-        "sha256": "058fe9dce1de7d69c4b84fada934df3e0153dd000758c4d65964d0166779aa99",
+        "sha256": "382a4d649addbfb7ba71a3631df0ec6a45d5ab9b098638144faf27f02778eb53",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.15"
+      "version": "2.5.4"
     },
     "build_runner_core": {
       "dependency": "transitive",
       "description": {
         "name": "build_runner_core",
-        "sha256": "22e3aa1c80e0ada3722fe5b63fd43d9c8990759d0a2cf489c8c5d7b2bdebc021",
+        "sha256": "85fbbb1036d576d966332a3f5ce83f2ce66a40bea1a94ad2d5fc29a19a0d3792",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.0.0"
+      "version": "9.1.2"
     },
     "built_collection": {
       "dependency": "transitive",
@@ -265,11 +305,11 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "ea90e81dc4a25a043d9bee692d20ed6d1c4a1662a28c03a96417446c093ed6b4",
+        "sha256": "0b1b12a0a549605e5f04476031cd0bc91ead1d7c8e830773a18ee54179b3cb62",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.9.5"
+      "version": "8.11.0"
     },
     "characters": {
       "dependency": "transitive",
@@ -285,31 +325,31 @@
       "dependency": "transitive",
       "description": {
         "name": "checked_yaml",
-        "sha256": "feb6bed21949061731a7a75fc5d2aa727cf160b91af9a3e464c5e3a32e28b5ff",
+        "sha256": "959525d3162f249993882720d52b7e0c833978df229be20702b33d48d91de70f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.3"
+      "version": "2.0.4"
     },
     "chopper": {
       "dependency": "direct main",
       "description": {
         "name": "chopper",
-        "sha256": "18928a74069cf1c257e657809c1b84b0304d8e32a6fc446dd2bbb28657e0358a",
+        "sha256": "f366529b450d0fd91931b08339c7c1d09c746d0d20e5ffb8c8641a79b6114dc2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.1.0"
+      "version": "8.2.0"
     },
     "chopper_generator": {
       "dependency": "direct dev",
       "description": {
         "name": "chopper_generator",
-        "sha256": "2cb23febc9ac9bbc9288b4703e60f3edc8e301a2ef5057d0c22369eab7313c6d",
+        "sha256": "4477b8b79aa0b6e2dd3d581e526782e6997f35c7fa3999b80d36003b1213acf2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.1.0"
+      "version": "8.2.0"
     },
     "ci": {
       "dependency": "transitive",
@@ -445,21 +485,21 @@
       "dependency": "direct dev",
       "description": {
         "name": "custom_lint",
-        "sha256": "409c485fd14f544af1da965d5a0d160ee57cd58b63eeaa7280a4f28cf5bda7f1",
+        "sha256": "9656925637516c5cf0f5da018b33df94025af2088fe09c8ae2ca54c53f2d9a84",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.5"
+      "version": "0.7.6"
     },
     "custom_lint_builder": {
       "dependency": "transitive",
       "description": {
         "name": "custom_lint_builder",
-        "sha256": "107e0a43606138015777590ee8ce32f26ba7415c25b722ff0908a6f5d7a4c228",
+        "sha256": "6cdc8e87e51baaaba9c43e283ed8d28e59a0c4732279df62f66f7b5984655414",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.5"
+      "version": "0.7.6"
     },
     "custom_lint_core": {
       "dependency": "transitive",
@@ -515,21 +555,21 @@
       "dependency": "direct main",
       "description": {
         "name": "device_info_plus",
-        "sha256": "0c6396126421b590089447154c5f98a5de423b70cfb15b1578fd018843ee6f53",
+        "sha256": "98f28b42168cc509abc92f88518882fd58061ea372d7999aecc424345c7bff6a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.4.0"
+      "version": "11.5.0"
     },
     "device_info_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "device_info_plus_platform_interface",
-        "sha256": "0b04e02b30791224b31969eb1b50d723498f402971bff3630bca2ba839bd1ed2",
+        "sha256": "e1ea89119e34903dca74b883d0dd78eb762814f97fb6c76f35e9ff74d261a18f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.0.2"
+      "version": "7.0.3"
     },
     "equatable": {
       "dependency": "transitive",
@@ -585,11 +625,11 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "77f8e81d22d2a07d0dee2c62e1dda71dc1da73bf43bb2d45af09727406167964",
+        "sha256": "ef9908739bdd9c476353d6adff72e88fd00c625f5b959ae23f7567bd5137db0a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.1.9"
+      "version": "10.2.0"
     },
     "file_sizes": {
       "dependency": "direct main",
@@ -637,35 +677,45 @@
       "source": "hosted",
       "version": "3.4.1"
     },
+    "flutter_discord_rpc": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_discord_rpc",
+        "sha256": "9363a803863d56fd89c0a21639c70b126245fcbafaeb0a3d091e7ac06951d03f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
     "flutter_gen_core": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_gen_core",
-        "sha256": "3eaa2d3d8be58267ac4cd5e215ac965dd23cae0410dc073de2e82e227be32bfc",
+        "sha256": "eda54fdc5de08e7eeea663eb8442aafc8660b5a13fda4e0c9e572c64e50195fb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.10.0"
+      "version": "5.11.0"
     },
     "flutter_gen_runner": {
       "dependency": "direct dev",
       "description": {
         "name": "flutter_gen_runner",
-        "sha256": "e74b4ead01df3e8f02e73a26ca856759dbbe8cb3fd60941ba9f4005cd0cd19c9",
+        "sha256": "669bf8b7a9b4acbdcb7fcc5e12bf638aca19acedf43341714cbca3bf3a219521",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.10.0"
+      "version": "5.11.0"
     },
     "flutter_launcher_icons": {
       "dependency": "direct dev",
       "description": {
         "name": "flutter_launcher_icons",
-        "sha256": "bfa04787c85d80ecb3f8777bde5fc10c3de809240c48fa061a2c2bf15ea5211c",
+        "sha256": "10f13781741a2e3972126fae08393d3c4e01fa4cd7473326b94b72cf594195e7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.14.3"
+      "version": "0.14.4"
     },
     "flutter_lints": {
       "dependency": "direct dev",
@@ -737,11 +787,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_svg",
-        "sha256": "d44bf546b13025ec7353091516f6881f1d4c633993cb109c3916c3a0159dadf1",
+        "sha256": "cd57f7969b4679317c17af6fd16ee233c1e60a82ed209d8a475c54fd6fd6f845",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.2.0"
     },
     "flutter_tabler_icons": {
       "dependency": "direct main",
@@ -769,6 +819,17 @@
       "source": "hosted",
       "version": "2.0.5"
     },
+    "flutter_user_certificates_android": {
+      "dependency": "direct main",
+      "description": {
+        "path": ".",
+        "ref": "db81e4ff3222a7db1308ed03c4bc3142c0d271d5",
+        "resolved-ref": "db81e4ff3222a7db1308ed03c4bc3142c0d271d5",
+        "url": "https://github.com/jfly/flutter_user_certificates_android.git"
+      },
+      "source": "git",
+      "version": "0.0.1"
+    },
     "flutter_web_plugins": {
       "dependency": "transitive",
       "description": "flutter",
@@ -789,11 +850,11 @@
       "dependency": "transitive",
       "description": {
         "name": "freezed_annotation",
-        "sha256": "c87ff004c8aa6af2d531668b46a4ea379f7191dc6dfa066acd53d506da6e044b",
+        "sha256": "7294967ff0a6d98638e7acb774aac3af2550777accd8149c90af5b014e6d44d8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.0"
+      "version": "3.1.0"
     },
     "frontend_server_client": {
       "dependency": "transitive",
@@ -845,6 +906,16 @@
       "source": "hosted",
       "version": "2.3.2"
     },
+    "gtk": {
+      "dependency": "transitive",
+      "description": {
+        "name": "gtk",
+        "sha256": "e8ce9ca4b1df106e4d72dad201d345ea1a036cc12c360f1a7d5a758f78ffa42c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.0"
+    },
     "hashcodes": {
       "dependency": "transitive",
       "description": {
@@ -859,11 +930,11 @@
       "dependency": "direct main",
       "description": {
         "name": "hive_ce",
-        "sha256": "192b7334299e3672efa1f85d544fef0091c5c592be5caada61417e37723addc6",
+        "sha256": "708bb39050998707c5d422752159f91944d3c81ab42d80e1bd0ee37d8e130658",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.11.2"
+      "version": "2.11.3"
     },
     "hive_ce_flutter": {
       "dependency": "direct main",
@@ -879,11 +950,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "hive_ce_generator",
-        "sha256": "84940c2fd3cb1d1eb318892cdb666bc0b8023f365f28aefe09b9e5a7222bc740",
+        "sha256": "609678c10ebee7503505a0007050af40a0a4f498b1fb7def3220df341e573a89",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.9.1"
+      "version": "1.9.2"
     },
     "hotreloader": {
       "dependency": "transitive",
@@ -896,7 +967,7 @@
       "version": "4.3.0"
     },
     "http": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "http",
         "sha256": "2c11f3f94c687ee9bad77c171151672986360b2b001d109814ee7140b2cf261b",
@@ -1000,8 +1071,8 @@
       "dependency": "direct dev",
       "description": {
         "path": "packages/isar_generator",
-        "ref": "ad574f60ed6f39d2995cd16fc7dc3de9a646ef30",
-        "resolved-ref": "ad574f60ed6f39d2995cd16fc7dc3de9a646ef30",
+        "ref": "f070a067378c215b9212a2a22ea593293671c9c9",
+        "resolved-ref": "f070a067378c215b9212a2a22ea593293671c9c9",
         "url": "https://github.com/callumw-k/isar.git"
       },
       "source": "git",
@@ -1011,11 +1082,11 @@
       "dependency": "transitive",
       "description": {
         "name": "isolate_channel",
-        "sha256": "bafedfbcc1e9796ada179b5dac7043b33eb85d35204b089ca37d480d9c0068df",
+        "sha256": "f3d36f783b301e6b312c3450eeb2656b0e7d1db81331af2a151d9083a3f6b18d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.2"
+      "version": "0.2.2+1"
     },
     "js": {
       "dependency": "transitive",
@@ -1393,11 +1464,11 @@
       "dependency": "direct main",
       "description": {
         "name": "permission_handler",
-        "sha256": "2d070d8684b68efb580a5997eb62f675e8a885ef0be6e754fb9ef489c177470f",
+        "sha256": "bc917da36261b00137bbc8896bf1482169cd76f866282368948f032c8c1caae1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "12.0.0+1"
+      "version": "12.0.1"
     },
     "permission_handler_android": {
       "dependency": "transitive",
@@ -1493,11 +1564,11 @@
       "dependency": "transitive",
       "description": {
         "name": "posix",
-        "sha256": "f0d7856b6ca1887cfa6d1d394056a296ae33489db914e365e2044fdada449e62",
+        "sha256": "6323a5b0fa688b6a010df4905a56b00181479e6d10534cecfecede2aa55add61",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.2"
+      "version": "6.0.3"
     },
     "progress_border": {
       "dependency": "direct main",
@@ -1543,11 +1614,11 @@
       "dependency": "transitive",
       "description": {
         "name": "qs_dart",
-        "sha256": "041c8ae470775b149ca3f7678adf9fb0752d1ab2c44c76aeb681f57379d30f62",
+        "sha256": "42a7ca80f965786d8d0730633b7cf05c132ebcb9558e04dbc8752f2865caa705",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.5+1"
+      "version": "1.3.9"
     },
     "recursive_regex": {
       "dependency": "transitive",
@@ -1709,6 +1780,76 @@
       "source": "hosted",
       "version": "5.0.2"
     },
+    "shared_preferences": {
+      "dependency": "direct main",
+      "description": {
+        "name": "shared_preferences",
+        "sha256": "6e8bf70b7fef813df4e9a36f658ac46d107db4b4cfe1048b477d4e453a8159f5",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.5.3"
+    },
+    "shared_preferences_android": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_android",
+        "sha256": "20cbd561f743a342c76c151d6ddb93a9ce6005751e7aa458baad3858bfbfb6ac",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.10"
+    },
+    "shared_preferences_foundation": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_foundation",
+        "sha256": "6a52cfcdaeac77cad8c97b539ff688ccfc458c007b4db12be584fbe5c0e49e03",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.5.4"
+    },
+    "shared_preferences_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_linux",
+        "sha256": "580abfd40f415611503cae30adf626e6656dfb2f0cee8f465ece7b6defb40f2f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.1"
+    },
+    "shared_preferences_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_platform_interface",
+        "sha256": "57cbf196c486bc2cf1f02b85784932c6094376284b3ad5779d1b1c6c6a816b80",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.1"
+    },
+    "shared_preferences_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_web",
+        "sha256": "c49bd060261c9a3f0ff445892695d6212ff603ef3115edbb448509d407600019",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.3"
+    },
+    "shared_preferences_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_windows",
+        "sha256": "94ef0f72b2d71bc3e700e025db3710911bd51a71cefb65cc609dd0d9a982e3c1",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.1"
+    },
     "shelf": {
       "dependency": "transitive",
       "description": {
@@ -1779,11 +1920,11 @@
       "dependency": "transitive",
       "description": {
         "name": "source_helper",
-        "sha256": "86d247119aedce8e63f4751bd9626fc9613255935558447569ad42f9f5b48b3c",
+        "sha256": "4f81479fe5194a622cdd1713fe1ecb683a6e6c85cd8cec8e2e35ee5ab3fdf2a1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.5"
+      "version": "1.3.6"
     },
     "source_span": {
       "dependency": "transitive",
@@ -1920,11 +2061,11 @@
       "dependency": "transitive",
       "description": {
         "name": "synchronized",
-        "sha256": "0669c70faae6270521ee4f05bffd2919892d42d1276e6c495be80174b6bc0ef6",
+        "sha256": "c254ade258ec8282947a0acbbc90b9575b4f19673533ee46f2f6e9b3aeefd7c0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.3.1"
+      "version": "3.4.0"
     },
     "term_glyph": {
       "dependency": "transitive",
@@ -2020,11 +2161,11 @@
       "dependency": "direct main",
       "description": {
         "name": "url_launcher",
-        "sha256": "9d06212b1362abc2f0f0d78e6f09f726608c74e3b9462e8368bb03314aa8d603",
+        "sha256": "f6a7e5c4835bb4e3026a04793a4199ca2d14c739ec378fdfe23fc8075d0439f8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.1"
+      "version": "6.3.2"
     },
     "url_launcher_android": {
       "dependency": "transitive",
@@ -2120,11 +2261,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics",
-        "sha256": "44cc7104ff32563122a929e4620cf3efd584194eec6d1d913eb5ba593dbcf6de",
+        "sha256": "a4f059dc26fc8295b5921376600a194c4ec7d55e72f2fe4c7d2831e103d461e6",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.18"
+      "version": "1.1.19"
     },
     "vector_graphics_codec": {
       "dependency": "transitive",
@@ -2140,11 +2281,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "1b4b9e706a10294258727674a340ae0d6e64a7231980f9f9a3d12e4b42407aad",
+        "sha256": "557a315b7d2a6dbb0aaaff84d857967ce6bdc96a63dc6ee2a57ce5a6ee5d3331",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.16"
+      "version": "1.1.17"
     },
     "vector_math": {
       "dependency": "transitive",
@@ -2200,11 +2341,11 @@
       "dependency": "transitive",
       "description": {
         "name": "watcher",
-        "sha256": "69da27e49efa56a15f8afe8f4438c4ec02eff0a117df1b22ea4aad194fe1c104",
+        "sha256": "0b7fd4a0bbc4b92641dbf20adfd7e3fd1398fe17102d94b674234563e110088a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.1"
+      "version": "1.1.2"
     },
     "weak_map": {
       "dependency": "transitive",
@@ -2250,11 +2391,11 @@
       "dependency": "transitive",
       "description": {
         "name": "win32",
-        "sha256": "329edf97fdd893e0f1e3b9e88d6a0e627128cc17cc316a8d67fda8f1451178ba",
+        "sha256": "66814138c3562338d05613a6e368ed8cfb237ad6d64a9e9334be3f309acfca03",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.13.0"
+      "version": "5.14.0"
     },
     "win32_registry": {
       "dependency": "transitive",
@@ -2328,7 +2469,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.7.0 <4.0.0",
+    "dart": ">=3.8.0 <4.0.0",
     "flutter": ">=3.32.0"
   }
 }
diff --git a/pkgs/by-name/fo/forecast/package.nix b/pkgs/by-name/fo/forecast/package.nix
index b4d291b51838..1c0721c1de3c 100644
--- a/pkgs/by-name/fo/forecast/package.nix
+++ b/pkgs/by-name/fo/forecast/package.nix
@@ -16,13 +16,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "forecast";
-  version = "0-unstable-2025-08-22";
+  version = "0-unstable-2025-09-04";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "forecast";
-    rev = "62e330435a2f5c678db8d0015330151d1e06039e";
-    hash = "sha256-b63O0e0AFHzS2TPP2WcsobMD+zPj3majjntCoB2pt5A=";
+    rev = "9671eb42c35da6ceb8196db41a58b7d0929876cd";
+    hash = "sha256-lwNjdblE/pRxhwAtRQiaXvx/UV6VbDiQeg/HZOZ2BYw=";
   };
 
   cargoHash = "sha256-mZ6nVQo83/o1fAVcHJGPqulBaQtE/8MJk3eLBAUoMmc=";
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index 499c58eaf8e5..e0d645412580 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -41,17 +41,17 @@ let
 in
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "10.0.1";
+  version = "11.0.0";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-p9inpt3v5KnKWdkkr2viL3KxN2fawesjaziyl2QsYko=";
+    hash = "sha256-R4YQHU1ZYLO45hLJPgXb6HUiQ8nuC6oyN1blPJ1hUs8=";
   };
 
-  vendorHash = "sha256-/LoNiNgUCFDW/nlqiDXvr2m0UwFNtyOewGmd1F35YEg=";
+  vendorHash = "sha256-IWlovmpnnQlP4J/eRkiOgmGyZR6uvBwfRzwW3Ui9dWE=";
 
   # See upstream Makefile
   # https://code.forgejo.org/forgejo/runner/src/branch/main/Makefile
@@ -63,7 +63,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X code.forgejo.org/forgejo/runner/v9/internal/pkg/ver.version=${src.rev}"
+    "-X code.forgejo.org/forgejo/runner/v11/internal/pkg/ver.version=${src.rev}"
   ];
 
   checkFlags = [
@@ -94,7 +94,7 @@ buildGoModule rec {
     description = "Runner for Forgejo based on act";
     homepage = "https://code.forgejo.org/forgejo/runner";
     changelog = "https://code.forgejo.org/forgejo/runner/releases/tag/${src.rev}";
-    license = licenses.mit;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [
       adamcstephens
       emilylange
diff --git a/pkgs/by-name/gi/git-codereview/package.nix b/pkgs/by-name/gi/git-codereview/package.nix
index 0505d2e2540c..d434f6fda708 100644
--- a/pkgs/by-name/gi/git-codereview/package.nix
+++ b/pkgs/by-name/gi/git-codereview/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "git-codereview";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "review";
     rev = "v${version}";
-    hash = "sha256-xokVMjCtpIugdO9JIoKPMg0neajsULn3okMXW82nCQg=";
+    hash = "sha256-mcyijASjm4DeXsh5ZPLoYuRypCeIbp2FcSIDA0M+l2g=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gi/git-town/package.nix b/pkgs/by-name/gi/git-town/package.nix
index 58c8b9dafaf1..00842e055148 100644
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule rec {
   pname = "git-town";
-  version = "21.4.3";
+  version = "21.5.0";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     tag = "v${version}";
-    hash = "sha256-E3j1lWQycB6aIj8xXaRUJdtrrvc92kxJjXhSHq3TBy0=";
+    hash = "sha256-H0WfUBrXPkqS2UnZpL6TyguzOa34KMetCwMKIvNKJ28=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gi/gitkraken/package.nix b/pkgs/by-name/gi/gitkraken/package.nix
index 13218a9b5587..423ca30f2986 100644
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,24 +56,24 @@
 
 let
   pname = "gitkraken";
-  version = "11.3.0";
+  version = "11.4.0";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-OUPsDr7+aQfYO8Xdu7gHlx4gvOUH5ee9xPxEsD9s3ng=";
+      hash = "sha256-mJ7BAR1cBZS4kE94kQQJc0FBR5lqId/fWTPxu62bUeA=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-J1RCFhIhi1z0WJ/a6z/KbSBJrhAiHFdBzy8EfZu6I6Y=";
+      hash = "sha256-qMe2vIjKcAI8T53W+lL71G1HS6oy6RaCQmHVLUgCzdI=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-hE0OOmDWlUBYBKMKLKDBO7FGoxwpLAb2lRkwCjFEAGE=";
+      hash = "sha256-HlEsSDq1DZWi6ehO66OHd57rA0jrYXWRA1V7H+DsveM=";
     };
   };
 
diff --git a/pkgs/by-name/go/go-away/package.nix b/pkgs/by-name/go/go-away/package.nix
index f749695c73ed..b9ca2a2dcec6 100644
--- a/pkgs/by-name/go/go-away/package.nix
+++ b/pkgs/by-name/go/go-away/package.nix
@@ -52,6 +52,11 @@ buildGoModule (finalAttrs: {
     "cmd/go-away"
   ];
 
+  postInstall = ''
+    mkdir -p $out/lib/go-away
+    cp -rv examples/snippets $out/lib/go-away/
+  '';
+
   meta = {
     changelog = "https://git.gammaspectra.live/git/go-away/releases/tag/${finalAttrs.src.tag}";
     description = "Self-hosted abuse detection and rule enforcement against low-effort mass AI scraping and bots";
diff --git a/pkgs/by-name/go/go-dnscollector/package.nix b/pkgs/by-name/go/go-dnscollector/package.nix
index 819fadc41bb8..89f6405ce6ac 100644
--- a/pkgs/by-name/go/go-dnscollector/package.nix
+++ b/pkgs/by-name/go/go-dnscollector/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-dnscollector";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "go-dnscollector";
     rev = "v${version}";
-    sha256 = "sha256-ebl/edMN45oLV1pN6mCaOSgxSSyAugsBP2sQWbIiPTI=";
+    sha256 = "sha256-99mVCuoog9ZkJoCCcUWkRJ2vA0IwftEcsSl6I02Qd4A=";
   };
 
-  vendorHash = "sha256-Y0LOtyRJWOFAQwfg8roisSer0oCxPiaYICE1FY/SEF8=";
+  vendorHash = "sha256-se4vNVydYFYk07Shb3eRLnVmE82HG36cwFRYCdZiZPM=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/go/gobusybox/package.nix b/pkgs/by-name/go/gobusybox/package.nix
index 12794e148502..de6c636918ba 100644
--- a/pkgs/by-name/go/gobusybox/package.nix
+++ b/pkgs/by-name/go/gobusybox/package.nix
@@ -1,10 +1,13 @@
 {
   lib,
-  buildGoModule,
+  # Build fails with Go 1.25, with the following error:
+  # 'vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go:64:9: invalid array length -delta * delta (constant -256 of type int64)'
+  # Wait for upstream to update their vendored dependencies before unpinning.
+  buildGo124Module,
   fetchFromGitHub,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo124Module (finalAttrs: {
   pname = "gobusybox";
   version = "0.2.0-unstable-2024-03-05";
 
diff --git a/pkgs/by-name/go/golds/package.nix b/pkgs/by-name/go/golds/package.nix
index 62af987d2f38..afb45254578d 100644
--- a/pkgs/by-name/go/golds/package.nix
+++ b/pkgs/by-name/go/golds/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "golds";
-  version = "0.7.8";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "go101";
     repo = "golds";
     tag = "v${version}";
-    hash = "sha256-sK7mnvIy8xgsb/K73bEsp1x667AXrDJXSXjFbOSoX9A=";
+    hash = "sha256-RM9ltqkOByOg1ZUF7ZXZcWTivlUKrNbZYgcFpwRwNUk=";
   };
 
   # nixpkgs is not using the go distpack archive and missing a VERSION file in the source
diff --git a/pkgs/by-name/go/google-cloud-sdk/package.nix b/pkgs/by-name/go/google-cloud-sdk/package.nix
index 4649fa57680c..d4fbf411c516 100644
--- a/pkgs/by-name/go/google-cloud-sdk/package.nix
+++ b/pkgs/by-name/go/google-cloud-sdk/package.nix
@@ -18,6 +18,9 @@
   callPackage,
   installShellFiles,
   with-gce ? false,
+  # NumPy is an optional runtime dependency and only needed for IAP TCP forwarding
+  # https://cloud.google.com/iap/docs/using-tcp-forwarding#increasing_the_tcp_upload_bandwidth
+  with-numpy ? true,
 }:
 
 let
@@ -47,10 +50,10 @@ let
       cryptography
       pyopenssl
       crcmod
-      numpy
       grpcio
     ]
     ++ lib.optional (with-gce) google-compute-engine
+    ++ lib.optional (with-numpy) numpy
   );
 
   data = import ./data.nix { };
diff --git a/pkgs/by-name/go/gotrue-supabase/package.nix b/pkgs/by-name/go/gotrue-supabase/package.nix
index 4c21985ec1a6..e15fa3596723 100644
--- a/pkgs/by-name/go/gotrue-supabase/package.nix
+++ b/pkgs/by-name/go/gotrue-supabase/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "auth";
-  version = "2.178.0";
+  version = "2.179.0";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "auth";
     rev = "v${version}";
-    hash = "sha256-slWPSlyiAxaxT0zXQrMCCfpVFeU3bWqflDu3n5WBGsk=";
+    hash = "sha256-wYQHdMLpeHFvh21z9cBadzR0CMETLvj81A3x4SRGw1c=";
   };
 
   vendorHash = "sha256-1SUih8uhHvxVf+gp5S4MJZctoxyUct3e/rRK/cZEfEI=";
diff --git a/pkgs/by-name/go/gotrue/package.nix b/pkgs/by-name/go/gotrue/package.nix
index 6bff0c026a2a..e660bc3e4330 100644
--- a/pkgs/by-name/go/gotrue/package.nix
+++ b/pkgs/by-name/go/gotrue/package.nix
@@ -10,7 +10,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "netlify";
-    repo = pname;
+    repo = "gotrue";
     rev = "v${version}";
     hash = "sha256-9h6CyCY7741tJR+qWDLwgPkAtE/kmaoTqlXEY+mOW58=";
   };
diff --git a/pkgs/by-name/gr/gramps/package.nix b/pkgs/by-name/gr/gramps/package.nix
index b25b5dfb24ae..000d5a6efc7c 100644
--- a/pkgs/by-name/gr/gramps/package.nix
+++ b/pkgs/by-name/gr/gramps/package.nix
@@ -23,7 +23,7 @@
 }:
 
 python3Packages.buildPythonApplication rec {
-  version = "6.0.4";
+  version = "6.0.5";
   pname = "gramps";
   pyproject = true;
 
@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication rec {
     owner = "gramps-project";
     repo = "gramps";
     tag = "v${version}";
-    hash = "sha256-MBsc4YMbCvzRG6+7/cGQpx7iYvQAdqWYrIMEpf1A7ew=";
+    hash = "sha256-mCc79h+XovUSaehybIa64zR5hutbNh705Uil58sQh7I=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gr/graphite-cli/package-lock.json b/pkgs/by-name/gr/graphite-cli/package-lock.json
index dbc4f5b68b93..aaf0d83d72e5 100644
--- a/pkgs/by-name/gr/graphite-cli/package-lock.json
+++ b/pkgs/by-name/gr/graphite-cli/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.6.7",
+  "version": "1.6.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.6.7",
+      "version": "1.6.8",
       "hasInstallScript": true,
       "license": "None",
       "dependencies": {
diff --git a/pkgs/by-name/gr/graphite-cli/package.nix b/pkgs/by-name/gr/graphite-cli/package.nix
index c0ba3df9a73d..634425053fdf 100644
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@@ -8,14 +8,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.6.7";
+  version = "1.6.8";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-OwfnCqxXp7qfDmMaWiuK1bBqPWIunV/26zNsp9zJrLc=";
+    hash = "sha256-HkxhPx38FjwrwPGhXSWw21mizjuWblcPxWFLYUU7Oys=";
   };
 
-  npmDepsHash = "sha256-DCtyA5hseXwvW9lRt60rENusEffOQ7RdLfW7okU7uos=";
+  npmDepsHash = "sha256-28jOlUaVo8HN5HF1EvcPAu9qYJOsby5gt9rCGbIOMRU=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/gs/gspeech/package.nix b/pkgs/by-name/gs/gspeech/package.nix
index c49fe985ee95..f587fdadc4b5 100644
--- a/pkgs/by-name/gs/gspeech/package.nix
+++ b/pkgs/by-name/gs/gspeech/package.nix
@@ -21,14 +21,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gSpeech";
-  version = "0.11.0";
+  version = "0.13.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "mothsart";
     repo = "gSpeech";
     rev = version;
-    sha256 = "0z11yxvgi8m2xjmmf56zla91jpmf0a4imwi9qqz6bp51pw4sk8gp";
+    sha256 = "sha256-IR7acxstJXueIrtBqVBqznEG3Avke7m1qfv7058u59g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index 2f4b722984d9..88553c5fe451 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2025-08-22";
+  version = "2.3.0-rolling-2025-09-05";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "6476496bd544c3c7f601d7ab2b07e378e8310e11";
-    hash = "sha256-ZSBYg1HCuYifTyDmHyNIjEWab5N1TT+q/4m62mFFDJ0=";
+    rev = "3b9b6a53cac8bcc6a25fb28df81ad295fc5f9402";
+    hash = "sha256-GJdZxGHQ6FWznY/PO3YN0yyfQ7RX8ilgEzXA4XciOqk=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ho/holo-cli/package.nix b/pkgs/by-name/ho/holo-cli/package.nix
index d97d3b98a872..9135732513de 100644
--- a/pkgs/by-name/ho/holo-cli/package.nix
+++ b/pkgs/by-name/ho/holo-cli/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "holo-cli";
-  version = "0.5.0-unstable-2025-08-09";
+  version = "0.5.0-unstable-2025-08-29";
 
   src = fetchFromGitHub {
     owner = "holo-routing";
     repo = "holo-cli";
-    rev = "52844aab4831655b1b3efc44206af9a5571b285a";
-    hash = "sha256-5m0k60FXgSmDgLAAmBuzYjnA6V4GXvl8bIt2wAjCpcM=";
+    rev = "31bca792c76e2ecb4d864a96cb20cc770135be74";
+    hash = "sha256-XNVeuAAsSdU9CM/HL/3UkBSgxngPheKuwTMkzm+MQ4Q=";
   };
 
   cargoHash = "sha256-bsoxWjOMzRRtFGEaaqK0/adhGpDcejCIY0Pzw1HjQ5U=";
diff --git a/pkgs/by-name/hy/hypnotix/package.nix b/pkgs/by-name/hy/hypnotix/package.nix
index 6ef21cc7ae7b..8971f4de0683 100644
--- a/pkgs/by-name/hy/hypnotix/package.nix
+++ b/pkgs/by-name/hy/hypnotix/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hypnotix";
-  version = "5.2";
+  version = "5.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "hypnotix";
-    rev = version;
-    hash = "sha256-QOUCpmq89XrWJVHyqSFbFD3a4y9UNgeMVXSr2H8TBeY=";
+    tag = version;
+    hash = "sha256-KJqGdBqeNtXYO3XOQvRJs4ie8jK4Hyv+YS86PB0dnOM=";
   };
 
   patches = [
@@ -56,7 +56,6 @@ stdenv.mkDerivation rec {
   ];
 
   pythonPath = with python3.pkgs; [
-    cinemagoer
     pygobject3
     requests
     setproctitle
@@ -88,7 +87,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "IPTV streaming application";
     homepage = "https://github.com/linuxmint/hypnotix";
-    changelog = "https://github.com/linuxmint/hypnotix/blob/${src.rev}/debian/changelog";
+    changelog = "https://github.com/linuxmint/hypnotix/blob/${src.tag}/debian/changelog";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       dotlambda
diff --git a/pkgs/by-name/i3/i3status-rust/package.nix b/pkgs/by-name/i3/i3status-rust/package.nix
index 9e0040faad70..98882431ff82 100644
--- a/pkgs/by-name/i3/i3status-rust/package.nix
+++ b/pkgs/by-name/i3/i3status-rust/package.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "greshake";
-    repo = pname;
+    repo = "i3status-rust";
     rev = "refs/tags/v${version}";
     hash = "sha256-E0HGF7oyffBWUT61fQZ+tjwDi7q9IhtV6DiF8TGeVsU=";
   };
diff --git a/pkgs/by-name/je/jellyfin-tui/package.nix b/pkgs/by-name/je/jellyfin-tui/package.nix
index 5b7840e4b4a6..97de94fc389f 100644
--- a/pkgs/by-name/je/jellyfin-tui/package.nix
+++ b/pkgs/by-name/je/jellyfin-tui/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jellyfin-tui";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchFromGitHub {
     owner = "dhonus";
     repo = "jellyfin-tui";
     tag = "v${version}";
-    hash = "sha256-fRlnfCHjUZWvp+pYxLUXFxW/nR7Glhhfm4YQKLR2XaY=";
+    hash = "sha256-BrIXKMRKsBcLKIe2cFU8IULn060hcAYITgFF9zEEnn4=";
   };
 
-  cargoHash = "sha256-VUg96qyTF7XkZsl4wl70u5S9NqgRCGJ4od8Cj4dSoI8=";
+  cargoHash = "sha256-49UuHH6Ql/ORkp3626O3JW89W5dxX2Y1Jn8euTTKpr8=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
diff --git a/pkgs/by-name/jo/jonquil/package.nix b/pkgs/by-name/jo/jonquil/package.nix
index 6a117cb74fba..8d1e04586c65 100644
--- a/pkgs/by-name/jo/jonquil/package.nix
+++ b/pkgs/by-name/jo/jonquil/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "toml-f";
-    repo = pname;
+    repo = "jonquil";
     rev = "v${version}";
     hash = "sha256-2JCTHA0nyA7xE0IA+LNrEAulHU2eIbNRvFGQ7YSQMRE=";
   };
diff --git a/pkgs/by-name/ka/kargo/package.nix b/pkgs/by-name/ka/kargo/package.nix
index d3383a796c9a..578606e5c1d6 100644
--- a/pkgs/by-name/ka/kargo/package.nix
+++ b/pkgs/by-name/ka/kargo/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "kargo";
-  version = "1.7.2";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "akuity";
     repo = "kargo";
     tag = "v${version}";
-    hash = "sha256-bknGLvoI4N3d96+taeY9MAgFoo0PT7niAJJrp4NdirA=";
+    hash = "sha256-mm4eTpTsnYqYK14N1BG8ObnHwgCY1HnJHHmLrX6WesA=";
   };
 
   vendorHash = "sha256-zo3aEs0xrWbjj5nCtZ1GEfAYXy2cnaUCUbN5bjYFZ+Y=";
diff --git a/pkgs/by-name/ko/komodo/package.nix b/pkgs/by-name/ko/komodo/package.nix
index f25d6b21c86f..60a258b3b56e 100644
--- a/pkgs/by-name/ko/komodo/package.nix
+++ b/pkgs/by-name/ko/komodo/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "komodo";
-  version = "1.19.1";
+  version = "1.19.3";
 
   src = fetchFromGitHub {
     owner = "moghtech";
     repo = "komodo";
     tag = "v${version}";
-    hash = "sha256-eDHkXHOw+6lVb0oMW0BIR/yAYMw4ROod7AKw65pj0Co=";
+    hash = "sha256-D6W9+JDvLpyALOAjFRcWtJcZMav0ypKmhhVhqlh4AgM=";
   };
 
-  cargoHash = "sha256-C5VMze6NS5Qgx4LWy8xojFv/HFwksGBkVkzRwec7M88=";
+  cargoHash = "sha256-uZYNdKhZ91JN6NR3gWVP82rhy6db1qI/h+qmiVwxYT8=";
 
   # disable for check. document generation is fail
   # > error: doctest failed, to rerun pass `-p komodo_client --doc`
diff --git a/pkgs/by-name/kr/krename/package.nix b/pkgs/by-name/kr/krename/package.nix
new file mode 100644
index 000000000000..50add1b75286
--- /dev/null
+++ b/pkgs/by-name/kr/krename/package.nix
@@ -0,0 +1,65 @@
+{
+  stdenv,
+  fetchFromGitLab,
+  lib,
+  extra-cmake-modules,
+  kdePackages,
+  taglib,
+  exiv2,
+  podofo_0_10,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "krename";
+  version = "5.0.60-unstable-2025-09-02";
+
+  # For when the next stable release is made
+  # src = fetchurl {
+  #   url = "mirror://kde/stable/krename/${version}/src/krename-${finalAttrs.version}.tar.xz";
+  #   hash = "sha256-sjxgp93Z9ttN1/VaxV/MqKVY+miq+PpcuJ4er2kvI+0=";
+  # };
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "utilities";
+    repo = "krename";
+
+    rev = "5ad5f5a1f0a1c7573fa1b872a1472dec96fe0dd7";
+    hash = "sha256-fGNiIGGq10F71wh37aKDB7Q3fCxSXqttg/176LH3nVM=";
+  };
+
+  buildInputs = with kdePackages; [
+    exiv2
+    podofo_0_10
+    kio
+    kxmlgui
+    qtbase
+    qtdeclarative
+    qt5compat
+    taglib
+  ];
+
+  nativeBuildInputs = [
+    extra-cmake-modules
+    kdePackages.kdoctools
+    kdePackages.wrapQtAppsHook
+  ];
+
+  env.NIX_LDFLAGS = "-ltag";
+
+  meta = {
+    description = "Powerful batch renamer for KDE";
+    mainProgram = "krename";
+    homepage = "https://kde.org/applications/utilities/krename/";
+    license = with lib.licenses; [
+      bsd3
+      cc0
+      gpl2Plus
+    ];
+    maintainers = with lib.maintainers; [
+      peterhoeg
+      kuflierl
+    ];
+    inherit (kdePackages.qtbase.meta) platforms;
+  };
+})
diff --git a/pkgs/by-name/ku/kubebuilder/package.nix b/pkgs/by-name/ku/kubebuilder/package.nix
index 828215f5fb0e..6a1180a22acc 100644
--- a/pkgs/by-name/ku/kubebuilder/package.nix
+++ b/pkgs/by-name/ku/kubebuilder/package.nix
@@ -13,16 +13,16 @@
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "4.7.1";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    hash = "sha256-nyjwLP1qy6X7BFtagXoqFawqRoDbKq6YSY7/XjsgC7M=";
+    hash = "sha256-HUJ/dgDVN2hgCkO/iw3CqEgl8P2TbWgQ/TNe8uO3Vvk=";
   };
 
-  vendorHash = "sha256-YtvIx0+kKEjC3hsHvXbZZhNqJD2gmjaS3tWtEWaU7SQ=";
+  vendorHash = "sha256-9hGIZgUyxMyOoxMn+KeN0+vmET2ISZtlejiaI5qUe40=";
 
   subPackages = [
     "cmd"
diff --git a/pkgs/by-name/ku/kubernetes-kcp/package.nix b/pkgs/by-name/ku/kubernetes-kcp/package.nix
index fd64e220a6f5..ee5a10dc922e 100644
--- a/pkgs/by-name/ku/kubernetes-kcp/package.nix
+++ b/pkgs/by-name/ku/kubernetes-kcp/package.nix
@@ -10,15 +10,15 @@
 
 buildGoModule rec {
   pname = "kubernetes-kcp";
-  version = "0.28.0";
+  version = "0.28.1";
 
   src = fetchFromGitHub {
     owner = "kcp-dev";
     repo = "kcp";
     tag = "v${version}";
-    hash = "sha256-1oxX6jouJ71XkflzZj1vWRJvuUtaz4bh61pNBlb/Ub0=";
+    hash = "sha256-GwfrFaGLrfUTxLoacGCHHzJ41+tA7flb4wvjWJntj+g=";
   };
-  vendorHash = "sha256-jsrJwBF8knq7z25bChR15zWIAZww9e9gQ3Ki+Xhi5Mo=";
+  vendorHash = "sha256-mJaWEZhuMiIy8NYlRJDc39nKfWxP4xlFuM9jiqmkJ0c=";
 
   subPackages = [ "cmd/kcp" ];
 
diff --git a/pkgs/by-name/ku/kubescape/package.nix b/pkgs/by-name/ku/kubescape/package.nix
index 98b27191be92..38bc797e7cba 100644
--- a/pkgs/by-name/ku/kubescape/package.nix
+++ b/pkgs/by-name/ku/kubescape/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "3.0.39";
+  version = "3.0.40";
 
   src = fetchFromGitHub {
     owner = "kubescape";
     repo = "kubescape";
     tag = "v${version}";
-    hash = "sha256-yKbOzwvg8VtSVLZTJC7AUzUVRDbj7c+sjCt+C3x8VSI=";
+    hash = "sha256-zrfXeKvgpRgu64kh0sNfashegSkmu7c/6/FtG0OHwOY=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-oFY31Cd0fXkmDpRwF8NI2VZVmWRDZ53uwsT2aUfGyjM=";
+  vendorHash = "sha256-2yW8e83t19uy7HzWrFwsoXdD1HXZxe48I5CGAgg2gDk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/kx/kxstitch/package.nix b/pkgs/by-name/kx/kxstitch/package.nix
index 6b5f5f272c8b..15d5f03339d4 100644
--- a/pkgs/by-name/kx/kxstitch/package.nix
+++ b/pkgs/by-name/kx/kxstitch/package.nix
@@ -3,35 +3,40 @@
   lib,
   fetchgit,
   cmake,
-  extra-cmake-modules,
   imagemagick,
-  libsForQt5,
+  kdePackages,
+  pkg-config,
 }:
 
 stdenv.mkDerivation {
   pname = "kxstitch";
-  version = "unstable-2023-12-31";
+  version = "unstable-2025-08-16";
 
   src = fetchgit {
     url = "https://invent.kde.org/graphics/kxstitch.git";
-    rev = "4bb575dcb89e3c997e67409c8833e675962e101a";
-    hash = "sha256-pi+RpuT8YQYp1ogGtIgXpTPdYSFk19TUHTHDVyOcrMI=";
+    rev = "bfe934ffc2c2dfa1cc554bc4483a3285b027b00c";
+    hash = "sha256-B81nwInFWcQVDJU6VINII8crVPtV5zYBXADVVe+wCu4=";
   };
 
-  buildInputs = with libsForQt5; [
+  buildInputs = with kdePackages; [
     qtbase
     kconfig
     kconfigwidgets
     kcompletion
     kio
+    ktextwidgets
+    kxmlgui
   ];
 
   nativeBuildInputs = [
     cmake
-    extra-cmake-modules
     imagemagick
-    libsForQt5.wrapQtAppsHook
-  ];
+    pkg-config
+  ]
+  ++ (with kdePackages; [
+    extra-cmake-modules
+    wrapQtAppsHook
+  ]);
 
   postInstall = ''
     install -D $src/org.kde.kxstitch.desktop $out/share/applications/org.kde.kxstitch.desktop
diff --git a/pkgs/by-name/le/ledger-live-desktop/package.nix b/pkgs/by-name/le/ledger-live-desktop/package.nix
index 5c6c001f1c5c..25eabe1104c6 100644
--- a/pkgs/by-name/le/ledger-live-desktop/package.nix
+++ b/pkgs/by-name/le/ledger-live-desktop/package.nix
@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.126.0";
+  version = "2.126.2";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-QAe8ft06Nna2rFyFTGK4mwfO1ueZKFcuacvKU4lln0k=";
+    hash = "sha256-cnY/XfJuzlT1HyyBJcmgsNF9ihkDBS/y35idTLj+DFE=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/by-name/li/libdnf/package.nix b/pkgs/by-name/li/libdnf/package.nix
index 300593dbc6f6..8a19697e882a 100644
--- a/pkgs/by-name/li/libdnf/package.nix
+++ b/pkgs/by-name/li/libdnf/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "rpm-software-management";
-    repo = pname;
+    repo = "libdnf";
     tag = version;
     hash = "sha256-NAnE8VPz2j7h/gB1A4FDwG/x7ki7QEmBjcfvOb6/+VY=";
   };
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index b4cacfafe898..0307263a1e47 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "9.6.5";
+  version = "9.6.6";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-d3teFW6eSKG+VIWbuOs5a9f0cxv2Fssepkcjfle7Ems=";
+    hash = "sha256-2NEwmC7+CbR297VsjTSguzYuhxHv8YtCgtB4oTrEaU8=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/lu/lucenepp/package.nix b/pkgs/by-name/lu/lucenepp/package.nix
index 84c2dd1585e3..158b6143d64b 100644
--- a/pkgs/by-name/lu/lucenepp/package.nix
+++ b/pkgs/by-name/lu/lucenepp/package.nix
@@ -76,6 +76,6 @@ stdenv.mkDerivation rec {
       lgpl3Plus
     ];
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
   };
 }
diff --git a/pkgs/by-name/m2/m2-planet/package.nix b/pkgs/by-name/m2/m2-planet/package.nix
index b99706aa786c..2fd86da7f1ba 100644
--- a/pkgs/by-name/m2/m2-planet/package.nix
+++ b/pkgs/by-name/m2/m2-planet/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "m2-planet";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "oriansj";
     repo = "M2-Planet";
     rev = "Release_${finalAttrs.version}";
-    hash = "sha256-xVwUO67PlRiBj/YBnnTXFGh3jH470fcbaNjABoyYes4=";
+    hash = "sha256-qig+E9rrg168yYTR5n1Y9Iqy1NX+8GOraMhsr7id4lk=";
   };
 
   # Don't use vendored M2libc
diff --git a/pkgs/by-name/ma/matrix-hookshot/package.json b/pkgs/by-name/ma/matrix-hookshot/package.json
index c954ca35e9bf..a112ab69d5d9 100644
--- a/pkgs/by-name/ma/matrix-hookshot/package.json
+++ b/pkgs/by-name/ma/matrix-hookshot/package.json
@@ -1,6 +1,6 @@
 {
   "name": "matrix-hookshot",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "description": "A bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA.",
   "main": "lib/app.js",
   "repository": "https://github.com/matrix-org/matrix-hookshot",
@@ -56,15 +56,15 @@
     "clsx": "^2.1.1",
     "cors": "^2.8.5",
     "date-fns": "^4.1.0",
-    "express": "^4.20.0",
+    "express": "^4.21.2",
     "figma-js": "^1.16.1-0",
     "helmet": "^7.1.0",
     "http-status-codes": "^2.2.0",
-    "ioredis": "^5.2.3",
+    "ioredis": "^5.6.1",
     "jira-client": "^8.2.2",
     "markdown-it": "^14.0.0",
-    "matrix-appservice-bridge": "^9.0.1",
-    "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@0.7.1-element.8",
+    "matrix-appservice-bridge": "^11.0.0",
+    "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@0.7.1-element.14",
     "matrix-widget-api": "^1.10.0",
     "micromatch": "^4.0.8",
     "mime": "^4.0.4",
@@ -99,7 +99,7 @@
     "@types/busboy": "^1.5.4",
     "@types/chai": "^4.2.22",
     "@types/cors": "^2.8.12",
-    "@types/express": "^4.17.14",
+    "@types/express": "^4.17.23",
     "@types/jira-client": "^7.1.0",
     "@types/markdown-it": "^13.0.7",
     "@types/micromatch": "^4.0.1",
diff --git a/pkgs/by-name/ma/matrix-hookshot/package.nix b/pkgs/by-name/ma/matrix-hookshot/package.nix
index fbeacff97178..dc103ef3542d 100644
--- a/pkgs/by-name/ma/matrix-hookshot/package.nix
+++ b/pkgs/by-name/ma/matrix-hookshot/package.nix
@@ -11,7 +11,7 @@
   rustc,
   napi-rs-cli,
   pkg-config,
-  nodejs_22,
+  nodejs_24,
   openssl,
 }:
 
@@ -30,7 +30,7 @@ mkYarnPackage rec {
   };
 
   packageJSON = ./package.json;
-  nodejs = nodejs_22;
+  nodejs = nodejs_24;
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
@@ -70,7 +70,7 @@ mkYarnPackage rec {
   '';
 
   postInstall = ''
-    makeWrapper '${nodejs_22}/bin/node' "$out/bin/matrix-hookshot" --add-flags \
+    makeWrapper '${nodejs_24}/bin/node' "$out/bin/matrix-hookshot" --add-flags \
         "$out/libexec/matrix-hookshot/deps/matrix-hookshot/lib/App/BridgeApp.js"
   '';
 
diff --git a/pkgs/by-name/ma/matrix-hookshot/pin.json b/pkgs/by-name/ma/matrix-hookshot/pin.json
index bebd0a297af8..4ecb566a4934 100644
--- a/pkgs/by-name/ma/matrix-hookshot/pin.json
+++ b/pkgs/by-name/ma/matrix-hookshot/pin.json
@@ -1,6 +1,6 @@
 {
-  "version": "7.0.0",
-  "srcHash": "sha256-MBET/oRvCToCnkUsbSK/6BzE2nrg33BzVuKAuu2BnkQ=",
-  "yarnHash": "1lmakjgpflx8zcvl4ycn529dgkyp8yic9xhpwajdyj6dc56blpbb",
+  "version": "7.1.0",
+  "srcHash": "sha256-jRLax1vqC0K3XvAWrH1J7nqtFioLr4n6Df9Kra/KKKU=",
+  "yarnHash": "0m0cqy7kkj8d9lhw93halr64017rqscf5msz4bm3g8lhkil9w53g",
   "cargoHash": "sha256-1eBiLZHGNJxXNCVavkKt0xckAD2cilOW2wNCtqJ8O4g="
 }
diff --git a/pkgs/by-name/ma/matrix-sdk-crypto-nodejs/package.nix b/pkgs/by-name/ma/matrix-sdk-crypto-nodejs/package.nix
index e40aa7e6d11d..f5b7644f5ce6 100644
--- a/pkgs/by-name/ma/matrix-sdk-crypto-nodejs/package.nix
+++ b/pkgs/by-name/ma/matrix-sdk-crypto-nodejs/package.nix
@@ -10,20 +10,20 @@
   libiconv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "matrix-sdk-crypto-nodejs";
-  version = "0.3.0-beta.1-unstable-2025-02-11";
+  version = "0.4.0-beta.1";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "matrix-rust-sdk-crypto-nodejs";
-    rev = "f74a37e9c8f5af005119464a3501346b8c22695f";
-    hash = "sha256-QHKFD9PPUXMb78GjSabk3vWnd5DIhTjtBZL8e/Tuw0g=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Rl0xtaEj2RnW9HPN94hjETwiMInxT1XGa1BocldQAPs=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-hKuFu8T7zCXlmiG7k3WJsLSDYhIu6vT5la+AZOmz8EM=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-4AC+l52I8Z3sXiViNPe6GLCl1Z+GpqjbwkcFX6BhxDA=";
   };
 
   nativeBuildInputs = [
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    local -r outPath="$out/lib/node_modules/@matrix-org/${pname}"
+    local -r outPath="$out/lib/node_modules/@matrix-org/${finalAttrs.pname}"
     mkdir -p "$outPath"
     cp package.json index.js index.d.ts matrix-sdk-crypto.*.node "$outPath"
 
@@ -67,4 +67,4 @@ stdenv.mkDerivation rec {
     # napi_build doesn't handle most cross-compilation configurations
     broken = (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) || stdenv.hostPlatform.isStatic;
   };
-}
+})
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index f8682bf37d2d..4730e74aef70 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.159.0",
+  "version": "3.161.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.159.0/mirrord_linux_x86_64",
-      "hash": "sha256-QwoilxsUmUDaYbIJLOhERbRgrrCN/M1sp4BvJsMWtOQ="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.161.0/mirrord_linux_x86_64",
+      "hash": "sha256-Oqk1ITUcFqs2hM3Ph/2MjWmAeyU3jzfoDzZUHRXOyHQ="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.159.0/mirrord_linux_aarch64",
-      "hash": "sha256-/4VACn2xOwDBjKca8gO2syuw6foDQNyqZCECiPNeT2M="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.161.0/mirrord_linux_aarch64",
+      "hash": "sha256-9BWLLkUGc65nMfaJ3GUXN3/9hI+RVA5lVcDTT+ZMCMw="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.159.0/mirrord_mac_universal",
-      "hash": "sha256-l/ZlUNzmp1/JBufNTbBD7yPUtHTCaU1gBOzX4GzHrq0="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.161.0/mirrord_mac_universal",
+      "hash": "sha256-ak2DrNudwZWxy8RoPxc9+lLuU4LqCPa86/7DQrndVdk="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.159.0/mirrord_mac_universal",
-      "hash": "sha256-l/ZlUNzmp1/JBufNTbBD7yPUtHTCaU1gBOzX4GzHrq0="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.161.0/mirrord_mac_universal",
+      "hash": "sha256-ak2DrNudwZWxy8RoPxc9+lLuU4LqCPa86/7DQrndVdk="
     }
   }
 }
diff --git a/pkgs/by-name/mk/mkuimage/package.nix b/pkgs/by-name/mk/mkuimage/package.nix
index 30ded02c53d4..ceba3f9c6c06 100644
--- a/pkgs/by-name/mk/mkuimage/package.nix
+++ b/pkgs/by-name/mk/mkuimage/package.nix
@@ -1,21 +1,24 @@
 {
   lib,
-  buildGoModule,
+  # Build fails with Go 1.25, with the following error:
+  # 'vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go:64:9: invalid array length -delta * delta (constant -256 of type int64)'
+  # Wait for upstream to update their vendored dependencies before unpinning.
+  buildGo124Module,
   fetchFromGitHub,
   coreutils,
   bash,
   stdenv,
 }:
 
-buildGoModule {
+buildGo124Module {
   pname = "mkuimage";
-  version = "0-unstable-2024-02-28";
+  version = "0-unstable-2025-09-05";
 
   src = fetchFromGitHub {
     owner = "u-root";
     repo = "mkuimage";
-    rev = "899a47eaaa318bd2327dc94d964ccda40a784037";
-    hash = "sha256-sb/LtwAN7RN8jWG/x6pomz2Q+vKekA/teC7U5NVb2qY=";
+    rev = "9a40452f5d3ba67f236a83de54fa2c40f797b68b";
+    hash = "sha256-asC4j2DXkQnx6BZntxA8hSaM2k6p0CxraHYq3bK9vNQ=";
   };
 
   vendorHash = "sha256-KX9uv5m4N4+7gOgjhotRac9sz8tWSJ1krq98RWdsbzg=";
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index a651cc68b74e..420159d0ee3f 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-08-27";
+  version = "0-unstable-2025-09-06";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "58cb8fe59ed6c1cbd64ae27a401286bd7cb39f23";
-    hash = "sha256-jGMZvpcpuW2ALGYkYF67HO7sV/XivWXPBqOedGazCAs=";
+    rev = "5ed40fe25f2ffd13c19936727a7763a982e0f924";
+    hash = "sha256-UsBsedOhLwW/8tfaxE7+d3dSY7YZB4M3YEGBhwNQHOM=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/mu/muffin/package.nix b/pkgs/by-name/mu/muffin/package.nix
index a6e5f521e004..0844df43a89b 100644
--- a/pkgs/by-name/mu/muffin/package.nix
+++ b/pkgs/by-name/mu/muffin/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   replaceVars,
   cairo,
   cinnamon-desktop,
@@ -62,6 +63,13 @@ stdenv.mkDerivation rec {
     (replaceVars ./fix-paths.patch {
       inherit zenity;
     })
+
+    # Fix Qt apps crashing on wayland
+    # https://github.com/linuxmint/muffin/pull/739
+    (fetchpatch {
+      url = "https://github.com/linuxmint/muffin/commit/760e2a3046e13610c4fda1291a9a28e589d2bd93.patch";
+      hash = "sha256-D0u8UxW5USzMW9KlP3Y4XCWxrQ1ySufDv+eCbrAP71c=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index 5a5e84d16d6c..ac228584fac4 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -9,14 +9,14 @@
 
 buildGoModule rec {
   pname = "museum";
-  version = "1.2.0";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     tag = "photos-v${version}";
-    hash = "sha256-/TxQKwQ604zsQ+31SZR/WWKBDiR3taGs2wi9oFOENVA=";
+    hash = "sha256-2kcIXnQPNB6V8ElTxoAETFCSyIIOGme15pYVXNLPlAg=";
   };
 
   vendorHash = "sha256-px4pMqeH73Fe06va4+n6hklIUDMbPmAQNKKRIhwv6ec=";
diff --git a/pkgs/by-name/ne/neocmakelsp/package.nix b/pkgs/by-name/ne/neocmakelsp/package.nix
index 45e489d89398..4be6e42aaee6 100644
--- a/pkgs/by-name/ne/neocmakelsp/package.nix
+++ b/pkgs/by-name/ne/neocmakelsp/package.nix
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
-      rewine
+      wineee
       multivac61
     ];
     mainProgram = "neocmakelsp";
diff --git a/pkgs/by-name/ni/nightfox-gtk-theme/package.nix b/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
index 2a07c05b2c39..c39921efc594 100644
--- a/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
+++ b/pkgs/by-name/ni/nightfox-gtk-theme/package.nix
@@ -70,13 +70,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants lib
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "0-unstable-2025-08-21";
+    version = "0-unstable-2025-09-02";
 
     src = fetchFromGitHub {
       owner = "Fausto-Korpsvart";
       repo = "Nightfox-GTK-Theme";
-      rev = "4d73329de5ac65dc3e957e1635d471c7d3122a6b";
-      hash = "sha256-QTsouPINcn8coLk5z2EFMG1egP97rFVPgiYqGhwu62c=";
+      rev = "9e5e876e2a4ca7f69f30cc453990b839232b0149";
+      hash = "sha256-gFrijAev9NuW6kjBNuDADPxwNebrJoUZ3eJCDAlwFrY=";
     };
 
     propagatedUserEnvPkgs = [ gtk-engine-murrine ];
diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index ddc0f4b1ddfa..45c78732f722 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.13.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     tag = "v${version}";
-    hash = "sha256-dGQDxjvB5OX4ot22zt2zFu3T3h/clSRlfxhCpkPRePU=";
+    hash = "sha256-NgA4gAXHOz6ErBT/txSOpEUPMmdl0YObdPVda2wv4l4=";
   };
 
   vendorHash = "sha256-d5KTDZKfuzv84oMgmsjJoXGO5XYLVKxOB5XehqgRvYw=";
diff --git a/pkgs/by-name/np/npm-check-updates/package.nix b/pkgs/by-name/np/npm-check-updates/package.nix
index c31cb5309808..6f1e0baa0e20 100644
--- a/pkgs/by-name/np/npm-check-updates/package.nix
+++ b/pkgs/by-name/np/npm-check-updates/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "npm-check-updates";
-  version = "18.0.3";
+  version = "18.1.0";
 
   src = fetchFromGitHub {
     owner = "raineorshine";
     repo = "npm-check-updates";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LqnewJGdiT06yK/I4NPGx+qRyoKnaRfVTa+iNV0kYxE=";
+    hash = "sha256-vFcghhJTJJMl+0GrnEsTj6NUDW4GSU3wOi0KsNreC5k=";
   };
 
-  npmDepsHash = "sha256-BV2DJN6L+zJHQtryjTW0On5upY2bkc3df4qUrnf1/Cg=";
+  npmDepsHash = "sha256-Y1yl2kF8CPArDgeEYj0aP8Zx61mQMRxDg3WEwRdvoHc=";
 
   postPatch = ''
     sed -i '/"prepare"/d' package.json
diff --git a/pkgs/by-name/nv/nvs/package.nix b/pkgs/by-name/nv/nvs/package.nix
index e73c3a5e2f76..6c180ea5b0e4 100644
--- a/pkgs/by-name/nv/nvs/package.nix
+++ b/pkgs/by-name/nv/nvs/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nvs";
-  version = "1.10.6";
+  version = "1.10.7";
 
   src = fetchFromGitHub {
     owner = "y3owk1n";
     repo = "nvs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hqIauWbAsWbD7P58BGnj6NlLtfuaR5YxOLgPOrpN++w=";
+    hash = "sha256-rmTSM4xoUn+Jk6nPPg2XQ094WFnUVzqdICjucNCwhZM=";
   };
 
   vendorHash = "sha256-l2FdnXA+vKVRekcIKt1R+MxppraTsmo0b/B7RNqnxjA=";
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 762c7cd43744..929e8ba2353f 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -117,13 +117,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.11.7";
+  version = "0.11.10";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rSKuLdfbmAyGTkhfdE9GuywuQweeA5WfNwP/wGMN4So=";
+    hash = "sha256-F5Us1w+QCnWK32noi8vfRwgMofHP9vGiRFfN2UAf1vw=";
   };
 
   vendorHash = "sha256-SlaDsu001TUW+t9WRp7LqxUSQSGDF1Lqu9M1bgILoX4=";
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 0ac600275fd2..cc7aa4d6606c 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.25";
+  version = "0.6.26";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-XB3cwxtcOVoAwGJroZuPT8XwaCo3wpkn2KIEuuXMeu4=";
+    hash = "sha256-ourzYHwVSlM4nqEbkKf6PsNfNkW8quXdcBSW0p16pIg=";
   };
 
   frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-WL1kdXn7uAaBEwWiIJzzisMZ1uiaOVtFViWK/kW6lsY=";
+    npmDepsHash = "sha256-xZtES8qZ7MTt/OviEqGmGO3D3BuOpMGHjnBuSsdFJgM=";
 
     # See https://github.com/open-webui/open-webui/issues/15880
     npmFlags = [
@@ -85,12 +85,6 @@ python3Packages.buildPythonApplication rec {
 
   pythonRelaxDeps = true;
 
-  pythonRemoveDeps = [
-    "docker"
-    "pytest"
-    "pytest-docker"
-  ];
-
   dependencies =
     with python3Packages;
     [
@@ -126,7 +120,6 @@ python3Packages.buildPythonApplication rec {
       firecrawl-py
       fpdf2
       ftfy
-      gcp-storage-emulator
       google-api-python-client
       google-auth-httplib2
       google-auth-oauthlib
@@ -139,11 +132,9 @@ python3Packages.buildPythonApplication rec {
       langchain
       langchain-community
       langdetect
-      langfuse
       ldap3
       loguru
       markdown
-      moto
       nltk
       onnxruntime
       openai
@@ -172,14 +163,12 @@ python3Packages.buildPythonApplication rec {
       playwright
       posthog
       psutil
-      psycopg2-binary
       pyarrow
       pycrdt
       pydub
       pyjwt
       pymdown-extensions
       pymilvus
-      pymongo
       pymysql
       pypandoc
       pypdf
@@ -209,7 +198,22 @@ python3Packages.buildPythonApplication rec {
       xlrd
       youtube-transcript-api
     ]
-    ++ moto.optional-dependencies.s3;
+    ++ pyjwt.optional-dependencies.crypto;
+
+  optional-dependencies = with python3Packages; rec {
+    postgres = [
+      pgvector
+      psycopg2-binary
+    ];
+
+    all = [
+      moto
+      gcp-storage-emulator
+      pymongo
+    ]
+    ++ moto.optional-dependencies.s3
+    ++ postgres;
+  };
 
   pythonImportsCheck = [ "open_webui" ];
 
@@ -247,6 +251,7 @@ python3Packages.buildPythonApplication rec {
     mainProgram = "open-webui";
     maintainers = with lib.maintainers; [
       shivaraj-bh
+      codgician
     ];
   };
 }
diff --git a/pkgs/by-name/op/openvscode-server/package.nix b/pkgs/by-name/op/openvscode-server/package.nix
index f27bcd4c2a64..ab5bb984538a 100644
--- a/pkgs/by-name/op/openvscode-server/package.nix
+++ b/pkgs/by-name/op/openvscode-server/package.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openvscode-server";
-  version = "1.102.3";
+  version = "1.103.1";
 
   src = fetchFromGitHub {
     owner = "gitpod-io";
     repo = "openvscode-server";
     rev = "openvscode-server-v${finalAttrs.version}";
-    hash = "sha256-WY2vmDt3sSgbyouGxBFfJ0hZZ5ZJWhBnTvegyq4zmFM=";
+    hash = "sha256-Co0MF8Yr60Ppv6Zv85nJeua2S5Rnye6wGB1hTWNpMm4=";
   };
 
   ## fetchNpmDeps doesn't correctly process git dependencies
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
         inherit (finalAttrs) src nativeBuildInputs;
         outputHashMode = "recursive";
         outputHashAlgo = "sha256";
-        outputHash = "sha256-ElxgztLu6MCdP0c+D/gUmztsQ2hNqJjmRWpJu3N2Z1g=";
+        outputHash = "sha256-xK4qfzkWuOsEyP1+6cY5Dhrr5wNW3eOJBTyQaE6gTcc=";
         env = {
           FORCE_EMPTY_CACHE = true;
           FORCE_GIT_DEPS = true;
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 822d7ec65ccd..d428e0d4aac0 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -28,13 +28,13 @@
   xorg,
 }:
 let
-  version = "2.18.3";
+  version = "2.18.4";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-rr1QfTNutKO+DwEQmltxdtjuk07mT0unlYo3SMq6oEs=";
+    hash = "sha256-sQ5laFO6DSg+4tF9jk2yuV0q2Vp7VC/+hu2XrVj8/bY=";
   };
 
   python = python3.override {
@@ -79,8 +79,8 @@ let
 
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
-      fetcherVersion = 1;
-      hash = "sha256-bx/jXlG3lRiwKyz1M0dU00Xn5xaeALSIxIAGzo8gAgo=";
+      fetcherVersion = 2;
+      hash = "sha256-fs9a2uI/TnWalQ/qRb6m4d1CsU7O6VYCJMz2xWLdC0I=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/pg/pgroll/package.nix b/pkgs/by-name/pg/pgroll/package.nix
index c8e61fc2963d..eaf7d9033f74 100644
--- a/pkgs/by-name/pg/pgroll/package.nix
+++ b/pkgs/by-name/pg/pgroll/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "pgroll";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "xataio";
     repo = "pgroll";
     tag = "v${version}";
-    hash = "sha256-5g9adfp0kJ/Qou7TnTb6Pu04u2LXPfUct8Xkkodf1S8=";
+    hash = "sha256-tSiGzWxnxiNzBSory5sd676+iVwsl/nkbDWaCls52MQ=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-pK1cR62cGt1OE8Rz2qTb6ZBDCnuqes9HJGY7QOREv6E=";
+  vendorHash = "sha256-rQPWL39AD/qCneuRyJHOQCANmDE7pqmwHx+AavJ/3cw=";
 
   excludedPackages = [ "dev" ];
 
diff --git a/pkgs/by-name/pi/pihole-ftl/disable-redirect-root.patch b/pkgs/by-name/pi/pihole-ftl/disable-redirect-root.patch
new file mode 100644
index 000000000000..e2e1b96b8bdc
--- /dev/null
+++ b/pkgs/by-name/pi/pihole-ftl/disable-redirect-root.patch
@@ -0,0 +1,45 @@
+From 14311f18ae9427a0baa1e0cb67198580d9d2dc69 Mon Sep 17 00:00:00 2001
+From: averyvigolo <avery@averyv.me>
+Date: Sun, 24 Aug 2025 18:35:37 +0100
+Subject: [PATCH] Only use redirect_root_handler if webhome is set (fixes
+ #2518)
+
+This fixes an infinite redirect on the home page when authentication is enabled.
+The redirects are caused by XHR calls to the API, which receive a 401 response, and
+the error handlers simply reload the page.
+
+If webhome is not set, the default request handler should be used to properly
+handle authentication. So, conditionally enable redirect_root_handler, if
+webhome is not empty or `/`. This fixes the problem, as there's an immediate
+redirect to /login, before any XHR calls.
+
+Remove the initial fix in https://github.com/pi-hole/FTL/pull/2521, as it is no
+longer necessary. That fix involved checking in redirect_root_handler, if the
+redirect destination is the same as the request URI.
+
+Signed-off-by: averyvigolo <avery@averyv.me>
+---
+ src/webserver/webserver.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/webserver/webserver.c b/src/webserver/webserver.c
+index e0999d230..c3e32a35c 100644
+--- a/src/webserver/webserver.c
++++ b/src/webserver/webserver.c
+@@ -720,7 +714,14 @@ void http_init(void)
+ 	// prefix should be stripped away by the reverse proxy
+ 	mg_set_request_handler(ctx, "/api", api_handler, NULL);
+ 
+-	mg_set_request_handler(ctx, "/$", redirect_root_handler, NULL);
++	if(strcmp(prefix_webhome, "/") == 0 || strlen(prefix_webhome) == 0)
++	{
++		log_debug(DEBUG_API, "Not redirecting root since webhome is '%s'",
++			  prefix_webhome);
++	} else {
++		// Redirect requests to / to the webhome path.
++		mg_set_request_handler(ctx, "/$", redirect_root_handler, NULL);
++	}
+ 
+ 	if(strcmp(config.webserver.paths.webhome.v.s, "/") == 0 &&
+ 	   config.dns.blocking.mode.v.blocking_mode == MODE_IP)
+
diff --git a/pkgs/by-name/pi/pihole-ftl/package.nix b/pkgs/by-name/pi/pihole-ftl/package.nix
index 855e3d01087e..6999dc989e1b 100644
--- a/pkgs/by-name/pi/pihole-ftl/package.nix
+++ b/pkgs/by-name/pi/pihole-ftl/package.nix
@@ -26,6 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-d1kpkBKuc30oIT1dRac8gkzh36Yyg80cizNRbyZ4424=";
   };
 
+  patches = [
+    # https://github.com/pi-hole/FTL/pull/2610: Fix authentication redirect when webhome is /
+    ./disable-redirect-root.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     xxd
diff --git a/pkgs/by-name/pi/pihole/0001-Remove-sudo.patch b/pkgs/by-name/pi/pihole/0001-Remove-sudo.patch
index f037d2953bea..f10afba82490 100644
--- a/pkgs/by-name/pi/pihole/0001-Remove-sudo.patch
+++ b/pkgs/by-name/pi/pihole/0001-Remove-sudo.patch
@@ -1,7 +1,7 @@
-From a2b3aa45d6e073272608506b1d27e4f43f2b0032 Mon Sep 17 00:00:00 2001
-From: williamvds <william@williamvds.me>
-Date: Sun, 6 Apr 2025 23:00:41 +0100
-Subject: [PATCH 1/3] Remove sudo
+From 833856bd77dc6ea77557ab0659c1459bee393653 Mon Sep 17 00:00:00 2001
+From: averyv <avery@averyv.me>
+Date: Sat, 6 Sep 2025 17:51:48 +0100
+Subject: [PATCH 1/2] Remove sudo
 
 Rely on polkit and sensible permissions
 ---
@@ -9,16 +9,16 @@ Rely on polkit and sensible permissions
  1 file changed, 8 deletions(-)
 
 diff --git a/pihole b/pihole
-index 1d5093c..6afc48a 100755
+index 7b5e3eb..b00617e 100755
 --- a/pihole
 +++ b/pihole
 @@ -570,14 +570,6 @@ if [[ -z ${USER} ]]; then
    USER=$(whoami)
  fi
  
--# Check if the current user is neither root nor pihole and if the command
+-# Check if the current user is not root and if the command
 -# requires root. If so, exit with an error message.
--if [[ $EUID -ne 0 && ${USER} != "pihole" && need_root -eq 1 ]];then
+-if [[ $EUID -ne 0 && need_root -eq 1 ]];then
 -  echo -e "  ${CROSS} The Pi-hole command requires root privileges, try:"
 -  echo -e "      ${COL_GREEN}sudo pihole $*${COL_NC}"
 -  exit 1
@@ -28,5 +28,5 @@ index 1d5093c..6afc48a 100755
  case "${1}" in
    "allow" | "allowlist"           ) listFunc "$@";;
 -- 
-2.48.1
+2.50.1
 
diff --git a/pkgs/by-name/pi/pihole/0002-Remove-unsupported-commands.patch b/pkgs/by-name/pi/pihole/0002-Remove-unsupported-commands.patch
index 541d9b487764..d153afd6a8d8 100644
--- a/pkgs/by-name/pi/pihole/0002-Remove-unsupported-commands.patch
+++ b/pkgs/by-name/pi/pihole/0002-Remove-unsupported-commands.patch
@@ -1,7 +1,7 @@
-From ab0650484cdd89afb5b60a0a046509ec5ae14375 Mon Sep 17 00:00:00 2001
-From: williamvds <william@williamvds.me>
-Date: Sun, 6 Apr 2025 23:01:30 +0100
-Subject: [PATCH 2/3] Remove unsupported commands
+From d72475d713a8eecd1476bc5bb4acfb0448d5abad Mon Sep 17 00:00:00 2001
+From: averyv <avery@averyv.me>
+Date: Sat, 6 Sep 2025 18:04:11 +0100
+Subject: [PATCH 2/2] Remove unsupported commands
 
 Remove some unsupported maintenance commands, particularly the ones which
 reinstall, update, and uninstall pihole. This is managed by NixOS, after all.
@@ -10,7 +10,7 @@ reinstall, update, and uninstall pihole. This is managed by NixOS, after all.
  1 file changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/pihole b/pihole
-index 6afc48a..cce7c97 100755
+index b00617e..a3c2e20 100755
 --- a/pihole
 +++ b/pihole
 @@ -92,6 +92,7 @@ debugFunc() {
@@ -63,5 +63,5 @@ index 6afc48a..cce7c97 100755
  
  helpFunc() {
 -- 
-2.48.1
+2.50.1
 
diff --git a/pkgs/by-name/pi/pihole/0003-Fix-redefinition-of-readonly-variable-utilsfile.patch b/pkgs/by-name/pi/pihole/0003-Fix-redefinition-of-readonly-variable-utilsfile.patch
deleted file mode 100644
index 62c67c026ded..000000000000
--- a/pkgs/by-name/pi/pihole/0003-Fix-redefinition-of-readonly-variable-utilsfile.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From cca2f6437e3ba09019b8fcb1986b4558d7c6db4e Mon Sep 17 00:00:00 2001
-From: williamvds <william@williamvds.me>
-Date: Sat, 31 May 2025 13:43:42 +0100
-Subject: [PATCH 3/3] Fix redefinition of readonly variable utilsfile
-
----
- advanced/Scripts/api.sh |  2 +-
- pihole                  | 10 +++-------
- 2 files changed, 4 insertions(+), 8 deletions(-)
-
-diff --git a/advanced/Scripts/api.sh b/advanced/Scripts/api.sh
-index 613a8d8..8720043 100755
---- a/advanced/Scripts/api.sh
-+++ b/advanced/Scripts/api.sh
-@@ -19,7 +19,7 @@
- 
- TestAPIAvailability() {
- 
--    local chaos_api_list authResponse authStatus authData apiAvailable DNSport
-+    local chaos_api_list authResponse authStatus authData apiAvailable DNSport utilsfile
- 
-     # as we are running locally, we can get the port value from FTL directly
-     readonly utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
-diff --git a/pihole b/pihole
-index cce7c97..d63d064 100755
---- a/pihole
-+++ b/pihole
-@@ -16,18 +16,14 @@ readonly PI_HOLE_SCRIPT_DIR="/opt/pihole"
- # error due to modifying a readonly variable.
- PI_HOLE_BIN_DIR="/usr/local/bin"
- 
--readonly colfile="${PI_HOLE_SCRIPT_DIR}/COL_TABLE"
- # shellcheck source=./advanced/Scripts/COL_TABLE
--source "${colfile}"
-+source "${PI_HOLE_SCRIPT_DIR}/COL_TABLE"
- 
--readonly utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh"
- # shellcheck source=./advanced/Scripts/utils.sh
--source "${utilsfile}"
-+source "${PI_HOLE_SCRIPT_DIR}/utils.sh"
- 
--# Source api functions
--readonly apifile="${PI_HOLE_SCRIPT_DIR}/api.sh"
- # shellcheck source=./advanced/Scripts/api.sh
--source "${apifile}"
-+source "${PI_HOLE_SCRIPT_DIR}/api.sh"
- 
- versionsfile="/etc/pihole/versions"
- if [ -f "${versionsfile}" ]; then
--- 
-2.48.1
-
diff --git a/pkgs/by-name/pi/pihole/package.nix b/pkgs/by-name/pi/pihole/package.nix
index 152fc208643b..5a816b3623f9 100644
--- a/pkgs/by-name/pi/pihole/package.nix
+++ b/pkgs/by-name/pi/pihole/package.nix
@@ -31,13 +31,13 @@
 
 (resholve.mkDerivation rec {
   pname = "pihole";
-  version = "6.1";
+  version = "6.1.4";
 
   src = fetchFromGitHub {
     owner = "pi-hole";
     repo = "pi-hole";
     tag = "v${version}";
-    hash = "sha256-aEnv8Lhb5vf0yDyuriVTaUY1wcdVmTdqoK+KDHvT/Lw=";
+    hash = "sha256-2B2GUJKt4jHEjQLBx96FRuHpnLCTzE4UPDaeQvnDONc=";
   };
 
   patches = [
@@ -45,8 +45,6 @@
     ./0001-Remove-sudo.patch
     # Disable unsupported subcommands, particularly those for imperatively installing/upgrading Pi-hole
     ./0002-Remove-unsupported-commands.patch
-    # Fix a readonly variable error caused by defining a shadowing local variable
-    ./0003-Fix-redefinition-of-readonly-variable-utilsfile.patch
   ];
 
   nativeBuildInputs = [
@@ -57,7 +55,7 @@
   installPhase = ''
     runHook preInstall
 
-    readonly scriptsDir=$out/usr/share/pihole
+    readonly scriptsDir=$out/share/pihole
 
     install -Dm 555 -t $out/bin pihole
     install -Dm 555 -t $scriptsDir/advanced/Scripts gravity.sh
@@ -74,12 +72,12 @@
   solutions.default =
     let
       out = builtins.placeholder "out";
-      scriptsDir = "${out}/usr/share/pihole/advanced/Scripts";
+      scriptsDir = "${out}/share/pihole/advanced/Scripts";
     in
     {
       scripts =
         let
-          relativeScripts = "usr/share/pihole/advanced/Scripts";
+          relativeScripts = "share/pihole/advanced/Scripts";
         in
         [
           "bin/pihole"
@@ -101,7 +99,7 @@
       inputs = [
         # TODO: see if these inputs can help resholving
         "bin"
-        "usr/share/pihole/advanced/Scripts"
+        "share/pihole/advanced/Scripts"
 
         bash
         coreutils
@@ -150,16 +148,16 @@
       };
       fix = {
         "$PI_HOLE_BIN_DIR" = [ "${out}/bin" ];
-        "$PI_HOLE_FILES_DIR" = [ "${out}/usr/share/pihole" ];
+        "$PI_HOLE_FILES_DIR" = [ "${out}/share/pihole" ];
         "$PI_HOLE_INSTALL_DIR" = [ scriptsDir ];
-        "$PI_HOLE_LOCAL_REPO" = [ "${out}/usr/share/pihole" ];
+        "$PI_HOLE_LOCAL_REPO" = [ "${out}/share/pihole" ];
         "$PI_HOLE_SCRIPT_DIR" = [ scriptsDir ];
         "$colfile" = [ "${scriptsDir}/COL_TABLE" ];
         "$coltable" = [ "${scriptsDir}/COL_TABLE" ];
         "$PIHOLE_COLTABLE_FILE" = [ "${scriptsDir}/COL_TABLE" ];
         "$utilsfile" = [ "${scriptsDir}/utils.sh" ];
         "$apifile" = [ "${scriptsDir}/api.sh" ];
-        "$piholeGitDir" = [ "${out}/usr/share/pihole" ];
+        "$piholeGitDir" = [ "${out}/share/pihole" ];
         "$PIHOLE_COMMAND" = [ "pihole" ];
       };
       keep = {
@@ -168,7 +166,7 @@
           "$setupVars" # Global config file
           "$PIHOLE_SETUP_VARS_FILE"
           "$versionsfile" # configuration file, doesn't exist on NixOS
-          "${out}/usr/share/pihole/automated install/basic-install.sh"
+          "${out}/share/pihole/automated install/basic-install.sh"
           "${scriptsDir}/COL_TABLE"
           "${scriptsDir}/database_migration/gravity-db.sh"
           "${scriptsDir}/gravity.sh"
@@ -213,8 +211,8 @@
         # both quoted and escaped. Resholve apparently requires matching the
         # literal path, so we need to provide a version with and without the
         # backslash.
-        "'${out}/usr/share/pihole/automated\\ install/basic-install.sh'" = true;
-        "'${out}/usr/share/pihole/automated install/basic-install.sh'" = true;
+        "'${out}/share/pihole/automated\\ install/basic-install.sh'" = true;
+        "'${out}/share/pihole/automated install/basic-install.sh'" = true;
 
         "/etc/.pihole" = true; # Patched with an override
         "/etc/os-release" = true;
@@ -232,6 +230,8 @@
 
   meta = {
     description = "Black hole for Internet advertisements";
+    homepage = "https://pi-hole.net";
+    changelog = "https://github.com/pi-hole/pi-hole/releases/tag/v${version}";
     license = lib.licenses.eupl12;
     maintainers = with lib.maintainers; [ averyvigolo ];
     platforms = lib.platforms.linux;
@@ -239,13 +239,13 @@
   };
 
   passthru = {
-    stateDir = stateDir;
+    inherit stateDir;
   };
 }).overrideAttrs
   (old: {
     # Resholve can't fix the hardcoded absolute paths, so substitute them before resholving
     preFixup = ''
-      scriptsDir=$out/usr/share/pihole
+      scriptsDir=$out/share/pihole
 
       substituteInPlace $out/bin/pihole $scriptsDir/advanced/Scripts/*.sh \
         --replace-quiet /etc/.pihole $scriptsDir \
diff --git a/pkgs/by-name/pi/piliplus/git-hashes.json b/pkgs/by-name/pi/piliplus/git-hashes.json
index dc4bb9ee123a..858bd20fc8ed 100644
--- a/pkgs/by-name/pi/piliplus/git-hashes.json
+++ b/pkgs/by-name/pi/piliplus/git-hashes.json
@@ -6,6 +6,6 @@
   "floating": "sha256-TJ2i3hTOQ4euHWr+lfQU44L3vVehmWVdZuAzNyVaEfA=",
   "flutter_sortable_wrap": "sha256-Qj9Lzh+pJy+vHznGt5M3xwoJtaVtt00fxm4JJXL4bFI=",
   "material_design_icons_flutter": "sha256-KMwjnzJJj8nemCqUCSwYafPOwTYbtoHNenxstocJtz4=",
-  "media_kit_video": "sha256-wtxTbqOkwQvgDX+LBWLZAdgKkTj4LC484if1LOMjbmA=",
+  "media_kit_video": "sha256-RI2ddJLY/CyQ7OHvfZI/ysQPytUpbv9gxdJftzx8owc=",
   "webdav_client": "sha256-euNF7HdDtZ68BqSEq9BvO10BK09MxX2wWGoElFS0yeE="
 }
diff --git a/pkgs/by-name/pi/piliplus/package.nix b/pkgs/by-name/pi/piliplus/package.nix
index ba57b46eae13..807951316789 100644
--- a/pkgs/by-name/pi/piliplus/package.nix
+++ b/pkgs/by-name/pi/piliplus/package.nix
@@ -11,8 +11,8 @@
 }:
 
 let
-  version = "1.1.4.1";
-  rev = "288d554de9bd79ed52582d95517a3d2ea59e6e06";
+  version = "1.1.4.3";
+  rev = "fc6f51787ba0f1aa45afd494d3c5524f908d8631";
 
   description = "Third-party Bilibili client developed in Flutter";
 in
@@ -29,7 +29,7 @@ flutter335.buildFlutterApplication.override
       owner = "bggRGjQaUbCoE";
       repo = "PiliPlus";
       inherit rev;
-      hash = "sha256-ia+qN3Oa8R7ZPN/IETedESv1+cSXKQOo158is0m/JJM=";
+      hash = "sha256-jlbMKFShqrdGlVAutRSUVY+rGP/Sy7e454jahRRHkJk=";
     };
 
     # Disable update check.
diff --git a/pkgs/by-name/pi/piliplus/pubspec.lock.json b/pkgs/by-name/pi/piliplus/pubspec.lock.json
index 92e73ea0ab4c..00c9960a60b6 100644
--- a/pkgs/by-name/pi/piliplus/pubspec.lock.json
+++ b/pkgs/by-name/pi/piliplus/pubspec.lock.json
@@ -931,11 +931,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_plugin_android_lifecycle",
-        "sha256": "6382ce712ff69b0f719640ce957559dde459e55ecd433c767e06d139ddf16cab",
+        "sha256": "b0694b7fb1689b0e6cc193b3f1fcac6423c4f93c74fb20b806c6b6f196db0c31",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.29"
+      "version": "2.0.30"
     },
     "flutter_smart_dialog": {
       "dependency": "direct main",
@@ -1121,7 +1121,7 @@
       "version": "1.5.0"
     },
     "http2": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "http2",
         "sha256": "382d3aefc5bd6dc68c6b892d7664f29b5beb3251611ae946a98d35158a82bbfa",
@@ -1204,11 +1204,11 @@
       "dependency": "transitive",
       "description": {
         "name": "image_picker_android",
-        "sha256": "e83b2b05141469c5e19d77e1dfa11096b6b1567d09065b2265d7c6904560050c",
+        "sha256": "28f3987ca0ec702d346eae1d90eda59603a2101b52f1e234ded62cff1d5cfa6e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.8.13"
+      "version": "0.8.13+1"
     },
     "image_picker_for_web": {
       "dependency": "transitive",
@@ -1400,16 +1400,6 @@
       "source": "hosted",
       "version": "6.5.0"
     },
-    "marquee": {
-      "dependency": "direct main",
-      "description": {
-        "name": "marquee",
-        "sha256": "a87e7e80c5d21434f90ad92add9f820cf68be374b226404fe881d2bba7be0862",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.3.0"
-    },
     "matcher": {
       "dependency": "transitive",
       "description": {
@@ -1526,7 +1516,7 @@
       "description": {
         "path": "media_kit_video",
         "ref": "version_1.2.5",
-        "resolved-ref": "69fbf92def88d4304fc177fa4dd14664c0c2d8d5",
+        "resolved-ref": "4785f3223ff04d86b1644ab114e3960723ddf7cd",
         "url": "https://github.com/bggRGjQaUbCoE/media-kit.git"
       },
       "source": "git",
@@ -1636,11 +1626,11 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "d0d310befe2c8ab9e7f393288ccbb11b60c019c6b5afc21973eeee4dda2b35e9",
+        "sha256": "993381400e94d18469750e5b9dcb8206f15bc09f9da86b9e44a9b0092a0066db",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.17"
+      "version": "2.2.18"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
@@ -1746,11 +1736,11 @@
       "dependency": "transitive",
       "description": {
         "name": "petitparser",
-        "sha256": "07c8f0b1913bcde1ff0d26e57ace2f3012ccbf2b204e070290dad3bb22797646",
+        "sha256": "1a97266a94f7350d30ae522c0af07890c70b8e62c71e8e3920d1db4d23c057d1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.0"
+      "version": "7.0.1"
     },
     "platform": {
       "dependency": "transitive",
@@ -1896,21 +1886,21 @@
       "dependency": "direct main",
       "description": {
         "name": "screen_brightness",
-        "sha256": "b6cb9381b83fef7be74187ea043d54598b9a265b4ef6e40b69345ae28699b13e",
+        "sha256": "5f70754028f169f059fdc61112a19dcbee152f8b293c42c848317854d650cba3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.6"
+      "version": "2.1.7"
     },
     "screen_brightness_android": {
       "dependency": "transitive",
       "description": {
         "name": "screen_brightness_android",
-        "sha256": "fb5fa43cb89d0c9b8534556c427db1e97e46594ac5d66ebdcf16063b773d54ed",
+        "sha256": "d34f5321abd03bc3474f4c381f53d189117eba0b039eac1916aa92cca5fd0a96",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.2"
+      "version": "2.1.3"
     },
     "screen_brightness_ios": {
       "dependency": "transitive",
@@ -1936,11 +1926,11 @@
       "dependency": "transitive",
       "description": {
         "name": "screen_brightness_ohos",
-        "sha256": "af2680660f7df785bcd2b1bef9b9f3c172191166dd27098f2dfe020c50c3dea4",
+        "sha256": "a93a263dcd39b5c56e589eb495bcd001ce65cdd96ff12ab1350683559d5c5bb7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.1.2"
     },
     "screen_brightness_platform_interface": {
       "dependency": "transitive",
@@ -2016,11 +2006,11 @@
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_android",
-        "sha256": "5bcf0772a761b04f8c6bf814721713de6f3e5d9d89caf8d3fe031b02a342379e",
+        "sha256": "a2608114b1ffdcbc9c120eb71a0e207c71da56202852d4aab8a5e30a82269e74",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.11"
+      "version": "2.4.12"
     },
     "shared_preferences_foundation": {
       "dependency": "transitive",
@@ -2332,11 +2322,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_android",
-        "sha256": "0aedad096a85b49df2e4725fa32118f9fa580f3b14af7a2d2221896a02cd5656",
+        "sha256": "69ee86740f2847b9a4ba6cffa74ed12ce500bbe2b07f3dc1e643439da60637b7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.17"
+      "version": "6.3.18"
     },
     "url_launcher_ios": {
       "dependency": "transitive",
@@ -2432,11 +2422,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "ca81fdfaf62a5ab45d7296614aea108d2c7d0efca8393e96174bf4d51e6725b0",
+        "sha256": "d354a7ec6931e6047785f4db12a1f61ec3d43b207fc0790f863818543f8ff0dc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.18"
+      "version": "1.1.19"
     },
     "vector_math": {
       "dependency": "direct main",
@@ -2502,11 +2492,11 @@
       "dependency": "transitive",
       "description": {
         "name": "watcher",
-        "sha256": "0b7fd4a0bbc4b92641dbf20adfd7e3fd1398fe17102d94b674234563e110088a",
+        "sha256": "5bf046f41320ac97a469d506261797f35254fa61c641741ef32dacda98b7d39c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.2"
+      "version": "1.1.3"
     },
     "waterfall_flow": {
       "dependency": "direct main",
@@ -2593,11 +2583,11 @@
       "dependency": "transitive",
       "description": {
         "name": "xml",
-        "sha256": "b015a8ad1c488f66851d762d3090a21c600e479dc75e68328c52774040cf9226",
+        "sha256": "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.5.0"
+      "version": "6.6.1"
     },
     "yaml": {
       "dependency": "transitive",
@@ -2612,6 +2602,6 @@
   },
   "sdks": {
     "dart": ">=3.9.0 <4.0.0",
-    "flutter": ">=3.35.1"
+    "flutter": ">=3.35.2"
   }
 }
diff --git a/pkgs/by-name/pi/pinnwand/package.nix b/pkgs/by-name/pi/pinnwand/package.nix
index 2b19dedb1093..3e7431e3c67a 100644
--- a/pkgs/by-name/pi/pinnwand/package.nix
+++ b/pkgs/by-name/pi/pinnwand/package.nix
@@ -13,7 +13,7 @@ buildPythonApplication rec {
 
   src = fetchFromGitHub {
     owner = "supakeen";
-    repo = pname;
+    repo = "pinnwand";
     tag = "v${version}";
     hash = "sha256-oB7Dd1iVzGqr+5nG7BfZuwOQUgUnmg6ptQDZPGH7P5E=";
   };
diff --git a/pkgs/by-name/pl/plakar/package.nix b/pkgs/by-name/pl/plakar/package.nix
new file mode 100644
index 000000000000..120526a43037
--- /dev/null
+++ b/pkgs/by-name/pl/plakar/package.nix
@@ -0,0 +1,48 @@
+{
+  stdenv,
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  fuse,
+}:
+buildGoModule (finalAttrs: {
+  pname = "plakar";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "PlakarKorp";
+    repo = "plakar";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4fJB00poA06aQC//zw6L0bRXa8KauFJfZbniCu+vrac=";
+  };
+
+  vendorHash = "sha256-UxTETtR7LNOavIS2oJRVKx/Ns2bvzJe+Enh8xFhM2mI=";
+
+  buildInputs = [
+    fuse
+  ];
+
+  checkFlags =
+    let
+      skippedTests = [
+        # mount: fusermount: exec: "fusermount": executable file not found in $PATH
+        "TestExecuteCmdMountDefault"
+      ]
+      ++ lib.optionals stdenv.isDarwin [
+        "TestBTreeScanMemory"
+        "TestBTreeScanPebble"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  meta = {
+    mainProgram = "plakar";
+    description = "Encrypted, queryable backups for engineers based on an immutable data store and portable archives";
+    homepage = "https://www.plakar.io";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [
+      heph2
+      qbit
+    ];
+  };
+})
diff --git a/pkgs/by-name/po/polar/package.nix b/pkgs/by-name/po/polar/package.nix
index e53efaa24141..f7f438dac991 100644
--- a/pkgs/by-name/po/polar/package.nix
+++ b/pkgs/by-name/po/polar/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "cmaion";
-    repo = pname;
+    repo = "polar";
     rev = "be15f5f897f8a919dd639009873147dca2a9cea0";
     sha256 = "0gqkqfrqnrsy6avg372xwqj22yz8g6r2hnzbw6197b1rf7zr1il7";
   };
diff --git a/pkgs/by-name/qi/qimgv/package.nix b/pkgs/by-name/qi/qimgv/package.nix
index 0fc80b57d0a9..e4a2e453456f 100644
--- a/pkgs/by-name/qi/qimgv/package.nix
+++ b/pkgs/by-name/qi/qimgv/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "easymodo";
-    repo = pname;
+    repo = "qimgv";
     rev = "a4d475fae07847be7c106cb628fb97dad51ab920";
     sha256 = "sha256-iURUJiPe8hbCnpaf6lk8OVSzVqrJKGab889yOic5yLI=";
   };
diff --git a/pkgs/by-name/rc/rclip/package.nix b/pkgs/by-name/rc/rclip/package.nix
index d2a5ca838625..b39198487c7f 100644
--- a/pkgs/by-name/rc/rclip/package.nix
+++ b/pkgs/by-name/rc/rclip/package.nix
@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "rclip";
-  version = "2.0.5";
+  version = "2.0.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yurijmikhalevich";
     repo = "rclip";
     tag = "v${version}";
-    hash = "sha256-d/jEtcBvOiebdI4DgWNWtP8ZfOy2x7EaQt/6mo7o2Ok=";
+    hash = "sha256-OiAOK6i088TMqD2+PzdSs7UBsycNHa+nqWima0dPYIA=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/rc/rcp/package.nix b/pkgs/by-name/rc/rcp/package.nix
index 4eb69d938ce8..2ad362c960a0 100644
--- a/pkgs/by-name/rc/rcp/package.nix
+++ b/pkgs/by-name/rc/rcp/package.nix
@@ -7,22 +7,26 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rcp";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "wykurz";
     repo = "rcp";
     rev = "v${version}";
-    hash = "sha256-mFFMxGu/r8xtfMkpDW2Rk/oTWQcS9oK6ngoRKCc+STo=";
+    hash = "sha256-hAm9dHxsIR5cJlZHvSUcj3FXBIF9g7klJ2gSg9vVQcE=";
   };
 
-  cargoHash = "sha256-2S3bygSu9ouT/RYCmafFGvFHHFJXVryb5E3PMmcZs0U=";
+  cargoHash = "sha256-iULpW3DiEUmKz5OKUeWfYNAfhrEECd2XijtYqfcbjB0=";
 
   RUSTFLAGS = "--cfg tokio_unstable";
 
   checkFlags = [
-    # this test also sets setuid permissions on a test file (3oXXX) which doesn't work in a sandbox
+    # these tests set setuid permissions on a test file (3oXXX) which doesn't work in a sandbox
     "--skip=copy::copy_tests::check_default_mode"
+    "--skip=test_weird_permissions"
+    "--skip=test_edge_case_special_permissions"
+    # these tests require network access to determine local IP address
+    "--skip=test_remote"
   ];
 
   meta = {
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 02bd67a1b281..871337eabbc2 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2025.08.25.00";
+  version = "2025.09.01.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${version}";
-    hash = "sha256-lrDfufxABC4noqHvG6vt2AjWI+O2pPrJLki67GnrB24=";
+    hash = "sha256-C9mS3l0vv7Za5Zy10WiXXcYCV+ZTp97feu5f0zB7tZM=";
   };
 
   cargoHash = "sha256-7szjy2scCSedkHahWOCIxMrDh7f+nWYpK8BpKT6P9tE=";
diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index af5ce53c307e..4c1085c096c1 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -16,14 +16,14 @@
 
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "06.00.01";
+  version = "06.01.00";
 
   src = fetchFromGitea {
     domain = "git.skoll.ca";
     owner = "Skollsoft-Public";
     repo = "Remind";
     rev = version;
-    hash = "sha256-+0G7Bz5vAAKCPVznYWdX5NKXVGrZ86oHx2sevOzPcBI=";
+    hash = "sha256-1M1cKyonDydYl+UtScMwtp7DBQEFceaSXSUvMseKzzA=";
   };
 
   propagatedBuildInputs = lib.optionals withGui [
diff --git a/pkgs/by-name/ri/ripes/package.nix b/pkgs/by-name/ri/ripes/package.nix
index 0afec0618a3b..8508f0280c85 100644
--- a/pkgs/by-name/ri/ripes/package.nix
+++ b/pkgs/by-name/ri/ripes/package.nix
@@ -67,6 +67,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.unix;
     mainProgram = "Ripes";
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
   };
 }
diff --git a/pkgs/by-name/ro/rover/package.nix b/pkgs/by-name/ro/rover/package.nix
index 2f2db1e6b724..45cce26e5cf6 100644
--- a/pkgs/by-name/ro/rover/package.nix
+++ b/pkgs/by-name/ro/rover/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "apollographql";
-    repo = pname;
+    repo = "rover";
     rev = "v${version}";
     sha256 = "sha256-uyeePAHBDCzXzwIWrKcc9LHClwSI7DMBYod/o4LfK+Y=";
   };
diff --git a/pkgs/by-name/ru/rustical/package.nix b/pkgs/by-name/ru/rustical/package.nix
index 8a54772c43b7..a6bca8944920 100644
--- a/pkgs/by-name/ru/rustical/package.nix
+++ b/pkgs/by-name/ru/rustical/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustical";
-  version = "0.9.1";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "lennart-k";
     repo = "rustical";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kp1s9c1GCvz5aCbjjIHtIxhbgOgrWFG2TUg6bDSm3ZA=";
+    hash = "sha256-2nKK+mVBbgaz0jgey54nAXeRQ2arVUvBUoTmQviL44k=";
   };
 
-  cargoHash = "sha256-Fvstze4YfBcbBQiVXjxtPo+h6GGcfmiCNuvtfviyP2o=";
+  cargoHash = "sha256-e87lVUXznWpbfp17bAYKMa6gIyBKGwwFWzXBdlNMPYU=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index 046389e254ce..100df45b8da3 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.5-unstable-2025-08-26";
+  version = "11.5-unstable-2025-09-06";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "f2abd58b4311e3f873619a6da1e65c5ad3d81943";
-    hash = "sha256-4si8ObGNeM+grMR83pXppm50HZrw01tayQLePhwNRhk=";
+    rev = "cc2781b08764f820a3b9dc7dfbbc40505a3131db";
+    hash = "sha256-8hwCzoELeDsnIz+XvfHHyRov4KajqCe1icI8uobrbDk=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/sa/sage/sage-src.nix b/pkgs/by-name/sa/sage/sage-src.nix
index c5a9092216ca..ad3fb2438cd5 100644
--- a/pkgs/by-name/sa/sage/sage-src.nix
+++ b/pkgs/by-name/sa/sage/sage-src.nix
@@ -82,6 +82,20 @@ stdenv.mkDerivation rec {
       url = "https://github.com/sagemath/sage/commit/d0cbe9d353722580f98a327694f1a361c9b83ccd.patch?full_index=1";
       hash = "sha256-uV2nttxCKDsNqMf1O+lUmuoiDrx7/CfiS00JBb9kiM8=";
     })
+
+    # https://github.com/sagemath/sage/pull/40156, landed in 10.7.beta5
+    (fetchpatch2 {
+      name = "cython-3.1-update.patch";
+      url = "https://github.com/sagemath/sage/commit/5ea8db28977ec113aec3c4c4b208d1783e3937a7.patch?full_index=1";
+      hash = "sha256-5DPPxMuidPpVHrjK8j0UVZzuwiVy9vQzFd6hBYwNAok=";
+    })
+
+    # https://github.com/sagemath/sage/pull/40175, landed in 10.7.beta8
+    (fetchpatch2 {
+      name = "rpy2-3.6-update.patch";
+      url = "https://github.com/sagemath/sage/commit/db2d8db99d9a7dfa1972d534ecd89e3d2ba5c55b.patch?full_index=1";
+      hash = "sha256-6Bk0uGlKFsiDsgv+ljMC1YnmAT+g+he6aFNkpvw2on0=";
+    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
diff --git a/pkgs/by-name/sd/sd-switch/package.nix b/pkgs/by-name/sd/sd-switch/package.nix
index ce45c53e8900..72eebfbef610 100644
--- a/pkgs/by-name/sd/sd-switch/package.nix
+++ b/pkgs/by-name/sd/sd-switch/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.5.5";
+  version = "0.6.0";
 in
 rustPlatform.buildRustPackage {
   pname = "sd-switch";
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage {
     owner = "~rycee";
     repo = "sd-switch";
     rev = version;
-    hash = "sha256-hhT7w76bQe5USHGOQ6Rg8XEW+4JIccAXkfGj86id/Ec=";
+    hash = "sha256-IZ2tyQzWa2Uk002P9jCiaIV3huRiFdTe8eYXVQPBBJI=";
   };
 
-  cargoHash = "sha256-88jNiOYEikqnY69Bceaz32rQHN9BOy2/r4LiOiqsR4Y=";
+  cargoHash = "sha256-ExQPCA8sAZVE5uB1KUnq6PXGhG1IZjzM9eFwYW3oJtE=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
index 2139781da64e..a3b3190580c4 100644
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2025-08-25";
+  version = "0-unstable-2025-09-03";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "992a0caf690e32a332a9707c355a4444516a2764";
-    hash = "sha256-hv1xtAXpSQlzO1nSUkFaeoth4o0V7aUjzZgqnehezaY=";
+    rev = "86e83c3c9c1c3574df44bbb9d28513bfee8a8e3b";
+    hash = "sha256-0ynh2TbwCtkrA4i5i0pR+oIE4Y49JxMQex3SKmKHWKk=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/se/serve/package.nix b/pkgs/by-name/se/serve/package.nix
new file mode 100644
index 000000000000..342c0f367280
--- /dev/null
+++ b/pkgs/by-name/se/serve/package.nix
@@ -0,0 +1,44 @@
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  lib,
+  makeWrapper,
+  nodejs,
+  pnpm_9,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "serve";
+  version = "14.2.4";
+
+  src = fetchFromGitHub {
+    owner = "vercel";
+    repo = "serve";
+    tag = finalAttrs.version;
+    hash = "sha256-QVbau4MrpgEQkwlWx4tU9H93zdM0mSZgIzXpjHRM5mk=";
+  };
+
+  npmDeps = null;
+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 2;
+    hash = "sha256-IJMu0XHwEn2TZP/He79FFGl/PeXOCTD51lIgmImpyKo=";
+  };
+
+  npmConfigHook = pnpm_9.configHook;
+
+  dontNpmBuild = true;
+
+  # takes too long to finish
+  dontNpmPrune = true;
+
+  meta = {
+    description = "Static file serving and directory listing";
+    homepage = "https://github.com/vercel/serve";
+    downloadPage = "https://github.com/vercel/serve/releases";
+    changelog = "https://github.com/vercel/serve/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ prince213 ];
+    mainProgram = "serve";
+  };
+})
diff --git a/pkgs/by-name/sh/sharkey/package.nix b/pkgs/by-name/sh/sharkey/package.nix
index 33b3087d9d08..f2aed7b9541d 100644
--- a/pkgs/by-name/sh/sharkey/package.nix
+++ b/pkgs/by-name/sh/sharkey/package.nix
@@ -9,6 +9,7 @@
   ffmpeg-headless,
   jemalloc,
   makeWrapper,
+  nix-update-script,
   nodejs,
   pango,
   pixman,
@@ -154,6 +155,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.sharkey = nixosTests.sharkey;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Sharkish microblogging platform";
     homepage = "https://joinsharkey.org";
diff --git a/pkgs/by-name/si/simdutf/package.nix b/pkgs/by-name/si/simdutf/package.nix
index c2f02d97c721..f83736d4bca0 100644
--- a/pkgs/by-name/si/simdutf/package.nix
+++ b/pkgs/by-name/si/simdutf/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
       asl20
       mit
     ];
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
     mainProgram = "simdutf";
     platforms = platforms.all;
   };
diff --git a/pkgs/by-name/sl/slint-lsp/package.nix b/pkgs/by-name/sl/slint-lsp/package.nix
index 2f1f84069c92..4e701856a994 100644
--- a/pkgs/by-name/sl/slint-lsp/package.nix
+++ b/pkgs/by-name/sl/slint-lsp/package.nix
@@ -15,14 +15,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "slint-lsp";
-  version = "1.12.1";
+  version = "1.13.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-adYd/PJ2c+SmJm7CNjCueaqHiHDC2KzFd4tS88wEMS4=";
+    hash = "sha256-xgGkgL2UyRBef57lA4dpVx3RcC7R+1Y2ejV8h6yzQCA=";
   };
 
-  cargoHash = "sha256-Wa07LLcMQ1PxA8CJhaLDu5OllfJYKmJ8uWDfXOu8rus=";
+  cargoHash = "sha256-TgI7MsWtI2mwXuTpaXLRmoNfghLoXqlM1/NIFKNU0Uc=";
 
   rpathLibs = [
     fontconfig
diff --git a/pkgs/by-name/so/sonusmix/package.nix b/pkgs/by-name/so/sonusmix/package.nix
deleted file mode 100644
index 7926058f2c75..000000000000
--- a/pkgs/by-name/so/sonusmix/package.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitea,
-  pkg-config,
-  glib,
-  gtk4,
-  pipewire,
-  dbus,
-  wrapGAppsHook4,
-  autoPatchelfHook,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "sonusmix";
-  version = "0.1.1";
-  doCheck = false;
-
-  src = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "sonusmix";
-    repo = "sonusmix";
-    rev = "v${version}";
-    hash = "sha256-vqbYJuErghSsvkFccLFUYuf1Dsg17tCBhF4/NLcba/E=";
-  };
-
-  cargoHash = "sha256-KiCJ8XOU5qnO0zB1K7XBTx35WWUpAmqPFkNZOIgwLA0=";
-
-  nativeBuildInputs = [
-    pkg-config
-    rustPlatform.bindgenHook
-    wrapGAppsHook4
-    autoPatchelfHook
-  ];
-
-  buildInputs = [
-    glib
-    gtk4
-    pipewire
-    dbus
-  ];
-
-  meta = {
-    description = "Next-gen Pipewire audio routing tool";
-    homepage = "https://codeberg.org/sonusmix/sonusmix";
-    license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [ ];
-    platforms = lib.platforms.linux;
-    mainProgram = "sonusmix";
-  };
-}
diff --git a/pkgs/by-name/sr/srain/package.nix b/pkgs/by-name/sr/srain/package.nix
index 73bc467e8af5..3ed7dea7163b 100644
--- a/pkgs/by-name/sr/srain/package.nix
+++ b/pkgs/by-name/sr/srain/package.nix
@@ -59,6 +59,6 @@ stdenv.mkDerivation rec {
     homepage = "https://srain.silverrainz.me";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
   };
 }
diff --git a/pkgs/by-name/st/starlark/package.nix b/pkgs/by-name/st/starlark/package.nix
index 61f58ec128f8..6ce52ceafc6a 100644
--- a/pkgs/by-name/st/starlark/package.nix
+++ b/pkgs/by-name/st/starlark/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule {
   pname = "starlark";
-  version = "0-unstable-2025-08-04";
+  version = "0-unstable-2025-09-06";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "starlark-go";
-    rev = "3c9dc17c5f2e062f7d7b8b4237e571810e9c6445";
-    hash = "sha256-hNP2kt6X46WpyQ4eDFU+mGP4x5H6sD3PC+BRD3AUgbo=";
+    rev = "bf296ed553ea1715656054a7f64ac6a6dd161360";
+    hash = "sha256-ijZvmR9oFsIvpindO1RSi01USr2bhBATvVEQtYlgP/A=";
   };
 
   vendorHash = "sha256-8drlCBy+KROyqXzm/c+HBe/bMVOyvwRoLHxOApJhMfo=";
diff --git a/pkgs/by-name/st/storj-uplink/package.nix b/pkgs/by-name/st/storj-uplink/package.nix
index 4a89f9927053..c492f1144f04 100644
--- a/pkgs/by-name/st/storj-uplink/package.nix
+++ b/pkgs/by-name/st/storj-uplink/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "storj-uplink";
-  version = "1.135.3";
+  version = "1.136.1";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9KcJ0Ol+oV2SWpTUOJxNcKnd+l80ysh8A02of0pccjs=";
+    hash = "sha256-yUdD3yMfNFVNX7IJIGlHAYiy3KNjtOeXBe2bgUA+ysk=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-XOsOCBIC9krvEn7MxRhXpLA2UAjv4Sfdnim/wf3HBPU=";
+  vendorHash = "sha256-YWqrdjB6lOOdt99XOrh27O1gza6qZ2Xn+9XfTnwOJsw=";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/st/structorizer/package.nix b/pkgs/by-name/st/structorizer/package.nix
index da1f9e583178..fc86386c4677 100644
--- a/pkgs/by-name/st/structorizer/package.nix
+++ b/pkgs/by-name/st/structorizer/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "structorizer";
-  version = "3.32-31";
+  version = "3.32-32";
 
   desktopItems = [
     (makeDesktopItem {
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     owner = "fesch";
     repo = "Structorizer.Desktop";
     rev = version;
-    hash = "sha256-SOaNX48V42xR/bSj2jKpN7FMiR/ziWl8RYg/PQrfiaA=";
+    hash = "sha256-ZA+DGys4vR8W+nX8JyWiD1GPOLjYAKaqJTel8wWooHA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/su/supabase-cli/package.nix b/pkgs/by-name/su/supabase-cli/package.nix
index 1612460b0104..50a90c32de42 100644
--- a/pkgs/by-name/su/supabase-cli/package.nix
+++ b/pkgs/by-name/su/supabase-cli/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "supabase-cli";
-  version = "2.40.0";
+  version = "2.40.6";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-j/MtVPFs1nQAOggXWPUabyNqaKmuFF3HmBUJ3AF9Wys=";
+    hash = "sha256-SZ0lmOeT3gPEX/13vmN6c1exweFIf8UIB8TJJw1d49U=";
   };
 
-  vendorHash = "sha256-yeZdUfXyWI/F5Y7lv5RB2cNN3fmVlWRyfm+v5xBGmRo=";
+  vendorHash = "sha256-WxgDEMw6IWmREe1Z9IUER3aWLP4xoUrqrUCE6u2J3aI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/sw/swayidle/package.nix b/pkgs/by-name/sw/swayidle/package.nix
index ea4ae160b1c1..47745212f78f 100644
--- a/pkgs/by-name/sw/swayidle/package.nix
+++ b/pkgs/by-name/sw/swayidle/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.mit;
     mainProgram = "swayidle";
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/by-name/sw/swaylock/package.nix b/pkgs/by-name/sw/swaylock/package.nix
index de20c0274a0f..674d84f83878 100644
--- a/pkgs/by-name/sw/swaylock/package.nix
+++ b/pkgs/by-name/sw/swaylock/package.nix
@@ -66,6 +66,6 @@ stdenv.mkDerivation rec {
     mainProgram = "swaylock";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
   };
 }
diff --git a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
index fd62ac70d5b0..dfe8a6633d64 100644
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@@ -1,23 +1,23 @@
 {
-  version = "1.22.5";
+  version = "1.22.6";
 
   x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.5/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-hcjCHWhT/qkSVsVgBP52Ad0UBtjuzHsm4I3MTzzWKn0=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.6/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-aOwvxIxq1h66YKJGnFVIFTcA/tq0CseeNLe6pfLobkI=";
   };
 
   aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.5/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-BThHWsBDVz/r0r0+IywhNM2R/MdLSTUnNwuMeC/YxVI=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.6/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-m79OVmW+9D+941BX9xBwBxrZrDBBrFBDyjS8T6sE3m4=";
   };
 
   x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.5/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-dhhURD+R1nnPNu7sB7Q5aHfXzk/GvBToWmPDcf5Rw3k=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.6/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-RGc+ZHkX4y6kDwzaZeGWpB3TLRvThUbPkriMDK7U3cQ=";
   };
 
   aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.5/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-vPsTww130K03gXIH9M9N6cfOus/DwjFwbJoknBPyqC8=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.22.6/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-mFHxETd96ZGJUYDXi6mjhfJDlozDAo4IHaoisbNhwwc=";
   };
 }
diff --git a/pkgs/by-name/sy/systeroid/package.nix b/pkgs/by-name/sy/systeroid/package.nix
index bfff55f4d2aa..c5f316f0cb45 100644
--- a/pkgs/by-name/sy/systeroid/package.nix
+++ b/pkgs/by-name/sy/systeroid/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systeroid";
-  version = "0.4.5";
+  version = "0.4.6";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "systeroid";
     rev = "v${version}";
-    sha256 = "sha256-nyQFNPmPcguPGeArd+w1Jexj4/J53PXAeGDvoRSsh/k=";
+    sha256 = "sha256-Ip5zFyCMtTwfgY/XoHPOJq7VGCjZWVAgnjf6QsTG9go=";
   };
 
   postPatch = ''
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"/usr/share/doc/kernel-doc-*/Documentation/*",' '"${linux-doc}/share/doc/linux-doc/*",'
   '';
 
-  cargoHash = "sha256-KopbqiQKHzz40SYJXexIAUCoF7224JtmQ0jkhFSTr4c=";
+  cargoHash = "sha256-Gce7DqhGD0CeBTPEqKhzdQ3IIHA6kjoWrejj4V8gT1I=";
 
   buildInputs = [
     xorg.libxcb
diff --git a/pkgs/by-name/ta/tailwindcss_4/package.nix b/pkgs/by-name/ta/tailwindcss_4/package.nix
index ca21148aceb2..2e65996b27f1 100644
--- a/pkgs/by-name/ta/tailwindcss_4/package.nix
+++ b/pkgs/by-name/ta/tailwindcss_4/package.nix
@@ -7,7 +7,7 @@
   makeWrapper,
 }:
 let
-  version = "4.1.12";
+  version = "4.1.13";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "tailwindcss has not been packaged for ${system} yet.";
 
@@ -22,10 +22,10 @@ let
 
   hash =
     {
-      aarch64-darwin = "sha256-fWm+F3a76KSeFXFNmHPQiVnDIK/w8HFNjY5tnQDZtUM=";
-      aarch64-linux = "sha256-GBMyl0//GzQjrXXWovHQmt8cpj6xMk2wr7xMMP8a0IY=";
-      x86_64-darwin = "sha256-/JNdUYE0QkcsLhsoWC/sPfIEN55T1XJJN9UW3UJa83w=";
-      x86_64-linux = "sha256-Xu7mbqI36umhYPozFP0M92q5k1Uamfr7Fvodtsa5Aok=";
+      aarch64-darwin = "sha256-xHaB6ZSNsgAmqROkrKTuAmm0wNTvP3E0PLiR39wel8k=";
+      aarch64-linux = "sha256-yQUpR1o5itvzMViYchwPn+hfQ0orPqPq+tpohnZBgZo=";
+      x86_64-darwin = "sha256-w7Iwvb+qRslMrY20TaH4J3PxC6xU9W+hlsiXfYGcCeQ=";
+      x86_64-linux = "sha256-ue2fj2QNMyNxH59oYIqiZt/zrbxC6GfDjqLQCblzvhE=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/ta/talhelper/package.nix b/pkgs/by-name/ta/talhelper/package.nix
index 3ef3111af1e5..54af313888e3 100644
--- a/pkgs/by-name/ta/talhelper/package.nix
+++ b/pkgs/by-name/ta/talhelper/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.0.33";
+  version = "3.0.34";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8C3I+cP07BXB9/pd3Vt4KLqgfcGFbCy8uViZ6+44hVQ=";
+    hash = "sha256-RQCtEIfANb+x8lqOu91jkahVV2+CYFbS9pXsLTXGEQE=";
   };
 
-  vendorHash = "sha256-Ya7dhbuvLh3mWjtdJkFqtlyiQtZqI4SkW2coGSteQak=";
+  vendorHash = "sha256-3EOa23M6sQ+FZcUA40BdMfjerLRJAZTbz3Fw/QAaP14=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ta/tantivy-go/add-Cargo.lock.patch b/pkgs/by-name/ta/tantivy-go/add-Cargo.lock.patch
index 50fa59c32807..395a38741d53 100644
--- a/pkgs/by-name/ta/tantivy-go/add-Cargo.lock.patch
+++ b/pkgs/by-name/ta/tantivy-go/add-Cargo.lock.patch
@@ -1,9 +1,9 @@
 diff --git a/rust/Cargo.lock b/rust/Cargo.lock
 new file mode 100644
-index 0000000..7cb3275
+index 0000000..6717372
 --- /dev/null
 +++ b/rust/Cargo.lock
-@@ -0,0 +1,1762 @@
+@@ -0,0 +1,1908 @@
 +# This file is automatically @generated by Cargo.
 +# It is not intended for manual editing.
 +version = 4
@@ -16,14 +16,14 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "ahash"
-+version = "0.8.11"
++version = "0.8.12"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
++checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 +dependencies = [
 + "cfg-if",
 + "once_cell",
 + "version_check",
-+ "zerocopy 0.7.35",
++ "zerocopy",
 +]
 +
 +[[package]]
@@ -43,9 +43,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "anstream"
-+version = "0.6.18"
++version = "0.6.20"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
++checksum = "3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192"
 +dependencies = [
 + "anstyle",
 + "anstyle-parse",
@@ -58,37 +58,37 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "anstyle"
-+version = "1.0.10"
++version = "1.0.11"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
++checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
 +
 +[[package]]
 +name = "anstyle-parse"
-+version = "0.2.6"
++version = "0.2.7"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
++checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
 +dependencies = [
 + "utf8parse",
 +]
 +
 +[[package]]
 +name = "anstyle-query"
-+version = "1.1.2"
++version = "1.1.4"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
++checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
 +dependencies = [
-+ "windows-sys 0.59.0",
++ "windows-sys 0.60.2",
 +]
 +
 +[[package]]
 +name = "anstyle-wincon"
-+version = "3.0.7"
++version = "3.0.10"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
++checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
 +dependencies = [
 + "anstyle",
-+ "once_cell",
-+ "windows-sys 0.59.0",
++ "once_cell_polyfill",
++ "windows-sys 0.60.2",
 +]
 +
 +[[package]]
@@ -105,14 +105,14 @@ index 0000000..7cb3275
 +dependencies = [
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
 +name = "autocfg"
-+version = "1.4.0"
++version = "1.5.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
++checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 +
 +[[package]]
 +name = "base64"
@@ -122,9 +122,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "bitflags"
-+version = "2.9.0"
++version = "2.9.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
++checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
 +
 +[[package]]
 +name = "bitpacking"
@@ -137,9 +137,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "bon"
-+version = "3.6.1"
++version = "3.6.5"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "94054366e2ff97b455acdd4fdb03913f717febc57b7bbd1741b2c3b87efae030"
++checksum = "33d9ef19ae5263a138da9a86871eca537478ab0332a7770bac7e3f08b801f89f"
 +dependencies = [
 + "bon-macros",
 + "rustversion",
@@ -147,9 +147,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "bon-macros"
-+version = "3.6.1"
++version = "3.6.5"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "542a990e676ce0a0a895ae54b2d94afd012434f2228a85b186c6bc1a7056cdc6"
++checksum = "577ae008f2ca11ca7641bd44601002ee5ab49ef0af64846ce1ab6057218a5cc1"
 +dependencies = [
 + "darling",
 + "ident_case",
@@ -157,10 +157,16 @@ index 0000000..7cb3275
 + "proc-macro2",
 + "quote",
 + "rustversion",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
++name = "bumpalo"
++version = "3.19.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
++
++[[package]]
 +name = "byteorder"
 +version = "1.5.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -180,16 +186,16 @@ index 0000000..7cb3275
 + "quote",
 + "serde",
 + "serde_json",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 + "tempfile",
 + "toml",
 +]
 +
 +[[package]]
 +name = "cc"
-+version = "1.2.19"
++version = "1.2.32"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8e3a13707ac958681c13b39b458c073d0d9bc8a22cb1b2f4c8e55eb72c13f362"
++checksum = "2352e5597e9c544d5e6d9c95190d5d27738ade584fa8db0a16e130e5c2b5296e"
 +dependencies = [
 + "jobserver",
 + "libc",
@@ -213,24 +219,24 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "cfg-if"
-+version = "1.0.0"
++version = "1.0.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
++checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
 +
 +[[package]]
 +name = "clap"
-+version = "4.5.36"
++version = "4.5.43"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2df961d8c8a0d08aa9945718ccf584145eee3f3aa06cddbeac12933781102e04"
++checksum = "50fd97c9dc2399518aa331917ac6f274280ec5eb34e555dd291899745c48ec6f"
 +dependencies = [
 + "clap_builder",
 +]
 +
 +[[package]]
 +name = "clap_builder"
-+version = "4.5.36"
++version = "4.5.43"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "132dbda40fb6753878316a489d5a1242a8ef2f0d9e47ba01c951ea8aa7d013a5"
++checksum = "c35b5830294e1fa0462034af85cc95225a4cb07092c088c55bda3147cfcd8f65"
 +dependencies = [
 + "anstream",
 + "anstyle",
@@ -240,15 +246,15 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "clap_lex"
-+version = "0.7.4"
++version = "0.7.5"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
++checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
 +
 +[[package]]
 +name = "colorchoice"
-+version = "1.0.3"
++version = "1.0.4"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
++checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 +
 +[[package]]
 +name = "core2"
@@ -261,9 +267,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "crc32fast"
-+version = "1.4.2"
++version = "1.5.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
++checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 +dependencies = [
 + "cfg-if",
 +]
@@ -310,9 +316,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "darling"
-+version = "0.20.11"
++version = "0.21.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
++checksum = "d6b136475da5ef7b6ac596c0e956e37bad51b85b987ff3d5e230e964936736b2"
 +dependencies = [
 + "darling_core",
 + "darling_macro",
@@ -320,27 +326,27 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "darling_core"
-+version = "0.20.11"
++version = "0.21.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
++checksum = "b44ad32f92b75fb438b04b68547e521a548be8acc339a6dacc4a7121488f53e6"
 +dependencies = [
 + "fnv",
 + "ident_case",
 + "proc-macro2",
 + "quote",
 + "strsim",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
 +name = "darling_macro"
-+version = "0.20.11"
++version = "0.21.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
++checksum = "2b5be8a7a562d315a5b92a630c30cec6bcf663e6673f00fbb69cca66a6f521b9"
 +dependencies = [
 + "darling_core",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
@@ -402,12 +408,12 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "errno"
-+version = "0.3.11"
++version = "0.3.13"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e"
++checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
 +dependencies = [
 + "libc",
-+ "windows-sys 0.59.0",
++ "windows-sys 0.60.2",
 +]
 +
 +[[package]]
@@ -458,7 +464,7 @@ index 0000000..7cb3275
 +dependencies = [
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
@@ -492,20 +498,20 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "getrandom"
-+version = "0.2.15"
++version = "0.2.16"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
++checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 +dependencies = [
 + "cfg-if",
 + "libc",
-+ "wasi 0.11.0+wasi-snapshot-preview1",
++ "wasi 0.11.1+wasi-snapshot-preview1",
 +]
 +
 +[[package]]
 +name = "getrandom"
-+version = "0.3.2"
++version = "0.3.3"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
++checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 +dependencies = [
 + "cfg-if",
 + "libc",
@@ -525,9 +531,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "hashbrown"
-+version = "0.15.2"
++version = "0.15.5"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
++checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 +dependencies = [
 + "allocator-api2",
 + "equivalent",
@@ -581,17 +587,17 @@ index 0000000..7cb3275
 + "libflate",
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
 +name = "indexmap"
-+version = "2.9.0"
++version = "2.10.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
++checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
 +dependencies = [
 + "equivalent",
-+ "hashbrown 0.15.2",
++ "hashbrown 0.15.5",
 +]
 +
 +[[package]]
@@ -626,9 +632,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "jieba-rs"
-+version = "0.7.2"
++version = "0.7.4"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "6d1bcad6332969e4d48ee568d430e14ee6dea70740c2549d005d87677ebefb0c"
++checksum = "f5dd552bbb95d578520ee68403bf8aaf0dbbb2ce55b0854d019f9350ad61040a"
 +dependencies = [
 + "cedarwood",
 + "fxhash",
@@ -641,9 +647,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "jiff"
-+version = "0.2.8"
++version = "0.2.15"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "e5ad87c89110f55e4cd4dc2893a9790820206729eaf221555f742d540b0724a0"
++checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49"
 +dependencies = [
 + "jiff-static",
 + "log",
@@ -654,13 +660,13 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "jiff-static"
-+version = "0.2.8"
++version = "0.2.15"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "d076d5b64a7e2fe6f0743f02c43ca4a6725c0f904203bfe276a5b3e793103605"
++checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
 +dependencies = [
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
@@ -669,11 +675,21 @@ index 0000000..7cb3275
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
 +dependencies = [
-+ "getrandom 0.3.2",
++ "getrandom 0.3.3",
 + "libc",
 +]
 +
 +[[package]]
++name = "js-sys"
++version = "0.3.77"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
++dependencies = [
++ "once_cell",
++ "wasm-bindgen",
++]
++
++[[package]]
 +name = "lazy_static"
 +version = "1.5.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -687,9 +703,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "libc"
-+version = "0.2.172"
++version = "0.2.174"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
++checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
 +
 +[[package]]
 +name = "libflate"
@@ -717,9 +733,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "libm"
-+version = "0.2.11"
++version = "0.2.15"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa"
++checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
 +
 +[[package]]
 +name = "linux-raw-sys"
@@ -748,7 +764,7 @@ index 0000000..7cb3275
 + "proc-macro-error",
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
@@ -757,14 +773,14 @@ index 0000000..7cb3275
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
 +dependencies = [
-+ "hashbrown 0.15.2",
++ "hashbrown 0.15.5",
 +]
 +
 +[[package]]
 +name = "lz4_flex"
-+version = "0.11.3"
++version = "0.11.5"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "75761162ae2b0e580d7e7c390558127e5f01b4194debd6221fd8c207fc80e3f5"
++checksum = "08ab2867e3eeeca90e844d1940eab391c9dc5228783db2ed999acbc0a9ed375a"
 +
 +[[package]]
 +name = "measure_time"
@@ -777,15 +793,15 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "memchr"
-+version = "2.7.4"
++version = "2.7.5"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
++checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 +
 +[[package]]
 +name = "memmap2"
-+version = "0.9.5"
++version = "0.9.7"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "fd3f7eed9d3848f8b98834af67102b720745c4ec028fcd0aa0239277e7de374f"
++checksum = "483758ad303d734cec05e5c12b41d7e93e6a6390c5e9dae6bdeb7c1259012d28"
 +dependencies = [
 + "libc",
 +]
@@ -835,6 +851,12 @@ index 0000000..7cb3275
 +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 +
 +[[package]]
++name = "once_cell_polyfill"
++version = "1.70.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
++
++[[package]]
 +name = "oneshot"
 +version = "0.1.11"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -888,7 +910,7 @@ index 0000000..7cb3275
 + "phf_shared",
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
@@ -920,9 +942,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "portable-atomic"
-+version = "1.11.0"
++version = "1.11.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
++checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
 +
 +[[package]]
 +name = "portable-atomic-util"
@@ -945,17 +967,17 @@ index 0000000..7cb3275
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 +dependencies = [
-+ "zerocopy 0.8.24",
++ "zerocopy",
 +]
 +
 +[[package]]
 +name = "prettyplease"
-+version = "0.2.32"
++version = "0.2.36"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "664ec5419c51e34154eec046ebcba56312d5a2fc3b09a06da188e1ad21afadf6"
++checksum = "ff24dfcda44452b9816fff4cd4227e1bb73ff5a2f1bc1105aa92fb8565ce44d2"
 +dependencies = [
 + "proc-macro2",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
@@ -1002,9 +1024,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "r-efi"
-+version = "5.2.0"
++version = "5.3.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
++checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 +
 +[[package]]
 +name = "rand"
@@ -1033,7 +1055,7 @@ index 0000000..7cb3275
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 +dependencies = [
-+ "getrandom 0.2.15",
++ "getrandom 0.2.16",
 +]
 +
 +[[package]]
@@ -1127,22 +1149,22 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "rustix"
-+version = "1.0.5"
++version = "1.0.8"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "d97817398dd4bb2e6da002002db259209759911da105da92bec29ccb12cf58bf"
++checksum = "11181fbabf243db407ef8df94a6ce0b2f9a733bd8be4ad02b4eda9602296cac8"
 +dependencies = [
 + "bitflags",
 + "errno",
 + "libc",
 + "linux-raw-sys 0.9.4",
-+ "windows-sys 0.59.0",
++ "windows-sys 0.60.2",
 +]
 +
 +[[package]]
 +name = "rustversion"
-+version = "1.0.20"
++version = "1.0.21"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
++checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
 +
 +[[package]]
 +name = "ryu"
@@ -1167,14 +1189,14 @@ index 0000000..7cb3275
 +dependencies = [
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
 +name = "serde_json"
-+version = "1.0.140"
++version = "1.0.142"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
++checksum = "030fedb782600dcbd6f02d479bf0d817ac3bb40d644745b769d6a96bc3afc5a7"
 +dependencies = [
 + "itoa",
 + "memchr",
@@ -1184,9 +1206,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "serde_spanned"
-+version = "0.6.8"
++version = "0.6.9"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
++checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
 +dependencies = [
 + "serde",
 +]
@@ -1214,18 +1236,15 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "slab"
-+version = "0.4.9"
++version = "0.4.11"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
-+dependencies = [
-+ "autocfg",
-+]
++checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
 +
 +[[package]]
 +name = "smallvec"
-+version = "1.15.0"
++version = "1.15.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
++checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 +
 +[[package]]
 +name = "stable_deref_trait"
@@ -1251,9 +1270,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "syn"
-+version = "2.0.100"
++version = "2.0.104"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
++checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
 +dependencies = [
 + "proc-macro2",
 + "quote",
@@ -1426,14 +1445,14 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "tempfile"
-+version = "3.19.1"
++version = "3.20.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf"
++checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
 +dependencies = [
 + "fastrand",
-+ "getrandom 0.3.2",
++ "getrandom 0.3.3",
 + "once_cell",
-+ "rustix 1.0.5",
++ "rustix 1.0.8",
 + "windows-sys 0.59.0",
 +]
 +
@@ -1454,7 +1473,7 @@ index 0000000..7cb3275
 +dependencies = [
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
@@ -1490,9 +1509,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "toml"
-+version = "0.8.20"
++version = "0.8.23"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148"
++checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
 +dependencies = [
 + "serde",
 + "serde_spanned",
@@ -1502,27 +1521,34 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "toml_datetime"
-+version = "0.6.8"
++version = "0.6.11"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
++checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
 +dependencies = [
 + "serde",
 +]
 +
 +[[package]]
 +name = "toml_edit"
-+version = "0.22.24"
++version = "0.22.27"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
++checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 +dependencies = [
 + "indexmap",
 + "serde",
 + "serde_spanned",
 + "toml_datetime",
++ "toml_write",
 + "winnow",
 +]
 +
 +[[package]]
++name = "toml_write"
++version = "0.1.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
++
++[[package]]
 +name = "unicode-ident"
 +version = "1.0.18"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1548,12 +1574,14 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "uuid"
-+version = "1.16.0"
++version = "1.17.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
++checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
 +dependencies = [
-+ "getrandom 0.3.2",
++ "getrandom 0.3.3",
++ "js-sys",
 + "serde",
++ "wasm-bindgen",
 +]
 +
 +[[package]]
@@ -1564,9 +1592,9 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "wasi"
-+version = "0.11.0+wasi-snapshot-preview1"
++version = "0.11.1+wasi-snapshot-preview1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
++checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 +
 +[[package]]
 +name = "wasi"
@@ -1578,6 +1606,64 @@ index 0000000..7cb3275
 +]
 +
 +[[package]]
++name = "wasm-bindgen"
++version = "0.2.100"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
++dependencies = [
++ "cfg-if",
++ "once_cell",
++ "rustversion",
++ "wasm-bindgen-macro",
++]
++
++[[package]]
++name = "wasm-bindgen-backend"
++version = "0.2.100"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
++dependencies = [
++ "bumpalo",
++ "log",
++ "proc-macro2",
++ "quote",
++ "syn 2.0.104",
++ "wasm-bindgen-shared",
++]
++
++[[package]]
++name = "wasm-bindgen-macro"
++version = "0.2.100"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
++dependencies = [
++ "quote",
++ "wasm-bindgen-macro-support",
++]
++
++[[package]]
++name = "wasm-bindgen-macro-support"
++version = "0.2.100"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn 2.0.104",
++ "wasm-bindgen-backend",
++ "wasm-bindgen-shared",
++]
++
++[[package]]
++name = "wasm-bindgen-shared"
++version = "0.2.100"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
++dependencies = [
++ "unicode-ident",
++]
++
++[[package]]
 +name = "winapi"
 +version = "0.3.9"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1600,12 +1686,18 @@ index 0000000..7cb3275
 +checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 +
 +[[package]]
++name = "windows-link"
++version = "0.1.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
++
++[[package]]
 +name = "windows-sys"
 +version = "0.52.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 +dependencies = [
-+ "windows-targets",
++ "windows-targets 0.52.6",
 +]
 +
 +[[package]]
@@ -1614,7 +1706,16 @@ index 0000000..7cb3275
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 +dependencies = [
-+ "windows-targets",
++ "windows-targets 0.52.6",
++]
++
++[[package]]
++name = "windows-sys"
++version = "0.60.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
++dependencies = [
++ "windows-targets 0.53.3",
 +]
 +
 +[[package]]
@@ -1623,14 +1724,31 @@ index 0000000..7cb3275
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 +dependencies = [
-+ "windows_aarch64_gnullvm",
-+ "windows_aarch64_msvc",
-+ "windows_i686_gnu",
-+ "windows_i686_gnullvm",
-+ "windows_i686_msvc",
-+ "windows_x86_64_gnu",
-+ "windows_x86_64_gnullvm",
-+ "windows_x86_64_msvc",
++ "windows_aarch64_gnullvm 0.52.6",
++ "windows_aarch64_msvc 0.52.6",
++ "windows_i686_gnu 0.52.6",
++ "windows_i686_gnullvm 0.52.6",
++ "windows_i686_msvc 0.52.6",
++ "windows_x86_64_gnu 0.52.6",
++ "windows_x86_64_gnullvm 0.52.6",
++ "windows_x86_64_msvc 0.52.6",
++]
++
++[[package]]
++name = "windows-targets"
++version = "0.53.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
++dependencies = [
++ "windows-link",
++ "windows_aarch64_gnullvm 0.53.0",
++ "windows_aarch64_msvc 0.53.0",
++ "windows_i686_gnu 0.53.0",
++ "windows_i686_gnullvm 0.53.0",
++ "windows_i686_msvc 0.53.0",
++ "windows_x86_64_gnu 0.53.0",
++ "windows_x86_64_gnullvm 0.53.0",
++ "windows_x86_64_msvc 0.53.0",
 +]
 +
 +[[package]]
@@ -1640,52 +1758,100 @@ index 0000000..7cb3275
 +checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 +
 +[[package]]
++name = "windows_aarch64_gnullvm"
++version = "0.53.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
++
++[[package]]
 +name = "windows_aarch64_msvc"
 +version = "0.52.6"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 +
 +[[package]]
++name = "windows_aarch64_msvc"
++version = "0.53.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
++
++[[package]]
 +name = "windows_i686_gnu"
 +version = "0.52.6"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 +
 +[[package]]
++name = "windows_i686_gnu"
++version = "0.53.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
++
++[[package]]
 +name = "windows_i686_gnullvm"
 +version = "0.52.6"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 +
 +[[package]]
++name = "windows_i686_gnullvm"
++version = "0.53.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
++
++[[package]]
 +name = "windows_i686_msvc"
 +version = "0.52.6"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 +
 +[[package]]
++name = "windows_i686_msvc"
++version = "0.53.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
++
++[[package]]
 +name = "windows_x86_64_gnu"
 +version = "0.52.6"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 +
 +[[package]]
++name = "windows_x86_64_gnu"
++version = "0.53.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
++
++[[package]]
 +name = "windows_x86_64_gnullvm"
 +version = "0.52.6"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 +
 +[[package]]
++name = "windows_x86_64_gnullvm"
++version = "0.53.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
++
++[[package]]
 +name = "windows_x86_64_msvc"
 +version = "0.52.6"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 +
 +[[package]]
-+name = "winnow"
-+version = "0.7.6"
++name = "windows_x86_64_msvc"
++version = "0.53.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "63d3fcd9bba44b03821e7d699eeee959f3126dcc4aa8e4ae18ec617c2a5cea10"
++checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
++
++[[package]]
++name = "winnow"
++version = "0.7.12"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f3edebf492c8125044983378ecb5766203ad3b4c2f7a922bd7dd207f6d443e95"
 +dependencies = [
 + "memchr",
 +]
@@ -1701,42 +1867,22 @@ index 0000000..7cb3275
 +
 +[[package]]
 +name = "zerocopy"
-+version = "0.7.35"
++version = "0.8.26"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
++checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
 +dependencies = [
-+ "zerocopy-derive 0.7.35",
-+]
-+
-+[[package]]
-+name = "zerocopy"
-+version = "0.8.24"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2586fea28e186957ef732a5f8b3be2da217d65c5969d4b1e17f973ebbe876879"
-+dependencies = [
-+ "zerocopy-derive 0.8.24",
++ "zerocopy-derive",
 +]
 +
 +[[package]]
 +name = "zerocopy-derive"
-+version = "0.7.35"
++version = "0.8.26"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
++checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
 +dependencies = [
 + "proc-macro2",
 + "quote",
-+ "syn 2.0.100",
-+]
-+
-+[[package]]
-+name = "zerocopy-derive"
-+version = "0.8.24"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "a996a8f63c5c4448cd959ac1bab0aaa3306ccfd060472f85943ee0750f0169be"
-+dependencies = [
-+ "proc-macro2",
-+ "quote",
-+ "syn 2.0.100",
++ "syn 2.0.104",
 +]
 +
 +[[package]]
@@ -1766,6 +1912,3 @@ index 0000000..7cb3275
 + "cc",
 + "pkg-config",
 +]
--- 
-2.48.1
-
diff --git a/pkgs/by-name/ta/tantivy-go/package.nix b/pkgs/by-name/ta/tantivy-go/package.nix
index 44c9037f7ab6..b4c98758213d 100644
--- a/pkgs/by-name/ta/tantivy-go/package.nix
+++ b/pkgs/by-name/ta/tantivy-go/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tantivy-go";
-  version = "1.0.1";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "tantivy-go";
     tag = "v${version}";
-    hash = "sha256-iTGIm5C7SMBZv2OcKCQCyEZS/eeMJQ5nFSpuFJbTEXU=";
+    hash = "sha256-ksHw+62JwQrzxLuXwYfTLOkC22Miz1Rpl5XX8+vPBcM=";
   };
 
-  cargoHash = "sha256-f8xI4g6MK4NUn0DpxD+miaCzBe8FSSqaL5rpjoqUGfY=";
+  cargoHash = "sha256-GKbQFWXKEgYmoTyFCQ/SAgFB7UJpYN2SWwZEiUxd260=";
 
   cargoPatches = [
     ./add-Cargo.lock.patch
diff --git a/pkgs/by-name/tb/tbox/package.nix b/pkgs/by-name/tb/tbox/package.nix
index 992e8d95bc72..16f26e2d82d4 100644
--- a/pkgs/by-name/tb/tbox/package.nix
+++ b/pkgs/by-name/tb/tbox/package.nix
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     homepage = "https://docs.tboox.org";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
   };
 }
diff --git a/pkgs/by-name/td/tdf/package.nix b/pkgs/by-name/td/tdf/package.nix
index e3a49e93ab94..e0a979900378 100644
--- a/pkgs/by-name/td/tdf/package.nix
+++ b/pkgs/by-name/td/tdf/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tdf";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "itsjunetime";
     repo = "tdf";
     fetchSubmodules = true;
     tag = "v${finalAttrs.version}";
-    hash = "sha256-le2xlSVnYbWMDV9+SbrTFHSFZn/H6N7CEaKr5Zzo/c4=";
+    hash = "sha256-ZC7yQt2ssbRWP7EP7QBrLe8mN9Z9Va4eLivEP/78YpM=";
   };
 
-  cargoHash = "sha256-UB7G5tl90CNq/aYUaUOpgGJcEL9ND3pJ29/lpIkh2iU=";
+  cargoHash = "sha256-8JGiKlVr41YbG+mI/S0xPByKa4pwAH4cDVlznRcfCxE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/te/tela-circle-icon-theme/package.nix b/pkgs/by-name/te/tela-circle-icon-theme/package.nix
index dd1c27305de6..5cba50aae8b4 100644
--- a/pkgs/by-name/te/tela-circle-icon-theme/package.nix
+++ b/pkgs/by-name/te/tela-circle-icon-theme/package.nix
@@ -13,10 +13,7 @@
   colorVariants ? [ ], # default is standard
 }:
 
-let
-  pname = "tela-circle-icon-theme";
-in
-lib.checkListOfEnum "${pname}: color variants"
+lib.checkListOfEnum "tela-circle-icon-theme: color variants"
   [
     "standard"
     "black"
@@ -38,12 +35,12 @@ lib.checkListOfEnum "${pname}: color variants"
 
   stdenvNoCC.mkDerivation
   rec {
-    inherit pname;
+    pname = "tela-circle-icon-theme";
     version = "2025-02-10";
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
-      repo = pname;
+      repo = "tela-circle-icon-theme";
       tag = version;
       hash = "sha256-5Kqf6QNM+/JGGp2H3Vcl69Vh1iZYPq3HJxhvSH6k+eQ=";
     };
diff --git a/pkgs/by-name/te/teleport_16/package.nix b/pkgs/by-name/te/teleport_16/package.nix
index 2ef76956122c..c8e14a52137b 100644
--- a/pkgs/by-name/te/teleport_16/package.nix
+++ b/pkgs/by-name/te/teleport_16/package.nix
@@ -1,15 +1,15 @@
 {
   buildTeleport,
-  buildGo123Module,
+  buildGo124Module,
   wasm-bindgen-cli_0_2_95,
 }:
 buildTeleport rec {
-  version = "16.5.13";
-  hash = "sha256-X9Ujgvp+2dFCoku0tjGW4W05X8QrnExFE+H1kMhf91A=";
-  vendorHash = "sha256-0+7xbIONnZs7dPpfpHPmep+k4XxQE8TS/eKz4F5a3V0=";
-  pnpmHash = "sha256-waBzmNs20wbuoBDObVFnJjEYs3NJ/bzQksVz7ltMD7M=";
+  version = "16.5.15";
+  hash = "sha256-DqNG6gl+KdjSbkE9Bwum8az8cLCSOmZwo9xpuWafHCA=";
+  vendorHash = "sha256-sZvRKLF2iZ3UpgGNUPuWMT7VTpnDa2uU0d1XjDKSmdo=";
+  pnpmHash = "sha256-8xnH9PkKz77whtq/LVYUjyG1Z1reRtW03Gv8sZ/1vww=";
   cargoHash = "sha256-04zykCcVTptEPGy35MIWG+tROKFzEepLBmn04mSbt7I=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_95;
-  buildGoModule = buildGo123Module;
+  buildGoModule = buildGo124Module;
 }
diff --git a/pkgs/by-name/te/teleport_17/package.nix b/pkgs/by-name/te/teleport_17/package.nix
index 68e642564971..35bd56a07432 100644
--- a/pkgs/by-name/te/teleport_17/package.nix
+++ b/pkgs/by-name/te/teleport_17/package.nix
@@ -1,16 +1,16 @@
 {
   buildTeleport,
-  buildGo123Module,
+  buildGo124Module,
   wasm-bindgen-cli_0_2_95,
 }:
 
 buildTeleport rec {
-  version = "17.5.4";
-  hash = "sha256-ojRIyPTrSG3/xuqdaUNrN4s5HP3E8pvzjG8h+qFEYrc=";
-  vendorHash = "sha256-IHXwCp1MdcEKJhIs9DNf77Vd93Ai2as7ROlh6AJT9+Q=";
+  version = "17.7.3";
+  hash = "sha256-YSYkJRAeu7iPOs/gFnozZbks0Fx5srNH0VjrKvFmHZo=";
+  vendorHash = "sha256-7Rb94ERtp3H1Jwyh9d7AFT06d4xXdnfe5tpdvJQrbUQ=";
   cargoHash = "sha256-qz8gkooQTuBlPWC4lHtvBQpKkd+nEZ0Hl7AVg9JkPqs=";
-  pnpmHash = "sha256-YwftGEQTEI8NvFTFLMJHhYkvaIIP9+bskCQCp5xuEtY=";
+  pnpmHash = "sha256-ZONs8z8mgBBQBmqaDGJKqhmtUKBrxE8BGYppbAqpQmg=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_95;
-  buildGoModule = buildGo123Module;
+  buildGoModule = buildGo124Module;
 }
diff --git a/pkgs/by-name/te/teleport_18/package.nix b/pkgs/by-name/te/teleport_18/package.nix
index 72a558a5e20b..f0c459886425 100644
--- a/pkgs/by-name/te/teleport_18/package.nix
+++ b/pkgs/by-name/te/teleport_18/package.nix
@@ -5,10 +5,10 @@
 }:
 
 buildTeleport rec {
-  version = "18.1.1";
-  hash = "sha256-xhf6WwgR3VwjtvFo0/b9A0RcyY7dklPfPUakludUmm8=";
-  vendorHash = "sha256-63pqTI92045/V8Gf+TDKUWLV9eO4hVKOHtgWbYnAf6I=";
-  pnpmHash = "sha256-ZuMMacsyr2rGLVDlaEwA7IbZZfGBuTRBOv4Q6XIjDek=";
+  version = "18.2.0";
+  hash = "sha256-JWgGRv9pK76u7IxwqnBcuAI93XIKfIVvme7l+a/3J7c=";
+  vendorHash = "sha256-oPi/rIuwze2ZlyHfZ2MdDHHvdIaF2IZ2aklEVNRgoLo=";
+  pnpmHash = "sha256-wW4RT1uqOTpy8wKIsAOfIlxoOamTzPqEbFQRAub+sn4=";
   cargoHash = "sha256-ia4We4IfIkqz82aFMVvXdzjDXw0w+OJSPVdutfau6PA=";
 
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_99;
diff --git a/pkgs/by-name/te/telepresence2/package.nix b/pkgs/by-name/te/telepresence2/package.nix
index ca8947c1879a..3420bac48456 100644
--- a/pkgs/by-name/te/telepresence2/package.nix
+++ b/pkgs/by-name/te/telepresence2/package.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.24.0";
+  version = "2.24.1";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-aqL2AjDscN6o9WKur3ed5SU3XQJy6hAu/QUD7Fh/0pE=";
+    hash = "sha256-f9KlDKLRLmYAGMWdlKb4PbGZ+hn8J55EAmQ19oJ5+q4=";
   };
 
   propagatedBuildInputs = [
@@ -51,7 +51,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-ncMquDrlkcf71voCbxadOM+EKO/7olMEAf5FOFoxrvA=";
+  vendorHash = "sha256-I2FyoOKSU1h6a2LwmAdFKGIcqVGbtxujjarqdSX7HFI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/te/texsurgery/package.nix b/pkgs/by-name/te/texsurgery/package.nix
new file mode 100644
index 000000000000..98864e38271e
--- /dev/null
+++ b/pkgs/by-name/te/texsurgery/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  fetchPypi,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "texsurgery";
+  version = "0.6.3";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-zoOeTRHcpDnXJ1QC7BIz9guzqL9Q7kmJ5VSGEyqanfY=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    jupyter-client
+    pyparsing
+  ];
+
+  pythonImportsCheck = [
+    "texsurgery"
+    "texsurgery.texsurgery"
+    "texsurgery.command_line"
+  ];
+
+  meta = {
+    description = "Replace some commands and environments within a TeX document by evaluating code inside a jupyter kernel";
+    homepage = "https://pypi.org/project/texsurgery";
+    license = lib.licenses.mit;
+    mainProgram = "texsurgery";
+    maintainers = with lib.maintainers; [ romildo ];
+  };
+}
diff --git a/pkgs/by-name/ti/tideways-daemon/package.nix b/pkgs/by-name/ti/tideways-daemon/package.nix
index 399de2fdd5e1..4515b76beb5d 100644
--- a/pkgs/by-name/ti/tideways-daemon/package.nix
+++ b/pkgs/by-name/ti/tideways-daemon/package.nix
@@ -10,7 +10,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-daemon";
-  version = "1.9.52";
+  version = "1.10.0";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -28,15 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-8OGGF1b74lYv1EQgcY54gdwJ2mvuS2D2oNdmKoJmkmM=";
+        hash = "sha256-XxKwT7VgdEZclim14H3oZNAE25DoALcpRzx/IPEE4sc=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_aarch64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-adtA5+Ft7ToTDeQ2vp3Hx1UUHgU0NUlcCVpJsV1alvU=";
+        hash = "sha256-0G9SwZHZSHgTAfB+GWTEoSGVhk+Xk8o/aX2zCcnoInI=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-kMIvW3dabv9iHLOx9QbsuiBkts62FHjvEYzBze9prlw=";
+        hash = "sha256-nD2d5XOxV2N4o5LiiF+ZomHXdWmVEYUIz5Yhs0awjEs=";
       };
     };
     updateScript = "${
diff --git a/pkgs/by-name/ti/timekpr/package.nix b/pkgs/by-name/ti/timekpr/package.nix
new file mode 100644
index 000000000000..e56b2aefc406
--- /dev/null
+++ b/pkgs/by-name/ti/timekpr/package.nix
@@ -0,0 +1,150 @@
+{
+  fetchgit,
+  gitUpdater,
+  glib,
+  gobject-introspection,
+  gtk3,
+  lib,
+  python3Packages,
+  sound-theme-freedesktop,
+  stdenv,
+  wrapGAppsHook4,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "timekpr";
+  version = "0.5.8";
+
+  src = fetchgit {
+    url = "https://git.launchpad.net/timekpr-next";
+    tag = "v${version}";
+    hash = "sha256-Y0jAKl553HjoP59wJnKBKq4Ogko1cs8uazW2dy7AlBo=";
+  };
+
+  buildInputs = [
+    glib
+    gtk3
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook4
+  ];
+
+  pyproject = true;
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    dbus-python
+    pygobject3
+    psutil
+  ];
+
+  # Generate setup.py because the upstream repository does not include it
+  SETUP_PY = ''
+    from setuptools import setup, find_namespace_packages
+
+    package_dir={"timekpr": "."}
+    setup(
+      name="timekpr-next",
+      version="${version}",
+      package_dir=package_dir,
+      packages=[
+        f"{package_prefix}.{package_suffix}"
+        for package_prefix, where in package_dir.items()
+        for package_suffix in find_namespace_packages(where=where)
+      ],
+      install_requires=[
+        ${lib.concatMapStringsSep ", " (dependency: "'${dependency.pname}'") dependencies}
+      ],
+    )
+  '';
+
+  postPatch = ''
+    shopt -s globstar extglob nullglob
+
+    substituteInPlace bin/* **/*.py resource/server/systemd/timekpr.service \
+      --replace-quiet /usr/lib/python3/dist-packages "$out"/${lib.escapeShellArg python3Packages.python.sitePackages}
+
+    substituteInPlace **/*.desktop **/*.policy **/*.service \
+      --replace-fail /usr/bin/timekpr "$out"/bin/timekpr
+
+    substituteInPlace common/constants/constants.py \
+      --replace-fail /usr/share/sounds/freedesktop ${lib.escapeShellArg sound-theme-freedesktop}/share/sounds/freedesktop \
+      --replace-fail /usr/share/timekpr "$out"/share/timekpr \
+      --replace-fail /usr/share/locale "$out"/share/locale
+
+    substituteInPlace resource/server/timekpr.conf \
+      --replace-fail /usr/share/timekpr "$out"/share/timekpr \
+
+    # The original file name `timekpra` is renamed to `..timekpra-wrapped-wrapped` because `makeCWrapper` was used multiple times.
+    substituteInPlace client/admin/adminprocessor.py \
+      --replace-fail '"/timekpra" in ' '"/..timekpra-wrapped-wrapped" in '
+
+    printf %s "$SETUP_PY" > setup.py
+  '';
+
+  # We need to manually inject $PYTHONPATH here, because `buildPythonApplication` does not recognize timekpr's executables as Python scripts, and therefore it does not automatically inject $PYTHONPATH into them.
+  postFixup = ''
+    for executable in $out/bin/*
+    do
+      wrapProgram "$executable" --prefix PYTHONPATH : "$PYTHONPATH"
+    done
+  '';
+
+  preInstall = ''
+    while IFS= read -r line
+    do
+      # Trim leading/trailing whitespace
+      line=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+
+      # Skip empty lines and comments
+      if [[ -z "$line" || "$line" =~ ^# ]]; then
+          continue
+      fi
+
+      # Separate source and destination
+      # This assumes the destination is the last field and source path doesn't contain problematic spaces
+      # More robust parsing might be needed if source paths have spaces.
+      source_path=$(echo "$line" | awk '{ $NF=""; print $0 }' | sed 's/[[:space:]]*$//')
+      dest_path=$(echo "$line" | awk '{ print $NF }')
+
+      # Check destination path prefix and map to $out/*
+      case "$dest_path" in
+        usr/share/*)
+          # Remove "usr/" prefix and prepend "$out/"
+          install -D --mode=444 "$source_path" --target-directory="$out/''${dest_path#usr/}"
+          ;;
+        usr/bin/*)
+          # Remove "usr/" prefix and prepend "$out/"
+          install -D --mode=555 "$source_path" --target-directory="$out/''${dest_path#usr/}"
+          ;;
+        etc/*|lib/*|var/*)
+          # Prepend "$out/"
+          install -D --mode=444 "$source_path" --target-directory="$out/$dest_path"
+          ;;
+        usr/lib/python3/dist-packages/*)
+          # Skip this line if the destination is a Python module
+          # because it will be handled by the Python build process
+          continue
+          ;;
+        *)
+          echo "Error: Unknown destination prefix: '$dest_path'" >&2
+          exit 1
+          ;;
+      esac
+    done < debian/install
+  '';
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Manages and restricts user screen time by enforcing time limits";
+    homepage = "https://mjasnik.gitlab.io/timekpr-next/";
+    license = lib.licenses.gpl3;
+    maintainers = [ lib.maintainers.atry ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/to/tokyonight-gtk-theme/package.nix b/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
index 8725b5c63d11..fda9841253de 100644
--- a/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
+++ b/pkgs/by-name/to/tokyonight-gtk-theme/package.nix
@@ -71,13 +71,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants lib
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "0-unstable-2025-08-21";
+    version = "0-unstable-2025-08-28";
 
     src = fetchFromGitHub {
       owner = "Fausto-Korpsvart";
       repo = "Tokyonight-GTK-Theme";
-      rev = "5ff3fb932e7cd01c194813a5540ab77d0b51d6e0";
-      hash = "sha256-Tx4s2TVnoiB8/o5acHeQG+WK8iEFdBBmNEoGrbGJVUU=";
+      rev = "98bd5965341b16e6040571462a950d947c18368a";
+      hash = "sha256-khkL23m8KxAGEB5G6/I2zxQYw1/gjy2+M5GZcq8gS1k=";
     };
 
     propagatedUserEnvPkgs = [ gtk-engine-murrine ];
diff --git a/pkgs/by-name/tr/trzsz-ssh/package.nix b/pkgs/by-name/tr/trzsz-ssh/package.nix
index dd97c6bc76fb..2a4ba92e82cd 100644
--- a/pkgs/by-name/tr/trzsz-ssh/package.nix
+++ b/pkgs/by-name/tr/trzsz-ssh/package.nix
@@ -36,7 +36,7 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/trzsz/trzsz-ssh";
     changelog = "https://github.com/trzsz/trzsz-ssh/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     mainProgram = "trzsz-ssh";
   };
 })
diff --git a/pkgs/by-name/tx/txtpbfmt/package.nix b/pkgs/by-name/tx/txtpbfmt/package.nix
index 74e403bda000..1bf23708da18 100644
--- a/pkgs/by-name/tx/txtpbfmt/package.nix
+++ b/pkgs/by-name/tx/txtpbfmt/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "txtpbfmt";
-  version = "0-unstable-2025-06-27";
+  version = "0-unstable-2025-09-03";
 
   src = fetchFromGitHub {
     owner = "protocolbuffers";
     repo = "txtpbfmt";
-    rev = "f293424e46b51a8dc295a0edf0fe7217ebda2660";
-    hash = "sha256-0fFQbzj4CZ78P7A3iTwNA6LHUDM0nwYM/mPwDOlV2Zo=";
+    rev = "cf07efcaeff78f7d945f844d506daf4cad5a9229";
+    hash = "sha256-A/rmMtYLaTEkP02DLaYu/1nwaQ7EWacvcl0ri5Zx5zs=";
   };
 
   vendorHash = "sha256-iWY0b6PAw9BhA8WrTEECnVAKWTGXuIiGvOi9uhJO4PI=";
diff --git a/pkgs/by-name/u-/u-root/package.nix b/pkgs/by-name/u-/u-root/package.nix
index c61bf39ef673..3526ae04a38d 100644
--- a/pkgs/by-name/u-/u-root/package.nix
+++ b/pkgs/by-name/u-/u-root/package.nix
@@ -1,23 +1,27 @@
 {
   lib,
-  buildGoModule,
+  # Build fails with Go 1.25, with the following error:
+  # 'vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go:64:9: invalid array length -delta * delta (constant -256 of type int64)'
+  # Wait for upstream to update their vendored dependencies before unpinning.
+  buildGo124Module,
   fetchFromGitHub,
   coreutils,
   bash,
+  nix-update-script,
 
   linuxManualConfig,
   fetchurl,
   linux_latest,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo124Module (finalAttrs: {
   pname = "u-root";
-  version = "0.14.0-unstable-2024-09-26";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "u-root";
     repo = "u-root";
-    rev = "a620c4fc0eeeaa71ea68c27d6ef96352ed814829";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-8B2H3AwGo9friveBk4bijOph9bSSNR7PPKJYEuywgm4=";
   };
 
@@ -52,6 +56,7 @@ buildGoModule (finalAttrs: {
       };
       allowImportFromDerivation = true;
     };
+    updateScript = nix-update-script { };
   };
 
   meta = {
diff --git a/pkgs/by-name/ut/utsushi/package.nix b/pkgs/by-name/ut/utsushi/package.nix
index e826fa31fb7a..22c6f722db32 100644
--- a/pkgs/by-name/ut/utsushi/package.nix
+++ b/pkgs/by-name/ut/utsushi/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitLab {
     owner = "utsushi";
-    repo = pname;
+    repo = "imagescan";
     rev = version;
     hash = "sha256-CrN9F/WJKmlDN7eozEHtKgGUQBWVwTqwjnrfiATk7lI=";
   };
diff --git a/pkgs/by-name/ve/versitygw/package.nix b/pkgs/by-name/ve/versitygw/package.nix
index cc404ffa0043..d3d3bcc06174 100644
--- a/pkgs/by-name/ve/versitygw/package.nix
+++ b/pkgs/by-name/ve/versitygw/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "versitygw";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchFromGitHub {
     owner = "versity";
     repo = "versitygw";
     tag = "v${version}";
-    hash = "sha256-MLM3pjcSV+4cpHcUP4m2YqadOEdwAnnk7IvaF9vXw48=";
+    hash = "sha256-RNxB0VxyYeR3CkzNVkDiAwV6qAUAl37JzHTSWbvaiTs=";
   };
 
-  vendorHash = "sha256-EV2GWfRvYHFosl2NjRkSu1acWKxcCd1I8gVvyXA4O1A=";
+  vendorHash = "sha256-YJ7p19o3SWLLdSRuqqIUvtyF6UBJ8AKhMqe7SuIIlG4=";
 
   doCheck = false; # Require access to online S3 services
 
diff --git a/pkgs/by-name/ve/veryl/package.nix b/pkgs/by-name/ve/veryl/package.nix
index c4e3fa5109e2..3e8644849033 100644
--- a/pkgs/by-name/ve/veryl/package.nix
+++ b/pkgs/by-name/ve/veryl/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "veryl";
-  version = "0.16.3";
+  version = "0.16.4";
 
   src = fetchFromGitHub {
     owner = "veryl-lang";
     repo = "veryl";
     rev = "v${version}";
-    hash = "sha256-oAA9EG06MTd88oiW93qIpnzjTWV2SoIDec/SLzI0ouQ=";
+    hash = "sha256-VT6ZYAqUEBkl8D7PMUEtTWkVuGPwFn1SVy1G/MH+3iQ=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-TtK8qGlioJ0yOrLhe2kQ/DrQmnz9wDJjRMS1r24HLE4=";
+  cargoHash = "sha256-7aOJGvWtk7sX1PFTM/wWr0/CnGpR1qQtfbamQUmNc/M=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 48eac470d55b..fd7f274670a6 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -233,7 +233,7 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [
       marcusramberg
       max06
-      rewine
+      wineee
     ];
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/wa/wasmer/package.nix b/pkgs/by-name/wa/wasmer/package.nix
index da8a9fe6ce71..ddde5f11434d 100644
--- a/pkgs/by-name/wa/wasmer/package.nix
+++ b/pkgs/by-name/wa/wasmer/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "wasmerio";
-    repo = pname;
+    repo = "wasmer";
     tag = "v${version}";
     hash = "sha256-rP0qvSb9PxsTMAq0hpB+zdSTHvridyCVdukLUYxdao8=";
   };
diff --git a/pkgs/by-name/wa/wayland-utils/package.nix b/pkgs/by-name/wa/wayland-utils/package.nix
index 81b68206db66..45e08d374eca 100644
--- a/pkgs/by-name/wa/wayland-utils/package.nix
+++ b/pkgs/by-name/wa/wayland-utils/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.freedesktop.org/wayland/wayland-utils";
     license = licenses.mit; # Expat version
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
     mainProgram = "wayland-info";
   };
 }
diff --git a/pkgs/by-name/we/wev/package.nix b/pkgs/by-name/we/wev/package.nix
index 7163cabb3a5a..ff5f9ed4b7a7 100644
--- a/pkgs/by-name/we/wev/package.nix
+++ b/pkgs/by-name/we/wev/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       X11 tool xev.
     '';
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     platforms = lib.platforms.linux;
     mainProgram = "wev";
   };
diff --git a/pkgs/by-name/wg/wgnord/package.nix b/pkgs/by-name/wg/wgnord/package.nix
index ee1a15285627..87bb9c2c984c 100644
--- a/pkgs/by-name/wg/wgnord/package.nix
+++ b/pkgs/by-name/wg/wgnord/package.nix
@@ -18,7 +18,7 @@ resholve.mkDerivation rec {
 
   src = fetchFromGitHub {
     owner = "phirecc";
-    repo = pname;
+    repo = "wgnord";
     rev = version;
     hash = "sha256-26cfYXtZVQ7kIRxY6oNGCqIjdw/hjwXhVKimVgolLgk=";
   };
diff --git a/pkgs/by-name/wi/wit-bindgen/package.nix b/pkgs/by-name/wi/wit-bindgen/package.nix
index c46ae38c27ff..b1e1d5b5e1d7 100644
--- a/pkgs/by-name/wi/wit-bindgen/package.nix
+++ b/pkgs/by-name/wi/wit-bindgen/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wit-bindgen";
-  version = "0.45.0";
+  version = "0.45.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wit-bindgen";
     rev = "v${version}";
-    hash = "sha256-xjDktIxNY8b0kAuHfX/EzvKO40xMVS1WfzYtX2fpffg=";
+    hash = "sha256-o5pWEh/AmYPsQjqn7amz3MYePdyi0JG1SYmOBQEmrsk=";
   };
 
-  cargoHash = "sha256-eOfHPhxMIE9VGMEW5crn5aXjFnbEHu0A4aUm+VFc3YU=";
+  cargoHash = "sha256-05h0NmN4UUtEFblt6MoX/XVya/KjmI68999Z2HufyUA=";
 
   # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
   # However, GitHub Actions ensures a proper build.
diff --git a/pkgs/by-name/wl/wlsunset/package.nix b/pkgs/by-name/wl/wlsunset/package.nix
index 321fbc1db3a3..11cc2044b9da 100644
--- a/pkgs/by-name/wl/wlsunset/package.nix
+++ b/pkgs/by-name/wl/wlsunset/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     changelog = "https://git.sr.ht/~kennylevinsen/wlsunset/refs/${version}";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     mainProgram = "wlsunset";
   };
 }
diff --git a/pkgs/by-name/wp/wprs/package.nix b/pkgs/by-name/wp/wprs/package.nix
index 6c156fad51db..1a08f85b024f 100644
--- a/pkgs/by-name/wp/wprs/package.nix
+++ b/pkgs/by-name/wp/wprs/package.nix
@@ -10,13 +10,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "wprs";
-  version = "0-unstable-2024-10-22";
+  version = "0-unstable-2025-09-05";
 
   src = fetchFromGitHub {
     owner = "wayland-transpositor";
     repo = "wprs";
-    rev = "6b993332c55568e66961b52bb6285e76d97d50df";
-    hash = "sha256-WrPr9b1r8As4Y5c+QCOYnHvY9x145+pL4OSmrGsYDpk=";
+    rev = "1eb482e0f80cc84a3ee55f7cda99df9bea6573af";
+    hash = "sha256-+m0gXQQa2NkUFNXfGPCwHTlyTFOw1nfjrUBgSD5iGMo=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,9 @@ rustPlatform.buildRustPackage {
     (python3.withPackages (pp: with pp; [ psutil ]))
   ];
 
-  cargoHash = "sha256-caf1d7SdAEc5RUDQCQkxlYw073gIUwlnvlVaX8gJGmc=";
+  cargoHash = "sha256-krrVgdoCcW3voSiQAoWsG+rPf1HYKbuGhplhn21as2c=";
+
+  RUSTFLAGS = "-C target-feature=+avx2"; # only works on x86 systems supporting AVX2
 
   preFixup = ''
     cp  wprs "$out/bin/wprs"
diff --git a/pkgs/by-name/wp/wpsoffice-cn/package.nix b/pkgs/by-name/wp/wpsoffice-cn/package.nix
index e7fd47ea7577..15d57395daab 100644
--- a/pkgs/by-name/wp/wpsoffice-cn/package.nix
+++ b/pkgs/by-name/wp/wpsoffice-cn/package.nix
@@ -172,7 +172,7 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [
       mlatus
       th0rgal
-      rewine
+      wineee
       pokon548
     ];
   };
diff --git a/pkgs/by-name/wp/wpsoffice/package.nix b/pkgs/by-name/wp/wpsoffice/package.nix
index 22a043865912..482f619ae81b 100644
--- a/pkgs/by-name/wp/wpsoffice/package.nix
+++ b/pkgs/by-name/wp/wpsoffice/package.nix
@@ -136,7 +136,7 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [
       mlatus
       th0rgal
-      rewine
+      wineee
       pokon548
     ];
   };
diff --git a/pkgs/by-name/xm/xmake/package.nix b/pkgs/by-name/xm/xmake/package.nix
index 800a39c558f9..6ad455131f89 100644
--- a/pkgs/by-name/xm/xmake/package.nix
+++ b/pkgs/by-name/xm/xmake/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://xmake.io";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
-      rewine
+      wineee
       rennsax
     ];
     mainProgram = "xmake";
diff --git a/pkgs/by-name/xs/xsane/package.nix b/pkgs/by-name/xs/xsane/package.nix
index d575092d9bf3..5746664e09b6 100644
--- a/pkgs/by-name/xs/xsane/package.nix
+++ b/pkgs/by-name/xs/xsane/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitLab {
     owner = "frontend";
     group = "sane-project";
-    repo = pname;
+    repo = "xsane";
     rev = version;
     hash = "sha256-oOg94nUsT9LLKnHocY0S5g02Y9a1UazzZAjpEI/s+yM=";
   };
diff --git a/pkgs/by-name/ya/yazi/plugins/gitui/default.nix b/pkgs/by-name/ya/yazi/plugins/gitui/default.nix
index bb1fff2babae..112d5f73e28a 100644
--- a/pkgs/by-name/ya/yazi/plugins/gitui/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/gitui/default.nix
@@ -3,16 +3,14 @@
   fetchFromGitHub,
   mkYaziPlugin,
 }:
-let
-  pname = "gitui.yazi";
-in
+
 mkYaziPlugin {
-  inherit pname;
+  pname = "gitui.yazi";
   version = "0-unstable-2025-05-26";
 
   src = fetchFromGitHub {
     owner = "gclarkjr5";
-    repo = pname;
+    repo = "gitui.yazi";
     rev = "397e9cf9cff536a43e746d72e0e81fd5c3050d2d";
     hash = "sha256-Bo16/5XuSxRhN6URwTBxuw0FTMHLF3nV1UDBQQJFHMM=";
   };
diff --git a/pkgs/by-name/yc/ycmd/package.nix b/pkgs/by-name/yc/ycmd/package.nix
index 5fa89a4f4848..520dd5f23461 100644
--- a/pkgs/by-name/yc/ycmd/package.nix
+++ b/pkgs/by-name/yc/ycmd/package.nix
@@ -21,15 +21,14 @@
 
 stdenv.mkDerivation {
   pname = "ycmd";
-  version = "0-unstable-2023-11-06";
-  disabled = !python3.isPy3k;
+  version = "0-unstable-2025-06-16";
 
   # required for third_party directory creation
   src = fetchFromGitHub {
     owner = "ycm-core";
     repo = "ycmd";
-    rev = "0607eed2bc211f88f82657b7781f4fe66579855b";
-    hash = "sha256-SzEcMQ4lX7NL2/g9tuhA6CaZ8pX/DGs7Fla/gr+RcOU=";
+    rev = "9160b4eee67ea61c8501bad36d061bcec5340021";
+    hash = "sha256-MSzYX1vXuhd4TNxUfHWaRu7O0r89az1XjZBIZ6B3gBk=";
     fetchSubmodules = true;
   };
 
@@ -46,6 +45,7 @@ stdenv.mkDerivation {
       boost
       libllvm.all
       libclang.all
+      legacy-cgi
     ]
     ++ [
       jedi
@@ -84,6 +84,9 @@ stdenv.mkDerivation {
     mkdir -p $out/bin
     ln -s $out/lib/ycmd/ycmd/__main__.py $out/bin/ycmd
 
+    ## Work-around CMake/Nix naming of `.so` output
+    ln -s $out/lib/ycmd/ycm_core.cpython-[[:digit:]-][^[:space:]]*-gnu${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/ycmd/ycm_core.so
+
     # Copy everything: the structure of third_party has been known to change.
     # When linking our own libraries below, do so with '-f'
     # to clobber anything we may have copied here.
@@ -120,6 +123,15 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Code-completion and comprehension server";
+    longDescription = ''
+      Note if YouCompleteMe Vim plugin complains with;
+
+      > ImportError: Python version mismatch: module was compiled for Python 3.13, but the interpreter version is incompatible: 3.10.18
+
+      ...  then set something similar to following in `programs.vim.extraConfig`;
+
+          let g:ycm_server_python_interpreter = "${python3.interpreter}"
+    '';
     mainProgram = "ycmd";
     homepage = "https://github.com/ycm-core/ycmd";
     license = licenses.gpl3;
@@ -127,6 +139,7 @@ stdenv.mkDerivation {
       rasendubi
       lnl7
       mel
+      S0AndS0
     ];
     platforms = platforms.all;
   };
diff --git a/pkgs/by-name/ze/zed-discord-presence/package.nix b/pkgs/by-name/ze/zed-discord-presence/package.nix
index 8ead3f68b229..8691887b9e61 100644
--- a/pkgs/by-name/ze/zed-discord-presence/package.nix
+++ b/pkgs/by-name/ze/zed-discord-presence/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-discord-presence";
-  version = "0.8.3";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "xhyrom";
     repo = "zed-discord-presence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0y28W54JZtjGmgrI7A0Ews+GKHK96nX0ejHMuqxjvh4=";
+    hash = "sha256-jqsXGNhvkQgGYHlv39zVZpQhSU5BUxHxl07x/yv7tzU=";
   };
 
   cargoBuildFlags = [ "--package discord-presence-lsp" ];
-  cargoHash = "sha256-D2apZowN+NDcMTLnGDbFUIdiGckFsuUhlrW6an8ZdGE=";
+  cargoHash = "sha256-1lcnw79UURe7LUuV2q9+CwUzVxG34J6cAxIgORbjLnU=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 4be54454a2b0..eb5b67bad57f 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -323,6 +323,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
       extraArgs = [
         "--version-regex"
         "^v(?!.*(?:-pre|0\.999999\.0|0\.9999-temporary)$)(.+)$"
+
+        # use github releases instead of git tags
+        # zed sometimes moves git tags, making them unreliable
+        # see: https://github.com/NixOS/nixpkgs/pull/439893#issuecomment-3250497178
+        "--use-github-releases"
       ];
     };
     fhs = fhs { zed-editor = finalAttrs.finalPackage; };
diff --git a/pkgs/desktops/gnome/extensions/systemd-manager/default.nix b/pkgs/desktops/gnome/extensions/systemd-manager/default.nix
index d5d559ab131d..33b6cae814fa 100644
--- a/pkgs/desktops/gnome/extensions/systemd-manager/default.nix
+++ b/pkgs/desktops/gnome/extensions/systemd-manager/default.nix
@@ -18,7 +18,7 @@ assert lib.elem allowPolkitPolicy [
 
 stdenvNoCC.mkDerivation rec {
   pname = "gnome-shell-extension-systemd-manager";
-  version = "18";
+  version = "19";
 
   # Upstream doesn't post new versions in extensions.gnome.org anymore, see also:
   # https://github.com/hardpixel/systemd-manager/issues/19
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation rec {
     owner = "hardpixel";
     repo = "systemd-manager";
     rev = "v${version}";
-    hash = "sha256-V4vYv1nAjFjvkSYdOpcpt8h9L+g0ch4V2VZRVSbtSKE=";
+    hash = "sha256-qmRDTyI2Kyr+ViNNgmna/E8xH1qzPyxzdPXyrwrgQGY=";
   };
 
   nativeBuildInputs = [ glib ];
diff --git a/pkgs/desktops/mate/mate-panel/default.nix b/pkgs/desktops/mate/mate-panel/default.nix
index 9a9d89effab2..abbe84809a73 100644
--- a/pkgs/desktops/mate/mate-panel/default.nix
+++ b/pkgs/desktops/mate/mate-panel/default.nix
@@ -31,14 +31,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-panel";
-  version = "1.28.5";
+  version = "1.28.6";
 
   src = fetchFromGitHub {
     owner = "mate-desktop";
     repo = "mate-panel";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-P1zrOH1xTbKXIoP13azAFDv2Q05dubR1AfmuLbgh250=";
+    hash = "sha256-jfPXvb/iQGP+WwhquKtQICDUtjMhBY10YY8+dMfM8S8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/ghc/9.2.4-binary.nix b/pkgs/development/compilers/ghc/9.2.4-binary.nix
index d867b7926684..2031babd4ebb 100644
--- a/pkgs/development/compilers/ghc/9.2.4-binary.nix
+++ b/pkgs/development/compilers/ghc/9.2.4-binary.nix
@@ -211,8 +211,6 @@ let
 
 in
 
-assert import ./common-have-ncg.nix { inherit lib stdenv version; };
-
 stdenv.mkDerivation {
   inherit version;
   pname = "ghc-binary${binDistUsed.variantSuffix}";
@@ -497,5 +495,6 @@ stdenv.mkDerivation {
     # `pkgsMusl`.
     platforms = builtins.attrNames ghcBinDists.${distSetName};
     teams = [ lib.teams.haskell ];
+    broken = !(import ./common-have-ncg.nix { inherit lib stdenv version; });
   };
 }
diff --git a/pkgs/development/compilers/ghc/9.6.3-binary.nix b/pkgs/development/compilers/ghc/9.6.3-binary.nix
index 1557cb48a3df..814c188be2da 100644
--- a/pkgs/development/compilers/ghc/9.6.3-binary.nix
+++ b/pkgs/development/compilers/ghc/9.6.3-binary.nix
@@ -210,8 +210,6 @@ let
 
 in
 
-assert import ./common-have-ncg.nix { inherit lib stdenv version; };
-
 stdenv.mkDerivation {
   inherit version;
   pname = "ghc-binary${binDistUsed.variantSuffix}";
@@ -471,5 +469,6 @@ stdenv.mkDerivation {
     # `pkgsMusl`.
     platforms = builtins.attrNames ghcBinDists.${distSetName};
     teams = [ lib.teams.haskell ];
+    broken = !(import ./common-have-ncg.nix { inherit lib stdenv version; });
   };
 }
diff --git a/pkgs/development/compilers/ghc/9.8.4-binary.nix b/pkgs/development/compilers/ghc/9.8.4-binary.nix
index b691715f8795..11422665a057 100644
--- a/pkgs/development/compilers/ghc/9.8.4-binary.nix
+++ b/pkgs/development/compilers/ghc/9.8.4-binary.nix
@@ -224,8 +224,6 @@ let
 
 in
 
-assert import ./common-have-ncg.nix { inherit lib stdenv version; };
-
 stdenv.mkDerivation {
   inherit version;
   pname = "ghc-binary${binDistUsed.variantSuffix}";
@@ -486,5 +484,6 @@ stdenv.mkDerivation {
     # `pkgsMusl`.
     platforms = builtins.attrNames ghcBinDists.${distSetName};
     maintainers = lib.teams.haskell.members;
+    broken = !(import ./common-have-ncg.nix { inherit lib stdenv version; });
   };
 }
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index ebbebb89a54d..a59d25aa51fe 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -33,9 +33,9 @@ let
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.0".officialRelease.sha256 = "sha256-4DLEZuhREHMl2t0f1iqvXSRSE5VBMVxd94Tj4m8Yf9s=";
     "22.0.0-git".gitRelease = {
-      rev = "0b42e117c829c6e127ef4b1bd82807ba01853128";
-      rev-version = "22.0.0-unstable-2025-08-31";
-      sha256 = "sha256-rClCPbTYqw0ZO9dJqJn3bqtuu9yxwcEfJs3vAW2xjAc=";
+      rev = "6fc32e93066c59a39b3c8c9be4e4f416653a917e";
+      rev-version = "22.0.0-unstable-2025-09-07";
+      sha256 = "sha256-CRveujx+4IwaNwopUInRbxdwnQb0bD60fzTfXpNZ3aE=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/coq-modules/coq-record-update/default.nix b/pkgs/development/coq-modules/coq-record-update/default.nix
index 982f9650a775..f703be52642b 100644
--- a/pkgs/development/coq-modules/coq-record-update/default.nix
+++ b/pkgs/development/coq-modules/coq-record-update/default.nix
@@ -15,9 +15,10 @@ mkCoqDerivation {
     in
     with lib.versions;
     lib.switch coq.coq-version [
-      (case (range "8.14" "9.1") "0.3.5")
+      (case (range "8.14" "9.1") "0.3.6")
       (case (range "8.10" "9.1") "0.3.4")
     ] null;
+  release."0.3.6".sha256 = "sha256-Sd9cmRPb/0MDlR9mzbFrrF9ifP/2vd0KG6u5fGOydds=";
   release."0.3.5".sha256 = "sha256-n2HjGD45Ikwhle8jKjum+Hv+4WrpEqKEbJ6iKfwlQKw=";
   release."0.3.4".sha256 = "sha256-AhEcugUiVIsgbq884Lur/bQIuGw8prk+3AlNkP1omcw=";
   release."0.3.3".sha256 = "sha256-HDIPeFHiC9EwhiOH7yMGJ9d2zJMhboTpRGf9kWcB9Io=";
diff --git a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
index 8f28e77d2612..cc2f839e0cca 100644
--- a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
@@ -32,6 +32,7 @@ mkCoqDerivation {
     lib.switch
       [ coq.coq-version mathcomp-algebra.version ]
       [
+        (case (range "8.20" "9.1") (isGe "2.4") "1.2.7")
         (case (range "8.20" "9.1") (isGe "2.4") "1.2.6")
         (case (range "8.20" "9.1") (isGe "2.4") "1.2.5")
         (case (range "8.16" "9.0") (isGe "2.0") "1.2.4")
@@ -48,6 +49,7 @@ mkCoqDerivation {
   release."1.2.4".sha256 = "sha256-BRxt0LGPz2u3kJRjcderaZqCfs8M8qKAAwNSWmIck7Q=";
   release."1.2.5".sha256 = "sha256-wTfe+g7ljWs1S+g02VQutnJGLVIOzNX1lm1HTMXeUUA=";
   release."1.2.6".sha256 = "sha256-D7EEiLeCJMgxsYvlAFyL7QZyx/KJAKesVE+vyfzqzkU=";
+  release."1.2.7".sha256 = "sha256-pCal3BPZ85SMAsEFAXRWWV7nuriHGWtyfNocJqsEmLk=";
 
   propagatedBuildInputs = [
     mathcomp-ssreflect
diff --git a/pkgs/development/libraries/agda/agda-categories/default.nix b/pkgs/development/libraries/agda/agda-categories/default.nix
index b59255e887f8..786c1164fb31 100644
--- a/pkgs/development/libraries/agda/agda-categories/default.nix
+++ b/pkgs/development/libraries/agda/agda-categories/default.nix
@@ -6,14 +6,14 @@
 }:
 
 mkDerivation rec {
-  version = "0.2.0";
+  version = "0.3.0";
   pname = "agda-categories";
 
   src = fetchFromGitHub {
     owner = "agda";
     repo = "agda-categories";
     rev = "v${version}";
-    sha256 = "sha256-GQuQxzYSQxAIVSJ1vf0blRC0juoxAqD1AHW66H/6NSk=";
+    sha256 = "sha256-zPh6RFnky4KsnQx5Y/3FeYZ/jWK+hqJGNyCjEFPPHWQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libwnck/default.nix b/pkgs/development/libraries/libwnck/default.nix
index d0a9c4867549..901d31669143 100644
--- a/pkgs/development/libraries/libwnck/default.nix
+++ b/pkgs/development/libraries/libwnck/default.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwnck";
-  version = "43.2";
+  version = "43.3";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libwnck/${lib.versions.major version}/libwnck-${version}.tar.xz";
-    sha256 = "VadETsH7uVwIbUCWc4jyMbXAu8jP+qCGv5KQrkSeUdU=";
+    sha256 = "avisQajwZ63h08qu0lSoNCO19hrT96Rg/Ky6wuGSvfc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/pdfhummus/default.nix b/pkgs/development/libraries/pdfhummus/default.nix
index e109d19c43d1..b73640354ddb 100644
--- a/pkgs/development/libraries/pdfhummus/default.nix
+++ b/pkgs/development/libraries/pdfhummus/default.nix
@@ -51,6 +51,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.pdfhummus.com";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
   };
 }
diff --git a/pkgs/development/libraries/qmarkdowntextedit/default.nix b/pkgs/development/libraries/qmarkdowntextedit/default.nix
index 77534706d243..7a9567b7f049 100644
--- a/pkgs/development/libraries/qmarkdowntextedit/default.nix
+++ b/pkgs/development/libraries/qmarkdowntextedit/default.nix
@@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/pbek/qmarkdowntextedit";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
   };
 }
diff --git a/pkgs/development/libraries/qtdbusextended/default.nix b/pkgs/development/libraries/qtdbusextended/default.nix
index c1cc09b29bc1..91ea9e49d356 100644
--- a/pkgs/development/libraries/qtdbusextended/default.nix
+++ b/pkgs/development/libraries/qtdbusextended/default.nix
@@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/nemomobile/qtdbusextended";
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
   };
 }
diff --git a/pkgs/development/libraries/qwlroots/default.nix b/pkgs/development/libraries/qwlroots/default.nix
index eaa7fb392e2c..eab87539f1d9 100644
--- a/pkgs/development/libraries/qwlroots/default.nix
+++ b/pkgs/development/libraries/qwlroots/default.nix
@@ -69,6 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
       asl20
     ];
     platforms = wlroots.meta.platforms;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
   };
 })
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 55e9408461a3..1e2e1aaa889d 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://gitlab.freedesktop.org/wayland/wayland-protocols";
     license = lib.licenses.mit; # Expat version
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     pkgConfigModules = [ "wayland-protocols" ];
   };
 
diff --git a/pkgs/development/libraries/waylib/default.nix b/pkgs/development/libraries/waylib/default.nix
index 6e6b76c45fec..b6cb99025d64 100644
--- a/pkgs/development/libraries/waylib/default.nix
+++ b/pkgs/development/libraries/waylib/default.nix
@@ -69,6 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
       asl20
     ];
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
   };
 })
diff --git a/pkgs/development/libraries/wayqt/default.nix b/pkgs/development/libraries/wayqt/default.nix
index a8c77cb48252..a48742949554 100644
--- a/pkgs/development/libraries/wayqt/default.nix
+++ b/pkgs/development/libraries/wayqt/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://gitlab.com/desktop-frameworks/wayqt";
     description = "Qt-based library to handle Wayland and Wlroots protocols to be used with any Qt project";
-    maintainers = with lib.maintainers; [ rewine ];
+    maintainers = with lib.maintainers; [ wineee ];
     platforms = lib.platforms.linux;
     license = lib.licenses.mit;
   };
diff --git a/pkgs/development/libraries/wlroots/default.nix b/pkgs/development/libraries/wlroots/default.nix
index 279daed5bc19..6cd9e74402ac 100644
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@@ -131,7 +131,7 @@ let
         platforms = lib.platforms.linux;
         maintainers = with lib.maintainers; [
           synthetica
-          rewine
+          wineee
         ];
         pkgConfigModules = [
           (
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index c8e24794e2c1..523735e7c897 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -191,6 +191,7 @@ mapAliases {
   rollup = throw "rollup has been removed because it was broken"; # added 2025-04-28
   inherit (pkgs) rtlcss; # added 2023-08-29
   s3http = throw "s3http was removed because it was abandoned upstream"; # added 2023-08-18
+  inherit (pkgs) serve; # added 2025-08-27
   inherit (pkgs) serverless; # Added 2023-11-29
   shout = throw "shout was removed because it was deprecated upstream in favor of thelounge."; # Added 2024-10-19
   inherit (pkgs) snyk; # Added 2023-08-30
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 9167fa3d6624..9ace13598dd7 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -139,7 +139,6 @@
 , "rimraf"
 , "sass"
 , "semver"
-, "serve"
 , "sloc"
 , "smartdc"
 , "speed-test"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 8e8fa9375329..fdb5911a3af1 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -62110,136 +62110,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  serve = nodeEnv.buildNodePackage {
-    name = "serve";
-    packageName = "serve";
-    version = "14.2.4";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/serve/-/serve-14.2.4.tgz";
-      sha512 = "qy1S34PJ/fcY8gjVGszDB3EXiPSk5FKhUa7tQe0UPRddxRidc2V6cNHPNewbE1D7MAkgLuWEt3Vw56vYy73tzQ==";
-    };
-    dependencies = [
-      sources."@zeit/schemas-2.36.0"
-      sources."accepts-1.3.8"
-      sources."ajv-8.12.0"
-      (
-        sources."ansi-align-3.0.1"
-        // {
-          dependencies = [
-            sources."ansi-regex-5.0.1"
-            sources."string-width-4.2.3"
-            sources."strip-ansi-6.0.1"
-          ];
-        }
-      )
-      sources."ansi-regex-6.1.0"
-      sources."ansi-styles-6.2.1"
-      sources."arch-2.2.0"
-      sources."arg-5.0.2"
-      sources."balanced-match-1.0.2"
-      sources."boxen-7.0.0"
-      sources."brace-expansion-1.1.11"
-      sources."bytes-3.0.0"
-      sources."camelcase-7.0.1"
-      sources."chalk-5.0.1"
-      (
-        sources."chalk-template-0.4.0"
-        // {
-          dependencies = [
-            sources."ansi-styles-4.3.0"
-            sources."chalk-4.1.2"
-          ];
-        }
-      )
-      sources."cli-boxes-3.0.0"
-      sources."clipboardy-3.0.0"
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      sources."compressible-2.0.18"
-      sources."compression-1.7.4"
-      sources."concat-map-0.0.1"
-      sources."content-disposition-0.5.2"
-      sources."cross-spawn-7.0.6"
-      sources."debug-2.6.9"
-      sources."deep-extend-0.6.0"
-      sources."eastasianwidth-0.2.0"
-      sources."emoji-regex-8.0.0"
-      sources."execa-5.1.1"
-      sources."fast-deep-equal-3.1.3"
-      sources."get-stream-6.0.1"
-      sources."has-flag-4.0.0"
-      sources."human-signals-2.1.0"
-      sources."ini-1.3.8"
-      sources."is-docker-2.2.1"
-      sources."is-fullwidth-code-point-3.0.0"
-      sources."is-port-reachable-4.0.0"
-      sources."is-stream-2.0.1"
-      sources."is-wsl-2.2.0"
-      sources."isexe-2.0.0"
-      sources."json-schema-traverse-1.0.0"
-      sources."merge-stream-2.0.0"
-      sources."mime-db-1.52.0"
-      sources."mime-types-2.1.35"
-      sources."mimic-fn-2.1.0"
-      sources."minimatch-3.1.2"
-      sources."minimist-1.2.8"
-      sources."ms-2.0.0"
-      sources."negotiator-0.6.3"
-      sources."npm-run-path-4.0.1"
-      sources."on-headers-1.0.2"
-      sources."onetime-5.1.2"
-      sources."path-is-inside-1.0.2"
-      sources."path-key-3.1.1"
-      sources."path-to-regexp-3.3.0"
-      sources."punycode-2.3.1"
-      sources."range-parser-1.2.0"
-      sources."rc-1.2.8"
-      sources."registry-auth-token-3.3.2"
-      sources."registry-url-3.1.0"
-      sources."require-from-string-2.0.2"
-      sources."safe-buffer-5.1.2"
-      (
-        sources."serve-handler-6.1.6"
-        // {
-          dependencies = [
-            sources."mime-db-1.33.0"
-            sources."mime-types-2.1.18"
-          ];
-        }
-      )
-      sources."shebang-command-2.0.0"
-      sources."shebang-regex-3.0.0"
-      sources."signal-exit-3.0.7"
-      (
-        sources."string-width-5.1.2"
-        // {
-          dependencies = [
-            sources."emoji-regex-9.2.2"
-          ];
-        }
-      )
-      sources."strip-ansi-7.1.0"
-      sources."strip-final-newline-2.0.0"
-      sources."strip-json-comments-2.0.1"
-      sources."supports-color-7.2.0"
-      sources."type-fest-2.19.0"
-      sources."update-check-1.5.4"
-      sources."uri-js-4.4.1"
-      sources."vary-1.1.2"
-      sources."which-2.0.2"
-      sources."widest-line-4.0.1"
-      sources."wrap-ansi-8.1.0"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "Static file serving and directory listing";
-      homepage = "https://github.com/vercel/serve#readme";
-      license = "MIT";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   sloc = nodeEnv.buildNodePackage {
     name = "sloc";
     packageName = "sloc";
diff --git a/pkgs/development/python-modules/bitsandbytes/default.nix b/pkgs/development/python-modules/bitsandbytes/default.nix
index a70ed26e6137..d1767fa005be 100644
--- a/pkgs/development/python-modules/bitsandbytes/default.nix
+++ b/pkgs/development/python-modules/bitsandbytes/default.nix
@@ -83,6 +83,8 @@ buildPythonPackage {
 
   nativeBuildInputs = [
     cmake
+  ]
+  ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc
   ];
 
@@ -96,7 +98,7 @@ buildPythonPackage {
   cmakeFlags = [
     (lib.cmakeFeature "COMPUTE_BACKEND" (if cudaSupport then "cuda" else "cpu"))
   ];
-  CUDA_HOME = "${cuda-native-redist}";
+  CUDA_HOME = lib.optionalString cudaSupport "${cuda-native-redist}";
   NVCC_PREPEND_FLAGS = lib.optionals cudaSupport [
     "-I${cuda-native-redist}/include"
     "-L${cuda-native-redist}/lib"
diff --git a/pkgs/development/python-modules/brother/default.nix b/pkgs/development/python-modules/brother/default.nix
index b58f8a9bd1d9..70a982334896 100644
--- a/pkgs/development/python-modules/brother/default.nix
+++ b/pkgs/development/python-modules/brother/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "brother";
-  version = "5.0.1";
+  version = "5.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = "brother";
     tag = version;
-    hash = "sha256-YgH/yPaOPL/HEK74riW881+cWFOq7P9jNmPHlaYIIEs=";
+    hash = "sha256-g0Xg12JV7CpgSzitEEzsFFpTKF644m6mbo1KgvhQOO4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/bytecode/default.nix b/pkgs/development/python-modules/bytecode/default.nix
index f5d0475a204b..44c5d26b298c 100644
--- a/pkgs/development/python-modules/bytecode/default.nix
+++ b/pkgs/development/python-modules/bytecode/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "bytecode";
-  version = "0.16.2";
+  version = "0.17.0";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "vstinner";
     repo = "bytecode";
     tag = version;
-    hash = "sha256-74qEwAYHXV4HakJQ05A9K7LuO0xP28Hub6no09KO4r4=";
+    hash = "sha256-AocS5Z4WkHTR+nO5/4B7oV/fb/ASG0aGrG/722Ioup0=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/colcon-recursive-crawl/default.nix b/pkgs/development/python-modules/colcon-recursive-crawl/default.nix
new file mode 100644
index 000000000000..809bfd171132
--- /dev/null
+++ b/pkgs/development/python-modules/colcon-recursive-crawl/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  # build-system
+  setuptools,
+  # dependencies
+  colcon,
+  # tests
+  pytestCheckHook,
+  scspell,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage rec {
+  pname = "colcon-recursive-crawl";
+  version = "0.2.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-recursive-crawl";
+    tag = version;
+    hash = "sha256-zmmEelMjsIbXy5LchZMtr2+x+Ne2c2PhexLjbkZJmm8=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTestPaths = [
+    # Skip the linter tests that require additional dependencies
+    "test/test_flake8.py"
+  ];
+
+  pythonImportsCheck = [ "colcon_recursive_crawl" ];
+
+  meta = {
+    description = "Extension for colcon to recursively crawl for packages";
+    homepage = "https://colcon.readthedocs.io/";
+    downloadPage = "https://github.com/colcon/colcon-recursive-crawl";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
diff --git a/pkgs/development/python-modules/cxxheaderparser/default.nix b/pkgs/development/python-modules/cxxheaderparser/default.nix
index dac17827d693..c4c39941a610 100644
--- a/pkgs/development/python-modules/cxxheaderparser/default.nix
+++ b/pkgs/development/python-modules/cxxheaderparser/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cxxheaderparser";
-  version = "1.5.4";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "robotpy";
     repo = "cxxheaderparser";
     rev = version;
-    hash = "sha256-56u7JPlms6ep53LsrDEkwctG2VQzmIVQyjSFLZaK95g=";
+    hash = "sha256-3nQCUb2sgF91ilREHj/fb8IoMTHjPoOFWGzkbssGqFY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dataclass-wizard/default.nix b/pkgs/development/python-modules/dataclass-wizard/default.nix
index 399c25a08fe9..570aa2e304c7 100644
--- a/pkgs/development/python-modules/dataclass-wizard/default.nix
+++ b/pkgs/development/python-modules/dataclass-wizard/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "dataclass-wizard";
-  version = "0.35.0";
+  version = "0.35.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rnag";
     repo = "dataclass-wizard";
     tag = "v${version}";
-    hash = "sha256-Ed9/y2blOGYfNcmCCAe4TPWssKWUS0gxvRXKMf+cJh0=";
+    hash = "sha256-GnD0Rxvy46+SLP5oFYVPO4+4VSBAPPRip//8e7xyylA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dissect-extfs/default.nix b/pkgs/development/python-modules/dissect-extfs/default.nix
index 44d613d00324..9e6398e12a44 100644
--- a/pkgs/development/python-modules/dissect-extfs/default.nix
+++ b/pkgs/development/python-modules/dissect-extfs/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-extfs";
-  version = "3.13";
+  version = "3.14";
   format = "pyproject";
 
   disabled = pythonOlder "3.12";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.extfs";
     tag = version;
-    hash = "sha256-MAe3AJlDn8CX9xO0XU369EXnvJXTBGYZ2xD+BjG2vk4=";
+    hash = "sha256-BoEvLDjLKXX0oNfKkgLFkNovJuQozsAt+W1efYsqiiU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dissect-shellitem/default.nix b/pkgs/development/python-modules/dissect-shellitem/default.nix
index 77381c9cd3dc..75e388a279c5 100644
--- a/pkgs/development/python-modules/dissect-shellitem/default.nix
+++ b/pkgs/development/python-modules/dissect-shellitem/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-shellitem";
-  version = "3.11";
+  version = "3.12";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.shellitem";
     tag = version;
-    hash = "sha256-mHcH6lgTyv1DlEccYRitfby7WMJc3/71ef/OurW3EEw=";
+    hash = "sha256-mklMNKW3amPed2qXWVUxl73O9iORdauTh1ZygY/rg7I=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/dissect-sql/default.nix b/pkgs/development/python-modules/dissect-sql/default.nix
index ec328ece8891..3974ecf9fae2 100644
--- a/pkgs/development/python-modules/dissect-sql/default.nix
+++ b/pkgs/development/python-modules/dissect-sql/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-sql";
-  version = "3.11";
+  version = "3.12";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.sql";
     tag = version;
-    hash = "sha256-1rIsG4TUv7JkNMiyGCbEEnnp2RccP8QksE91p3z1zjY=";
+    hash = "sha256-pkyiPyw6TOdi4kh/LusqWL2/UknQC48XkFiZr/4/fHg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/dissect-squashfs/default.nix b/pkgs/development/python-modules/dissect-squashfs/default.nix
index 63408a044e28..52fb4dfeae6d 100644
--- a/pkgs/development/python-modules/dissect-squashfs/default.nix
+++ b/pkgs/development/python-modules/dissect-squashfs/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-squashfs";
-  version = "1.9";
+  version = "1.10";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.squashfs";
     tag = version;
-    hash = "sha256-8u+pWUTUr4Warhb28XTxVU/jzOkXW+O6V8gDoAAlAbc=";
+    hash = "sha256-DFcC633TboQAwpLUKlRsVLN4PBGS8acOh/zCrv8ao8Y=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-pattern-library/default.nix b/pkgs/development/python-modules/django-pattern-library/default.nix
index da43dd05c8ac..1650bf9723d5 100644
--- a/pkgs/development/python-modules/django-pattern-library/default.nix
+++ b/pkgs/development/python-modules/django-pattern-library/default.nix
@@ -15,6 +15,7 @@
   beautifulsoup4,
   pytestCheckHook,
   pytest-django,
+  mkdocs,
 }:
 
 buildPythonPackage rec {
@@ -41,6 +42,7 @@ buildPythonPackage rec {
     beautifulsoup4
     pytestCheckHook
     pytest-django
+    mkdocs # only needed for jinja2, we don't build docs
   ];
 
   env.DJANGO_SETTINGS_MODULE = "tests.settings.dev";
diff --git a/pkgs/development/python-modules/docling-mcp/default.nix b/pkgs/development/python-modules/docling-mcp/default.nix
new file mode 100644
index 000000000000..58801822260f
--- /dev/null
+++ b/pkgs/development/python-modules/docling-mcp/default.nix
@@ -0,0 +1,101 @@
+{
+  lib,
+  accelerate,
+  buildPythonPackage,
+  docling,
+  fetchFromGitHub,
+  hatchling,
+  httpx,
+  llama-index-core,
+  llama-index-embeddings-huggingface,
+  llama-index-embeddings-openai,
+  llama-index-llms-openai-like,
+  llama-index-node-parser-docling,
+  llama-index-readers-docling,
+  llama-index-readers-file,
+  llama-index-vector-stores-milvus,
+  llama-index,
+  llama-stack-client,
+  mcp,
+  ollama,
+  pydantic-settings,
+  pydantic,
+  pytest-asyncio,
+  pytestCheckHook,
+  python-dotenv,
+  smolagents,
+  torch,
+  transformers,
+}:
+
+buildPythonPackage rec {
+  pname = "docling-mcp";
+  version = "1.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "docling-project";
+    repo = "docling-mcp";
+    tag = "v${version}";
+    hash = "sha256-ktJ5K+1Qb7/lUHPkmv2FMnSe6PiIQ1BvWj5qIG8xfdE=";
+  };
+
+  pythonRemoveDeps = [
+    # Disabled due to circular dependency
+    "mellea"
+  ];
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    docling
+    httpx
+    mcp
+    pydantic
+    pydantic-settings
+    python-dotenv
+  ];
+
+  optional-dependencies = {
+    llama-index-rag = [
+      llama-index
+      llama-index-core
+      llama-index-embeddings-huggingface
+      llama-index-embeddings-openai
+      llama-index-llms-openai-like
+      llama-index-node-parser-docling
+      llama-index-readers-docling
+      llama-index-readers-file
+      llama-index-vector-stores-milvus
+    ];
+    llama-stack = [ llama-stack-client ];
+    smolagents = [
+      accelerate
+      ollama
+      smolagents
+      torch
+      transformers
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "docling_mcp" ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/test_mcp_server.py"
+    "tests/test_conversion_tools.py"
+  ];
+
+  meta = {
+    description = "Making docling agentic through MCP";
+    homepage = "https://github.com/docling-project/docling-mcp";
+    changelog = "https://github.com/docling-project/docling-mcp/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/docling-serve/default.nix b/pkgs/development/python-modules/docling-serve/default.nix
index 6d1074cfff11..bf3ebf1827c0 100644
--- a/pkgs/development/python-modules/docling-serve/default.nix
+++ b/pkgs/development/python-modules/docling-serve/default.nix
@@ -7,6 +7,7 @@
   # python dependencies
   docling,
   docling-jobkit,
+  docling-mcp,
   fastapi,
   httpx,
   pydantic-settings,
@@ -57,6 +58,7 @@ buildPythonPackage rec {
   dependencies = [
     docling
     (docling-jobkit.override { inherit withTesserocr withRapidocr; })
+    docling-mcp
     fastapi
     httpx
     pydantic-settings
diff --git a/pkgs/development/python-modules/ffmpeg-progress-yield/default.nix b/pkgs/development/python-modules/ffmpeg-progress-yield/default.nix
index 8470813caa61..167398c0c2cf 100644
--- a/pkgs/development/python-modules/ffmpeg-progress-yield/default.nix
+++ b/pkgs/development/python-modules/ffmpeg-progress-yield/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
@@ -40,6 +41,16 @@ buildPythonPackage rec {
 
   enabledTestPaths = [ "test/test.py" ];
 
+  disabledTests = lib.optional stdenv.hostPlatform.isDarwin [
+    # cannot access /usr/bin/pgrep from the sandbox
+    "test_context_manager"
+    "test_context_manager_with_exception"
+    "test_automatic_cleanup_on_exception"
+    "test_async_context_manager"
+    "test_async_context_manager_with_exception"
+    "test_async_automatic_cleanup_on_exception"
+  ];
+
   pythonImportsCheck = [ "ffmpeg_progress_yield" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 905dc5d47a04..35a729767ce8 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -9,27 +9,36 @@
   config,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
-  cudaPackages,
+
+  # nativeBuildInputs
   cmake,
   ninja,
-  numpy,
-  torch,
-  pynvml,
+  cudaPackages,
+
+  # dependencies
+  click,
   einops,
+  numpy,
+  pynvml,
+  tabulate,
+  torch,
+  tqdm,
 }:
 
 buildPythonPackage rec {
   pname = "flashinfer";
-  version = "0.2.14";
+  version = "0.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "flashinfer-ai";
     repo = "flashinfer";
     tag = "v${version}";
-    hash = "sha256-MZiZwdedz+Vxa1+VBfHDKf4NVSiOAytGboIJ0DvCXmk=";
     fetchSubmodules = true;
+    hash = "sha256-e9PfLfU0DdoLKlXiHylCbGd125c7Iw9y4NDIOAP0xHs=";
   };
 
   build-system = [ setuptools ];
@@ -68,16 +77,22 @@ buildPythonPackage rec {
     export MAX_JOBS="$NIX_BUILD_CORES"
   '';
 
-  TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" torch.cudaCapabilities;
+  FLASHINFER_CUDA_ARCH_LIST = lib.concatStringsSep ";" torch.cudaCapabilities;
 
+  pythonRemoveDeps = [
+    "nvidia-cudnn-frontend"
+  ];
   dependencies = [
-    numpy
-    torch
-    pynvml
+    click
     einops
+    numpy
+    pynvml
+    tabulate
+    torch
+    tqdm
   ];
 
-  meta = with lib; {
+  meta = {
     broken = !torch.cudaSupport || !config.cudaSupport;
     homepage = "https://flashinfer.ai/";
     description = "Library and kernel generator for Large Language Models";
@@ -88,7 +103,7 @@ buildPythonPackage rec {
       and inference, and delivers state-of-the-art performance across diverse
       scenarios.
     '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ breakds ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ breakds ];
   };
 }
diff --git a/pkgs/development/python-modules/genie-partner-sdk/default.nix b/pkgs/development/python-modules/genie-partner-sdk/default.nix
index 429aa38baa56..6d5eb32c95e8 100644
--- a/pkgs/development/python-modules/genie-partner-sdk/default.nix
+++ b/pkgs/development/python-modules/genie-partner-sdk/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "genie-partner-sdk";
-  version = "1.0.10";
+  version = "1.0.11";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "genie_partner_sdk";
-    hash = "sha256-wADTKmR/9p60VJtbK+chUfZuyHe8fYkDSzFHALpXApg=";
+    hash = "sha256-eNeN+mtpPzY6p0iVo/ot0eLza/aeJP70PxNHx7/MVoY=";
   };
 
   nativeBuildInputs = [ hatchling ];
diff --git a/pkgs/development/python-modules/geoarrow-c/default.nix b/pkgs/development/python-modules/geoarrow-c/default.nix
index d7b0eb34909b..c6832a88715a 100644
--- a/pkgs/development/python-modules/geoarrow-c/default.nix
+++ b/pkgs/development/python-modules/geoarrow-c/default.nix
@@ -49,5 +49,6 @@ buildPythonPackage rec {
     maintainers = with maintainers; [
       cpcloud
     ];
+    teams = [ lib.teams.geospatial ];
   };
 }
diff --git a/pkgs/development/python-modules/geoarrow-pandas/default.nix b/pkgs/development/python-modules/geoarrow-pandas/default.nix
index 5a68d34cc8dd..3ade7c417748 100644
--- a/pkgs/development/python-modules/geoarrow-pandas/default.nix
+++ b/pkgs/development/python-modules/geoarrow-pandas/default.nix
@@ -48,5 +48,6 @@ buildPythonPackage rec {
     maintainers = with maintainers; [
       cpcloud
     ];
+    teams = [ lib.teams.geospatial ];
   };
 }
diff --git a/pkgs/development/python-modules/geoarrow-pyarrow/default.nix b/pkgs/development/python-modules/geoarrow-pyarrow/default.nix
index c06a2f649057..371c6b2614e1 100644
--- a/pkgs/development/python-modules/geoarrow-pyarrow/default.nix
+++ b/pkgs/development/python-modules/geoarrow-pyarrow/default.nix
@@ -73,5 +73,6 @@ buildPythonPackage rec {
     maintainers = with maintainers; [
       cpcloud
     ];
+    teams = [ lib.teams.geospatial ];
   };
 }
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index 0bf427e96098..bede5d9b0f33 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "1.13.0";
+  version = "1.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkdocstrings";
     repo = "griffe";
     tag = version;
-    hash = "sha256-PaOdK9ZMId87Hg1QzSX2SsgNED3kOFolUfSWSZ42VSQ=";
+    hash = "sha256-0koTrA1b3S1NO6w24S8eghWpYDkGEo61giRveQ7MZhM=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/kernels/default.nix b/pkgs/development/python-modules/kernels/default.nix
index 47e087b90b3f..5d69e12affcb 100644
--- a/pkgs/development/python-modules/kernels/default.nix
+++ b/pkgs/development/python-modules/kernels/default.nix
@@ -7,14 +7,14 @@
 }:
 buildPythonPackage rec {
   pname = "kernels";
-  version = "0.9.0";
+  version = "0.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "kernels";
     tag = "v${version}";
-    hash = "sha256-lREccuvahjNV44reYNF8fkJ2o4fMZRB9Ddr9r4HmT2k=";
+    hash = "sha256-3V7dE22wfT/cbw0n2sAGlzrajXO9t0Qd2ffWhfuSZS0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/litestar/default.nix b/pkgs/development/python-modules/litestar/default.nix
index f8c95329e9b5..7115f038800c 100644
--- a/pkgs/development/python-modules/litestar/default.nix
+++ b/pkgs/development/python-modules/litestar/default.nix
@@ -61,14 +61,14 @@
 
 buildPythonPackage rec {
   pname = "litestar";
-  version = "2.16.0";
+  version = "2.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "litestar-org";
     repo = "litestar";
     tag = "v${version}";
-    hash = "sha256-67O/NxPBBLa1QfH1o9laOAQEin8jRA8SkcV7QEzCjI0=";
+    hash = "sha256-jUd0Nf3OmcKmO7DAXMqBXZPw3+heAQszcgE2xT+lAyA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/llama-index-node-parser-docling/default.nix b/pkgs/development/python-modules/llama-index-node-parser-docling/default.nix
new file mode 100644
index 000000000000..8d6b4774997e
--- /dev/null
+++ b/pkgs/development/python-modules/llama-index-node-parser-docling/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  docling-core,
+  fetchPypi,
+  hatchling,
+  llama-index-core,
+}:
+
+buildPythonPackage rec {
+  pname = "llama-index-node-parser-docling";
+  version = "0.4.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "llama_index_node_parser_docling";
+    inherit version;
+    hash = "sha256-3D2X5sKAaweJG5w5qVeCEMgvKPZVUdI4/GsSwB9zfQ4=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    docling-core
+    llama-index-core
+  ];
+
+  pythonImportsCheck = [ "llama_index.node_parser.docling" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Llama-index node_parser docling integration";
+    homepage = "https://pypi.org/project/llama-index-node-parser-docling/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/llama-index-readers-docling/default.nix b/pkgs/development/python-modules/llama-index-readers-docling/default.nix
new file mode 100644
index 000000000000..fdad8918d170
--- /dev/null
+++ b/pkgs/development/python-modules/llama-index-readers-docling/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  docling-core,
+  docling,
+  fetchPypi,
+  hatchling,
+  llama-index-core,
+  numpy,
+}:
+
+buildPythonPackage rec {
+  pname = "llama-index-readers-docling";
+  version = "0.4.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "llama_index_readers_docling";
+    inherit version;
+    hash = "sha256-b9UxJWlh/KnfTIOcKe9jiWCD1VknqeJH2hQjrDNmsOg=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    docling
+    docling-core
+    llama-index-core
+    numpy
+  ];
+
+  pythonImportsCheck = [ "llama_index.readers.docling" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Llama-index readers docling integration";
+    homepage = "https://pypi.org/project/llama-index-readers-docling/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix
new file mode 100644
index 000000000000..e1b95f532a69
--- /dev/null
+++ b/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  hatchling,
+  llama-index-core,
+  pymilvus,
+}:
+
+buildPythonPackage rec {
+  pname = "llama-index-vector-stores-milvus";
+  version = "0.9.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "llama_index_vector_stores_milvus";
+    inherit version;
+    hash = "sha256-8alWmT1CglPpvDqbav7AoahIOcabchsiUmrAbBeOyZI=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    llama-index-core
+    pymilvus
+  ];
+
+  pythonImportsCheck = [ "llama_index.vector_stores.milvus" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Llama-index vector_stores milvus integration";
+    homepage = "https://pypi.org/project/llama-index-vector-stores-milvus/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/llama-stack-client/default.nix b/pkgs/development/python-modules/llama-stack-client/default.nix
new file mode 100644
index 000000000000..3212702eb680
--- /dev/null
+++ b/pkgs/development/python-modules/llama-stack-client/default.nix
@@ -0,0 +1,103 @@
+{
+  lib,
+  aiohttp,
+  anyio,
+  buildPythonPackage,
+  click,
+  dirty-equals,
+  distro,
+  fetchPypi,
+  fire,
+  hatch-fancy-pypi-readme,
+  hatchling,
+  httpx-aiohttp,
+  httpx,
+  nest-asyncio,
+  pandas,
+  prompt-toolkit,
+  pyaml,
+  pydantic,
+  pytest-asyncio,
+  pytest-xdist,
+  pytestCheckHook,
+  requests,
+  respx,
+  rich,
+  sniffio,
+  termcolor,
+  tqdm,
+  typing-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "llama-stack-client";
+  version = "0.2.20";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "llama_stack_client";
+    inherit version;
+    hash = "sha256-NWJX8KS7tkIF+J4RPXFZJYU9XjTsdE5yRm2nJ5C6QVs=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "hatchling==1.26.3" "hatchling"
+  '';
+
+  build-system = [
+    hatch-fancy-pypi-readme
+    hatchling
+  ];
+
+  dependencies = [
+    anyio
+    click
+    distro
+    fire
+    httpx
+    pandas
+    prompt-toolkit
+    pyaml
+    pydantic
+    requests
+    rich
+    sniffio
+    termcolor
+    tqdm
+    typing-extensions
+  ];
+
+  optional-dependencies = {
+    aiohttp = [
+      aiohttp
+      httpx-aiohttp
+    ];
+  };
+
+  nativeCheckInputs = [
+    dirty-equals
+    nest-asyncio
+    pytest-asyncio
+    pytest-xdist
+    pytestCheckHook
+    respx
+  ]
+  ++ lib.flatten (builtins.attrValues optional-dependencies);
+
+  pythonImportsCheck = [ "llama_stack_client" ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/api_resources/"
+    "tests/test_client.py"
+  ];
+
+  meta = {
+    description = "Library for the llama-stack-client API";
+    homepage = "https://github.com/llamastack/llama-stack-client-python";
+    changelog = "https://github.com/llamastack/llama-stack-client-python/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/mapclassify/default.nix b/pkgs/development/python-modules/mapclassify/default.nix
index ef30592b9b66..2ce7804f896b 100644
--- a/pkgs/development/python-modules/mapclassify/default.nix
+++ b/pkgs/development/python-modules/mapclassify/default.nix
@@ -48,10 +48,16 @@ buildPythonPackage rec {
 
   # requires network access
   disabledTestPaths = [
+    # this module does http requests *at import time*
     "mapclassify/tests/test_greedy.py"
+    # depends on remote data
     "mapclassify/tests/test_rgba.py"
-    # Abort trap: 6
-    "mapclassify/tests/test_mapclassify.py"
+  ];
+
+  disabledTests = [
+    # depends on remote datasets
+    "test_legendgram_map"
+    "test_legendgram_most_recent_cmap"
   ];
 
   pythonImportsCheck = [ "mapclassify" ];
diff --git a/pkgs/development/python-modules/mplhep/default.nix b/pkgs/development/python-modules/mplhep/default.nix
index 36729e8c5285..1f35dee40c2f 100644
--- a/pkgs/development/python-modules/mplhep/default.nix
+++ b/pkgs/development/python-modules/mplhep/default.nix
@@ -57,10 +57,9 @@ buildPythonPackage rec {
     uproot
   ];
 
-  disabledTests = [
+  disabledTestPaths = [
     # requires uproot4
-    "test_inputs_uproot"
-    "test_uproot_versions"
+    "tests/test_inputs.py"
   ];
 
   pythonImportsCheck = [ "mplhep" ];
diff --git a/pkgs/development/python-modules/niworkflows/default.nix b/pkgs/development/python-modules/niworkflows/default.nix
index 9b4ab372c23f..22cf18ead7fb 100644
--- a/pkgs/development/python-modules/niworkflows/default.nix
+++ b/pkgs/development/python-modules/niworkflows/default.nix
@@ -40,14 +40,14 @@
 
 buildPythonPackage rec {
   pname = "niworkflows";
-  version = "1.13.5";
+  version = "1.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nipreps";
     repo = "niworkflows";
     tag = version;
-    hash = "sha256-Q43IXlzmCO7m9y/tRlJJ2Dz4wNeK+kXtLLLrthO+n58=";
+    hash = "sha256-QmIsbuw+W7lPpoxz0aEB1N4HZFHIPPewrIcyMB5DPJw=";
   };
 
   pythonRelaxDeps = [ "traits" ];
diff --git a/pkgs/development/python-modules/parsedmarc/default.nix b/pkgs/development/python-modules/parsedmarc/default.nix
index 3a9252f15d06..45ed7d0f1636 100644
--- a/pkgs/development/python-modules/parsedmarc/default.nix
+++ b/pkgs/development/python-modules/parsedmarc/default.nix
@@ -48,14 +48,14 @@ let
 in
 buildPythonPackage rec {
   pname = "parsedmarc";
-  version = "8.18.6";
+  version = "6.18.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "domainaware";
     repo = "parsedmarc";
     tag = version;
-    hash = "sha256-wwncnkZnd8GsjvwsuJEgFYCtapzGYYcVBRYoJ1cwVEw=";
+    hash = "sha256-AjRYd3uN76Zl7IEXqFK+qssAvuS+TbT+mZL+pPlxDwc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pinecone-plugin-assistant/default.nix b/pkgs/development/python-modules/pinecone-plugin-assistant/default.nix
index ed8bdb5847a4..9cbabf17e9e3 100644
--- a/pkgs/development/python-modules/pinecone-plugin-assistant/default.nix
+++ b/pkgs/development/python-modules/pinecone-plugin-assistant/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pinecone-plugin-assistant";
-  version = "1.7.0";
+  version = "1.8.0";
 
   pyproject = true;
 
   src = fetchPypi {
     pname = "pinecone_plugin_assistant";
     inherit version;
-    hash = "sha256-4m47oQqLccPaDXd8/0B2aAIugpY8SRPQ/+tsVSch5II=";
+    hash = "sha256-joaCz/MPm66SQ7OEAhq6cckfTm7xZQ6dY+5kqrg8uoc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyqt/6.x.nix b/pkgs/development/python-modules/pyqt/6.x.nix
index 8671534aa7a1..492550a0eded 100644
--- a/pkgs/development/python-modules/pyqt/6.x.nix
+++ b/pkgs/development/python-modules/pyqt/6.x.nix
@@ -118,6 +118,7 @@ buildPythonPackage rec {
       qtquicktimeline
     ]
     # ++ lib.optional withConnectivity qtconnectivity
+    ++ lib.optional withMultimedia qtmultimedia
     ++ lib.optional withWebSockets qtwebsockets
     ++ lib.optional withLocation qtlocation
     ++ lib.optional withSerialPort qtserialport;
diff --git a/pkgs/development/python-modules/python-octaviaclient/default.nix b/pkgs/development/python-modules/python-octaviaclient/default.nix
index 950c3344c066..42c6552612a2 100644
--- a/pkgs/development/python-modules/python-octaviaclient/default.nix
+++ b/pkgs/development/python-modules/python-octaviaclient/default.nix
@@ -30,13 +30,13 @@
 
 buildPythonPackage rec {
   pname = "python-octaviaclient";
-  version = "3.11.1";
+  version = "3.12.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "python_octaviaclient";
     inherit version;
-    hash = "sha256-M+JRUMsTq46+UpqSKFzvtRXsaboUKTuqwWs29v09q04=";
+    hash = "sha256-5brfxkpJQousEcXl0YerzYDjrfl0XyWV0RXPTz146Y4=";
   };
 
   # somehow python-neutronclient cannot be found despite it being supplied
diff --git a/pkgs/development/python-modules/python-zunclient/default.nix b/pkgs/development/python-modules/python-zunclient/default.nix
index b7164d3a1c62..0dba0ccb0bf7 100644
--- a/pkgs/development/python-modules/python-zunclient/default.nix
+++ b/pkgs/development/python-modules/python-zunclient/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "python-zunclient";
-  version = "5.2.1";
+  version = "5.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "openstack";
     repo = "python-zunclient";
     tag = version;
-    hash = "sha256-YdE5a/qm91Nv2TW9pot9sn5GwvnFuqPCgiuLF6O7reA=";
+    hash = "sha256-qBpsahkVZEQwsVcNJFtRSJvvxGITauAJ6Zv8p+70hh0=";
   };
 
   env.PBR_VERSION = version;
diff --git a/pkgs/development/python-modules/reqif/default.nix b/pkgs/development/python-modules/reqif/default.nix
index 0e6424ab85e7..884c0905e21e 100644
--- a/pkgs/development/python-modules/reqif/default.nix
+++ b/pkgs/development/python-modules/reqif/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "reqif";
-  version = "0.0.46";
+  version = "0.0.47";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "strictdoc-project";
     repo = "reqif";
     tag = version;
-    hash = "sha256-QI+OhhV+jKw3g2erSCdTj10JW+XFQQyXuAC0LAnts7c=";
+    hash = "sha256-z7krly5X5OlrmAlm4bZZ3eP8lvx3HUY3Z8K/6AiBOfQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/rpy2-rinterface/default.nix b/pkgs/development/python-modules/rpy2-rinterface/default.nix
new file mode 100644
index 000000000000..13b20da717c8
--- /dev/null
+++ b/pkgs/development/python-modules/rpy2-rinterface/default.nix
@@ -0,0 +1,79 @@
+{
+  stdenv,
+  lib,
+  buildPythonPackage,
+  fetchurl,
+  isPyPy,
+  R,
+  rWrapper,
+  xz,
+  bzip2,
+  zlib,
+  zstd,
+  icu,
+  pytestCheckHook,
+  setuptools,
+  cffi,
+}:
+
+buildPythonPackage rec {
+  version = "3.6.3";
+  format = "pyproject";
+  pname = "rpy2-rinterface";
+
+  disabled = isPyPy;
+  src = fetchurl {
+    url = "mirror://pypi/${builtins.substring 0 1 pname}/${pname}/${
+      builtins.replaceStrings [ "-" ] [ "_" ] pname
+    }-${version}.tar.gz";
+    hash = "sha256-R3vC9R0AetG4VnxdS6GvD1mVFobufxBXagbQg03ld28=";
+  };
+
+  patches = [
+    # https://github.com/rpy2/rpy2/pull/1171#issuecomment-3263994962
+    ./restore-initr-simple.patch
+
+    # R_LIBS_SITE is used by the nix r package to point to the installed R libraries.
+    # This patch sets R_LIBS_SITE when rpy2 is imported.
+    ./rpy2-3.x-r-libs-site.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace 'src/rpy2/rinterface_lib/embedded.py' --replace '@NIX_R_LIBS_SITE@' "$R_LIBS_SITE"
+  '';
+
+  buildInputs = [
+    xz
+    bzip2
+    zlib
+    zstd
+    icu
+  ]
+  ++ rWrapper.recommendedPackages;
+
+  nativeBuildInputs = [
+    R # needed at setup time to detect R_HOME (alternatively set R_HOME explicitly)
+  ];
+
+  propagatedBuildInputs = [
+    cffi
+    setuptools
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  # https://github.com/rpy2/rpy2/issues/1111
+  disabledTests = [
+    "test_parse_incomplete_error"
+    "test_parse_error"
+    "test_parse_error_when_evaluting"
+  ];
+
+  meta = {
+    homepage = "https://rpy2.github.io/";
+    description = "Python interface to R";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib; [ teams.sage ];
+  };
+}
diff --git a/pkgs/development/python-modules/rpy2-rinterface/restore-initr-simple.patch b/pkgs/development/python-modules/rpy2-rinterface/restore-initr-simple.patch
new file mode 100644
index 000000000000..fd41ae661134
--- /dev/null
+++ b/pkgs/development/python-modules/rpy2-rinterface/restore-initr-simple.patch
@@ -0,0 +1,20 @@
+diff --git a/src/rpy2/rinterface/__init__.py b/src/rpy2/rinterface/__init__.py
+index 0ba46083..1f4265aa 100644
+--- a/src/rpy2/rinterface/__init__.py
++++ b/src/rpy2/rinterface/__init__.py
+@@ -1100,6 +1100,15 @@ NA = None
+ NA_Real = None
+ NA_Complex = None
+ 
++def initr_simple() -> typing.Optional[int]:
++    """Initialize R's embedded C library."""
++    with openrlib.rlock:
++        status = embedded._initr()
++        atexit.register(endr, 0)
++        _rinterface._register_external_symbols()
++        _post_initr_setup()
++        return status
++
+ 
+ def initr(
+         interactive: typing.Optional[bool] = None,
diff --git a/pkgs/development/python-modules/rpy2-rinterface/rpy2-3.x-r-libs-site.patch b/pkgs/development/python-modules/rpy2-rinterface/rpy2-3.x-r-libs-site.patch
new file mode 100644
index 000000000000..549270ee30e8
--- /dev/null
+++ b/pkgs/development/python-modules/rpy2-rinterface/rpy2-3.x-r-libs-site.patch
@@ -0,0 +1,19 @@
+diff --git a/src/rpy2/rinterface_lib/embedded.py b/src/rpy2/rinterface_lib/embedded.py
+index cc9f7da1..10626f13 100644
+--- a/src/rpy2/rinterface_lib/embedded.py b/src/rpy2/rinterface_lib/embedded.py
+@@ -328,6 +328,15 @@ def _initr(
+             _setinitialized()
+             return None
+ 
++        # path to libraries
++        existing = os.environ.get('R_LIBS_SITE')
++        if existing is not None:
++            prefix = existing + ':'
++        else:
++            prefix = ''
++        additional = '@NIX_R_LIBS_SITE@'
++        os.environ['R_LIBS_SITE'] = prefix + additional
++
+         # TODO: Setting LD_LIBRARY_PATH after the process has started
+         # is too late. Because of this, the line below does not help
+         # address issues where calling R from the command line is working
diff --git a/pkgs/development/python-modules/rpy2-robjects/default.nix b/pkgs/development/python-modules/rpy2-robjects/default.nix
new file mode 100644
index 000000000000..566cf7581068
--- /dev/null
+++ b/pkgs/development/python-modules/rpy2-robjects/default.nix
@@ -0,0 +1,63 @@
+{
+  stdenv,
+  lib,
+  buildPythonPackage,
+  fetchurl,
+  fetchpatch2,
+  isPyPy,
+  R,
+  rpy2-rinterface,
+  ipython,
+  jinja2,
+  numpy,
+  pandas,
+  tzlocal,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  version = "3.6.2";
+  format = "pyproject";
+  pname = "rpy2-robjects";
+
+  disabled = isPyPy;
+  src = fetchurl {
+    url = "mirror://pypi/${builtins.substring 0 1 pname}/${pname}/${
+      builtins.replaceStrings [ "-" ] [ "_" ] pname
+    }-${version}.tar.gz";
+    hash = "sha256-rJGvMtXE2iNrBaPNaNr7JM2PWogPAHhim48r8CUFQjs=";
+  };
+
+  patches = [
+    # https://github.com/rpy2/rpy2/pull/1171#issuecomment-3263994962
+    (fetchpatch2 {
+      url = "https://github.com/rpy2/rpy2/commit/524546eef9b8f7f3d61aeb76d7e7fa7beeabd2d2.patch?full_index=1";
+      hash = "sha256-aR44E8wIBlD7UpQKm7B+aMn2p3FQ8dwBwLwkibIpcuM=";
+      relative = "rpy2-robjects";
+      revert = true;
+    })
+  ];
+
+  nativeBuildInputs = [
+    R # needed at setup time to detect R_HOME (alternatively set R_HOME explicitly)
+  ];
+
+  propagatedBuildInputs = [
+    ipython
+    jinja2
+    numpy
+    pandas
+    rpy2-rinterface
+    tzlocal
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    homepage = "https://rpy2.github.io/";
+    description = "Python interface to R";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ joelmo ];
+  };
+}
diff --git a/pkgs/development/python-modules/rpy2/default.nix b/pkgs/development/python-modules/rpy2/default.nix
index 0f6b273fa3ab..664b81ea843b 100644
--- a/pkgs/development/python-modules/rpy2/default.nix
+++ b/pkgs/development/python-modules/rpy2/default.nix
@@ -4,99 +4,31 @@
   buildPythonPackage,
   fetchPypi,
   isPyPy,
-  R,
-  libdeflate,
-  rWrapper,
-  rPackages,
-  pcre,
-  xz,
-  bzip2,
-  zlib,
-  zstd,
-  icu,
-  ipython,
-  jinja2,
-  pytz,
-  pandas,
-  numpy,
-  cffi,
-  tzlocal,
-  simplegeneric,
+  rpy2-rinterface,
+  rpy2-robjects,
   pytestCheckHook,
-  extraRPackages ? [ ],
 }:
 
 buildPythonPackage rec {
-  version = "3.6.2";
-  format = "setuptools";
+  version = "3.6.3";
+  format = "pyproject";
   pname = "rpy2";
 
   disabled = isPyPy;
   src = fetchPypi {
     inherit version pname;
-    hash = "sha256-F06ld2qR0Ds13VYRiJlg4PVFHp0KvqSr/IwL5qhTd9A=";
+    hash = "sha256-lCYYoSUhljAG0i6IqqTUgakjghwDoXQsmb7uci6w/Fo=";
   };
 
-  patches = [
-    # R_LIBS_SITE is used by the nix r package to point to the installed R libraries.
-    # This patch sets R_LIBS_SITE when rpy2 is imported.
-    ./rpy2-3.x-r-libs-site.patch
-  ];
-
-  postPatch = ''
-    substituteInPlace 'rpy2/rinterface_lib/embedded.py' --replace '@NIX_R_LIBS_SITE@' "$R_LIBS_SITE"
-    substituteInPlace 'requirements.txt' --replace 'pytest' ""
-  '';
-
-  buildInputs = [
-    pcre
-    xz
-    bzip2
-    zlib
-    zstd
-    icu
-    libdeflate
-  ]
-  ++ (with rPackages; [
-    # packages expected by the test framework
-    ggplot2
-    dplyr
-    RSQLite
-    broom
-    DBI
-    dbplyr
-    hexbin
-    lazyeval
-    lme4
-    tidyr
-  ])
-  ++ extraRPackages
-  ++ rWrapper.recommendedPackages;
-
-  nativeBuildInputs = [
-    R # needed at setup time to detect R_HOME (alternatively set R_HOME explicitly)
-  ];
-
   propagatedBuildInputs = [
-    ipython
-    jinja2
-    pytz
-    pandas
-    numpy
-    cffi
-    tzlocal
-    simplegeneric
+    rpy2-rinterface
+    rpy2-robjects
   ];
 
-  # https://github.com/rpy2/rpy2/issues/1111
-  disabledTests = [
-    "test_parse_incomplete_error"
-    "test_parse_error"
-    "test_parse_error_when_evaluting"
+  pythonImportsCheck = [
+    "rpy2"
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
   meta = {
     homepage = "https://rpy2.github.io/";
     description = "Python interface to R";
diff --git a/pkgs/development/python-modules/rpy2/rpy2-3.x-r-libs-site.patch b/pkgs/development/python-modules/rpy2/rpy2-3.x-r-libs-site.patch
deleted file mode 100644
index 2617472096d4..000000000000
--- a/pkgs/development/python-modules/rpy2/rpy2-3.x-r-libs-site.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/rpy2/rinterface_lib/embedded.py b/rpy2/rinterface_lib/embedded.py
-index ccd3a315..51fb5da4 100644
---- a/rpy2/rinterface_lib/embedded.py
-+++ b/rpy2/rinterface_lib/embedded.py
-@@ -276,6 +276,16 @@ def _initr(
-                  os.environ.get('LD_LIBRARY_PATH', ''))
-                 )
-         )
-+
-+        # path to libraries
-+        existing = os.environ.get('R_LIBS_SITE')
-+        if existing is not None:
-+            prefix = existing + ':'
-+        else:
-+            prefix = ''
-+        additional = '@NIX_R_LIBS_SITE@'
-+        os.environ['R_LIBS_SITE'] = prefix + additional
-+
-         options_c = [ffi.new('char[]', o.encode('ASCII')) for o in _options]
-         n_options = len(options_c)
-         n_options_c = ffi.cast('int', n_options)
diff --git a/pkgs/development/python-modules/scalar-fastapi/default.nix b/pkgs/development/python-modules/scalar-fastapi/default.nix
index 51bc7aac30ba..901a23ee679d 100644
--- a/pkgs/development/python-modules/scalar-fastapi/default.nix
+++ b/pkgs/development/python-modules/scalar-fastapi/default.nix
@@ -23,13 +23,13 @@
 
 buildPythonPackage rec {
   pname = "scalar-fastapi";
-  version = "1.2.3";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "scalar_fastapi";
     inherit version;
-    hash = "sha256-z5ujaUfqGwQC/B+jEfMKaQs547rt7x97RVPPVwAtrOs=";
+    hash = "sha256-0qANeCaueAP1SYYvuzTJNOfth9nkNTiIe/zejznq2VI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/skops/default.nix b/pkgs/development/python-modules/skops/default.nix
index ed6cf8b9c555..80860f51a307 100644
--- a/pkgs/development/python-modules/skops/default.nix
+++ b/pkgs/development/python-modules/skops/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "skops";
-  version = "0.12.0";
+  version = "0.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "skops-dev";
     repo = "skops";
     tag = "v${version}";
-    hash = "sha256-OLRnaG++5Z7Y0WZnvfdPn6iIXzum5FTL0+geiO5QjYs=";
+    hash = "sha256-1550LIVyChqP5q4VZmflCXPyXXg4eHJU5AlVQJD2M8c=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/ssh-python/default.nix b/pkgs/development/python-modules/ssh-python/default.nix
index 2cd514419151..2704600d0900 100644
--- a/pkgs/development/python-modules/ssh-python/default.nix
+++ b/pkgs/development/python-modules/ssh-python/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "ssh-python";
-  version = "03.0";
+  version = "1.1.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "ParallelSSH";
     repo = "ssh-python";
     tag = version;
-    hash = "sha256-hrTf0eywmK/sbZ7fVPatJvcWh5e1/rCLpk0yQKlyLYU=";
+    hash = "sha256-kidz4uHT5C8TUROLGQUHihemYtwOoWZQNw7ElbwYKLM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index 6f5af8ba14d7..9f5ede64cbe9 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "12.5.0";
+  version = "12.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zSuOcSFrau1dwem15vZYteIdaaYNRPuMCPQeH3vd7dA=";
+    hash = "sha256-VAfQksNVwxOT52fS3LLVqMOYDKqaBzrLMtDMs8AbBLU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tree-sitter-embedded-template/default.nix b/pkgs/development/python-modules/tree-sitter-embedded-template/default.nix
index cb71db0adba5..e027dfadd252 100644
--- a/pkgs/development/python-modules/tree-sitter-embedded-template/default.nix
+++ b/pkgs/development/python-modules/tree-sitter-embedded-template/default.nix
@@ -12,19 +12,19 @@
 
 buildPythonPackage rec {
   pname = "tree-sitter-embedded-template";
-  version = "0.23.2";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter-embedded-template";
     tag = "v${version}";
-    hash = "sha256-C2Lo3tT2363O++ycXiR6x0y+jy2zlmhcKp7t1LhvCe8=";
+    hash = "sha256-nBQain0Lc21jOgQFfvkyq615ZmT8qdMxtqIoUcOcO3A=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-DscTKXKukh3RsqtKjplyzrxY977zUgpFpeXtFOLJEXA=";
+    hash = "sha256-C+P/fALEmRDrX59diXS/cdzffvJyn0qnCUD5nFsW+ww=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tree-sitter-markdown/default.nix b/pkgs/development/python-modules/tree-sitter-markdown/default.nix
index 554324248f4b..2fcc34269bb8 100644
--- a/pkgs/development/python-modules/tree-sitter-markdown/default.nix
+++ b/pkgs/development/python-modules/tree-sitter-markdown/default.nix
@@ -5,12 +5,10 @@
   setuptools,
   tree-sitter,
   pytestCheckHook,
-  nix-update-script,
 }:
 
 buildPythonPackage rec {
   pname = "tree-sitter-markdown";
-  # only update to the latest version on PyPI
   version = "0.5.0";
   pyproject = true;
 
@@ -38,15 +36,6 @@ buildPythonPackage rec {
     tree-sitter
   ];
 
-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      # later versions have incompatible changes, pin it to the latest on PyPI
-      # reverse-dependencies also pull packages from PyPI, see:
-      # https://github.com/Textualize/textual/issues/5868
-      "--version=0.3.2"
-    ];
-  };
-
   meta = {
     description = "Markdown grammar for tree-sitter";
     homepage = "https://github.com/tree-sitter-grammars/tree-sitter-markdown";
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index 9a5ada4dc0f3..6ce17cffc8e6 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "weaviate-client";
-  version = "4.16.5";
+  version = "4.16.9";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "weaviate";
     repo = "weaviate-python-client";
     tag = "v${version}";
-    hash = "sha256-AjZZ9kmVxePlomX6bXUohZZXl2IXMbrjG00qNlGdjRc=";
+    hash = "sha256-vnBBZUUTv8GVPxjkxqKgTYA9/UaJ7VPr9QoRBIBVek8=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/webauthn/default.nix b/pkgs/development/python-modules/webauthn/default.nix
index f549d04a8e09..3ff31f0a009b 100644
--- a/pkgs/development/python-modules/webauthn/default.nix
+++ b/pkgs/development/python-modules/webauthn/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "webauthn";
-  version = "2.6.0";
+  version = "2.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "duo-labs";
     repo = "py_webauthn";
     tag = "v${version}";
-    hash = "sha256-TMEwgEXkd2ZTd3jWv94IS+GiGb8vdwourWWXWcnXpcg=";
+    hash = "sha256-aZDptKJPFU6Oo4vKkIWkqkJ5ogDe5x3v7PAQRixWFe4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/xgrammar/default.nix b/pkgs/development/python-modules/xgrammar/default.nix
index ef67d4b22abd..6a1a1549293f 100644
--- a/pkgs/development/python-modules/xgrammar/default.nix
+++ b/pkgs/development/python-modules/xgrammar/default.nix
@@ -11,6 +11,7 @@
   scikit-build-core,
 
   # dependencies
+  mlx-lm,
   pydantic,
   sentencepiece,
   tiktoken,
@@ -25,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "xgrammar";
-  version = "0.1.23";
+  version = "0.1.24";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -33,7 +34,7 @@ buildPythonPackage rec {
     repo = "xgrammar";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-asyxJsrsbfFNh1pLBDzM4kdmunQp7/mTDw3L8KuZf4g=";
+    hash = "sha256-K+GCHuWKF449JaGWr7FQrDeJS3pxmVKnGf68L53LrK0=";
   };
 
   patches = [
@@ -57,6 +58,9 @@ buildPythonPackage rec {
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) [
     triton
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+    mlx-lm
   ];
 
   nativeCheckInputs = [
@@ -64,10 +68,10 @@ buildPythonPackage rec {
     writableTmpDirAsHomeHook
   ];
 
-  NIX_CFLAGS_COMPILE = toString [
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isLinux (toString [
     # xgrammar hardcodes -flto=auto while using static linking, which can cause linker errors without this additional flag.
     "-ffat-lto-objects"
-  ];
+  ]);
 
   disabledTests = [
     # You are trying to access a gated repo.
@@ -98,10 +102,6 @@ buildPythonPackage rec {
     badPlatforms = [
       # error: ‘operator delete’ called on unallocated object ‘result’ [-Werror=free-nonheap-object]
       "aarch64-linux"
-
-      # clang++: error: unsupported option '-ffat-lto-objects' for target 'arm64-apple-darwin'
-      # idem for 'x86_64-apple-darwin'
-      lib.systems.inspect.patterns.isDarwin
     ];
   };
 }
diff --git a/pkgs/development/python-modules/zipstream-ng/default.nix b/pkgs/development/python-modules/zipstream-ng/default.nix
index 28c423f3c235..4f10c8715b02 100644
--- a/pkgs/development/python-modules/zipstream-ng/default.nix
+++ b/pkgs/development/python-modules/zipstream-ng/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "zipstream-ng";
-  version = "1.8.0";
+  version = "1.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pR0Ps";
     repo = "zipstream-ng";
     tag = "v${version}";
-    hash = "sha256-mmPxzml+gaVg2IQ/Gql+3ru0hHosbyX4WjLCMxD/MJw=";
+    hash = "sha256-dkSTZkj6Rx6OMdlX4oDOydetosf/iEJhlARmEc0W9gQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/rocq-modules/rocq-elpi/default.nix b/pkgs/development/rocq-modules/rocq-elpi/default.nix
index c19d42f7db19..66c07bce7d4f 100644
--- a/pkgs/development/rocq-modules/rocq-elpi/default.nix
+++ b/pkgs/development/rocq-modules/rocq-elpi/default.nix
@@ -17,7 +17,7 @@ let
       in
       with lib.versions;
       lib.switch rocq-core.rocq-version [
-        (case (range "9.0" "9.1") "3.0.1")
+        (case (range "9.0" "9.1") "3.3.0")
         (case (range "9.0" "9.1") "2.0.7")
       ] { };
   elpi = rocq-core.ocamlPackages.elpi.override { version = default-elpi-version; };
@@ -36,7 +36,7 @@ let
       in
       with lib.versions;
       lib.switch rocq-core.rocq-version [
-        (case (range "9.0" "9.1") "3.0.0")
+        (case (range "9.0" "9.1") "3.1.0")
         (case (range "9.0" "9.1") "2.6.0")
         (case ("9.0") "2.5.2")
       ] null;
diff --git a/pkgs/development/tools/gammaray/default.nix b/pkgs/development/tools/gammaray/default.nix
index 6b75b06e578e..37673a7bcf00 100644
--- a/pkgs/development/tools/gammaray/default.nix
+++ b/pkgs/development/tools/gammaray/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/KDAB/GammaRay";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rewine ];
+    maintainers = with maintainers; [ wineee ];
     mainProgram = "gammaray";
   };
 }
diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index 7f16c7599c43..8d4d3a3d4555 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://wiki.qt.io/Qt_Creator";
     license = lib.licenses.gpl3Only; # annotated with The Qt Company GPL Exception 1.0
     maintainers = with lib.maintainers; [
-      rewine
+      wineee
       zatm8
     ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 4a78b44276f4..8264eebdbcfe 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -18,8 +18,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.19.4";
-  sha256 = "b87fd7106013d3906706913ffc63a4403715fbb272c4f83ff4338527353eec0f";
+  version = "20.19.5";
+  sha256 = "230c899f4e2489c4b8d2232edd6cc02f384fb2397c2a246a22e415837ee5da51";
   patches = [
     ./configure-emulator.patch
     ./configure-armv6-vfpv2.patch
diff --git a/pkgs/games/dwarf-fortress/df.lock.json b/pkgs/games/dwarf-fortress/df.lock.json
index 5ffff70c7e9a..4e4c5f3e8bc8 100644
--- a/pkgs/games/dwarf-fortress/df.lock.json
+++ b/pkgs/games/dwarf-fortress/df.lock.json
@@ -1,28 +1,48 @@
 {
   "game": {
     "latest": {
-      "linux": "51.11",
+      "linux": "52.04",
       "darwin": "0.47.05"
     },
     "versions": {
-      "51.11": {
+      "52.04": {
         "df": {
-          "version": "51.11",
+          "version": "52.04",
           "urls": {
             "linux": {
-              "url": "https://www.bay12games.com/dwarves/df_51_11_linux.tar.bz2",
-              "outputHash": "sha256-51cwIFMm5cwSaXjjhpz4pS3D8B5/Mt5+k1ALu1F+JWc="
+              "url": "https://www.bay12games.com/dwarves/df_52_04_linux.tar.bz2",
+              "outputHash": "sha256-x/v4yWuojnbea0N7KUAINBdhPBjl0DoWy8Pi/eDCpec="
             }
           }
         },
         "hack": {
-          "version": "51.11-r1.2",
+          "version": "52.04-r1",
           "git": {
             "url": "https://github.com/DFHack/dfhack.git",
-            "revision": "51.11-r1.2",
-            "outputHash": "sha256-x8zY8IGDhnyoeNz24Mt00o+2XLzSHZG165MXQHXW+YA="
+            "revision": "52.04-r1",
+            "outputHash": "sha256-DPW+fvurUYnwfGrEqV3JEN1TfllOJPHqGIlNJ3Wha90="
           },
-          "xmlRev": "6502bdefd1796315365a7bb58e30e0ce34359bea"
+          "xmlRev": "7b691d256f9427036e7ff24fa795a0f9334739e7"
+        }
+      },
+      "51.13": {
+        "df": {
+          "version": "51.13",
+          "urls": {
+            "linux": {
+              "url": "https://www.bay12games.com/dwarves/df_51_13_linux.tar.bz2",
+              "outputHash": "sha256-Fdb3QS+P0xL4/U0z6nZyMh78KVHDiu9TI3fF6saAw3I="
+            }
+          }
+        },
+        "hack": {
+          "version": "51.13-r1",
+          "git": {
+            "url": "https://github.com/DFHack/dfhack.git",
+            "revision": "51.13-r1",
+            "outputHash": "sha256-Z6ZmXl4BmSg9jRwPpYKMIw3fW6DYxBJEv8oboh+PbZQ="
+          },
+          "xmlRev": "ae7424d3f40bf60b3906b5b9b472cb9a7209a3a8"
         }
       },
       "50.15": {
@@ -96,12 +116,12 @@
     }
   },
   "therapist": {
-    "version": "42.1.13",
-    "maxDfVersion": "51.11",
+    "version": "42.1.18",
+    "maxDfVersion": "52.03",
     "git": {
       "url": "https://github.com/Dwarf-Therapist/Dwarf-Therapist.git",
-      "revision": "v42.1.13",
-      "outputHash": "sha256-y/kUur/BTArznrEzw54FZBrxnD2KXHcwfrHE4WvoemA="
+      "revision": "v42.1.18",
+      "outputHash": "sha256-RdBUpVkjvsNjTowHpQ2FQUCtJiwfqls4dnoUIwKoXGg="
     }
   }
 }
diff --git a/pkgs/games/dwarf-fortress/dfhack/default.nix b/pkgs/games/dwarf-fortress/dfhack/default.nix
index a97439344ab0..18c080f9d510 100644
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@@ -120,23 +120,16 @@ stdenv.mkDerivation {
       name = "rename-lerp.patch";
       url = "https://github.com/DFHack/dfhack/commit/389dcf5cfcdb8bfb8deeb05fa5756c9f4f5709d1.patch";
       hash = "sha256-QuDtGURhP+nM+x+8GIKO5LrMcmBkl9JSHHIeqzqGIPQ=";
-    });
+    })
+    # Newer versions use SDL_GetBasePath and SDL_GetPrefPath with a Windows-esque directory
+    # that mismatches where we have historically stored data in nixpkgs:
+    # https://github.com/libsdl-org/SDL/blob/release-2.24.x/src/filesystem/unix/SDL_sysfilesystem.c#L136
+    # Use SDL_GetPrefPath since this takes XDG_DATA_HOME into account (which is correct).
+    ++ optional (versionAtLeast version "52.02-r2") ./use-df-linux-dir.patch;
 
   # gcc 11 fix
   CXXFLAGS = optionalString (versionOlder version "0.47.05-r3") "-fpermissive";
 
-  # As of
-  # https://github.com/DFHack/dfhack/commit/56e43a0dde023c5a4595a22b29d800153b31e3c4,
-  # dfhack gets its goodies from the directory above the Dwarf_Fortress
-  # executable, which leads to stock Dwarf Fortress and not the built
-  # environment where all the dfhack resources are symlinked to (typically
-  # ~/.local/share/df_linux). This causes errors like `tweak is not a
-  # recognized command` to be reported and dfhack to lose some of its
-  # functionality.
-  postPatch = ''
-    sed -i 's@cached_path = path_string.*@cached_path = getenv("DF_DIR");@' library/Process-linux.cpp
-  '';
-
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/games/dwarf-fortress/dfhack/use-df-linux-dir.patch b/pkgs/games/dwarf-fortress/dfhack/use-df-linux-dir.patch
new file mode 100644
index 000000000000..8b8fcabfdd62
--- /dev/null
+++ b/pkgs/games/dwarf-fortress/dfhack/use-df-linux-dir.patch
@@ -0,0 +1,25 @@
+diff --git a/library/modules/Filesystem.cpp b/library/modules/Filesystem.cpp
+index 7a6b09a50..d5827f016 100644
+--- a/library/modules/Filesystem.cpp
++++ b/library/modules/Filesystem.cpp
+@@ -232,17 +232,10 @@ std::filesystem::path Filesystem::canonicalize(std::filesystem::path p) noexcept
+ 
+ std::filesystem::path Filesystem::getInstallDir() noexcept
+ {
+-    return std::filesystem::path{ DFSDL::DFSDL_GetBasePath() };
++    return std::filesystem::path{ DFSDL::DFSDL_GetPrefPath("", "df_linux") };
+ }
+ 
+ std::filesystem::path Filesystem::getBaseDir() noexcept
+ {
+-    auto getsavebase = []() {
+-        // assume portable mode is _on_ if init is missing
+-        if (!df::global::init || df::global::init->media.flag.is_set(df::enums::init_media_flags::PORTABLE_MODE))
+-            return DFSDL::DFSDL_GetBasePath();
+-        else
+-            return DFSDL::DFSDL_GetPrefPath("Bay 12 Games", "Dwarf Fortress");
+-        };
+-    return std::filesystem::path{ getsavebase() };
++    return std::filesystem::path{ DFSDL::DFSDL_GetPrefPath("", "df_linux") };
+ }
+
diff --git a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
index c07d48d26e72..b70fb9316333 100644
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
@@ -74,9 +74,10 @@ stdenv.mkDerivation {
         local orig_md5="$2"
         local patched_md5="$3"
         echo "It doesn't support DF $dfVersion out of the box, so we're doing it the hard way."
-        export NIXPKGS_DF_HOME="$(mktemp -dt dfhack.XXXXXX)"
+        export HOME="$(mktemp -dt dfhack.XXXXXX)"
+        export XDG_DATA_HOME="$HOME/.local/share"
         expect ${dfHackExpectScript}
-        local ini="$NIXPKGS_DF_HOME/therapist.ini"
+        local ini="$XDG_DATA_HOME/df_linux/therapist.ini"
         if [ -f "$ini" ]; then
           if grep -q "$patched_md5" "$ini"; then
             cp -v "$ini" "$output"
diff --git a/pkgs/games/dwarf-fortress/update.rb b/pkgs/games/dwarf-fortress/update.rb
index ff051cad15cb..d00fd1d1a750 100755
--- a/pkgs/games/dwarf-fortress/update.rb
+++ b/pkgs/games/dwarf-fortress/update.rb
@@ -571,7 +571,7 @@ class DFLock < Struct.new(:game, :therapist, keyword_init: true)
 
   # Returns an array containing all versions.
   def all_versions
-    self.game.versions.keys.map {"DF #{_1}"}.to_a + ["DT #{self.therapist.version}"]
+    [self.game.versions.keys.lazy.map {"DF #{_1}"}.first] + ["DT #{self.therapist.version}"]
   end
 
   # Loads this DFLock.
diff --git a/pkgs/os-specific/linux/batman-adv/version.nix b/pkgs/os-specific/linux/batman-adv/version.nix
index ac3b657e4a6e..43e854979fff 100644
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@@ -1,14 +1,14 @@
 {
-  version = "2025.2";
+  version = "2025.3";
 
   # To get these, run:
   #
   # ```
-  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2025.2/$tool-2025.2.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done
+  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2025.3/$tool-2025.3.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done
   # ```
   sha256 = {
-    alfred = "sha256-Q0fR5LB5Svv2sXGoV7mjx9UaKR/FTxbNrZLH99HNtRo=";
-    batctl = "sha256-q2wDRqFvER57n9XOVczd633grXdCvi9FExfrQo9qCpY=";
-    batman-adv = "sha256-FsRfi7jzBTcc2Q6IhjDPslHCsYnlUypSepNvo1ukl/c=";
+    alfred = "sha256-+wTI22Y6bh0dyeRnEvyr6Ctz0MC0fkC00WEAAu9RCXU=";
+    batctl = "sha256-cERLGCyF0MJxTZFFdBJJgIAbt0PRYm7iehefoiBm/cI=";
+    batman-adv = "sha256-vggjoJNr9Z4q8tEVp+JjF/giC5mPSDMldGWvK2/+HOg=";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 4127534a923d..541b3ce3525f 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.16.3"; # zen
+      version = "6.16.5"; # zen
       suffix = "zen1"; # zen
-      sha256 = "1dxxpd1j163m0ijw3ldc0v958jwn002crw5x0n1yzrklgs4jp4dm"; # zen
+      sha256 = "19b5dpw4kkr9vfx2if56y69zs0di8ygrxsmnq8qhyg5v1985y5i6"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 25bdbdc8a08f..acbc088e28e1 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -1,11 +1,16 @@
 { lib, pkgs }:
 let
   inherit (lib)
+    boolToString
     concatStringsSep
     escape
+    filterAttrs
     flatten
+    hasPrefix
     id
     isAttrs
+    isBool
+    isDerivation
     isFloat
     isInt
     isList
@@ -16,8 +21,11 @@ let
     optionalAttrs
     optionalString
     pipe
-    types
     singleton
+    strings
+    toPretty
+    types
+    versionAtLeast
     warn
     ;
 
@@ -863,6 +871,101 @@ optionalAttrs allowAliases aliases
       lib.mkRaw = lib.mkLuaInline;
     };
 
+  nixConf =
+    {
+      package,
+      version,
+      extraOptions ? "",
+      checkAllErrors ? true,
+      checkConfig ? true,
+    }:
+    let
+      isNixAtLeast = versionAtLeast version;
+    in
+    assert isNixAtLeast "2.2";
+    {
+      type =
+        let
+          atomType = nullOr (oneOf [
+            bool
+            int
+            float
+            str
+            path
+            package
+          ]);
+        in
+        attrsOf atomType;
+      generate =
+        name: value:
+        let
+
+          # note that list type has been omitted here as the separator varies, see `nix.settings.*`
+          mkValueString =
+            v:
+            if v == null then
+              ""
+            else if isInt v then
+              toString v
+            else if isBool v then
+              boolToString v
+            else if isFloat v then
+              strings.floatToString v
+            else if isDerivation v then
+              toString v
+            else if builtins.isPath v then
+              toString v
+            else if isString v then
+              v
+            else if strings.isConvertibleWithToString v then
+              toString v
+            else
+              abort "The nix conf value: ${toPretty { } v} can not be encoded";
+
+          mkKeyValue = k: v: "${escape [ "=" ] k} = ${mkValueString v}";
+
+          mkKeyValuePairs = attrs: concatStringsSep "\n" (mapAttrsToList mkKeyValue attrs);
+
+          isExtra = key: hasPrefix "extra-" key;
+
+        in
+        pkgs.writeTextFile {
+          inherit name;
+          # workaround for https://github.com/NixOS/nix/issues/9487
+          # extra-* settings must come after their non-extra counterpart
+          text = ''
+            # WARNING: this file is generated from the nix.* options in
+            # your NixOS configuration, typically
+            # /etc/nixos/configuration.nix.  Do not edit it!
+            ${mkKeyValuePairs (filterAttrs (key: _: !(isExtra key)) value)}
+            ${mkKeyValuePairs (filterAttrs (key: _: isExtra key) value)}
+            ${extraOptions}
+          '';
+          checkPhase = lib.optionalString checkConfig (
+            if pkgs.stdenv.hostPlatform != pkgs.stdenv.buildPlatform then
+              ''
+                echo "Ignoring validation for cross-compilation"
+              ''
+            else
+              let
+                showCommand = if isNixAtLeast "2.20pre" then "config show" else "show-config";
+              in
+              ''
+                echo "Validating generated nix.conf"
+                ln -s $out ./nix.conf
+                set -e
+                set +o pipefail
+                NIX_CONF_DIR=$PWD \
+                  ${package}/bin/nix ${showCommand} ${optionalString (isNixAtLeast "2.3pre") "--no-net"} \
+                    ${optionalString (isNixAtLeast "2.4pre") "--option experimental-features nix-command"} \
+                  |& sed -e 's/^warning:/error:/' \
+                  | (! grep '${if checkAllErrors then "^error:" else "^error: unknown setting"}')
+                set -o pipefail
+              ''
+          );
+        };
+    };
+
   # Outputs a succession of Python variable assignments
   # Useful for many Django-based services
   pythonVars =
diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix
index badde2d7b025..9b1ab396a3fe 100644
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -850,6 +850,31 @@ runBuildTests {
     '';
   };
 
+  nixConfAtoms = shouldPass {
+    format = formats.nixConf {
+      package = pkgs.nix;
+      version = pkgs.nix.version;
+      extraOptions = ''ignore-try = false'';
+    };
+    input = {
+      auto-optimise-store = true;
+      cores = 0;
+      store = "auto";
+    };
+    # note that null type is hard to test here,
+    # as it involves a trailing space our formatter will remove here
+    expected = ''
+      # WARNING: this file is generated from the nix.* options in
+      # your NixOS configuration, typically
+      # /etc/nixos/configuration.nix.  Do not edit it!
+      auto-optimise-store = true
+      cores = 0
+      store = auto
+
+      ignore-try = false
+    '';
+  };
+
   phpAtoms = shouldPass rec {
     format = formats.php { finalVariable = "config"; };
     input = {
diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix
index 0e7bcb3768c8..a9e54e7a8f4f 100644
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@@ -14,6 +14,13 @@
 
 let
   versionMap = {
+    "4_1" = {
+      kafkaVersion = "4.1.0";
+      scalaVersion = "2.13";
+      sha256 = "sha256-hbRThHDR3LmNAnMoa/q4cXBlUi5Zfs//zU24OjAhdY4=";
+      jre = jdk17_headless;
+      nixosTest = nixosTests.kafka.base.kafka_4_1;
+    };
     "4_0" = {
       kafkaVersion = "4.0.0";
       scalaVersion = "2.13";
diff --git a/pkgs/servers/home-assistant/custom-components/samsungtv-smart/package.nix b/pkgs/servers/home-assistant/custom-components/samsungtv-smart/package.nix
index c4e71e1ba60c..f9174d72a2a5 100644
--- a/pkgs/servers/home-assistant/custom-components/samsungtv-smart/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/samsungtv-smart/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "ollo69";
   domain = "samsungtv_smart";
-  version = "0.14.4";
+  version = "0.14.5";
 
   src = fetchFromGitHub {
     owner = "ollo69";
     repo = "ha-samsungtv-smart";
     tag = "v${version}";
-    hash = "sha256-naogq/7yGj2OD93JayOH8kHZhyDsKkWa2v+lKL0FlPU=";
+    hash = "sha256-J3+HD/jMJDIBSiVJnHvjOJ3yswck+DV3XpPqIoR5/sU=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 38fe473815e9..033db524760c 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -70,7 +70,7 @@ in
   };
 
   tomcat11 = common {
-    version = "11.0.10";
-    hash = "sha256-6w4ybJed9iyiqq0igUalagYyP9Okroz8NP8NLeWKMNY=";
+    version = "11.0.11";
+    hash = "sha256-KpG4DB6n279K8Fux+Aq7l15d5BXAyAPep0XlqhEm4IE=";
   };
 }
diff --git a/pkgs/servers/sql/postgresql/ext/pg_cron.nix b/pkgs/servers/sql/postgresql/ext/pg_cron.nix
index bb5dca058bfe..564ba2a20871 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_cron.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_cron.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_cron";
-  version = "1.6.6";
+  version = "1.6.7";
 
   src = fetchFromGitHub {
     owner = "citusdata";
     repo = "pg_cron";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N6lLmfegUeHCpwXztMifTRvajlVLyxL0j+8edouKIOQ=";
+    hash = "sha256-oQjaQeIEMbg5pipY8tT4I7bNdyDOwcr/ZJikqgcEZOs=";
   };
 
   meta = {
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 1c46a5f52ffd..e0fd4ca55469 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.21.3";
+  version = "2.22.0";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-u6xa8Tgb17pz0FSgbw06J6FOeFHROX9agXK4sUK1G9k=";
+    hash = "sha256-6VXS/vTBXlFbEtzm7FfLBtD57GI+QHStDmFv2AvUdSs=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -106,7 +106,7 @@ postgresqlBuildExtension (finalAttrs: {
       ||
         # PostgreSQL 18 support issue upstream: https://github.com/timescale/timescaledb/issues/8233
         # Check after next package update.
-        lib.warnIf (finalAttrs.version != "2.21.3") "Is postgresql18Packages.timescaledb still broken?" (
+        lib.warnIf (finalAttrs.version != "2.22.0") "Is postgresql18Packages.timescaledb still broken?" (
           lib.versionAtLeast postgresql.version "18"
         );
   };
diff --git a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
index dd900babd171..d38ce32b8e06 100644
--- a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
+++ b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
@@ -6,13 +6,13 @@
 }:
 buildFishPlugin {
   pname = "exercism-cli-fish-wrapper";
-  version = "0-unstable-2025-07-14";
+  version = "0-unstable-2025-09-04";
 
   src = fetchFromGitHub {
     owner = "glennj";
     repo = "exercism-cli-fish-wrapper";
-    rev = "bb03e058d4e9c5d5918e27ae7e046fff2c91adb0";
-    hash = "sha256-taIZSyaObVmnjp6ME/QgGKlWZoeOmgRVRLYC0bb8XWk=";
+    rev = "446420f62144aa6b1cbdd64d0429ba8bd4123dfc";
+    hash = "sha256-HTRC47BMQaVkxXr2f81enL2Tr9ZoFN3X5RZdmAiGXtU=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/stdenv/linux/bootstrap-files/powerpc64-unknown-linux-gnuabielfv1.nix b/pkgs/stdenv/linux/bootstrap-files/powerpc64-unknown-linux-gnuabielfv1.nix
new file mode 100644
index 000000000000..b7e8eab9a319
--- /dev/null
+++ b/pkgs/stdenv/linux/bootstrap-files/powerpc64-unknown-linux-gnuabielfv1.nix
@@ -0,0 +1,21 @@
+# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
+# $ ./refresh-tarballs.bash --targets=powerpc64-unknown-linux-gnuabielfv1
+#
+# Metadata:
+# - nixpkgs revision: 2ba17da62f2813a5b779ec2b13abe96baec8ea08
+# - hydra build: https://hydra.nixos.org/job/nixpkgs/cross-trunk/bootstrapTools.powerpc64-unknown-linux-gnuabielfv1.build/latest
+# - resolved hydra build: https://hydra.nixos.org/build/301750343
+# - instantiated derivation: /nix/store/4djsi9i5fc3nc7qzf4gjljn4zzjiy226-stdenv-bootstrap-tools-powerpc64-unknown-linux-gnuabielfv1.drv
+# - output directory: /nix/store/b8zndw2p8f82hn23a3ilkmfc6v26yian-stdenv-bootstrap-tools-powerpc64-unknown-linux-gnuabielfv1
+# - build time: Fri, 04 Jul 2025 13:37:14 +0000
+{
+  bootstrapTools = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/powerpc64-unknown-linux-gnuabielfv1/2ba17da62f2813a5b779ec2b13abe96baec8ea08/bootstrap-tools.tar.xz";
+    hash = "sha256-OnjFUMRNFmGu0EFSM99loZ03Bx6htCyTiftCBO1enQM=";
+  };
+  busybox = import <nix/fetchurl.nix> {
+    url = "http://tarballs.nixos.org/stdenv/powerpc64-unknown-linux-gnuabielfv1/2ba17da62f2813a5b779ec2b13abe96baec8ea08/busybox";
+    hash = "sha256-f5U+O8oHTAfJpukjz+YmIf8QQVuMoh+kKhOw5Zf5QJY=";
+    executable = true;
+  };
+}
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 6287a3877b41..bd26a6024ce5 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -78,7 +78,12 @@
             else
               ./bootstrap-files/mips64el-unknown-linux-gnuabi64.nix
           );
-          powerpc64-linux = import ./bootstrap-files/powerpc64-unknown-linux-gnuabielfv2.nix;
+          powerpc64-linux = import (
+            if localSystem.isAbiElfv2 then
+              ./bootstrap-files/powerpc64-unknown-linux-gnuabielfv2.nix
+            else
+              ./bootstrap-files/powerpc64-unknown-linux-gnuabielfv1.nix
+          );
           powerpc64le-linux = import ./bootstrap-files/powerpc64le-unknown-linux-gnu.nix;
           riscv64-linux = import ./bootstrap-files/riscv64-unknown-linux-gnu.nix;
           s390x-linux = import ./bootstrap-files/s390x-unknown-linux-gnu.nix;
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index cf7327c8242d..6e43f0d832a5 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -11,13 +11,8 @@ with pkgs;
         let
           pkgSets = lib.pipe pkgNames [
             (filter (lib.hasPrefix "llvmPackages"))
-            (filter (n: n != "rocmPackages.llvm"))
-            # Are throw aliases.
-            (filter (n: n != "llvmPackages_rocm"))
+            # Are aliases.
             (filter (n: n != "llvmPackages_latest"))
-            (filter (n: n != "llvmPackages_6"))
-            (filter (n: n != "llvmPackages_7"))
-            (filter (n: n != "llvmPackages_8"))
             (filter (n: n != "llvmPackages_9"))
             (filter (n: n != "llvmPackages_10"))
             (filter (n: n != "llvmPackages_11"))
@@ -42,6 +37,10 @@ with pkgs;
               (filter (n: n != "gcc6Stdenv"))
               (filter (n: n != "gcc7Stdenv"))
               (filter (n: n != "gcc8Stdenv"))
+              (filter (n: n != "gcc9Stdenv"))
+              (filter (n: n != "gcc10Stdenv"))
+              (filter (n: n != "gcc11Stdenv"))
+              (filter (n: n != "gcc12Stdenv"))
             ]
             ++
               lib.optionals
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index 8ab43953fcb7..5ffe4f810dcd 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -23,7 +23,7 @@
 }:
 
 # cpp and mpi options are mutually exclusive
-# (--enable-unsupported could be used to force the build)
+# "-DALLOW_UNSUPPORTED=ON" could be used to force the build.
 assert !cppSupport || !mpiSupport;
 
 let
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional javaSupport "-DHDF5_BUILD_JAVA=ON"
   ++ lib.optional usev110Api "-DDEFAULT_API_VERSION=v110"
   ++ lib.optionals threadsafe [
-    "-DDHDF5_ENABLE_THREADSAFE:BOOL=ON"
+    "-DHDF5_ENABLE_THREADSAFE:BOOL=ON"
     "-DHDF5_BUILD_HL_LIB=OFF"
   ]
   # broken in nixpkgs since around 1.14.3 -> 1.14.4.3
diff --git a/pkgs/tools/misc/ttfautohint/default.nix b/pkgs/tools/misc/ttfautohint/default.nix
index ae01868bb405..4b9c579ba8fc 100644
--- a/pkgs/tools/misc/ttfautohint/default.nix
+++ b/pkgs/tools/misc/ttfautohint/default.nix
@@ -25,18 +25,14 @@ stdenv.mkDerivation (finalAttrs: {
       echo "${finalAttrs.version}" > VERSION
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      echo '#define VERSION "${finalAttrs.version}"' > version
+      substituteInPlace configure --replace-fail "macx-g++" "macx-clang"
     '';
 
-  postAutoreconf = ''
-    substituteInPlace configure --replace-fail "macx-g++" "macx-clang"
-  '';
-
   nativeBuildInputs = [
     pkg-config
-    autoreconfHook
     perl
   ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoreconfHook ]
   ++ lib.optionals enableGUI [ libsForQt5.qt5.wrapQtAppsHook ];
 
   buildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 144b0358b1c7..b8905d31c3fc 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1261,7 +1261,6 @@ mapAliases {
   kramdown-rfc2629 = throw "'kramdown-rfc2629' has been renamed to/replaced by 'rubyPackages.kramdown-rfc2629'"; # Converted to throw 2024-10-17
   krb5Full = krb5;
   kreative-square-fonts = throw "'kreative-square-fonts' has been renamed to 'kreative-square'"; # Added 2025-04-16
-  krename = throw "'krename' has been removed, as it is unmaintained upstream"; # Added 2025-08-30
   krita-beta = throw "'krita-beta' has been renamed to/replaced by 'krita'"; # Converted to throw 2024-10-17
   krun = throw "'krun' has been renamed to/replaced by 'muvm'"; # Added 2025-05-01
   krunner-pass = throw "'krunner-pass' has been removed, as it only works on Plasma 5"; # Added 2025-08-30
@@ -2210,6 +2209,7 @@ mapAliases {
   space-orbit = throw "'space-orbit' has been removed because it is unmaintained; Debian upstream stopped tracking it in 2011."; # Added 2025-06-08
   spatialite_gui = throw "spatialite_gui has been renamed to spatialite-gui"; # Added 2025-01-12
   spatialite_tools = throw "spatialite_tools has been renamed to spatialite-tools"; # Added 2025-02-06
+  sonusmix = throw "'sonusmix' has been removed due to lack of maintenance"; # Added 2025-08-27
 
   # Added 2020-02-10
   sourceHanSansPackages = {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 22116d1701df..6305d947f985 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -418,9 +418,7 @@ with pkgs;
     name = "die-hook";
   } ../build-support/setup-hooks/die.sh;
 
-  digitalbitbox = libsForQt5.callPackage ../applications/misc/digitalbitbox {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  digitalbitbox = libsForQt5.callPackage ../applications/misc/digitalbitbox { };
 
   devShellTools = callPackage ../build-support/dev-shell-tools { };
 
@@ -3141,7 +3139,10 @@ with pkgs;
     cppSupport = false;
   };
 
-  hdf5-threadsafe = hdf5.override { threadsafe = true; };
+  hdf5-threadsafe = hdf5.override {
+    cppSupport = false;
+    threadsafe = true;
+  };
 
   heaptrack = kdePackages.callPackage ../development/tools/profiling/heaptrack { };
 
@@ -6471,9 +6472,10 @@ with pkgs;
     apacheKafka_3_8
     apacheKafka_3_9
     apacheKafka_4_0
+    apacheKafka_4_1
     ;
 
-  apacheKafka = apacheKafka_4_0;
+  apacheKafka = apacheKafka_4_1;
 
   asn2quickder = python3Packages.callPackage ../development/tools/asn2quickder { };
 
@@ -12103,7 +12105,7 @@ with pkgs;
 
   k4dirstat = libsForQt5.callPackage ../applications/misc/k4dirstat { };
 
-  kiwix = libsForQt5.callPackage ../applications/misc/kiwix { };
+  kiwix = qt6Packages.callPackage ../applications/misc/kiwix { };
 
   kiwix-tools = callPackage ../applications/misc/kiwix/tools.nix { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 82871be7f8dc..81523a7049d6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2823,6 +2823,8 @@ self: super: with self; {
 
   colcon-parallel-executor = callPackage ../development/python-modules/colcon-parallel-executor { };
 
+  colcon-recursive-crawl = callPackage ../development/python-modules/colcon-recursive-crawl { };
+
   colcon-ros-domain-id-coordinator =
     callPackage ../development/python-modules/colcon-ros-domain-id-coordinator
       { };
@@ -4268,6 +4270,8 @@ self: super: with self; {
 
   docling-jobkit = callPackage ../development/python-modules/docling-jobkit { };
 
+  docling-mcp = callPackage ../development/python-modules/docling-mcp { };
+
   docling-parse = callPackage ../development/python-modules/docling-parse {
     loguru-cpp = pkgs.loguru;
   };
@@ -8548,10 +8552,18 @@ self: super: with self; {
     callPackage ../development/python-modules/llama-index-multi-modal-llms-openai
       { };
 
+  llama-index-node-parser-docling =
+    callPackage ../development/python-modules/llama-index-node-parser-docling
+      { };
+
   llama-index-readers-database =
     callPackage ../development/python-modules/llama-index-readers-database
       { };
 
+  llama-index-readers-docling =
+    callPackage ../development/python-modules/llama-index-readers-docling
+      { };
+
   llama-index-readers-file = callPackage ../development/python-modules/llama-index-readers-file { };
 
   llama-index-readers-json = callPackage ../development/python-modules/llama-index-readers-json { };
@@ -8580,6 +8592,10 @@ self: super: with self; {
     callPackage ../development/python-modules/llama-index-vector-stores-google
       { };
 
+  llama-index-vector-stores-milvus =
+    callPackage ../development/python-modules/llama-index-vector-stores-milvus
+      { };
+
   llama-index-vector-stores-postgres =
     callPackage ../development/python-modules/llama-index-vector-stores-postgres
       { };
@@ -8592,6 +8608,8 @@ self: super: with self; {
 
   llama-parse = callPackage ../development/python-modules/llama-parse { };
 
+  llama-stack-client = callPackage ../development/python-modules/llama-stack-client { };
+
   llamaindex-py-client = callPackage ../development/python-modules/llamaindex-py-client { };
 
   llfuse = callPackage ../development/python-modules/llfuse { inherit (pkgs) fuse; };
@@ -16119,7 +16137,13 @@ self: super: with self; {
 
   rpmfluff = callPackage ../development/python-modules/rpmfluff { };
 
-  rpy2 = callPackage ../development/python-modules/rpy2 { inherit (pkgs) zstd; };
+  rpy2 = callPackage ../development/python-modules/rpy2 { };
+
+  rpy2-rinterface = callPackage ../development/python-modules/rpy2-rinterface {
+    inherit (pkgs) zstd;
+  };
+
+  rpy2-robjects = callPackage ../development/python-modules/rpy2-robjects { };
 
   rpyc = callPackage ../development/python-modules/rpyc { };