diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 0f7ac9ea0f91..0c77c146d335 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -72,6 +72,8 @@
   The binary name remains `webfontkitgenerator`.
   The `webfontkitgenerator` package is an alias to `webfont-bundler`.
 
+- `python3Packages.triton` no longer takes an `enableRocm` argument and supports ROCm in all build configurations via runtime binding. In most cases no action will be needed. If triton is unable to find the HIP SDK add `rocmPackages.clr` as a build input or set the environment variable `HIP_PATH="${rocmPackages.clr}"`.
+
 - `inspircd` has been updated to the v4 release series. Please refer to the upstream documentation for [general information](https://docs.inspircd.org/4/overview/#v4-overview) and a list of [breaking changes](https://docs.inspircd.org/4/breaking-changes/).
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
@@ -95,6 +97,8 @@
 
 - `privatebin` has been updated to `2.0.0`. This release changes configuration defaults including switching the template and removing legacy features. See the [v2.0.0 changelog entry](https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.0) for details on how to upgrade.
 
+- `rocmPackages.triton` has been removed in favor of `python3Packages.triton`.
+
 - `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with it's [upstream support lifecycle](https://vektra.github.io/mockery/
 
 - [private-gpt](https://github.com/zylon-ai/private-gpt) service has been removed by lack of maintenance upstream.
diff --git a/lib/lists.nix b/lib/lists.nix
index 226e264176a0..3d324e545dd4 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -829,7 +829,7 @@ rec {
     toList [ 1 2 ]
     => [ 1 2 ]
     toList "hi"
-    => [ "hi "]
+    => [ "hi" ]
     ```
 
     :::
diff --git a/nixos/README-modular-services.md b/nixos/README-modular-services.md
index 6bb5c83626f5..f6e933173b2c 100644
--- a/nixos/README-modular-services.md
+++ b/nixos/README-modular-services.md
@@ -51,6 +51,10 @@ A [`_class`](https://nixos.org/manual/nixpkgs/unstable/#module-system-lib-evalMo
 Provide it as the first attribute in the module:
 
 ```nix
+# Non-module dependencies (`importApply`)
+{ writeScript, runtimeShell }:
+
+# Service module
 { lib, config, ... }:
 {
   _class = "service";
@@ -87,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     services = {
       default = {
-        imports = [ ./service.nix ];
+        imports = [ (lib.modules.importApply ./service.nix { inherit pkgs; }) ];
         example.package = finalAttrs.finalPackage;
         # ...
       };
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 33a2e250f0a3..b552986f526b 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -25,6 +25,7 @@ let
     escapeShellArg
     concatMapStringsSep
     sourceFilesBySuffices
+    modules
     ;
 
   common = import ./common.nix;
@@ -129,7 +130,16 @@ let
   '';
 
   portableServiceOptions = buildPackages.nixosOptionsDoc {
-    inherit (evalModules { modules = [ ../../modules/system/service/portable/service.nix ]; }) options;
+    inherit
+      (evalModules {
+        modules = [
+          (modules.importApply ../../modules/system/service/portable/service.nix {
+            pkgs = throw "nixos docs / portableServiceOptions: Do not reference pkgs in docs";
+          })
+        ];
+      })
+      options
+      ;
     inherit revision warningsAreErrors;
     transformOptions =
       opt:
diff --git a/nixos/doc/manual/development/modular-services.md b/nixos/doc/manual/development/modular-services.md
index 963da8f32b0b..c616b51fa933 100644
--- a/nixos/doc/manual/development/modular-services.md
+++ b/nixos/doc/manual/development/modular-services.md
@@ -85,7 +85,9 @@ Moving their logic into separate Nix files may still be beneficial for the effic
 
 ## Writing and Reviewing a Modular Service {#modular-service-review}
 
-Refer to the contributor documentation in [`nixos/README-modular-services.md`](https://github.com/NixOS/nixpkgs/blob/master/nixos/README-modular-services.md).
+A typical service module consists of the following:
+
+For more details, refer to the contributor documentation in [`nixos/README-modular-services.md`](https://github.com/NixOS/nixpkgs/blob/master/nixos/README-modular-services.md).
 
 ## Portable Service Options {#modular-service-options-portable}
 
diff --git a/nixos/modules/system/service/README.md b/nixos/modules/system/service/README.md
index 667abb511f52..fa4d0204611e 100644
--- a/nixos/modules/system/service/README.md
+++ b/nixos/modules/system/service/README.md
@@ -53,3 +53,93 @@ Many services implement automatic reloading or reloading on e.g. `SIGUSR1`, but
 
 - **Simple attribute structure**: Unlike `environment.etc`, `configData` uses a simpler structure with just `enable`, `name`, `text`, `source`, and `path` attributes. Complex ownership options were omitted for simplicity and portability.
   Per-service user creation is still TBD.
+
+## No `pkgs` module argument
+
+The modular service infrastructure avoids exposing `pkgs` as a module argument to service modules. Instead, derivations and builder functions are provided through lexical closure, making dependency relationships explicit and avoiding uncertainty about where dependencies come from.
+
+### Benefits
+
+- **Explicit dependencies**: Services declare what they need rather than implicitly depending on `pkgs`
+- **No interference**: Service modules can be reused in different contexts without assuming a specific `pkgs` instance. An unexpected `pkgs` version is not a failure mode anymore.
+- **Clarity**: With fewer ways to do things, there's no ambiguity about where dependencies come from (from the module, not the OS or service manager)
+
+### Implementation
+
+- **Portable layer**: Service modules in `portable/` do not receive `pkgs` as a module argument. Any required derivations must be provided by the caller.
+
+- **Systemd integration**: The `systemd/system.nix` module imports `config-data.nix` as a function, providing `pkgs` in lexical closure:
+  ```nix
+  (import ../portable/config-data.nix { inherit pkgs; })
+  ```
+
+- **Service modules**:
+  1. Should explicitly declare their package dependencies as options rather than using `pkgs` defaults:
+    ```nix
+    {
+      # Bad: uses pkgs module argument
+      foo.package = mkOption {
+        default = pkgs.python3;
+        # ...
+      };
+    }
+    ```
+
+    ```nix
+    {
+      # Good: caller provides the package
+      foo.package = mkOption {
+        type = types.package;
+        description = "Python package to use";
+        defaultText = lib.literalMD "The package that provided this module.";
+      };
+    }
+    ```
+
+  2. `passthru.services` can still provide a complete module using the package's lexical scope, making the module truly self-contained:
+
+    **Package (`package.nix`):**
+    ```nix
+    {
+      lib,
+      writeScript,
+      runtimeShell,
+    # ... other dependencies
+    }:
+    stdenv.mkDerivation (finalAttrs: {
+      # ... package definition
+
+      passthru.services.default = {
+        imports = [
+          (lib.modules.importApply ./service.nix {
+            inherit writeScript runtimeShell;
+          })
+        ];
+        someService.package = finalAttrs.finalPackage;
+      };
+    })
+    ```
+
+    **Service module (`service.nix`):**
+    ```nix
+    # Non-module dependencies (importApply)
+    { writeScript, runtimeShell }:
+
+    # Service module
+    {
+      lib,
+      config,
+      options,
+      ...
+    }:
+    {
+      # Service definition using writeScript, runtimeShell from lexical scope
+      process.argv = [
+        (writeScript "wrapper" ''
+          #!${runtimeShell}
+          # ... wrapper logic
+        '')
+        # ... other args
+      ];
+    }
+    ```
diff --git a/nixos/modules/system/service/portable/config-data.nix b/nixos/modules/system/service/portable/config-data.nix
index 84c4d53452a9..63f570140b55 100644
--- a/nixos/modules/system/service/portable/config-data.nix
+++ b/nixos/modules/system/service/portable/config-data.nix
@@ -1,10 +1,13 @@
 # Tests in: ../../../../tests/modular-service-etc/test.nix
+
+# Non-modular context provided by the modular services integration.
+{ pkgs }:
+
 # Configuration data support for portable services
 # This module provides configData for services, enabling configuration reloading
 # without terminating and restarting the service process.
 {
   lib,
-  pkgs,
   ...
 }:
 let
diff --git a/nixos/modules/system/service/portable/lib.nix b/nixos/modules/system/service/portable/lib.nix
index 0529f81f8561..88db80f91494 100644
--- a/nixos/modules/system/service/portable/lib.nix
+++ b/nixos/modules/system/service/portable/lib.nix
@@ -1,6 +1,11 @@
 { lib, ... }:
 let
-  inherit (lib) concatLists mapAttrsToList showOption;
+  inherit (lib)
+    concatLists
+    mapAttrsToList
+    showOption
+    types
+    ;
 in
 rec {
   flattenMapServicesConfigToList =
@@ -30,4 +35,43 @@ rec {
       assertion = ass.assertion;
     }) config.assertions
   );
+
+  /**
+    This is the entrypoint for the portable part of modular services.
+
+    It provides the various options that are consumed by service manager implementations.
+
+    # Inputs
+
+    `serviceManagerPkgs`: A Nixpkgs instance which will be used for built-in logic such as converting `configData.<path>.text` to a store path.
+
+    `extraRootModules`: Modules to be loaded into the "root" service submodule, but not into its sub-`services`. That's the modules' own responsibility.
+
+    `extraRootSpecialArgs`: Fixed module arguments that are provided in a similar manner to `extraRootModules`.
+
+    # Output
+
+    An attribute set.
+
+    `serviceSubmodule`: a Module System option type which is a `submodule` with the portable modules and this function's inputs loaded into it.
+  */
+  configure =
+    {
+      serviceManagerPkgs,
+      extraRootModules ? [ ],
+      extraRootSpecialArgs ? { },
+    }:
+    let
+      modules = [
+        (lib.modules.importApply ./service.nix { pkgs = serviceManagerPkgs; })
+      ];
+      serviceSubmodule = types.submoduleWith {
+        class = "service";
+        modules = modules ++ extraRootModules;
+        specialArgs = extraRootSpecialArgs;
+      };
+    in
+    {
+      inherit serviceSubmodule;
+    };
 }
diff --git a/nixos/modules/system/service/portable/service.nix b/nixos/modules/system/service/portable/service.nix
index a2d86274ec29..77befdfb63d6 100644
--- a/nixos/modules/system/service/portable/service.nix
+++ b/nixos/modules/system/service/portable/service.nix
@@ -1,3 +1,9 @@
+# Non-module arguments
+# These are separate from the module arguments to avoid implicit dependencies.
+# This makes service modules self-contains, allowing mixing of Nixpkgs versions.
+{ pkgs }:
+
+# The module
 {
   lib,
   ...
@@ -12,14 +18,14 @@ in
   imports = [
     ../../../../../modules/generic/meta-maintainers.nix
     ../../../misc/assertions.nix
-    ./config-data.nix
+    (lib.modules.importApply ./config-data.nix { inherit pkgs; })
   ];
   options = {
     services = mkOption {
       type = types.attrsOf (
         types.submoduleWith {
           modules = [
-            ./service.nix
+            (lib.modules.importApply ./service.nix { inherit pkgs; })
           ];
         }
       );
diff --git a/nixos/modules/system/service/portable/test.nix b/nixos/modules/system/service/portable/test.nix
index 5f78208dc4eb..f1d508805870 100644
--- a/nixos/modules/system/service/portable/test.nix
+++ b/nixos/modules/system/service/portable/test.nix
@@ -7,6 +7,12 @@ let
 
   portable-lib = import ./lib.nix { inherit lib; };
 
+  configured = portable-lib.configure {
+    serviceManagerPkgs = throw "do not use pkgs in this test";
+    extraRootModules = [ ];
+    extraRootSpecialArgs = { };
+  };
+
   dummyPkg =
     name:
     derivation {
@@ -79,23 +85,25 @@ let
     modules = [
       {
         options.services = mkOption {
-          type = types.attrsOf (
-            types.submoduleWith {
-              class = "service";
-              modules = [
-                ./service.nix
-              ];
-            }
-          );
+          type = types.attrsOf configured.serviceSubmodule;
         };
       }
       exampleConfig
     ];
   };
 
+  filterEval =
+    config:
+    lib.optionalAttrs (config ? process) {
+      inherit (config) assertions warnings process;
+    }
+    // {
+      services = lib.mapAttrs (k: filterEval) config.services;
+    };
+
   test =
     assert
-      exampleEval.config == {
+      filterEval exampleEval.config == {
         services = {
           service1 = {
             process = {
diff --git a/nixos/modules/system/service/systemd/service.nix b/nixos/modules/system/service/systemd/service.nix
index 9ba9bb7bf3f2..30c2335b81e3 100644
--- a/nixos/modules/system/service/systemd/service.nix
+++ b/nixos/modules/system/service/systemd/service.nix
@@ -52,8 +52,8 @@ let
 
 in
 {
+  _class = "service";
   imports = [
-    ../portable/service.nix
     (lib.mkAliasOptionModule [ "systemd" "service" ] [ "systemd" "services" "" ])
     (lib.mkAliasOptionModule [ "systemd" "socket" ] [ "systemd" "sockets" "" ])
   ];
@@ -101,6 +101,8 @@ in
           };
         }
       );
+      # Rendered by the portable docs instead.
+      visible = false;
     };
   };
   config = {
diff --git a/nixos/modules/system/service/systemd/system.nix b/nixos/modules/system/service/systemd/system.nix
index 139eb8398751..3405072089e1 100644
--- a/nixos/modules/system/service/systemd/system.nix
+++ b/nixos/modules/system/service/systemd/system.nix
@@ -59,44 +59,28 @@ let
     // concatMapAttrs (
       subServiceName: subService: makeUnits unitType (dash prefix subServiceName) subService
     ) service.services;
+
+  modularServiceConfiguration = portable-lib.configure {
+    serviceManagerPkgs = pkgs;
+    extraRootModules = [
+      ./service.nix
+      ./config-data-path.nix
+    ];
+    extraRootSpecialArgs = {
+      systemdPackage = config.systemd.package;
+    };
+  };
 in
 {
+  _class = "nixos";
+
   # First half of the magic: mix systemd logic into the otherwise abstract services
   options = {
     system.services = mkOption {
       description = ''
         A collection of NixOS [modular services](https://nixos.org/manual/nixos/unstable/#modular-services) that are configured as systemd services.
       '';
-      type = types.attrsOf (
-        types.submoduleWith {
-          class = "service";
-          modules = [
-            ./service.nix
-            ./config-data-path.nix
-
-            # TODO: Consider removing pkgs. Service modules can provide their own
-            #       dependencies.
-            {
-              # Extend portable services option
-              options.services = lib.mkOption {
-                type = types.attrsOf (
-                  types.submoduleWith {
-                    specialArgs.pkgs = pkgs;
-                    modules = [ ];
-                  }
-                );
-              };
-            }
-          ];
-          specialArgs = {
-            # perhaps: features."systemd" = { };
-            # TODO: Consider removing pkgs. Service modules can provide their own
-            #       dependencies.
-            inherit pkgs;
-            systemdPackage = config.systemd.package;
-          };
-        }
-      );
+      type = types.attrsOf modularServiceConfiguration.serviceSubmodule;
       default = { };
       visible = "shallow";
     };
diff --git a/nixos/tests/modular-service-etc/python-http-server.nix b/nixos/tests/modular-service-etc/python-http-server.nix
index 539354c66de1..72315831ba94 100644
--- a/nixos/tests/modular-service-etc/python-http-server.nix
+++ b/nixos/tests/modular-service-etc/python-http-server.nix
@@ -3,7 +3,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 let
@@ -16,7 +15,6 @@ in
     python-http-server = {
       package = mkOption {
         type = types.package;
-        default = pkgs.python3;
         description = "Python package to use for the web server";
       };
 
@@ -46,21 +44,9 @@ in
     ];
 
     configData = {
-      # This should probably just be {} if we were to put this module in production.
-      "webroot" = lib.mkDefault {
-        source = pkgs.runCommand "default-webroot" { } ''
-          mkdir -p $out
-          cat > $out/index.html << 'EOF'
-          <!DOCTYPE html>
-          <html>
-          <head><title>Python Web Server</title></head>
-          <body>
-            <h1>Welcome to the Python Web Server</h1>
-            <p>Serving from port ${toString config.python-http-server.port}</p>
-          </body>
-          </html>
-          EOF
-        '';
+      "webroot" = {
+        # Enable only if directory is set to use this path
+        enable = lib.mkDefault (config.python-http-server.directory == config.configData."webroot".path);
       };
     };
   };
diff --git a/nixos/tests/modular-service-etc/test.nix b/nixos/tests/modular-service-etc/test.nix
index 8011444e15e4..66e682871194 100644
--- a/nixos/tests/modular-service-etc/test.nix
+++ b/nixos/tests/modular-service-etc/test.nix
@@ -12,18 +12,44 @@
   nodes = {
     server =
       { pkgs, ... }:
+      let
+        # Normally the package services.default attribute combines this, but we
+        # don't have that, because this is not a production service. Should it be?
+        python-http-server = {
+          imports = [ ./python-http-server.nix ];
+          python-http-server.package = pkgs.python3;
+        };
+      in
       {
         system.services.webserver = {
           # The python web server is simple enough that it doesn't need a reload signal.
           # Other services may need to receive a signal in order to re-read what's in `configData`.
-          imports = [ ./python-http-server.nix ];
+          imports = [ python-http-server ];
           python-http-server = {
             port = 8080;
           };
 
+          configData = {
+            "webroot" = {
+              source = pkgs.runCommand "webroot" { } ''
+                mkdir -p $out
+                cat > $out/index.html << 'EOF'
+                <!DOCTYPE html>
+                <html>
+                <head><title>Python Web Server</title></head>
+                <body>
+                  <h1>Welcome to the Python Web Server</h1>
+                  <p>Serving from port 8080</p>
+                </body>
+                </html>
+                EOF
+              '';
+            };
+          };
+
           # Add a sub-service
           services.api = {
-            imports = [ ./python-http-server.nix ];
+            imports = [ python-http-server ];
             python-http-server = {
               port = 8081;
             };
@@ -147,8 +173,9 @@
     print(f"Before switch - webserver PID: {webserver_pid}, api PID: {api_pid}")
 
     # Switch to the specialisation with updated content
-    switch_output = server.succeed("/run/current-system/specialisation/updated/bin/switch-to-configuration test")
-    print(f"Switch output: {switch_output}")
+    # Capture both stdout and stderr, and show stderr in real-time for debugging
+    switch_output = server.succeed("/run/current-system/specialisation/updated/bin/switch-to-configuration test 2>&1 | tee /dev/stderr")
+    print(f"Switch output (stdout+stderr): {switch_output}")
 
     # Verify services are not mentioned in the switch output (indicating they weren't touched)
     assert "webserver.service" not in switch_output, f"webserver.service was mentioned in switch output: {switch_output}"
diff --git a/nixos/tests/php/fpm-modular.nix b/nixos/tests/php/fpm-modular.nix
index cd95bbd7e098..360e664963cf 100644
--- a/nixos/tests/php/fpm-modular.nix
+++ b/nixos/tests/php/fpm-modular.nix
@@ -1,3 +1,5 @@
+# Run with:
+#   nix-build -A nixosTests.php.fpm-modular
 { lib, php, ... }:
 {
   name = "php-${php.version}-fpm-modular-nginx-test";
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 58f4d38bf28f..1815d565762d 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7496,6 +7496,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  live-preview-nvim = buildVimPlugin {
+    pname = "live-preview.nvim";
+    version = "2025-08-17";
+    src = fetchFromGitHub {
+      owner = "brianhuster";
+      repo = "live-preview.nvim";
+      rev = "5890c4f7cb81a432fd5f3b960167757f1b4d4702";
+      sha256 = "0gr68xmx9ph74pqnlpbfx9kj5bh7yg3qh0jni98z2nmkzfvg4qcx";
+    };
+    meta.homepage = "https://github.com/brianhuster/live-preview.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   live-rename-nvim = buildVimPlugin {
     pname = "live-rename.nvim";
     version = "2025-06-23";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index a319de91ea6c..cea9ccf904a8 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1794,6 +1794,22 @@ in
     dependencies = [ self.litee-nvim ];
   };
 
+  live-preview-nvim = super.live-preview-nvim.overrideAttrs {
+    checkInputs = with self; [
+      fzf-lua
+      mini-pick
+      snacks-nvim
+      telescope-nvim
+    ];
+
+    nvimSkipModules = [
+      # Ignore livepreview._spec as it fails nvimRequireCheck.
+      # This file runs tests on require which unfortunately fails as it attempts to require the base plugin. See https://github.com/brianhuster/live-preview.nvim/blob/5890c4f7cb81a432fd5f3b960167757f1b4d4702/lua/livepreview/_spec.lua#L25
+      "livepreview._spec"
+    ];
+    meta.license = lib.licenses.gpl3Only;
+  };
+
   lspcontainers-nvim = super.lspcontainers-nvim.overrideAttrs {
     dependencies = [ self.nvim-lspconfig ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 954c16213677..68358bfffc45 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -575,6 +575,7 @@ https://github.com/ldelossa/litee-filetree.nvim/,,
 https://github.com/ldelossa/litee-symboltree.nvim/,,
 https://github.com/ldelossa/litee.nvim/,,
 https://github.com/smjonas/live-command.nvim/,HEAD,
+https://github.com/brianhuster/live-preview.nvim/,HEAD,
 https://github.com/saecki/live-rename.nvim/,HEAD,
 https://github.com/azratul/live-share.nvim/,HEAD,
 https://github.com/ggml-org/llama.vim/,HEAD,
diff --git a/pkgs/applications/emulators/libretro/cores/mupen64plus.nix b/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
index 48b54825b65a..d87f69b41040 100644
--- a/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
+++ b/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
@@ -12,13 +12,13 @@
 }:
 mkLibretroCore {
   core = "mupen64plus-next";
-  version = "0-unstable-2025-07-29";
+  version = "0-unstable-2025-08-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mupen64plus-libretro-nx";
-    rev = "2d923939db32aad01e633010fac71f860c943a6d";
-    hash = "sha256-HNhGVXTeCECqOdyluPq6aYWuA612H+PCJ65XoN9WJXU=";
+    rev = "222acbd3f98391458a047874d0372fe78e14fe94";
+    hash = "sha256-esssh/0nxNUDW/eMDQbWEdcSPuqLjnKLkK4mKN17HjQ=";
   };
 
   # Fix for GCC 14
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 0ba4654bea51..90ad45152c03 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -82,14 +82,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.44.1";
+  version = "3.44.2";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-WUXYjMCq95S5GHcn3pR45kpP3Us1HG4sS+EmjCBYOrM=";
+    hash = "sha256-ERaox5jqB7E/W0W6NnipHx1qfY2+FTHYf3r2l1KRkC0=";
   };
 
   passthru = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index ffae95c46000..e645a9d87ce7 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -866,6 +866,15 @@
     "spdx": "Apache-2.0",
     "vendorHash": null
   },
+  "neon": {
+    "hash": "sha256-D1KWC2D4OLMUSWKzQmiZaDrATCv4SEUWwk6SK/o1U5M=",
+    "homepage": "https://registry.terraform.io/providers/kislerdm/neon",
+    "owner": "kislerdm",
+    "repo": "terraform-provider-neon",
+    "rev": "v0.9.0",
+    "spdx": "MPL-2.0",
+    "vendorHash": "sha256-8WY2iEOFOwx7zDMps5cctxzv1stRseS/OUaHkMDuBYs="
+  },
   "netlify": {
     "hash": "sha256-7U+hHN/6GqcbI1gX7L01YqVjlUgvdfhgpXvLF2lwbkA=",
     "homepage": "https://registry.terraform.io/providers/AegirHealth/netlify",
diff --git a/pkgs/by-name/_8/_86Box/package.nix b/pkgs/by-name/_8/_86Box/package.nix
index a0f912d7c547..6b0421956a16 100644
--- a/pkgs/by-name/_8/_86Box/package.nix
+++ b/pkgs/by-name/_8/_86Box/package.nix
@@ -28,6 +28,7 @@
   libvorbis,
   libopus,
   libmpg123,
+  libgcrypt,
 
   enableDynarec ? with stdenv.hostPlatform; isx86 || isAarch,
   enableNewDynarec ? enableDynarec && stdenv.hostPlatform.isAarch,
@@ -87,7 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
   ++ lib.optional enableWayland wayland
-  ++ lib.optional enableVncRenderer libvncserver;
+  ++ lib.optionals enableVncRenderer [
+    libvncserver
+    libgcrypt
+  ];
 
   cmakeFlags =
     lib.optional stdenv.hostPlatform.isDarwin "-DCMAKE_MACOSX_BUNDLE=OFF"
diff --git a/pkgs/by-name/bo/bootspec/package.nix b/pkgs/by-name/bo/bootspec/package.nix
index e3f1b8c598a0..307733da90f4 100644
--- a/pkgs/by-name/bo/bootspec/package.nix
+++ b/pkgs/by-name/bo/bootspec/package.nix
@@ -2,19 +2,22 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "bootspec";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "bootspec";
     rev = "v${version}";
-    hash = "sha256-0MO+SqG7Gjq+fmMJkIFvaKsfTmC7z3lGfi7bbBv7iBE=";
+    hash = "sha256-WDEaTxj5iT8tvasd6gnMhRgNoEdDi9Wi4ke8sVtNpt8=";
   };
 
-  cargoHash = "sha256-fKbF5SyI0UlZTWsygdE8BGWuOoNSU4jx+CGdJoJFhZs=";
+  cargoHash = "sha256-ZJKoL1vYfAG1rpCcE1jRm7Yj2dhooJ6iQ91c6EGF83E=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Implementation of RFC-0125's datatype and synthesis tooling";
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 51b53deb0420..5ad1b80c6379 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.92"
+        "@anthropic-ai/claude-code": "^1.0.93"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.92",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.92.tgz",
-      "integrity": "sha512-/XuwJqAvXwIGf9WeZOxHI6qQsAGzxhrRc3hyQdvwW6cU5iviTmrxWasksPbJMvFt6KQoAUU6XHs78XyYmBpOXQ==",
+      "version": "1.0.93",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.93.tgz",
+      "integrity": "sha512-HSrbuYVu4k1dwoj/IYsXEVSoMWDPujy2D4zl9BMt4Zt0kwUwZch0nHpTyQ0C+YeHMN7hHbViz0bw6spg0a5GgQ==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 30135b447218..d75cbc98cbbe 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.92";
+  version = "1.0.93";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-xW+oI91wL+DFaOHw5M84QJktuE9HXb031pGbrNcrpPQ=";
+    hash = "sha256-vEUty4HRPSkFpT94bxMWcLj0nFe34AeQEZ0WsCXuy10=";
   };
 
-  npmDepsHash = "sha256-rrMskQkWKz+B5dqJ8gHgBxO20OdgE3d53TJWDxeJGbo=";
+  npmDepsHash = "sha256-JL0GPIhpyTQonKsyMR5zN8LaPfX3KkEfQbMR1Z7gTFE=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/fo/fosrl-pangolin/package.nix b/pkgs/by-name/fo/fosrl-pangolin/package.nix
index 50ca8ad15e5c..c2289acd3683 100644
--- a/pkgs/by-name/fo/fosrl-pangolin/package.nix
+++ b/pkgs/by-name/fo/fosrl-pangolin/package.nix
@@ -28,13 +28,13 @@ in
 
 buildNpmPackage (finalAttrs: {
   pname = "pangolin";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "pangolin";
     tag = finalAttrs.version;
-    hash = "sha256-X8Jvk/1gDj4cqXP3vlsrhWEM5lR42FsQ0HaSNeNxTXg=";
+    hash = "sha256-r0/HtRWdlDV749yT2pMnKqQKKYm6FPpcy3eul6M8iDQ=";
   };
 
   npmDepsHash = "sha256-OygskQhveT9CiymOOd5gx+aR9v3nMUZj72k/om3IF/c=";
diff --git a/pkgs/by-name/gh/ghostunnel/package.nix b/pkgs/by-name/gh/ghostunnel/package.nix
index a057dd263d39..ed4cc9f9c7a5 100644
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@@ -7,6 +7,8 @@
   ghostunnel,
   apple-sdk_12,
   darwinMinVersionHook,
+  writeScript,
+  runtimeShell,
 }:
 
 buildGoModule rec {
@@ -41,7 +43,11 @@ buildGoModule rec {
   };
 
   passthru.services.default = {
-    imports = [ ./service.nix ];
+    imports = [
+      (lib.modules.importApply ./service.nix {
+        inherit writeScript runtimeShell;
+      })
+    ];
     ghostunnel.package = ghostunnel; # FIXME: finalAttrs.finalPackage
   };
 
diff --git a/pkgs/by-name/gh/ghostunnel/service.nix b/pkgs/by-name/gh/ghostunnel/service.nix
index 485ce30fc8e0..4fb7db2c3150 100644
--- a/pkgs/by-name/gh/ghostunnel/service.nix
+++ b/pkgs/by-name/gh/ghostunnel/service.nix
@@ -1,8 +1,11 @@
+# Non-module dependencies (`importApply`)
+{ writeScript, runtimeShell }:
+
+# Service module
 {
   lib,
   config,
   options,
-  pkgs,
   ...
 }:
 let
@@ -25,6 +28,7 @@ in
     ghostunnel = {
       package = mkOption {
         description = "Package to use for ghostunnel";
+        defaultText = "The ghostunnel package that provided this module.";
         type = types.package;
       };
 
@@ -191,8 +195,8 @@ in
             cfg.cacert
           ])
           (
-            pkgs.writeScript "load-credentials" ''
-              #!${pkgs.runtimeShell}
+            writeScript "load-credentials" ''
+              #!${runtimeShell}
               exec $@ ${
                 concatStringsSep " " (
                   optional (cfg.keystore != null) "--keystore=$CREDENTIALS_DIRECTORY/keystore"
diff --git a/pkgs/by-name/ka/kawa/package.nix b/pkgs/by-name/ka/kawa/package.nix
new file mode 100644
index 000000000000..c7995bd23768
--- /dev/null
+++ b/pkgs/by-name/ka/kawa/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jdk11,
+  ant,
+  makeWrapper,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kawa";
+  version = "3.1.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/kawa/kawa-${finalAttrs.version}.tar.gz";
+    hash = "sha256-jJpQzWsQAVTJAb0ZCzrNL7g1PzNiLEos6Po5Kn8J4Bk=";
+  };
+
+  nativeBuildInputs = [
+    jdk11
+    ant
+    makeWrapper
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    ant -Denable-java-frontend=yes
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/java
+    cp lib/kawa.jar $out/share/java/kawa.jar
+
+    # Install info files
+    mkdir -p $out/share/info
+    cp doc/*.info* $out/share/info/
+
+    # Install man pages
+    mkdir -p $out/share/man/man1
+    cp doc/kawa.man $out/share/man/man1/kawa.1
+    cp doc/qexo.man $out/share/man/man1/qexo.1
+
+    mkdir -p $out/bin
+    makeWrapper ${jdk11}/bin/java $out/bin/kawa \
+      --add-flags "-Dkawa.home=$out -jar $out/share/java/kawa.jar"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Scheme implementation running on the Java platform";
+    longDescription = ''
+      Kawa is a general-purpose programming language that runs on the Java platform.
+      It aims to combine the benefits of dynamic scripting languages (less boiler-plate
+      code, fast and easy start-up, a REPL, no required compilation step) with the
+      benefits of traditional compiled languages (fast execution, static error detection,
+      modularity, zero-overhead Java platform integration).
+    '';
+    homepage = "https://www.gnu.org/software/kawa";
+    license = [
+      lib.licenses.mit
+      lib.licenses.gpl2Plus
+    ];
+    maintainers = with lib.maintainers; [ siraben ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libopaque/package.nix b/pkgs/by-name/li/libopaque/package.nix
new file mode 100644
index 000000000000..81ee5e4174c9
--- /dev/null
+++ b/pkgs/by-name/li/libopaque/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libsodium,
+  liboprf,
+  testers,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libopaque";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "stef";
+    repo = "libopaque";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VVD4489yWAJTWLGrpXYe8or5QjDnAuQ9/tzlNJJu/lo=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  strictDeps = true;
+
+  buildInputs = [
+    libsodium
+    liboprf
+  ];
+
+  postInstall = ''
+    mkdir -p ${placeholder "out"}/lib/pkgconfig
+    cp ../libopaque.pc ${placeholder "out"}/lib/pkgconfig/
+  '';
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Implementation of the OPAQUE protocol with support for threshold variants";
+    homepage = "https://github.com/stef/libopaque/";
+    changelog = "https://github.com/stef/libopaque/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.lgpl3Plus;
+    teams = [ lib.teams.ngi ];
+    platforms = lib.platforms.unix;
+    pkgConfigModules = [ "libopaque" ];
+  };
+})
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index a560370d678f..456d08a7d981 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -21,16 +21,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.8.10";
+  version = "2025.8.20";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-ycYB/XuaTwGmXzh59cxt5KC1v0gqoTB67MMmpCsR6o8=";
+    hash = "sha256-zjb0ND6U/fe/1h+0LdTDYLIpsSPTvGhWOhFOb4vmiT0=";
   };
 
-  cargoHash = "sha256-9YHW8jO+K1YZjmfN+KxctConrvp6yYODnRoSwIFxryU=";
+  cargoHash = "sha256-kebXsDAtQjEtAVCD76n5/A9hB1Sj+ww9MoHcfm/ucBs=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 6fb4a2175a6b..0ac600275fd2 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.22";
+  version = "0.6.25";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-SX2uLmDZu1TW45A6F5mSXVtSqv5rbNKuVw8sWj8tEb4=";
+    hash = "sha256-XB3cwxtcOVoAwGJroZuPT8XwaCo3wpkn2KIEuuXMeu4=";
   };
 
   frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-mMnDYMy1/7gW6XVaWVct9BuxDP78XX5u46lGBWjUvOQ=";
+    npmDepsHash = "sha256-WL1kdXn7uAaBEwWiIJzzisMZ1uiaOVtFViWK/kW6lsY=";
 
     # See https://github.com/open-webui/open-webui/issues/15880
     npmFlags = [
diff --git a/pkgs/by-name/os/osm-gps-map/package.nix b/pkgs/by-name/os/osm-gps-map/package.nix
index ac31cbf184fb..39d4926eef6e 100644
--- a/pkgs/by-name/os/osm-gps-map/package.nix
+++ b/pkgs/by-name/os/osm-gps-map/package.nix
@@ -7,6 +7,8 @@
   gnome-common,
   gtk3,
   gobject-introspection,
+  autoreconfHook,
+  gtk-doc,
   pkg-config,
   lib,
   stdenv,
@@ -50,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
+    autoreconfHook
+    gtk-doc
     pkg-config
     gobject-introspection
     gnome-common
diff --git a/pkgs/by-name/pa/pay-respects/package.nix b/pkgs/by-name/pa/pay-respects/package.nix
index f7c297063410..f2b82e49b3ff 100644
--- a/pkgs/by-name/pa/pay-respects/package.nix
+++ b/pkgs/by-name/pa/pay-respects/package.nix
@@ -6,17 +6,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pay-respects";
-  version = "0.7.8";
+  version = "0.7.9";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "iff";
     repo = "pay-respects";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-73uGxcJCWUVwr1ddNjZTRJwx8OfnAPwtp80v1xpUEhA=";
+    hash = "sha256-qKej29kM0Kq5RRHo+lu9cGeTjnjUvpmIqSxq5yHuCKc=";
   };
 
-  cargoHash = "sha256-VSv0BpIICkYyCIfGDfK7wfKQssWF13hCh6IW375CI/c=";
+  cargoHash = "sha256-2MEbUBTZ/zsPLhHTnQCrWQManqUQ3V3xta5NT9gu38A=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/te/telepresence2/package.nix b/pkgs/by-name/te/telepresence2/package.nix
index fdc464c23f5e..ca8947c1879a 100644
--- a/pkgs/by-name/te/telepresence2/package.nix
+++ b/pkgs/by-name/te/telepresence2/package.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.23.6";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-bo98R5uWOg219JF5czUd3XPznyXpphQMJtsgF5xJFqE=";
+    hash = "sha256-aqL2AjDscN6o9WKur3ed5SU3XQJy6hAu/QUD7Fh/0pE=";
   };
 
   propagatedBuildInputs = [
@@ -51,7 +51,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-DAbPgLt0CGdbfDmMXZDyjStyeb4A1dPCNiJMH1NUAUg=";
+  vendorHash = "sha256-ncMquDrlkcf71voCbxadOM+EKO/7olMEAf5FOFoxrvA=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index b7f7f9fd69c4..046c23c10acc 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
   meson,
   ninja,
   pkg-config,
@@ -11,41 +11,29 @@
   libX11,
   libdrm,
   libgbm,
-  nativeContextSupport ? stdenv.hostPlatform.isLinux,
-  vaapiSupport ? !stdenv.hostPlatform.isDarwin,
   libva,
-  vulkanSupport ? stdenv.hostPlatform.isLinux,
   vulkan-headers,
   vulkan-loader,
-  gitUpdater,
+  nix-update-script,
+  vulkanSupport ? stdenv.hostPlatform.isLinux,
+  nativeContextSupport ? stdenv.hostPlatform.isLinux,
+  vaapiSupport ? !stdenv.hostPlatform.isDarwin,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "virglrenderer";
   version = "1.1.1";
 
-  src = fetchurl {
-    url = "https://gitlab.freedesktop.org/virgl/virglrenderer/-/archive/${version}/virglrenderer-${version}.tar.bz2";
-    hash = "sha256-D+SJqBL76z1nGBmcJ7Dzb41RvFxU2Ak6rVOwDRB94rM=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "virgl";
+    repo = "virglrenderer";
+    tag = finalAttrs.version;
+    hash = "sha256-ah6+AAf7B15rPMb4uO873wieT3+gf/5iGH+ZFoZKAAI=";
   };
 
   separateDebugInfo = true;
 
-  buildInputs = [
-    libepoxy
-  ]
-  ++ lib.optionals vaapiSupport [ libva ]
-  ++ lib.optionals vulkanSupport [
-    vulkan-headers
-    vulkan-loader
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    libGLU
-    libX11
-    libdrm
-    libgbm
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -55,27 +43,48 @@ stdenv.mkDerivation rec {
     ]))
   ];
 
+  buildInputs = [
+    libepoxy
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    libGLU
+    libX11
+    libdrm
+    libgbm
+  ]
+  ++ lib.optionals vaapiSupport [
+    libva
+  ]
+  ++ lib.optionals vulkanSupport [
+    vulkan-headers
+    vulkan-loader
+  ];
+
   mesonFlags = [
     (lib.mesonBool "video" vaapiSupport)
     (lib.mesonBool "venus" vulkanSupport)
-  ]
-  ++ lib.optionals nativeContextSupport [
-    (lib.mesonOption "drm-renderers" "amdgpu-experimental,msm")
+    (lib.mesonOption "drm-renderers" (
+      lib.optionalString nativeContextSupport (
+        lib.concatStringsSep "," [
+          "amdgpu-experimental"
+          "msm"
+        ]
+      )
+    ))
   ];
 
   passthru = {
-    updateScript = gitUpdater {
-      url = "https://gitlab.freedesktop.org/virgl/virglrenderer.git";
-      rev-prefix = "virglrenderer-";
-    };
+    updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
-    description = "Virtual 3D GPU library that allows a qemu guest to use the host GPU for accelerated 3D rendering";
+  meta = {
+    description = "Virtual 3D GPU for use inside QEMU virtual machines";
+    homepage = "https://docs.mesa3d.org/drivers/virgl";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      normalcea
+    ];
     mainProgram = "virgl_test_server";
-    homepage = "https://virgil3d.github.io/";
-    license = licenses.mit;
-    platforms = platforms.unix;
-    maintainers = [ maintainers.xeji ];
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/xe/xed-editor/package.nix b/pkgs/by-name/xe/xed-editor/package.nix
index 2c7f8c774074..bc87c6c0775e 100644
--- a/pkgs/by-name/xe/xed-editor/package.nix
+++ b/pkgs/by-name/xe/xed-editor/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xed-editor";
-  version = "3.8.3";
+  version = "3.8.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xed";
     rev = version;
-    hash = "sha256-bNnxQOYDBS/pNaBwvmrt/VAya/m7t5H40lJkFevufUE=";
+    hash = "sha256-pI9gjAA5dn0QwZKGungQ1xpQJmnfCxmqWR0VBEQ5v84=";
   };
 
   patches = [
diff --git a/pkgs/by-name/xv/xviewer/package.nix b/pkgs/by-name/xv/xviewer/package.nix
index 76b440e69ce7..40f5c9275929 100644
--- a/pkgs/by-name/xv/xviewer/package.nix
+++ b/pkgs/by-name/xv/xviewer/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xviewer";
-  version = "3.4.11";
+  version = "3.4.12";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xviewer";
     rev = version;
-    hash = "sha256-fW+hhHJ4i3u0vtbvaQWliIZSLI1WCFhR5CvVZL6Vy8U=";
+    hash = "sha256-WvA8T6r9DtlpOZLMEOILO6/0Am3bhCLM8FnwXvALjS8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index 11b1ddd1a08f..f65507959f90 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -437,8 +437,6 @@ package-maintainers:
     - hercules-ci-cnix-store
     - inline-c
     - inline-c-cpp
-  roosemberth:
-    - git-annex
   rvl:
     - taffybar
     - arbtt
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 7c31b2670255..bafb3dc90a5e 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -32,6 +32,8 @@ let
       common-updater-scripts,
       curl,
       jq,
+      coreutils,
+      formats,
 
       version,
       phpSrc ? null,
@@ -390,7 +392,11 @@ let
             inherit ztsSupport;
 
             services.default = {
-              imports = [ ./service.nix ];
+              imports = [
+                (lib.modules.importApply ./service.nix {
+                  inherit formats coreutils;
+                })
+              ];
               php-fpm.package = lib.mkDefault finalAttrs.finalPackage;
             };
           };
diff --git a/pkgs/development/interpreters/php/service.nix b/pkgs/development/interpreters/php/service.nix
index 50fcbb649800..06b1247c5e20 100644
--- a/pkgs/development/interpreters/php/service.nix
+++ b/pkgs/development/interpreters/php/service.nix
@@ -1,13 +1,18 @@
+# Tests in: nixos/tests/php/fpm-modular.nix
+
+# Non-module dependencies (importApply)
+{ formats, coreutils }:
+
+# Service module
 {
   options,
   config,
-  pkgs,
   lib,
   ...
 }:
 let
   cfg = config.php-fpm;
-  format = pkgs.formats.iniWithGlobalSection { };
+  format = formats.iniWithGlobalSection { };
   configFile = format.generate "php-fpm.conf" {
     globalSection = lib.filterAttrs (_: v: !lib.isAttrs v) cfg.settings;
     sections = lib.filterAttrs (_: lib.isAttrs) cfg.settings;
@@ -76,8 +81,11 @@ in
   _class = "service";
 
   options.php-fpm = {
-    package = lib.mkPackageOption pkgs "php" {
-      example = ''
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = "PHP package to use for php-fpm";
+      defaultText = lib.literalMD ''The PHP package that provided this module.'';
+      example = lib.literalExpression ''
         php.buildEnv {
           extensions =
             { all, ... }:
@@ -163,7 +171,7 @@ in
 
       serviceConfig = {
         Type = "notify";
-        ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
+        ExecReload = "${coreutils}/bin/kill -USR2 $MAINPID";
         RuntimeDirectory = "php-fpm";
         RuntimeDirectoryPreserve = true;
         Restart = "always";
@@ -175,7 +183,7 @@ in
 
     finit.service = {
       conditions = [ "service/syslogd/ready" ];
-      reload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
+      reload = "${coreutils}/bin/kill -USR2 $MAINPID";
       notify = "systemd";
     };
   };
diff --git a/pkgs/development/ocaml-modules/dune-rpc/default.nix b/pkgs/development/ocaml-modules/dune-rpc/default.nix
index 2814f4e8f5da..d5031728eda5 100644
--- a/pkgs/development/ocaml-modules/dune-rpc/default.nix
+++ b/pkgs/development/ocaml-modules/dune-rpc/default.nix
@@ -4,8 +4,8 @@
   dune_3,
   csexp,
   stdune,
+  ocamlc-loc,
   ordering,
-  pp,
   xdg,
   dyn,
 }:
@@ -21,8 +21,8 @@ buildDunePackage {
   propagatedBuildInputs = [
     csexp
     stdune
+    ocamlc-loc
     ordering
-    pp
     xdg
     dyn
   ];
diff --git a/pkgs/development/python-modules/fastmcp/default.nix b/pkgs/development/python-modules/fastmcp/default.nix
index 418fdfef0075..efe66eb37b1b 100644
--- a/pkgs/development/python-modules/fastmcp/default.nix
+++ b/pkgs/development/python-modules/fastmcp/default.nix
@@ -14,6 +14,7 @@
   exceptiongroup,
   httpx,
   mcp,
+  openapi-core,
   openapi-pydantic,
   pydantic,
   pyperclip,
@@ -31,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "fastmcp";
-  version = "2.11.1";
+  version = "2.11.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jlowin";
     repo = "fastmcp";
     tag = "v${version}";
-    hash = "sha256-Y71AJdWcRBDbq63p+lcQplqutz2UTQ3f+pTyhcolpuw=";
+    hash = "sha256-jIXrMyNnyPE2DUgg+sxT6LD4dTmKQglh4cFuaw179Z0=";
   };
 
   postPatch = ''
@@ -57,6 +58,7 @@ buildPythonPackage rec {
     exceptiongroup
     httpx
     mcp
+    openapi-core
     openapi-pydantic
     pyperclip
     python-dotenv
@@ -87,6 +89,10 @@ buildPythonPackage rec {
     "test_keep_alive_starts_new_session_if_manually_closed"
     "test_keep_alive_maintains_session_if_reentered"
     "test_close_session_and_try_to_use_client_raises_error"
+    "test_run_mcp_config"
+    "test_uv_transport"
+    "test_uv_transport_module"
+    "test_github_api_schema_performance"
 
     # RuntimeError: Client failed to connect: Timed out while waiting for response
     "test_timeout"
@@ -94,20 +100,25 @@ buildPythonPackage rec {
 
     # assert 0 == 2
     "test_multi_client"
+    "test_canonical_multi_client_with_transforms"
 
     # fastmcp.exceptions.ToolError: Unknown tool
     "test_multi_client_with_logging"
     "test_multi_client_with_elicitation"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # RuntimeError: Server failed to start after 10 attempts
+    "test_unauthorized_access"
   ];
 
   disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
     # RuntimeError: Server failed to start after 10 attempts
-    "tests/auth/providers/test_bearer.py"
-    "tests/auth/test_oauth_client.py"
-    "tests/client/test_openapi.py"
+    "tests/client/auth/test_oauth_client.py"
+    "tests/client/test_openapi_experimental.py"
+    "tests/client/test_openapi_legacy.py"
     "tests/client/test_sse.py"
     "tests/client/test_streamable_http.py"
-    "tests/server/http/test_http_dependencies.py"
+    "tests/server/auth/test_jwt_provider.py"
     "tests/server/http/test_http_dependencies.py"
   ];
 
diff --git a/pkgs/development/python-modules/opaque/default.nix b/pkgs/development/python-modules/opaque/default.nix
new file mode 100644
index 000000000000..7c9996dcf2e1
--- /dev/null
+++ b/pkgs/development/python-modules/opaque/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  libopaque,
+  setuptools,
+  pysodium,
+  python,
+}:
+
+buildPythonPackage rec {
+  pname = "opaque";
+  pyproject = true;
+
+  inherit (libopaque)
+    version
+    src
+    ;
+
+  sourceRoot = "${src.name}/python";
+
+  postPatch =
+    let
+      soext = stdenv.hostPlatform.extensions.sharedLibrary;
+    in
+    ''
+      substituteInPlace ./opaque/__init__.py --replace-fail \
+        "ctypes.util.find_library('opaque') or ctypes.util.find_library('libopaque')" "'${lib.getLib libopaque}/lib/libopaque${soext}'"
+    '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [ pysodium ];
+
+  pythonImportsCheck = [ "opaque" ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    ${python.interpreter} test/simple.py
+
+    runHook postCheck
+  '';
+
+  meta = {
+    inherit (libopaque.meta)
+      description
+      homepage
+      license
+      teams
+      ;
+  };
+}
diff --git a/pkgs/development/python-modules/opencc/default.nix b/pkgs/development/python-modules/opencc/default.nix
new file mode 100644
index 000000000000..2a4c7fa01611
--- /dev/null
+++ b/pkgs/development/python-modules/opencc/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  cmake,
+  setuptools,
+  wheel,
+}:
+
+buildPythonPackage rec {
+  pname = "opencc";
+  version = "1.1.9";
+  format = "setuptools";
+
+  src = fetchPypi {
+    pname = "opencc";
+    inherit version;
+    hash = "sha256-itcig3MpUTAzkPrjOhztqYrJsDNoqPKRLtyTTXQHfko=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    setuptools
+    wheel
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  pythonImportsCheck = [
+    "opencc"
+  ];
+
+  meta = {
+    description = "Python bindings for OpenCC (Conversion between Traditional and Simplified Chinese)";
+    homepage = "https://github.com/BYVoid/OpenCC";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ siraben ];
+  };
+}
diff --git a/pkgs/development/python-modules/osc/default.nix b/pkgs/development/python-modules/osc/default.nix
index 7eadbf1a8313..51beca1710b6 100644
--- a/pkgs/development/python-modules/osc/default.nix
+++ b/pkgs/development/python-modules/osc/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "osc";
-  version = "1.9.1";
+  version = "1.19.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "osc";
     rev = version;
-    hash = "sha256-03EDarU7rmsiE96IYHXFuPtD8nWur0qwj8NDzSj8OX0=";
+    hash = "sha256-klPO873FwQOf4DCTuDd86vmGLI4ep9xgS6c+HasJv0Q=";
   };
 
   buildInputs = [ bashInteractive ]; # needed for bash-completion helper
diff --git a/pkgs/development/python-modules/pyiceberg/default.nix b/pkgs/development/python-modules/pyiceberg/default.nix
index 40020a675727..61956f9fd36d 100644
--- a/pkgs/development/python-modules/pyiceberg/default.nix
+++ b/pkgs/development/python-modules/pyiceberg/default.nix
@@ -84,6 +84,7 @@ buildPythonPackage rec {
   env.CIBUILDWHEEL = "1";
 
   pythonRelaxDeps = [
+    "cachetools"
     "rich"
   ];
 
diff --git a/pkgs/development/python-modules/pyocd/default.nix b/pkgs/development/python-modules/pyocd/default.nix
index a6ba9cd6c745..b5d53d11cf9e 100644
--- a/pkgs/development/python-modules/pyocd/default.nix
+++ b/pkgs/development/python-modules/pyocd/default.nix
@@ -1,8 +1,13 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
+
+  # build-system
+  setuptools-scm,
+
+  # dependencies
   capstone,
   cmsis-pack-manager,
   colorama,
@@ -17,10 +22,10 @@
   pylink-square,
   pyusb,
   pyyaml,
-  setuptools-scm,
   typing-extensions,
-  stdenv,
   hidapi,
+
+  # tests
   pytestCheckHook,
 }:
 
@@ -36,16 +41,6 @@ buildPythonPackage rec {
     hash = "sha256-4fdVcTNH125e74S3mA/quuDun17ntGCazX6CV+obUGc=";
   };
 
-  patches = [
-    # https://github.com/pyocd/pyOCD/pull/1332
-    # merged into develop
-    (fetchpatch {
-      name = "libusb-package-optional.patch";
-      url = "https://github.com/pyocd/pyOCD/commit/0b980cf253e3714dd2eaf0bddeb7172d14089649.patch";
-      hash = "sha256-B2+50VntcQELeakJbCeJdgI1iBU+h2NkXqba+LRYa/0=";
-    })
-  ];
-
   pythonRelaxDeps = [ "capstone" ];
   pythonRemoveDeps = [ "libusb-package" ];
 
@@ -80,13 +75,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/pyocd/pyOCD/releases/tag/${src.tag}";
     description = "Python library for programming and debugging Arm Cortex-M microcontrollers";
     downloadPage = "https://github.com/pyocd/pyOCD";
     homepage = "https://pyocd.io";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       frogamic
       sbruder
     ];
diff --git a/pkgs/development/python-modules/pytouchlinesl/default.nix b/pkgs/development/python-modules/pytouchlinesl/default.nix
index a89fd6cdb810..5928ee5203ef 100644
--- a/pkgs/development/python-modules/pytouchlinesl/default.nix
+++ b/pkgs/development/python-modules/pytouchlinesl/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pytouchlinesl";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "jnsgruk";
     repo = "pytouchlinesl";
     tag = version;
-    hash = "sha256-hrC5cBtAU9P9VaRIoUKDx5x4KwUN6mO/JwEZrsnYB0s=";
+    hash = "sha256-R5XgH8A9P5KcjQL/f+E189A+iRVUIbWsmyRrnfV43v4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 8fa0894ed863..ac5a6306611e 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -64,7 +64,7 @@
 
 let
   pname = "ray";
-  version = "2.48.0";
+  version = "2.49.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -85,28 +85,28 @@ buildPythonPackage rec {
       # Results are in ./ray-hashes.nix
       hashes = {
         x86_64-linux = {
-          cp310 = "sha256-ZJ7ZRC3C05E1xZO2zww46DVRcLkmcjZat6PLyVjEJjQ=";
-          cp311 = "sha256-RtS0KlhJLex5yq0tViNEaJpPmagoruqBGgzSzWU1U+8=";
-          cp312 = "sha256-pC7TtkD0tZmj/IBnyD7mBJfA8D0HDXp98Co4j6F6VGs=";
-          cp313 = "sha256-JeS3n8yPhJ1y2xrMTwPzcAjFwLdF32PYowzTVna2VF4=";
+          cp310 = "sha256-bFQKbfqOWC4HJQV8E3JFzNP6DWl7R2SFMxdvWoqzCjA=";
+          cp311 = "sha256-Ja5MII3Hi0plPDEcsmuTx0QB5nYqGTztX6uqkQqBfYE=";
+          cp312 = "sha256-lShdI6MDsXTQcKaz6ocj6dq/B6QUegHLkzHV6t+MoLI=";
+          cp313 = "sha256-42mZ1Pgx8vIcqPtWnwWY+4DKjawPiDbErHXM2ltVi/s=";
         };
         aarch64-linux = {
-          cp310 = "sha256-+CCVC8RNewAMIjNC9cgAycCOf9iVJCARJTiOohHKrRo=";
-          cp311 = "sha256-JKcPQW7AvhS5dfFgBEgFzLSMxrxQ3mMpg+uPCo4WaCs=";
-          cp312 = "sha256-8c8z0mAxb5L3dVgYXxw2/DVQbXbuf9/tn1tw+cS9un8=";
-          cp313 = "sha256-Yi5rzbeNmAQNh76pTmXQu2zMCuG0MpTGvWn1Qr8o4JI=";
+          cp310 = "sha256-jFWnpGKgzese1Y+jYQ9S46KEzk4MVVZjWb0RWKloP0Q=";
+          cp311 = "sha256-KnXS/YvKsahQkeow5ZMsXiiXxxIq4j+SH0+v7sIsOCg=";
+          cp312 = "sha256-NjVn9WES86FRjs2NDjoM5PBTcFzI9NQ+kzyvafs1lxw=";
+          cp313 = "sha256-/Wu+DBhvHWpJ31NTKyGSH9Bf+ZPLVG9mW3GAmGIPY8U=";
         };
         x86_64-darwin = {
-          cp310 = "sha256-M72kdTrQrNK1JMkVgInUNIbNRMxZ/pcEZkNbwpaP3i0=";
-          cp311 = "sha256-uUUA/i0X5JH+LpvUo79i3yF+IajyhFAzw1PU0uokD3M=";
-          cp312 = "sha256-Wm9XEm6sndMoYongfpHoewVHkvlpi298yriLYkgWtUI=";
-          cp313 = "sha256-V0K3KlFK/l1g9BMwIAzVCDduFsZQ9pYuYjN6pILWoMY=";
+          cp310 = "sha256-6Qjm97RkKdJvRZRXlFgpiETRpIXCiM/liRT6eilP06Q=";
+          cp311 = "sha256-5CpBh6kOiXr7lVF8uKpPwMJHGL1Ci97AsmCqLRjs5sg=";
+          cp312 = "sha256-FvsQ5YuuSDECZ16Cnq0afQpHjcVfmf8GuDKnicogi6k=";
+          cp313 = "sha256-LhOphUj78ujX8JY8YK/1HZtT01naDO9QoHGpUMT85Uo=";
         };
         aarch64-darwin = {
-          cp310 = "sha256-bKK5zkWtNgy+KZaYL7Imkez+ZVPsj5eiVIKV8PlqrHg=";
-          cp311 = "sha256-S5uSrCljX1Ve80E0fZpj2/ArfZRjRyOa88CeNkvEXPg=";
-          cp312 = "sha256-jeeZ87CJb0jTBtXkoE/GA3oIxJXUX5x5k1NE5Wk+PPg=";
-          cp313 = "sha256-p6bYMNncWui7FW/N6aGtq39O2wBPA5GKck2IXs64Jk0=";
+          cp310 = "sha256-seRUvxTQCGfaXslF4L4IfWhFfyQbqmClDLccBBosTfw=";
+          cp311 = "sha256-VKipsP5qnLFagvNxwufWhCD540/+OKi+PD3UvlQFHGY=";
+          cp312 = "sha256-+UOpwq4EljaxJqGUBH/fkQEGCpmF0dthSxeycGH46fM=";
+          cp313 = "sha256-9CDvy2n6ZDAf8su3YR10rwEguu6OhAhtjzuV6BVTD5M=";
         };
       };
     in
diff --git a/pkgs/development/python-modules/spsdk-pyocd/default.nix b/pkgs/development/python-modules/spsdk-pyocd/default.nix
index bd10411161e5..ef16cf229f66 100644
--- a/pkgs/development/python-modules/spsdk-pyocd/default.nix
+++ b/pkgs/development/python-modules/spsdk-pyocd/default.nix
@@ -35,6 +35,10 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "pyocd"
+  ];
+
   dependencies = [
     pyocd
   ];
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index edc8c5e9eeb0..066c52c0a030 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -39,6 +39,7 @@
   x690,
 
   # tests
+  cookiecutter,
   ipykernel,
   pytest-notebook,
   pytestCheckHook,
@@ -95,6 +96,7 @@ buildPythonPackage rec {
     click-command-tree
     click-option-group
     colorama
+    cookiecutter
     crcmod
     cryptography
     deepmerge
@@ -122,6 +124,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "spsdk" ];
 
   nativeCheckInputs = [
+    cookiecutter
     ipykernel
     pytest-notebook
     pytestCheckHook
@@ -134,6 +137,9 @@ buildPythonPackage rec {
   disabledTests = [
     # Missing rotk private key
     "test_general_notebooks"
+
+    # Attempts to access /run
+    "test_nxpimage_famode_export_cli"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/torch/source/default.nix b/pkgs/development/python-modules/torch/source/default.nix
index 014c01adca4d..ccd0ac5c6956 100644
--- a/pkgs/development/python-modules/torch/source/default.nix
+++ b/pkgs/development/python-modules/torch/source/default.nix
@@ -72,13 +72,7 @@
   #          (dependencies without cuda support).
   #          Instead we should rely on overlays and nixpkgsFun.
   # (@SomeoneSerge)
-  _tritonEffective ?
-    if cudaSupport then
-      triton-cuda
-    else if rocmSupport then
-      rocmPackages.triton
-    else
-      triton,
+  _tritonEffective ? if cudaSupport then triton-cuda else triton,
   triton-cuda,
 
   # Disable MKLDNN on aarch64-darwin, it negatively impacts performance,
diff --git a/pkgs/development/python-modules/triton/0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch b/pkgs/development/python-modules/triton/0002-nvidia-driver-short-circuit-before-ldconfig.patch
similarity index 53%
rename from pkgs/development/python-modules/triton/0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch
rename to pkgs/development/python-modules/triton/0002-nvidia-driver-short-circuit-before-ldconfig.patch
index 9600680567ce..13077545d7ef 100644
--- a/pkgs/development/python-modules/triton/0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch
+++ b/pkgs/development/python-modules/triton/0002-nvidia-driver-short-circuit-before-ldconfig.patch
@@ -1,17 +1,3 @@
-diff --git a/third_party/amd/backend/driver.py b/third_party/amd/backend/driver.py
-index ca712f904..0961d2dda 100644
---- a/third_party/amd/backend/driver.py
-+++ b/third_party/amd/backend/driver.py
-@@ -79,6 +79,9 @@ def _get_path_to_hip_runtime_dylib():
-             return mmapped_path
-         raise RuntimeError(f"memory mapped '{mmapped_path}' in process does not point to a valid {lib_name}")
- 
-+    if os.path.isdir("@libhipDir@"):
-+        return ["@libhipDir@"]
-+
-     paths = []
- 
-     import site
 diff --git a/third_party/nvidia/backend/driver.py b/third_party/nvidia/backend/driver.py
 index d088ec092..625de2db8 100644
 --- a/third_party/nvidia/backend/driver.py
diff --git a/pkgs/development/python-modules/triton/0005-amd-search-env-paths.patch b/pkgs/development/python-modules/triton/0005-amd-search-env-paths.patch
new file mode 100644
index 000000000000..8f46c826c2fd
--- /dev/null
+++ b/pkgs/development/python-modules/triton/0005-amd-search-env-paths.patch
@@ -0,0 +1,60 @@
+From 9e4e58b647c17c5fa098c8a74e221f88d3cb1a43 Mon Sep 17 00:00:00 2001
+From: Luna Nova <git@lunnova.dev>
+Date: Sun, 24 Aug 2025 07:41:30 -0700
+Subject: [PATCH] [AMD] Search HIP_PATH, hipconfig, and ROCM_PATH for
+ libamdhip64
+
+Search for libamdhip64 from HIP_PATH env var, hipconfig --path output,
+and ROCM_PATH before looking in system-wide ldconfig or /opt/rocm.
+
+The system-wide ROCm path isn't guaranteed to be where the ROCm
+install we're building against is located, so follow typical ROCm
+lib behavior and look under env paths first.
+
+This is especially important for non-FHS distros like NixOS
+where /opt/rocm never exists, but may be useful in more
+typical distros if multiple ROCm installs are present
+to ensure the right libamdhip64.so is picked up.
+---
+ third_party/amd/backend/driver.py | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/third_party/amd/backend/driver.py b/third_party/amd/backend/driver.py
+index af8e1a5c8097..57b0f7388c60 100644
+--- a/third_party/amd/backend/driver.py
++++ b/third_party/amd/backend/driver.py
+@@ -110,6 +110,34 @@ def _get_path_to_hip_runtime_dylib():
+                 return f
+             paths.append(f)
+ 
++    # HIP_PATH should point to HIP SDK root if set
++    env_hip_path = os.getenv("HIP_PATH")
++    if env_hip_path:
++        hip_lib_path = os.path.join(env_hip_path, "lib", lib_name)
++        if os.path.exists(hip_lib_path):
++            return hip_lib_path
++        paths.append(hip_lib_path)
++
++    # if available, `hipconfig --path` prints the HIP SDK root
++    try:
++        hip_root = subprocess.check_output(["hipconfig", "--path"]).decode().strip()
++        if hip_root:
++            hip_lib_path = os.path.join(hip_root, "lib", lib_name)
++            if os.path.exists(hip_lib_path):
++                return hip_lib_path
++            paths.append(hip_lib_path)
++    except (subprocess.CalledProcessError, FileNotFoundError):
++        # hipconfig may not be available
++        pass
++
++    # ROCm lib dir based on env var
++    env_rocm_path = os.getenv("ROCM_PATH")
++    if env_rocm_path:
++        rocm_lib_path = os.path.join(env_rocm_path, "lib", lib_name)
++        if os.path.exists(rocm_lib_path):
++            return rocm_lib_path
++        paths.append(rocm_lib_path)
++
+     # Afterwards try to search the loader dynamic library resolution paths.
+     libs = subprocess.check_output(["/sbin/ldconfig", "-p"]).decode(errors="ignore")
+     # each line looks like the following:
diff --git a/pkgs/development/python-modules/triton/default.nix b/pkgs/development/python-modules/triton/default.nix
index ab0db19f9bca..c22016654700 100644
--- a/pkgs/development/python-modules/triton/default.nix
+++ b/pkgs/development/python-modules/triton/default.nix
@@ -23,7 +23,7 @@
   torchWithRocm,
   zlib,
   cudaSupport ? config.cudaSupport,
-  rocmSupport ? config.rocmSupport,
+  runCommand,
   rocmPackages,
   triton,
 }:
@@ -45,11 +45,12 @@ buildPythonPackage rec {
     (replaceVars ./0001-_build-allow-extra-cc-flags.patch {
       ccCmdExtraFlags = "-Wl,-rpath,${addDriverRunpath.driverLink}/lib";
     })
-    (replaceVars ./0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch {
-      libhipDir = if rocmSupport then "${lib.getLib rocmPackages.clr}/lib" else null;
+    (replaceVars ./0002-nvidia-driver-short-circuit-before-ldconfig.patch {
       libcudaStubsDir =
         if cudaSupport then "${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs" else null;
     })
+    # Upstream PR: https://github.com/triton-lang/triton/pull/7959
+    ./0005-amd-search-env-paths.patch
   ]
   ++ lib.optionals cudaSupport [
     (replaceVars ./0003-nvidia-cudart-a-systempath.patch {
@@ -81,6 +82,13 @@ buildPythonPackage rec {
       substituteInPlace cmake/AddTritonUnitTest.cmake \
         --replace-fail "include(\''${PROJECT_SOURCE_DIR}/unittest/googletest.cmake)" ""\
         --replace-fail "include(GoogleTest)" "find_package(GTest REQUIRED)"
+    ''
+    # Don't use FHS path for ROCm LLD
+    # Remove this after `[AMD] Use lld library API #7548` makes it into a release
+    + ''
+      substituteInPlace third_party/amd/backend/compiler.py \
+        --replace-fail 'lld = Path("/opt/rocm/llvm/bin/ld.lld")' \
+        "import os;lld = Path(os.getenv('HIP_PATH', '/opt/rocm/')"' + "/llvm/bin/ld.lld")'
     '';
 
   build-system = [ setuptools ];
@@ -205,6 +213,47 @@ buildPythonPackage rec {
     # Ultimately, torch is our test suite:
     inherit torchWithRocm;
 
+    # Test that _get_path_to_hip_runtime_dylib works when ROCm is available at runtime
+    rocm-libamdhip64-path =
+      runCommand "triton-rocm-libamdhip64-path-test"
+        {
+          buildInputs = [
+            triton
+            python
+            rocmPackages.clr
+          ];
+        }
+        ''
+          python -c "
+          import os
+          import triton
+          path = triton.backends.amd.driver._get_path_to_hip_runtime_dylib()
+          print(f'libamdhip64 path: {path}')
+          assert os.path.exists(path)
+          " && touch $out
+        '';
+
+    # Test that path_to_rocm_lld works when ROCm is available at runtime
+    # Remove this after `[AMD] Use lld library API #7548` makes it into a release
+    rocm-lld-path =
+      runCommand "triton-rocm-lld-test"
+        {
+          buildInputs = [
+            triton
+            python
+            rocmPackages.clr
+          ];
+        }
+        ''
+          python -c "
+          import os
+          import triton
+          path = triton.backends.backends['amd'].compiler.path_to_rocm_lld()
+          print(f'ROCm LLD path: {path}')
+          assert os.path.exists(path)
+          " && touch $out
+        '';
+
     # Test as `nix run -f "<nixpkgs>" python3Packages.triton.tests.axpy-cuda`
     # or, using `programs.nix-required-mounts`, as `nix build -f "<nixpkgs>" python3Packages.triton.tests.axpy-cuda.gpuCheck`
     axpy-cuda =
diff --git a/pkgs/development/python-modules/vdirsyncer/default.nix b/pkgs/development/python-modules/vdirsyncer/default.nix
index b93b03108767..fa3e4b67be06 100644
--- a/pkgs/development/python-modules/vdirsyncer/default.nix
+++ b/pkgs/development/python-modules/vdirsyncer/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  fetchpatch,
   pythonOlder,
   click,
   click-log,
@@ -38,6 +39,18 @@ buildPythonPackage rec {
     hash = "sha256-5DeFH+uYXew1RGVPj5z23RCbCwP34ZlWCGYDCS/+so8=";
   };
 
+  patches = [
+    (
+      # Fix event_loop missing
+      # TODO: remove it after vdirsyncer release 0.19.4
+      fetchpatch {
+        # https://github.com/pimutils/vdirsyncer/pull/1185
+        url = "https://github.com/pimutils/vdirsyncer/commit/164559ad7a95ed795ce4ae8d9b287bd27704742d.patch";
+        hash = "sha256-nUGvkBnHr8nVPpBuhQ5GjaRs3QSxokdZUEIsOrQ+lpo=";
+      }
+    )
+  ];
+
   nativeBuildInputs = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/rocm-modules/6/default.nix b/pkgs/development/rocm-modules/6/default.nix
index 47588fd29446..a113ce0925ac 100644
--- a/pkgs/development/rocm-modules/6/default.nix
+++ b/pkgs/development/rocm-modules/6/default.nix
@@ -264,21 +264,6 @@ let
       );
       mpi = self.openmpi;
 
-      triton-llvm = triton-llvm.overrideAttrs {
-        src = fetchFromGitHub {
-          owner = "llvm";
-          repo = "llvm-project";
-          # make sure this matches triton llvm rel branch hash for now
-          # https://github.com/triton-lang/triton/blob/release/3.2.x/cmake/llvm-hash.txt
-          rev = "86b69c31642e98f8357df62c09d118ad1da4e16a";
-          hash = "sha256-W/mQwaLGx6/rIBjdzUTIbWrvGjdh7m4s15f70fQ1/hE=";
-        };
-        pname = "triton-llvm-rocm";
-        patches = [ ]; # FIXME: https://github.com/llvm/llvm-project//commit/84837e3cc1cf17ed71580e3ea38299ed2bfaa5f6.patch doesn't apply, may need to rebase
-      };
-
-      triton = pyPackages.callPackage ./triton { rocmPackages = self; };
-
       ## Meta ##
       # Emulate common ROCm meta layout
       # These are mainly for users. I strongly suggest NOT using these in nixpkgs derivations
@@ -454,6 +439,10 @@ let
       };
     }
     // lib.optionalAttrs config.allowAliases {
+      triton = throw ''
+        'rocmPackages.triton' has been removed. Please use python3Packages.triton
+      ''; # Added 2025-08-24
+
       rocm-thunk = throw ''
         'rocm-thunk' has been removed. It's now part of the ROCm runtime.
       ''; # Added 2025-3-16
diff --git a/pkgs/development/rocm-modules/6/triton/default.nix b/pkgs/development/rocm-modules/6/triton/default.nix
deleted file mode 100644
index 8dc20629a219..000000000000
--- a/pkgs/development/rocm-modules/6/triton/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  triton-no-cuda,
-  rocmPackages,
-  fetchFromGitHub,
-}:
-(triton-no-cuda.override (_old: {
-  inherit rocmPackages;
-  rocmSupport = true;
-  stdenv = rocmPackages.llvm.rocmClangStdenv;
-  llvm = rocmPackages.triton-llvm;
-})).overridePythonAttrs
-  (old: {
-    doCheck = false;
-    stdenv = rocmPackages.llvm.rocmClangStdenv;
-    version = "3.2.0";
-    src = fetchFromGitHub {
-      owner = "triton-lang";
-      repo = "triton";
-      rev = "9641643da6c52000c807b5eeed05edaec4402a67"; # "release/3.2.x";
-      hash = "sha256-V1lpARwOLn28ZHfjiWR/JJWGw3MB34c+gz6Tq1GOVfo=";
-    };
-    buildInputs = old.buildInputs ++ [
-      rocmPackages.clr
-    ];
-    dontStrip = true;
-    env = old.env // {
-      CXXFLAGS = "-O3 -I${rocmPackages.clr}/include -I/build/source/third_party/triton/third_party/nvidia/backend/include";
-      TRITON_OFFLINE_BUILD = 1;
-    };
-    patches = [ ];
-    postPatch = ''
-      # Remove nvidia backend so we don't depend on unfree nvidia headers
-      # when we only want to target ROCm
-      rm -rf third_party/nvidia
-      substituteInPlace CMakeLists.txt \
-        --replace-fail "add_subdirectory(test)" ""
-      sed -i '/nvidia\|NVGPU\|registerConvertTritonGPUToLLVMPass\|mlir::test::/Id' bin/RegisterTritonDialects.h
-      sed -i '/TritonTestAnalysis/Id' bin/CMakeLists.txt
-      substituteInPlace python/setup.py \
-        --replace-fail 'backends = [*BackendInstaller.copy(["nvidia", "amd"]), *BackendInstaller.copy_externals()]' \
-        'backends = [*BackendInstaller.copy(["amd"]), *BackendInstaller.copy_externals()]'
-      find . -type f -exec sed -i 's|[<]cupti.h[>]|"cupti.h"|g' {} +
-      find . -type f -exec sed -i 's|[<]cuda.h[>]|"cuda.h"|g' {} +
-      # remove any downloads
-      substituteInPlace python/setup.py \
-        --replace-fail "[get_json_package_info()]" "[]"\
-        --replace-fail "[get_llvm_package_info()]" "[]"\
-        --replace-fail "curr_version != version" "False"
-      # Don't fetch googletest
-      substituteInPlace cmake/AddTritonUnitTest.cmake \
-        --replace-fail 'include(''${PROJECT_SOURCE_DIR}/unittest/googletest.cmake)' "" \
-        --replace-fail "include(GoogleTest)" "find_package(GTest REQUIRED)"
-      substituteInPlace third_party/amd/backend/compiler.py \
-        --replace-fail '"/opt/rocm/llvm/bin/ld.lld"' "os.environ['ROCM_PATH']"' + "/llvm/bin/ld.lld"'
-    '';
-  })
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index 059beb6372c6..c4dfd1374338 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -14,11 +14,11 @@ else
 
   stdenv.mkDerivation rec {
     pname = "dune";
-    version = "3.19.1";
+    version = "3.20.1";
 
     src = fetchurl {
       url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-      hash = "sha256-oQOG+YDNqUF9FGVGa+1Q3SrvnJO50GoPf+7tsKFUEVg=";
+      hash = "sha256-8I6V3igo6JHWiQbkQwtRFwMihSB7W8aE/F1FZS6zDgo=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 98c0dcfb6713..ebca23a792bc 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -24,6 +24,8 @@
   curl,
   python3Packages,
   haskellPackages,
+  testers,
+  zstd,
 }:
 
 stdenv.mkDerivation rec {
@@ -126,6 +128,7 @@ stdenv.mkDerivation rec {
       python-zstd = python3Packages.zstd;
       haskell-zstd = haskellPackages.zstd;
       haskell-hs-zstd = haskellPackages.hs-zstd;
+      pkg-config = testers.hasPkgConfigModules { package = zstd; };
     };
   };
 
@@ -146,5 +149,6 @@ stdenv.mkDerivation rec {
     mainProgram = "zstd";
     platforms = platforms.all;
     maintainers = with maintainers; [ orivej ];
+    pkgConfigModules = [ "libzstd" ];
   };
 }
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 92ff966a5bc1..3f0701ddaa47 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -196,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxkbcommon
     wayland
     wayland-protocols
+    wayland-scanner # For cross, build uses $PKG_CONFIG to look for wayland-scanner
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index eeabea613a75..19f621e4e6db 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10775,6 +10775,8 @@ self: super: with self; {
 
   oocsi = callPackage ../development/python-modules/oocsi { };
 
+  opaque = callPackage ../development/python-modules/opaque { };
+
   opcua-widgets = callPackage ../development/python-modules/opcua-widgets { };
 
   open-clip-torch = callPackage ../development/python-modules/open-clip-torch { };
@@ -10813,6 +10815,8 @@ self: super: with self; {
 
   opencamlib = callPackage ../development/python-modules/opencamlib { };
 
+  opencc = callPackage ../development/python-modules/opencc { };
+
   opencensus = callPackage ../development/python-modules/opencensus { };
 
   opencensus-context = callPackage ../development/python-modules/opencensus-context { };