diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index cd452d761b9c..33a2e250f0a3 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -15,6 +15,7 @@ let
   inherit (pkgs) buildPackages runCommand docbook_xsl_ns;
 
   inherit (pkgs.lib)
+    evalModules
     hasPrefix
     removePrefix
     flip
@@ -117,8 +118,41 @@ let
         ${testOptionsDoc.optionsJSON}/${common.outputPath}/options.json
     sed -e '/@PYTHON_MACHINE_METHODS@/ {' -e 'r ${testDriverMachineDocstrings}/machine-methods.md' -e 'd' -e '}' \
       -i ./development/writing-nixos-tests.section.md
+    substituteInPlace ./development/modular-services.md \
+      --replace-fail \
+        '@PORTABLE_SERVICE_OPTIONS@' \
+        ${portableServiceOptions.optionsJSON}/${common.outputPath}/options.json
+    substituteInPlace ./development/modular-services.md \
+      --replace-fail \
+        '@SYSTEMD_SERVICE_OPTIONS@' \
+        ${systemdServiceOptions.optionsJSON}/${common.outputPath}/options.json
   '';
 
+  portableServiceOptions = buildPackages.nixosOptionsDoc {
+    inherit (evalModules { modules = [ ../../modules/system/service/portable/service.nix ]; }) options;
+    inherit revision warningsAreErrors;
+    transformOptions =
+      opt:
+      opt
+      // {
+        # Clean up declaration sites to not refer to the NixOS source tree.
+        declarations = map stripAnyPrefixes opt.declarations;
+      };
+  };
+
+  systemdServiceOptions = buildPackages.nixosOptionsDoc {
+    inherit (evalModules { modules = [ ../../modules/system/service/systemd/service.nix ]; }) options;
+    # TODO: filter out options that are not systemd-specific, maybe also change option prefix to just `service-opt-`?
+    inherit revision warningsAreErrors;
+    transformOptions =
+      opt:
+      opt
+      // {
+        # Clean up declaration sites to not refer to the NixOS source tree.
+        declarations = map stripAnyPrefixes opt.declarations;
+      };
+  };
+
 in
 rec {
   inherit (optionsDoc) optionsJSON optionsNix optionsDocBook;
diff --git a/nixos/doc/manual/development/development.md b/nixos/doc/manual/development/development.md
index 76f405c3b29c..37762afb41da 100644
--- a/nixos/doc/manual/development/development.md
+++ b/nixos/doc/manual/development/development.md
@@ -12,4 +12,5 @@ writing-documentation.chapter.md
 nixos-tests.chapter.md
 developing-the-test-driver.chapter.md
 testing-installer.chapter.md
+modular-services.md
 ```
diff --git a/nixos/doc/manual/development/modular-services.md b/nixos/doc/manual/development/modular-services.md
new file mode 100644
index 000000000000..eadead5c4a40
--- /dev/null
+++ b/nixos/doc/manual/development/modular-services.md
@@ -0,0 +1,98 @@
+
+# Modular Services {#modular-services}
+
+Status: in development. This functionality is new in NixOS 25.11, and significant changes should be expected. We'd love to hear your feedback in <https://github.com/NixOS/nixpkgs/pull/372170>
+
+Traditionally, NixOS services were defined using sets of options *in* modules, not *as* modules. This made them non-modular, resulting in problems with composability, reuse, and portability.
+
+A configuration management framework is an application of `evalModules` with the `class` and `specialArgs` input attribute set to particular values.
+NixOS is such a configuration management framework, and so are [Home Manager](https://github.com/nix-community/home-manager) and [`nix-darwin`](https://github.com/lnl7/nix-darwin).
+
+The service management component of a configuration management framework is the set of module options that connects Nix expressions with the underlying service (or process) manager.
+For NixOS this is the module wrapping [`systemd`](https://systemd.io/), on `nix-darwin` this is the module wrapping [`launchd`](https://en.wikipedia.org/wiki/Launchd).
+
+A *modular service* is a [module] that defines values for a core set of options declared in the service management component of a configuration management framework, including which program to run.
+Since it's a module, it can be composed with other modules via `imports` to extend its functionality.
+
+NixOS provides two options into which such modules can be plugged:
+
+- `system.services.<name>`
+- an option for user services (TBD)
+
+Crucially, these options have the type [`attrsOf`] [`submodule`].
+The name of the service is the attribute name corresponding to `attrsOf`.
+<!-- ^ This is how composition is *always* provided, instead of a difficult thing (but this is reference docs, not a changelog) -->
+The `submodule` is pre-loaded with two modules:
+- a generic module that is intended to be portable
+- a module with systemd-specific options, whose values or defaults derive from the generic module's option values.
+
+So note that the default value of `system.services.<name>` is not a complete service. It requires that the user provide a value, and this is typically done by importing a module. For example:
+
+<!-- Not using typical example syntax, because reading this is *not* optional, and should it should not be folded closed. -->
+```nix
+{
+  system.services.my-service-instance = {
+    imports = [ pkgs.some-application.services.some-service-module ];
+    foo.settings = {
+      # ...
+    };
+  };
+}
+```
+
+## Portability {#modular-service-portability}
+
+It is possible to write service modules that are portable. This is done by either avoiding the `systemd` option tree, or by defining process-manager-specific definitions in an optional way:
+
+```nix
+{ config, options, lib, ... }: {
+  _class = "service";
+  config = {
+    process.argv = [ (lib.getExe config.foo.program) ];
+  } // lib.optionalAttrs (options?systemd) {
+    # ... systemd-specific definitions ...
+  };
+}
+```
+
+This way, the module can be loaded into a configuration manager that does not use systemd, and the `systemd` definitions will be ignored.
+Similarly, other configuration managers can declare their own options for services to customize.
+
+## Composition and Ownership {#modular-service-composition}
+
+Compared to traditional services, modular services are inherently more composable, by virtue of being modules and receiving a user-provided name when imported.
+However, composition can not end there, because services need to be able to interact with each other.
+This can be achieved in two ways:
+1. Users can link services together by providing the necessary NixOS configuration.
+2. Services can be compositions of other services.
+
+These aren't mutually exclusive. In fact, it is a good practice when developing services to first write them as individual services, and then compose them into a higher-level composition. Each of these services is a valid modular service, including their composition.
+
+## Migration {#modular-service-migration}
+
+Many services could be migrated to the modular service system, but even when the modular service system is mature, it is not necessary to migrate all services.
+For instance, many system-wide services are a mandatory part of a desktop system, and it doesn't make sense to have multiple instances of them.
+Moving their logic into separate Nix files may still be beneficial for the efficient evaluation of configurations that don't use those services, but that is a rather minor benefit, unless modular services potentially become the standard way to define services.
+
+<!-- TODO example of a single-instance service -->
+
+## Portable Service Options {#modular-service-options-portable}
+
+```{=include=} options
+id-prefix: service-opt-
+list-id: service-options
+source: @PORTABLE_SERVICE_OPTIONS@
+```
+
+## Systemd-specific Service Options {#modular-service-options-systemd}
+
+```{=include=} options
+id-prefix: systemd-service-opt-
+list-id: systemd-service-options
+source: @SYSTEMD_SERVICE_OPTIONS@
+```
+
+[module]: https://nixos.org/manual/nixpkgs/stable/index.html#module-system
+<!-- TODO: more anchors -->
+[`attrsOf`]: #sec-option-types-composed
+[`submodule`]: #sec-option-types-submodule
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 8e9e6e7f225c..d816b7e35dd0 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -11,6 +11,24 @@
   "book-nixos-manual": [
     "index.html#book-nixos-manual"
   ],
+  "modular-service-composition": [
+    "index.html#modular-service-composition"
+  ],
+  "modular-service-migration": [
+    "index.html#modular-service-migration"
+  ],
+  "modular-service-options-portable": [
+    "index.html#modular-service-options-portable"
+  ],
+  "modular-service-options-systemd": [
+    "index.html#modular-service-options-systemd"
+  ],
+  "modular-service-portability": [
+    "index.html#modular-service-portability"
+  ],
+  "modular-services": [
+    "index.html#modular-services"
+  ],
   "module-services-anubis": [
     "index.html#module-services-anubis"
   ],
diff --git a/nixos/modules/misc/assertions.nix b/nixos/modules/misc/assertions.nix
index 5853f64329c1..ae8fa710b2b8 100644
--- a/nixos/modules/misc/assertions.nix
+++ b/nixos/modules/misc/assertions.nix
@@ -32,5 +32,7 @@
     };
 
   };
-  # impl of assertions is in <nixpkgs/nixos/modules/system/activation/top-level.nix>
+  # impl of assertions is in
+  # - <nixpkgs/nixos/modules/system/activation/top-level.nix>
+  # - <nixpkgs/nixos/modules/system/service/portable/lib.nix>
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9c9d49c09ad4..5ab57bd30aed 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1843,6 +1843,8 @@
   ./system/boot/uvesafb.nix
   ./system/boot/zram-as-tmp.nix
   ./system/etc/etc-activation.nix
+  ./system/service/systemd/system.nix
+  ./system/service/systemd/user.nix
   ./tasks/auto-upgrade.nix
   ./tasks/bcache.nix
   ./tasks/cpu-freq.nix
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index d30f7c335357..dcee09968bc1 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -4,10 +4,12 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
+  inherit (lib)
+    mkIf
+    mkMerge
+    ;
+
   cfg = config.services.nextcloud;
 
   overridePackage = cfg.package.override {
@@ -43,7 +45,7 @@ let
     nix-apps = {
       enabled = cfg.extraApps != { };
       linkTarget = pkgs.linkFarm "nix-apps" (
-        mapAttrsToList (name: path: { inherit name path; }) cfg.extraApps
+        lib.mapAttrsToList (name: path: { inherit name path; }) cfg.extraApps
       );
       writable = false;
     };
@@ -63,10 +65,10 @@ let
       ''
         mkdir $out
         ln -sfv "${overridePackage}"/* "$out"
-        ${concatStrings (
-          mapAttrsToList (
+        ${lib.concatStrings (
+          lib.mapAttrsToList (
             name: store:
-            optionalString (store.enabled && store ? linkTarget) ''
+            lib.optionalString (store.enabled && store ? linkTarget) ''
               if [ -e "$out"/${name} ]; then
                 echo "Didn't expect ${name} already in $out!"
                 exit 1
@@ -90,26 +92,26 @@ let
           intl
           sodium
         ] # recommended
-        ++ optional cfg.enableImagemagick imagick
+        ++ lib.optional cfg.enableImagemagick imagick
         # Optionally enabled depending on caching settings
-        ++ optional cfg.caching.apcu apcu
-        ++ optional cfg.caching.redis redis
-        ++ optional cfg.caching.memcached memcached
-        ++ optional (cfg.settings.log_type == "systemd") systemd
+        ++ lib.optional cfg.caching.apcu apcu
+        ++ lib.optional cfg.caching.redis redis
+        ++ lib.optional cfg.caching.memcached memcached
+        ++ lib.optional (cfg.settings.log_type == "systemd") systemd
       )
       ++ cfg.phpExtraExtensions all; # Enabled by user
     extraConfig = toKeyValue cfg.phpOptions;
   };
 
-  toKeyValue = generators.toKeyValue {
-    mkKeyValue = generators.mkKeyValueDefault { } " = ";
+  toKeyValue = lib.generators.toKeyValue {
+    mkKeyValue = lib.generators.mkKeyValueDefault { } " = ";
   };
 
-  phpCli = concatStringsSep " " (
+  phpCli = lib.concatStringsSep " " (
     [
-      "${getExe phpPackage}"
+      "${lib.getExe phpPackage}"
     ]
-    ++ optionals (cfg.cli.memoryLimit != null) [
+    ++ lib.optionals (cfg.cli.memoryLimit != null) [
       "-dmemory_limit=${cfg.cli.memoryLimit}"
     ]
   );
@@ -198,20 +200,20 @@ let
         let
           s3 = c.objectstore.s3;
         in
-        optionalString s3.enable ''
+        lib.optionalString s3.enable ''
           'objectstore' => [
             'class' => '\\OC\\Files\\ObjectStore\\S3',
             'arguments' => [
               'bucket' => '${s3.bucket}',
-              'verify_bucket_exists' => ${boolToString s3.verify_bucket_exists},
+              'verify_bucket_exists' => ${lib.boolToString s3.verify_bucket_exists},
               'key' => '${s3.key}',
               'secret' => nix_read_secret('s3_secret'),
-              ${optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
-              ${optionalString (s3.port != null) "'port' => ${toString s3.port},"}
-              'use_ssl' => ${boolToString s3.useSsl},
-              ${optionalString (s3.region != null) "'region' => '${s3.region}',"}
-              'use_path_style' => ${boolToString s3.usePathStyle},
-              ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('s3_sse_c_key'),"}
+              ${lib.optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
+              ${lib.optionalString (s3.port != null) "'port' => ${toString s3.port},"}
+              'use_ssl' => ${lib.boolToString s3.useSsl},
+              ${lib.optionalString (s3.region != null) "'region' => '${s3.region}',"}
+              'use_path_style' => ${lib.boolToString s3.usePathStyle},
+              ${lib.optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('s3_sse_c_key'),"}
             ],
           ]
         '';
@@ -220,17 +222,17 @@ let
         let
           x = cfg.appstoreEnable;
         in
-        if x == null then "false" else boolToString x;
+        if x == null then "false" else lib.boolToString x;
       mkAppStoreConfig =
         name:
         { enabled, writable, ... }:
-        optionalString enabled ''
-          [ 'path' => '${webroot}/${name}', 'url' => '/${name}', 'writable' => ${boolToString writable} ],
+        lib.optionalString enabled ''
+          [ 'path' => '${webroot}/${name}', 'url' => '/${name}', 'writable' => ${lib.boolToString writable} ],
         '';
     in
     pkgs.writeText "nextcloud-config.php" ''
       <?php
-      ${optionalString requiresRuntimeSystemdCredentials ''
+      ${lib.optionalString requiresRuntimeSystemdCredentials ''
         function nix_read_secret($credential_name) {
           $credentials_directory = getenv("CREDENTIALS_DIRECTORY");
           if (!$credentials_directory) {
@@ -278,15 +280,17 @@ let
       }
       $CONFIG = [
         'apps_paths' => [
-          ${concatStrings (mapAttrsToList mkAppStoreConfig appStores)}
+          ${lib.concatStrings (lib.mapAttrsToList mkAppStoreConfig appStores)}
         ],
-        ${optionalString (showAppStoreSetting) "'appstoreenabled' => ${renderedAppStoreSetting},"}
-        ${optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
-        ${optionalString (c.dbname != null) "'dbname' => '${c.dbname}',"}
-        ${optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
-        ${optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
-        ${optionalString (c.dbtableprefix != null) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
-        ${optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_secret('dbpass'),"}
+        ${lib.optionalString (showAppStoreSetting) "'appstoreenabled' => ${renderedAppStoreSetting},"}
+        ${lib.optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
+        ${lib.optionalString (c.dbname != null) "'dbname' => '${c.dbname}',"}
+        ${lib.optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
+        ${lib.optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
+        ${lib.optionalString (
+          c.dbtableprefix != null
+        ) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
+        ${lib.optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_secret('dbpass'),"}
         'dbtype' => '${c.dbtype}',
         ${objectstoreConfig}
       ];
@@ -296,7 +300,7 @@ let
         "impossible: this should never happen (decoding generated settings file %s failed)"
       ));
 
-      ${optionalString (cfg.secretFile != null) ''
+      ${lib.optionalString (cfg.secretFile != null) ''
         $CONFIG = array_replace_recursive($CONFIG, nix_read_secret_and_decode_json_file('secret_file'));
       ''}
     '';
@@ -304,90 +308,90 @@ in
 {
 
   imports = [
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "cron" "memoryLimit" ]
       [ "services" "nextcloud" "cli" "memoryLimit" ]
     )
-    (mkRemovedOptionModule [ "services" "nextcloud" "enableBrokenCiphersForSSE" ] ''
+    (lib.mkRemovedOptionModule [ "services" "nextcloud" "enableBrokenCiphersForSSE" ] ''
       This option has no effect since there's no supported Nextcloud version packaged here
       using OpenSSL for RC4 SSE.
     '')
-    (mkRemovedOptionModule [ "services" "nextcloud" "config" "dbport" ] ''
+    (lib.mkRemovedOptionModule [ "services" "nextcloud" "config" "dbport" ] ''
       Add port to services.nextcloud.config.dbhost instead.
     '')
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "logLevel" ]
       [ "services" "nextcloud" "settings" "loglevel" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "logType" ]
       [ "services" "nextcloud" "settings" "log_type" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "config" "defaultPhoneRegion" ]
       [ "services" "nextcloud" "settings" "default_phone_region" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "config" "overwriteProtocol" ]
       [ "services" "nextcloud" "settings" "overwriteprotocol" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "skeletonDirectory" ]
       [ "services" "nextcloud" "settings" "skeletondirectory" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "globalProfiles" ]
       [ "services" "nextcloud" "settings" "profile.enabled" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "config" "extraTrustedDomains" ]
       [ "services" "nextcloud" "settings" "trusted_domains" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "config" "trustedProxies" ]
       [ "services" "nextcloud" "settings" "trusted_proxies" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "extraOptions" ]
       [ "services" "nextcloud" "settings" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "nextcloud" "config" "objectstore" "s3" "autocreate" ]
       [ "services" "nextcloud" "config" "objectstore" "s3" "verify_bucket_exists" ]
     )
   ];
 
   options.services.nextcloud = {
-    enable = mkEnableOption "nextcloud";
+    enable = lib.mkEnableOption "nextcloud";
 
-    hostName = mkOption {
-      type = types.str;
+    hostName = lib.mkOption {
+      type = lib.types.str;
       description = "FQDN for the nextcloud instance.";
     };
-    home = mkOption {
-      type = types.str;
+    home = lib.mkOption {
+      type = lib.types.str;
       default = "/var/lib/nextcloud";
       description = "Storage path of nextcloud.";
     };
-    datadir = mkOption {
-      type = types.str;
+    datadir = lib.mkOption {
+      type = lib.types.str;
       default = config.services.nextcloud.home;
-      defaultText = literalExpression "config.services.nextcloud.home";
+      defaultText = lib.literalExpression "config.services.nextcloud.home";
       description = ''
         Nextcloud's data storage path.  Will be [](#opt-services.nextcloud.home) by default.
         This folder will be populated with a config.php file and a data folder which contains the state of the instance (excluding the database).";
       '';
       example = "/mnt/nextcloud-file";
     };
-    extraApps = mkOption {
-      type = types.attrsOf types.package;
+    extraApps = lib.mkOption {
+      type = lib.types.attrsOf lib.types.package;
       default = { };
       description = ''
         Extra apps to install. Should be an attrSet of appid to packages generated by fetchNextcloudApp.
         The appid must be identical to the "id" value in the apps appinfo/info.xml.
         Using this will disable the appstore to prevent Nextcloud from updating these apps (see [](#opt-services.nextcloud.appstoreEnable)).
       '';
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           inherit (pkgs.nextcloud31Packages.apps) mail calendar contacts;
           phonetrack = pkgs.fetchNextcloudApp {
@@ -399,16 +403,16 @@ in
         }
       '';
     };
-    extraAppsEnable = mkOption {
-      type = types.bool;
+    extraAppsEnable = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
         Automatically enable the apps in [](#opt-services.nextcloud.extraApps) every time Nextcloud starts.
         If set to false, apps need to be enabled in the Nextcloud web user interface or with `nextcloud-occ app:enable`.
       '';
     };
-    appstoreEnable = mkOption {
-      type = types.nullOr types.bool;
+    appstoreEnable = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
       default = null;
       example = true;
       description = ''
@@ -418,8 +422,8 @@ in
         Set this to false to disable the installation of apps from the global appstore. App management is always enabled regardless of this setting.
       '';
     };
-    https = mkOption {
-      type = types.bool;
+    https = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Use HTTPS for generated links.
@@ -427,20 +431,21 @@ in
         Be aware that this also enables HTTP Strict Transport Security (HSTS) headers.
       '';
     };
-    package = mkOption {
-      type = types.package;
+    package = lib.mkOption {
+      type = lib.types.package;
       description = "Which package to use for the Nextcloud instance.";
       relatedPackages = [
         "nextcloud30"
         "nextcloud31"
       ];
     };
-    phpPackage = mkPackageOption pkgs "php" {
+    phpPackage = lib.mkPackageOption pkgs "php" {
+      default = [ "php83" ];
       example = "php82";
     };
 
-    finalPackage = mkOption {
-      type = types.package;
+    finalPackage = lib.mkOption {
+      type = lib.types.package;
       readOnly = true;
       description = ''
         Package to the finalized Nextcloud package, including all installed apps.
@@ -448,17 +453,17 @@ in
       '';
     };
 
-    maxUploadSize = mkOption {
+    maxUploadSize = lib.mkOption {
       default = "512M";
-      type = types.str;
+      type = lib.types.str;
       description = ''
         The upload limit for files. This changes the relevant options
         in php.ini and nginx if enabled.
       '';
     };
 
-    webfinger = mkOption {
-      type = types.bool;
+    webfinger = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Enable this option if you plan on using the webfinger plugin.
@@ -466,31 +471,31 @@ in
       '';
     };
 
-    phpExtraExtensions = mkOption {
-      type = with types; functionTo (listOf package);
+    phpExtraExtensions = lib.mkOption {
+      type = lib.types.functionTo (lib.types.listOf lib.types.package);
       default = all: [ ];
-      defaultText = literalExpression "all: []";
+      defaultText = lib.literalExpression "all: []";
       description = ''
         Additional PHP extensions to use for Nextcloud.
         By default, only extensions necessary for a vanilla Nextcloud installation are enabled,
         but you may choose from the list of available extensions and add further ones.
         This is sometimes necessary to be able to install a certain Nextcloud app that has additional requirements.
       '';
-      example = literalExpression ''
+      example = lib.literalExpression ''
         all: [ all.pdlib all.bz2 ]
       '';
     };
 
-    phpOptions = mkOption {
-      type =
-        with types;
-        attrsOf (oneOf [
-          str
-          int
-        ]);
-      defaultText = literalExpression (
-        generators.toPretty { } (
-          defaultPHPSettings // { "openssl.cafile" = literalExpression "config.security.pki.caBundle"; }
+    phpOptions = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.oneOf [
+          lib.types.str
+          lib.types.int
+        ]
+      );
+      defaultText = lib.literalExpression (
+        lib.generators.toPretty { } (
+          defaultPHPSettings // { "openssl.cafile" = lib.literalExpression "config.security.pki.caBundle"; }
         )
       );
       description = ''
@@ -522,14 +527,14 @@ in
       '';
     };
 
-    poolSettings = mkOption {
-      type =
-        with types;
-        attrsOf (oneOf [
-          str
-          int
-          bool
-        ]);
+    poolSettings = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.oneOf [
+          lib.types.str
+          lib.types.int
+          lib.types.bool
+        ]
+      );
       default = {
         "pm" = "dynamic";
         "pm.max_children" = "120";
@@ -547,16 +552,16 @@ in
       '';
     };
 
-    poolConfig = mkOption {
-      type = types.nullOr types.lines;
+    poolConfig = lib.mkOption {
+      type = lib.types.nullOr lib.types.lines;
       default = null;
       description = ''
         Options for Nextcloud's PHP pool. See the documentation on `php-fpm.conf` for details on configuration directives.
       '';
     };
 
-    fastcgiTimeout = mkOption {
-      type = types.int;
+    fastcgiTimeout = lib.mkOption {
+      type = lib.types.int;
       default = 120;
       description = ''
         FastCGI timeout for database connection in seconds.
@@ -565,8 +570,8 @@ in
 
     database = {
 
-      createLocally = mkOption {
-        type = types.bool;
+      createLocally = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to create the database and database user locally.
@@ -576,9 +581,9 @@ in
     };
 
     config = {
-      dbtype = mkOption {
-        type = types.nullOr (
-          types.enum [
+      dbtype = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.enum [
             "sqlite"
             "pgsql"
             "mysql"
@@ -587,25 +592,25 @@ in
         default = null;
         description = "Database type.";
       };
-      dbname = mkOption {
-        type = types.nullOr types.str;
+      dbname = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = "nextcloud";
         description = "Database name.";
       };
-      dbuser = mkOption {
-        type = types.nullOr types.str;
+      dbuser = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = "nextcloud";
         description = "Database user.";
       };
-      dbpassFile = mkOption {
-        type = types.nullOr types.str;
+      dbpassFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           The full path to a file that contains the database password.
         '';
       };
-      dbhost = mkOption {
-        type = types.nullOr types.str;
+      dbhost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default =
           if pgsqlLocal then
             "/run/postgresql"
@@ -622,8 +627,8 @@ in
           defaults to the correct Unix socket instead.
         '';
       };
-      dbtableprefix = mkOption {
-        type = types.nullOr types.str;
+      dbtableprefix = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Table prefix in Nextcloud's database.
@@ -633,8 +638,8 @@ in
           with installations that were originally provisioned with Nextcloud <20.
         '';
       };
-      adminuser = mkOption {
-        type = types.str;
+      adminuser = lib.mkOption {
+        type = lib.types.str;
         default = "root";
         description = ''
           Username for the admin account. The username is only set during the
@@ -642,8 +647,8 @@ in
           ID internally, it cannot be changed later!
         '';
       };
-      adminpassFile = mkOption {
-        type = types.str;
+      adminpassFile = lib.mkOption {
+        type = lib.types.str;
         description = ''
           The full path to a file that contains the admin's password. The password is
           set only in the initial setup of Nextcloud by the systemd service `nextcloud-setup.service`.
@@ -651,7 +656,7 @@ in
       };
       objectstore = {
         s3 = {
-          enable = mkEnableOption ''
+          enable = lib.mkEnableOption ''
             S3 object storage as primary storage.
 
             This mounts a bucket on an Amazon S3 object storage or compatible
@@ -660,66 +665,66 @@ in
             Further details about this feature can be found in the
             [upstream documentation](https://docs.nextcloud.com/server/22/admin_manual/configuration_files/primary_storage.html)
           '';
-          bucket = mkOption {
-            type = types.str;
+          bucket = lib.mkOption {
+            type = lib.types.str;
             example = "nextcloud";
             description = ''
               The name of the S3 bucket.
             '';
           };
-          verify_bucket_exists = mkOption {
-            type = types.bool;
+          verify_bucket_exists = lib.mkOption {
+            type = lib.types.bool;
             default = true;
             description = ''
               Create the objectstore bucket if it does not exist.
             '';
           };
-          key = mkOption {
-            type = types.str;
+          key = lib.mkOption {
+            type = lib.types.str;
             example = "EJ39ITYZEUH5BGWDRUFY";
             description = ''
               The access key for the S3 bucket.
             '';
           };
-          secretFile = mkOption {
-            type = types.str;
+          secretFile = lib.mkOption {
+            type = lib.types.str;
             example = "/var/nextcloud-objectstore-s3-secret";
             description = ''
               The full path to a file that contains the access secret.
             '';
           };
-          hostname = mkOption {
-            type = types.nullOr types.str;
+          hostname = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
             default = null;
             example = "example.com";
             description = ''
               Required for some non-Amazon implementations.
             '';
           };
-          port = mkOption {
-            type = types.nullOr types.port;
+          port = lib.mkOption {
+            type = lib.types.nullOr lib.types.port;
             default = null;
             description = ''
               Required for some non-Amazon implementations.
             '';
           };
-          useSsl = mkOption {
-            type = types.bool;
+          useSsl = lib.mkOption {
+            type = lib.types.bool;
             default = true;
             description = ''
               Use SSL for objectstore access.
             '';
           };
-          region = mkOption {
-            type = types.nullOr types.str;
+          region = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
             default = null;
             example = "REGION";
             description = ''
               Required for some non-Amazon implementations.
             '';
           };
-          usePathStyle = mkOption {
-            type = types.bool;
+          usePathStyle = lib.mkOption {
+            type = lib.types.bool;
             default = false;
             description = ''
               Required for some non-Amazon S3 implementations.
@@ -730,8 +735,8 @@ in
               `http://hostname.domain/bucket` instead.
             '';
           };
-          sseCKeyFile = mkOption {
-            type = types.nullOr types.path;
+          sseCKeyFile = lib.mkOption {
+            type = lib.types.nullOr lib.types.path;
             default = null;
             example = "/var/nextcloud-objectstore-s3-sse-c-key";
             description = ''
@@ -754,7 +759,7 @@ in
     };
 
     enableImagemagick =
-      mkEnableOption ''
+      lib.mkEnableOption ''
         the ImageMagick module for PHP.
         This is used by the theming app and for generating previews of certain images (e.g. SVG and HEIF).
         You may want to disable it for increased security. In that case, previews will still be available
@@ -768,7 +773,7 @@ in
     configureRedis = lib.mkOption {
       type = lib.types.bool;
       default = config.services.nextcloud.notify_push.enable;
-      defaultText = literalExpression "config.services.nextcloud.notify_push.enable";
+      defaultText = lib.literalExpression "config.services.nextcloud.notify_push.enable";
       description = ''
         Whether to configure Nextcloud to use the recommended Redis settings for small instances.
 
@@ -779,15 +784,15 @@ in
     };
 
     caching = {
-      apcu = mkOption {
-        type = types.bool;
+      apcu = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to load the APCu module into PHP.
         '';
       };
-      redis = mkOption {
-        type = types.bool;
+      redis = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to load the Redis module into PHP.
@@ -795,8 +800,8 @@ in
           See <https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/caching_configuration.html>
         '';
       };
-      memcached = mkOption {
-        type = types.bool;
+      memcached = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to load the Memcached module into PHP.
@@ -806,15 +811,15 @@ in
       };
     };
     autoUpdateApps = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Run a regular auto-update of all apps installed from the Nextcloud app store.
         '';
       };
-      startAt = mkOption {
-        type = with types; either str (listOf str);
+      startAt = lib.mkOption {
+        type = lib.types.either lib.types.str (lib.types.listOf lib.types.str);
         default = "05:00:00";
         example = "Sun 14:00:00";
         description = ''
@@ -822,22 +827,22 @@ in
         '';
       };
     };
-    occ = mkOption {
-      type = types.package;
+    occ = lib.mkOption {
+      type = lib.types.package;
       default = occ;
-      defaultText = literalMD "generated script";
+      defaultText = lib.literalMD "generated script";
       description = ''
         The nextcloud-occ program preconfigured to target this Nextcloud instance.
       '';
     };
 
-    settings = mkOption {
-      type = types.submodule {
+    settings = lib.mkOption {
+      type = lib.types.submodule {
         freeformType = jsonFormat.type;
         options = {
 
-          loglevel = mkOption {
-            type = types.ints.between 0 4;
+          loglevel = lib.mkOption {
+            type = lib.types.ints.between 0 4;
             default = 2;
             description = ''
               Log level value between 0 (DEBUG) and 4 (FATAL).
@@ -853,8 +858,8 @@ in
               - 4 (fatal): Log only fatal errors that cause the server to stop.
             '';
           };
-          log_type = mkOption {
-            type = types.enum [
+          log_type = lib.mkOption {
+            type = lib.types.enum [
               "errorlog"
               "file"
               "syslog"
@@ -867,17 +872,17 @@ in
               See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
             '';
           };
-          skeletondirectory = mkOption {
+          skeletondirectory = lib.mkOption {
             default = "";
-            type = types.str;
+            type = lib.types.str;
             description = ''
               The directory where the skeleton files are located. These files will be
               copied to the data directory of new users. Leave empty to not copy any
               skeleton files.
             '';
           };
-          trusted_domains = mkOption {
-            type = types.listOf types.str;
+          trusted_domains = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
             default = [ ];
             description = ''
               Trusted domains, from which the nextcloud installation will be
@@ -885,16 +890,16 @@ in
               `services.nextcloud.hostname` here.
             '';
           };
-          trusted_proxies = mkOption {
-            type = types.listOf types.str;
+          trusted_proxies = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
             default = [ ];
             description = ''
               Trusted proxies, to provide if the nextcloud installation is being
               proxied to secure against e.g. spoofing.
             '';
           };
-          overwriteprotocol = mkOption {
-            type = types.enum [
+          overwriteprotocol = lib.mkOption {
+            type = lib.types.enum [
               ""
               "http"
               "https"
@@ -908,9 +913,9 @@ in
               Nextcloud may be served via HTTPS.
             '';
           };
-          default_phone_region = mkOption {
+          default_phone_region = lib.mkOption {
             default = "";
-            type = types.str;
+            type = lib.types.str;
             example = "DE";
             description = ''
               An [ISO 3166-1](https://www.iso.org/iso-3166-country-codes.html)
@@ -921,7 +926,7 @@ in
               the `+49` prefix can be omitted for phone numbers.
             '';
           };
-          "profile.enabled" = mkEnableOption "global profiles" // {
+          "profile.enabled" = lib.mkEnableOption "global profiles" // {
             description = ''
               Makes user-profiles globally available under `nextcloud.tld/u/user.name`.
               Even though it's enabled by default in Nextcloud, it must be explicitly enabled
@@ -946,7 +951,7 @@ in
       description = ''
         Extra options which should be appended to Nextcloud's config.php file.
       '';
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           redis = {
             host = "/run/redis/redis.sock";
@@ -959,8 +964,8 @@ in
       '';
     };
 
-    secretFile = mkOption {
-      type = types.nullOr types.str;
+    secretFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         Secret options which will be appended to Nextcloud's config.php file (written as JSON, in the same
@@ -970,13 +975,13 @@ in
     };
 
     nginx = {
-      recommendedHttpHeaders = mkOption {
-        type = types.bool;
+      recommendedHttpHeaders = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Enable additional recommended HTTP response headers";
       };
-      hstsMaxAge = mkOption {
-        type = types.ints.positive;
+      hstsMaxAge = lib.mkOption {
+        type = lib.types.ints.positive;
         default = 15552000;
         description = ''
           Value for the `max-age` directive of the HTTP
@@ -986,8 +991,8 @@ in
           directive and header.
         '';
       };
-      enableFastcgiRequestBuffering = mkOption {
-        type = types.bool;
+      enableFastcgiRequestBuffering = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to buffer requests against fastcgi requests. This is a workaround
@@ -1005,8 +1010,8 @@ in
       };
     };
 
-    cli.memoryLimit = mkOption {
-      type = types.nullOr types.str;
+    cli.memoryLimit = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       example = "1G";
       description = ''
@@ -1035,27 +1040,27 @@ in
           '';
 
         in
-        (optional (cfg.poolConfig != null) ''
+        (lib.optional (cfg.poolConfig != null) ''
           Using config.services.nextcloud.poolConfig is deprecated and will become unsupported in a future release.
           Please migrate your configuration to config.services.nextcloud.poolSettings.
         '')
-        ++ (optional (cfg.config.dbtableprefix != null) ''
+        ++ (lib.optional (cfg.config.dbtableprefix != null) ''
           Using `services.nextcloud.config.dbtableprefix` is deprecated. Fresh installations with this
           option set are not allowed anymore since v20.
 
           If you have an existing installation with a custom table prefix, make sure it is
           set correctly in `config.php` and remove the option from your NixOS config.
         '')
-        ++ (optional (versionOlder overridePackage.version "26") (upgradeWarning 25 "23.05"))
-        ++ (optional (versionOlder overridePackage.version "27") (upgradeWarning 26 "23.11"))
-        ++ (optional (versionOlder overridePackage.version "28") (upgradeWarning 27 "24.05"))
-        ++ (optional (versionOlder overridePackage.version "29") (upgradeWarning 28 "24.11"))
-        ++ (optional (versionOlder overridePackage.version "30") (upgradeWarning 29 "24.11"))
-        ++ (optional (versionOlder overridePackage.version "31") (upgradeWarning 30 "25.05"));
+        ++ (lib.optional (lib.versionOlder overridePackage.version "26") (upgradeWarning 25 "23.05"))
+        ++ (lib.optional (lib.versionOlder overridePackage.version "27") (upgradeWarning 26 "23.11"))
+        ++ (lib.optional (lib.versionOlder overridePackage.version "28") (upgradeWarning 27 "24.05"))
+        ++ (lib.optional (lib.versionOlder overridePackage.version "29") (upgradeWarning 28 "24.11"))
+        ++ (lib.optional (lib.versionOlder overridePackage.version "30") (upgradeWarning 29 "24.11"))
+        ++ (lib.optional (lib.versionOlder overridePackage.version "31") (upgradeWarning 30 "25.05"));
 
       services.nextcloud.package =
         with pkgs;
-        mkDefault (
+        lib.mkDefault (
           if pkgs ? nextcloud then
             throw ''
               The `pkgs.nextcloud`-attribute has been removed. If it's supposed to be the default
@@ -1072,10 +1077,8 @@ in
             nextcloud31
         );
 
-      services.nextcloud.phpPackage = pkgs.php83;
-
       services.nextcloud.phpOptions = mkMerge [
-        (mapAttrs (const mkOptionDefault) defaultPHPSettings)
+        (lib.mapAttrs (lib.const lib.mkOptionDefault) defaultPHPSettings)
         {
           upload_max_filesize = cfg.maxUploadSize;
           post_max_size = cfg.maxUploadSize;
@@ -1164,8 +1167,8 @@ in
                   arg = "ADMINPASS";
                   value = ''"$(<"$CREDENTIALS_DIRECTORY/adminpass")"'';
                 };
-                installFlags = concatStringsSep " \\\n    " (
-                  mapAttrsToList (k: v: "${k} ${toString v}") {
+                installFlags = lib.concatStringsSep " \\\n    " (
+                  lib.mapAttrsToList (k: v: "${k} ${toString v}") {
                     "--database" = ''"${c.dbtype}"'';
                     # The following attributes are optional depending on the type of
                     # database.  Those that evaluate to null on the left hand side
@@ -1186,8 +1189,8 @@ in
                 ${lib.getExe occ} maintenance:install \
                     ${installFlags}
               '';
-            occSetTrustedDomainsCmd = concatStringsSep "\n" (
-              imap0 (i: v: ''
+            occSetTrustedDomainsCmd = lib.concatStringsSep "\n" (
+              lib.imap0 (i: v: ''
                 ${lib.getExe occ} config:system:set trusted_domains \
                   ${toString i} --value="${toString v}"
               '') (lib.unique ([ cfg.hostName ] ++ cfg.settings.trusted_domains))
@@ -1198,12 +1201,12 @@ in
             wantedBy = [ "multi-user.target" ];
             wants = [ "nextcloud-update-db.service" ];
             before = [ "phpfpm-nextcloud.service" ];
-            after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
-            requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+            after = lib.optional mysqlLocal "mysql.service" ++ lib.optional pgsqlLocal "postgresql.target";
+            requires = lib.optional mysqlLocal "mysql.service" ++ lib.optional pgsqlLocal "postgresql.target";
             path = [ occ ];
             restartTriggers = [ overrideConfig ];
             script = ''
-              ${optionalString (c.dbpassFile != null) ''
+              ${lib.optionalString (c.dbpassFile != null) ''
                 if [ -z "$(<"$CREDENTIALS_DIRECTORY/dbpass")" ]; then
                   echo "dbpassFile ${c.dbpassFile} is empty!"
                   exit 1
@@ -1223,7 +1226,7 @@ in
                 exit 1
               fi
 
-              ${concatMapStrings
+              ${lib.concatMapStrings
                 (name: ''
                   if [ -d "${cfg.home}"/${name} ]; then
                     echo "Cleaning up ${name}; these are now bundled in the webroot store-path!"
@@ -1245,9 +1248,9 @@ in
 
               ${lib.getExe occ} config:system:delete trusted_domains
 
-              ${optionalString (cfg.extraAppsEnable && cfg.extraApps != { }) ''
+              ${lib.optionalString (cfg.extraAppsEnable && cfg.extraApps != { }) ''
                 # Try to enable apps
-                ${lib.getExe occ} app:enable ${concatStringsSep " " (attrNames cfg.extraApps)}
+                ${lib.getExe occ} app:enable ${lib.concatStringsSep " " (lib.attrNames cfg.extraApps)}
               ''}
 
               ${occSetTrustedDomainsCmd}
@@ -1357,7 +1360,7 @@ in
             PATH = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin";
           };
           settings =
-            mapAttrs (name: mkDefault) {
+            lib.mapAttrs (name: lib.mkDefault) {
               "listen.owner" = config.services.nginx.user;
               "listen.group" = config.services.nginx.group;
             }
@@ -1411,13 +1414,13 @@ in
       services.nextcloud = {
         caching.redis = lib.mkIf cfg.configureRedis true;
         settings = mkMerge [
-          ({
+          {
             datadirectory = lib.mkDefault "${datadir}/data";
             trusted_domains = [ cfg.hostName ];
             "upgrade.disable-web" = true;
             # NixOS already provides its own integrity check and the nix store is read-only, therefore Nextcloud does not need to do its own integrity checks.
             "integrity.check.disabled" = true;
-          })
+          }
           (lib.mkIf cfg.configureRedis {
             "memcache.distributed" = ''\OC\Memcache\Redis'';
             "memcache.locking" = ''\OC\Memcache\Redis'';
@@ -1429,7 +1432,7 @@ in
         ];
       };
 
-      services.nginx.enable = mkDefault true;
+      services.nginx.enable = lib.mkDefault true;
 
       services.nginx.virtualHosts.${cfg.hostName} = {
         root = webroot;
@@ -1528,7 +1531,7 @@ in
         };
         extraConfig = ''
           index index.php index.html /index.php$request_uri;
-          ${optionalString (cfg.nginx.recommendedHttpHeaders) ''
+          ${lib.optionalString (cfg.nginx.recommendedHttpHeaders) ''
             add_header X-Content-Type-Options nosniff;
             add_header X-XSS-Protection "1; mode=block";
             add_header X-Robots-Tag "noindex, nofollow";
@@ -1536,7 +1539,7 @@ in
             add_header X-Frame-Options sameorigin;
             add_header Referrer-Policy no-referrer;
           ''}
-          ${optionalString (cfg.https) ''
+          ${lib.optionalString (cfg.https) ''
             add_header Strict-Transport-Security "max-age=${toString cfg.nginx.hstsMaxAge}; includeSubDomains" always;
           ''}
           client_max_body_size ${cfg.maxUploadSize};
@@ -1549,7 +1552,7 @@ in
           gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
           gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
 
-          ${optionalString cfg.webfinger ''
+          ${lib.optionalString cfg.webfinger ''
             rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
             rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
           ''}
@@ -1559,5 +1562,5 @@ in
   ]);
 
   meta.doc = ./nextcloud.md;
-  meta.maintainers = teams.nextcloud.members;
+  meta.maintainers = lib.teams.nextcloud.members;
 }
diff --git a/nixos/modules/system/service/README.md b/nixos/modules/system/service/README.md
new file mode 100644
index 000000000000..ed0a247267eb
--- /dev/null
+++ b/nixos/modules/system/service/README.md
@@ -0,0 +1,28 @@
+
+# Modular Services
+
+This directory defines a modular service infrastructure for NixOS.
+See the [Modular Services chapter] in the manual [[source]](../../doc/manual/development/modular-services.md).
+
+[Modular Services chapter]: https://nixos.org/manual/nixos/unstable/#modular-services
+
+# Design decision log
+
+- `system.services.<name>`. Alternatives considered
+  - `systemServices`: similar to does not allow importing a composition of services into `system`. Not sure if that's a good idea in the first place, but I've kept the possibility open.
+  - `services.abstract`: used in https://github.com/NixOS/nixpkgs/pull/267111, but too weird. Service modules should fit naturally into the configuration system.
+    Also "abstract" is wrong, because it has submodules - in other words, evalModules results, concrete services - not abstract at all.
+  - `services.modular`: only slightly better than `services.abstract`, but still weird
+
+- No `daemon.*` options. https://github.com/NixOS/nixpkgs/pull/267111/files#r1723206521
+
+- For now, do not add an `enable` option, because it's ambiguous. Does it disable at the Nix level (not generate anything) or at the systemd level (generate a service that is disabled)?
+
+- Move all process options into a `process` option tree. Putting this at the root is messy, because we also have sub-services at that level. Those are rather distinct. Grouping them "by kind" should raise fewer questions.
+
+- `modules/system/service/systemd/system.nix` has `system` twice. Not great, but
+  - they have different meanings
+    1. These are system-provided modules, provided by the configuration manager
+    2. `systemd/system` configures SystemD _system units_.
+  - This reserves `modules/service` for actual service modules, at least until those are lifted out of NixOS, potentially
+
diff --git a/nixos/modules/system/service/portable/lib.nix b/nixos/modules/system/service/portable/lib.nix
new file mode 100644
index 000000000000..0529f81f8561
--- /dev/null
+++ b/nixos/modules/system/service/portable/lib.nix
@@ -0,0 +1,33 @@
+{ lib, ... }:
+let
+  inherit (lib) concatLists mapAttrsToList showOption;
+in
+rec {
+  flattenMapServicesConfigToList =
+    f: loc: config:
+    f loc config
+    ++ concatLists (
+      mapAttrsToList (
+        k: v:
+        flattenMapServicesConfigToList f (
+          loc
+          ++ [
+            "services"
+            k
+          ]
+        ) v
+      ) config.services
+    );
+
+  getWarnings = flattenMapServicesConfigToList (
+    loc: config: map (msg: "in ${showOption loc}: ${msg}") config.warnings
+  );
+
+  getAssertions = flattenMapServicesConfigToList (
+    loc: config:
+    map (ass: {
+      message = "in ${showOption loc}: ${ass.message}";
+      assertion = ass.assertion;
+    }) config.assertions
+  );
+}
diff --git a/nixos/modules/system/service/portable/service.nix b/nixos/modules/system/service/portable/service.nix
new file mode 100644
index 000000000000..b62b23e09a67
--- /dev/null
+++ b/nixos/modules/system/service/portable/service.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  config,
+  options,
+  ...
+}:
+let
+  inherit (lib) mkOption types;
+  pathOrStr = types.coercedTo types.path (x: "${x}") types.str;
+in
+{
+  # https://nixos.org/manual/nixos/unstable/#modular-services
+  _class = "service";
+  imports = [
+    ../../../misc/assertions.nix
+  ];
+  options = {
+    services = mkOption {
+      type = types.attrsOf (
+        types.submoduleWith {
+          modules = [
+            ./service.nix
+          ];
+        }
+      );
+      description = ''
+        A collection of [modular services](https://nixos.org/manual/nixos/unstable/#modular-services) that are configured in one go.
+
+        You could consider the sub-service relationship to be an ownership relation.
+        It **does not** automatically create any other relationship between services (e.g. systemd slices), unless perhaps such a behavior is explicitly defined and enabled in another option.
+      '';
+      default = { };
+      visible = "shallow";
+    };
+    process = {
+      argv = lib.mkOption {
+        type = types.listOf pathOrStr;
+        example = lib.literalExpression ''[ (lib.getExe config.package) "--nobackground" ]'';
+        description = ''
+          Command filename and arguments for starting this service.
+          This is a raw command-line that should not contain any shell escaping.
+          If expansion of environmental variables is required then use
+          a shell script or `importas` from `pkgs.execline`.
+        '';
+      };
+    };
+  };
+}
diff --git a/nixos/modules/system/service/portable/test.nix b/nixos/modules/system/service/portable/test.nix
new file mode 100644
index 000000000000..5f78208dc4eb
--- /dev/null
+++ b/nixos/modules/system/service/portable/test.nix
@@ -0,0 +1,183 @@
+# Run:
+#   nix-instantiate --eval nixos/modules/system/service/portable/test.nix
+let
+  lib = import ../../../../../lib;
+
+  inherit (lib) mkOption types;
+
+  portable-lib = import ./lib.nix { inherit lib; };
+
+  dummyPkg =
+    name:
+    derivation {
+      system = "dummy";
+      name = name;
+      builder = "/bin/false";
+    };
+
+  exampleConfig = {
+    _file = "${__curPos.file}:${toString __curPos.line}";
+    services = {
+      service1 = {
+        process = {
+          argv = [
+            "/usr/bin/echo" # *giggles*
+            "hello"
+          ];
+        };
+        assertions = [
+          {
+            assertion = false;
+            message = "you can't enable this for that reason";
+          }
+        ];
+        warnings = [
+          "The `foo' service is deprecated and will go away soon!"
+        ];
+      };
+      service2 = {
+        process = {
+          # No meta.mainProgram, because it's supposedly an executable script _file_,
+          # not a directory with a bin directory containing the main program.
+          argv = [
+            (dummyPkg "cowsay.sh")
+            "world"
+          ];
+        };
+      };
+      service3 = {
+        process = {
+          argv = [ "/bin/false" ];
+        };
+        services.exclacow = {
+          process = {
+            argv = [
+              (lib.getExe (
+                dummyPkg "cowsay-ng"
+                // {
+                  meta.mainProgram = "cowsay";
+                }
+              ))
+              "!"
+            ];
+          };
+          assertions = [
+            {
+              assertion = false;
+              message = "you can't enable this for such reason";
+            }
+          ];
+          warnings = [
+            "The `bar' service is deprecated and will go away soon!"
+          ];
+        };
+      };
+    };
+  };
+
+  exampleEval = lib.evalModules {
+    modules = [
+      {
+        options.services = mkOption {
+          type = types.attrsOf (
+            types.submoduleWith {
+              class = "service";
+              modules = [
+                ./service.nix
+              ];
+            }
+          );
+        };
+      }
+      exampleConfig
+    ];
+  };
+
+  test =
+    assert
+      exampleEval.config == {
+        services = {
+          service1 = {
+            process = {
+              argv = [
+                "/usr/bin/echo"
+                "hello"
+              ];
+            };
+            services = { };
+            assertions = [
+              {
+                assertion = false;
+                message = "you can't enable this for that reason";
+              }
+            ];
+            warnings = [
+              "The `foo' service is deprecated and will go away soon!"
+            ];
+          };
+          service2 = {
+            process = {
+              argv = [
+                "${dummyPkg "cowsay.sh"}"
+                "world"
+              ];
+            };
+            services = { };
+            assertions = [ ];
+            warnings = [ ];
+          };
+          service3 = {
+            process = {
+              argv = [ "/bin/false" ];
+            };
+            services.exclacow = {
+              process = {
+                argv = [
+                  "${dummyPkg "cowsay-ng"}/bin/cowsay"
+                  "!"
+                ];
+              };
+              services = { };
+              assertions = [
+                {
+                  assertion = false;
+                  message = "you can't enable this for such reason";
+                }
+              ];
+              warnings = [ "The `bar' service is deprecated and will go away soon!" ];
+            };
+            assertions = [ ];
+            warnings = [ ];
+          };
+        };
+      };
+
+    assert
+      portable-lib.getWarnings [ "service1" ] exampleEval.config.services.service1 == [
+        "in service1: The `foo' service is deprecated and will go away soon!"
+      ];
+
+    assert
+      portable-lib.getAssertions [ "service1" ] exampleEval.config.services.service1 == [
+        {
+          message = "in service1: you can't enable this for that reason";
+          assertion = false;
+        }
+      ];
+
+    assert
+      portable-lib.getWarnings [ "service3" ] exampleEval.config.services.service3 == [
+        "in service3.services.exclacow: The `bar' service is deprecated and will go away soon!"
+      ];
+    assert
+      portable-lib.getAssertions [ "service3" ] exampleEval.config.services.service3 == [
+        {
+          message = "in service3.services.exclacow: you can't enable this for such reason";
+          assertion = false;
+        }
+      ];
+
+    "ok";
+
+in
+test
diff --git a/nixos/modules/system/service/systemd/service.nix b/nixos/modules/system/service/systemd/service.nix
new file mode 100644
index 000000000000..9ba9bb7bf3f2
--- /dev/null
+++ b/nixos/modules/system/service/systemd/service.nix
@@ -0,0 +1,121 @@
+{
+  lib,
+  config,
+  systemdPackage,
+  ...
+}:
+let
+  inherit (lib)
+    concatMapStringsSep
+    isDerivation
+    isInt
+    isFloat
+    isPath
+    isString
+    mkOption
+    replaceStrings
+    types
+    ;
+  inherit (builtins) toJSON;
+
+  # Local copy of systemd exec argument escaping function.
+  # TODO: This could perhaps be deduplicated, but it is unclear where it should go.
+  #       Preferably, we don't create a hard dependency on NixOS here, so that this
+  #       module can be reused in a non-NixOS context, such as mutaable services
+  #       in /run/systemd/system.
+
+  # Quotes an argument for use in Exec* service lines.
+  # systemd accepts "-quoted strings with escape sequences, toJSON produces
+  # a subset of these.
+  # Additionally we escape % to disallow expansion of % specifiers. Any lone ;
+  # in the input will be turned it ";" and thus lose its special meaning.
+  # Every $ is escaped to $$, this makes it unnecessary to disable environment
+  # substitution for the directive.
+  escapeSystemdExecArg =
+    arg:
+    let
+      s =
+        if isPath arg then
+          "${arg}"
+        else if isString arg then
+          arg
+        else if isInt arg || isFloat arg || isDerivation arg then
+          toString arg
+        else
+          throw "escapeSystemdExecArg only allows strings, paths, numbers and derivations";
+    in
+    replaceStrings [ "%" "$" ] [ "%%" "$$" ] (toJSON s);
+
+  # Quotes a list of arguments into a single string for use in a Exec*
+  # line.
+  escapeSystemdExecArgs = concatMapStringsSep " " escapeSystemdExecArg;
+
+in
+{
+  imports = [
+    ../portable/service.nix
+    (lib.mkAliasOptionModule [ "systemd" "service" ] [ "systemd" "services" "" ])
+    (lib.mkAliasOptionModule [ "systemd" "socket" ] [ "systemd" "sockets" "" ])
+  ];
+  options = {
+    systemd.services = mkOption {
+      description = ''
+        This module configures systemd services, with the notable difference that their unit names will be prefixed with the abstract service name.
+
+        This option's value is not suitable for reading, but you can define a module here that interacts with just the unit configuration in the host system configuration.
+
+        Note that this option contains _deferred_ modules.
+        This means that the module has not been combined with the system configuration yet, no values can be read from this option.
+        What you can do instead is define a module that reads from the module arguments (such as `config`) that are available when the module is merged into the system configuration.
+      '';
+      type = types.lazyAttrsOf (
+        types.deferredModuleWith {
+          staticModules = [
+            # TODO: Add modules for the purpose of generating documentation?
+          ];
+        }
+      );
+      default = { };
+    };
+    systemd.sockets = mkOption {
+      description = ''
+        Declares systemd socket units. Names will be prefixed by the service name / path.
+
+        See {option}`systemd.services`.
+      '';
+      type = types.lazyAttrsOf types.deferredModule;
+      default = { };
+    };
+
+    # Also import systemd logic into sub-services
+    # extends the portable `services` option
+    services = mkOption {
+      type = types.attrsOf (
+        types.submoduleWith {
+          class = "service";
+          modules = [
+            ./service.nix
+          ];
+          specialArgs = {
+            inherit systemdPackage;
+          };
+        }
+      );
+    };
+  };
+  config = {
+    # Note that this is the systemd.services option above, not the system one.
+    systemd.services."" = {
+      # TODO description;
+      wantedBy = lib.mkDefault [ "multi-user.target" ];
+      serviceConfig = {
+        Type = lib.mkDefault "simple";
+        Restart = lib.mkDefault "always";
+        RestartSec = lib.mkDefault "5";
+        ExecStart = [
+          (escapeSystemdExecArgs config.process.argv)
+        ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/system/service/systemd/system.nix b/nixos/modules/system/service/systemd/system.nix
new file mode 100644
index 000000000000..92bf4d41abe8
--- /dev/null
+++ b/nixos/modules/system/service/systemd/system.nix
@@ -0,0 +1,90 @@
+{
+  lib,
+  config,
+  options,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    concatMapAttrs
+    mkOption
+    types
+    concatLists
+    mapAttrsToList
+    ;
+
+  portable-lib = import ../portable/lib.nix { inherit lib; };
+
+  dash =
+    before: after:
+    if after == "" then
+      before
+    else if before == "" then
+      after
+    else
+      "${before}-${after}";
+
+  makeUnits =
+    unitType: prefix: service:
+    concatMapAttrs (unitName: unitModule: {
+      "${dash prefix unitName}" =
+        { ... }:
+        {
+          imports = [ unitModule ];
+        };
+    }) service.systemd.${unitType}
+    // concatMapAttrs (
+      subServiceName: subService: makeUnits unitType (dash prefix subServiceName) subService
+    ) service.services;
+in
+{
+  # First half of the magic: mix systemd logic into the otherwise abstract services
+  options = {
+    system.services = mkOption {
+      description = ''
+        A collection of NixOS [modular services](https://nixos.org/manual/nixos/unstable/#modular-services) that are configured as systemd services.
+      '';
+      type = types.attrsOf (
+        types.submoduleWith {
+          class = "service";
+          modules = [
+            ./service.nix
+          ];
+          specialArgs = {
+            # perhaps: features."systemd" = { };
+            inherit pkgs;
+            systemdPackage = config.systemd.package;
+          };
+        }
+      );
+      default = { };
+      visible = "shallow";
+    };
+  };
+
+  # Second half of the magic: siphon units that were defined in isolation to the system
+  config = {
+
+    assertions = concatLists (
+      mapAttrsToList (
+        name: cfg: portable-lib.getAssertions (options.system.services.loc ++ [ name ]) cfg
+      ) config.system.services
+    );
+
+    warnings = concatLists (
+      mapAttrsToList (
+        name: cfg: portable-lib.getWarnings (options.system.services.loc ++ [ name ]) cfg
+      ) config.system.services
+    );
+
+    systemd.services = concatMapAttrs (
+      serviceName: topLevelService: makeUnits "services" serviceName topLevelService
+    ) config.system.services;
+
+    systemd.sockets = concatMapAttrs (
+      serviceName: topLevelService: makeUnits "sockets" serviceName topLevelService
+    ) config.system.services;
+  };
+}
diff --git a/nixos/modules/system/service/systemd/test.nix b/nixos/modules/system/service/systemd/test.nix
new file mode 100644
index 000000000000..70d1b17d1a6d
--- /dev/null
+++ b/nixos/modules/system/service/systemd/test.nix
@@ -0,0 +1,92 @@
+# Run:
+#   nix-build -A nixosTests.modularService
+
+{
+  evalSystem,
+  runCommand,
+  hello,
+  ...
+}:
+
+let
+  machine = evalSystem (
+    { lib, ... }:
+    let
+      hello' = lib.getExe hello;
+    in
+    {
+
+      # Test input
+
+      system.services.foo = {
+        process = {
+          argv = [
+            hello'
+            "--greeting"
+            "hoi"
+          ];
+        };
+      };
+      system.services.bar = {
+        process = {
+          argv = [
+            hello'
+            "--greeting"
+            "hoi"
+          ];
+        };
+        systemd.service = {
+          serviceConfig.X-Bar = "lol crossbar whatever";
+        };
+        services.db = {
+          process = {
+            argv = [
+              hello'
+              "--greeting"
+              "Hi, I'm a database, would you believe it"
+            ];
+          };
+          systemd.service = {
+            serviceConfig.RestartSec = "42";
+          };
+        };
+      };
+
+      # irrelevant stuff
+      system.stateVersion = "25.05";
+      fileSystems."/".device = "/test/dummy";
+      boot.loader.grub.enable = false;
+    }
+  );
+
+  inherit (machine.config.system.build) toplevel;
+in
+runCommand "test-modular-service-systemd-units"
+  {
+    passthru = {
+      inherit
+        machine
+        toplevel
+        ;
+    };
+  }
+  ''
+    echo ${toplevel}/etc/systemd/system/foo.service:
+    cat -n ${toplevel}/etc/systemd/system/foo.service
+    (
+      set -x
+      grep -F 'ExecStart="${hello}/bin/hello" "--greeting" "hoi"' ${toplevel}/etc/systemd/system/foo.service >/dev/null
+
+      grep -F 'ExecStart="${hello}/bin/hello" "--greeting" "hoi"' ${toplevel}/etc/systemd/system/bar.service >/dev/null
+      grep -F 'X-Bar=lol crossbar whatever' ${toplevel}/etc/systemd/system/bar.service >/dev/null
+
+      grep    'ExecStart="${hello}/bin/hello" "--greeting" ".*database.*"' ${toplevel}/etc/systemd/system/bar-db.service >/dev/null
+      grep -F 'RestartSec=42' ${toplevel}/etc/systemd/system/bar-db.service >/dev/null
+
+      [[ ! -e ${toplevel}/etc/systemd/system/foo.socket ]]
+      [[ ! -e ${toplevel}/etc/systemd/system/bar.socket ]]
+      [[ ! -e ${toplevel}/etc/systemd/system/bar-db.socket ]]
+    )
+    echo 🐬👍
+    touch $out
+  ''
diff --git a/nixos/modules/system/service/systemd/user.nix b/nixos/modules/system/service/systemd/user.nix
new file mode 100644
index 000000000000..514731233b09
--- /dev/null
+++ b/nixos/modules/system/service/systemd/user.nix
@@ -0,0 +1,3 @@
+# TBD, analogous to system.nix but for user units
+{
+}
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 47318ca4d600..0832ca937d32 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -194,6 +194,7 @@ let
           -L ${nixStoreFilesystemLabel} \
           -U eb176051-bd15-49b7-9e6b-462e0b467019 \
           -T 0 \
+          --hard-dereference \
           --tar=f \
           "$TMPDIR"/store.img
 
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9d6907a1d909..82d53c0613c6 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -89,6 +89,16 @@ let
     featureFlags.minimalModules = { };
   };
   evalMinimalConfig = module: nixosLib.evalModules { modules = [ module ]; };
+  evalSystem =
+    module:
+    import ../lib/eval-config.nix {
+      system = null;
+      modules = [
+        ../modules/misc/nixpkgs/read-only.nix
+        { nixpkgs.pkgs = pkgs; }
+        module
+      ];
+    };
 
   inherit
     (rec {
@@ -589,6 +599,7 @@ in
   gerrit = runTest ./gerrit.nix;
   geth = runTest ./geth.nix;
   ghostunnel = runTest ./ghostunnel.nix;
+  ghostunnel-modular = runTest ./ghostunnel-modular.nix;
   gitdaemon = runTest ./gitdaemon.nix;
   gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
   github-runner = runTest ./github-runner.nix;
@@ -894,6 +905,9 @@ in
   mjolnir = runTest ./matrix/mjolnir.nix;
   mobilizon = runTest ./mobilizon.nix;
   mod_perl = runTest ./mod_perl.nix;
+  modularService = pkgs.callPackage ../modules/system/service/systemd/test.nix {
+    inherit evalSystem;
+  };
   molly-brown = runTest ./molly-brown.nix;
   mollysocket = runTest ./mollysocket.nix;
   monado = runTest ./monado.nix;
diff --git a/nixos/tests/ghostunnel-modular.nix b/nixos/tests/ghostunnel-modular.nix
new file mode 100644
index 000000000000..a1f17bc03400
--- /dev/null
+++ b/nixos/tests/ghostunnel-modular.nix
@@ -0,0 +1,120 @@
+{ hostPkgs, lib, ... }:
+{
+  _class = "nixosTest";
+  name = "ghostunnel";
+  nodes = {
+    backend =
+      { pkgs, ... }:
+      {
+        services.nginx.enable = true;
+        services.nginx.virtualHosts."backend".root = pkgs.runCommand "webroot" { } ''
+          mkdir $out
+          echo hi >$out/hi.txt
+        '';
+        networking.firewall.allowedTCPPorts = [ 80 ];
+      };
+    service =
+      { pkgs, ... }:
+      {
+        system.services."ghostunnel-plain-old" = {
+          imports = [ pkgs.ghostunnel.services.default ];
+          ghostunnel = {
+            listen = "0.0.0.0:443";
+            cert = "/root/service-cert.pem";
+            key = "/root/service-key.pem";
+            disableAuthentication = true;
+            target = "backend:80";
+            unsafeTarget = true;
+          };
+        };
+        system.services."ghostunnel-client-cert" = {
+          imports = [ pkgs.ghostunnel.services.default ];
+          ghostunnel = {
+            listen = "0.0.0.0:1443";
+            cert = "/root/service-cert.pem";
+            key = "/root/service-key.pem";
+            cacert = "/root/ca.pem";
+            target = "backend:80";
+            allowCN = [ "client" ];
+            unsafeTarget = true;
+          };
+        };
+        networking.firewall.allowedTCPPorts = [
+          443
+          1443
+        ];
+      };
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
+      };
+  };
+
+  testScript = ''
+
+    # prepare certificates
+
+    def cmd(command):
+      print(f"+{command}")
+      r = os.system(command)
+      if r != 0:
+        raise Exception(f"Command {command} failed with exit code {r}")
+
+    # Create CA
+    cmd("${hostPkgs.openssl}/bin/openssl genrsa -out ca-key.pem 4096")
+    cmd("${hostPkgs.openssl}/bin/openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -subj '/C=NL/ST=Zuid-Holland/L=The Hague/O=Stevige Balken en Planken B.V./OU=OpSec/CN=Certificate Authority' -out ca.pem")
+
+    # Create service
+    cmd("${hostPkgs.openssl}/bin/openssl genrsa -out service-key.pem 4096")
+    cmd("${hostPkgs.openssl}/bin/openssl req -subj '/CN=service' -sha256 -new -key service-key.pem -out service.csr")
+    cmd("echo subjectAltName = DNS:service,IP:127.0.0.1 >> extfile.cnf")
+    cmd("echo extendedKeyUsage = serverAuth >> extfile.cnf")
+    cmd("${hostPkgs.openssl}/bin/openssl x509 -req -days 365 -sha256 -in service.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out service-cert.pem -extfile extfile.cnf")
+
+    # Create client
+    cmd("${hostPkgs.openssl}/bin/openssl genrsa -out client-key.pem 4096")
+    cmd("${hostPkgs.openssl}/bin/openssl req -subj '/CN=client' -new -key client-key.pem -out client.csr")
+    cmd("echo extendedKeyUsage = clientAuth > extfile-client.cnf")
+    cmd("${hostPkgs.openssl}/bin/openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -extfile extfile-client.cnf")
+
+    cmd("ls -al")
+
+    start_all()
+
+    # Configuration
+    service.copy_from_host("ca.pem", "/root/ca.pem")
+    service.copy_from_host("service-cert.pem", "/root/service-cert.pem")
+    service.copy_from_host("service-key.pem", "/root/service-key.pem")
+    client.copy_from_host("ca.pem", "/root/ca.pem")
+    client.copy_from_host("service-cert.pem", "/root/service-cert.pem")
+    client.copy_from_host("client-cert.pem", "/root/client-cert.pem")
+    client.copy_from_host("client-key.pem", "/root/client-key.pem")
+
+    backend.wait_for_unit("nginx.service")
+    service.wait_for_unit("multi-user.target")
+    service.wait_for_unit("multi-user.target")
+    client.wait_for_unit("multi-user.target")
+
+    # Check assumptions before the real test
+    client.succeed("bash -c 'diff <(curl -v --no-progress-meter http://backend/hi.txt) <(echo hi)'")
+
+    # Plain old simple TLS can connect, ignoring cert
+    client.succeed("bash -c 'diff <(curl -v --no-progress-meter --insecure https://service/hi.txt) <(echo hi)'")
+
+    # Plain old simple TLS provides correct signature with its cert
+    client.succeed("bash -c 'diff <(curl -v --no-progress-meter --cacert /root/ca.pem https://service/hi.txt) <(echo hi)'")
+
+    # Client can authenticate with certificate
+    client.succeed("bash -c 'diff <(curl -v --no-progress-meter --cert /root/client-cert.pem --key /root/client-key.pem --cacert /root/ca.pem https://service:1443/hi.txt) <(echo hi)'")
+
+    # Client must authenticate with certificate
+    client.fail("bash -c 'diff <(curl -v --no-progress-meter --cacert /root/ca.pem https://service:1443/hi.txt) <(echo hi)'")
+  '';
+
+  meta.maintainers = with lib.maintainers; [
+    roberth
+  ];
+}
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 955c598468bc..42ce508aabaf 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -12025,6 +12025,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  opencode-nvim = buildVimPlugin {
+    pname = "opencode.nvim";
+    version = "2025-07-24";
+    src = fetchFromGitHub {
+      owner = "NickvanDyke";
+      repo = "opencode.nvim";
+      rev = "db3aa9ca3b738600c81e29646a3356477dabaa87";
+      sha256 = "1yhspgja3zdnsf8r3ahci14cndk3bzxvq0w9jqggd7ya103nq6kz";
+    };
+    meta.homepage = "https://github.com/NickvanDyke/opencode.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   openingh-nvim = buildVimPlugin {
     pname = "openingh.nvim";
     version = "2025-05-01";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 330dba5b5178..8994b0de532c 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -923,6 +923,7 @@ https://github.com/sonph/onehalf/,,
 https://github.com/rmehri01/onenord.nvim/,main,
 https://github.com/tyru/open-browser-github.vim/,,
 https://github.com/tyru/open-browser.vim/,,
+https://github.com/NickvanDyke/opencode.nvim/,HEAD,
 https://github.com/Almo7aya/openingh.nvim/,,
 https://github.com/salkin-mada/openscad.nvim/,HEAD,
 https://github.com/chipsenkbeil/org-roam.nvim/,HEAD,
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index 91ea5934b35f..9dbc67d77a4f 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -68,14 +68,14 @@
 
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20250613.0";
+  version = "20250718.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-+6DTbYq50UPSQ+KipXhWje1bZs64wZrS37z2Na1RtN8=";
+    hash = "sha256-EEiuymfu28bJ6pfBKwlsCGDq7XlKGZYK+2WjPJ+tcxw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/video/olive-editor/default.nix b/pkgs/applications/video/olive-editor/default.nix
index 4a49b281adaa..787062bd3178 100644
--- a/pkgs/applications/video/olive-editor/default.nix
+++ b/pkgs/applications/video/olive-editor/default.nix
@@ -30,6 +30,9 @@ let
         hash = "sha256-I2/JPmUBDb0bw7qbSZcAkYHB2q2Uo7En7ZurMwWhg/M=";
       }
     );
+
+    # robin-map headers require c++17
+    cmakeFlags = (old.cmakeFlags or [ ]) ++ [ (lib.cmakeFeature "CMAKE_CXX_STANDARD" "17") ];
   });
 in
 
diff --git a/pkgs/by-name/am/amfora/package.nix b/pkgs/by-name/am/amfora/package.nix
index 9af81c3cb66a..8a6ee884bd16 100644
--- a/pkgs/by-name/am/amfora/package.nix
+++ b/pkgs/by-name/am/amfora/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "amfora";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "makeworld-the-better-one";
     repo = "amfora";
     tag = "v${version}";
-    hash = "sha256-KOuKgxH3n4rdF+oj/TwEcRqX1sn4A9e23FNwQMhMVO4=";
+    hash = "sha256-6nY/wVqhSm+ZLA8ktrgmxoYiHK1r96aNbSf8+1YMXf8=";
   };
 
-  vendorHash = "sha256-T/hnlQMDOZV+QGl7xp29sBGfb4VXcXqN6PDoBFdpp4M=";
+  vendorHash = "sha256-zZuFZtG0KKJ29t/9XyjRPIvyZqItxH2KwyKcAx3nuNM=";
 
   postInstall = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     sed -i "s:amfora:$out/bin/amfora:" amfora.desktop
diff --git a/pkgs/by-name/as/astyle/package.nix b/pkgs/by-name/as/astyle/package.nix
index 94c9dad7dae8..8277e261b293 100644
--- a/pkgs/by-name/as/astyle/package.nix
+++ b/pkgs/by-name/as/astyle/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "astyle";
-  version = "3.6.9";
+  version = "3.6.10";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-tkRZdlTfW0AIe+SkZyPGUED3zlnzNp8bj2kPnBDKurw=";
+    hash = "sha256-HW7onAhKk93MKNGgVs2o0cNX0xjvjihEVtnwvSzrS20=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/bc/bcc/libbcc-path.patch b/pkgs/by-name/bc/bcc/libbcc-path.patch
deleted file mode 100644
index 187bb3aadd00..000000000000
--- a/pkgs/by-name/bc/bcc/libbcc-path.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- source.org/src/python/bcc/libbcc.py	2018-05-13 08:35:06.850522883 +0100
-+++ source/src/python/bcc/libbcc.py	2018-05-13 08:36:24.602733151 +0100
-@@ -14,7 +14,7 @@
- 
- import ctypes as ct
- 
--lib = ct.CDLL("libbcc.so.0", use_errno=True)
-+lib = ct.CDLL("@out@/lib/libbcc.so.0", use_errno=True)
- 
- # keep in sync with bpf_common.h
- lib.bpf_module_create_b.restype = ct.c_void_p
diff --git a/pkgs/by-name/bc/bcc/package.nix b/pkgs/by-name/bc/bcc/package.nix
index c45d4b854b7e..27cd51936203 100644
--- a/pkgs/by-name/bc/bcc/package.nix
+++ b/pkgs/by-name/bc/bcc/package.nix
@@ -16,15 +16,14 @@
   nixosTests,
   python3Packages,
   readline,
-  stdenv,
+  replaceVars,
   zip,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "bcc";
   version = "0.35.0";
-
-  disabled = !stdenv.hostPlatform.isLinux;
+  pyproject = false;
 
   src = fetchFromGitHub {
     owner = "iovisor";
@@ -32,12 +31,36 @@ python3Packages.buildPythonApplication rec {
     tag = "v${version}";
     hash = "sha256-eP/VEq7cPALi2oDKAZFQGQ3NExdmcBKyi6ddRZiYmbI=";
   };
-  format = "other";
 
-  buildInputs = with llvmPackages; [
-    llvm
-    llvm.dev
-    libclang
+  patches = [
+    # This is needed until we fix
+    # https://github.com/NixOS/nixpkgs/issues/40427
+    ./fix-deadlock-detector-import.patch
+    # Quick & dirty fix for bashreadline
+    # https://github.com/NixOS/nixpkgs/issues/328743
+    ./bashreadline.py-remove-dependency-on-elftools.patch
+
+    (replaceVars ./absolute-ausyscall.patch {
+      ausyscall = lib.getExe' audit "ausyscall";
+    })
+  ];
+
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = [ python3Packages.netaddr ];
+
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+    llvmPackages.llvm
+    makeWrapper
+    zip
+  ];
+
+  buildInputs = [
+    llvmPackages.llvm
+    llvmPackages.libclang
     elfutils
     luajit
     netperf
@@ -47,45 +70,18 @@ python3Packages.buildPythonApplication rec {
     libbpf
   ];
 
-  patches = [
-    # This is needed until we fix
-    # https://github.com/NixOS/nixpkgs/issues/40427
-    ./fix-deadlock-detector-import.patch
-    # Quick & dirty fix for bashreadline
-    # https://github.com/NixOS/nixpkgs/issues/328743
-    ./bashreadline.py-remove-dependency-on-elftools.patch
-  ];
-
-  propagatedBuildInputs = [ python3Packages.netaddr ];
-  nativeBuildInputs = [
-    bison
-    cmake
-    flex
-    llvmPackages.llvm.dev
-    makeWrapper
-    python3Packages.setuptools
-    zip
-  ];
-
   cmakeFlags = [
-    "-DBCC_KERNEL_MODULES_DIR=/run/booted-system/kernel-modules/lib/modules"
-    "-DREVISION=${version}"
-    "-DENABLE_USDT=ON"
-    "-DENABLE_CPP_API=ON"
-    "-DCMAKE_USE_LIBBPF_PACKAGE=ON"
-    "-DENABLE_LIBDEBUGINFOD=OFF"
+    (lib.cmakeFeature "BCC_KERNEL_MODULES_DIR" "/run/booted-system/kernel-modules/lib/modules")
+    (lib.cmakeFeature "REVISION" version)
+    (lib.cmakeBool "ENABLE_USDT" true)
+    (lib.cmakeBool "ENABLE_CPP_API" true)
+    (lib.cmakeBool "CMAKE_USE_LIBBPF_PACKAGE" true)
+    (lib.cmakeBool "ENABLE_LIBDEBUGINFOD" false)
   ];
 
-  # to replace this executable path:
-  # https://github.com/iovisor/bcc/blob/master/src/python/bcc/syscall.py#L384
-  ausyscall = "${audit}/bin/ausyscall";
-
   postPatch = ''
-    substituteAll ${./libbcc-path.patch} ./libbcc-path.patch
-    patch -p1 < libbcc-path.patch
-
-    substituteAll ${./absolute-ausyscall.patch} ./absolute-ausyscall.patch
-    patch -p1 < absolute-ausyscall.patch
+    substituteInPlace src/python/bcc/libbcc.py \
+      --replace-fail "libbcc.so.0" "$out/lib/libbcc.so.0"
 
     # https://github.com/iovisor/bcc/issues/3996
     substituteInPlace src/cc/libbcc.pc.in \
@@ -95,10 +91,6 @@ python3Packages.buildPythonApplication rec {
       --replace-fail '/bin/bash' '${readline}/lib/libreadline.so'
   '';
 
-  preInstall = ''
-    # required for setuptool during install
-    export PYTHONPATH=$out/${python3Packages.python.sitePackages}:$PYTHONPATH
-  '';
   postInstall = ''
     mkdir -p $out/bin $out/share
     rm -r $out/share/bcc/tools/old
diff --git a/pkgs/by-name/bl/blender/package.nix b/pkgs/by-name/bl/blender/package.nix
index dbc625085c3d..11e9b3a0fe91 100644
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -58,7 +58,7 @@
   opencolorio,
   openexr,
   openimagedenoise,
-  openimageio_2,
+  openimageio,
   openjpeg,
   openpgl,
   opensubdiv,
@@ -250,7 +250,7 @@ stdenv'.mkDerivation (finalAttrs: {
     (manifold.override { tbb_2021 = tbb; })
     opencolorio
     openexr
-    openimageio_2
+    openimageio
     openjpeg
     (openpgl.override { inherit tbb; })
     (opensubdiv.override { inherit cudaSupport; })
diff --git a/pkgs/by-name/ca/catppuccinifier-gui/package.nix b/pkgs/by-name/ca/catppuccinifier-gui/package.nix
index 4388c11c6662..0e2317ab0265 100644
--- a/pkgs/by-name/ca/catppuccinifier-gui/package.nix
+++ b/pkgs/by-name/ca/catppuccinifier-gui/package.nix
@@ -3,79 +3,71 @@
   gtk3,
   glib,
   dbus,
-  curl,
-  wget,
+  nodejs,
   cairo,
-  stdenv,
-  librsvg,
-  libsoup_2_4,
-  fetchzip,
-  openssl_3,
+  cargo-tauri,
   webkitgtk_4_1,
+  wrapGAppsHook3,
   gdk-pixbuf,
   pkg-config,
-  makeDesktopItem,
-  copyDesktopItems,
-  autoPatchelfHook,
+  rustPlatform,
+  fetchYarnDeps,
+  yarnConfigHook,
+  fetchFromGitHub,
+  desktop-file-utils,
 }:
-let
-  version = "9.0.0";
-in
-stdenv.mkDerivation {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "catppuccinifier-gui";
-  inherit version;
+  version = "9.1.0";
 
-  src = fetchzip {
-    url = "https://github.com/lighttigerXIV/catppuccinifier/releases/download/${version}/Catppuccinifier-Linux-${version}.tar.xz";
-    hash = "sha256-wGj0mWxmGqG/z/jmQ5pw1LdxYKzHaf+eOUXhpMT3kgs=";
+  src = fetchFromGitHub {
+    owner = "lighttigerXIV";
+    repo = "catppuccinifier";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-e8sLYp+0YhC/vAn4vag9UUaw3VYDRERGnLD1RuW1TXE=";
+  };
+
+  sourceRoot = finalAttrs.src.name + "/src/catppuccinifier-gui";
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = finalAttrs.cargoRoot;
+
+  cargoHash = "sha256-BUXqPY3jNn4YB1avtCp6MFyN1KIYqT0b1H9drOmikj0=";
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/src/catppuccinifier-gui/yarn.lock";
+    hash = "sha256-UfQZf2raMrgPhUQVTAW+mA/nP1XjLKx0WBbYtdeD9kY=";
   };
 
   nativeBuildInputs = [
-    autoPatchelfHook
+    cargo-tauri.hook
     pkg-config
-    copyDesktopItems
+    nodejs
+    yarnConfigHook
+    wrapGAppsHook3
+    desktop-file-utils
   ];
 
   buildInputs = [
-    curl
-    wget
     webkitgtk_4_1
     gtk3
     cairo
     gdk-pixbuf
-    libsoup_2_4
     glib
     dbus
-    openssl_3
-    librsvg
   ];
 
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm555 installation-files/catppuccinifier-gui "$out/bin/catppuccinifier-gui"
-    install -Dm644 installation-files/catppuccinifier.png "$out/share/pixmaps/catppuccinifier.png"
-
-    runHook postInstall
+  postInstall = ''
+    desktop-file-edit "$out/share/applications/catppuccinifier-gui.desktop" \
+      --set-key "Categories" --set-value "Graphics" \
+      --set-key "Comment" --set-value "Apply catppuccin flavors to your wallpapers"
   '';
 
-  desktopItems = [
-    (makeDesktopItem {
-      desktopName = "catppuccinifier";
-      name = "catppuccinifier";
-      exec = "catppuccinifier-gui";
-      icon = "catppuccinifier";
-      comment = "Apply catppuccin flavors to your wallpapers";
-    })
-  ];
-
   meta = {
     description = "Apply catppuccin flavors to your wallpapers";
     homepage = "https://github.com/lighttigerXIV/catppuccinifier";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ isabelroses ];
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.linux;
     mainProgram = "catppuccinifier-gui";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
-}
+})
diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 57e4874fd2b3..e1af552d8fe9 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.2.10";
+  version = "6.2.11";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-56tbSOoYRtmRzKqRDe951JXOlPymRGtEyGSZ0dWXOcw=";
+    hash = "sha256-3VQmTQ6ZlDTRL3nx/sQxWLKgW8ee0Ts+C1CiWkiX2/g=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-z5BFo6X3Lpb/PJPMQ+3m1RozvXeHLaY81PABAE7gTTA=";
+  cargoHash = "sha256-QIqLzk/vAOrW0ain0Oq9tnqzCSyK4yDOYsjmil3xPc4=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url
diff --git a/pkgs/by-name/ch/chroma/package.nix b/pkgs/by-name/ch/chroma/package.nix
index 7dd707c5d280..929dbbb88b85 100644
--- a/pkgs/by-name/ch/chroma/package.nix
+++ b/pkgs/by-name/ch/chroma/package.nix
@@ -10,7 +10,7 @@ in
 
 buildGoModule rec {
   pname = "chroma";
-  version = "2.15.0";
+  version = "2.19.0";
 
   # To update:
   # nix-prefetch-git --rev v${version} https://github.com/alecthomas/chroma.git > src.json
@@ -21,7 +21,7 @@ buildGoModule rec {
     inherit (srcInfo) sha256;
   };
 
-  vendorHash = "sha256:14jg809xz647yv6sc8rnnksg2bpnn75panj8a2kdk2v87yrpq2zr";
+  vendorHash = "sha256-Gqldcp68Rn4wkfQptbmKUjkwLSb+qaFboJNfmWVkrPU=";
 
   modRoot = "./cmd/chroma";
 
diff --git a/pkgs/by-name/ch/chroma/src.json b/pkgs/by-name/ch/chroma/src.json
index e9cee45b9f29..1a5fd3cf2246 100644
--- a/pkgs/by-name/ch/chroma/src.json
+++ b/pkgs/by-name/ch/chroma/src.json
@@ -1,10 +1,10 @@
 {
   "url": "https://github.com/alecthomas/chroma.git",
-  "rev": "009385f9487ee14c8a54e49aaf4331fea0830310",
-  "date": "2024-12-30T09:27:18+11:00",
-  "path": "/nix/store/rr2cj4bmlfw803diwyfpbrpai35gifaw-chroma",
-  "sha256": "088w3aixwfk8s04iyb2mjn3kx5dl3gb9q14jzawabcdy2ar7iijn",
-  "hash": "sha256-VsZ4shK+saW4+pIEnNYbtJU+h5VVLB8J0Gg63qMaHCE=",
+  "rev": "adeac8f5dbfb6806a51bcf07eefd89fc8a0aee6a",
+  "date": "2025-07-01T09:59:45+10:00",
+  "path": "/nix/store/063ldbczafhxq02g5n28bxr1xnl6fwgd-chroma",
+  "sha256": "1r50gqbizi7l1l07syx9wgfyx1k8gzspmsbpk42jnwgw3h9dcw42",
+  "hash": "sha256-gnDWEhz8cSsFmXfpevV/aIbu3eOpe30ADfTEHxd+oOQ=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/pkgs/by-name/co/containerlab/package.nix b/pkgs/by-name/co/containerlab/package.nix
index ea89c97789f3..3e4ee48340f4 100644
--- a/pkgs/by-name/co/containerlab/package.nix
+++ b/pkgs/by-name/co/containerlab/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "containerlab";
-  version = "0.68.0";
+  version = "0.69.1";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x6QDwduAMCD+Trj0awQXW0Tdleb2U6YBi/7mdMB6V/8=";
+    hash = "sha256-+KZrKOxn9M+iKtugH89bPc106NGLwErMgIyiaU2kcGE=";
   };
 
-  vendorHash = "sha256-XRgKfRw6VGg+lkbtPWUVNfAk5a7ZdFwVmhjtM7uSwHs=";
+  vendorHash = "sha256-YmE2eR5UnXy2nXTQP2FdyPQLAQVYPzDTmLrWtbRknAs=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -37,6 +37,11 @@ buildGoModule (finalAttrs: {
     export USER="runner"
   '';
 
+  # TestVerifyLinks wants to use docker.sock, which is not available in the Nix build environment.
+  checkFlags = [
+    "-skip=^TestVerifyLinks$"
+  ];
+
   postInstall = ''
     local INSTALL="$out/bin/containerlab"
     installShellCompletion --cmd containerlab \
diff --git a/pkgs/by-name/de/delve/package.nix b/pkgs/by-name/de/delve/package.nix
index 7cbef6ba718b..8fb047e049b3 100644
--- a/pkgs/by-name/de/delve/package.nix
+++ b/pkgs/by-name/de/delve/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "delve";
-  version = "1.25.0";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "go-delve";
     repo = "delve";
     rev = "v${version}";
-    hash = "sha256-bp8pYWS3Vpg0R2Xfe5agDTENzLGu9r43BgORa8VrP+Y=";
+    hash = "sha256-I7GGpLGhOp29+2V3CSSGnItSwhyrM+2yZxQsGRN812U=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ev/evcxr/package.nix b/pkgs/by-name/ev/evcxr/package.nix
index d00b3728950c..431d5e154c59 100644
--- a/pkgs/by-name/ev/evcxr/package.nix
+++ b/pkgs/by-name/ev/evcxr/package.nix
@@ -19,17 +19,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "evcxr";
-  version = "0.20.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "evcxr";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-vntXHKP3fk5+26fPHKUy3gqr1Bt9o/ypxyyvXOfdt3I=";
+    sha256 = "sha256-8dV+NNtU4HFerrgRyc1kO+MSsMTJJItTtJylEIN014g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bV83OvHG7lQN3juVsPRurINCzxVPZd0yZ2YNtXXFU8I=";
+  cargoHash = "sha256-HJrEXt6O7qCNJ/xOh4kjmqKJ22EVwBTzV1S+q98k0VQ=";
 
   RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
 
diff --git a/pkgs/by-name/gh/gh-f/package.nix b/pkgs/by-name/gh/gh-f/package.nix
index d90ede5caa7e..0e2f3c598629 100644
--- a/pkgs/by-name/gh/gh-f/package.nix
+++ b/pkgs/by-name/gh/gh-f/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "gh-f";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "gennaro-tedesco";
     repo = "gh-f";
     rev = "v${version}";
-    hash = "sha256-CW6iAI5IomJoMuPBFq/3owhZJbcruKtOqoxzsh+FNVw=";
+    hash = "sha256-JlMJ5RplEtQ8ApN3x1Sl0Lkutb5kLpuMJrF96oKZC9k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gh/ghostunnel/package.nix b/pkgs/by-name/gh/ghostunnel/package.nix
index f99f296c8bbc..a057dd263d39 100644
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   lib,
   nixosTests,
+  ghostunnel,
   apple-sdk_12,
   darwinMinVersionHook,
 }:
@@ -39,6 +40,11 @@ buildGoModule rec {
     podman = nixosTests.podman-tls-ghostunnel;
   };
 
+  passthru.services.default = {
+    imports = [ ./service.nix ];
+    ghostunnel.package = ghostunnel; # FIXME: finalAttrs.finalPackage
+  };
+
   meta = {
     description = "TLS proxy with mutual authentication support for securing non-TLS backend applications";
     homepage = "https://github.com/ghostunnel/ghostunnel#readme";
diff --git a/pkgs/by-name/gh/ghostunnel/service.nix b/pkgs/by-name/gh/ghostunnel/service.nix
new file mode 100644
index 000000000000..218b783629b2
--- /dev/null
+++ b/pkgs/by-name/gh/ghostunnel/service.nix
@@ -0,0 +1,241 @@
+{
+  lib,
+  config,
+  options,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    concatStringsSep
+    getExe
+    mkDefault
+    mkIf
+    mkOption
+    optional
+    types
+    ;
+  cfg = config.ghostunnel;
+
+in
+{
+  # https://nixos.org/manual/nixos/unstable/#modular-services
+  _class = "service";
+  options = {
+    ghostunnel = {
+      package = mkOption {
+        description = "Package to use for ghostunnel";
+        type = types.package;
+      };
+
+      listen = mkOption {
+        description = ''
+          Address and port to listen on (can be HOST:PORT, unix:PATH).
+        '';
+        type = types.str;
+      };
+
+      target = mkOption {
+        description = ''
+          Address to forward connections to (can be HOST:PORT or unix:PATH).
+        '';
+        type = types.str;
+      };
+
+      keystore = mkOption {
+        description = ''
+          Path to keystore (combined PEM with cert/key, or PKCS12 keystore).
+
+          NB: storepass is not supported because it would expose credentials via `/proc/*/cmdline`.
+
+          Specify this or `cert` and `key`.
+        '';
+        type = types.nullOr types.str;
+        default = null;
+      };
+
+      cert = mkOption {
+        description = ''
+          Path to certificate (PEM with certificate chain).
+
+          Not required if `keystore` is set.
+        '';
+        type = types.nullOr types.str;
+        default = null;
+      };
+
+      key = mkOption {
+        description = ''
+          Path to certificate private key (PEM with private key).
+
+          Not required if `keystore` is set.
+        '';
+        type = types.nullOr types.str;
+        default = null;
+      };
+
+      cacert = mkOption {
+        description = ''
+          Path to CA bundle file (PEM/X509). Uses system trust store if `null`.
+        '';
+        type = types.nullOr types.str;
+      };
+
+      disableAuthentication = mkOption {
+        description = ''
+          Disable client authentication, no client certificate will be required.
+        '';
+        type = types.bool;
+        default = false;
+      };
+
+      allowAll = mkOption {
+        description = ''
+          If true, allow all clients, do not check client cert subject.
+        '';
+        type = types.bool;
+        default = false;
+      };
+
+      allowCN = mkOption {
+        description = ''
+          Allow client if common name appears in the list.
+        '';
+        type = types.listOf types.str;
+        default = [ ];
+      };
+
+      allowOU = mkOption {
+        description = ''
+          Allow client if organizational unit name appears in the list.
+        '';
+        type = types.listOf types.str;
+        default = [ ];
+      };
+
+      allowDNS = mkOption {
+        description = ''
+          Allow client if DNS subject alternative name appears in the list.
+        '';
+        type = types.listOf types.str;
+        default = [ ];
+      };
+
+      allowURI = mkOption {
+        description = ''
+          Allow client if URI subject alternative name appears in the list.
+        '';
+        type = types.listOf types.str;
+        default = [ ];
+      };
+
+      extraArguments = mkOption {
+        description = "Extra arguments to pass to `ghostunnel server`";
+        type = types.listOf types.str;
+        default = [ ];
+      };
+
+      unsafeTarget = mkOption {
+        description = ''
+          If set, does not limit target to localhost, 127.0.0.1, [::1], or UNIX sockets.
+
+          This is meant to protect against accidental unencrypted traffic on
+          untrusted networks.
+        '';
+        type = types.bool;
+        default = false;
+      };
+    };
+  };
+
+  config = {
+    assertions = [
+      {
+        message = ''
+          At least one access control flag is required.
+          Set at least one of:
+            - ${options.ghostunnel.disableAuthentication}
+            - ${options.ghostunnel.allowAll}
+            - ${options.ghostunnel.allowCN}
+            - ${options.ghostunnel.allowOU}
+            - ${options.ghostunnel.allowDNS}
+            - ${options.ghostunnel.allowURI}
+        '';
+        assertion =
+          cfg.disableAuthentication
+          || cfg.allowAll
+          || cfg.allowCN != [ ]
+          || cfg.allowOU != [ ]
+          || cfg.allowDNS != [ ]
+          || cfg.allowURI != [ ];
+      }
+    ];
+
+    ghostunnel = {
+      # Clients should not be authenticated with the public root certificates
+      # (afaict, it doesn't make sense), so we only provide that default when
+      # client cert auth is disabled.
+      cacert = mkIf cfg.disableAuthentication (mkDefault null);
+    };
+
+    # TODO assertions
+
+    process = {
+      argv =
+        # Use a shell if credentials need to be pulled from the environment.
+        optional
+          (builtins.any (v: v != null) [
+            cfg.keystore
+            cfg.cert
+            cfg.key
+            cfg.cacert
+          ])
+          (
+            pkgs.writeScript "load-credentials" ''
+              #!${pkgs.runtimeShell}
+              exec $@ ${
+                concatStringsSep " " (
+                  optional (cfg.keystore != null) "--keystore=$CREDENTIALS_DIRECTORY/keystore"
+                  ++ optional (cfg.cert != null) "--cert=$CREDENTIALS_DIRECTORY/cert"
+                  ++ optional (cfg.key != null) "--key=$CREDENTIALS_DIRECTORY/key"
+                  ++ optional (cfg.cacert != null) "--cacert=$CREDENTIALS_DIRECTORY/cacert"
+                )
+              }
+            ''
+          )
+        ++ [
+          (getExe cfg.package)
+          "server"
+          "--listen"
+          cfg.listen
+          "--target"
+          cfg.target
+        ]
+        ++ optional cfg.allowAll "--allow-all"
+        ++ map (v: "--allow-cn=${v}") cfg.allowCN
+        ++ map (v: "--allow-ou=${v}") cfg.allowOU
+        ++ map (v: "--allow-dns=${v}") cfg.allowDNS
+        ++ map (v: "--allow-uri=${v}") cfg.allowURI
+        ++ optional cfg.disableAuthentication "--disable-authentication"
+        ++ optional cfg.unsafeTarget "--unsafe-target"
+        ++ cfg.extraArguments;
+    };
+
+    # refine the service
+    systemd.service = {
+      after = [ "network.target" ];
+      wants = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Restart = "always";
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        DynamicUser = true;
+        LoadCredential =
+          optional (cfg.keystore != null) "keystore:${cfg.keystore}"
+          ++ optional (cfg.cert != null) "cert:${cfg.cert}"
+          ++ optional (cfg.key != null) "key:${cfg.key}"
+          ++ optional (cfg.cacert != null) "cacert:${cfg.cacert}";
+      };
+    };
+  };
+}
diff --git a/pkgs/by-name/gi/gickup/package.nix b/pkgs/by-name/gi/gickup/package.nix
index 5435cad7659a..47c8284ee12d 100644
--- a/pkgs/by-name/gi/gickup/package.nix
+++ b/pkgs/by-name/gi/gickup/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gickup";
-  version = "0.10.38";
+  version = "0.10.39";
 
   src = fetchFromGitHub {
     owner = "cooperspencer";
     repo = "gickup";
     tag = "v${version}";
-    hash = "sha256-vthr4nkwuhvGXxH2P0uHeuQpjQFNTpGFHF+eXG2jiqk=";
+    hash = "sha256-Aalt/oiNzV2a8Ix/ruL4r3q0W1EY1UTe9IVPWNL+lLA=";
   };
 
-  vendorHash = "sha256-RtuEpvux+8oJ829WEvz5OPfnYvFCdNo/9GCXhjXurRM=";
+  vendorHash = "sha256-Xtreh7nHovBYh0PnFYn2VuYGN8GQSmy6EPnZnHSdt/o=";
 
   ldflags = [ "-X main.version=${version}" ];
 
diff --git a/pkgs/by-name/gp/gpupad/package.nix b/pkgs/by-name/gp/gpupad/package.nix
index 59045737053e..25c740910bf0 100644
--- a/pkgs/by-name/gp/gpupad/package.nix
+++ b/pkgs/by-name/gp/gpupad/package.nix
@@ -7,7 +7,7 @@
   glslang,
   imath,
   ktx-tools,
-  openimageio_2,
+  openimageio,
   qt6Packages,
   spdlog,
   spirv-cross,
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     glslang
     imath # needed for openimageio
     ktx-tools
-    openimageio_2
+    openimageio
     qt6Packages.qtbase
     qt6Packages.qtdeclarative
     qt6Packages.qtmultimedia
diff --git a/pkgs/by-name/ha/hayabusa-sec/package.nix b/pkgs/by-name/ha/hayabusa-sec/package.nix
new file mode 100644
index 000000000000..8dc4adb95493
--- /dev/null
+++ b/pkgs/by-name/ha/hayabusa-sec/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  rust-jemalloc-sys,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "hayabusa-sec";
+  version = "3.3.0-unstable-2025-07-17";
+
+  src = fetchFromGitHub {
+    owner = "Yamato-Security";
+    repo = "hayabusa";
+    rev = "feaa165b4c0af34919ad26f634cb684e23172359";
+    hash = "sha256-h08InhNVW33IjPA228gv6Enlg6EKmj0yHb/UvJ/f7uw=";
+    # Include the hayabusa-rules
+    fetchSubmodules = true;
+  };
+
+  cargoHash = "sha256-wcH1Ron5Zx2ypWyaW0z7L9rCanAcosvpPQnP60qbvWQ=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    rust-jemalloc-sys # transitive dependency via the hayabusa-evtx crate
+  ];
+
+  env.OPENSSL_NO_VENDOR = true;
+
+  # Several checks panic
+  # Skipping individual checks causes failure as `--skip` flags
+  # end up passed to executing `hayabusa`
+  # > error: unexpected argument '--skip' found
+  doCheck = false;
+
+  meta = {
+    description = "Sigma-based threat hunting and fast forensics timeline generator for Windows event logs";
+    homepage = "https://github.com/Yamato-Security/hayabusa";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [
+      d3vil0p3r
+      jk
+    ];
+    mainProgram = "hayabusa";
+  };
+}
diff --git a/pkgs/tools/networking/hue-cli/Gemfile b/pkgs/by-name/hu/hue-cli/Gemfile
similarity index 100%
rename from pkgs/tools/networking/hue-cli/Gemfile
rename to pkgs/by-name/hu/hue-cli/Gemfile
diff --git a/pkgs/tools/networking/hue-cli/Gemfile.lock b/pkgs/by-name/hu/hue-cli/Gemfile.lock
similarity index 100%
rename from pkgs/tools/networking/hue-cli/Gemfile.lock
rename to pkgs/by-name/hu/hue-cli/Gemfile.lock
diff --git a/pkgs/tools/networking/hue-cli/gemset.nix b/pkgs/by-name/hu/hue-cli/gemset.nix
similarity index 100%
rename from pkgs/tools/networking/hue-cli/gemset.nix
rename to pkgs/by-name/hu/hue-cli/gemset.nix
diff --git a/pkgs/tools/networking/hue-cli/default.nix b/pkgs/by-name/hu/hue-cli/package.nix
similarity index 76%
rename from pkgs/tools/networking/hue-cli/default.nix
rename to pkgs/by-name/hu/hue-cli/package.nix
index afb732a32e52..20c24f6178d6 100644
--- a/pkgs/tools/networking/hue-cli/default.nix
+++ b/pkgs/by-name/hu/hue-cli/package.nix
@@ -11,12 +11,12 @@ bundlerApp {
 
   passthru.updateScript = bundlerUpdateScript "hue-cli";
 
-  meta = with lib; {
+  meta = {
     description = "Command line interface for controlling Philips Hue system's lights and bridge";
     homepage = "https://github.com/birkirb/hue-cli";
-    license = licenses.mit;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
       manveru
       nicknovitski
     ];
diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index 5c10d9519ed7..f67b811b8b2b 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inputplumber";
-  version = "0.60.2";
+  version = "0.60.7";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${version}";
-    hash = "sha256-zcy9scs7oRRLKm/FL6BfO64IstWY4HmTRxG/jJG0jLw=";
+    hash = "sha256-3o5Y6fbshC3oTerf8M+yuo01BbQAilkT7TdrlwO6YBs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-fw7pM6HSy/8fNTYu7MqKiTl/2jdyDOLDBNhd0rpzb6M=";
+  cargoHash = "sha256-Tk3NCcturMHIs9hdGqwC87kqnhg/PvriCNSkYcq9+aM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ko/komikku/package.nix b/pkgs/by-name/ko/komikku/package.nix
index bbfffa359945..30755a5ecfb2 100644
--- a/pkgs/by-name/ko/komikku/package.nix
+++ b/pkgs/by-name/ko/komikku/package.nix
@@ -23,7 +23,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.81.0";
+  version = "1.82.0";
   pyproject = false;
 
   src = fetchFromGitea {
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     tag = "v${version}";
-    hash = "sha256-k64bcJLKFUMy60a5zj740Pk3lGZ6vKaAv5HOHfoW9p4=";
+    hash = "sha256-F+RlfnKnMqlPTk1iv79ah/UaEjd7Og+gV1YVsZqkIBk=";
   };
 
   nativeBuildInputs = [
@@ -65,7 +65,6 @@ python3.pkgs.buildPythonApplication rec {
     natsort
     piexif
     pillow
-    pillow-heif
     curl-cffi
     pygobject3
     python-magic
diff --git a/pkgs/by-name/li/libdwarf/package.nix b/pkgs/by-name/li/libdwarf/package.nix
index 6c68ef9c26dc..e98c999f6438 100644
--- a/pkgs/by-name/li/libdwarf/package.nix
+++ b/pkgs/by-name/li/libdwarf/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdwarf";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "davea42";
     repo = "libdwarf-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SsFg+7zGBEGxDSzfiIP5bxdttlBkhEiEQWaU12hINas=";
+    hash = "sha256-Q+ke5vRSBFZirCIBu8M88LzBQW851kjkW4vUgE89ejQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libwacom/package.nix b/pkgs/by-name/li/libwacom/package.nix
index 120c3609e593..48fdad5f87b1 100644
--- a/pkgs/by-name/li/libwacom/package.nix
+++ b/pkgs/by-name/li/libwacom/package.nix
@@ -85,5 +85,9 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Libraries, configuration, and diagnostic tools for Wacom tablets running under Linux";
     teams = [ lib.teams.freedesktop ];
     license = lib.licenses.hpnd;
+    badPlatforms = [
+      # Mandatory shared library.
+      lib.systems.inspect.platformPatterns.isStatic
+    ];
   };
 })
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/pin.json b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
index dd5286e659bd..d127dafdb1fb 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@@ -1,10 +1,10 @@
 {
   "stable": {
-    "version": "5.18.3",
-    "hash": "sha256-we4mWtMemszIpTehk74hbqjisX1vTk94tLdGGNiz4c8="
+    "version": "5.20.0",
+    "hash": "sha256-XqzCxzmNJHG+aYBJoeAAryFx3XctrGBk6QqoonCbrWU="
   },
   "beta": {
-    "version": "5.18.3",
-    "hash": "sha256-we4mWtMemszIpTehk74hbqjisX1vTk94tLdGGNiz4c8="
+    "version": "5.20.0",
+    "hash": "sha256-XqzCxzmNJHG+aYBJoeAAryFx3XctrGBk6QqoonCbrWU="
   }
 }
diff --git a/pkgs/by-name/me/mergiraf/package.nix b/pkgs/by-name/me/mergiraf/package.nix
index 05a16236e6ef..168c0bb29b1e 100644
--- a/pkgs/by-name/me/mergiraf/package.nix
+++ b/pkgs/by-name/me/mergiraf/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mergiraf";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "mergiraf";
     repo = "mergiraf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-09C5A9ToH3zzUlUcLDd/5wOOkWs4jmjaqI9HpzGebUU=";
+    hash = "sha256-MPmpS4iLur05jkSUrGl6NCtzRO/8Pch9pRNuT6psNRo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TFGFHK35pary9nGG3XB474Bv2B8YW2X06NvInBLmcIA=";
+  cargoHash = "sha256-nT9HsG9eRBf4mRr7fqmRSQVI+yz+yr7wKCSQHG5JtD4=";
 
   nativeCheckInputs = [ git ];
 
diff --git a/pkgs/by-name/ne/newsflash/package.nix b/pkgs/by-name/ne/newsflash/package.nix
index d56a32b69163..9a3084cfca86 100644
--- a/pkgs/by-name/ne/newsflash/package.nix
+++ b/pkgs/by-name/ne/newsflash/package.nix
@@ -27,18 +27,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "newsflash";
-  version = "4.0.3";
+  version = "4.1.2";
 
   src = fetchFromGitLab {
     owner = "news-flash";
     repo = "news_flash_gtk";
     tag = "v.${finalAttrs.version}";
-    hash = "sha256-TVQZq+Akb7EFUazAgUqvlwC7htVpUf7Hck8p7vY0o3M=";
+    hash = "sha256-yNO9ju5AQzMeZlQN1f3FRiFA6hq89mSuQClrJkoM+xE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-fjb/AVvWbSq+Mc+5D7wCncLQ8OPjnTqHMzFFYgmCCjY=";
+    hash = "sha256-gF1wHLM5t0jYm/nWQQeAbDlExsPYNV0/YYH0yfQuetM=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
index ba338edeb17a..a9e082c4c370 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
@@ -94,7 +94,7 @@ class Redirects:
           - The first element of an identifier's redirects list must denote its current location.
         """
         xref_targets = {}
-        ignored_identifier_patterns = ("opt-", "auto-generated-", "function-library-")
+        ignored_identifier_patterns = ("opt-", "auto-generated-", "function-library-", "service-opt-", "systemd-service-opt")
         for id, target in initial_xref_targets.items():
             # filter out automatically generated identifiers from module options and library documentation
             if id.startswith(ignored_identifier_patterns):
diff --git a/pkgs/by-name/oc/octodns/providers/ovh/package.nix b/pkgs/by-name/oc/octodns/providers/ovh/package.nix
new file mode 100644
index 000000000000..cd01f99c1ac2
--- /dev/null
+++ b/pkgs/by-name/oc/octodns/providers/ovh/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  octodns,
+  ovh,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "octodns-ovh";
+  version = "1.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "octodns";
+    repo = "octodns-ovh";
+    tag = "v${version}";
+    hash = "sha256-UbxOdpG099G9oKyweIMH5JTP0W0MpLmsOWgQYEFD8sQ=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    octodns
+    ovh
+  ];
+
+  env.OCTODNS_RELEASE = 1;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "octodns_ovh" ];
+
+  meta = {
+    description = "OVHcloud DNS v6 API provider for octoDNS";
+    homepage = "https://github.com/octodns/octodns-ovh";
+    changelog = "https://github.com/octodns/octodns-ovh/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    teams = [ lib.teams.octodns ];
+  };
+}
diff --git a/pkgs/by-name/ol/olympus-unwrapped/package.nix b/pkgs/by-name/ol/olympus-unwrapped/package.nix
index b1125c5cbdd7..b668d78c130a 100644
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -31,9 +31,9 @@ let
 
   phome = "$out/lib/olympus";
   # The following variables are to be updated by the update script.
-  version = "25.07.12.01";
-  buildId = "4934"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "17634d29b91b737580c878ba96f73bd077fbfba0";
+  version = "25.07.23.01";
+  buildId = "4972"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "2d4876fa93063df39ba8e2d6c97b57223f7b3b4f";
 in
 buildDotnetModule {
   pname = "olympus-unwrapped";
@@ -44,7 +44,7 @@ buildDotnetModule {
     owner = "EverestAPI";
     repo = "Olympus";
     fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-Z6OWO6WCHhmmGI8dF23yiLNBy11Mutu941jY/0pxIkQ=";
+    hash = "sha256-30Lir9erklCPIEsreIWwjrSkuZtr5mJpqxXAMXawYyk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opengamepadui/package.nix b/pkgs/by-name/op/opengamepadui/package.nix
index 5403a05e97b0..81a17828e417 100644
--- a/pkgs/by-name/op/opengamepadui/package.nix
+++ b/pkgs/by-name/op/opengamepadui/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opengamepadui";
-  version = "0.40.3";
+  version = "0.40.4";
 
   buildType = if withDebug then "debug" else "release";
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ShadowBlip";
     repo = "OpenGamepadUI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ggCVNWh36q/clYMzObhhxU39qacWSb6urgXOI9yfQeo=";
+    hash = "sha256-o6n3b4dh3IHaRk2Zi7rt3gzKTZWt6s9L9WcG0WoCQ3U=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/op/openimageio/2.nix b/pkgs/by-name/op/openimageio/2.nix
deleted file mode 100644
index d31dd2190a51..000000000000
--- a/pkgs/by-name/op/openimageio/2.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ fetchFromGitHub, openimageio }:
-
-let
-  version = "2.5.17.0";
-in
-openimageio.overrideAttrs {
-  inherit version;
-
-  src = fetchFromGitHub {
-    owner = "AcademySoftwareFoundation";
-    repo = "OpenImageIO";
-    tag = "v${version}";
-    hash = "sha256-d5LqRcqWj6E9jJYY/Pa5e7/MeuQGMjUo/hMCYRKsKeU=";
-  };
-}
diff --git a/pkgs/by-name/pc/pcsx2/package.nix b/pkgs/by-name/pc/pcsx2/package.nix
index bf68de038ec5..61c2f8adba07 100644
--- a/pkgs/by-name/pc/pcsx2/package.nix
+++ b/pkgs/by-name/pc/pcsx2/package.nix
@@ -15,7 +15,6 @@
   libwebp,
   llvmPackages,
   lz4,
-  makeWrapper,
   pkg-config,
   qt6,
   shaderc,
@@ -36,8 +35,8 @@ let
   pcsx2_patches = fetchFromGitHub {
     owner = "PCSX2";
     repo = "pcsx2_patches";
-    rev = "6448ff90bbf2fddb4498dcfdae0e6d3ec8c23479";
-    hash = "sha256-ZXAZekllZHYjfU1q1QrbEdRlRAUAB6VOXLeAfn1GqW0=";
+    rev = "9b193aa0a61f5e93d3bd4124b111e8f296ef9fa8";
+    hash = "sha256-1hhdjFxJCNfeO/FIAnjRHESfiyzkErYddZqpRxzG7VQ=";
   };
 
   inherit (qt6)
@@ -50,13 +49,13 @@ let
 in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
   pname = "pcsx2";
-  version = "2.3.424";
+  version = "2.4.0";
   src = fetchFromGitHub {
     pname = "pcsx2-source";
     owner = "PCSX2";
     repo = "pcsx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EdFkSsat6O/1tXtJVHOPviseSaixd5LB1TNtfqhqR1E=";
+    hash = "sha256-R+BdywkZKxR/+Z+o1512O3A1mg9A6s7i+JZjFyUbJVs=";
   };
 
   patches = [
@@ -134,14 +133,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
-  # https://github.com/PCSX2/pcsx2/pull/10200
-  # Can't avoid the double wrapping, the binary wrapper from qtWrapperArgs doesn't support --run
-  postFixup = ''
-    source "${makeWrapper}/nix-support/setup-hook"
-    wrapProgram $out/bin/pcsx2-qt \
-      --run 'if [[ -z $I_WANT_A_BROKEN_WAYLAND_UI ]]; then export QT_QPA_PLATFORM=xcb; fi'
-  '';
-
   passthru = {
     inherit pcsx2_patches;
     updateScript.command = [ ./update.sh ];
diff --git a/pkgs/by-name/pc/pcsx2/update.sh b/pkgs/by-name/pc/pcsx2/update.sh
index 0191e7dc8ada..07203fd80e2a 100755
--- a/pkgs/by-name/pc/pcsx2/update.sh
+++ b/pkgs/by-name/pc/pcsx2/update.sh
@@ -1,12 +1,16 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash nix-update common-updater-scripts coreutils
+#!nix-shell -i bash -p bash nix-update common-updater-scripts coreutils jq
 
 set -ex
 
-latestRev=`git ls-remote -b https://github.com/PCSX2/pcsx2_patches main | cut -f1`
+latestPatchesRev=`git ls-remote -b https://github.com/PCSX2/pcsx2_patches main | cut -f1`
 
 update-source-version pcsx2 \
   --ignore-same-version \
-  --rev=$latestRev \
+  --rev=$latestPatchesRev \
   --source-key=pcsx2_patches
-nix-update --version=unstable pcsx2
+
+latestVersion="`curl "https://api.github.com/repos/PCSX2/pcsx2/releases/latest" \
+  | jq -r ".tag_name[1:]"`"
+
+nix-update pcsx2 --version=$latestVersion
diff --git a/pkgs/by-name/pl/playwright-mcp/package.nix b/pkgs/by-name/pl/playwright-mcp/package.nix
index 15c003aff992..b2e74c842769 100644
--- a/pkgs/by-name/pl/playwright-mcp/package.nix
+++ b/pkgs/by-name/pl/playwright-mcp/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "playwright-mcp";
-  version = "0.0.29";
+  version = "0.0.31";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright-mcp";
     tag = "v${version}";
-    hash = "sha256-owSoE3+jSg09dFpM5wv7FJovzsX5ZMp/9IIQhkmSZt0=";
+    hash = "sha256-Hw4OUZCHoquX6Ixv7GlsHcKxqOdJEQYfuDPzqYkVNAk=";
   };
 
-  npmDepsHash = "sha256-jweIBhlVci8CFBIYlFp0opc1ilWMcHt0is4qgTiYNcQ=";
+  npmDepsHash = "sha256-70/t/mgSBwMv9C3VusbjIMMyy3e3npxQLXqKbdL9xa4=";
 
   postInstall = ''
     rm -r $out/lib/node_modules/@playwright/mcp/node_modules/playwright
diff --git a/pkgs/by-name/pl/pluto/package.nix b/pkgs/by-name/pl/pluto/package.nix
index ce3398e80c31..f8b578935218 100644
--- a/pkgs/by-name/pl/pluto/package.nix
+++ b/pkgs/by-name/pl/pluto/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.22.0";
+  version = "5.22.1";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    hash = "sha256-fqN6uj/YL/sch16mmB/smJtbzCFlUa9yvCLa8sXJ/u4=";
+    hash = "sha256-mq18PUyVFhi3ePju6EvYg4VowwAHJwhvpI67BX8BqRY=";
   };
 
   vendorHash = "sha256-59mRVfQ2rduTvIJE1l/j3K+PY3OEMfNpjjYg3hqNUhs=";
diff --git a/pkgs/by-name/pu/pulumi/package.nix b/pkgs/by-name/pu/pulumi/package.nix
index d1557c9dcfa3..5c87d0b63fbd 100644
--- a/pkgs/by-name/pu/pulumi/package.nix
+++ b/pkgs/by-name/pu/pulumi/package.nix
@@ -17,18 +17,18 @@
 }:
 buildGoModule rec {
   pname = "pulumi";
-  version = "3.162.0";
+  version = "3.185.0";
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "pulumi";
     tag = "v${version}";
-    hash = "sha256-avtqURmj3PL82j89kLmVsBWqJJHnOFqR1huoUESt4L4=";
+    hash = "sha256-/7VaFeEQXVqF7g+CR2oTSmOWgWjw/LS9s0+VZcSlFvU=";
     # Some tests rely on checkout directory name
     name = "pulumi";
   };
 
-  vendorHash = "sha256-fJFpwhbRkxSI2iQfNJ9qdL9oYM1SVVMJ30VIymoZBmg=";
+  vendorHash = "sha256-aAxBVMLL7JRSJSVIR9/gNTNj8sZHg39ftv+ZAO8PS54=";
 
   sourceRoot = "${src.name}/pkg";
 
@@ -81,6 +81,11 @@ buildGoModule rec {
         "TestPulumiNewWithOrgTemplates"
         "TestPulumiNewWithoutPulumiAccessToken"
         "TestPulumiNewWithoutTemplateSupport"
+        "TestGeneratingProjectWithAIPromptSucceeds"
+        "TestPulumiNewWithRegistryTemplates"
+
+        # Connects to https://api.pulumi.com/…
+        "TestGetLatestPluginIncludedVersion"
 
         # Connects to https://pulumi-testing.vault.azure.net/…
         "TestAzureCloudManager"
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
index 2d7c350626ad..687e0f23eb1d 100644
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
@@ -9,7 +9,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/sdk/go/pulumi-language-go";
 
-  vendorHash = "sha256-3I9Kh3Zqpu0gT0pQNzg2mMwxQUdhEpjITZOrO7Yt50A=";
+  vendorHash = "sha256-FSkFZhuwbTxCQgES+rFoVeSJHtepZiHEtnfShZ+eSMU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
index 0eae02fc2a21..219653344594 100644
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/sdk/nodejs/cmd/pulumi-language-nodejs";
 
-  vendorHash = "sha256-UvfSmHWRFRZkmcgzUrLkqktQAt8ZlVDEzP6y+pxUOGc=";
+  vendorHash = "sha256-q/NKPB5U7z3gPXIV2wCZXBN6QfJ4nMVdLUMcwXJ800Q=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
index 5930c1ffef81..cfa68ca5d945 100644
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/sdk/python/cmd/pulumi-language-python";
 
-  vendorHash = "sha256-5tr3mQ5x6jMOa9meHK6gaoRjNgLoHkWiTiaYXXqmUDo=";
+  vendorHash = "sha256-oWEl/IeoMya40D62QaYoGiyKcKQZZ008RxR9m/pJ7VU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index f91d1f1bec5e..e0ec3fc63f6d 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.23.4";
+  version = "3.24.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-drN28p+tHCxvVFfBw+nlPZxtiF6sIseiW16/FxwxRLI=";
+    hash = "sha256-MvLqKqFFrd3EV/9TEhYqn7lArWfNYzUg4UNUSFT2Nek=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/re/redpanda-client/package.nix b/pkgs/by-name/re/redpanda-client/package.nix
index 06e7d1baf782..eaa2d76a6259 100644
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "25.1.7";
+  version = "25.1.9";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-GRWLEzf0YfSk96oDCuthMNmu0C1KJCk10Uz7eApS4mk=";
+    sha256 = "sha256-X7pBbR2XCyHB4V0Z/PjZ10o/heXswyhzVj1yp+jvUEM=";
   };
 in
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
   inherit doCheck src version;
   modRoot = "./src/go/rpk";
   runVend = false;
-  vendorHash = "sha256-DevAHiNcxSbgNwr2Jm7yXhNWflXvqWZOlaYHj+xY0Tw=";
+  vendorHash = "sha256-I/jUlOYUXOSmAD2r8lBlnEBYlxf+V6gSICgnMXosP+4=";
 
   ldflags = [
     ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
diff --git a/pkgs/by-name/ro/robin-map/package.nix b/pkgs/by-name/ro/robin-map/package.nix
index c2afe76559e7..63ac6f1130c7 100644
--- a/pkgs/by-name/ro/robin-map/package.nix
+++ b/pkgs/by-name/ro/robin-map/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "robin-map";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "Tessil";
     repo = "robin-map";
     tag = "v${version}";
-    hash = "sha256-dspOWp/8oNR0p5XRnqO7WtPcCx54/y8m1cDho4UBYyc=";
+    hash = "sha256-Hkgxiq2i0TuqMK/bI5OMOn3LkmSE40NimDjK1FBZpsA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix
index 09f39b9a59f3..4c253f50285e 100644
--- a/pkgs/by-name/sa/saga/package.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "saga";
-  version = "9.9.0";
+  version = "9.9.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${version}.tar.gz";
-    hash = "sha256-xS9h8QGm6PH8rx0qXmvolDpH9fy8ma7HlBVbQo5pX4Q=";
+    hash = "sha256-InypyVCk08tsByKaIBRFWldwRz1AkNCgFD3DL4OG84w=";
   };
 
   sourceRoot = "saga-${version}/saga-gis";
diff --git a/pkgs/by-name/we/wechat/package.nix b/pkgs/by-name/we/wechat/package.nix
index ca5db30472f3..d68959fcdf4a 100644
--- a/pkgs/by-name/we/wechat/package.nix
+++ b/pkgs/by-name/we/wechat/package.nix
@@ -30,14 +30,14 @@ let
       # https://dldir1.qq.com/weixin/mac/mac-release.xml
       any-darwin =
         let
-          version = "4.0.6.19-29383";
+          version = "4.0.6.25-29387";
           version' = lib.replaceString "-" "_" version;
         in
         {
           inherit version;
           src = fetchurl {
             url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_${version'}.dmg";
-            hash = "sha256-HloG++DGzsxM7C0AbN4PXkkzFdhUhBDcH5Vq+bTUuEE=";
+            hash = "sha256-vdeUUJdbIxT8tX5Xo9QIzbWTwRjtSXwrNoImMwt5xkY=";
           };
         };
     in
diff --git a/pkgs/by-name/wo/wofi/package.nix b/pkgs/by-name/wo/wofi/package.nix
index b7bf125930d3..ac3692d854fc 100644
--- a/pkgs/by-name/wo/wofi/package.nix
+++ b/pkgs/by-name/wo/wofi/package.nix
@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "wofi";
-  version = "1.4.1";
+  version = "1.5";
 
   outputs = [
     "out"
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     repo = "wofi";
     owner = "~scoopta";
     rev = "v${version}";
-    sha256 = "sha256-aedoUhVfk8ljmQ23YxVmGZ00dPpRftW2dnRAgXmtV/w=";
+    sha256 = "sha256-7C4rO1Uf7qmzYAr60auILzYyKrJ//TJzTwU1PrBWdVA=";
     vc = "hg";
   };
 
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index 486d91a5ab06..8b04fe8a07a7 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -89,7 +89,7 @@ let
         inherit fetchMixDeps mixRelease;
       };
 
-      elixir-ls = callPackage ./elixir-ls { inherit elixir fetchMixDeps mixRelease; };
+      elixir-ls = callPackage ./elixir-ls { inherit elixir; };
 
       lfe = lfe_2_1;
       lfe_2_1 = lib'.callLFE ../interpreters/lfe/2.1.nix { inherit erlang buildRebar3 buildHex; };
diff --git a/pkgs/development/beam-modules/elixir-ls/default.nix b/pkgs/development/beam-modules/elixir-ls/default.nix
index 237838bc337b..eda8502395ad 100644
--- a/pkgs/development/beam-modules/elixir-ls/default.nix
+++ b/pkgs/development/beam-modules/elixir-ls/default.nix
@@ -3,13 +3,12 @@
   elixir,
   fetchpatch,
   fetchFromGitHub,
-  fetchMixDeps,
   makeWrapper,
-  mixRelease,
+  stdenv,
   nix-update-script,
 }:
 
-mixRelease rec {
+stdenv.mkDerivation rec {
   pname = "elixir-ls";
   version = "0.28.1";
 
@@ -20,16 +19,6 @@ mixRelease rec {
     hash = "sha256-r4P+3MPniDNdF3SG2jfBbzHsoxn826eYd2tsv6bJBoI=";
   };
 
-  inherit elixir;
-
-  stripDebug = true;
-
-  mixFodDeps = fetchMixDeps {
-    pname = "mix-deps-${pname}";
-    inherit src version elixir;
-    hash = "sha256-8zs+99jwf+YX5SwD65FCPmfrYhTCx4AQGCGsDeCKxKc=";
-  };
-
   patches = [
     # fix elixir deterministic support https://github.com/elixir-lsp/elixir-ls/pull/1216
     # remove > 0.28.1
@@ -46,28 +35,25 @@ mixRelease rec {
     makeWrapper
   ];
 
-  # elixir-ls require a special step for release
-  # compile and release need to be performed together because
-  # of the no-deps-check requirement
-  buildPhase = ''
-    runHook preBuild
+  # for substitution
+  env.elixir = elixir;
 
-    mix do compile --no-deps-check, elixir_ls.release${lib.optionalString (lib.versionAtLeast elixir.version "1.16.0") "2"}
-
-    runHook postBuild
-  '';
+  dontConfigure = true;
+  dontBuild = true;
 
   installPhase = ''
+    cp -R . $out
+    ln -s $out/VERSION $out/scripts/VERSION
+
+    substituteAllInPlace $out/scripts/launch.sh
+
     mkdir -p $out/bin
-    cp -Rv release $out/libexec
 
-    substituteAllInPlace $out/libexec/launch.sh
+    makeWrapper $out/scripts/language_server.sh $out/bin/elixir-ls \
+      --set ELS_LOCAL "1"
 
-    makeWrapper $out/libexec/language_server.sh $out/bin/elixir-ls \
-      --set ELS_INSTALL_PREFIX "$out/libexec"
-
-    makeWrapper $out/libexec/debug_adapter.sh $out/bin/elixir-debug-adapter \
-      --set ELS_INSTALL_PREFIX "$out/libexec"
+    makeWrapper $out/scripts/debug_adapter.sh $out/bin/elixir-debug-adapter \
+      --set ELS_LOCAL "1"
 
     runHook postInstall
   '';
diff --git a/pkgs/development/beam-modules/elixir-ls/launch.sh.patch b/pkgs/development/beam-modules/elixir-ls/launch.sh.patch
index aabfd82a3d58..ebbac1997fa4 100644
--- a/pkgs/development/beam-modules/elixir-ls/launch.sh.patch
+++ b/pkgs/development/beam-modules/elixir-ls/launch.sh.patch
@@ -1,6 +1,6 @@
-diff --git i/scripts/launch.sh w/scripts/launch.sh
-index 21afbb1e..975cbdf0 100755
---- i/scripts/launch.sh
+diff --git c/scripts/launch.sh w/scripts/launch.sh
+index 21afbb1e..8bc5c382 100755
+--- c/scripts/launch.sh
 +++ w/scripts/launch.sh
 @@ -1,125 +1,4 @@
 -#!/bin/sh
@@ -129,7 +129,7 @@ index 21afbb1e..975cbdf0 100755
  
  # In case that people want to tweak the path, which Elixir to use, or
  # whatever prior to launching the language server or the debug adapter, we
-@@ -138,29 +17,18 @@ fi
+@@ -138,29 +17,22 @@ fi
  # script so we can correctly configure the Erlang library path to
  # include the local .ez files, and then do what we were asked to do.
  
@@ -140,7 +140,7 @@ index 21afbb1e..975cbdf0 100755
 -  SCRIPTPATH=${ELS_INSTALL_PREFIX}
 -fi
 +SCRIPT=$(readlink -f "$0")
-+SCRIPTPATH=$(dirname "$SCRIPT")/../libexec
++SCRIPTPATH=$(dirname "$SCRIPT")/../scripts
  
  export MIX_ENV=prod
  # Mix.install prints to stdout and reads from stdin
@@ -166,4 +166,8 @@ index 21afbb1e..975cbdf0 100755
 +ELX_STDLIB_PATH=${ELX_STDLIB_PATH:-@elixir@/lib/elixir}
 +export ELX_STDLIB_PATH
 +
++# ensure our elixir is in the path
++PATH="@elixir@/bin:$PATH"
++export PATH
++
 +source "$SCRIPTPATH/exec.bash"
diff --git a/pkgs/development/libraries/embree/2.x.nix b/pkgs/development/libraries/embree/2.x.nix
index 05764262a979..6ec8f1040769 100644
--- a/pkgs/development/libraries/embree/2.x.nix
+++ b/pkgs/development/libraries/embree/2.x.nix
@@ -7,7 +7,7 @@
   ispc,
   tbb_2020,
   glfw,
-  openimageio_2,
+  openimageio,
   libjpeg,
   libpng,
   libpthreadstubs,
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     # tbb_2021 is not backward compatible
     tbb_2020
     glfw
-    openimageio_2
+    openimageio
     libjpeg
     libpng
     libX11
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 54076c6063a4..67af703d44f9 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -152,5 +152,9 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ codyopel ];
     teams = [ teams.freedesktop ];
     changelog = "https://gitlab.freedesktop.org/libinput/libinput/-/releases/${version}";
+    badPlatforms = [
+      # Mandatory shared library.
+      lib.systems.inspect.platformPatterns.isStatic
+    ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/brisk-reconciler/default.nix b/pkgs/development/ocaml-modules/brisk-reconciler/default.nix
index 91c9efc90e8f..d99e050d7642 100644
--- a/pkgs/development/ocaml-modules/brisk-reconciler/default.nix
+++ b/pkgs/development/ocaml-modules/brisk-reconciler/default.nix
@@ -4,23 +4,28 @@
   lib,
   reason,
   ppxlib,
+  ocaml,
 }:
 
+let
+  version =
+    if lib.versionAtLeast ocaml.version "5.3" then
+      throw "brisk-reconciler is not available for OCaml ${ocaml.version}"
+    else
+      "1.0.0-alpha1";
+in
+
 buildDunePackage {
   pname = "brisk-reconciler";
-  version = "unstable-2020-12-02";
-
-  duneVersion = "3";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "briskml";
     repo = "brisk-reconciler";
-    rev = "c9d5c4cf5dd17ff2da994de2c3b0f34c72778f70";
-    sha256 = "sha256-AAB4ZzBnwfwFXOAqX/sIT6imOl70F0YNMt96SWOOE9w=";
+    tag = "v${version}";
+    hash = "sha256-Xj6GGsod3lnEEjrzPrlHwQAowq66uz8comlhpWK888k=";
   };
 
-  nativeBuildInputs = [ reason ];
-
   buildInputs = [
     ppxlib
   ];
diff --git a/pkgs/development/python-modules/materialx/default.nix b/pkgs/development/python-modules/materialx/default.nix
index ac858b468fdd..4e47efbb27ce 100644
--- a/pkgs/development/python-modules/materialx/default.nix
+++ b/pkgs/development/python-modules/materialx/default.nix
@@ -8,7 +8,7 @@
   libX11,
   libXt,
   libGL,
-  openimageio_2,
+  openimageio,
   imath,
   python,
   apple-sdk_14,
@@ -16,16 +16,13 @@
 
 buildPythonPackage rec {
   pname = "materialx";
-  version = "1.38.10";
+  version = "1.39.3";
 
-  # nixpkgs-update: no auto update
-  # Updates are disabled due to API breakage in 1.39+ that breaks almost all
-  # consumers.
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "MaterialX";
     rev = "v${version}";
-    hash = "sha256-/kMHmW2dptZNtjuhE5s+jvPRIdtY+FRiVtMU+tiBgQo=";
+    hash = "sha256-ceVYD/dyb3SEEENoJZxjn94DGmUj6IYSNLjsJvmPM84=";
   };
 
   format = "other";
@@ -36,7 +33,7 @@ buildPythonPackage rec {
   ];
 
   buildInputs = [
-    openimageio_2
+    openimageio
     imath
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -50,6 +47,7 @@ buildPythonPackage rec {
 
   cmakeFlags = [
     (lib.cmakeBool "MATERIALX_BUILD_OIIO" true)
+    (lib.cmakeBool "MATERIALX_BUILD_SHARED_LIBS" true)
     (lib.cmakeBool "MATERIALX_BUILD_PYTHON" true)
     (lib.cmakeBool "MATERIALX_BUILD_GEN_MSL" (
       stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin
@@ -66,12 +64,6 @@ buildPythonPackage rec {
     ln -s $out/python $target_dir
   '';
 
-  # Update to 1.39 has major API changes and downstream software
-  # needs to adapt, first. So, do not include in mass updates. For reference, see
-  # https://github.com/NixOS/nixpkgs/pull/326466#issuecomment-2293029160
-  # and https://github.com/NixOS/nixpkgs/issues/380230
-  passthru.skipBulkUpdate = true;
-
   meta = {
     changelog = "https://github.com/AcademySoftwareFoundation/MaterialX/blob/${src.rev}/CHANGELOG.md";
     description = "Open standard for representing rich material and look-development content in computer graphics";
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index fe60be7c864f..c232bf96b9e2 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -22,7 +22,7 @@ in
 buildPythonPackage rec {
   pname = "playwright";
   # run ./pkgs/development/python-modules/playwright/update.sh to update
-  version = "1.53.0";
+  version = "1.54.0";
   pyproject = true;
   disabled = pythonOlder "3.9";
 
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "playwright-python";
     tag = "v${version}";
-    hash = "sha256-jFS2Luq/9mRsXZ65H3VLw+sTBplVNVy/yZYrpF5Hc0M=";
+    hash = "sha256-xyuofDL0hWL8Gn4sYNLKte8q/4bMo+3aSbYaf5iWiBk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/playwright/update.sh b/pkgs/development/python-modules/playwright/update.sh
index a7ab9522f0d1..cdd80a84c691 100755
--- a/pkgs/development/python-modules/playwright/update.sh
+++ b/pkgs/development/python-modules/playwright/update.sh
@@ -22,6 +22,19 @@ repo_url_prefix="https://github.com/microsoft/playwright/raw"
 temp_dir=$(mktemp -d)
 trap 'rm -rf "$temp_dir"' EXIT
 
+# Update playwright-mcp package
+mcp_version=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s https://api.github.com/repos/microsoft/playwright-mcp/releases/latest | jq -r '.tag_name | sub("^v"; "")')
+update-source-version playwright-mcp "$mcp_version"
+
+# Update npmDepsHash for playwright-mcp
+pushd "$temp_dir" >/dev/null
+curl -fsSL -o package-lock.json "https://raw.githubusercontent.com/microsoft/playwright-mcp/v${mcp_version}/package-lock.json"
+mcp_npm_hash=$(prefetch-npm-deps package-lock.json)
+rm -f package-lock.json
+popd >/dev/null
+
+mcp_package_file="$root/../../../by-name/pl/playwright-mcp/package.nix"
+sed -E 's#\bnpmDepsHash = ".*?"#npmDepsHash = "'"$mcp_npm_hash"'"#' -i "$mcp_package_file"
 
 
 # update binaries of browsers, used by playwright.
@@ -48,6 +61,9 @@ update_browser() {
     else
         if [ "$name" = "ffmpeg" ] || [ "$name" = "chromium-headless-shell" ]; then
             suffix="linux"
+        elif [ "$name" = "chromium" ]; then
+            stripRoot="true"
+            suffix="linux"
         elif [ "$name" = "firefox" ]; then
             stripRoot="true"
             suffix="ubuntu-22.04"
@@ -81,7 +97,7 @@ curl -fsSl \
       )
     ' > "$playwright_dir/browsers.json"
 
-# We currently use Chromium from nixpkgs, so we don't need to download it here
+update_browser "chromium" "linux"
 update_browser "chromium-headless-shell" "linux"
 update_browser "firefox" "linux"
 update_browser "webkit" "linux"
diff --git a/pkgs/development/python-modules/python-tsp/default.nix b/pkgs/development/python-modules/python-tsp/default.nix
new file mode 100644
index 000000000000..7751fdc448d5
--- /dev/null
+++ b/pkgs/development/python-modules/python-tsp/default.nix
@@ -0,0 +1,57 @@
+{
+  # Basic
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  # Build system
+  poetry-core,
+  # Dependencies
+  numpy,
+  requests,
+  tsplib95,
+  # Test
+  pytestCheckHook,
+  mock,
+}:
+
+buildPythonPackage rec {
+  pname = "python-tsp";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fillipe-gsm";
+    repo = "python-tsp";
+    tag = "v${version}";
+    hash = "sha256-X4L0j6ZL8/Xj2YFcvwOl8voC2xHagMcdcj9F1f/6/5M=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    numpy
+    requests
+    tsplib95
+  ];
+
+  # Rename some dependencies
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "poetry>=0.12" "poetry-core>=0.12" \
+      --replace-fail "poetry.masonry.api" "poetry.core.masonry.api"
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    mock
+  ];
+
+  pythonImportsCheck = [ "python_tsp" ];
+
+  meta = {
+    description = "Library for solving typical Traveling Salesperson Problems (TSP)";
+    homepage = "https://github.com/fillipe-gsm/python-tsp";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ thattemperature ];
+  };
+}
diff --git a/pkgs/development/web/playwright/browsers.json b/pkgs/development/web/playwright/browsers.json
index a79b88d42048..f7155ea875d3 100644
--- a/pkgs/development/web/playwright/browsers.json
+++ b/pkgs/development/web/playwright/browsers.json
@@ -2,19 +2,19 @@
   "comment": "This file is kept up to date via update.sh",
   "browsers": {
     "chromium": {
-      "revision": "1179",
-      "browserVersion": "138.0.7204.23"
+      "revision": "1181",
+      "browserVersion": "139.0.7258.5"
     },
     "chromium-headless-shell": {
-      "revision": "1179",
-      "browserVersion": "138.0.7204.23"
+      "revision": "1181",
+      "browserVersion": "139.0.7258.5"
     },
     "firefox": {
-      "revision": "1488",
-      "browserVersion": "139.0"
+      "revision": "1489",
+      "browserVersion": "140.0.2"
     },
     "webkit": {
-      "revision": "2182",
+      "revision": "2191",
       "revisionOverrides": {
         "debian11-x64": "2105",
         "debian11-arm64": "2105",
@@ -29,7 +29,7 @@
         "ubuntu20.04-x64": "2092",
         "ubuntu20.04-arm64": "2092"
       },
-      "browserVersion": "18.5"
+      "browserVersion": "26.0"
     },
     "ffmpeg": {
       "revision": "1011",
diff --git a/pkgs/development/web/playwright/chromium-headless-shell.nix b/pkgs/development/web/playwright/chromium-headless-shell.nix
index f4ea66e14171..40a8ff2eb832 100644
--- a/pkgs/development/web/playwright/chromium-headless-shell.nix
+++ b/pkgs/development/web/playwright/chromium-headless-shell.nix
@@ -30,8 +30,8 @@ let
       stripRoot = false;
       hash =
         {
-          x86_64-linux = "sha256-C545VC0RxFYfKf8XArfVoI2yzrGyfR7vxjryJHfcfBQ=";
-          aarch64-linux = "sha256-i+HVf/6Qz2nCLLzPxbRYVFjDDOhd5ETYuHje5YsmsAo=";
+          x86_64-linux = "sha256-AYh2urKZdjXCELimYaFihWp0FbDLf4uRrKLJZVxug5M=";
+          aarch64-linux = "sha256-diBiy0z51BxGK0PcfQOf1aryUcZesKu/UHBSZUjqwMk=";
         }
         .${system} or throwSystem;
     };
@@ -66,8 +66,8 @@ let
     stripRoot = false;
     hash =
       {
-        x86_64-darwin = "sha256-2pe1LS3WXRG/V2k/BNN1MmOOdGoA0WCFhUpZW8TUhic=";
-        aarch64-darwin = "sha256-U07QnHFPQXyO3VGWfZvcP8cJEmVJAJ7imj+6DQlN9vQ=";
+        x86_64-darwin = "sha256-vIJuDjkasUYlMW0aCOyztyrlh5kvcwNR9GBaoa/yh/M=";
+        aarch64-darwin = "sha256-6Q6nz0H2749srdMF/puk/gnG1gQBEnWe9cQO3owL2OU=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/chromium.nix b/pkgs/development/web/playwright/chromium.nix
index 34d24f9cc563..c356023fd3fc 100644
--- a/pkgs/development/web/playwright/chromium.nix
+++ b/pkgs/development/web/playwright/chromium.nix
@@ -41,8 +41,8 @@ let
       url = "https://playwright.azureedge.net/builds/chromium/${revision}/chromium-${suffix}.zip";
       hash =
         {
-          x86_64-linux = "sha256-7oQQCAIt1VJiMNFEJO40K8oENK/L0BICXm2D/3fZ8bA=";
-          aarch64-linux = "sha256-1OmByLX2jNHXAzWdXF8Od7S7pj/jl4wwvOQcsZc5R7o=";
+          x86_64-linux = "sha256-R7nMCVpUqgRwtB0syhfIK81maiTVWr8lYBLp4bR8VBg=";
+          aarch64-linux = "sha256-4fc4X7QwBigktmEeseuqIyEeV70Dy3eO/femXrftMd0=";
         }
         .${system} or throwSystem;
     };
@@ -109,8 +109,8 @@ let
     stripRoot = false;
     hash =
       {
-        x86_64-darwin = "sha256-KOoCbygsZZzGNKD8ICcGg0iM2h0HVgXq0I4JMPaUJR8=";
-        aarch64-darwin = "sha256-2naFzKWmo6el+AqljzILO+hUq/E2g81Dt1fwq79EYO8=";
+        x86_64-darwin = "sha256-0u1AStbUTX+qgUmg2DvL59B4b265WywDaBV+MdSuaNE=";
+        aarch64-darwin = "sha256-4pg4wmNTF8mw+APmdpvYlFxb9zc6OUh11oW5gCRKETY=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/driver.nix b/pkgs/development/web/playwright/driver.nix
index cbd8d5ca9ea8..36234e2b0dab 100644
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@@ -27,13 +27,13 @@ let
     }
     .${system} or throwSystem;
 
-  version = "1.53.1";
+  version = "1.54.1";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright";
     rev = "v${version}";
-    hash = "sha256-N5BS8zpoQGUf5gly0fyutaK76CAhbwOGAUofGnfkmnM=";
+    hash = "sha256-xwyREgelHLkpbUXOZTppKK7L6dE4jx0d/lbDWSKGzTY=";
   };
 
   babel-bundle = buildNpmPackage {
@@ -70,7 +70,7 @@ let
     pname = "utils-bundle-core";
     inherit version src;
     sourceRoot = "${src.name}/packages/playwright-core/bundles/utils";
-    npmDepsHash = "sha256-3hdOmvs/IGAgW7vhldms9Q9/ZQfbjbc+xP+JEtGJ7g8=";
+    npmDepsHash = "sha256-gEm2oTxj4QIiGnIOPffOLh3BYSngpGToF89ObnDYBqs=";
     dontNpmBuild = true;
     installPhase = ''
       cp -r . "$out"
@@ -92,7 +92,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}"; # update.sh depends on sourceRoot presence
-    npmDepsHash = "sha256-a1s1l8PG0ViVqYOksB2dkID/AHczMjLNQJW88+yB0B0=";
+    npmDepsHash = "sha256-4bsX8Q8V3CBpIsyqMYTzfERQQPY5zlPf7CoqR6UkUHU=";
 
     nativeBuildInputs = [
       cacert
diff --git a/pkgs/development/web/playwright/firefox.nix b/pkgs/development/web/playwright/firefox.nix
index 92bdc123220a..afc15e970ecc 100644
--- a/pkgs/development/web/playwright/firefox.nix
+++ b/pkgs/development/web/playwright/firefox.nix
@@ -17,8 +17,8 @@ let
       }.zip";
       hash =
         {
-          x86_64-linux = "sha256-L9bIldFCqZ/jnNKkJk6nS0HNaJefzTMQIJ6VLUE9ugc=";
-          aarch64-linux = "sha256-iuiS59f8j3K+grBU7ZtZPfU4r2Dp7s0JJHf2n/4r30U=";
+          x86_64-linux = "sha256-j7gOuXMyftNQencgfpk8Y4ED2LuT7TAa30IPyzmir48=";
+          aarch64-linux = "sha256-deIUGKBrp56TsDr61cbNbRRSRcVpSoa6pdmMk4oB/Eg=";
         }
         .${system} or throwSystem;
     };
@@ -41,8 +41,8 @@ let
     stripRoot = false;
     hash =
       {
-        x86_64-darwin = "sha256-K0eW1kC1tckJu0crD89hDhK8PHyQUB0YUYN9DdX0HKw=";
-        aarch64-darwin = "sha256-n1Uy59r6wxmung8QKvw3JeyF3ec/avCVp9fI+bck/iA=";
+        x86_64-darwin = "sha256-ljgFoyqCg9kma2cDFodNjbkAeEylIzVdWkS1vU/9Rbg=";
+        aarch64-darwin = "sha256-W2J5APPWEkmoDgBEox6/ygg2xyWpOHZESXFG0tZbj1M=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/webkit.nix b/pkgs/development/web/playwright/webkit.nix
index 1d188b296ad4..a068c052825f 100644
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -102,7 +102,11 @@ let
           hash = "sha256-X4fbYTMS+kHfZRbeGzSdBW5jQKw8UN44FEyFRUtw0qo=";
         })
       ];
-      postPatch = "";
+      postPatch = ''
+        # Fix multiple definition errors by using C++17 instead of C++11
+        substituteInPlace CMakeLists.txt \
+          --replace "set(CMAKE_CXX_STANDARD 11)" "set(CMAKE_CXX_STANDARD 17)"
+      '';
       postInstall = "";
 
       cmakeFlags = [
@@ -125,8 +129,8 @@ let
       stripRoot = false;
       hash =
         {
-          x86_64-linux = "sha256-lwH783B3/laqw0IdGBnVzvySRoF0AwZsSolaqUKmsM4=";
-          aarch64-linux = "sha256-qtvP0bc5rcZcz6SqigfdrjhTWEmvT4k11I1GW1Eoj/Q=";
+          x86_64-linux = "sha256-OSVHFGdcQrzmhLPdXF61tKmip/6/D+uaQgSBBQiOIZI=";
+          aarch64-linux = "sha256-b8XwVMCwSbujyqgkJKIPAVNX83Qmmsthprr2x9XSb10=";
         }
         .${system} or throwSystem;
     };
@@ -206,8 +210,8 @@ let
     stripRoot = false;
     hash =
       {
-        x86_64-darwin = "sha256-p1+Pk+Zhf2OPEmEWCEd0tA7CdoMcOgYp69SnQXufFJ0=";
-        aarch64-darwin = "sha256-tEfKvJuGe4htZLSOn94eKeBtWXYkjl73iJSY4BWJMKo=";
+        x86_64-darwin = "sha256-shjhozJS2VbBjpjJVlM9hwBzGWwgva1qhfEUhY8t9Bk=";
+        aarch64-darwin = "sha256-ZRl86L/OOTNPWfZDl6JQfuXL41kI/Wir99/JIbf7T7M=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 67f49c6b22f0..2e159ff1e971 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,11 +1,11 @@
 {
     "testing": {
-        "version": "6.16-rc6",
-        "hash": "sha256:03sz5gbnz1s763nlq2sbqk3bmjca24hq2n9wrpqhy6gyrd11s22f"
+        "version": "6.16-rc7",
+        "hash": "sha256:071xwskg7rpa6j09khdxzzccqp8a2fk68l0p2bn7ycr51pyywxz9"
     },
     "6.1": {
-        "version": "6.1.146",
-        "hash": "sha256:117gyi8zym09z2qarnv02i7v23v8596nqvllid07aydlcpihl9pv"
+        "version": "6.1.147",
+        "hash": "sha256:1xv6whvxjcdmvv0cil7nnac4hs2hxjnc98agx08xiqs179k2b3r1"
     },
     "5.15": {
         "version": "5.15.189",
@@ -20,15 +20,15 @@
         "hash": "sha256:0fm73yqzbzclh2achcj8arpg428d412k2wgmlfmyy6xzb1762qrx"
     },
     "6.6": {
-        "version": "6.6.99",
-        "hash": "sha256:0dmbi7g156gknglcgb47kl1i29fa6q4rkx99m2glpiqykxr7k1mh"
+        "version": "6.6.100",
+        "hash": "sha256:1flpvypy88rmp2sbz3z4fxlgdylm5lxb5832bgsi8j5iam6yrh6n"
     },
     "6.12": {
-        "version": "6.12.39",
-        "hash": "sha256:0iakbyipani7rcm37xb0bsl5zn7h1m7vfhwfangn64gxm012amkf"
+        "version": "6.12.40",
+        "hash": "sha256:0cr9hi0m7p9jf0rdblign1ya40rckab9axiwxb62r3gr2w9sy4a8"
     },
     "6.15": {
-        "version": "6.15.7",
-        "hash": "sha256:1sgq32ivnrvlqskmz6i5k9157y6c5x3r9lj3pl0i23habc8ds1rm"
+        "version": "6.15.8",
+        "hash": "sha256:19i87zpq3zhpg09sdirnzys2s2yrv9xn8mpibl1a6qmr2sy94znk"
     }
 }
diff --git a/pkgs/tools/admin/meshcentral/default.nix b/pkgs/tools/admin/meshcentral/default.nix
index 33fd196ea964..b648830321e0 100644
--- a/pkgs/tools/admin/meshcentral/default.nix
+++ b/pkgs/tools/admin/meshcentral/default.nix
@@ -8,11 +8,11 @@
 }:
 
 yarn2nix-moretea.mkYarnPackage {
-  version = "1.1.47";
+  version = "1.1.48";
 
   src = fetchzip {
-    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.47.tgz";
-    sha256 = "196d2rzmy5caaw42d3az9m4yfwjsgia82g7ic71knamd28q9rab2";
+    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.48.tgz";
+    sha256 = "0ns4pp0gswvfpyjzklsh76ych9sv9qjcn50dhain7b6cy6dkrmga";
   };
 
   patches = [
@@ -24,7 +24,7 @@ yarn2nix-moretea.mkYarnPackage {
 
   offlineCache = fetchYarnDeps {
     yarnLock = ./yarn.lock;
-    hash = "sha256-2pU0XhkiDNjkZiXA2S4RMTY4IyVEnsV/vEDtYnPjOfk=";
+    hash = "sha256-oHY21OMLVyrdJOiV9MarXWnjcKNaKtvUz26xIvVNRsw=";
   };
 
   # Tarball has CRLF line endings. This makes patching difficult, so let's convert them.
diff --git a/pkgs/tools/admin/meshcentral/package.json b/pkgs/tools/admin/meshcentral/package.json
index 458ec1ed6b35..5e31c186fd18 100644
--- a/pkgs/tools/admin/meshcentral/package.json
+++ b/pkgs/tools/admin/meshcentral/package.json
@@ -1,6 +1,6 @@
 {
   "name": "meshcentral",
-  "version": "1.1.47",
+  "version": "1.1.48",
   "keywords": [
     "Remote Device Management",
     "Remote Device Monitoring",
@@ -41,8 +41,8 @@
     "archiver": "7.0.1",
     "body-parser": "1.20.3",
     "cbor": "5.2.0",
-    "compression": "1.7.5",
-    "cookie-session": "2.1.0",
+    "compression": "1.8.1",
+    "cookie-session": "2.1.1",
     "express": "4.21.2",
     "express-handlebars": "7.1.3",
     "express-ws": "5.0.2",
@@ -50,8 +50,8 @@
     "minimist": "1.2.8",
     "multiparty": "4.2.3",
     "node-forge": "1.3.1",
-    "ua-parser-js": "1.0.40",
     "ua-client-hints-js": "0.1.2",
+    "ua-parser-js": "1.0.40",
     "ws": "8.18.0",
     "yauzl": "2.10.0"
   },
@@ -77,8 +77,8 @@
     "archiver": "7.0.1",
     "body-parser": "1.20.3",
     "cbor": "5.2.0",
-    "compression": "1.7.5",
-    "cookie-session": "2.1.0",
+    "compression": "1.8.1",
+    "cookie-session": "2.1.1",
     "express": "4.21.2",
     "express-handlebars": "7.1.3",
     "express-ws": "5.0.2",
diff --git a/pkgs/tools/admin/meshcentral/yarn.lock b/pkgs/tools/admin/meshcentral/yarn.lock
index c63c14095127..9eb55196e096 100644
--- a/pkgs/tools/admin/meshcentral/yarn.lock
+++ b/pkgs/tools/admin/meshcentral/yarn.lock
@@ -48,24 +48,24 @@
     "@smithy/util-utf8" "^2.0.0"
     tslib "^2.6.2"
 
-"@aws-sdk/client-cognito-identity@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-cognito-identity/-/client-cognito-identity-3.846.0.tgz#f7bfecb0c731df961058b4f63029f7556cb7eda6"
-  integrity sha512-vlzQVq1TOOYHPppmON/+oNhCxprCPPqxlqAuUddf885JcT6Q9r7FeV7S2yHli/1XC6vBa7sAninNvOjzwDbwYw==
+"@aws-sdk/client-cognito-identity@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-cognito-identity/-/client-cognito-identity-3.848.0.tgz#d7461128c39214a3d37c69eae6dceddfb7931f2a"
+  integrity sha512-Sin8aLnA81MgvUJrfQsBIQ1UJg4klWT3NuYYjExLiVQf3A0/F7Bfx1HTIyWXtSchY4QgGr7MMone0/0KZ4Dy9g==
   dependencies:
     "@aws-crypto/sha256-browser" "5.2.0"
     "@aws-crypto/sha256-js" "5.2.0"
     "@aws-sdk/core" "3.846.0"
-    "@aws-sdk/credential-provider-node" "3.846.0"
+    "@aws-sdk/credential-provider-node" "3.848.0"
     "@aws-sdk/middleware-host-header" "3.840.0"
     "@aws-sdk/middleware-logger" "3.840.0"
     "@aws-sdk/middleware-recursion-detection" "3.840.0"
-    "@aws-sdk/middleware-user-agent" "3.846.0"
+    "@aws-sdk/middleware-user-agent" "3.848.0"
     "@aws-sdk/region-config-resolver" "3.840.0"
     "@aws-sdk/types" "3.840.0"
-    "@aws-sdk/util-endpoints" "3.845.0"
+    "@aws-sdk/util-endpoints" "3.848.0"
     "@aws-sdk/util-user-agent-browser" "3.840.0"
-    "@aws-sdk/util-user-agent-node" "3.846.0"
+    "@aws-sdk/util-user-agent-node" "3.848.0"
     "@smithy/config-resolver" "^4.1.4"
     "@smithy/core" "^3.7.0"
     "@smithy/fetch-http-handler" "^5.1.0"
@@ -93,10 +93,10 @@
     "@smithy/util-utf8" "^4.0.0"
     tslib "^2.6.2"
 
-"@aws-sdk/client-sso@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sso/-/client-sso-3.846.0.tgz#9905ccf216e371c94ca63b1df19dba923d286307"
-  integrity sha512-7MgMl3nlwf2ixad5Xe8pFHtcwFchkx37MEvGuB00tn5jyBp3AQQ4dK3iHtj2HjhXcXD0G67zVPvH4/QNOL7/gw==
+"@aws-sdk/client-sso@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sso/-/client-sso-3.848.0.tgz#84178a83af2a1ce5d0ddfcfc980f4fe71987c01a"
+  integrity sha512-mD+gOwoeZQvbecVLGoCmY6pS7kg02BHesbtIxUj+PeBqYoZV5uLvjUOmuGfw1SfoSobKvS11urxC9S7zxU/Maw==
   dependencies:
     "@aws-crypto/sha256-browser" "5.2.0"
     "@aws-crypto/sha256-js" "5.2.0"
@@ -104,12 +104,12 @@
     "@aws-sdk/middleware-host-header" "3.840.0"
     "@aws-sdk/middleware-logger" "3.840.0"
     "@aws-sdk/middleware-recursion-detection" "3.840.0"
-    "@aws-sdk/middleware-user-agent" "3.846.0"
+    "@aws-sdk/middleware-user-agent" "3.848.0"
     "@aws-sdk/region-config-resolver" "3.840.0"
     "@aws-sdk/types" "3.840.0"
-    "@aws-sdk/util-endpoints" "3.845.0"
+    "@aws-sdk/util-endpoints" "3.848.0"
     "@aws-sdk/util-user-agent-browser" "3.840.0"
-    "@aws-sdk/util-user-agent-node" "3.846.0"
+    "@aws-sdk/util-user-agent-node" "3.848.0"
     "@smithy/config-resolver" "^4.1.4"
     "@smithy/core" "^3.7.0"
     "@smithy/fetch-http-handler" "^5.1.0"
@@ -158,12 +158,12 @@
     fast-xml-parser "5.2.5"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-cognito-identity@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-cognito-identity/-/credential-provider-cognito-identity-3.846.0.tgz#61c09e6a3ccf325991f2e335378fd40d6018f44b"
-  integrity sha512-zfcNFUK0QC7czR/n3ATMp3ZWkMrGZzJ1mS/sTezjFg1IupFnogyF+8xKmnmqXiABJd1yE8FduYgw8yx0ZSWiCw==
+"@aws-sdk/credential-provider-cognito-identity@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-cognito-identity/-/credential-provider-cognito-identity-3.848.0.tgz#c3d54f75a176aadddd3a6a7f6092987744ca32d1"
+  integrity sha512-2cm/Ye6ktagW1h7FmF4sgo8STZyBr2+0+L9lr/veuPKZVWoi/FyhJR3l0TtKrd8z78no9P5xbsGUmxoDLtsxiw==
   dependencies:
-    "@aws-sdk/client-cognito-identity" "3.846.0"
+    "@aws-sdk/client-cognito-identity" "3.848.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/types" "^4.3.1"
@@ -196,18 +196,18 @@
     "@smithy/util-stream" "^4.2.3"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-ini@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.846.0.tgz#3d4df54131048d745a04ab3b4af95407f49f7514"
-  integrity sha512-GUxaBBKsYx1kOlRbcs77l6BVyG9K70zekJX+5hdwTEgJq7AoHl/XYoWiDxPf6zQ7J4euixPJoyRhpNbJjAXdFw==
+"@aws-sdk/credential-provider-ini@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.848.0.tgz#aec6f9158b08b9842d4e9ee7671296a2a237b026"
+  integrity sha512-r6KWOG+En2xujuMhgZu7dzOZV3/M5U/5+PXrG8dLQ3rdPRB3vgp5tc56KMqLwm/EXKRzAOSuw/UE4HfNOAB8Hw==
   dependencies:
     "@aws-sdk/core" "3.846.0"
     "@aws-sdk/credential-provider-env" "3.846.0"
     "@aws-sdk/credential-provider-http" "3.846.0"
     "@aws-sdk/credential-provider-process" "3.846.0"
-    "@aws-sdk/credential-provider-sso" "3.846.0"
-    "@aws-sdk/credential-provider-web-identity" "3.846.0"
-    "@aws-sdk/nested-clients" "3.846.0"
+    "@aws-sdk/credential-provider-sso" "3.848.0"
+    "@aws-sdk/credential-provider-web-identity" "3.848.0"
+    "@aws-sdk/nested-clients" "3.848.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/credential-provider-imds" "^4.0.6"
     "@smithy/property-provider" "^4.0.4"
@@ -215,17 +215,17 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-node@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-node/-/credential-provider-node-3.846.0.tgz#576d302e7d5af1abc7e5b95695dd97afa03ad2f8"
-  integrity sha512-du2DsXYRfQ8VIt/gXGThhT8KdUEt2j9W91W87Bl9IA5DINt4nSZv+gzh8LqHBYsTSqoUpKb+qIfP1RjZM/8r0A==
+"@aws-sdk/credential-provider-node@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-node/-/credential-provider-node-3.848.0.tgz#aeeccc9cadaae57fd2664298ecacea18648d6b9c"
+  integrity sha512-AblNesOqdzrfyASBCo1xW3uweiSro4Kft9/htdxLeCVU1KVOnFWA5P937MNahViRmIQm2sPBCqL8ZG0u9lnh5g==
   dependencies:
     "@aws-sdk/credential-provider-env" "3.846.0"
     "@aws-sdk/credential-provider-http" "3.846.0"
-    "@aws-sdk/credential-provider-ini" "3.846.0"
+    "@aws-sdk/credential-provider-ini" "3.848.0"
     "@aws-sdk/credential-provider-process" "3.846.0"
-    "@aws-sdk/credential-provider-sso" "3.846.0"
-    "@aws-sdk/credential-provider-web-identity" "3.846.0"
+    "@aws-sdk/credential-provider-sso" "3.848.0"
+    "@aws-sdk/credential-provider-web-identity" "3.848.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/credential-provider-imds" "^4.0.6"
     "@smithy/property-provider" "^4.0.4"
@@ -245,48 +245,48 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-sso@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.846.0.tgz#6c1040a3476e877a769075682c3f7c105f16460b"
-  integrity sha512-Dxz9dpdjfxUsSfW92SAldu9wy8wgEbskn4BNWBFHslQHTmqurmR0ci4P1SMxJJKd498AUEoIAzZOtjGOC38irQ==
+"@aws-sdk/credential-provider-sso@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.848.0.tgz#5921e154cde77f261e00da63431294ddde91d6f9"
+  integrity sha512-pozlDXOwJZL0e7w+dqXLgzVDB7oCx4WvtY0sk6l4i07uFliWF/exupb6pIehFWvTUcOvn5aFTTqcQaEzAD5Wsg==
   dependencies:
-    "@aws-sdk/client-sso" "3.846.0"
+    "@aws-sdk/client-sso" "3.848.0"
     "@aws-sdk/core" "3.846.0"
-    "@aws-sdk/token-providers" "3.846.0"
+    "@aws-sdk/token-providers" "3.848.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/shared-ini-file-loader" "^4.0.4"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-web-identity@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.846.0.tgz#939629e1cf2b778168f350ea79aaf278b357317e"
-  integrity sha512-j6zOd+kynPQJzmVwSKSUTpsLXAf7vKkr7hCPbQyqC8ZqkIuExsRqu2vRQjX2iH/MKhwZ+qEWMxPMhfDoyv7Gag==
+"@aws-sdk/credential-provider-web-identity@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.848.0.tgz#86eaa04daf17ce41b9aab06a3c19a326fcbfaddf"
+  integrity sha512-D1fRpwPxtVDhcSc/D71exa2gYweV+ocp4D3brF0PgFd//JR3XahZ9W24rVnTQwYEcK9auiBZB89Ltv+WbWN8qw==
   dependencies:
     "@aws-sdk/core" "3.846.0"
-    "@aws-sdk/nested-clients" "3.846.0"
+    "@aws-sdk/nested-clients" "3.848.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
 "@aws-sdk/credential-providers@^3.186.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-providers/-/credential-providers-3.846.0.tgz#98c348ec6551f7dc832bfc369fe221b2b71e4846"
-  integrity sha512-YpTJcV5PO0V+I1nRGAyNF/kCcOIgPgzihlAyOqicmq3vZ8UHZqUCOfzcS6qbEpPFeAB3domzBgsAJNsQXht4SA==
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-providers/-/credential-providers-3.848.0.tgz#78ab8cb8114136130f2ccb357761c4936117a38a"
+  integrity sha512-lRDuU05YC+r/1JmRULngJQli7scP5hmq0/7D+xw1s8eRM0H2auaH7LQFlq/SLxQZLMkVNPCrmsug3b3KcLj1NA==
   dependencies:
-    "@aws-sdk/client-cognito-identity" "3.846.0"
+    "@aws-sdk/client-cognito-identity" "3.848.0"
     "@aws-sdk/core" "3.846.0"
-    "@aws-sdk/credential-provider-cognito-identity" "3.846.0"
+    "@aws-sdk/credential-provider-cognito-identity" "3.848.0"
     "@aws-sdk/credential-provider-env" "3.846.0"
     "@aws-sdk/credential-provider-http" "3.846.0"
-    "@aws-sdk/credential-provider-ini" "3.846.0"
-    "@aws-sdk/credential-provider-node" "3.846.0"
+    "@aws-sdk/credential-provider-ini" "3.848.0"
+    "@aws-sdk/credential-provider-node" "3.848.0"
     "@aws-sdk/credential-provider-process" "3.846.0"
-    "@aws-sdk/credential-provider-sso" "3.846.0"
-    "@aws-sdk/credential-provider-web-identity" "3.846.0"
-    "@aws-sdk/nested-clients" "3.846.0"
+    "@aws-sdk/credential-provider-sso" "3.848.0"
+    "@aws-sdk/credential-provider-web-identity" "3.848.0"
+    "@aws-sdk/nested-clients" "3.848.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/config-resolver" "^4.1.4"
     "@smithy/core" "^3.7.0"
@@ -325,23 +325,23 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/middleware-user-agent@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.846.0.tgz#e038f60b1b12b2c44a41c831925f52347ca27540"
-  integrity sha512-85/oUc2jMXqQWo+HHH7WwrdqqArzhMmTmBCpXZwklBHG+ZMzTS5Wug2B0HhGDVWo9aYRMeikSq4lsrpHFVd2MQ==
+"@aws-sdk/middleware-user-agent@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.848.0.tgz#d1bba79ba7f026ad7a6df55e47ccd0513f8fdada"
+  integrity sha512-rjMuqSWJEf169/ByxvBqfdei1iaduAnfolTshsZxwcmLIUtbYrFUmts0HrLQqsAG8feGPpDLHA272oPl+NTCCA==
   dependencies:
     "@aws-sdk/core" "3.846.0"
     "@aws-sdk/types" "3.840.0"
-    "@aws-sdk/util-endpoints" "3.845.0"
+    "@aws-sdk/util-endpoints" "3.848.0"
     "@smithy/core" "^3.7.0"
     "@smithy/protocol-http" "^5.1.2"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/nested-clients@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/nested-clients/-/nested-clients-3.846.0.tgz#c0389df04f04e6f4d124a605cc17b2b3f9a82faa"
-  integrity sha512-LCXPVtNQnkTuE8inPCtpfWN2raE/ndFBKf5OIbuHnC/0XYGOUl5q7VsJz471zJuN9FX3WMfopaFwmNc7cQNMpQ==
+"@aws-sdk/nested-clients@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/nested-clients/-/nested-clients-3.848.0.tgz#69f8f57fb5df25262b8e60a3334e13dcded0309d"
+  integrity sha512-joLsyyo9u61jnZuyYzo1z7kmS7VgWRAkzSGESVzQHfOA1H2PYeUFek6vLT4+c9xMGrX/Z6B0tkRdzfdOPiatLg==
   dependencies:
     "@aws-crypto/sha256-browser" "5.2.0"
     "@aws-crypto/sha256-js" "5.2.0"
@@ -349,12 +349,12 @@
     "@aws-sdk/middleware-host-header" "3.840.0"
     "@aws-sdk/middleware-logger" "3.840.0"
     "@aws-sdk/middleware-recursion-detection" "3.840.0"
-    "@aws-sdk/middleware-user-agent" "3.846.0"
+    "@aws-sdk/middleware-user-agent" "3.848.0"
     "@aws-sdk/region-config-resolver" "3.840.0"
     "@aws-sdk/types" "3.840.0"
-    "@aws-sdk/util-endpoints" "3.845.0"
+    "@aws-sdk/util-endpoints" "3.848.0"
     "@aws-sdk/util-user-agent-browser" "3.840.0"
-    "@aws-sdk/util-user-agent-node" "3.846.0"
+    "@aws-sdk/util-user-agent-node" "3.848.0"
     "@smithy/config-resolver" "^4.1.4"
     "@smithy/core" "^3.7.0"
     "@smithy/fetch-http-handler" "^5.1.0"
@@ -394,13 +394,13 @@
     "@smithy/util-middleware" "^4.0.4"
     tslib "^2.6.2"
 
-"@aws-sdk/token-providers@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/token-providers/-/token-providers-3.846.0.tgz#36b499314c2ed754aa9372058a2a8c9e9054ad49"
-  integrity sha512-sGNk3xclK7xx+rIJZDJC4FNFqaSSqN0nSr+AdVdQ+/iKQKaUA6hixRbXaQ7I7M5mhqS6fMW1AsqVRywQq2BSMw==
+"@aws-sdk/token-providers@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/token-providers/-/token-providers-3.848.0.tgz#a30431066b2fc2927169e3a958bb610cfb936406"
+  integrity sha512-oNPyM4+Di2Umu0JJRFSxDcKQ35+Chl/rAwD47/bS0cDPI8yrao83mLXLeDqpRPHyQW4sXlP763FZcuAibC0+mg==
   dependencies:
     "@aws-sdk/core" "3.846.0"
-    "@aws-sdk/nested-clients" "3.846.0"
+    "@aws-sdk/nested-clients" "3.848.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/shared-ini-file-loader" "^4.0.4"
@@ -415,10 +415,10 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/util-endpoints@3.845.0":
-  version "3.845.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-endpoints/-/util-endpoints-3.845.0.tgz#a4a303502b79a9868da2f6a17f81d24a34f10974"
-  integrity sha512-MBmOf0Pb4q6xs9V7jXT1+qciW2965yvaoZUlUUnxUEoX6zxWROeIu/gttASc4vSjOHr/+64hmFkxjeBUF37FJA==
+"@aws-sdk/util-endpoints@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-endpoints/-/util-endpoints-3.848.0.tgz#dea15ac0949fcbc518426fb4a86d1e9bd53433db"
+  integrity sha512-fY/NuFFCq/78liHvRyFKr+aqq1aA/uuVSANjzr5Ym8c+9Z3HRPE9OrExAHoMrZ6zC8tHerQwlsXYYH5XZ7H+ww==
   dependencies:
     "@aws-sdk/types" "3.840.0"
     "@smithy/types" "^4.3.1"
@@ -443,12 +443,12 @@
     bowser "^2.11.0"
     tslib "^2.6.2"
 
-"@aws-sdk/util-user-agent-node@3.846.0":
-  version "3.846.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.846.0.tgz#05ab54d561bcbe3888d88b500ef62a7f41acac8c"
-  integrity sha512-MXYXCplw76xe8A9ejVaIru6Carum/2LQbVtNHsIa4h0TlafLdfulywsoMWL1F53Y9XxQSeOKyyqDKLNOgRVimw==
+"@aws-sdk/util-user-agent-node@3.848.0":
+  version "3.848.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.848.0.tgz#992acf856aa8edd9d26b906c7c92fbdcd72f8bb1"
+  integrity sha512-Zz1ft9NiLqbzNj/M0jVNxaoxI2F4tGXN0ZbZIj+KJ+PbJo+w5+Jo6d0UDAtbj3AEd79pjcCaP4OA9NTVzItUdw==
   dependencies:
-    "@aws-sdk/middleware-user-agent" "3.846.0"
+    "@aws-sdk/middleware-user-agent" "3.848.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/types" "^4.3.1"
@@ -762,12 +762,12 @@
   integrity sha512-eddz6UnOBEB1oITPinyrB2Pttej49M9FZQY8NxgEvc3tq6ZICZ19m70RsmzRdDHk80O9NoYN/25AqJl8vPVf/g==
 
 "@duosecurity/duo_universal@*":
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/@duosecurity/duo_universal/-/duo_universal-2.1.0.tgz#05312e7bf7557625145e7e243a7ece2385853dcf"
-  integrity sha512-6i+oSezndETL5nwaZbe8OVXA8GTalI0KmY4hc060iTaGpkj5/WY1OWC1W9lWDg0dWpYohsTwZy1dBQOs+vUc7g==
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/@duosecurity/duo_universal/-/duo_universal-3.0.0.tgz#c2dae2976dc00dc734bc74d995dc23219dfafe7a"
+  integrity sha512-4amiQl9b/03kkDRZAWcvrow5PQfSO4zFpU4VjU+RLXNih5B/Frvrt4q+q2gE+QpSxNPCGE3wt8/tuuv0IGnMKw==
   dependencies:
-    axios "^1.2.2"
-    jsonwebtoken "^9.0.0"
+    axios "^1.10.0"
+    jose "^6.0.11"
 
 "@fastify/busboy@^2.0.0":
   version "2.1.1"
@@ -1240,10 +1240,10 @@
     "@smithy/util-middleware" "^4.0.4"
     tslib "^2.6.2"
 
-"@smithy/core@^3.7.0":
-  version "3.7.0"
-  resolved "https://registry.yarnpkg.com/@smithy/core/-/core-3.7.0.tgz#b3a98ccc48b1c408dfdb986aaa22d6affffd7795"
-  integrity sha512-7ov8hu/4j0uPZv8b27oeOFtIBtlFmM3ibrPv/Omx1uUdoXvcpJ00U+H/OWWC/keAguLlcqwtyL2/jTlSnApgNQ==
+"@smithy/core@^3.7.0", "@smithy/core@^3.7.1":
+  version "3.7.1"
+  resolved "https://registry.yarnpkg.com/@smithy/core/-/core-3.7.1.tgz#7f47fc1ec93f20b686d007a7d667a02de8b86219"
+  integrity sha512-ExRCsHnXFtBPnM7MkfKBPcBBdHw1h/QS/cbNw4ho95qnyNHvnpmGbR39MIAv9KggTr5qSPxRSEL+hRXlyGyGQw==
   dependencies:
     "@smithy/middleware-serde" "^4.0.8"
     "@smithy/protocol-http" "^5.1.2"
@@ -1318,12 +1318,12 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@smithy/middleware-endpoint@^4.1.15":
-  version "4.1.15"
-  resolved "https://registry.yarnpkg.com/@smithy/middleware-endpoint/-/middleware-endpoint-4.1.15.tgz#31d93e6f33bbe2dbd120bda0833bce35cf960c39"
-  integrity sha512-L2M0oz+r6Wv0KZ90MgClXmWkV7G72519Hd5/+K5i3gQMu4WNQykh7ERr58WT3q60dd9NqHSMc3/bAK0FsFg3Fw==
+"@smithy/middleware-endpoint@^4.1.15", "@smithy/middleware-endpoint@^4.1.16":
+  version "4.1.16"
+  resolved "https://registry.yarnpkg.com/@smithy/middleware-endpoint/-/middleware-endpoint-4.1.16.tgz#d0fea3683659289974a87afb089e5f38575f96c0"
+  integrity sha512-plpa50PIGLqzMR2ANKAw2yOW5YKS626KYKqae3atwucbz4Ve4uQ9K9BEZxDLIFmCu7hKLcrq2zmj4a+PfmUV5w==
   dependencies:
-    "@smithy/core" "^3.7.0"
+    "@smithy/core" "^3.7.1"
     "@smithy/middleware-serde" "^4.0.8"
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/shared-ini-file-loader" "^4.0.4"
@@ -1333,14 +1333,14 @@
     tslib "^2.6.2"
 
 "@smithy/middleware-retry@^4.1.16":
-  version "4.1.16"
-  resolved "https://registry.yarnpkg.com/@smithy/middleware-retry/-/middleware-retry-4.1.16.tgz#0e044d0da18e7019052ac61ec02a2956437376fd"
-  integrity sha512-PpPhMpC6U1fLW0evKnC8gJtmobBYn0oi4RrIKGhN1a86t6XgVEK+Vb9C8dh5PPXb3YDr8lE6aYKh1hd3OikmWw==
+  version "4.1.17"
+  resolved "https://registry.yarnpkg.com/@smithy/middleware-retry/-/middleware-retry-4.1.17.tgz#5a7aa2547918422e3a8747520900c2fd26a43328"
+  integrity sha512-gsCimeG6BApj0SBecwa1Be+Z+JOJe46iy3B3m3A8jKJHf7eIihP76Is4LwLrbJ1ygoS7Vg73lfqzejmLOrazUA==
   dependencies:
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/protocol-http" "^5.1.2"
     "@smithy/service-error-classification" "^4.0.6"
-    "@smithy/smithy-client" "^4.4.7"
+    "@smithy/smithy-client" "^4.4.8"
     "@smithy/types" "^4.3.1"
     "@smithy/util-middleware" "^4.0.4"
     "@smithy/util-retry" "^4.0.6"
@@ -1447,13 +1447,13 @@
     "@smithy/util-utf8" "^4.0.0"
     tslib "^2.6.2"
 
-"@smithy/smithy-client@^4.4.7":
-  version "4.4.7"
-  resolved "https://registry.yarnpkg.com/@smithy/smithy-client/-/smithy-client-4.4.7.tgz#68e9f7785179060896ed51d52cd4f4cfc1cbffb5"
-  integrity sha512-x+MxBNOcG7rY9i5QsbdgvvRJngKKvUJrbU5R5bT66PTH3e6htSupJ4Q+kJ3E7t6q854jyl57acjpPi6qG1OY5g==
+"@smithy/smithy-client@^4.4.7", "@smithy/smithy-client@^4.4.8":
+  version "4.4.8"
+  resolved "https://registry.yarnpkg.com/@smithy/smithy-client/-/smithy-client-4.4.8.tgz#91b562a4f60db92c2533a720a091e98557117ab6"
+  integrity sha512-pcW691/lx7V54gE+dDGC26nxz8nrvnvRSCJaIYD6XLPpOInEZeKdV/SpSux+wqeQ4Ine7LJQu8uxMvobTIBK0w==
   dependencies:
-    "@smithy/core" "^3.7.0"
-    "@smithy/middleware-endpoint" "^4.1.15"
+    "@smithy/core" "^3.7.1"
+    "@smithy/middleware-endpoint" "^4.1.16"
     "@smithy/middleware-stack" "^4.0.4"
     "@smithy/protocol-http" "^5.1.2"
     "@smithy/types" "^4.3.1"
@@ -1523,26 +1523,26 @@
     tslib "^2.6.2"
 
 "@smithy/util-defaults-mode-browser@^4.0.23":
-  version "4.0.23"
-  resolved "https://registry.yarnpkg.com/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.0.23.tgz#74887922f87da4f4acbf523b5c0271f11af5997d"
-  integrity sha512-NqRi6VvEIwpJ+KSdqI85+HH46H7uVoNqVTs2QO7p1YKnS7k8VZnunJj8R5KdmmVnTojkaL1OMPyZC8uR5F7fSg==
+  version "4.0.24"
+  resolved "https://registry.yarnpkg.com/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.0.24.tgz#36e2ebd191cffa4799c2474d1d4e793264067fa9"
+  integrity sha512-UkQNgaQ+bidw1MgdgPO1z1k95W/v8Ej/5o/T/Is8PiVUYPspl/ZxV6WO/8DrzZQu5ULnmpB9CDdMSRwgRc21AA==
   dependencies:
     "@smithy/property-provider" "^4.0.4"
-    "@smithy/smithy-client" "^4.4.7"
+    "@smithy/smithy-client" "^4.4.8"
     "@smithy/types" "^4.3.1"
     bowser "^2.11.0"
     tslib "^2.6.2"
 
 "@smithy/util-defaults-mode-node@^4.0.23":
-  version "4.0.23"
-  resolved "https://registry.yarnpkg.com/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.0.23.tgz#dd22609289183fe3d722f9a1601b6cc618f9efa7"
-  integrity sha512-NE9NtEVigFa+HHJ5bBeQT7KF3KiltW880CLN9TnWWL55akeou3ziRAHO22QSUPgPZ/nqMfPXi/LGMQ6xQvXPNQ==
+  version "4.0.24"
+  resolved "https://registry.yarnpkg.com/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.0.24.tgz#3b9382bbffcc5c211e582ea6164c630ad994816f"
+  integrity sha512-phvGi/15Z4MpuQibTLOYIumvLdXb+XIJu8TA55voGgboln85jytA3wiD7CkUE8SNcWqkkb+uptZKPiuFouX/7g==
   dependencies:
     "@smithy/config-resolver" "^4.1.4"
     "@smithy/credential-provider-imds" "^4.0.6"
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/property-provider" "^4.0.4"
-    "@smithy/smithy-client" "^4.4.7"
+    "@smithy/smithy-client" "^4.4.8"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
@@ -1712,9 +1712,9 @@
   integrity sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==
 
 "@types/node@*", "@types/node@>=13.7.0":
-  version "24.0.14"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-24.0.14.tgz#6e3d4fb6d858c48c69707394e1a0e08ce1ecc1bc"
-  integrity sha512-4zXMWD91vBLGRtHK3YbIoFMia+1nqEz72coM42C5ETjnNCa/heoj7NT1G67iAfOqMmcfhuCZ4uNpyz8EjlAejw==
+  version "24.1.0"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-24.1.0.tgz#0993f7dc31ab5cc402d112315b463e383d68a49c"
+  integrity sha512-ut5FthK5moxFKH2T1CUOC6ctR67rQRvvHdFLCD2Ql6KXmMuCrjsSsRI9UsLCm9M18BMwClv4pn327UvB7eeO1w==
   dependencies:
     undici-types "~7.8.0"
 
@@ -1724,9 +1724,9 @@
   integrity sha512-fAtCfv4jJg+ExtXhvCkCqUKZ+4ok/JQk01qDKhL5BDDoS3AxKXhV5/MAVUZyQnSEd2GT92fkgZl0pz0Q0AzcIQ==
 
 "@types/node@^22.0.1", "@types/node@^22.5.4":
-  version "22.16.4"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-22.16.4.tgz#00c763ad4d4e45f62d5a270c040ae1a799c7e38a"
-  integrity sha512-PYRhNtZdm2wH/NT2k/oAJ6/f2VD2N2Dag0lGlx2vWgMSJXGNmlce5MiTQzoWAiIJtso30mjnfQCOKVH+kAQC/g==
+  version "22.16.5"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-22.16.5.tgz#cc46ac3994cd957000d0c11095a0b1dae2ea2368"
+  integrity sha512-bJFoMATwIGaxxx8VJPeM8TonI8t579oRvgAuT8zFugJsJZgzqv0Fu8Mhp68iecjzG7cnN3mO2dJQ5uUM2EFrgQ==
   dependencies:
     undici-types "~6.21.0"
 
@@ -2443,13 +2443,13 @@ axios@^0.21.1:
   dependencies:
     follow-redirects "^1.14.0"
 
-axios@^1.2.2, axios@^1.8.2:
-  version "1.10.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.10.0.tgz#af320aee8632eaf2a400b6a1979fa75856f38d54"
-  integrity sha512-/1xYAC4MP/HEG+3duIhFr4ZQXR4sQXOIe+o6sdqzeykGLx6Upp/1p8MHqhINOvGeP7xyNHe7tsiJByc4SSVUxw==
+axios@^1.10.0, axios@^1.8.2:
+  version "1.11.0"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.11.0.tgz#c2ec219e35e414c025b2095e8b8280278478fdb6"
+  integrity sha512-1Lx3WLFQWm3ooKDYZD1eXmoGO9fxYQjrycfHFC8P0sCfQVXyROp0p9PFWBehewBOdCwHc+f/b8I0fMto5eSfwA==
   dependencies:
     follow-redirects "^1.15.6"
-    form-data "^4.0.0"
+    form-data "^4.0.4"
     proxy-from-env "^1.1.0"
 
 b4a@^1.6.4:
@@ -3053,16 +3053,16 @@ compressible@~2.0.18:
   dependencies:
     mime-db ">= 1.43.0 < 2"
 
-compression@1.7.5:
-  version "1.7.5"
-  resolved "https://registry.yarnpkg.com/compression/-/compression-1.7.5.tgz#fdd256c0a642e39e314c478f6c2cd654edd74c93"
-  integrity sha512-bQJ0YRck5ak3LgtnpKkiabX5pNF7tMUh1BSy2ZBOTh0Dim0BUu6aPPwByIns6/A5Prh8PufSPerMDUklpzes2Q==
+compression@1.8.1:
+  version "1.8.1"
+  resolved "https://registry.yarnpkg.com/compression/-/compression-1.8.1.tgz#4a45d909ac16509195a9a28bd91094889c180d79"
+  integrity sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==
   dependencies:
     bytes "3.1.2"
     compressible "~2.0.18"
     debug "2.6.9"
     negotiator "~0.6.4"
-    on-headers "~1.0.2"
+    on-headers "~1.1.0"
     safe-buffer "5.2.1"
     vary "~1.1.2"
 
@@ -3108,14 +3108,14 @@ cookie-jar@~0.3.0:
   resolved "https://registry.yarnpkg.com/cookie-jar/-/cookie-jar-0.3.0.tgz#bc9a27d4e2b97e186cd57c9e2063cb99fa68cccc"
   integrity sha512-dX1400pzPULr+ZovkIsDEqe7XH8xCAYGT5Dege4Eot44Qs2mS2iJmnh45TxTO5MIsCfrV/JGZVloLhm46AHxNw==
 
-cookie-session@2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/cookie-session/-/cookie-session-2.1.0.tgz#ae30b566b2f9f2d8ca2c4936513e6bf181830558"
-  integrity sha512-u73BDmR8QLGcs+Lprs0cfbcAPKl2HnPcjpwRXT41sEV4DRJ2+W0vJEEZkG31ofkx+HZflA70siRIjiTdIodmOQ==
+cookie-session@2.1.1:
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/cookie-session/-/cookie-session-2.1.1.tgz#3e0bdd4a8386467a1d7cca5249690a0ebfb27842"
+  integrity sha512-ji3kym/XZaFVew1+tIZk5ZLp9Z/fLv9rK1aZmpug0FsgE7Cu3ZDrUdRo7FT9vFjMYfNimrrUHJzywDwT7XEFlg==
   dependencies:
     cookies "0.9.1"
     debug "3.2.7"
-    on-headers "~1.0.2"
+    on-headers "~1.1.0"
     safe-buffer "5.2.1"
 
 cookie-signature@1.0.6:
@@ -3559,9 +3559,9 @@ ee-first@1.1.1:
   integrity sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==
 
 electron-to-chromium@^1.5.173:
-  version "1.5.185"
-  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.185.tgz#b4f9189c4ef652ddf9f1bb37529e2b79f865e912"
-  integrity sha512-dYOZfUk57hSMPePoIQ1fZWl1Fkj+OshhEVuPacNKWzC1efe56OsHY3l/jCfiAgIICOU3VgOIdoq7ahg7r7n6MQ==
+  version "1.5.190"
+  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.190.tgz#f0ac8be182291a45e8154dbb12f18d2b2318e4ac"
+  integrity sha512-k4McmnB2091YIsdCgkS0fMVMPOJgxl93ltFzaryXqwip1AaxeDqKCGLxkXODDA5Ab/D+tV5EL5+aTx76RvLRxw==
 
 emoji-regex@^7.0.1:
   version "7.0.3"
@@ -4124,20 +4124,21 @@ forever-agent@~0.6.1:
   integrity sha512-j0KLYPhm6zeac4lz3oJ3o65qvgQCcPubiyotZrXqEaG4hNagNYO8qdlUrX5vwqv9ohqeT/Z3j6+yW067yWWdUw==
 
 form-data@^2.5.0:
-  version "2.5.3"
-  resolved "https://registry.yarnpkg.com/form-data/-/form-data-2.5.3.tgz#f9bcf87418ce748513c0c3494bb48ec270c97acc"
-  integrity sha512-XHIrMD0NpDrNM/Ckf7XJiBbLl57KEhT3+i3yY+eWm+cqYZJQTZrKo8Y8AWKnuV5GT4scfuUGt9LzNoIx3dU1nQ==
+  version "2.5.5"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-2.5.5.tgz#a5f6364ad7e4e67e95b4a07e2d8c6f711c74f624"
+  integrity sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==
   dependencies:
     asynckit "^0.4.0"
     combined-stream "^1.0.8"
     es-set-tostringtag "^2.1.0"
+    hasown "^2.0.2"
     mime-types "^2.1.35"
     safe-buffer "^5.2.1"
 
-form-data@^4.0.0:
-  version "4.0.3"
-  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.3.tgz#608b1b3f3e28be0fccf5901fc85fb3641e5cf0ae"
-  integrity sha512-qsITQPfmvMOSAdeyZ+12I1c+CKSstAFAwu+97zrnWAbIr5u8wfsExUzCesVLC8NgHuRUqNN4Zy6UPWUTRGslcA==
+form-data@^4.0.0, form-data@^4.0.4:
+  version "4.0.4"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.4.tgz#784cdcce0669a9d68e94d11ac4eea98088edd2c4"
+  integrity sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==
   dependencies:
     asynckit "^0.4.0"
     combined-stream "^1.0.8"
@@ -5257,6 +5258,11 @@ jose@^4.15.4, jose@^4.15.9:
   resolved "https://registry.yarnpkg.com/jose/-/jose-4.15.9.tgz#9b68eda29e9a0614c042fa29387196c7dd800100"
   integrity sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==
 
+jose@^6.0.11:
+  version "6.0.12"
+  resolved "https://registry.yarnpkg.com/jose/-/jose-6.0.12.tgz#56253d94d46bd784addc4bde3691c323552fe7e4"
+  integrity sha512-T8xypXs8CpmiIi78k0E+Lk7T2zlK4zDyg+o1CZ4AkOHgDg98ogdP2BeZ61lTFKFyoEwJ9RgAgN+SdM3iPgNonQ==
+
 js-tokens@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"
@@ -6408,10 +6414,10 @@ on-finished@2.4.1:
   dependencies:
     ee-first "1.1.1"
 
-on-headers@~1.0.2:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.0.2.tgz#772b0ae6aaa525c399e489adfad90c403eb3c28f"
-  integrity sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA==
+on-headers@~1.1.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/on-headers/-/on-headers-1.1.0.tgz#59da4f91c45f5f989c6e4bcedc5a3b0aed70ff65"
+  integrity sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==
 
 once@^1.3.0, once@^1.3.1, once@^1.4.0:
   version "1.4.0"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c95c989ffdae..9d278d980217 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -766,7 +766,7 @@ mapAliases {
   gcj6 = throw "gcj6 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   gcolor2 = throw "'gcolor2' has been removed due to lack of maintenance upstream and depending on gtk2. Consider using 'gcolor3' or 'eyedropper' instead"; # Added 2024-09-15
   gdome2 = throw "'gdome2' has been removed from nixpkgs, as it is umaintained and obsolete"; # Added 2024-12-29
-  geocode-glib = "throw 'geocode-glib' has been removed, as it was unused and used outdated libraries"; # Added 2025-04-16
+  geocode-glib = throw "throw 'geocode-glib' has been removed, as it was unused and used outdated libraries"; # Added 2025-04-16
   geos_3_11 = throw "geos_3_11 has been removed from nixpgks. Please use a more recent 'geos' instead.";
   gfbgraph = throw "'gfbgraph' has been removed as it was archived upstream and unused in nixpkgs"; # Added 2025-04-20
   gfortran48 = throw "'gfortran48' has been removed from nixpkgs"; # Added 2024-09-10
@@ -893,7 +893,7 @@ mapAliases {
   gsignond = throw "'gsignond' and its plugins have been removed due to lack of maintenance upstream"; # added 2025-04-17
   gsignondPlugins = throw "'gsignondPlugins' have been removed alongside 'gsignond' due to lack of maintenance upstream and depending on libsoup_2"; # added 2025-04-17
   gtetrinet = throw "'gtetrinet' has been removed because it depends on GNOME 2 libraries"; # Added 2024-06-27
-  gtk-engine-bluecurve = "'gtk-engine-bluecurve' has been removed as it has been archived upstream."; # Added 2024-12-04
+  gtk-engine-bluecurve = throw "'gtk-engine-bluecurve' has been removed as it has been archived upstream."; # Added 2024-12-04
   gtk2fontsel = throw "'gtk2fontsel' has been removed due to lack of maintenance upstream. GTK now has a built-in font chooser so it's no longer needed for newer apps"; # Added 2024-10-19
   gtkcord4 = dissent; # Added 2024-03-10
   gtkextra = throw "'gtkextra' has been removed due to lack of maintenance upstream."; # Added 2025-06-10
@@ -1810,7 +1810,7 @@ mapAliases {
   schildichat-desktop = schildichat-web;
   schildichat-desktop-wayland = schildichat-web;
   scitoken-cpp = scitokens-cpp; # Added 2024-02-12
-  scry = "'scry' has been removed as it was archived upstream. Use 'crystalline' instead"; # Added 2025-02-12
+  scry = throw "'scry' has been removed as it was archived upstream. Use 'crystalline' instead"; # Added 2025-02-12
   semeru-bin-16 = throw "Semeru 16 has been removed as it has reached its end of life"; # Added 2024-08-01
   semeru-jre-bin-16 = throw "Semeru 16 has been removed as it has reached its end of life"; # Added 2024-08-01
   sensu = throw "sensu has been removed as the upstream project is deprecated. Consider using `sensu-go`"; # Added 2024-10-28
@@ -1996,9 +1996,9 @@ mapAliases {
   timelens = throw "'timelens' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   tix = tclPackages.tix; # Added 2024-10-02
   tkcvs = tkrev; # Added 2022-03-07
-  tkgate = "'tkgate' has been removed as it is unmaintained"; # Added 2025-05-17
+  tkgate = throw "'tkgate' has been removed as it is unmaintained"; # Added 2025-05-17
   tkimg = tclPackages.tkimg; # Added 2024-10-02
-  todiff = "'todiff' was removed due to lack of known users"; # Added 2025-01-25
+  todiff = throw "'todiff' was removed due to lack of known users"; # Added 2025-01-25
   toil = throw "toil was removed as it was broken and requires obsolete versions of libraries"; # Added 2024-09-22
   tokodon = plasma5Packages.tokodon;
   tokyo-night-gtk = tokyonight-gtk-theme; # Added 2024-01-28
@@ -2049,7 +2049,7 @@ mapAliases {
   ubootBeagleboneBlack = throw "'ubootBeagleboneBlack' has been renamed to/replaced by 'ubootAmx335xEVM'"; # Converted to throw 2024-10-17
   ubuntu_font_family = ubuntu-classic; # Added 2024-02-19
   uclibc = uclibc-ng; # Added 2022-06-16
-  unicap = "'unicap' has been removed because it is unmaintained"; # Added 2025-05-17
+  unicap = throw "'unicap' has been removed because it is unmaintained"; # Added 2025-05-17
   unicorn-emu = throw "'unicorn-emu' has been renamed to/replaced by 'unicorn'"; # Converted to throw 2024-10-17
   uniffi-bindgen = throw "uniffi-bindgen has been removed since upstream no longer provides a standalone package for the CLI";
   unifi-poller = unpoller; # Added 2022-11-24
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fcf38107ed8b..c4708986aadd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12524,8 +12524,6 @@ with pkgs;
 
   hpmyroom = libsForQt5.callPackage ../applications/networking/hpmyroom { };
 
-  hue-cli = callPackage ../tools/networking/hue-cli { };
-
   hugin = callPackage ../applications/graphics/hugin {
     wxGTK = wxGTK32;
   };
@@ -13337,8 +13335,6 @@ with pkgs;
     inherit (darwin) DarwinTools;
   };
 
-  openimageio_2 = callPackage ../by-name/op/openimageio/2.nix { };
-
   open-music-kontrollers = lib.recurseIntoAttrs {
     eteroj = callPackage ../applications/audio/open-music-kontrollers/eteroj.nix { };
     jit = callPackage ../applications/audio/open-music-kontrollers/jit.nix { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 28aa7a7dddb1..2c6e5180a9ce 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -14784,6 +14784,8 @@ self: super: with self; {
 
   python-trovo = callPackage ../development/python-modules/python-trovo { };
 
+  python-tsp = callPackage ../development/python-modules/python-tsp { };
+
   python-twitch-client = callPackage ../development/python-modules/python-twitch-client { };
 
   python-twitter = callPackage ../development/python-modules/python-twitter { };