diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 26d71b846369..2062ccd7c14a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -98,7 +98,7 @@ jobs:
         if: |
           contains(matrix.builds, 'manual-nixos') && !cancelled() &&
           contains(fromJSON(inputs.baseBranch).type, 'primary')
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: nixos-manual-${{ matrix.name }}
           path: nixos-manual
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 97d5c114acb0..d6e6ca7a05ba 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -143,7 +143,7 @@ jobs:
 
       - name: Upload outpaths diff and stats
         if: inputs.targetSha
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: ${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
           path: diff/*
@@ -167,7 +167,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Download output paths and eval stats for all systems
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           pattern: diff-*
           path: diff
@@ -200,7 +200,7 @@ jobs:
           cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload the comparison results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: comparison
           path: comparison/*
@@ -242,7 +242,7 @@ jobs:
     needs: [versions, eval]
     steps:
       - name: Download output paths and eval stats for all versions
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           pattern: "*-diff-*"
           path: versions
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 22ac1bb5bcd4..6d23e1dde9b7 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -124,7 +124,7 @@ jobs:
         run: gh api /rate_limit | jq
 
       - name: Download the comparison results
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           run-id: ${{ steps.eval.outputs.run-id }}
           github-token: ${{ github.token }}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 22b41192bc54..035e424d02ad 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -27803,6 +27803,12 @@
     githubId = 43357387;
     keys = [ { fingerprint = "F844 80B2 0CA9 D6CC C7F5  2479 A776 D2AD 099E 8BC0"; } ];
   };
+  wetisobe = {
+    name = "Martin Woods";
+    github = "wetisobe";
+    email = "weti.sobe@pen-net.de";
+    githubId = 172606048;
+  };
   wetrustinprize = {
     email = "git@wetrustinprize.com";
     github = "wetrustinprize";
diff --git a/nixos/modules/config/i18n.nix b/nixos/modules/config/i18n.nix
index 1e6c35a4ea31..196160ee481a 100644
--- a/nixos/modules/config/i18n.nix
+++ b/nixos/modules/config/i18n.nix
@@ -12,7 +12,7 @@ let
   ]
   ++ lib.pipe config.i18n.extraLocaleSettings [
     # See description of extraLocaleSettings for why is this ignored here.
-    (lib.filterAttrs (n: v: n != "LANGUAGE"))
+    (x: lib.removeAttrs x [ "LANGUAGE" ])
     (lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
     (lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
   ]
@@ -30,12 +30,12 @@ in
       glibcLocales = lib.mkOption {
         type = lib.types.path;
         default = pkgs.glibcLocales.override {
-          allLocales = lib.any (x: x == "all") config.i18n.supportedLocales;
+          allLocales = lib.elem "all" config.i18n.supportedLocales;
           locales = config.i18n.supportedLocales;
         };
         defaultText = lib.literalExpression ''
           pkgs.glibcLocales.override {
-            allLocales = lib.any (x: x == "all") config.i18n.supportedLocales;
+            allLocales = lib.elem "all" config.i18n.supportedLocales;
             locales = config.i18n.supportedLocales;
           }
         '';
@@ -149,7 +149,7 @@ in
         (
           !(
             (lib.subtractLists config.i18n.supportedLocales aggregatedLocales) == [ ]
-            || lib.any (x: x == "all") config.i18n.supportedLocales
+            || lib.elem "all" config.i18n.supportedLocales
           )
         )
         ''
diff --git a/nixos/modules/hardware/facter/default.nix b/nixos/modules/hardware/facter/default.nix
index 324471b16e70..f2719b55b8ce 100644
--- a/nixos/modules/hardware/facter/default.nix
+++ b/nixos/modules/hardware/facter/default.nix
@@ -7,6 +7,7 @@
   imports = [
     ./disk.nix
     ./keyboard.nix
+    ./networking
     ./system.nix
   ];
 
diff --git a/nixos/modules/hardware/facter/networking/default.nix b/nixos/modules/hardware/facter/networking/default.nix
new file mode 100644
index 000000000000..dfbc54c8396d
--- /dev/null
+++ b/nixos/modules/hardware/facter/networking/default.nix
@@ -0,0 +1,69 @@
+{ config, lib, ... }:
+let
+  # Filter network interfaces from facter report to only those suitable for DHCP
+  physicalInterfaces = lib.filter (
+    iface:
+    # Only include network interfaces suitable for DHCP:
+    # - Ethernet (most common)
+    # - WLAN (WiFi)
+    # - USB-Link (USB network adapters, tethering)
+    # - Network Interface (generic/unknown type)
+    # This implicitly excludes: Loopback, mainframe-specific interfaces (CTC, IUCV, HSI, ESCON)
+    # See: https://github.com/numtide/hwinfo/blob/ea251a74b88dcd53aebdd381194ab43d10fbbd79/src/ids/src/class#L817-L874
+    let
+      validTypes = [
+        "Ethernet"
+        "WLAN"
+        "USB-Link"
+        "Network Interface"
+      ];
+    in
+    lib.elem (iface.sub_class.name or "") validTypes
+  ) (config.hardware.facter.report.hardware.network_interface or [ ]);
+
+  # Extract interface names from unix_device_names
+  detectedInterfaceNames = lib.concatMap (iface: iface.unix_device_names or [ ]) physicalInterfaces;
+
+  # Get the interface names from the configuration (which defaults to detectedInterfaceNames)
+  interfaceNames = config.hardware.facter.detected.dhcp.interfaces;
+
+  # Generate per-interface DHCP config
+  perInterfaceConfig = lib.listToAttrs (
+    lib.map (name: {
+      inherit name;
+      value = {
+        useDHCP = lib.mkDefault true;
+      };
+    }) interfaceNames
+  );
+in
+{
+  imports = [
+    ./initrd.nix
+    ./intel.nix
+  ];
+
+  options.hardware.facter.detected.dhcp = {
+    enable = lib.mkEnableOption "Facter dhcp module" // {
+      default = builtins.length config.hardware.facter.report.hardware.network_interface or [ ] > 0;
+      defaultText = "hardware dependent";
+    };
+
+    interfaces = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = detectedInterfaceNames;
+      defaultText = lib.literalExpression "automatically detected from facter report";
+      description = "List of network interface names to configure with DHCP. Defaults to auto-detected physical interfaces.";
+      example = [
+        "eth0"
+        "wlan0"
+      ];
+    };
+  };
+  config = lib.mkIf config.hardware.facter.detected.dhcp.enable {
+    networking.useDHCP = lib.mkDefault true;
+
+    # Per-interface DHCP configuration
+    networking.interfaces = perInterfaceConfig;
+  };
+}
diff --git a/nixos/modules/hardware/facter/networking/initrd.nix b/nixos/modules/hardware/facter/networking/initrd.nix
new file mode 100644
index 000000000000..56be802b7cd9
--- /dev/null
+++ b/nixos/modules/hardware/facter/networking/initrd.nix
@@ -0,0 +1,20 @@
+{ lib, config, ... }:
+let
+  facterLib = import ../lib.nix lib;
+
+  inherit (config.hardware.facter) report;
+in
+{
+  options.hardware.facter.detected.boot.initrd.networking.kernelModules = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = lib.uniqueStrings (facterLib.collectDrivers (report.hardware.network_controller or [ ]));
+    defaultText = "hardware dependent";
+    description = ''
+      List of kernel modules to include in the initrd to support networking.
+    '';
+  };
+
+  config = lib.mkIf config.boot.initrd.network.enable {
+    boot.initrd.kernelModules = config.hardware.facter.detected.boot.initrd.networking.kernelModules;
+  };
+}
diff --git a/nixos/modules/hardware/facter/networking/intel.nix b/nixos/modules/hardware/facter/networking/intel.nix
new file mode 100644
index 000000000000..4ae693a3c636
--- /dev/null
+++ b/nixos/modules/hardware/facter/networking/intel.nix
@@ -0,0 +1,57 @@
+{ lib, config, ... }:
+let
+  inherit (config.hardware.facter) report;
+  cfg = config.hardware.facter.detected.networking.intel;
+in
+{
+  options.hardware.facter.detected.networking.intel = with lib; {
+    _2200BG.enable = mkEnableOption "the Facter Intel 2200BG module" // {
+
+      default = lib.any (
+        {
+          vendor ? { },
+          device ? { },
+          ...
+        }:
+        # vendor (0x8086) Intel Corp.
+        (vendor.value or 0) == 32902
+        && (lib.elem (device.value or 0) [
+          4163 # 0x1043
+          4175 # 0x104f
+          16928 # 0x4220
+          16929 # 0x4221
+          16931 # 0x4223
+          16932 # 0x4224
+        ])
+      ) (report.hardware.network_controller or [ ]);
+
+      defaultText = "hardware dependent";
+    };
+    _3945ABG.enable = mkEnableOption "the Facter Intel 3945ABG module" // {
+
+      default = lib.any (
+        {
+          vendor ? { },
+          device ? { },
+          ...
+        }:
+        # vendor (0x8086) Intel Corp.
+        (vendor.value or 0) == 32902
+        && (lib.elem (device.value or 0) [
+          16937 # 0x4229
+          16938 # 0x4230
+          16930 # 0x4222
+          16935 # 0x4227
+        ])
+      ) (report.hardware.network_controller or [ ]);
+
+      defaultText = "hardware dependent";
+    };
+  };
+
+  config = {
+    networking.enableIntel2200BGFirmware = lib.mkIf cfg._2200BG.enable (lib.mkDefault true);
+    hardware.enableRedistributableFirmware = lib.mkIf cfg._3945ABG.enable (lib.mkDefault true);
+  };
+
+}
diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index 1f276590f9c2..8f892b96438b 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -223,7 +223,7 @@ in
             }
             repartConfig = {
               Type = "esp";
-              Format = "fat";
+              Format = "vfat";
             };
           };
           "20-root" = {
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5ce80a8a3f17..71159d209134 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -240,7 +240,6 @@
   ./programs/iay.nix
   ./programs/iftop.nix
   ./programs/iio-hyprland.nix
-  ./programs/iio-niri.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
   ./programs/java.nix
@@ -857,6 +856,7 @@
   ./services/misc/heisenbridge.nix
   ./services/misc/homepage-dashboard.nix
   ./services/misc/ihaskell.nix
+  ./services/misc/iio-niri.nix
   ./services/misc/input-remapper.nix
   ./services/misc/invidious-router.nix
   ./services/misc/irkerd.nix
diff --git a/nixos/modules/services/audio/mpdscribble.nix b/nixos/modules/services/audio/mpdscribble.nix
index 967853ffc85c..39dab7105968 100644
--- a/nixos/modules/services/audio/mpdscribble.nix
+++ b/nixos/modules/services/audio/mpdscribble.nix
@@ -130,7 +130,7 @@ in
     passwordFile = lib.mkOption {
       default =
         if localMpd then
-          (lib.findFirst (c: lib.any (x: x == "read") c.permissions) {
+          (lib.findFirst (c: lib.elem "read" c.permissions) {
             passwordFile = null;
           } mpdCfg.credentials).passwordFile
         else
diff --git a/nixos/modules/services/hardware/thinkfan.nix b/nixos/modules/services/hardware/thinkfan.nix
index d5d1f23f1d98..daf865252653 100644
--- a/nixos/modules/services/hardware/thinkfan.nix
+++ b/nixos/modules/services/hardware/thinkfan.nix
@@ -101,14 +101,12 @@ let
   # removes NixOS special and unused attributes
   sensorToConf =
     { type, query, ... }@args:
-    (lib.filterAttrs (
-      k: v:
-      v != null
-      && !(lib.elem k [
+    (lib.filterAttrs (k: v: v != null) (
+      lib.removeAttrs args [
         "type"
         "query"
-      ])
-    ) args)
+      ]
+    ))
     // {
       "${type}" = query;
     };
diff --git a/nixos/modules/services/mail/public-inbox.nix b/nixos/modules/services/mail/public-inbox.nix
index 0933d2dd535d..353db2e2207c 100644
--- a/nixos/modules/services/mail/public-inbox.nix
+++ b/nixos/modules/services/mail/public-inbox.nix
@@ -403,7 +403,7 @@ in
       }
     ];
     services.public-inbox.settings = filterAttrsRecursive (n: v: v != null) {
-      publicinbox = mapAttrs (n: filterAttrs (n: v: n != "description")) cfg.inboxes;
+      publicinbox = mapAttrs (n: v: removeAttrs v [ "description" ]) cfg.inboxes;
     };
     users = {
       users.public-inbox = {
diff --git a/nixos/modules/programs/iio-niri.nix b/nixos/modules/services/misc/iio-niri.nix
similarity index 100%
rename from nixos/modules/programs/iio-niri.nix
rename to nixos/modules/services/misc/iio-niri.nix
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index 9aad9e21fa6e..46da20bec8ad 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -126,7 +126,7 @@ let
       '';
 
   # Get a submodule without any embedded metadata:
-  _filter = x: filterAttrs (k: v: k != "_module") x;
+  _filter = x: removeAttrs x [ "_module" ];
 
   # https://grafana.com/docs/grafana/latest/administration/provisioning/#datasources
   grafanaTypes.datasourceConfig = types.submodule {
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/mail.nix b/nixos/modules/services/monitoring/prometheus/exporters/mail.nix
index 7dc40293d464..61ca738fdd31 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/mail.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/mail.nix
@@ -15,6 +15,7 @@ let
     nameValuePair
     toLower
     filterAttrs
+    removeAttrs
     escapeShellArg
     literalExpression
     mkIf
@@ -41,7 +42,7 @@ let
           )
         else
           nameValuePair (toLower name) value
-      ) (filterAttrs (n: _: !(n == "_module")) cfg.configuration)
+      ) (removeAttrs cfg.configuration [ "_module" ])
     )
   );
 
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/node.nix b/nixos/modules/services/monitoring/prometheus/exporters/node.nix
index c543ac9a206e..2c4a82f0e044 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/node.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/node.nix
@@ -13,11 +13,11 @@ let
     types
     concatStringsSep
     concatMapStringsSep
-    any
+    elem
     optionals
     ;
-  collectorIsEnabled = final: any (collector: (final == collector)) cfg.enabledCollectors;
-  collectorIsDisabled = final: any (collector: (final == collector)) cfg.disabledCollectors;
+  collectorIsEnabled = final: elem final cfg.enabledCollectors;
+  collectorIsDisabled = final: elem final cfg.disabledCollectors;
 in
 {
   port = 9100;
diff --git a/nixos/modules/services/networking/anubis.md b/nixos/modules/services/networking/anubis.md
index 533ece7bfbd3..af5d3cf997bc 100644
--- a/nixos/modules/services/networking/anubis.md
+++ b/nixos/modules/services/networking/anubis.md
@@ -8,6 +8,34 @@ between a reverse proxy and the service to be protected.
 This module is designed to use Unix domain sockets as the socket paths can be automatically configured for multiple
 instances, but TCP sockets are also supported.
 
+Configuring multiple instances may look like the following.
+
+Notes:
+
+- Each instance as its runtime directory set to `anubis/anubis-<instance name>`.
+- When a single instance is declared with unix sockets, the runtime directory `anubis` is allowed for backward
+  compatibility.
+
+```nix
+{
+  services.anubis.instances."instance-1" = {
+    # Runtime directory: "anubis/anubis-instance-1".
+    settings = {
+      BIND = "/run/anubis/anubis-instance-1/anubis.sock";
+      TARGET = "http://localhost:8001";
+    };
+  };
+
+  services.anubis.instances."instance-2" = {
+    # Runtime directory: "anubis/anubis-instance-2".
+    settings = {
+      BIND = "/run/anubis/anubis-instance-2/anubis.sock";
+      TARGET = "http://localhost:8002";
+    };
+  };
+}
+```
+
 A minimal configuration with [nginx](#opt-services.nginx.enable) may look like the following:
 
 ```nix
diff --git a/nixos/modules/services/networking/anubis.nix b/nixos/modules/services/networking/anubis.nix
index 968595d303d1..cb1ca0ee293e 100644
--- a/nixos/modules/services/networking/anubis.nix
+++ b/nixos/modules/services/networking/anubis.nix
@@ -12,6 +12,28 @@ let
   enabledInstances = lib.filterAttrs (_: conf: conf.enable) cfg.instances;
   instanceName = name: if name == "" then "anubis" else "anubis-${name}";
 
+  unixAddr = network: addr: lib.strings.optionalString (network == "unix") addr;
+  unixSocketAddrs =
+    settings:
+    lib.filter (x: x != "") [
+      (unixAddr settings.BIND_NETWORK settings.BIND)
+      (unixAddr settings.METRICS_BIND_NETWORK settings.METRICS_BIND)
+    ];
+
+  runtimeDirectoryPrefix = name: "/run/anubis/${instanceName name}/";
+  instanceUsesUnixSockets = instance: lib.length (unixSocketAddrs instance.settings) > 0;
+  instanceUsesDedicatedRuntimeDirectory =
+    name: instance:
+    lib.any (lib.hasPrefix (runtimeDirectoryPrefix name)) (unixSocketAddrs instance.settings);
+  useDedicatedRuntimeDirectory =
+    # Set when:
+    # - Multiple instances are configured to use unix sockets.
+    # - At least one instance uses the new runtime directory prefix: /run/anubis/anubis-<instance name>.
+    lib.count instanceUsesUnixSockets (lib.attrValues enabledInstances) > 1
+    || lib.any (attrs: instanceUsesDedicatedRuntimeDirectory attrs.name attrs.value) (
+      lib.attrsToList enabledInstances
+    );
+
   commonSubmodule =
     isDefault:
     let
@@ -185,6 +207,7 @@ let
         default = "/run/anubis/${instanceName name}.sock";
         description = ''
           The address that Anubis listens to. See Go's [`net.Listen`](https://pkg.go.dev/net#Listen) for syntax.
+          Use the prefix ${runtimeDirectoryPrefix "<instance name>"} when configuring multiple instances.
 
           Defaults to Unix domain sockets. To use TCP sockets, set this to a TCP address and `BIND_NETWORK` to `"tcp"`.
         '';
@@ -196,6 +219,7 @@ let
         description = ''
           The address Anubis' metrics server listens to. See Go's [`net.Listen`](https://pkg.go.dev/net#Listen) for
           syntax.
+          Use the prefix ${runtimeDirectoryPrefix "<instance name>"} when configuring multiple instances.
 
           The metrics server is enabled by default and may be disabled. However, due to implementation details, this is
           only possible by setting a command line flag. See {option}`services.anubis.defaultOptions.extraFlags` for an
@@ -245,6 +269,25 @@ in
   };
 
   config = lib.mkIf (enabledInstances != { }) {
+    warnings = [
+      "RuntimeDirectory is going to be migrated from `anubis` to `anubis/anubis-<instance name>`, update BIND and METRICS_BIND to ${runtimeDirectoryPrefix "<instance name>"} if using unix sockets"
+    ];
+
+    assertions =
+      let
+        validInstanceUnixSocketAddrs =
+          { name, value }:
+          lib.all (lib.hasPrefix (runtimeDirectoryPrefix name)) (unixSocketAddrs value.settings);
+      in
+      [
+        {
+          assertion =
+            !useDedicatedRuntimeDirectory
+            || lib.all validInstanceUnixSocketAddrs (lib.attrsToList enabledInstances);
+          message = "use the prefix ${runtimeDirectoryPrefix "<instance name>"} in BIND and METRICS_BIND when configuring multiple instances";
+        }
+      ];
+
     users.users = lib.mkIf (cfg.defaultOptions.user == "anubis") {
       anubis = {
         isSystemUser = true;
@@ -288,19 +331,14 @@ in
             (lib.singleton (lib.getExe cfg.package)) ++ instance.extraFlags
           );
           RuntimeDirectory =
-            if
-              lib.any (lib.hasPrefix "/run/anubis") (
-                with instance.settings;
-                [
-                  BIND
-                  METRICS_BIND
-                ]
-              )
-            then
+            if useDedicatedRuntimeDirectory then
+              "anubis/${instanceName name}"
+            else if instanceUsesUnixSockets instance then
+              # `dedicatedRuntimeDirectory = false`: /run/anubis may still be used.
+              # Warning: `anubis` will be deprecated eventually.
               "anubis"
             else
               null;
-
           # hardening
           NoNewPrivileges = true;
           CapabilityBoundingSet = null;
diff --git a/nixos/modules/services/networking/ifstate.nix b/nixos/modules/services/networking/ifstate.nix
index ddd95d33d131..41997a039ec0 100644
--- a/nixos/modules/services/networking/ifstate.nix
+++ b/nixos/modules/services/networking/ifstate.nix
@@ -198,7 +198,7 @@ in
         {
           assertion =
             initrdCfg.package.passthru.features.withWireguard
-            || !(builtins.any (kind: kind == "wireguard") initrdInterfaceTypes);
+            || !(builtins.elem "wireguard" initrdInterfaceTypes);
           message = "IfState initrd package is configured without the `wireguard` feature, but wireguard interfaces are configured. Please see the `boot.initrd.network.ifstate.package` option.";
         }
         {
diff --git a/nixos/modules/services/security/authelia.nix b/nixos/modules/services/security/authelia.nix
index 5dc438473a1d..059337e3a425 100644
--- a/nixos/modules/services/security/authelia.nix
+++ b/nixos/modules/services/security/authelia.nix
@@ -270,7 +270,7 @@ let
     lib.updateManyAttrsByPath [
       {
         path = lib.init pathList;
-        update = old: lib.filterAttrs (n: v: n != (lib.last pathList)) old;
+        update = old: lib.removeAttrs old [ (lib.last pathList) ];
       }
     ] set;
 in
diff --git a/nixos/modules/services/web-apps/dolibarr.nix b/nixos/modules/services/web-apps/dolibarr.nix
index 0a669ccad2a7..2ed5bbccd6e2 100644
--- a/nixos/modules/services/web-apps/dolibarr.nix
+++ b/nixos/modules/services/web-apps/dolibarr.nix
@@ -6,9 +6,9 @@
 }:
 let
   inherit (lib)
-    any
     boolToString
     concatStringsSep
+    elem
     isBool
     isString
     mapAttrsToList
@@ -46,7 +46,7 @@ let
 
       toStr =
         k: v:
-        if (any (str: k == str) secretKeys) then
+        if (elem k secretKeys) then
           v
         else if isString v then
           "'${v}'"
diff --git a/nixos/modules/services/web-apps/librespeed.nix b/nixos/modules/services/web-apps/librespeed.nix
index 1ffc382a3d8e..2f7658339751 100644
--- a/nixos/modules/services/web-apps/librespeed.nix
+++ b/nixos/modules/services/web-apps/librespeed.nix
@@ -338,10 +338,10 @@ in
                 proxy_buffering off;
                 proxy_request_buffering off;
               ''
-              + lib.optionalString (lib.any (m: m.name == "brotli") config.services.nginx.additionalModules) ''
+              + lib.optionalString (lib.elem "brotli" config.services.nginx.additionalModules) ''
                 brotli off;
               ''
-              + lib.optionalString (lib.any (m: m.name == "zstd") config.services.nginx.additionalModules) ''
+              + lib.optionalString (lib.elem "zstd" config.services.nginx.additionalModules) ''
                 zstd off;
               '';
             };
diff --git a/nixos/modules/system/boot/kernel_config.nix b/nixos/modules/system/boot/kernel_config.nix
index 8ca9c96006a4..2cf34e899cae 100644
--- a/nixos/modules/system/boot/kernel_config.nix
+++ b/nixos/modules/system/boot/kernel_config.nix
@@ -6,7 +6,7 @@ let
     locs: defs:
     if defs == [ ] then
       abort "This case should never happen."
-    else if any (x: x == false) (getValues defs) then
+    else if elem false (getValues defs) then
       false
     else
       true;
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index c7e81bb44335..3c827c3d6627 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -592,7 +592,7 @@ in
             '';
 
         enabledUpstreamSystemUnits = filter (n: !elem n cfg.suppressedSystemUnits) upstreamSystemUnits;
-        enabledUnits = filterAttrs (n: v: !elem n cfg.suppressedSystemUnits) cfg.units;
+        enabledUnits = removeAttrs cfg.units cfg.suppressedSystemUnits;
 
       in
       {
diff --git a/nixos/tests/anubis.nix b/nixos/tests/anubis.nix
index 761c31d6b8c6..b2b3b2f8fa82 100644
--- a/nixos/tests/anubis.nix
+++ b/nixos/tests/anubis.nix
@@ -1,4 +1,36 @@
 { lib, ... }:
+let
+  legacyBotPolicyJSON = ''
+    {
+      "bots": [
+        {
+          "import": "(data)/bots/_deny-pathological.yaml"
+        },
+        {
+          "import": "(data)/meta/ai-block-aggressive.yaml"
+        },
+        {
+          "import": "(data)/crawlers/_allow-good.yaml"
+        },
+        {
+          "import": "(data)/bots/aggressive-brazilian-scrapers.yaml"
+        },
+        {
+          "import": "(data)/common/keep-internet-working.yaml"
+        },
+        {
+          "name": "generic-browser",
+          "user_agent_regex": "Mozilla|Opera",
+          "action": "CHALLENGE"
+        }
+      ],
+      "dnsbl": false,
+      "status_codes": {
+        "CHALLENGE": 200,
+        "DENY": 200
+      }
+    }'';
+in
 {
   name = "anubis";
   meta.maintainers = with lib.maintainers; [
@@ -7,57 +39,75 @@
     ryand56
   ];
 
-  nodes.machine =
+  nodes.machineLegacy =
     { config, pkgs, ... }:
     {
       services.anubis = {
         defaultOptions = {
-          # Get default botPolicy
-          botPolicy = lib.importJSON "${config.services.anubis.package.src}/data/botPolicies.json";
+          botPolicy = builtins.fromJSON legacyBotPolicyJSON;
           settings = {
             DIFFICULTY = 3;
             USER_DEFINED_DEFAULT = true;
           };
         };
-        instances = {
-          "".settings = {
+
+        instances."".settings = {
+          TARGET = "http://localhost:8080";
+          DIFFICULTY = 5;
+          USER_DEFINED_INSTANCE = true;
+        };
+
+        instances."tcp" = {
+          user = "anubis-tcp";
+          group = "anubis-tcp";
+          settings = {
             TARGET = "http://localhost:8080";
-            DIFFICULTY = 5;
-            USER_DEFINED_INSTANCE = true;
-          };
-
-          "tcp" = {
-            user = "anubis-tcp";
-            group = "anubis-tcp";
-            settings = {
-              TARGET = "http://localhost:8080";
-              BIND = ":9000";
-              BIND_NETWORK = "tcp";
-              METRICS_BIND = ":9001";
-              METRICS_BIND_NETWORK = "tcp";
-            };
-          };
-
-          "unix-upstream" = {
-            group = "nginx";
-            settings.TARGET = "unix:///run/nginx/nginx.sock";
-          };
-
-          "botPolicy-default" = {
-            botPolicy = null;
-            settings.TARGET = "http://localhost:8080";
-          };
-
-          "botPolicy-file" = {
-            settings = {
-              TARGET = "http://localhost:8080";
-              POLICY_FNAME = "/etc/anubis-botPolicy.json";
-            };
+            BIND = "127.0.0.1:9000";
+            BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:9001";
+            METRICS_BIND_NETWORK = "tcp";
           };
         };
       };
 
-      # Empty json for testing
+      users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
+      services.nginx = {
+        enable = true;
+        recommendedProxySettings = true;
+        virtualHosts."basic.localhost".locations = {
+          "/".proxyPass = "http://unix:${config.services.anubis.instances."".settings.BIND}";
+          "/metrics".proxyPass = "http://unix:${config.services.anubis.instances."".settings.METRICS_BIND}";
+        };
+
+        virtualHosts."tcp.localhost".locations = {
+          "/".proxyPass = "http://${config.services.anubis.instances."tcp".settings.BIND}";
+          "/metrics".proxyPass = "http://${config.services.anubis.instances."tcp".settings.METRICS_BIND}";
+        };
+
+        # emulate an upstream with nginx, listening on tcp and unix sockets.
+        virtualHosts."upstream.localhost" = {
+          default = true; # make nginx match this vhost for `localhost`
+          listen = [
+            { addr = "unix:/run/nginx/nginx.sock"; }
+            {
+              addr = "localhost";
+              port = 8080;
+            }
+          ];
+          locations."/" = {
+            tryFiles = "$uri $uri/index.html =404";
+            root = pkgs.runCommand "anubis-test-upstream" { } ''
+              mkdir $out
+              echo "it works" >> $out/index.html
+            '';
+          };
+        };
+      };
+    };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
       environment.etc."anubis-botPolicy.json".text = lib.generators.toJSON { } {
         bots = [
           {
@@ -68,8 +118,73 @@
         ];
       };
 
+      services.anubis = {
+        defaultOptions = {
+          botPolicy = builtins.fromJSON legacyBotPolicyJSON;
+          settings = {
+            DIFFICULTY = 3;
+            USER_DEFINED_DEFAULT = true;
+          };
+        };
+
+        instances."".settings = {
+          TARGET = "http://localhost:8080";
+          DIFFICULTY = 5;
+          USER_DEFINED_INSTANCE = true;
+          BIND = "/run/anubis/anubis/anubis.sock";
+          METRICS_BIND = "/run/anubis/anubis/anubis-metrics.sock";
+        };
+
+        instances."tcp" = {
+          user = "anubis-tcp";
+          group = "anubis-tcp";
+          settings = {
+            TARGET = "http://localhost:8080";
+            BIND = "127.0.0.1:9000";
+            BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:9001";
+            METRICS_BIND_NETWORK = "tcp";
+          };
+        };
+
+        instances."another-unix-listen" = {
+          settings = {
+            TARGET = "http://localhost:8080";
+            BIND = "/run/anubis/anubis-another-unix-listen/anubis.sock";
+            METRICS_BIND = "/run/anubis/anubis-another-unix-listen/anubis-metrics.sock";
+          };
+        };
+
+        instances."unix-upstream" = {
+          group = "nginx";
+          settings = {
+            BIND = "/run/anubis/anubis-unix-upstream/anubis.sock";
+            METRICS_BIND = "/run/anubis/anubis-unix-upstream/anubis-metrics.sock";
+            TARGET = "unix:///run/nginx/nginx.sock";
+          };
+        };
+
+        instances."botPolicy-default" = {
+          botPolicy = null;
+          settings = {
+            TARGET = "http://localhost:8080";
+            BIND = "/run/anubis/anubis-botPolicy-default/anubis.sock";
+            METRICS_BIND = "/run/anubis/anubis-botPolicy-default/anubis-metrics.sock";
+          };
+        };
+
+        instances."botPolicy-file" = {
+          settings = {
+            TARGET = "http://localhost:8080";
+            POLICY_FNAME = "/etc/anubis-botPolicy.json";
+            BIND = "/run/anubis/anubis-botPolicy-file/anubis.sock";
+            METRICS_BIND = "/run/anubis/anubis-botPolicy-file/anubis-metrics.sock";
+          };
+        };
+      };
+
       # support
-      users.users.nginx.extraGroups = [ config.services.anubis.defaultOptions.group ];
+      users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
       services.nginx = {
         enable = true;
         recommendedProxySettings = true;
@@ -79,12 +194,21 @@
         };
 
         virtualHosts."tcp.localhost".locations = {
-          "/".proxyPass = "http://localhost:9000";
-          "/metrics".proxyPass = "http://localhost:9001";
+          "/".proxyPass = "http://${config.services.anubis.instances."tcp".settings.BIND}";
+          "/metrics".proxyPass = "http://${config.services.anubis.instances."tcp".settings.METRICS_BIND}";
+        };
+
+        virtualHosts."another-unix-listen".locations = {
+          "/".proxyPass = "http://unix:${
+            config.services.anubis.instances."another-unix-listen".settings.BIND
+          }";
+          "/metrics".proxyPass = "http://unix:${
+            config.services.anubis.instances."another-unix-listen".settings.METRICS_BIND
+          }";
         };
 
         virtualHosts."unix.localhost".locations = {
-          "/".proxyPass = "http://unix:${config.services.anubis.instances.unix-upstream.settings.BIND}";
+          "/".proxyPass = "http://unix:${config.services.anubis.instances."unix-upstream".settings.BIND}";
         };
 
         # emulate an upstream with nginx, listening on tcp and unix sockets.
@@ -109,43 +233,61 @@
     };
 
   testScript = ''
-    for unit in ["nginx", "anubis", "anubis-tcp", "anubis-unix-upstream"]:
-      machine.wait_for_unit(unit + ".service")
+    with subtest("Legacy anubis service configuration: supports only a single RuntimeDirectory"):
+      for unit in ["nginx", "anubis", "anubis-tcp"]:
+        machineLegacy.wait_for_unit(unit + ".service")
 
-    for port in [9000, 9001]:
-      machine.wait_for_open_port(port)
+      machineLegacy.wait_for_open_unix_socket("/run/anubis/anubis.sock")
+      machineLegacy.wait_for_open_unix_socket("/run/anubis/anubis-metrics.sock")
 
-    for instance in ["anubis", "anubis-unix-upstream"]:
-      machine.wait_for_open_unix_socket(f"/run/anubis/{instance}.sock")
-      machine.wait_for_open_unix_socket(f"/run/anubis/{instance}-metrics.sock")
+      # Default unix socket mode with 1 instance listening on unix sockets.
+      machineLegacy.succeed('curl -f http://localhost:8080 | grep "it works"')
+      machineLegacy.succeed('curl -f http://basic.localhost | grep "it works"')
+      machineLegacy.succeed('curl -f http://basic.localhost -H "User-Agent: Mozilla" | grep anubis')
+      machineLegacy.succeed('curl -f http://basic.localhost/metrics | grep anubis_challenges_issued')
 
-    # Default unix socket mode
-    machine.succeed('curl -f http://basic.localhost | grep "it works"')
-    machine.succeed('curl -f http://basic.localhost -H "User-Agent: Mozilla" | grep anubis')
-    machine.succeed('curl -f http://basic.localhost/metrics | grep anubis_challenges_issued')
+      # TCP mode.
+      machineLegacy.succeed('curl -f http://tcp.localhost -H "User-Agent: Mozilla" | grep anubis')
+      machineLegacy.succeed('curl -f http://tcp.localhost/metrics | grep anubis_challenges_issued')
 
-    # TCP mode
-    machine.succeed('curl -f http://tcp.localhost -H "User-Agent: Mozilla" | grep anubis')
-    machine.succeed('curl -f http://tcp.localhost/metrics | grep anubis_challenges_issued')
+    with subtest("Dedicated RuntimeDirectory"):
+      for unit in ["nginx", "anubis", "anubis-another-unix-listen", "anubis-tcp", "anubis-unix-upstream"]:
+        machine.wait_for_unit(unit + ".service")
 
-    # Upstream is a unix socket mode
-    machine.succeed('curl -f http://unix.localhost/index.html | grep "it works"')
+      for port in [9000, 9001]:
+        machine.wait_for_open_port(port)
 
-    # Default user-defined environment variables
-    machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "USER_DEFINED_DEFAULT"')
-    machine.succeed('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "USER_DEFINED_DEFAULT"')
+      machine.wait_for_open_unix_socket("/run/anubis/anubis/anubis.sock")
+      machine.wait_for_open_unix_socket("/run/anubis/anubis/anubis-metrics.sock")
+      for instance in ["another-unix-listen", "unix-upstream"]:
+        machine.wait_for_open_unix_socket(f"/run/anubis/anubis-{instance}/anubis.sock")
+        machine.wait_for_open_unix_socket(f"/run/anubis/anubis-{instance}/anubis-metrics.sock")
 
-    # Instance-specific user-specified environment variables
-    machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "USER_DEFINED_INSTANCE"')
-    machine.fail('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "USER_DEFINED_INSTANCE"')
+      machine.succeed('curl -f http://basic.localhost | grep "it works"')
+      machine.succeed('curl -f http://basic.localhost -H "User-Agent: Mozilla" | grep anubis')
+      machine.succeed('curl -f http://basic.localhost/metrics | grep anubis_challenges_issued')
 
-    # Make sure defaults don't overwrite themselves
-    machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "DIFFICULTY=5"')
-    machine.succeed('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "DIFFICULTY=3"')
+      machine.succeed('curl -f http://another-unix-listen.localhost -H "User-Agent: Mozilla" | grep anubis')
+      machine.succeed('curl -f http://another-unix-listen.localhost/metrics | grep anubis_challenges_issued')
 
-    # Check correct BotPolicy settings are applied
-    machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "POLICY_FNAME=/nix/store"')
-    machine.fail('cat /run/current-system/etc/systemd/system/anubis-botPolicy-default.service | grep "POLICY_FNAME="')
-    machine.succeed('cat /run/current-system/etc/systemd/system/anubis-botPolicy-file.service | grep "POLICY_FNAME=/etc/anubis-botPolicy.json"')
+      # Upstream is a unix socket mode.
+      machine.succeed('curl -f http://unix.localhost/index.html | grep "it works"')
+
+      # Default user-defined environment variables.
+      machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "USER_DEFINED_DEFAULT"')
+      machine.succeed('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "USER_DEFINED_DEFAULT"')
+
+      # Instance-specific user-specified environment variables.
+      machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "USER_DEFINED_INSTANCE"')
+      machine.fail('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "USER_DEFINED_INSTANCE"')
+
+      # Make sure defaults don't overwrite themselves.
+      machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "DIFFICULTY=5"')
+      machine.succeed('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "DIFFICULTY=3"')
+
+      # Check correct BotPolicy settings are applied
+      machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "POLICY_FNAME=/nix/store"')
+      machine.fail('cat /run/current-system/etc/systemd/system/anubis-botPolicy-default.service | grep "POLICY_FNAME="')
+      machine.succeed('cat /run/current-system/etc/systemd/system/anubis-botPolicy-file.service | grep "POLICY_FNAME=/etc/anubis-botPolicy.json"')
   '';
 }
diff --git a/nixos/tests/kubernetes/base.nix b/nixos/tests/kubernetes/base.nix
index ff943ef17763..8a6756b8f9e5 100644
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@@ -18,9 +18,7 @@ let
     }:
     let
       masterName = head (
-        filter (machineName: any (role: role == "master") machines.${machineName}.roles) (
-          attrNames machines
-        )
+        filter (machineName: lib.elem "master" machines.${machineName}.roles) (attrNames machines)
       );
       master = machines.${masterName};
       extraHosts = ''
diff --git a/nixos/tests/sftpgo.nix b/nixos/tests/sftpgo.nix
index c2090c8bb180..6d18c1c5581f 100644
--- a/nixos/tests/sftpgo.nix
+++ b/nixos/tests/sftpgo.nix
@@ -25,7 +25,7 @@ let
     groupName:
     # users.users attrset
     user:
-    lib.any (x: x == user.name) config.users.groups.${groupName}.members;
+    lib.elem user.name config.users.groups.${groupName}.members;
 
   # Generates a valid SFTPGo user configuration for a given user
   # Will be converted to JSON and loaded on application startup.
diff --git a/pkgs/applications/audio/zynaddsubfx/default.nix b/pkgs/applications/audio/zynaddsubfx/default.nix
index da5abd1baccb..9cde53585717 100644
--- a/pkgs/applications/audio/zynaddsubfx/default.nix
+++ b/pkgs/applications/audio/zynaddsubfx/default.nix
@@ -48,7 +48,7 @@
   ctestCheckHook,
 }:
 
-assert builtins.any (g: guiModule == g) [
+assert builtins.elem guiModule [
   "fltk"
   "ntk"
   "zest"
diff --git a/pkgs/applications/editors/jupyter/kernel.nix b/pkgs/applications/editors/jupyter/kernel.nix
index 4496b943997b..2a72d84c47f7 100644
--- a/pkgs/applications/editors/jupyter/kernel.nix
+++ b/pkgs/applications/editors/jupyter/kernel.nix
@@ -62,7 +62,7 @@ in
                 "logo64"
                 "extraPaths"
               ];
-              kernel = lib.filterAttrs (n: v: (lib.any (x: x == n) allowedKernelKeys)) unfilteredKernel;
+              kernel = lib.filterAttrs (n: v: (lib.elem n allowedKernelKeys)) unfilteredKernel;
               config = builtins.toJSON (
                 kernel
                 // {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 54f9f27ef5f1..c408384636e8 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2849,8 +2849,8 @@ let
         mktplcRef = {
           name = "vscode-ltex-plus";
           publisher = "ltex-plus";
-          version = "15.5.1";
-          hash = "sha256-BzIJ7gsjcMimLYeVxcvdP0fyIEmwCXxTxqil5o+810w=";
+          version = "15.6.1";
+          hash = "sha256-UOiYjA11P7xqPFgdR7eS63wOQl9dqWAqBxz3nklapqo=";
         };
         meta = {
           description = "VS Code extension for grammar/spell checking using LanguageTool with support for LaTeX, Markdown, and others";
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index 33c278c911ac..1be8ef9daca7 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-LUJ0e/ndyeeRsC2h7JJL6zymmPDWxW0cPGBceuC7+X0=";
+    hash = "sha256-Sm2Ij1yHMQzPM9lKtiejHRrdCot/DRzgnxznwlZyyro=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 5d294fc73a28..47ac7b7b66d6 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-7";
+  version = "7.1.2-8";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-9ARCYftoXiilpJoj+Y+aLCEqLmhHFYSrHfgA5DQHbGo=";
+    hash = "sha256-2jSQ59Wi6/1dbS/AgM1DfW6WlwoYuJlnTLoM8Mc6Ji8=";
   };
 
   outputs = [
diff --git a/pkgs/applications/window-managers/hyprwm/hypr/default.nix b/pkgs/applications/window-managers/hyprwm/hypr/default.nix
index 3a83551b6e51..c8b3fcbfa762 100644
--- a/pkgs/applications/window-managers/hyprwm/hypr/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hypr/default.nix
@@ -67,6 +67,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.4)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   postFixup = ''
     wrapProgram $out/bin/Hypr --prefix PATH : ${lib.makeBinPath [ xmodmap ]}
   '';
diff --git a/pkgs/by-name/az/azahar/package.nix b/pkgs/by-name/az/azahar/package.nix
index 723afbd6da93..5bf7c063134b 100644
--- a/pkgs/by-name/az/azahar/package.nix
+++ b/pkgs/by-name/az/azahar/package.nix
@@ -44,6 +44,7 @@
   nix-update-script,
   darwinMinVersionHook,
   apple-sdk_12,
+  fetchpatch2,
 }:
 let
   inherit (lib)
@@ -65,6 +66,12 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # https://github.com/azahar-emu/azahar/pull/1305
     ./fix-zstd-seekable-include.patch
+
+    # TODO: Remove in next release
+    (fetchpatch2 {
+      url = "https://github.com/azahar-emu/azahar/commit/1f483e1d335374482845d0325ac8b13af3162c53.patch?full_index=1";
+      hash = "sha256-9rmRbv7VFMhHly5qTGaeBLpvtWMu6HkCGUUM+t78Meg=";
+    })
   ];
 
   strictDeps = true;
diff --git a/pkgs/by-name/ba/badvpn/package.nix b/pkgs/by-name/ba/badvpn/package.nix
index 9f3372510b09..887eb08e4be6 100644
--- a/pkgs/by-name/ba/badvpn/package.nix
+++ b/pkgs/by-name/ba/badvpn/package.nix
@@ -38,6 +38,9 @@ stdenv.mkDerivation rec {
     cmakeFlagsArray=("-DCMAKE_BUILD_TYPE=" "-DCMAKE_C_FLAGS=-O3 ${
       lib.optionalString (!debug) "-DNDEBUG"
     }");
+    sed -e \
+      's/cmake_minimum_required(VERSION 2[.]8)/cmake_minimum_required(VERSION 3.5)/' \
+      -i CMakeLists.txt
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/bl/blint/package.nix b/pkgs/by-name/bl/blint/package.nix
index a3b163760a5d..d8a975996666 100644
--- a/pkgs/by-name/bl/blint/package.nix
+++ b/pkgs/by-name/bl/blint/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "blint";
-  version = "3.0.2";
+  version = "3.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "owasp-dep-scan";
     repo = "blint";
     tag = "v${version}";
-    hash = "sha256-ell0/opQso7/qD6d6i18vU55TfTgdcZwVFXD+yZg9/g=";
+    hash = "sha256-6dBNzBjhcBMX+PQ4NbjM18APqFuURH9/MYxHFZ/x7J8=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index eaad1cb706c1..157633ae5fa7 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -142,14 +142,12 @@ stdenv.mkDerivation (finalAttrs: {
         # the following are distributed with calibre, but we use upstream instead
         odfpy
       ]
-      ++
-        lib.optionals (lib.lists.any (p: p == stdenv.hostPlatform.system) pyqt6-webengine.meta.platforms)
-          [
-            # much of calibre's functionality is usable without a web
-            # browser, so we enable building on platforms which qtwebengine
-            # does not support by simply omitting qtwebengine.
-            pyqt6-webengine
-          ]
+      ++ lib.optionals (lib.lists.elem stdenv.hostPlatform.system pyqt6-webengine.meta.platforms) [
+        # much of calibre's functionality is usable without a web
+        # browser, so we enable building on platforms which qtwebengine
+        # does not support by simply omitting qtwebengine.
+        pyqt6-webengine
+      ]
       ++ lib.optional unrarSupport unrardll
     ))
     piper-tts
diff --git a/pkgs/by-name/co/comaps/package.nix b/pkgs/by-name/co/comaps/package.nix
index be08d8e2d773..5667c5231ed1 100644
--- a/pkgs/by-name/co/comaps/package.nix
+++ b/pkgs/by-name/co/comaps/package.nix
@@ -36,14 +36,14 @@ let
 in
 organicmaps.overrideAttrs (oldAttrs: rec {
   pname = "comaps";
-  version = "2025.10.16-1";
+  version = "2025.10.20-1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "comaps";
     repo = "comaps";
     tag = "v${version}";
-    hash = "sha256-2pnAYc5Ru1OK7ecCN1kKryAPPdxUIGQp9x2y4MosRl8=";
+    hash = "sha256-9L7wyIXieKkKSrudnmPyiLPu4Jfp10xWi5o5lGslLWc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/de/der-ascii/package.nix b/pkgs/by-name/de/der-ascii/package.nix
index af2bb299196f..85b8e13fbb90 100644
--- a/pkgs/by-name/de/der-ascii/package.nix
+++ b/pkgs/by-name/de/der-ascii/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "der-ascii";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "der-ascii";
     rev = "v${version}";
-    sha256 = "sha256-xGzxq5AHvzLUOp9VUcI9JMwrCpVIrpDvenWUOEBP6pA=";
+    sha256 = "sha256-i4rNeNDE7bIsO04haMKsbJmyvQRhhEt3I7UxmfTtL78=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/di/distrho-ports/package.nix b/pkgs/by-name/di/distrho-ports/package.nix
index f0271b3555ad..366b6960f415 100644
--- a/pkgs/by-name/di/distrho-ports/package.nix
+++ b/pkgs/by-name/di/distrho-ports/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
 
   env.NIX_CFLAGS_COMPILE = toString [ "-fpermissive" ];
 
-  postFixup = lib.optionalString (lib.any (x: x == "vitalium") plugins || plugins == [ ]) ''
+  postFixup = lib.optionalString (lib.elem "vitalium" plugins || plugins == [ ]) ''
     for file in \
       $out/lib/lv2/vitalium.lv2/vitalium.so \
       $out/lib/vst/vitalium.so \
diff --git a/pkgs/by-name/di/distro-info-data/package.nix b/pkgs/by-name/di/distro-info-data/package.nix
new file mode 100644
index 000000000000..bb8f4edc7747
--- /dev/null
+++ b/pkgs/by-name/di/distro-info-data/package.nix
@@ -0,0 +1,29 @@
+{
+  fetchFromGitLab,
+  lib,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "distro-info-data";
+  version = "0.67";
+
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "debian";
+    repo = "distro-info-data";
+    tag = "debian/${finalAttrs.version}";
+    hash = "sha256-xm/ajsPKtnmuyEkVxM1AxV7Tl0njkqjOmhE5rKRQ36Q=";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = {
+    description = "Information about Debian and Ubuntu releases";
+    homepage = "https://salsa.debian.org/debian/distro-info-data";
+    changelog = "https://salsa.debian.org/debian/distro-info-data/-/blob/${finalAttrs.src.tag}/debian/changelog";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ andersk ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/do/docfx/package.nix b/pkgs/by-name/do/docfx/package.nix
index e1d14f4f4f61..c54ab12aabf3 100644
--- a/pkgs/by-name/do/docfx/package.nix
+++ b/pkgs/by-name/do/docfx/package.nix
@@ -6,12 +6,12 @@
 
 buildDotnetGlobalTool {
   pname = "docfx";
-  version = "2.78.3";
+  version = "2.78.4";
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
   dotnet-runtime = dotnetCorePackages.runtime_8_0;
 
-  nugetHash = "sha256-hLb6OmxqXOOxFaq/N+aZ0sAzEYjU0giX3c1SWQtKDbs=";
+  nugetHash = "sha256-VvrKQjOnQ7RGp1hP+Bldi7CaM6qpfp4InB5rESISqEg=";
 
   meta = {
     description = "Build your technical documentation site with docfx, with landing pages, markdown, API reference docs for .NET, REST API and more";
diff --git a/pkgs/by-name/dp/dput-ng/package.nix b/pkgs/by-name/dp/dput-ng/package.nix
index c73978a3f496..60ea99b969a3 100644
--- a/pkgs/by-name/dp/dput-ng/package.nix
+++ b/pkgs/by-name/dp/dput-ng/package.nix
@@ -20,6 +20,10 @@ python3.pkgs.buildPythonApplication {
     hash = "sha256-zrH4h4C4y3oTiOXsidFv/rIJNzCdV2lqzNEg0SOkX4w=";
   };
 
+  postPatch = ''
+    substituteInPlace dput/core.py --replace-fail /usr/share/dput-ng "$out/share/dput-ng"
+  '';
+
   build-system = with python3.pkgs; [
     setuptools
   ];
@@ -31,10 +35,13 @@ python3.pkgs.buildPythonApplication {
     coverage
     xdg
     python-debian
+    distro-info
   ];
 
   postInstall = ''
     cp -r bin $out/
+    mkdir -p "$out/share/dput-ng"
+    cp -r skel/* "$out/share/dput-ng/"
   '';
 
   pythonImportsCheck = [ "dput" ];
diff --git a/pkgs/by-name/fe/fennel-ls/package.nix b/pkgs/by-name/fe/fennel-ls/package.nix
index c2aae5dc7604..f9dfa9e18a17 100644
--- a/pkgs/by-name/fe/fennel-ls/package.nix
+++ b/pkgs/by-name/fe/fennel-ls/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fennel-ls";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromSourcehut {
     owner = "~xerool";
     repo = "fennel-ls";
     rev = finalAttrs.version;
-    hash = "sha256-6ZbGRTBBRktudGVBZ+UMn8l0+wKa8f5dg7UOwLhOT7E=";
+    hash = "sha256-N1530u8Kq7ljdEdTFk0CJJyMLMVX5huQWXjyoMBJN5E=";
   };
   buildInputs = [
     lua
diff --git a/pkgs/by-name/fl/flameshot/package.nix b/pkgs/by-name/fl/flameshot/package.nix
index 021707044ad7..7eeda3cd9147 100644
--- a/pkgs/by-name/fl/flameshot/package.nix
+++ b/pkgs/by-name/fl/flameshot/package.nix
@@ -18,13 +18,13 @@ assert stdenv.hostPlatform.isDarwin -> (!enableWlrSupport);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flameshot";
-  version = "13.1.0";
+  version = "13.2.0";
 
   src = fetchFromGitHub {
     owner = "flameshot-org";
     repo = "flameshot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Wg0jc1AqgetaESmTyhzAHx3zal/5DMDum7fzhClqeck=";
+    hash = "sha256-oQMM2BUY6gpBjSRboR1YMZLIi6p0EmrHps7Y6YI7ytU=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/gi/github-copilot-cli/package.nix b/pkgs/by-name/gi/github-copilot-cli/package.nix
index 89d99bd3cd4e..0cea28613e50 100644
--- a/pkgs/by-name/gi/github-copilot-cli/package.nix
+++ b/pkgs/by-name/gi/github-copilot-cli/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
-  version = "0.0.328";
+  version = "0.0.351";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@github/copilot/-/copilot-${finalAttrs.version}.tgz";
-    hash = "sha256-9oTaVjvwyS8KY8N5kUEiAs+l6vEd/BZ0AGJI0p9Jie0=";
+    hash = "sha256-pv2/VTrAOtb2wlOCVbs6qmlb0jbCVl4KpwhlEnVxvP8=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/go/google-java-format/package.nix b/pkgs/by-name/go/google-java-format/package.nix
index 084d1674e3f1..481ac508b5e4 100644
--- a/pkgs/by-name/go/google-java-format/package.nix
+++ b/pkgs/by-name/go/google-java-format/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "google-java-format";
-  version = "1.30.0";
+  version = "1.31.0";
 
   src = fetchurl {
     url = "https://github.com/google/google-java-format/releases/download/v${version}/google-java-format-${version}-all-deps.jar";
-    sha256 = "sha256-8iOaiiNKJApU/f94CdSz5mcCwh9ZDHegts97IMgp6Vo=";
+    sha256 = "sha256-jUv6Lck4iCASp4nMaEl2ivpK+06wEwjGtx+R8I4sVQg=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/in/inspircd/package.nix b/pkgs/by-name/in/inspircd/package.nix
index 6245b34a2a7d..1980e8707107 100644
--- a/pkgs/by-name/in/inspircd/package.nix
+++ b/pkgs/by-name/in/inspircd/package.nix
@@ -24,7 +24,7 @@ let
   # libcs in nixpkgs (musl and glibc).
   compatible =
     lib: drv:
-    lib.any (lic: lic == (drv.meta.license or { })) [
+    lib.elem (drv.meta.license or { }) [
       lib.licenses.mit # musl
       lib.licenses.lgpl2Plus # glibc
     ];
diff --git a/pkgs/by-name/io/iosevka/package.nix b/pkgs/by-name/io/iosevka/package.nix
index c7cacdccdd1f..23ae4b93842b 100644
--- a/pkgs/by-name/io/iosevka/package.nix
+++ b/pkgs/by-name/io/iosevka/package.nix
@@ -47,10 +47,12 @@
   #   sequence = "+>"
   # '';
   extraParameters ? null,
-  # Custom font set name. Required if any custom settings above.
-  set ? null,
+  # Custom font set name. Required if `extraParameters` is used and/or
+  # if `privateBuildPlan` is a TOML string.
+  set ? privateBuildPlan.family or null,
 }:
 
+assert (builtins.isAttrs privateBuildPlan) -> builtins.hasAttr "family" privateBuildPlan;
 assert (privateBuildPlan != null) -> set != null;
 assert (extraParameters != null) -> set != null;
 
diff --git a/pkgs/by-name/ir/irods-icommands/package.nix b/pkgs/by-name/ir/irods-icommands/package.nix
index fd92911ec6a0..624986e5d3e4 100644
--- a/pkgs/by-name/ir/irods-icommands/package.nix
+++ b/pkgs/by-name/ir/irods-icommands/package.nix
@@ -16,7 +16,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     owner = "irods";
     repo = "irods_client_icommands";
     tag = finalAttrs.version;
-    hash = "sha256-lo1eCI/CSzl7BJWdPo7KKVHfznkPN6GwsiQThUGuQdw=";
+    hash = "sha256-jR7AhWeXYuJKzZRmYQUjiKSwK6PaB4dLQO8GVZwJQXk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ir/irods/package.nix b/pkgs/by-name/ir/irods/package.nix
index 98b823f54f77..8c2055ec406e 100644
--- a/pkgs/by-name/ir/irods/package.nix
+++ b/pkgs/by-name/ir/irods/package.nix
@@ -16,19 +16,19 @@
   boost183,
   nlohmann_json,
   nanodbc,
-  fmt_9,
+  fmt,
   spdlog,
 }:
 
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
   pname = "irods";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitHub {
     owner = "irods";
     repo = "irods";
     tag = finalAttrs.version;
-    hash = "sha256-/mcuqukgDoMc89FL/TfOhHWglsfdLmQbAnQYT8vTFsY=";
+    hash = "sha256-gYwuXWRf5MZv3CTUq/RDlU9Ekbw4jZJmSgWRBKqdKJo=";
   };
 
   nativeBuildInputs = [
@@ -54,12 +54,8 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     boost183
     nlohmann_json
     nanodbc
-    # Tracking issue for `fmt_11`:
-    # <https://github.com/irods/irods/issues/8454>
-    fmt_9
-    (spdlog.override {
-      fmt = fmt_9;
-    })
+    fmt
+    spdlog
   ];
 
   cmakeFlags = finalAttrs.passthru.commonCmakeFlags ++ [
diff --git a/pkgs/by-name/ki/kibi/package.nix b/pkgs/by-name/ki/kibi/package.nix
index cb2512e7e0cf..268ba30f54a7 100644
--- a/pkgs/by-name/ki/kibi/package.nix
+++ b/pkgs/by-name/ki/kibi/package.nix
@@ -5,31 +5,36 @@
   makeWrapper,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kibi";
-  version = "0.2.2";
+  version = "0.3.0";
 
-  cargoHash = "sha256-7SOkREsGiolT5LxLAbjZe3aAYBT/AlhlOXDlDmoei9w=";
+  cargoHash = "sha256-gXkwqmmFGNEJY7an3KWlRuLL5WuCH4P0n7BrLNsZ9/A=";
 
   src = fetchFromGitHub {
     owner = "ilai-deutel";
     repo = "kibi";
-    rev = "v${version}";
-    sha256 = "sha256-ox1qKWxJlUIFzEqeyzG2kqZix3AHnOKFrlpf6O5QM+k=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6uDpTQ97eNgM1lCiYPWS5QPxMNcPF3Ix14VaGiTY4Kc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
     install -Dm644 syntax.d/* -t $out/share/kibi/syntax.d
+    install -Dm644 kibi.desktop -t $out/share/applications
+    install -Dm0644 assets/logo.svg $out/share/icons/hicolor/scalable/apps/kibi.svg
     wrapProgram $out/bin/kibi --prefix XDG_DATA_DIRS : "$out/share"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Text editor in ≤1024 lines of code, written in Rust";
     homepage = "https://github.com/ilai-deutel/kibi";
-    license = licenses.mit;
-    maintainers = with maintainers; [ robertodr ];
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ robertodr ];
     mainProgram = "kibi";
   };
-}
+})
diff --git a/pkgs/by-name/le/letterpress/package.nix b/pkgs/by-name/le/letterpress/package.nix
index e83eaa0811cf..89092dd68145 100644
--- a/pkgs/by-name/le/letterpress/package.nix
+++ b/pkgs/by-name/le/letterpress/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitLab,
-  fetchpatch,
   wrapGAppsHook4,
   appstream,
   blueprint-compiler,
@@ -18,25 +17,16 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "letterpress";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "letterpress";
     rev = version;
-    hash = "sha256-9U8iH3V4WMljdtWLmb0RlexLeAN5StJ0c9RlEB2E7Xs=";
+    hash = "sha256-cqLodI6UjdLCKLGGcSIbXu1+LOcq2DE00V+lVS7OBMg=";
   };
 
-  patches = [
-    # Fix application segmentation fault on file chooser dialog opening
-    # https://gitlab.gnome.org/World/Letterpress/-/merge_requests/16
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/World/Letterpress/-/commit/15059eacca14204d1092a6e32ef30c6ce4df6d36.patch";
-      hash = "sha256-pjg/O9advtkZ0l73GQtL/GYcTWeOs5l3VGOdnsZCWI0=";
-    })
-  ];
-
   runtimeDeps = [
     jp2a
   ];
@@ -81,6 +71,7 @@ python3Packages.buildPythonApplication rec {
       High-res output can still be viewed comfortably by lowering the zoom factor.
     '';
     homepage = "https://apps.gnome.org/Letterpress/";
+    changelog = "https://gitlab.gnome.org/World/Letterpress/-/releases/${version}";
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.dawidd6 ];
     teams = [ teams.gnome-circle ];
diff --git a/pkgs/by-name/li/libsnark/package.nix b/pkgs/by-name/li/libsnark/package.nix
index 52871ae2f69b..319efa5e155b 100644
--- a/pkgs/by-name/li/libsnark/package.nix
+++ b/pkgs/by-name/li/libsnark/package.nix
@@ -41,6 +41,13 @@ stdenv.mkDerivation {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    substituteInPlace {,depends/{libff,libfqfft}/}CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace depends/gtest/{,googlemock/,googletest/}CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6.4)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = {
     broken = withProcps; # Despite procps having a valid pkg-config file, CMake doesn't seem to be able to find it.
     description = "C++ library for zkSNARKs";
diff --git a/pkgs/by-name/li/libvgm/package.nix b/pkgs/by-name/li/libvgm/package.nix
index 6c39efabcb72..d500f0d9a8e5 100644
--- a/pkgs/by-name/li/libvgm/package.nix
+++ b/pkgs/by-name/li/libvgm/package.nix
@@ -106,9 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "More modular rewrite of most components from VGMPlay";
     homepage = "https://github.com/ValleyBell/libvgm";
     license =
-      if
-        (enableEmulation && (withAllEmulators || (lib.lists.any (core: core == "WSWAN_ALL") emulators)))
-      then
+      if (enableEmulation && (withAllEmulators || (lib.lists.elem "WSWAN_ALL" emulators))) then
         lib.licenses.unfree # https://github.com/ValleyBell/libvgm/issues/43
       else
         lib.licenses.gpl2Only;
diff --git a/pkgs/by-name/ma/marl/package.nix b/pkgs/by-name/ma/marl/package.nix
index ae5e576bc9c7..b2e338d11bca 100644
--- a/pkgs/by-name/ma/marl/package.nix
+++ b/pkgs/by-name/ma/marl/package.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation {
   # Turn on the flag to install after building the library.
   cmakeFlags = [ "-DMARL_INSTALL=ON" ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/google/marl";
     description = "Hybrid thread / fiber task scheduler written in C++ 11";
diff --git a/pkgs/by-name/me/megaglest/package.nix b/pkgs/by-name/me/megaglest/package.nix
index 18b3923132cd..59ff8c9a7306 100644
--- a/pkgs/by-name/me/megaglest/package.nix
+++ b/pkgs/by-name/me/megaglest/package.nix
@@ -144,6 +144,11 @@ stdenv.mkDerivation {
     "-DBUILD_MEGAGLEST_MODEL_VIEWER=On"
   ];
 
+  postPatch = ''
+    substituteInPlace {data/glest_game,.}/CMakeLists.txt \
+      --replace-fail "CMAKE_MINIMUM_REQUIRED( VERSION 2.8.2 )" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   postInstall = ''
     for i in $out/bin/*; do
       wrapProgram $i \
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 3ddd98aeb6e7..6ada8f55c1ee 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -8,12 +8,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-10-24";
+  version = "0-unstable-2025-10-25";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "1548a725f07c2c6113379a8c5566c2e4c4dfc91f";
-    hash = "sha256-SgZFdjoSlmRS+eMbAIVPsDnwDEmzA/YFhgdHij3Qq38=";
+    rev = "6aaec4681f415cd7c87519b4acd61720525cdda1";
+    hash = "sha256-77PoCq072udYDsplW1ENQbw/8lQqXrEiPFh2e/oAqVw=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/na/nanodbc/package.nix b/pkgs/by-name/na/nanodbc/package.nix
index dcad1610d292..8c50f2bfd68f 100644
--- a/pkgs/by-name/na/nanodbc/package.nix
+++ b/pkgs/by-name/na/nanodbc/package.nix
@@ -20,6 +20,9 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp test/catch/catch.hpp
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0.0)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
   nativeBuildInputs = [ cmake ];
@@ -38,5 +41,6 @@ stdenv.mkDerivation rec {
     description = "Small C++ wrapper for the native C ODBC API";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.bzizou ];
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/by-name/oa/oatpp/package.nix b/pkgs/by-name/oa/oatpp/package.nix
index 92c52aa4a992..a0daeafbd9d0 100644
--- a/pkgs/by-name/oa/oatpp/package.nix
+++ b/pkgs/by-name/oa/oatpp/package.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
   # Tests fail on darwin. See https://github.com/NixOS/nixpkgs/pull/105419#issuecomment-735826894
   doCheck = !stdenv.hostPlatform.isDarwin;
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     homepage = "https://oatpp.io/";
     description = "Light and powerful C++ web framework for highly scalable and resource-efficient web applications";
diff --git a/pkgs/by-name/on/onedrive/package.nix b/pkgs/by-name/on/onedrive/package.nix
index 64a0077d23b1..5b0199afa241 100644
--- a/pkgs/by-name/on/onedrive/package.nix
+++ b/pkgs/by-name/on/onedrive/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "onedrive";
-  version = "2.5.6";
+  version = "2.5.7";
 
   src = fetchFromGitHub {
     owner = "abraunegg";
     repo = "onedrive";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-AFaz1RkrtsdTZfaWobdcADbzsAhbdCzJPkQX6Pa7hN8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IllPh4YJvoAAyXDmSNwWDHN/EUtUuUqS7TOnBpr3Yts=";
   };
 
   outputs = [
@@ -68,10 +68,8 @@ stdenv.mkDerivation (finalAttrs: {
       --fish contrib/completions/complete.fish \
       --zsh contrib/completions/complete.zsh
 
-    for s in $out/lib/systemd/user/onedrive.service $out/lib/systemd/system/onedrive@.service; do
-      substituteInPlace $s \
-        --replace-fail "/usr/bin/sleep" "${coreutils}/bin/sleep"
-    done
+    substituteInPlace $out/lib/systemd/user/onedrive.service $out/lib/systemd/system/onedrive@.service \
+      --replace-fail "/bin/sh -c 'sleep 15'" "${coreutils}/bin/sleep 15"
   '';
 
   passthru = {
diff --git a/pkgs/by-name/ot/otb/package.nix b/pkgs/by-name/ot/otb/package.nix
index 4de37605c62c..5febf925ebfc 100644
--- a/pkgs/by-name/ot/otb/package.nix
+++ b/pkgs/by-name/ot/otb/package.nix
@@ -59,7 +59,7 @@ let
     # https://gitlab.orfeo-toolbox.org/orfeotoolbox/otb/-/issues/2454#note_112821
     "fftw"
   ];
-  itkIsInDepsToRemove = dep: builtins.any (d: d == dep.name) itkDepsToRemove;
+  itkIsInDepsToRemove = dep: builtins.elem dep.name itkDepsToRemove;
 
   # remove after https://gitlab.orfeo-toolbox.org/orfeotoolbox/otb/-/issues/2451
   otbSwig = swig.overrideAttrs (oldArgs: {
diff --git a/pkgs/by-name/pd/pdns-recursor/package.nix b/pkgs/by-name/pd/pdns-recursor/package.nix
index bf5c07b37059..30bdb7190cad 100644
--- a/pkgs/by-name/pd/pdns-recursor/package.nix
+++ b/pkgs/by-name/pd/pdns-recursor/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns-recursor";
-  version = "5.2.5";
+  version = "5.2.6";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-qKZXp6vW6dI3zdJnU/fc9czVuMSKyBILCNK41XodhWo=";
+    hash = "sha256-INt/KcULGvsensXF6LIZ0RKtrPK4rPPaQW/yR+JaxAc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/po/pocketbase/package.nix b/pkgs/by-name/po/pocketbase/package.nix
index 5eab2ef9c561..b9b3d2c0eab5 100644
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.30.4";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-n2xBwonQOEk2LVQePxdO/PraM75FFDmOqZ9fIL2xd+I=";
+    hash = "sha256-YCYihhPq24JdJKAU8zr4h4z131zj4BN3Qh/y5tHmyRs=";
   };
 
-  vendorHash = "sha256-Zo0b0MTIRpLGPIg288ROFPIdHfMzZdFLbFZPAffWPxU=";
+  vendorHash = "sha256-wsPJIlsq4Q26cce69a0oqEalfDrNIMVFt8ufdj+WId4=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/by-name/po/postfix/package.nix b/pkgs/by-name/po/postfix/package.nix
index e615ebd3568e..e801abfa0c04 100644
--- a/pkgs/by-name/po/postfix/package.nix
+++ b/pkgs/by-name/po/postfix/package.nix
@@ -74,11 +74,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "postfix";
-  version = "3.10.4";
+  version = "3.10.5";
 
   src = fetchurl {
     url = "https://de.postfix.org/ftpmirror/official/postfix-${version}.tar.gz";
-    hash = "sha256-z7ZoYf6PlkeH3a6rFfPKPn7z3nMPlxca/EpeyjOMpEQ=";
+    hash = "sha256-apJr9wIXOGGwjkm8tR/KOi8mn5ozf3LvFZv0YFIIfjU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/py/pyradio/package.nix b/pkgs/by-name/py/pyradio/package.nix
index 38f39b35f89e..f294c5138555 100644
--- a/pkgs/by-name/py/pyradio/package.nix
+++ b/pkgs/by-name/py/pyradio/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.9.3.11.19";
+  version = "0.9.3.11.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     tag = version;
-    hash = "sha256-fjTaURYY2pSb3mod4Vffbczmyxsn0/4SAXkb68mRhQA=";
+    hash = "sha256-dcs9kwuS1/pNtBPhj6Z1VAHFJw/ajwzc2aTWGU/h4W0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qp/qpid-cpp/package.nix b/pkgs/by-name/qp/qpid-cpp/package.nix
index 61f415e6480b..53e52140f2ae 100644
--- a/pkgs/by-name/qp/qpid-cpp/package.nix
+++ b/pkgs/by-name/qp/qpid-cpp/package.nix
@@ -43,6 +43,11 @@ stdenv.mkDerivation rec {
     sed -i '/managementgen/d' CMakeLists.txt
     sed -i '/ENV/d' src/CMakeLists.txt
     sed -i '/management/d' CMakeLists.txt
+
+    substituteInPlace {./,examples/}CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8.7 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_policy(SET CMP0022 OLD)" ""
   '';
 
   env.NIX_CFLAGS_COMPILE = toString (
diff --git a/pkgs/by-name/qu/quartus-prime-lite/quartus.nix b/pkgs/by-name/qu/quartus-prime-lite/quartus.nix
index 2349d765b3cd..68121d1a14ce 100644
--- a/pkgs/by-name/qu/quartus-prime-lite/quartus.nix
+++ b/pkgs/by-name/qu/quartus-prime-lite/quartus.nix
@@ -35,9 +35,7 @@ let
       }) supportedDevices
     );
 
-  unsupportedDeviceIds = lib.filterAttrs (
-    name: value: !(lib.hasAttr name supportedDeviceIds)
-  ) deviceIds;
+  unsupportedDeviceIds = lib.removeAttrs deviceIds (lib.attrNames supportedDeviceIds);
 
   componentHashes = {
     "arria_lite" = "sha256-ASvi9YX15b4XXabGjkuR5wl9wDwCijl8s750XTR/4XU=";
diff --git a/pkgs/by-name/ro/romdirfs/package.nix b/pkgs/by-name/ro/romdirfs/package.nix
index 00b6543cc1ac..11ef69a039e6 100644
--- a/pkgs/by-name/ro/romdirfs/package.nix
+++ b/pkgs/by-name/ro/romdirfs/package.nix
@@ -24,6 +24,11 @@ gccStdenv.mkDerivation rec {
   ];
   buildInputs = [ fuse ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "CMAKE_MINIMUM_REQUIRED(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     description = "FUSE for access Playstation 2 IOP IOPRP images and BIOS dumps";
     homepage = "https://github.com/mlafeldt/romdirfs";
diff --git a/pkgs/by-name/rt/rttr/package.nix b/pkgs/by-name/rt/rttr/package.nix
index 9cf8dee8a877..da0822946ccc 100644
--- a/pkgs/by-name/rt/rttr/package.nix
+++ b/pkgs/by-name/rt/rttr/package.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation rec {
     "-DBUILD_PACKAGE=OFF"
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     broken = stdenv.hostPlatform.isDarwin;
     description = "C++ Reflection Library";
diff --git a/pkgs/by-name/sl/sleek-grub-theme/package.nix b/pkgs/by-name/sl/sleek-grub-theme/package.nix
index 186993f6fbd2..e7ae9353fbb4 100644
--- a/pkgs/by-name/sl/sleek-grub-theme/package.nix
+++ b/pkgs/by-name/sl/sleek-grub-theme/package.nix
@@ -6,7 +6,7 @@
   withStyle ? "light", # use override to specify one of "dark" / "orange" / "bigSur"
 }:
 
-assert builtins.any (s: withStyle == s) [
+assert builtins.elem withStyle [
   "light"
   "dark"
   "orange"
diff --git a/pkgs/by-name/sl/slint-lsp/package.nix b/pkgs/by-name/sl/slint-lsp/package.nix
index 2edeb1b5674e..ff24feebaa9b 100644
--- a/pkgs/by-name/sl/slint-lsp/package.nix
+++ b/pkgs/by-name/sl/slint-lsp/package.nix
@@ -15,14 +15,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "slint-lsp";
-  version = "1.13.1";
+  version = "1.14.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-XEs7zJWocRZgVPPDM/IxOOwE7ofh+b7A/TJrQw/mMOo=";
+    hash = "sha256-gVRoca4u1TVArDF226JWzLQJhUAIWA2JDyQ3Wo87AkA=";
   };
 
-  cargoHash = "sha256-DAoqfnis95oEPBgYeOdR3zUVdoKbay780iJ6zVkxdDU=";
+  cargoHash = "sha256-f3RLJnxoEUm7gsfqj86wXgfOj9woGmisONv0RZAQCGc=";
 
   rpathLibs = [
     fontconfig
diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index cb97b39c03d8..3a56b9282291 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation {
   pname = "solanum";
-  version = "0-unstable-2025-10-13";
+  version = "0-unstable-2025-10-23";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "2d483c6e3f0d33aef9447c17b3b55d3e86098831";
-    hash = "sha256-/84WXUqJTOMldIUJokPBNR4quU9YZM0PhWWWLAKoJsw=";
+    rev = "4544f823127c59951c7695f0f260128ee0691a67";
+    hash = "sha256-x+i4LUImepwIz5H13W5eNYl9GzgFvNGS1OSLVtl9qmE=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sp/spotdl/package.nix b/pkgs/by-name/sp/spotdl/package.nix
index faff6ff7b5e8..e1b2e3984899 100644
--- a/pkgs/by-name/sp/spotdl/package.nix
+++ b/pkgs/by-name/sp/spotdl/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "spotdl";
-  version = "4.4.2";
+  version = "4.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spotDL";
     repo = "spotify-downloader";
     tag = "v${version}";
-    hash = "sha256-guQ8fIA20wtCkB5CkU7zg/INE+g8/fvQfIs5TNteQGo=";
+    hash = "sha256-opbbcYjsR+xuo2uQ7Ic/2+BfkiwdEe1xD/whRonDBWo=";
   };
 
   build-system = with python3Packages; [ hatchling ];
@@ -50,8 +50,8 @@ python3Packages.buildPythonApplication rec {
     pyfakefs
     pytest-mock
     pytest-subprocess
-    pytest-vcr
     pytestCheckHook
+    vcrpy
     writableTmpDirAsHomeHook
   ];
 
@@ -65,6 +65,8 @@ python3Packages.buildPythonApplication rec {
     "tests/utils/test_m3u.py"
     "tests/utils/test_metadata.py"
     "tests/utils/test_search.py"
+    # TypeError: 'LocalPath' object is not subscriptable
+    "tests/utils/test_config.py"
   ];
 
   disabledTests = [
diff --git a/pkgs/by-name/ss/sscg/package.nix b/pkgs/by-name/ss/sscg/package.nix
index b9c1f004d7df..5e31229127d7 100644
--- a/pkgs/by-name/ss/sscg/package.nix
+++ b/pkgs/by-name/ss/sscg/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sscg";
-  version = "3.0.8";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "sgallagher";
     repo = "sscg";
     tag = "sscg-${finalAttrs.version}";
-    hash = "sha256-vHZuBjFs7sGIMGFWyqaW0SzzDDsrszlLmLREJtjLH2g=";
+    hash = "sha256-Z/Cea9m2v+M+t69gx/Y6IGAUZ/p5ZsTA80+fvUvqvYc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/su/supabase-cli/package.nix b/pkgs/by-name/su/supabase-cli/package.nix
index 4554d70990a3..67bd8b05d94c 100644
--- a/pkgs/by-name/su/supabase-cli/package.nix
+++ b/pkgs/by-name/su/supabase-cli/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "supabase-cli";
-  version = "2.53.5";
+  version = "2.54.8";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-U91G/5eWj+ZHCq9GU9R+gSYhwez99xi6t4VWsnYpjtI=";
+    hash = "sha256-iU2NFb97458ouDYuTwgCIYtBpM11MXPWS4hV/Q4IDMs=";
   };
 
-  vendorHash = "sha256-ST1j+UXGs3mBf5NYe+sp+QXjHsey9ATOFdriIEBJpKM=";
+  vendorHash = "sha256-JhPKfSFQxFwH5nIYIO3mACdDfURIhuISs1tANiCfWSk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/t4/t4kcommon/linebreak-fix.patch b/pkgs/by-name/t4/t4kcommon/linebreak-fix.patch
new file mode 100644
index 000000000000..a13cdd4a917e
--- /dev/null
+++ b/pkgs/by-name/t4/t4kcommon/linebreak-fix.patch
@@ -0,0 +1,17 @@
+--- a/src/linebreak/CMakeLists.txt
++++ b/src/linebreak/CMakeLists.txt
+@@ -72,12 +72,12 @@
+   ${LINEBREAK_BINARY_DIR} 
+   ${LINEBREAK_SOURCE_DIR} 
+   ${CMAKE_CURRENT_BINARY_DIR})
+-  
++add_library(linebreak STATIC ${LINEBREAK_SOURCES} ${LINEBREAK_HEADERS})
+ if (ICONV_FOUND)
+   include_directories(${ICONV_INCLUDE_DIR})
+   target_link_libraries(linebreak ${ICONV_LIBRARY})
+ endif (ICONV_FOUND)
+-add_library(linebreak STATIC ${LINEBREAK_SOURCES} ${LINEBREAK_HEADERS})
++
+ 
+ #project_source_group("${GROUP_CODE}" LINEBREAK_SOURCES LINEBREAK_HEADERS)
+ 
diff --git a/pkgs/by-name/t4/t4kcommon/package.nix b/pkgs/by-name/t4/t4kcommon/package.nix
index 956002f5a0e7..f59e0309260d 100644
--- a/pkgs/by-name/t4/t4kcommon/package.nix
+++ b/pkgs/by-name/t4/t4kcommon/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation rec {
       url = "https://salsa.debian.org/tux4kids-pkg-team/t4kcommon/raw/f7073fa384f5a725139f54844e59b57338b69dc7/debian/patches/libpng16.patch";
       hash = "sha256-auQ8VvOyvLE1PD2dfeHZJV+MzIt1OtUa7OcOqsXTAYI=";
     })
+    # Fix "Cannot specify link libraries for target "linebreak" which is not built by this project."
+    ./linebreak-fix.patch
   ];
 
   # Workaround build failure on -fno-common toolchains like upstream
@@ -55,6 +57,11 @@ stdenv.mkDerivation rec {
     libxml2
   ];
 
+  postPatch = ''
+    substituteInPlace {src/,./}CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     description = "Library of code shared between tuxmath and tuxtype";
     homepage = "https://github.com/tux4kids/t4kcommon";
diff --git a/pkgs/by-name/ta/tahoe-lafs/package.nix b/pkgs/by-name/ta/tahoe-lafs/package.nix
index 7d8f4d3a089c..0850840ca3fb 100644
--- a/pkgs/by-name/ta/tahoe-lafs/package.nix
+++ b/pkgs/by-name/ta/tahoe-lafs/package.nix
@@ -1,53 +1,33 @@
 {
   lib,
-  python3,
+  python3Packages,
   fetchFromGitHub,
+  installShellFiles,
   texinfo,
   versionCheckHook,
 }:
 
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      # tahoe-lafs is incompatible with magic-wormhole >= 0.19.0
-      # TODO: unpin, when https://tahoe-lafs.org/trac/tahoe-lafs/ticket/4180 is fixed
-      magic-wormhole = super.magic-wormhole.overridePythonAttrs (oldAttrs: rec {
-        version = "0.18.0";
-
-        src = fetchFromGitHub {
-          owner = "magic-wormhole";
-          repo = "magic-wormhole";
-          tag = version;
-          hash = "sha256-FQ7m6hkJcFZaE+ptDALq/gijn/RcAM1Zvzi2+xpoXBU=";
-        };
-
-        nativeCheckInputs = lib.filter (
-          input: (input.pname or null) != "pytest-twisted"
-        ) oldAttrs.nativeCheckInputs;
-
-        doCheck = false;
-      });
-    };
-  };
-  python3Packages = python.pkgs;
-in
 python3Packages.buildPythonApplication rec {
   pname = "tahoe-lafs";
-  version = "1.20.0";
+  version = "1.20.0-unstable-2025-10-12";
   pyproject = true;
 
+  # workaround required to build an unstable version
+  # TODO: when moving to a tagged version, remove this and the workaround for versionCheckHook
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = builtins.elemAt (builtins.split "-" version) 0;
+
   src = fetchFromGitHub {
     owner = "tahoe-lafs";
     repo = "tahoe-lafs";
-    tag = "tahoe-lafs-${version}";
-    hash = "sha256-9qaL4GmdjClviKTnwAxaTywvJChQ5cVVgWs1IkFxhIY=";
+    rev = "7b96d16aba511fd34dcc0c14c9db754229e19531";
+    hash = "sha256-7qMeyL0j0D6Yos7qDhhplinKPV87Vu72dbE4eWql/g4=";
   };
 
   outputs = [
     "out"
     "doc"
     "info"
+    "man"
   ];
 
   # Remove broken and expensive tests.
@@ -68,13 +48,16 @@ python3Packages.buildPythonApplication rec {
     hatchling
   ];
 
-  nativeBuildInputs = with python3Packages; [
-    # docs
+  nativeBuildInputs = # docs
+  [
+    installShellFiles
+    texinfo
+  ]
+  ++ (with python3Packages; [
     recommonmark
     sphinx
     sphinx-rtd-theme
-    texinfo
-  ];
+  ]);
 
   dependencies =
     with python3Packages;
@@ -89,8 +72,8 @@ python3Packages.buildPythonApplication rec {
       eliot
       filelock
       foolscap
-      future
       klein
+      legacy-cgi
       magic-wormhole
       netifaces
       psutil
@@ -121,6 +104,8 @@ python3Packages.buildPythonApplication rec {
       make info
       mkdir -p "$info/share/info"
       cp -rv _build/texinfo/*.info "$info/share/info"
+
+      installManPage man/man*/*
     )
   '';
 
@@ -139,13 +124,13 @@ python3Packages.buildPythonApplication rec {
     ++ [
       versionCheckHook
     ];
-  versionCheckProgram = "${placeholder "out"}/bin/tahoe";
+
   versionCheckProgramArg = "--version";
 
   checkPhase = ''
     runHook preCheck
 
-    runHook versionCheckHook
+    version=$SETUPTOOLS_SCM_PRETEND_VERSION runHook versionCheckHook
     trial --rterrors allmydata
 
     runHook postCheck
diff --git a/pkgs/by-name/ta/taskwarrior-tui/package.nix b/pkgs/by-name/ta/taskwarrior-tui/package.nix
index b595a4b8ee27..9ca19b9b21d2 100644
--- a/pkgs/by-name/ta/taskwarrior-tui/package.nix
+++ b/pkgs/by-name/ta/taskwarrior-tui/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "taskwarrior-tui";
-  version = "0.26.3";
+  version = "0.26.4";
 
   src = fetchFromGitHub {
     owner = "kdheepak";
     repo = "taskwarrior-tui";
     rev = "v${version}";
-    sha256 = "sha256-8PFGlsm9B6qHRrY7YIPwknmGS+Peg5MWd0kMT173wIQ=";
+    sha256 = "sha256-Ubl2xSFb5ZJ/5JqNI0In3hX6SxZd4g/AEq+CLdN2FsE=";
   };
 
-  cargoHash = "sha256-y5tHZIsbHLU9acIUM/QUx1T0eLK/E/jR+XXys5JnGjU=";
+  cargoHash = "sha256-lq2mqMrhcRX2gX7youx8NrZEKmEOJYuhIsHHixuQmmk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/te/teamspeak6-client/package.nix b/pkgs/by-name/te/teamspeak6-client/package.nix
index 3f3b138a948f..fb7ca2a4be55 100644
--- a/pkgs/by-name/te/teamspeak6-client/package.nix
+++ b/pkgs/by-name/te/teamspeak6-client/package.nix
@@ -30,11 +30,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "teamspeak6-client";
-  version = "6.0.0-beta3.1";
+  version = "6.0.0-beta3.2";
 
   src = fetchurl {
     url = "https://files.teamspeak-services.com/pre_releases/client/${finalAttrs.version}/teamspeak-client.tar.gz";
-    hash = "sha256-CWKyn49DSWgrkJyYcPwKUz2PBykvFQc1f7G/yvrHbWU=";
+    hash = "sha256-sZrYGonBw3BgUSExovs8GW5E54vhr3i/VR9eH9/qjWM=";
   };
 
   sourceRoot = ".";
@@ -119,6 +119,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     license = lib.licenses.teamspeak;
     mainProgram = "TeamSpeak";
     maintainers = with lib.maintainers; [
+      drafolin
       gepbird
       jojosch
     ];
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index d0b465fa8b17..ec13d6d2b992 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-m/T1Ns8mmifODTLoQ426Co/07rg/kpq/XewNKozDStE=";
-    "x86_64-linux" = "sha256-ClQLzae+8xd9Jb9fGRJ3u/SAYSlk/bxgSITDxSIbS7U=";
-    "aarch64-linux" = "sha256-G2l2636rhXbhegdehSJj6VQpOYHe1Lp8jsBaG53kzUk=";
+    "universal-macos" = "sha256-4lpJxXRwngBUdImBrIeuLVU6GJr6n6g/71bueuZTFj8=";
+    "x86_64-linux" = "sha256-5rJHyFRrU5N5wYIohISBRuwH7WfrSDUyHHmCppSvcfM=";
+    "aarch64-linux" = "sha256-CSB6PGr/EGV/ZdxfWMwY/R9/pObQRSASYE3Cp4cm1/E=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.61";
+  version = "0.16.62";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index fecd0217f94b..58f497322ad3 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -15,16 +15,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.13.28";
+  version = "0.13.30";
 
   src = fetchFromGitHub {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z2FAlFjFHCzFhlLILcXseynoSdMhRQ30fWC7rW946N4=";
+    hash = "sha256-7SUr23m+zUHsSmSZGlmKnwI5VUPh53Rxiw2Wx8yy+5k=";
   };
 
-  cargoHash = "sha256-7p+TNZO+uFqXhhMzmHj0r1X2WgDdg8aonMc0jgsrEnk=";
+  cargoHash = "sha256-Qvj4xdbKI8PEbJ+N8Ba+sE5hDDHMegzU18gFtx/q/W8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/tr/trzsz-ssh/package.nix b/pkgs/by-name/tr/trzsz-ssh/package.nix
index 2a4ba92e82cd..8194ae38e2f1 100644
--- a/pkgs/by-name/tr/trzsz-ssh/package.nix
+++ b/pkgs/by-name/tr/trzsz-ssh/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "trzsz-ssh";
-  version = "0.1.22";
+  version = "0.1.23";
 
   src = fetchFromGitHub {
     owner = "trzsz";
     repo = "trzsz-ssh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VvPdWRP+lrhho+Bk5rT9pktEvKe01512WoDfAu5d868=";
+    hash = "sha256-Cp5XI7ggpt48llojcmarYPi9mTM+YBqwjG/eNAnKTxc=";
   };
 
-  vendorHash = "sha256-EllXxDyWI4Dy5E6KnzYFxuYDQcdk9+01v5svpARZU44=";
+  vendorHash = "sha256-pI9BlttS9a1XrgBBmUd+h529fLbsbwSMwjKn4P50liE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/un/unciv/package.nix b/pkgs/by-name/un/unciv/package.nix
index d9f8949cb4db..da6aec474562 100644
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@@ -12,7 +12,7 @@
   nix-update-script,
 }:
 let
-  version = "4.18.7";
+  version = "4.18.10";
 
   desktopItem = makeDesktopItem {
     name = "unciv";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-bZzF8WUDw2rrF8Qi6PKBA9F5EUDZGwgXegcHDFgQxJY=";
+    hash = "sha256-8gp4h+fKK+gmwL8OnmfKb5pmO4mehClu8FeQe2KJiDk=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/uw/uwsgi/package.nix b/pkgs/by-name/uw/uwsgi/package.nix
index 61d4fa0a49d9..593835879c79 100644
--- a/pkgs/by-name/uw/uwsgi/package.nix
+++ b/pkgs/by-name/uw/uwsgi/package.nix
@@ -145,7 +145,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # this is a hack to make the php plugin link with session.so (which on nixos is a separate package)
   # the hack works in coordination with ./additional-php-ldflags.patch
-  UWSGICONFIG_PHP_LDFLAGS = lib.optionalString (builtins.any (x: x.name == "php") needed) (
+  UWSGICONFIG_PHP_LDFLAGS = lib.optionalString (lib.elem "php" needed) (
     lib.concatStringsSep "," [
       "-Wl"
       "-rpath=${php-embed.extensions.session}/lib/php/extensions/"
@@ -176,7 +176,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  postFixup = lib.optionalString (builtins.any (x: x.name == "php") needed) ''
+  postFixup = lib.optionalString (lib.elem "php" needed) ''
     wrapProgram $out/bin/uwsgi --set PHP_INI_SCAN_DIR ${php-embed}/lib
   '';
 
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index 1f08a8b343fd..c34a640aeead 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.18.9";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uXNSwp+Qqw8drSt+SN20AjoJG9Pmaz0WCozFq8jEv2o=";
+    hash = "sha256-MJM8gwSMwdr83NN2Rt6hGf2tJUrmMdhUp5QtylsldtM=";
   };
 
-  vendorHash = "sha256-+GkxN20mZD/ZBTCjmjiDcEAJix2Ssn9HsNrUtQkrI18=";
+  vendorHash = "sha256-w3TSTM0WezYuajMPSy5OIWb5coE+SgIRuJISe1kYokg=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/by-name/yc/ycmd/package.nix b/pkgs/by-name/yc/ycmd/package.nix
index 520dd5f23461..6978a1b60085 100644
--- a/pkgs/by-name/yc/ycmd/package.nix
+++ b/pkgs/by-name/yc/ycmd/package.nix
@@ -130,7 +130,7 @@ stdenv.mkDerivation {
 
       ...  then set something similar to following in `programs.vim.extraConfig`;
 
-          let g:ycm_server_python_interpreter = "${python3.interpreter}"
+          let g:ycm_server_python_interpreter = "''${python3.interpreter}"
     '';
     mainProgram = "ycmd";
     homepage = "https://github.com/ycm-core/ycmd";
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 54bcc294ed12..b61742fa0849 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -54,25 +54,25 @@ let
   # Zoom versions are released at different times per platform and often with different versions.
   # We write them on three lines like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "6.6.0.64511";
-  versions.x86_64-darwin = "6.6.0.64511";
+  versions.aarch64-darwin = "6.6.5.67181";
+  versions.x86_64-darwin = "6.6.5.67181";
 
   # This is the fallback version so that evaluation can produce a meaningful result.
-  versions.x86_64-linux = "6.6.0.4410";
+  versions.x86_64-linux = "6.6.5.5215";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-2GdiJ/2K3TDF6nvVaIBVLJHgasx1e22aS4rhP30L2/o=";
+      hash = "sha256-u8jRZNtVM6QdFcrBK5BcO4yPCAMNmKUv1aGRGqdORGw=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-td0EltgpfSGlyo9Pg/4qS8qUdELP+A97iY9z3g19MW8=";
+      hash = "sha256-pKCzrW4Y9YFTS2FyLQR9WA+6oC2hdzzExpEN/VH3PnA=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-KTg6VO1GT/8ppXFevGDx0br9JGl9rdUtuBzHmnjiOuk=";
+      hash = "sha256-sh1PbAxLGd5zsBO6lsIJV7Z22o9A15xAdopdJZ17ZUw=";
     };
   };
 
@@ -175,6 +175,7 @@ let
       pkgs.glib.dev
       pkgs.gtk3
       pkgs.libGL
+      pkgs.libGLU
       pkgs.libdrm
       pkgs.libgbm
       pkgs.libkrb5
diff --git a/pkgs/data/icons/maia-icon-theme/default.nix b/pkgs/data/icons/maia-icon-theme/default.nix
index e0558ce70c38..295f595a57b1 100644
--- a/pkgs/data/icons/maia-icon-theme/default.nix
+++ b/pkgs/data/icons/maia-icon-theme/default.nix
@@ -39,6 +39,13 @@ stdenv.mkDerivation {
 
   dontWrapQtApps = true;
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0.0 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace {icons,icons-dark}/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.8)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   postInstall = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
diff --git a/pkgs/desktops/lxqt/compton-conf/default.nix b/pkgs/desktops/lxqt/compton-conf/default.nix
index fdb5fa86417d..f7fb175bcbd7 100644
--- a/pkgs/desktops/lxqt/compton-conf/default.nix
+++ b/pkgs/desktops/lxqt/compton-conf/default.nix
@@ -43,6 +43,11 @@ stdenv.mkDerivation rec {
       --replace-fail "DESTINATION \"\''${LXQT_ETC_XDG_DIR}" "DESTINATION \"etc/xdg" \
   '';
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1.0 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   passthru.updateScript = gitUpdater { };
 
   meta = with lib; {
diff --git a/pkgs/desktops/lxqt/libfm-qt/default.nix b/pkgs/desktops/lxqt/libfm-qt/default.nix
index 222b4e839514..1bbec0fcda3b 100644
--- a/pkgs/desktops/lxqt/libfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/libfm-qt/default.nix
@@ -67,6 +67,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.updateScript = gitUpdater { };
 
+  postPatch = lib.optionals (version == "1.4.0") ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1.0 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = {
     homepage = "https://github.com/lxqt/libfm-qt";
     description = "Core library of PCManFM-Qt (Qt binding for libfm)";
diff --git a/pkgs/desktops/lxqt/libqtxdg/default.nix b/pkgs/desktops/lxqt/libqtxdg/default.nix
index b5b23b1569a8..891ab5149f5a 100644
--- a/pkgs/desktops/lxqt/libqtxdg/default.nix
+++ b/pkgs/desktops/lxqt/libqtxdg/default.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
     )
   '';
 
+  postPatch = lib.optionals (version == "3.12.0") ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1.0 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   passthru.updateScript = gitUpdater { };
 
   meta = {
diff --git a/pkgs/desktops/lxqt/qtermwidget/default.nix b/pkgs/desktops/lxqt/qtermwidget/default.nix
index 9cf2f488b91d..594665c1b20a 100644
--- a/pkgs/desktops/lxqt/qtermwidget/default.nix
+++ b/pkgs/desktops/lxqt/qtermwidget/default.nix
@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = gitUpdater { };
 
+  postPatch = lib.optionals (version == "1.4.0") ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.1.0 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = with lib; {
     broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://github.com/lxqt/qtermwidget";
diff --git a/pkgs/desktops/mate/mate-notification-daemon/default.nix b/pkgs/desktops/mate/mate-notification-daemon/default.nix
index 2d71ec226d46..027faa67898f 100644
--- a/pkgs/desktops/mate/mate-notification-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-notification-daemon/default.nix
@@ -1,7 +1,9 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  autoconf-archive,
+  autoreconfHook,
   pkg-config,
   gettext,
   glib,
@@ -11,6 +13,7 @@
   gtk-layer-shell,
   gtk3,
   libxml2,
+  mate-common,
   mate-desktop,
   mate-panel,
   wrapGAppsHook3,
@@ -19,17 +22,22 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-notification-daemon";
-  version = "1.28.3";
+  version = "1.28.5";
 
-  src = fetchurl {
-    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-4Azssf+fdbnMwmRFWORDQ7gJQe20A3fdgQDtOSKt9BM=";
+  src = fetchFromGitHub {
+    owner = "mate-desktop";
+    repo = "mate-notification-daemon";
+    tag = "v${version}";
+    hash = "sha256-6N6lD63JL9xAtALn9URjYiCEhMZBC9TfIsrdalyY3YY=";
   };
 
   nativeBuildInputs = [
+    autoconf-archive
+    autoreconfHook
     pkg-config
     gettext
     libxml2 # for xmllint
+    mate-common # mate-common.m4 macros
     wrapGAppsHook3
   ];
 
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index c030a464e133..7c8ef2fbfb80 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation rec {
   ]
   ++
     lib.optionals
-      (lib.any (l: l == optimizationLevel) [
+      (lib.elem optimizationLevel [
         "0"
         "1"
         "2"
diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
index 1c44a92bf2a1..539005aac186 100644
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@@ -18,13 +18,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "dns";
-  version = "10.2.1";
+  version = "10.2.2";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${finalAttrs.version}/dns-${finalAttrs.version}.tbz";
-    hash = "sha256-tIjPTFFP1X1KLLKbmdQjSuaEXv8NXnmxBZ93n3NCR4o=";
+    hash = "sha256-USPXFn9fs6WrcM8LPMyWUInsRA3Aft6r+MBWjuc3p/A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/http-mirage-client/default.nix b/pkgs/development/ocaml-modules/http-mirage-client/default.nix
index 58f9852e8c86..4689be5ce7f0 100644
--- a/pkgs/development/ocaml-modules/http-mirage-client/default.nix
+++ b/pkgs/development/ocaml-modules/http-mirage-client/default.nix
@@ -12,14 +12,16 @@
   mirage-crypto-rng,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "http-mirage-client";
   version = "0.0.10";
 
   minimalOCamlVersion = "4.08";
 
+  __darwinAllowLocalNetworking = true;
+
   src = fetchurl {
-    url = "https://github.com/roburio/http-mirage-client/releases/download/v${version}/http-mirage-client-${version}.tbz";
+    url = "https://github.com/robur-coop/http-mirage-client/releases/download/v${finalAttrs.version}/http-mirage-client-${finalAttrs.version}.tbz";
     hash = "sha256-AXEIH1TIAayD4LkFv0yGD8OYvcdC/AJnGudGlkjcWLY=";
   };
 
@@ -40,9 +42,9 @@ buildDunePackage rec {
 
   meta = {
     description = "HTTP client for MirageOS";
-    homepage = "https://github.com/roburio/http-mirage-client";
+    homepage = "https://github.com/robur-coop/http-mirage-client";
+    changelog = "https://github.com/robur-coop/http-mirage-client/blob/v${finalAttrs.version}/CHANGES.md";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.vbgl ];
   };
-
-}
+})
diff --git a/pkgs/development/ocaml-modules/mirage-ptime/default.nix b/pkgs/development/ocaml-modules/mirage-ptime/default.nix
index 8d981684899a..fddd9a832657 100644
--- a/pkgs/development/ocaml-modules/mirage-ptime/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-ptime/default.nix
@@ -3,7 +3,7 @@
   buildDunePackage,
   fetchurl,
   ptime,
-  version ? "5.1.0",
+  version ? "5.2.0",
 }:
 
 buildDunePackage {
@@ -13,7 +13,7 @@ buildDunePackage {
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-ptime/releases/download/v${version}/mirage-ptime-${version}.tbz";
-    hash = "sha256-6bPbMTZeGolRMMN4nmrc+ZZ3HqjnAWtj4V7L4fOKKfY=";
+    hash = "sha256-YOWpJrfQKG9khCwPb5lZXtf+fip4N0B1AAn2Y9zRLyg=";
   };
 
   propagatedBuildInputs = [ ptime ];
diff --git a/pkgs/development/python-modules/distro-info/default.nix b/pkgs/development/python-modules/distro-info/default.nix
new file mode 100644
index 000000000000..debef819aef3
--- /dev/null
+++ b/pkgs/development/python-modules/distro-info/default.nix
@@ -0,0 +1,45 @@
+{
+  buildPythonPackage,
+  distro-info-data,
+  fetchurl,
+  lib,
+  setuptools,
+  unittestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "distro-info";
+  version = "1.14";
+  pyproject = true;
+
+  # Not using fetchFromGitLab because it incorrectly sets
+  # SOURCE_DATE_EPOCH=315619200 (1980-01-02) and breaks tests.
+  src = fetchurl {
+    url = "https://salsa.debian.org/debian/distro-info/-/archive/debian/${version}/distro-info-debian-${version}.tar.gz";
+    hash = "sha256-nRLTlDPnll1jvwfg9FSxs9TmImvQkn9DVqSRSOKTAGI=";
+  };
+
+  postPatch = ''
+    substituteInPlace python/distro_info.py \
+      --replace-fail /usr/share/distro-info ${distro-info-data}/share/distro-info
+  '';
+
+  build-system = [ setuptools ];
+  pypaBuildFlags = "python";
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+  preCheck = ''
+    cd python
+    rm distro_info_test/test_flake8.py distro_info_test/test_pylint.py
+  '';
+
+  meta = {
+    description = "Information about Debian and Ubuntu releases";
+    homepage = "https://salsa.debian.org/debian/distro-info";
+    changelog = "https://salsa.debian.org/debian/distro-info/-/blob/debian/${version}/debian/changelog";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ andersk ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/python-modules/dramatiq-abort/default.nix b/pkgs/development/python-modules/dramatiq-abort/default.nix
index b4130f701bfe..655d2da4ec0f 100644
--- a/pkgs/development/python-modules/dramatiq-abort/default.nix
+++ b/pkgs/development/python-modules/dramatiq-abort/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
     gevent = [ gevent ];
     redis = [ redis ];
   };
diff --git a/pkgs/development/python-modules/markdown2/default.nix b/pkgs/development/python-modules/markdown2/default.nix
index d417fb25ca10..e4a6cfd497a0 100644
--- a/pkgs/development/python-modules/markdown2/default.nix
+++ b/pkgs/development/python-modules/markdown2/default.nix
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     code_syntax_highlighting = [ pygments ];
     wavedrom = [ wavedrom ];
     latex = [ latex2mathml ];
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/mat2/bubblewrap-path.patch b/pkgs/development/python-modules/mat2/bubblewrap-path.patch
deleted file mode 100644
index 2c71930b6df8..000000000000
--- a/pkgs/development/python-modules/mat2/bubblewrap-path.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-diff --git a/libmat2/bubblewrap.py b/libmat2/bubblewrap.py
-index 970d5dd..5d3c0b7 100644
---- a/libmat2/bubblewrap.py
-+++ b/libmat2/bubblewrap.py
-@@ -22,11 +22,7 @@ CalledProcessError = subprocess.CalledProcessError
- 
- 
- def _get_bwrap_path() -> str:
--    which_path = shutil.which('bwrap')
--    if which_path:
--        return which_path
--
--    raise RuntimeError("Unable to find bwrap")  # pragma: no cover
-+    return '@bwrap@'
- 
- 
- def _get_bwrap_args(tempdir: str,
-@@ -37,16 +33,11 @@ def _get_bwrap_args(tempdir: str,
- 
-     # XXX: use --ro-bind-try once all supported platforms
-     # have a bubblewrap recent enough to support it.
--    ro_bind_dirs = ['/usr', '/lib', '/lib64', '/bin', '/sbin', '/etc/alternatives', cwd]
-+    ro_bind_dirs = ['/nix/store', cwd]
-     for bind_dir in ro_bind_dirs:
-         if os.path.isdir(bind_dir):  # pragma: no cover
-             ro_bind_args.extend(['--ro-bind', bind_dir, bind_dir])
- 
--    ro_bind_files = ['/etc/ld.so.cache']
--    for bind_file in ro_bind_files:
--        if os.path.isfile(bind_file):  # pragma: no cover
--            ro_bind_args.extend(['--ro-bind', bind_file, bind_file])
--
-     args = ro_bind_args + \
-         ['--dev', '/dev',
-          '--proc', '/proc',
diff --git a/pkgs/development/python-modules/mat2/default.nix b/pkgs/development/python-modules/mat2/default.nix
index 19ec148450c4..f6ff184eb2c0 100644
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@@ -3,54 +3,40 @@
   stdenv,
   buildPythonPackage,
   pytestCheckHook,
-  fetchFromGitLab,
+  fetchFromGitHub,
   fetchpatch,
   replaceVars,
-  bubblewrap,
   exiftool,
   ffmpeg,
   setuptools,
   wrapGAppsHook3,
   gdk-pixbuf,
+  gnome,
   gobject-introspection,
   librsvg,
   poppler_gi,
+  webp-pixbuf-loader,
   mutagen,
   pygobject3,
   pycairo,
   dolphinIntegration ? false,
   kdePackages,
+  versionCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "mat2";
-  version = "0.13.5";
+  version = "0.14.0";
   pyproject = true;
 
-  src = fetchFromGitLab {
-    domain = "0xacab.org";
+  src = fetchFromGitHub {
     owner = "jvoisin";
     repo = "mat2";
     tag = version;
-    hash = "sha256-ivFgH/88DBucZRaO/OMsLlwJCjv/VQXb6AiKWhZ8XH0=";
+    hash = "sha256-JTt2/PuSxOXXHUuRP42y8jxw09mNMMz1piJM4ldnjq0=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "exiftool-13.25-compat.patch";
-      url = "https://0xacab.org/jvoisin/mat2/-/commit/473903b70e1b269a6110242a9c098a10c18554e2.patch";
-      hash = "sha256-vxxjAFwiTDlcTT3ZlfhOG4rlzBJS+LhLoA++8y2hEok=";
-    })
-    (fetchpatch {
-      name = "fix-test-on-python313.patch";
-      url = "https://0xacab.org/jvoisin/mat2/-/commit/f07344444d6d2f04a1f93e2954f4910b194bee0c.patch";
-      hash = "sha256-y756sKkjGO11A2lrRsXAwWgupOZ00u0cDypvkbsiNbY=";
-    })
-    (fetchpatch {
-      name = "fix-test-on-python312.patch";
-      url = "https://0xacab.org/jvoisin/mat2/-/commit/7a8ea224bc327b8ee929379d577c74968ea1c352.patch";
-      hash = "sha256-pPiYhoql5WhjhLKvd6y3OnvxORSbXIGCsZMc7UH3i1Q=";
-    })
     # hardcode paths to some binaries
     (replaceVars ./paths.patch {
       exiftool = lib.getExe exiftool;
@@ -64,11 +50,6 @@ buildPythonPackage rec {
     ./executable-name.patch
     # hardcode path to mat2 executable
     ./tests.patch
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux) [
-    (replaceVars ./bubblewrap-path.patch {
-      bwrap = lib.getExe bubblewrap;
-    })
   ];
 
   postPatch = ''
@@ -86,7 +67,6 @@ buildPythonPackage rec {
 
   buildInputs = [
     gdk-pixbuf
-    librsvg
     poppler_gi
   ];
 
@@ -97,6 +77,15 @@ buildPythonPackage rec {
   ];
 
   postInstall = ''
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          librsvg
+          webp-pixbuf-loader
+        ];
+      }
+    }"
+
     install -Dm 444 data/mat2.svg -t "$out/share/icons/hicolor/scalable/apps"
     install -Dm 444 doc/mat2.1 -t "$out/share/man/man1"
   ''
@@ -106,12 +95,15 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  meta = {
     description = "Handy tool to trash your metadata";
-    homepage = "https://0xacab.org/jvoisin/mat2";
-    changelog = "https://0xacab.org/jvoisin/mat2/-/blob/${version}/CHANGELOG.md";
-    license = licenses.lgpl3Plus;
+    homepage = "https://github.com/jvoisin/mat2";
+    changelog = "https://github.com/jvoisin/mat2/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.lgpl3Plus;
     mainProgram = "mat2";
-    maintainers = with maintainers; [ dotlambda ];
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/development/python-modules/odc-loader/default.nix b/pkgs/development/python-modules/odc-loader/default.nix
index e97bb7e87dc6..6fb6f3422ca8 100644
--- a/pkgs/development/python-modules/odc-loader/default.nix
+++ b/pkgs/development/python-modules/odc-loader/default.nix
@@ -50,7 +50,7 @@ buildPythonPackage rec {
   optional-dependencies = {
     botocore = [ botocore ];
     zarr = [ zarr ];
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pettingzoo/default.nix b/pkgs/development/python-modules/pettingzoo/default.nix
index 1409b29e3633..e8fa3a1ed962 100644
--- a/pkgs/development/python-modules/pettingzoo/default.nix
+++ b/pkgs/development/python-modules/pettingzoo/default.nix
@@ -53,7 +53,7 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
     atari = [
       # multi-agent-ale-py
       pygame
diff --git a/pkgs/development/python-modules/planetary-computer/default.nix b/pkgs/development/python-modules/planetary-computer/default.nix
index 7014512b6e4c..7bc6d0d61641 100644
--- a/pkgs/development/python-modules/planetary-computer/default.nix
+++ b/pkgs/development/python-modules/planetary-computer/default.nix
@@ -55,7 +55,7 @@ buildPythonPackage rec {
   optional-dependencies = {
     adlfs = [ adlfs ];
     azure = [ azure-storage-blob ];
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pulsar-client/default.nix b/pkgs/development/python-modules/pulsar-client/default.nix
index 3c9b5303ad7d..2919a84f8e79 100644
--- a/pkgs/development/python-modules/pulsar-client/default.nix
+++ b/pkgs/development/python-modules/pulsar-client/default.nix
@@ -67,7 +67,7 @@ buildPythonPackage rec {
       ratelimit
     ];
     avro = [ fastavro ];
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pylint-odoo/default.nix b/pkgs/development/python-modules/pylint-odoo/default.nix
index c9a6d80ed969..6e67fa12b5ea 100644
--- a/pkgs/development/python-modules/pylint-odoo/default.nix
+++ b/pkgs/development/python-modules/pylint-odoo/default.nix
@@ -8,14 +8,14 @@
 }:
 buildPythonPackage rec {
   pname = "pylint-odoo";
-  version = "9.3.21";
+  version = "9.3.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "OCA";
     repo = "pylint-odoo";
     tag = "v${version}";
-    hash = "sha256-qNZHk8bl1mxaLzS55oV29iKGDfIKumQgME1V9PIx4vQ=";
+    hash = "sha256-qSeDnfZCdEtXAXeAJ+mEbDH5Fbxj9ghiucwlz1mIMnI=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pyproject-parser/default.nix b/pkgs/development/python-modules/pyproject-parser/default.nix
index f3108c431c3f..95a7a7e4c2c6 100644
--- a/pkgs/development/python-modules/pyproject-parser/default.nix
+++ b/pkgs/development/python-modules/pyproject-parser/default.nix
@@ -46,7 +46,7 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
     cli = [
       click
       consolekit
diff --git a/pkgs/development/python-modules/pysnmp/default.nix b/pkgs/development/python-modules/pysnmp/default.nix
index e979bc82acf0..46b25ee5c45c 100644
--- a/pkgs/development/python-modules/pysnmp/default.nix
+++ b/pkgs/development/python-modules/pysnmp/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pysnmp";
-  version = "7.1.21";
+  version = "7.1.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lextudio";
     repo = "pysnmp";
     tag = "v${version}";
-    hash = "sha256-IbVs/fjNRDhp4a78ZbgqUOxyrlZjEwsKSlQV3+mmCjo=";
+    hash = "sha256-uEOhOVXaz4g1Ciun8x2AT8pRBkKR6uEfu4KJ1XSwouY=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/python-snoo/default.nix b/pkgs/development/python-modules/python-snoo/default.nix
index 05239538a597..044b5491edab 100644
--- a/pkgs/development/python-modules/python-snoo/default.nix
+++ b/pkgs/development/python-modules/python-snoo/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "python-snoo";
-  version = "0.9.0";
+  version = "0.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lash-L";
     repo = "python-snoo";
     tag = "v${version}";
-    hash = "sha256-HLX8eVhAZbydZNbBAwi7F4qloZImPZlts4CDyFLIeGE=";
+    hash = "sha256-p0cKIDdSQwryagvHGjydSTR4O5lAPO7UMhw+tSIxZrY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/roadrecon/default.nix b/pkgs/development/python-modules/roadrecon/default.nix
index 3eb00bdd7ec2..81e137aae936 100644
--- a/pkgs/development/python-modules/roadrecon/default.nix
+++ b/pkgs/development/python-modules/roadrecon/default.nix
@@ -10,7 +10,6 @@
   marshmallow,
   marshmallow-sqlalchemy,
   openpyxl,
-  pythonOlder,
   roadlib,
   setuptools,
   sqlalchemy,
@@ -18,23 +17,19 @@
 
 buildPythonPackage rec {
   pname = "roadrecon";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JJJPQcgZOdqyAXYgLmCQuNBhSGwg8WIDW8+2jfVyvyc=";
+    hash = "sha256-v8IUnJlREtKMnhJtdKtChcxM/IKNKRuHA79V38zxLGY=";
   };
 
   pythonRelaxDeps = [ "flask" ];
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     flask
     flask-cors
@@ -47,6 +42,9 @@ buildPythonPackage rec {
     sqlalchemy
   ];
 
+  # Module has no tests
+  doCheck = false;
+
   pythonImportsCheck = [ "roadtools.roadrecon" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/stringzilla/default.nix b/pkgs/development/python-modules/stringzilla/default.nix
index 35876032eea4..131ce9ae00c6 100644
--- a/pkgs/development/python-modules/stringzilla/default.nix
+++ b/pkgs/development/python-modules/stringzilla/default.nix
@@ -6,31 +6,20 @@
   pytest-repeat,
   pytestCheckHook,
   setuptools,
-  stdenv,
 }:
 
 buildPythonPackage rec {
   pname = "stringzilla";
-  version = "4.2.1";
+  version = "4.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ashvardanian";
     repo = "stringzilla";
     tag = "v${version}";
-    hash = "sha256-0CIekVxChvH912vFnBF2FR1YyIpxi3SD7KhBlh7yFGA=";
+    hash = "sha256-J1k8gYPStnnXHFvbHG6nHuQMQy1+XSiS5ERk/reL/Z4=";
   };
 
-  # Define _POSIX_C_SOURCE to enable POSIX signal handling for ARM capability detection
-  # See: https://github.com/ashvardanian/StringZilla/pull/263
-  env.NIX_CFLAGS_COMPILE = "-D_POSIX_C_SOURCE=200809L";
-
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # error: unsupported option '-mfloat-abi=' for target 'aarch64-apple-darwin'
-    substituteInPlace setup.py \
-      --replace-fail '"-mfloat-abi=hard",' ""
-  '';
-
   build-system = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/tianshou/default.nix b/pkgs/development/python-modules/tianshou/default.nix
index 7cb9052c2d02..2012e3f360a9 100644
--- a/pkgs/development/python-modules/tianshou/default.nix
+++ b/pkgs/development/python-modules/tianshou/default.nix
@@ -92,7 +92,7 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
 
     argparse = [
       docstring-parser
diff --git a/pkgs/development/python-modules/whey/default.nix b/pkgs/development/python-modules/whey/default.nix
index ace0f3fbad75..e07c68a3a423 100644
--- a/pkgs/development/python-modules/whey/default.nix
+++ b/pkgs/development/python-modules/whey/default.nix
@@ -55,7 +55,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "whey" ];
 
   optional-dependencies = {
-    all = lib.flatten (lib.attrValues (lib.filterAttrs (n: v: n != "all") optional-dependencies));
+    all = lib.flatten (lib.attrValues (lib.removeAttrs optional-dependencies [ "all" ]));
     editable = [
       editables
     ];
diff --git a/pkgs/development/ruby-modules/testing/stubs.nix b/pkgs/development/ruby-modules/testing/stubs.nix
index b0258988888f..614dcd822f4a 100644
--- a/pkgs/development/ruby-modules/testing/stubs.nix
+++ b/pkgs/development/ruby-modules/testing/stubs.nix
@@ -14,7 +14,7 @@ let
         builtins.toJSON (
           lib.filterAttrs (
             n: v:
-            builtins.any (x: x == n) [
+            builtins.elem n [
               "name"
               "system"
             ]
diff --git a/pkgs/development/tools/haskell/haskell-language-server/withWrapper.nix b/pkgs/development/tools/haskell/haskell-language-server/withWrapper.nix
index 2beaa3ed8e45..600a1acd6de6 100644
--- a/pkgs/development/tools/haskell/haskell-language-server/withWrapper.nix
+++ b/pkgs/development/tools/haskell/haskell-language-server/withWrapper.nix
@@ -99,7 +99,7 @@ let
     let
       # only formatters that were not requested
       unwanted = lib.pipe knownFormatters [
-        (lib.filterAttrs (fmt: _: !(lib.elem fmt supportedFormatters)))
+        (fmts: lib.removeAttrs fmts supportedFormatters)
         lib.attrsToList
       ];
       # all flags to disable
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index ddda525e70b0..6719de2e3468 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -57,7 +57,7 @@
         in
         {
           name = lib.removeSuffix ".patch" src.name;
-          patch = fetchurl (lib.filterAttrs (k: v: k != "extra") src);
+          patch = fetchurl (lib.removeAttrs src [ "extra" ]);
           extra = src.extra;
           inherit version sha256;
         };
diff --git a/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix b/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
index 9880425393dd..4d4e61a5942f 100644
--- a/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
@@ -26,11 +26,6 @@ stdenv.mkDerivation rec {
     inherit sha256;
   };
 
-  phases = [
-    "unpackPhase"
-    "installPhase"
-  ];
-
   installPhase = ''
     mkdir -p $out/{bin,share/nvidia-fabricmanager}
     for bin in nv{-fabricmanager,switch-audit};do
diff --git a/pkgs/os-specific/linux/tuxedo-drivers/default.nix b/pkgs/os-specific/linux/tuxedo-drivers/default.nix
index 2023553cd3db..db9efc0dc13a 100644
--- a/pkgs/os-specific/linux/tuxedo-drivers/default.nix
+++ b/pkgs/os-specific/linux/tuxedo-drivers/default.nix
@@ -13,17 +13,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tuxedo-drivers-${kernel.version}";
-  version = "4.15.4";
+  version = "4.16.0";
 
   src = fetchFromGitLab {
     group = "tuxedocomputers";
     owner = "development/packages";
     repo = "tuxedo-drivers";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WJeju+czbCw03ALW7yzGAFENCEAvDdKqHvedchd7NVY=";
+    hash = "sha256-NjKhr8wsnoKSFx5kEXVaQ2SQzAX8XG8ENpYKOSMB2yc=";
   };
 
-  patches = [ ./no-cp-etc-usr.patch ];
+  patches = [ ./no-cp-usr.patch ];
 
   postInstall = ''
     echo "Running postInstallhook"
@@ -71,6 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
       keksgesicht
       xaverdh
       XBagon
+      wetisobe
     ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/tuxedo-drivers/no-cp-etc-usr.patch b/pkgs/os-specific/linux/tuxedo-drivers/no-cp-usr.patch
similarity index 93%
rename from pkgs/os-specific/linux/tuxedo-drivers/no-cp-etc-usr.patch
rename to pkgs/os-specific/linux/tuxedo-drivers/no-cp-usr.patch
index 9e94a43d60c5..124b79c98a17 100644
--- a/pkgs/os-specific/linux/tuxedo-drivers/no-cp-etc-usr.patch
+++ b/pkgs/os-specific/linux/tuxedo-drivers/no-cp-usr.patch
@@ -6,7 +6,7 @@ index 75a6bc1..6021d42 100644
  
  install: all
  	make -C $(KDIR) M=$(PWD) $(MAKEFLAGS) modules_install
--	cp -r etc usr /
+-	cp -r usr /
  
  clean:
  	make -C $(KDIR) M=$(PWD) $(MAKEFLAGS) clean
diff --git a/pkgs/os-specific/linux/zfs/generic.nix b/pkgs/os-specific/linux/zfs/generic.nix
index 457d4cb144e6..9513e3e7a85d 100644
--- a/pkgs/os-specific/linux/zfs/generic.nix
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@@ -57,7 +57,7 @@ let
 
     let
       inherit (lib)
-        any
+        elem
         optionalString
         optionals
         optional
@@ -66,11 +66,11 @@ let
 
       smartmon = smartmontools.override { inherit enableMail; };
 
-      buildKernel = any (n: n == configFile) [
+      buildKernel = elem configFile [
         "kernel"
         "all"
       ];
-      buildUser = any (n: n == configFile) [
+      buildUser = elem configFile [
         "user"
         "all"
       ];
diff --git a/pkgs/os-specific/windows/default.nix b/pkgs/os-specific/windows/default.nix
index 98f438554ac0..137a948960b7 100644
--- a/pkgs/os-specific/windows/default.nix
+++ b/pkgs/os-specific/windows/default.nix
@@ -28,8 +28,12 @@ lib.makeScope newScope (
         buildPackages.gccWithoutTargetLibc.override (old: {
           bintools = old.bintools.override {
             libc = pkgs.libc;
+            noLibc = pkgs.libc == null;
+            nativeLibc = false;
           };
           libc = pkgs.libc;
+          noLibc = pkgs.libc == null;
+          nativeLibc = false;
         })
     );
 
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index acd755224619..81c297d1b898 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "0.13.0-unstable-2025-09-26";
+  version = "0.13.0-unstable-2025-10-23";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "af17c8c238ba8cdeaaabb87b25a3ca2375b47c11";
-    sha256 = "sha256-n3t58gsPXxlf2DnrofI28/0ZRC4EwnZvoFKxgxZ9vYA=";
+    rev = "6465921a5adb3a3335494598463066a6c3540cb5";
+    sha256 = "sha256-UKLJ+sf2g6BSbF+aNZ+QGcqVjFkV5GX9Sei6BCdqQL4=";
   };
 
   sourceRoot = "${src.name}/klippy";
diff --git a/pkgs/servers/web-apps/wordpress/packages/default.nix b/pkgs/servers/web-apps/wordpress/packages/default.nix
index 5fafdd153413..c7630cbeb1a5 100644
--- a/pkgs/servers/web-apps/wordpress/packages/default.nix
+++ b/pkgs/servers/web-apps/wordpress/packages/default.nix
@@ -43,7 +43,7 @@ let
           license,
           ...
         }@args:
-        assert lib.any (x: x == type) [
+        assert lib.elem type [
           "plugin"
           "theme"
           "language"
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index f7c5262acc98..a63e0c9b074b 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -731,7 +731,10 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
           (disallowedPackages prevStage)
           # Only cctools and ld64 are rebuilt from `bintoolsPackages` to avoid rebuilding their dependencies
           # again in this stage after building them in stage 1.
-          (lib.filterAttrs (name: _: name != "ld64" && name != "cctools") (bintoolsPackages prevStage))
+          (lib.removeAttrs (bintoolsPackages prevStage) [
+            "ld64"
+            "cctools"
+          ])
           (llvmToolsDeps prevStage)
           (sdkPackages prevStage)
           (sdkPackagesNoCC prevStage)
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index b27e59860e39..d00df6ff4139 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -426,7 +426,7 @@ let
 
       concretizeFlagImplications =
         flag: impliesFlags: list:
-        if any (x: x == flag) list then (list ++ impliesFlags) else list;
+        if builtins.elem flag list then (list ++ impliesFlags) else list;
 
       hardeningDisable' = unique (
         pipe hardeningDisable [
diff --git a/pkgs/tools/networking/maubot/plugins/generated.nix b/pkgs/tools/networking/maubot/plugins/generated.nix
index dbaee26f8853..9e7bf10ac8c3 100644
--- a/pkgs/tools/networking/maubot/plugins/generated.nix
+++ b/pkgs/tools/networking/maubot/plugins/generated.nix
@@ -69,7 +69,7 @@ lib.flip builtins.mapAttrs json (
             );
           in
           spdxLicenses.${spdx};
-        broken = builtins.any (x: x == null) reqDeps;
+        broken = builtins.elem null reqDeps;
       };
     }
     // lib.optionalAttrs (entry.isPoetry or false) {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a65855a2a2aa..6d0597a9052b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3812,6 +3812,8 @@ self: super: with self; {
 
   distro = callPackage ../development/python-modules/distro { };
 
+  distro-info = callPackage ../development/python-modules/distro-info { };
+
   distutils =
     if pythonOlder "3.12" then null else callPackage ../development/python-modules/distutils { };