diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 0392578df488..b516dcea1a87 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -48,7 +48,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@0193454f0c5947491d348f33a275c119f30eb736 # v3.2.1
+        uses: korthout/backport-action@ca4972adce8039ff995e618f5fc02d1b7961f27a # v3.3.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 97049cb08f87..6a2b11c621a1 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -50,7 +50,7 @@ jobs:
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
       - uses: actions/create-github-app-token@0f859bf9e69e887678d5bbfbee594437cb440ffe # v2.1.0
-        if: vars.NIXPKGS_CI_APP_ID
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/ci/github-script/run b/ci/github-script/run
index eeaee253ef42..1d974cf5355f 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -49,7 +49,7 @@ program
   .option('--no-dry', 'Make actual modifications')
   .action(async (owner, repo, pr, options) => {
     const prepare = (await import('./prepare.js')).default
-    run(prepare, owner, repo, pr, options)
+    await run(prepare, owner, repo, pr, options)
   })
 
 program
@@ -61,7 +61,7 @@ program
   .option('--no-cherry-picks', 'Do not expect cherry-picks.')
   .action(async (owner, repo, pr, options) => {
     const commits = (await import('./commits.js')).default
-    run(commits, owner, repo, pr, options)
+    await run(commits, owner, repo, pr, options)
   })
 
 program
@@ -77,7 +77,7 @@ program
     try {
       process.env.GITHUB_WORKSPACE = tmp
       process.chdir(tmp)
-      run(labels, owner, repo, pr, options)
+      await run(labels, owner, repo, pr, options)
     } finally {
       rmSync(tmp, { recursive: true })
     }
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 1b956d41d37f..7650b35d5cc7 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -114,6 +114,8 @@
 
 - `lisp-modules` were brought in sync with the [June 2025 Quicklisp release](http://blog.quicklisp.org/2025/07/june-2025-quicklisp-dist-now-available.html).
 
+- `ffmpeg_8`, `ffmpeg_8-headless`, and `ffmpeg_8-full` have been added. The default version of FFmpeg remains ffmpeg_7 for now, though this may change before release.
+
 - `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
   If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.
 
diff --git a/nixos/modules/system/boot/systemd/user.nix b/nixos/modules/system/boot/systemd/user.nix
index 6d60e7c1e7f1..802893cecf13 100644
--- a/nixos/modules/system/boot/systemd/user.nix
+++ b/nixos/modules/system/boot/systemd/user.nix
@@ -120,6 +120,13 @@ in
     };
 
     systemd.user.tmpfiles = {
+      enable =
+        (mkEnableOption "systemd user units systemd-tmpfiles-setup.service and systemd-tmpfiles-clean.timer")
+        // {
+          default = true;
+          example = false;
+        };
+
       rules = mkOption {
         type = types.listOf types.str;
         default = [ ];
@@ -210,11 +217,15 @@ in
       // mapAttrs' (n: v: nameValuePair "${n}.target" (targetToUnit v)) cfg.targets
       // mapAttrs' (n: v: nameValuePair "${n}.timer" (timerToUnit v)) cfg.timers;
 
+    systemd.user.timers = {
+      # enable systemd user tmpfiles
+      systemd-tmpfiles-clean.wantedBy = optional cfg.tmpfiles.enable "timers.target";
+    }
     # Generate timer units for all services that have a ‘startAt’ value.
-    systemd.user.timers = mapAttrs (name: service: {
+    // (mapAttrs (name: service: {
       wantedBy = [ "timers.target" ];
       timerConfig.OnCalendar = service.startAt;
-    }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services);
+    }) (filterAttrs (name: service: service.startAt != [ ]) cfg.services));
 
     # Provide the systemd-user PAM service, required to run systemd
     # user instances.
@@ -233,9 +244,7 @@ in
     systemd.services.systemd-user-sessions.restartIfChanged = false; # Restart kills all active sessions.
 
     # enable systemd user tmpfiles
-    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional (
-      cfg.tmpfiles.rules != [ ] || any (cfg': cfg'.rules != [ ]) (attrValues cfg.tmpfiles.users)
-    ) "basic.target";
+    systemd.user.services.systemd-tmpfiles-setup.wantedBy = optional cfg.tmpfiles.enable "basic.target";
 
     # /run/current-system/sw/etc/xdg is in systemd's $XDG_CONFIG_DIRS so we can
     # write the tmpfiles.d rules for everyone there
diff --git a/nixos/tests/slurm.nix b/nixos/tests/slurm.nix
index 1747e714117a..76041f87187a 100644
--- a/nixos/tests/slurm.nix
+++ b/nixos/tests/slurm.nix
@@ -49,6 +49,16 @@ let
       mkdir -p $out/bin
       ${lib.getDev pkgs.mpi}/bin/mpicc ${mpitestC} -o $out/bin/mpitest
     '';
+
+  sbatchOutput = "/tmp/shared/sbatch.log";
+  sbatchScript = pkgs.writeText "sbatchScript" ''
+    #!${pkgs.runtimeShell}
+    #SBATCH --nodes 1
+    #SBATCH --ntasks 1
+    #SBATCH --output ${sbatchOutput}
+
+    echo "sbatch success"
+  '';
 in
 {
   name = "slurm";
@@ -127,43 +137,38 @@ in
     };
 
   testScript = ''
-    start_all()
-
-    # Make sure DBD is up after DB initialzation
     with subtest("can_start_slurmdbd"):
-        dbd.succeed("systemctl restart slurmdbd")
         dbd.wait_for_unit("slurmdbd.service")
         dbd.wait_for_open_port(6819)
 
-    # there needs to be an entry for the current
-    # cluster in the database before slurmctld is restarted
-    with subtest("add_account"):
-        control.succeed("sacctmgr -i add cluster default")
-        # check for cluster entry
-        control.succeed("sacctmgr list cluster | awk '{ print $1 }' | grep default")
-
-    with subtest("can_start_slurmctld"):
-        control.succeed("systemctl restart slurmctld")
+    with subtest("cluster_is_initialized"):
+        control.wait_for_unit("multi-user.target")
         control.wait_for_unit("slurmctld.service")
+        control.wait_until_succeeds("sacctmgr list cluster | awk '{ print $1 }' | grep default")
+
+    start_all()
 
     with subtest("can_start_slurmd"):
         for node in [node1, node2, node3]:
-            node.succeed("systemctl restart slurmd.service")
             node.wait_for_unit("slurmd")
 
     # Test that the cluster works and can distribute jobs;
+    submit.wait_for_unit("multi-user.target")
 
     with subtest("run_distributed_command"):
         # Run `hostname` on 3 nodes of the partition (so on all the 3 nodes).
         # The output must contain the 3 different names
         submit.succeed("srun -N 3 hostname | sort | uniq | wc -l | xargs test 3 -eq")
 
-        with subtest("check_slurm_dbd"):
+        with subtest("check_slurm_dbd_job"):
             # find the srun job from above in the database
-            control.succeed("sleep 5")
-            control.succeed("sacct | grep hostname")
+            control.wait_until_succeeds("sacct | grep hostname")
 
     with subtest("run_PMIx_mpitest"):
         submit.succeed("srun -N 3 --mpi=pmix mpitest | grep size=3")
+
+    with subtest("run_sbatch"):
+        submit.succeed("sbatch --wait ${sbatchScript}")
+        submit.succeed("grep 'sbatch success' ${sbatchOutput}")
   '';
 }
diff --git a/nixos/tests/systemd-user-tmpfiles-rules.nix b/nixos/tests/systemd-user-tmpfiles-rules.nix
index c74a52c4f169..db621c5e606f 100644
--- a/nixos/tests/systemd-user-tmpfiles-rules.nix
+++ b/nixos/tests/systemd-user-tmpfiles-rules.nix
@@ -6,9 +6,8 @@
     maintainers = [ schnusch ];
   };
 
-  nodes.machine =
-    { ... }:
-    {
+  nodes = rec {
+    machine = {
       users.users = {
         alice.isNormalUser = true;
         bob.isNormalUser = true;
@@ -21,8 +20,22 @@
         users.alice.rules = [
           "d %h/only_alice"
         ];
+        users.bob.rules = [
+          "D %h/cleaned_up - - - 0"
+        ];
+      };
+
+      # run every 10 seconds
+      systemd.user.timers.systemd-tmpfiles-clean.timerConfig = {
+        OnStartupSec = "10s";
+        OnUnitActiveSec = "10s";
       };
     };
+    disabled = {
+      imports = [ machine ];
+      systemd.user.tmpfiles.enable = false;
+    };
+  };
 
   testScript =
     { ... }:
@@ -36,5 +49,16 @@
       machine.wait_until_succeeds("systemctl --user --machine=bob@ is-active systemd-tmpfiles-setup.service")
       machine.succeed("[ -d ~bob/user_tmpfiles_created ]")
       machine.succeed("[ ! -e ~bob/only_alice ]")
+
+      machine.succeed("systemctl --user --machine=bob@ is-active systemd-tmpfiles-clean.timer")
+      machine.succeed("runuser -u bob -- touch ~bob/cleaned_up/file")
+      machine.wait_until_fails("[ -e ~bob/cleaned_up/file ]")
+
+      # disabled user tmpfiles
+      disabled.succeed("loginctl enable-linger alice bob")
+      for user in ("alice", "bob"):
+          for verb in ("is-enabled", "is-active"):
+              for unit in ("systemd-tmpfiles-setup.service", "systemd-tmpfiles-clean.timer"):
+                  disabled.fail(f"systemctl --user --machine={user}@ {verb} {unit}")
     '';
 }
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 78c064422cec..58f4d38bf28f 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -12415,6 +12415,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  perfanno-nvim = buildVimPlugin {
+    pname = "perfanno.nvim";
+    version = "2024-12-28";
+    src = fetchFromGitHub {
+      owner = "t-troebst";
+      repo = "perfanno.nvim";
+      rev = "8640d6655f17a79af8de3153af2ce90c03f65e86";
+      sha256 = "1097sppcsw41asps1k51ic9h4z0hpzgc44kjfcyqdhclnxwady81";
+    };
+    meta.homepage = "https://github.com/t-troebst/perfanno.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   persisted-nvim = buildVimPlugin {
     pname = "persisted.nvim";
     version = "2025-08-16";
@@ -20126,6 +20139,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-rhai = buildVimPlugin {
+    pname = "vim-rhai";
+    version = "2022-07-16";
+    src = fetchFromGitHub {
+      owner = "rhaiscript";
+      repo = "vim-rhai";
+      rev = "b0585e2c92a4a64edcd060836ae41d1e698ebc20";
+      sha256 = "0m36d7f2zkb5197k3gfjdhidpl2j50y2n2ywg1mxv4a55b06vfbh";
+    };
+    meta.homepage = "https://github.com/rhaiscript/vim-rhai/";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-rhubarb = buildVimPlugin {
     pname = "vim-rhubarb";
     version = "2025-06-27";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 001f8138a7ac..a319de91ea6c 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -24,6 +24,7 @@
   direnv,
   fzf,
   gawk,
+  gperf,
   helm-ls,
   himalaya,
   htop,
@@ -2972,6 +2973,11 @@ in
     ];
   });
 
+  perfanno-nvim = super.perfanno-nvim.overrideAttrs (old: {
+    dependencies = [ gperf ];
+    meta.maintainers = with lib.maintainers; [ fredeb ];
+  });
+
   persisted-nvim = super.persisted-nvim.overrideAttrs {
     nvimSkipModules = [
       # /lua/persisted/init.lua:44: attempt to index upvalue 'config' (a nil value)
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 530c56e0394f..954c16213677 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -953,6 +953,7 @@ https://github.com/lewis6991/pckr.nvim/,HEAD,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
 https://github.com/toppair/peek.nvim/,HEAD,
+https://github.com/t-troebst/perfanno.nvim/,HEAD,
 https://github.com/olimorris/persisted.nvim/,HEAD,
 https://github.com/folke/persistence.nvim/,,
 https://github.com/Weissle/persistent-breakpoints.nvim/,,
@@ -1545,6 +1546,7 @@ https://github.com/tpope/vim-ragtag/,,
 https://github.com/tpope/vim-rails/,,
 https://github.com/jordwalke/vim-reasonml/,,
 https://github.com/tpope/vim-repeat/,,
+https://github.com/rhaiscript/vim-rhai/,,
 https://github.com/tpope/vim-rhubarb/,,
 https://github.com/airblade/vim-rooter/,,
 https://github.com/tpope/vim-rsi/,,
diff --git a/pkgs/applications/office/trilium/0001-Use-console-logger-instead-of-rolling-files.patch b/pkgs/applications/office/trilium/0001-Use-console-logger-instead-of-rolling-files.patch
deleted file mode 100644
index 68f203b464b2..000000000000
--- a/pkgs/applications/office/trilium/0001-Use-console-logger-instead-of-rolling-files.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-diff --git a/src/services/log.js b/src/services/log.js
-index a141eae14..094b9381b 100644
---- a/src/services/log.js
-+++ b/src/services/log.js
-@@ -1,15 +1,7 @@
- "use strict";
- 
--const fs = require('fs');
--const dataDir = require('./data_dir.js');
- const cls = require('./cls.js');
- 
--if (!fs.existsSync(dataDir.LOG_DIR)) {
--    fs.mkdirSync(dataDir.LOG_DIR, 0o700);
--}
--
--let logFile = null;
--
- const SECOND = 1000;
- const MINUTE = 60 * SECOND;
- const HOUR = 60 * MINUTE;
-@@ -17,38 +9,6 @@ const DAY = 24 * HOUR;
- 
- const NEW_LINE = process.platform === "win32" ? '\r\n' : '\n';
- 
--let todaysMidnight = null;
--
--initLogFile();
--
--function getTodaysMidnight() {
--    const now = new Date();
--
--    return new Date(now.getFullYear(), now.getMonth(), now.getDate());
--}
--
--function initLogFile() {
--    todaysMidnight = getTodaysMidnight();
--
--    const path = `${dataDir.LOG_DIR}/trilium-${formatDate()}.log`;
--
--    if (logFile) {
--        logFile.end();
--    }
--
--    logFile = fs.createWriteStream(path, {flags: 'a'});
--}
--
--function checkDate(millisSinceMidnight) {
--    if (millisSinceMidnight >= DAY) {
--        initLogFile();
--
--        millisSinceMidnight -= DAY;
--    }
--
--    return millisSinceMidnight;
--}
--
- function log(str) {
-     const bundleNoteId = cls.get("bundleNoteId");
- 
-@@ -56,12 +16,6 @@ function log(str) {
-         str = `[Script ${bundleNoteId}] ${str}`;
-     }
- 
--    let millisSinceMidnight = Date.now() - todaysMidnight.getTime();
--
--    millisSinceMidnight = checkDate(millisSinceMidnight);
--
--    logFile.write(`${formatTime(millisSinceMidnight)} ${str}${NEW_LINE}`);
--
-     console.log(str);
- }
- 
\ No newline at end of file
diff --git a/pkgs/applications/office/trilium/default.nix b/pkgs/applications/office/trilium/default.nix
deleted file mode 100644
index b910e548ba6f..000000000000
--- a/pkgs/applications/office/trilium/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, callPackage, ... }:
-
-let
-  metaCommon = with lib; {
-    description = "Hierarchical note taking application with focus on building large personal knowledge bases";
-    homepage = "https://github.com/zadam/trilium";
-    license = licenses.agpl3Plus;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [
-      fliegendewurst
-      eliandoran
-    ];
-  };
-in
-{
-
-  trilium-desktop = callPackage ./desktop.nix { metaCommon = metaCommon; };
-  trilium-server = callPackage ./server.nix { metaCommon = metaCommon; };
-
-}
diff --git a/pkgs/applications/office/trilium/desktop.nix b/pkgs/applications/office/trilium/desktop.nix
deleted file mode 100644
index 2a812f6d00b7..000000000000
--- a/pkgs/applications/office/trilium/desktop.nix
+++ /dev/null
@@ -1,113 +0,0 @@
-{
-  stdenv,
-  lib,
-  unzip,
-  autoPatchelfHook,
-  fetchurl,
-  makeWrapper,
-  alsa-lib,
-  libgbm,
-  nss,
-  nspr,
-  systemd,
-  makeDesktopItem,
-  copyDesktopItems,
-  wrapGAppsHook3,
-  metaCommon,
-}:
-
-let
-  pname = "trilium-desktop";
-  version = "0.63.6";
-
-  linuxSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-  linuxSource.sha256 = "12kgq5x4f93hxz057zqhz0x1y0rxfxh90fv9fjjs3jrnk0by7f33";
-
-  darwinSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-mac-x64-${version}.zip";
-  darwinSource.sha256 = "0ry512cn622av3nm8rnma2yvqc71rpzax639872ivvc5vm4rsc30";
-
-  meta = metaCommon // {
-    mainProgram = "trilium";
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-  };
-
-  linux = stdenv.mkDerivation rec {
-    inherit pname version meta;
-
-    src = fetchurl linuxSource;
-
-    # TODO: migrate off autoPatchelfHook and use nixpkgs' electron
-    nativeBuildInputs = [
-      autoPatchelfHook
-      makeWrapper
-      wrapGAppsHook3
-      copyDesktopItems
-    ];
-
-    buildInputs = [
-      alsa-lib
-      libgbm
-      nss
-      nspr
-      stdenv.cc.cc
-      systemd
-    ];
-
-    desktopItems = [
-      (makeDesktopItem {
-        name = "Trilium";
-        exec = "trilium";
-        icon = "trilium";
-        comment = meta.description;
-        desktopName = "Trilium Notes";
-        categories = [ "Office" ];
-        startupWMClass = "trilium notes";
-      })
-    ];
-
-    # Remove trilium-portable.sh, so trilium knows it is packaged making it stop auto generating a desktop item on launch
-    postPatch = ''
-      rm ./trilium-portable.sh
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/bin
-      mkdir -p $out/share/trilium
-      mkdir -p $out/share/icons/hicolor/128x128/apps
-
-      cp -r ./* $out/share/trilium
-      ln -s $out/share/trilium/trilium $out/bin/trilium
-
-      ln -s $out/share/trilium/icon.png $out/share/icons/hicolor/128x128/apps/trilium.png
-      runHook postInstall
-    '';
-
-    # LD_LIBRARY_PATH "shouldn't" be needed, remove when possible :)
-    # Error: libstdc++.so.6: cannot open shared object file: No such file or directory
-    preFixup = ''
-      gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs})
-    '';
-
-    dontStrip = true;
-
-    passthru.updateScript = ./update.sh;
-  };
-
-  darwin = stdenv.mkDerivation {
-    inherit pname version meta;
-
-    src = fetchurl darwinSource;
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out/Applications
-      cp -r *.app $out/Applications
-    '';
-  };
-
-in
-if stdenv.hostPlatform.isDarwin then darwin else linux
diff --git a/pkgs/applications/office/trilium/server.nix b/pkgs/applications/office/trilium/server.nix
deleted file mode 100644
index 4b1770dbd3d8..000000000000
--- a/pkgs/applications/office/trilium/server.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  lib,
-  stdenv,
-  autoPatchelfHook,
-  fetchurl,
-  nixosTests,
-  metaCommon,
-}:
-
-let
-  serverSource.url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-  serverSource.sha256 = "0gwp6h6nvfzq7k1g3233h838nans45jkd5c3pzl6qdhhm19vcs27";
-  version = "0.63.6";
-in
-stdenv.mkDerivation {
-  pname = "trilium-server";
-  inherit version;
-  meta = metaCommon // {
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "trilium-server";
-  };
-
-  src = fetchurl serverSource;
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-  ];
-
-  buildInputs = [
-    (lib.getLib stdenv.cc.cc)
-  ];
-
-  patches = [
-    # patch logger to use console instead of rolling files
-    ./0001-Use-console-logger-instead-of-rolling-files.patch
-  ];
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    mkdir -p $out/share/trilium-server
-
-    cp -r ./* $out/share/trilium-server
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    cat > $out/bin/trilium-server <<EOF
-    #!${stdenv.cc.shell}
-    cd $out/share/trilium-server
-    exec ./node/bin/node src/www
-    EOF
-    chmod a+x $out/bin/trilium-server
-
-    # ERROR: noBrokenSymlinks: found 4 dangling symlinks, 0 reflexive symlinks and 0 unreadable symlinks
-    unlink $out/share/trilium-server/node/bin/npx
-    unlink $out/share/trilium-server/node/bin/npm
-    unlink $out/share/trilium-server/node_modules/.bin/electron
-    unlink $out/share/trilium-server/node_modules/.bin/electron-installer-debian
-  '';
-
-  passthru.tests = {
-    trilium-server = nixosTests.trilium-server;
-  };
-}
diff --git a/pkgs/applications/office/trilium/update.sh b/pkgs/applications/office/trilium/update.sh
deleted file mode 100755
index e292609e3f75..000000000000
--- a/pkgs/applications/office/trilium/update.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq
-set -euo pipefail
-
-cd $(dirname "${BASH_SOURCE[0]}")
-
-setKV () {
-    sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1
-}
-
-version=$(curl -s --show-error "https://api.github.com/repos/zadam/trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
-
-# Update desktop application
-sha256_linux64=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz)
-sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-mac-x64-${version}.zip)
-setKV ./desktop.nix version $version
-setKV ./desktop.nix linuxSource.sha256 $sha256_linux64
-setKV ./desktop.nix darwinSource.sha256 $sha256_darwin64
-
-# Update server
-sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz)
-setKV ./server.nix version $version
-setKV ./server.nix serverSource.sha256 $sha256_linux64_server
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 98542ee3aabc..4e313ed8784c 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -169,8 +169,12 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     perl
 
-    # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
-    (python3Packages.python.withPackages (ps: with ps; [ distlib ]))
+    # For python changes other than simple package additions, ping @dramforever for review.
+    # Don't change `python3Packages` to `python3.pkgs.*`, breaks cross-compilation.
+    python3Packages.distlib
+    # Hooks from the python package are needed to add `$pythonPath` so
+    # `python/scripts/mkvenv.py` can detect `meson` otherwise the vendored meson without patches will be used.
+    python3Packages.python
   ]
   ++ lib.optionals gtkSupport [ wrapGAppsHook3 ]
   ++ lib.optionals enableDocs [
diff --git a/pkgs/by-name/_0/_0xffff/package.nix b/pkgs/by-name/_0/_0xffff/package.nix
new file mode 100644
index 000000000000..b30e4a273375
--- /dev/null
+++ b/pkgs/by-name/_0/_0xffff/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libusb-compat-0_1,
+  versionCheckHook,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "0xFFFF";
+  version = "0.10";
+
+  src = fetchFromGitHub {
+    owner = "pali";
+    repo = "0xFFFF";
+    tag = finalAttrs.version;
+    hash = "sha256-RTpiH6OpC1hRbhLW5Em01oDQdpAZ/mfggCDLSUzOC9s=";
+  };
+
+  strictDeps = true;
+
+  buildInputs = [ libusb-compat-0_1 ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "PREFIX="
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-h";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Open Free Fiasco Firmware Flasher for Maemo devices";
+    homepage = "https://github.com/pali/0xFFFF";
+    changelog = "https://github.com/pali/0xFFFF/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ungeskriptet ];
+    mainProgram = "0xFFFF";
+  };
+})
diff --git a/pkgs/by-name/bo/boxflat/package.nix b/pkgs/by-name/bo/boxflat/package.nix
index b42156eab9e9..71c1242a8807 100644
--- a/pkgs/by-name/bo/boxflat/package.nix
+++ b/pkgs/by-name/bo/boxflat/package.nix
@@ -48,7 +48,8 @@ python3Packages.buildPythonPackage rec {
   postPatch = ''
     substituteInPlace requirements.txt \
         --replace-fail "psutil==6.1.0" "psutil" \
-        --replace-fail "evdev==1.7.1" "evdev"
+        --replace-fail "evdev==1.7.1" "evdev" \
+        --replace-fail "pycairo==1.27.0" "pycairo"
   '';
 
   preBuild = ''
diff --git a/pkgs/by-name/ci/ci-edit/package.nix b/pkgs/by-name/ci/ci-edit/package.nix
deleted file mode 100644
index 02963c7e382c..000000000000
--- a/pkgs/by-name/ci/ci-edit/package.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  lib,
-  python3,
-  fetchFromGitHub,
-}:
-
-python3.pkgs.buildPythonApplication {
-  pname = "ci-edit";
-  version = "51-unstable-2023-04-11";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "ci_edit";
-    # Last build iteration is v51 from 2021, but there are some recent
-    # additions of syntax highlighting and dictionary files.
-    rev = "2976f01dc6421b5639505292b335212d413d044f";
-    hash = "sha256-DwVNNotRcYbvJX6iXffSQyZMFTxQexIhfG8reFmozN8=";
-  };
-
-  nativeBuildInputs = with python3.pkgs; [
-    setuptools
-  ];
-
-  postInstall = ''
-    ln -s $out/bin/ci.py $out/bin/ci_edit
-    ln -s $out/bin/ci.py $out/bin/we
-    install -Dm644 $src/app/*.words $out/${python3.sitePackages}/app/
-  '';
-
-  pythonImportsCheck = [ "app" ];
-
-  meta = with lib; {
-    description = "Terminal text editor with mouse support and ctrl+Q to quit";
-    homepage = "https://github.com/google/ci_edit";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ katexochen ];
-    mainProgram = "ci_edit";
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 12f4421556af..51b53deb0420 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.90"
+        "@anthropic-ai/claude-code": "^1.0.92"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.90",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.90.tgz",
-      "integrity": "sha512-waC7GC4fnfyiFVFTS7Eo4MAS/iEYpyM67JZFXr+B07bOkjBYtBqXh77+Z/btcyI8NxvUtpnFS0R5FXkU/tKCwg==",
+      "version": "1.0.92",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.92.tgz",
+      "integrity": "sha512-/XuwJqAvXwIGf9WeZOxHI6qQsAGzxhrRc3hyQdvwW6cU5iviTmrxWasksPbJMvFt6KQoAUU6XHs78XyYmBpOXQ==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index eb2cdfdceabb..30135b447218 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.90";
+  version = "1.0.92";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-dI3nnuN5a8lBsuTVGzEASxqxCKr2KrTpBdEIgk/47Kw=";
+    hash = "sha256-xW+oI91wL+DFaOHw5M84QJktuE9HXb031pGbrNcrpPQ=";
   };
 
-  npmDepsHash = "sha256-LinE6hbDhvZ5RlkRSzQMC+JbnmocQRosJLo5aP4p3hE=";
+  npmDepsHash = "sha256-rrMskQkWKz+B5dqJ8gHgBxO20OdgE3d53TJWDxeJGbo=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/js/json-fortran/package.nix b/pkgs/by-name/js/json-fortran/package.nix
index aa18a56a6899..ffe328b197bb 100644
--- a/pkgs/by-name/js/json-fortran/package.nix
+++ b/pkgs/by-name/js/json-fortran/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "json-fortran";
-  version = "9.0.4";
+  version = "9.0.5";
 
   src = fetchFromGitHub {
     owner = "jacobwilliams";
     repo = "json-fortran";
     rev = version;
-    hash = "sha256-tLDs/yh9xMfZd2m+jD6Mm3Lr4asI4SrBDOAU2vN5OfA=";
+    hash = "sha256-4IyysBcGKJKET8A5Bbbd5WJtlNh/7EdHuXsR6B/VDh0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libjpeg-tools/package.nix b/pkgs/by-name/li/libjpeg-tools/package.nix
new file mode 100644
index 000000000000..02b166817efe
--- /dev/null
+++ b/pkgs/by-name/li/libjpeg-tools/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libjpeg-tools";
+  version = "1.71";
+
+  src = fetchFromGitHub {
+    owner = "thorfdbg";
+    repo = "libjpeg";
+    rev = "25f71280913fde7400801772bbf885bb3e873242";
+    hash = "sha256-40yb9EujJp9y1PnuYLcPxK31Kj2Q4UQ5YBwXQFYXI/Y=";
+  };
+
+  outputs = [
+    "out"
+    "lib"
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    make lib
+    make final
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -m755 -D jpeg $out/bin/jpeg
+    install -m644 -D libjpeg.so $lib/lib/libjpeg
+    runHook postInstall
+  '';
+
+  doCheck = false; # no tests
+
+  meta = {
+    description = "A complete implementation of 10918-1 (JPEG) coming from jpeg.org (the ISO group) with extensions for HDR, lossless and alpha channel coding standardized as ISO/IEC 18477 (JPEG XT)";
+    homepage = "https://github.com/thorfdbg/libjpeg";
+    license = with lib.licenses; [ gpl3 ];
+    changelog = "https://github.com/thorfdbg/libjpeg/README.history";
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    platforms = lib.platforms.unix;
+    mainProgram = "jpeg";
+    # clang build fails with "ld: symbol(s) not found for architecture arm64" (on aarch64-darwin)
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})
diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
index 92d10debd1cd..7316c456b846 100644
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "14.5.5";
+  version = "14.5.6";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-PwqxYylW602XAKBvEJk4Rl8q6nWBGH3pFvTOuAYtr/w=";
+      hash = "sha256-oUbeteUlgQIzRezEQy9APDtXWX8RuOCtUXQAWlzqkyM=";
     };
   };
 
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index b05ca97d35a1..a8f4838c1f87 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -117,13 +117,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.11.4";
+  version = "0.11.7";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-joIA/rH8j+SJH5EVMr6iqKLve6bkntPQM43KCN9JTZ8=";
+    hash = "sha256-rSKuLdfbmAyGTkhfdE9GuywuQweeA5WfNwP/wGMN4So=";
   };
 
   vendorHash = "sha256-SlaDsu001TUW+t9WRp7LqxUSQSGDF1Lqu9M1bgILoX4=";
diff --git a/pkgs/by-name/op/openapv/package.nix b/pkgs/by-name/op/openapv/package.nix
new file mode 100644
index 000000000000..b4f7e162b8b5
--- /dev/null
+++ b/pkgs/by-name/op/openapv/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  writeText,
+  fetchFromGitHub,
+  cmake,
+}:
+let
+  # Requires an /etc/os-release file, so we override it with this.
+  osRelease = writeText "os-release" ''ID=NixOS'';
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openapv";
+  version = "0.2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "AcademySoftwareFoundation";
+    repo = "openapv";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Edj3xQ7AcHcdIbg4o2FidAGZ06fUBltW+1ojJPoIktA=";
+  };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "/etc/os-release" "${osRelease}"
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = {
+    changelog = "https://github.com/AcademySoftwareFoundation/openapv/releases/tag/v${finalAttrs.version}";
+    description = "Reference implementation of the APV codec";
+    homepage = "https://github.com/AcademySoftwareFoundation/openapv";
+    license = [ lib.licenses.bsd3 ];
+    maintainers = with lib.maintainers; [ pyrox0 ];
+  };
+})
diff --git a/pkgs/by-name/pl/plumed/package.nix b/pkgs/by-name/pl/plumed/package.nix
index c2d64c559678..c1131d48cd3f 100644
--- a/pkgs/by-name/pl/plumed/package.nix
+++ b/pkgs/by-name/pl/plumed/package.nix
@@ -9,13 +9,13 @@ assert !blas.isILP64;
 
 stdenv.mkDerivation rec {
   pname = "plumed";
-  version = "2.9.3";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "plumed";
     repo = "plumed2";
     rev = "v${version}";
-    hash = "sha256-KN412t64tp3QUQkhpLU3sAYDosQ3hw9HqpT1fzt5fwA=";
+    hash = "sha256-aFX8u+XNb7LARm1jtzWzIvZE5qHFaudtp45Om1Fridg=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/pr/prettierd/package.nix b/pkgs/by-name/pr/prettierd/package.nix
index 56bca3bb7711..2568f921bfbd 100644
--- a/pkgs/by-name/pr/prettierd/package.nix
+++ b/pkgs/by-name/pr/prettierd/package.nix
@@ -13,18 +13,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prettierd";
-  version = "0.26.1";
+  version = "0.26.2";
 
   src = fetchFromGitHub {
     owner = "fsouza";
     repo = "prettierd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8IlPC4KCFKJAbCVPl+vK9WustevKHOLbh41F6vMwHX4=";
+    hash = "sha256-KvFOvWQZBppvHbvUvGQu39j8aV/pQFwfuqjFQqdb7lI=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-M7mLkDHJa4iz6u3LSIIq3xCbYbiR0pPAkOK1MjJKstI=";
+    hash = "sha256-Rf7km2WUODqWu8U8iiHNrb5dMamIm1XCsRnldO71j5A=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ri/rime-wanxiang/package.nix b/pkgs/by-name/ri/rime-wanxiang/package.nix
index 0f4679d2cf3a..ee4f4c1d55e9 100644
--- a/pkgs/by-name/ri/rime-wanxiang/package.nix
+++ b/pkgs/by-name/ri/rime-wanxiang/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-wanxiang";
-  version = "11.1.4";
+  version = "11.3.1";
 
   src = fetchFromGitHub {
     owner = "amzxyz";
     repo = "rime_wanxiang";
     tag = "v" + finalAttrs.version;
-    hash = "sha256-mBfa2XF76dMv5Et54I0LQwgelKAdosLXaO3zPpS5nAU=";
+    hash = "sha256-tCQ2mPOw7meA7ex7e4BgVco86MNNtxsSC9L6oaVebo4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/spatialite-gui/package.nix b/pkgs/by-name/sp/spatialite-gui/package.nix
index 88193e2cbe8f..42ec69fcee55 100644
--- a/pkgs/by-name/sp/spatialite-gui/package.nix
+++ b/pkgs/by-name/sp/spatialite-gui/package.nix
@@ -20,17 +20,17 @@
   proj,
   sqlite,
   virtualpg,
-  wxGTK,
+  wxGTK32,
   xz,
   zstd,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "spatialite-gui";
   version = "2.1.0-beta1";
 
   src = fetchurl {
-    url = "https://www.gaia-gis.it/gaia-sins/spatialite-gui-sources/spatialite_gui-${version}.tar.gz";
+    url = "https://www.gaia-gis.it/gaia-sins/spatialite-gui-sources/spatialite_gui-${finalAttrs.version}.tar.gz";
     hash = "sha256-ukjZbfGM68P/I/aXlyB64VgszmL0WWtpuuMAyjwj2zM=";
   };
 
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     proj
     sqlite
     virtualpg
-    wxGTK
+    wxGTK32
     xz
     zstd
   ];
@@ -68,12 +68,12 @@ stdenv.mkDerivation rec {
     rm -fr $out/share
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Graphical user interface for SpatiaLite";
     homepage = "https://www.gaia-gis.it/fossil/spatialite_gui";
-    license = licenses.gpl3Plus;
-    platforms = platforms.unix;
-    teams = [ teams.geospatial ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+    teams = [ lib.teams.geospatial ];
     mainProgram = "spatialite_gui";
   };
-}
+})
diff --git a/pkgs/by-name/ta/tayga/package.nix b/pkgs/by-name/ta/tayga/package.nix
index 5e6adac35c75..718bf40dbd0d 100644
--- a/pkgs/by-name/ta/tayga/package.nix
+++ b/pkgs/by-name/ta/tayga/package.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-xOm4fetFq2UGuhOojrT8WOcX78c6MLTMVbDv+O62x2E=";
   };
 
+  makeFlags = [ "CC=${lib.getExe stdenv.cc}" ];
+
   preBuild = ''
     echo "#define TAYGA_VERSION \"${finalAttrs.version}\"" > version.h
   '';
diff --git a/pkgs/by-name/ta/taze/package.nix b/pkgs/by-name/ta/taze/package.nix
index a4bd2fe26c45..c1556a9d2105 100644
--- a/pkgs/by-name/ta/taze/package.nix
+++ b/pkgs/by-name/ta/taze/package.nix
@@ -13,19 +13,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taze";
-  version = "19.1.0";
+  version = "19.3.0";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "taze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hBXs8S8mOMV7FQIhCzJuhcbTczkwMc5B44fTacAJvyw=";
+    hash = "sha256-sgQHXaa8mPpmFgYfAVksjokuCvuYnT9blJRWG/tXdA8=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-aUMV2REINp5LDcj1s8bgQAj/4508UEewu+ebD+JT0+M=";
+    hash = "sha256-Wb19IIh9SKc0/Uvh3Tq0SlxU5Yd5ivn493uiPUtXKbk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tp/tparse/package.nix b/pkgs/by-name/tp/tparse/package.nix
index 5fe61b6088a7..2925a24cae93 100644
--- a/pkgs/by-name/tp/tparse/package.nix
+++ b/pkgs/by-name/tp/tparse/package.nix
@@ -5,7 +5,7 @@
 }:
 let
   pname = "tparse";
-  version = "0.17.0";
+  version = "0.18.0";
 in
 buildGoModule {
   inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
     owner = "mfridman";
     repo = "tparse";
     rev = "v${version}";
-    hash = "sha256-yU4hP+EJ+Ci3Ms0dAoSuqZFT9RRwqmN1V0x5cV+87z0=";
+    hash = "sha256-oJApKmdo8uvnm6npXpzcKBRRkZ901AH1kZqGuoLdB3U=";
   };
 
-  vendorHash = "sha256-m0YTGzzjr7/4+vTNhfPb7y2xtsI/y4Q2pbg+3yqSFaw=";
+  vendorHash = "sha256-4W6RryyQByUcwM2P2jmG2wXjNMrnpcCTSOJiw1M/Kd0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tr/trilium-next-desktop/package.nix b/pkgs/by-name/tr/trilium-desktop/package.nix
similarity index 77%
rename from pkgs/by-name/tr/trilium-next-desktop/package.nix
rename to pkgs/by-name/tr/trilium-desktop/package.nix
index 08ecf72c2075..76ae0feb72c6 100644
--- a/pkgs/by-name/tr/trilium-next-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-desktop/package.nix
@@ -14,28 +14,28 @@
 }:
 
 let
-  pname = "trilium-next-desktop";
-  version = "0.97.2";
+  pname = "trilium-desktop";
+  version = "0.98.0";
 
-  triliumSource = os: arch: sha256: {
+  triliumSource = os: arch: hash: {
     url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip";
-    inherit sha256;
+    inherit hash;
   };
 
   linuxSource = triliumSource "linux";
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.sha256 = "12ms6knzaawryf7qisfnj5fj7v1icvkq7r0fpw55aajm7y0mpmf0";
-  aarch64-linux.sha256 = "0qgvasic531crlckwqn8mm9aimm7kliab2y7i264k60pb8h5spmp";
-  x86_64-darwin.sha256 = "1dam3ig7z21vi6icd4ww46smgn4d7kis3r51h0r5cvi8mc9ahq1i";
-  aarch64-darwin.sha256 = "0wysa3kacxryv1g1rmqm4ikjv9hfp1bqjcv1yn8drsi80zscm4lj";
+  x86_64-linux.hash = "sha256-GrREVY6P9L0ymH6QbXdtOm3mNzFD3u8HAOWDI7/x1VU=";
+  aarch64-linux.hash = "sha256-bLeU2REsKuVRei3WujGJEponiCZAviE8WyofWu2/NPg=";
+  x86_64-darwin.hash = "sha256-pN+6HapDxL/anMQJ2JeGmtBcRrlLMzJlEpSTo9QBbpg=";
+  aarch64-darwin.hash = "sha256-9y8NDrwiz9ql1Ia2F0UYF0XWBCyCahHZaAPOsvIJ5l0=";
 
   sources = {
-    x86_64-linux = linuxSource "x64" x86_64-linux.sha256;
-    aarch64-linux = linuxSource "arm64" aarch64-linux.sha256;
-    x86_64-darwin = darwinSource "x64" x86_64-darwin.sha256;
-    aarch64-darwin = darwinSource "arm64" aarch64-darwin.sha256;
+    x86_64-linux = linuxSource "x64" x86_64-linux.hash;
+    aarch64-linux = linuxSource "arm64" aarch64-linux.hash;
+    x86_64-darwin = darwinSource "x64" x86_64-darwin.hash;
+    aarch64-darwin = darwinSource "arm64" aarch64-darwin.hash;
   };
 
   src = fetchurl sources.${stdenv.hostPlatform.system};
@@ -85,9 +85,9 @@ let
         exec = "trilium";
         icon = "trilium";
         comment = meta.description;
-        desktopName = "TriliumNext Notes";
+        desktopName = "Trilium Notes";
         categories = [ "Office" ];
-        startupWMClass = "Trilium Notes Next";
+        startupWMClass = "Trilium Notes";
       })
     ];
 
@@ -138,8 +138,8 @@ let
 
     installPhase = ''
       runHook preInstall
-      mkdir -p "$out/Applications/TriliumNext Notes.app"
-      cp -r * "$out/Applications/TriliumNext Notes.app/"
+      mkdir -p "$out/Applications/Trilium Notes.app"
+      cp -r * "$out/Applications/Trilium Notes.app/"
       runHook postInstall
     '';
   };
diff --git a/pkgs/by-name/tr/trilium-desktop/update.sh b/pkgs/by-name/tr/trilium-desktop/update.sh
new file mode 100755
index 000000000000..eefaa8c308b2
--- /dev/null
+++ b/pkgs/by-name/tr/trilium-desktop/update.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl jq
+set -euo pipefail
+
+cd $(dirname "${BASH_SOURCE[0]}")
+
+setKV () {
+    sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1
+}
+
+version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
+setKV ./package.nix version $version
+
+# Update desktop application
+sha256_linux64=$(nix store prefetch-file --json --hash-type sha256 https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-x64.zip | jq -r .hash)
+sha256_linux64_arm=$(nix store prefetch-file --json --hash-type sha256 https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-arm64.zip | jq -r .hash)
+sha256_darwin64=$(nix store prefetch-file --json --hash-type sha256 https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-x64.zip | jq -r .hash)
+sha256_darwin64_arm=$(nix store prefetch-file --json --hash-type sha256 https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-arm64.zip | jq -r .hash)
+setKV ./package.nix x86_64-linux.hash $sha256_linux64
+setKV ./package.nix aarch64-linux.hash $sha256_linux64_arm
+setKV ./package.nix x86_64-darwin.hash $sha256_darwin64
+setKV ./package.nix aarch64-darwin.hash $sha256_darwin64_arm
+
+# Update server
+sha256_linux64_server=$(nix store prefetch-file --json --hash-type sha256 https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz | jq -r .hash)
+sha256_linux64_server_arm=$(nix store prefetch-file --json --hash-type sha256 https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz | jq -r .hash)
+setKV ../trilium-server/package.nix version $version
+setKV ../trilium-server/package.nix serverSource_x64.hash $sha256_linux64_server
+setKV ../trilium-server/package.nix serverSource_arm64.hash $sha256_linux64_server_arm
diff --git a/pkgs/by-name/tr/trilium-next-desktop/update.sh b/pkgs/by-name/tr/trilium-next-desktop/update.sh
deleted file mode 100755
index 2b3802e9abd2..000000000000
--- a/pkgs/by-name/tr/trilium-next-desktop/update.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq
-set -euo pipefail
-
-cd $(dirname "${BASH_SOURCE[0]}")
-
-setKV () {
-    sed -i "s|$2 = \".*\"|$2 = \"${3:-}\"|" $1
-}
-
-version=$(curl -s --show-error "https://api.github.com/repos/TriliumNext/Trilium/releases/latest" | jq -r '.tag_name' | tail -c +2)
-setKV ./package.nix version $version
-
-# Update desktop application
-sha256_linux64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-x64.zip)
-sha256_linux64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-linux-arm64.zip)
-sha256_darwin64=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-x64.zip)
-sha256_darwin64_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-macos-arm64.zip)
-setKV ./package.nix x86_64-linux.sha256 $sha256_linux64
-setKV ./package.nix aarch64-linux.sha256 $sha256_linux64_arm
-setKV ./package.nix x86_64-darwin.sha256 $sha256_darwin64
-setKV ./package.nix aarch64-darwin.sha256 $sha256_darwin64_arm
-
-# Update server
-sha256_linux64_server=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz)
-sha256_linux64_server_arm=$(nix-prefetch-url --quiet https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz)
-setKV ../trilium-next-server/package.nix version $version
-setKV ../trilium-next-server/package.nix serverSource_x64.sha256 $sha256_linux64_server
-setKV ../trilium-next-server/package.nix serverSource_arm64.sha256 $sha256_linux64_server_arm
diff --git a/pkgs/by-name/tr/trilium-next-server/package.nix b/pkgs/by-name/tr/trilium-server/package.nix
similarity index 87%
rename from pkgs/by-name/tr/trilium-next-server/package.nix
rename to pkgs/by-name/tr/trilium-server/package.nix
index a8f92ae6f744..822b7acfabbc 100644
--- a/pkgs/by-name/tr/trilium-next-server/package.nix
+++ b/pkgs/by-name/tr/trilium-server/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.97.2";
+  version = "0.98.0";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.sha256 = "1zbi1jh2iib6wcaab0wdhb2rhslmn06dn22h28h8jjj5qjpbqqz0";
+  serverSource_x64.hash = "sha256-m5QDm8XOFi5Blbif044WMm/yyRrJx5t9/LjSto/gSL0=";
   serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.sha256 = "1a6gnfprskq0cqvg625dazqq39h89d3g9rssdcyw7w0a7kw8nfrv";
+  serverSource_arm64.hash = "sha256-1pdQEJIOxDU05z+31gNpsb9K4BpJ3njNsqxJymfD4wg=";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then
@@ -20,10 +20,10 @@ let
     else if stdenv.hostPlatform.isAarch64 then
       serverSource_arm64
     else
-      throw "${stdenv.hostPlatform.config} not supported by trilium-next-server";
+      throw "${stdenv.hostPlatform.config} not supported by trilium-server";
 in
 stdenv.mkDerivation {
-  pname = "trilium-next-server";
+  pname = "trilium-server";
   inherit version;
 
   src = fetchurl serverSource;
diff --git a/pkgs/by-name/wi/widevine-cdm/x86_64-linux.nix b/pkgs/by-name/wi/widevine-cdm/x86_64-linux.nix
index 00c1b625c32d..ae16e951c666 100644
--- a/pkgs/by-name/wi/widevine-cdm/x86_64-linux.nix
+++ b/pkgs/by-name/wi/widevine-cdm/x86_64-linux.nix
@@ -9,7 +9,8 @@ stdenv.mkDerivation (finalAttrs: {
   version = "4.10.2891.0";
 
   src = fetchzip {
-    url = "https://dl.google.com/widevine-cdm/${finalAttrs.version}-linux-x64.zip";
+    # The download 404s
+    url = "https://web.archive.org/web/20250725071306/https://dl.google.com/widevine-cdm/4.10.2891.0-linux-x64.zip";
     hash = "sha256-ZO6FmqJUnB9VEJ7caJt58ym8eB3/fDATri3iOWCULRI=";
     stripRoot = false;
   };
diff --git a/pkgs/by-name/wr/wrkflw/package.nix b/pkgs/by-name/wr/wrkflw/package.nix
index b165a9057258..40742d26f28f 100644
--- a/pkgs/by-name/wr/wrkflw/package.nix
+++ b/pkgs/by-name/wr/wrkflw/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wrkflw";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "bahdotsh";
     repo = "wrkflw";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-J0FlGuISBpyiZNQSwQF/9YJncu67BKSC2Bq2S6F/vKQ=";
+    hash = "sha256-r7FEyMVvsHqFylOXx9NKeI3WHGmlv5655BOhi0tlbVU=";
   };
 
-  cargoHash = "sha256-8iYsHVc7WI94IKMECYs4v+68rG3Mc8Kto9dmGwQrkCU=";
+  cargoHash = "sha256-hCkUN8BcdJIIWXJhPbSrdX06nHjsx5arrgPuC+Jo8rM=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 9972818aa0da..1d14f1d4cd03 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "0.15.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fbuh/SMfOygnuvG9zTZqem4oLaS+5uXScXPhU3aVDjM=";
+    hash = "sha256-YZmhwHA6PnQb3QXhbWK8cbV0CScbiD5k+HceDcV6iCI=";
   };
 
-  cargoHash = "sha256-+dPIujaxDJ7JrtNvX4VjGHFmgtCb1BJpFQL4c3E1/GY=";
+  cargoHash = "sha256-8LofNTLa3a2dDH72T54HJR/+qArXt+X6OMJIQwmjQIQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index f24b6b45669f..cc0332510307 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -29,6 +29,10 @@ let
     version = "7.1.1";
     hash = "sha256-GyS8imOqfOUPxXrzCiQtzCQIIH6bvWmQAB0fKUcRsW4=";
   };
+  v8 = {
+    version = "8.0";
+    hash = "sha256-okNZ1/m/thFAY3jK/GSV0+WZFnjrMr8uBPsOdH6Wq9E=";
+  };
 in
 
 rec {
@@ -47,6 +51,10 @@ rec {
   ffmpeg_7-headless = mkFFmpeg v7 "headless";
   ffmpeg_7-full = mkFFmpeg v7 "full";
 
+  ffmpeg_8 = mkFFmpeg v8 "small";
+  ffmpeg_8-headless = mkFFmpeg v8 "headless";
+  ffmpeg_8-full = mkFFmpeg v8 "full";
+
   # Please make sure this is updated to new major versions once they
   # build and work on all the major platforms. If absolutely necessary
   # due to severe breaking changes, the bump can wait a little bit to
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 55b991548309..940dd6c9ffc2 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -10,6 +10,7 @@
   texinfo,
   texinfo6,
   yasm,
+  nasm,
 
   # You can fetch any upstream version using this derivation by specifying version and hash
   # NOTICE: Always use this argument to override the version. Do not use overrideAttrs.
@@ -108,6 +109,7 @@
   withNvdec ? withHeadlessDeps && withNvcodec,
   withNvenc ? withHeadlessDeps && withNvcodec,
   withOpenal ? withFullDeps, # OpenAL 1.1 capture support
+  withOpenapv ? withHeadlessDeps && lib.versionAtLeast version "8.0", # APV encoding support
   withOpencl ? withHeadlessDeps,
   withOpencoreAmrnb ? withFullDeps && withVersion3, # AMR-NB de/encoder
   withOpencoreAmrwb ? withFullDeps && withVersion3, # AMR-WB decoder
@@ -152,6 +154,7 @@
   withVulkan ? withHeadlessDeps && !stdenv.hostPlatform.isDarwin,
   withVvenc ? withFullDeps && lib.versionAtLeast version "7.1", # H.266/VVC encoding
   withWebp ? withHeadlessDeps, # WebP encoder
+  withWhisper ? withFullDeps && lib.versionAtLeast version "8.0", # Whisper speech recognition
   withX264 ? withHeadlessDeps && withGPL, # H.264/AVC encoder
   withX265 ? withHeadlessDeps && withGPL, # H.265/HEVC encoder
   withXavs ? withFullDeps && withGPL, # AVS encoder
@@ -206,7 +209,9 @@
   # https://github.com/NixOS/nixpkgs/pull/211834#issuecomment-1417435991)
   buildAvresample ? withHeadlessDeps && lib.versionOlder version "5", # Build avresample library
   buildAvutil ? withHeadlessDeps, # Build avutil library
-  buildPostproc ? withHeadlessDeps, # Build postproc library
+  # Libpostproc is only available on versions lower than 8.0
+  # https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8c920c4c396163e3b9a0b428dd550d3c986236aa
+  buildPostproc ? withHeadlessDeps && lib.versionOlder version "8.0", # Build postproc library
   buildSwresample ? withHeadlessDeps, # Build swresample library
   buildSwscale ? withHeadlessDeps, # Build swscale library
   withLib ?
@@ -313,6 +318,7 @@
   nv-codec-headers-12,
   ocl-icd, # OpenCL ICD
   openal,
+  openapv,
   opencl-headers, # OpenCL headers
   opencore-amr,
   openh264,
@@ -338,6 +344,7 @@
   vulkan-headers,
   vulkan-loader,
   vvenc,
+  whisper-cpp,
   x264,
   x265,
   xavs,
@@ -570,7 +577,12 @@ stdenv.mkDerivation (
     ]
     ++ [
       (enableFeature buildAvutil "avutil")
+    ]
+    ++ optionals (lib.versionOlder version "8.0") [
+      # FFMpeg >= 8 doesn't know about the flag anymore
       (enableFeature (buildPostproc && withGPL) "postproc")
+    ]
+    ++ [
       (enableFeature buildSwresample "swresample")
       (enableFeature buildSwscale "swscale")
     ]
@@ -678,6 +690,11 @@ stdenv.mkDerivation (
       (enableFeature withNvdec "nvdec")
       (enableFeature withNvenc "nvenc")
       (enableFeature withOpenal "openal")
+    ]
+    ++ optionals (versionAtLeast version "8.0") [
+      (enableFeature withOpenapv "liboapv")
+    ]
+    ++ [
       (enableFeature withOpencl "opencl")
       (enableFeature withOpencoreAmrnb "libopencore-amrnb")
       (enableFeature withOpencoreAmrwb "libopencore-amrwb")
@@ -742,6 +759,11 @@ stdenv.mkDerivation (
     ]
     ++ [
       (enableFeature withWebp "libwebp")
+    ]
+    ++ optionals (versionAtLeast version "8.0") [
+      (enableFeature withWhisper "whisper")
+    ]
+    ++ [
       (enableFeature withX264 "libx264")
       (enableFeature withX265 "libx265")
       (enableFeature withXavs "libxavs")
@@ -803,8 +825,9 @@ stdenv.mkDerivation (
       addDriverRunpath
       perl
       pkg-config
-      yasm
     ]
+    # 8.0 is only compatible with nasm, and we don't want to rebuild all older ffmpeg builds at this moment.
+    ++ (if versionOlder version "8.0" then [ yasm ] else [ nasm ])
     # Texinfo version 7.1 introduced breaking changes, which older versions of ffmpeg do not handle.
     ++ (if versionOlder version "5" then [ texinfo6 ] else [ texinfo ])
     ++ optionals withCudaLLVM [ clang ]
@@ -874,6 +897,7 @@ stdenv.mkDerivation (
         cuda_nvcc
       ]
       ++ optionals withOpenal [ openal ]
+      ++ optionals withOpenapv [ openapv ]
       ++ optionals withOpencl [
         ocl-icd
         opencl-headers
@@ -928,6 +952,7 @@ stdenv.mkDerivation (
       ]
       ++ optionals withVvenc [ vvenc ]
       ++ optionals withWebp [ libwebp ]
+      ++ optionals withWhisper [ whisper-cpp ]
       ++ optionals withX264 [ x264 ]
       ++ optionals withX265 [ x265 ]
       ++ optionals withXavs [ xavs ]
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index 665094952cc1..c01d1749e137 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "bthome-ble";
-  version = "3.14.0";
+  version = "3.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "bthome-ble";
     tag = "v${version}";
-    hash = "sha256-1jgrE7EwYJPb/F5gIXmRFU3xBG00tIXRA8BsE20Tw6Y=";
+    hash = "sha256-ySvEO4ic1Oo0b/kBADOMRgf9Thq6sBvxYWFKQpH3ouU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index 88cd2cc05ed6..4629fa12d8c5 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -9,14 +9,13 @@
   click-plugins,
   click-repl,
   click,
-  fetchPypi,
+  fetchFromGitHub,
   gevent,
   google-cloud-firestore,
   google-cloud-storage,
   kombu,
   moto,
   msgpack,
-  nixosTests,
   pymongo,
   redis,
   pydantic,
@@ -27,7 +26,6 @@
   pytest-xdist,
   pytestCheckHook,
   python-dateutil,
-  pythonOlder,
   pyyaml,
   setuptools,
   vine,
@@ -38,11 +36,11 @@ buildPythonPackage rec {
   version = "5.5.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-bJcq55aMK1KBIn8Bw6P5hAN9IcUSnQe/NVDMKvxrEKU=";
+  src = fetchFromGitHub {
+    owner = "celery";
+    repo = "celery";
+    tag = "v${version}";
+    hash = "sha256-+sickqRfSkBxhcO0W9na6Uov4kZ7S5oqpXXKX0iRQ0w=";
   };
 
   build-system = [ setuptools ];
@@ -114,16 +112,19 @@ buildPythonPackage rec {
     "test_cleanup"
     "test_with_autoscaler_file_descriptor_safety"
     "test_with_file_descriptor_safety"
+
+    # Flaky: Unclosed temporary file handle under heavy load (as in nixpkgs-review)
+    "test_check_privileges_without_c_force_root_and_no_group_entry"
   ];
 
   pythonImportsCheck = [ "celery" ];
 
-  meta = with lib; {
+  meta = {
     description = "Distributed task queue";
     homepage = "https://github.com/celery/celery/";
     changelog = "https://github.com/celery/celery/releases/tag/v${version}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "celery";
   };
 }
diff --git a/pkgs/development/python-modules/dbt-adapters/default.nix b/pkgs/development/python-modules/dbt-adapters/default.nix
index ca491b9afbbe..bcfb16abff49 100644
--- a/pkgs/development/python-modules/dbt-adapters/default.nix
+++ b/pkgs/development/python-modules/dbt-adapters/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-adapters";
-  version = "1.16.3";
+  version = "1.16.5";
   pyproject = true;
 
   # missing tags on GitHub
   src = fetchPypi {
     pname = "dbt_adapters";
     inherit version;
-    hash = "sha256-1J0+V776ujbt8Anm/gAdld0MkC5apmeN8IEtzZBSWf8=";
+    hash = "sha256-OAPGC88WvBy/3sGyDO4pAHLYYe2+k7l7PpKpNcV+IdM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/dbt-common/default.nix b/pkgs/development/python-modules/dbt-common/default.nix
index 2bcc80d74e12..d0829b2c34f3 100644
--- a/pkgs/development/python-modules/dbt-common/default.nix
+++ b/pkgs/development/python-modules/dbt-common/default.nix
@@ -7,6 +7,7 @@
   hatchling,
 
   # dependencies
+  dbt-protos,
   agate,
   colorama,
   deepdiff,
@@ -28,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-common";
-  version = "1.23.0-unstable-2025-04-21";
+  version = "1.28.0-unstable-2025-08-14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "dbt-common";
-    rev = "03e09c01f20573975e8e17776a4b7c9088b3f212"; # They don't tag releases
-    hash = "sha256-KqnwlFZZRYuWRflMzjrqCPBnzY9q/pPhceM2DGqz5bw=";
+    rev = "dd34e0a0565620863ff70c0b02421d84fcee8a02"; # They don't tag releases
+    hash = "sha256-hG6S+IIAR3Cu69oFapQUVoCdaiEQYeMQ/ekBuAXxPrI=";
   };
 
   build-system = [ hatchling ];
@@ -50,6 +51,7 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
+    dbt-protos
     agate
     colorama
     deepdiff
@@ -81,7 +83,7 @@ buildPythonPackage rec {
   meta = {
     description = "Shared common utilities for dbt-core and adapter implementations use";
     homepage = "https://github.com/dbt-labs/dbt-common";
-    changelog = "https://github.com/dbt-labs/dbt-common/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/dbt-labs/dbt-common/blob/main/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/dbt-core/default.nix b/pkgs/development/python-modules/dbt-core/default.nix
index 4fd76d96d919..61620c332ad5 100644
--- a/pkgs/development/python-modules/dbt-core/default.nix
+++ b/pkgs/development/python-modules/dbt-core/default.nix
@@ -37,14 +37,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-core";
-  version = "1.10.6";
+  version = "1.10.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "dbt-core";
     tag = "v${version}";
-    hash = "sha256-tMrtn5NYkRpok6mv4/CBXGPQuHWpL/raejPXyagj7Bs=";
+    hash = "sha256-4K00EVTOTTUHWwTpBlXKoHGof/s/H2acoWZPJ9FmBuk=";
   };
 
   sourceRoot = "${src.name}/core";
diff --git a/pkgs/development/python-modules/dbt-extractor/default.nix b/pkgs/development/python-modules/dbt-extractor/default.nix
index b6b197680bfc..9474194a4eb3 100644
--- a/pkgs/development/python-modules/dbt-extractor/default.nix
+++ b/pkgs/development/python-modules/dbt-extractor/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-extractor";
-  version = "0.5.1";
+  version = "0.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,12 +18,12 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "dbt_extractor";
     inherit version;
-    hash = "sha256-zV2VV2qN6kGQJAqvmTajf9dLS3kTymmjw2j8RHK7fhM=";
+    hash = "sha256-1s8I7Hk7i8K9biYO+BgjCuaKT3FDb6SJ8I19saUuL/4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-luPAuRl+yrHinLs6H0ZRVnce2zz1DUrniVOCa1hu1S4=";
+    hash = "sha256-6Y4zfqhj1/IeEX+Ve49jblxeW565Q2ypNClb/Ej0xoc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
index 8c237e65a930..17f5751ec2f3 100644
--- a/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
+++ b/pkgs/development/python-modules/dbt-semantic-interfaces/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "dbt-semantic-interfaces";
-  version = "0.8.5";
+  version = "0.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "dbt-labs";
     repo = "dbt-semantic-interfaces";
     tag = "v${version}";
-    hash = "sha256-fe+0W08XfBzimQZugCpphrHYcDaoUUYkA+FYa2lS3Uo=";
+    hash = "sha256-I/bMpqTaAHs0XnYOYjFRgXv3qB06LItkaSxtRjk55js=";
   };
 
   pythonRelaxDeps = [ "importlib-metadata" ];
diff --git a/pkgs/development/python-modules/dbt-snowflake/default.nix b/pkgs/development/python-modules/dbt-snowflake/default.nix
index 9bd0f8552020..4f824570cdd5 100644
--- a/pkgs/development/python-modules/dbt-snowflake/default.nix
+++ b/pkgs/development/python-modules/dbt-snowflake/default.nix
@@ -2,25 +2,29 @@
   lib,
   buildPythonPackage,
   dbt-core,
-  fetchFromGitHub,
+  fetchPypi,
   pytestCheckHook,
-  setuptools,
+  hatchling,
   snowflake-connector-python,
 }:
 
 buildPythonPackage rec {
   pname = "dbt-snowflake";
-  version = "1.9.1";
+  version = "1.10.0";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "dbt-labs";
-    repo = "dbt-snowflake";
-    tag = "v${version}";
-    hash = "sha256-oPzSdAQgb2fKES3YcSGYjILFqixxxjdLCNVytVPecTg=";
+  # missing tags on GitHub
+  src = fetchPypi {
+    pname = "dbt_snowflake";
+    inherit version;
+    hash = "sha256-Y5H7ATm8bntl4YaF5l9DZiRhHt2q2/XaICp+PR9ywIw=";
   };
 
-  build-system = [ setuptools ];
+  pythonRelaxDeps = [
+    "certifi"
+  ];
+
+  build-system = [ hatchling ];
 
   dependencies = [
     dbt-core
@@ -32,12 +36,17 @@ buildPythonPackage rec {
 
   enabledTestPaths = [ "tests/unit" ];
 
+  pytestFlagsArray = [
+    # pyproject.toml specifies -n auto which only pytest-xdist understands
+    "--override-ini addopts=''"
+  ];
+
   pythonImportsCheck = [ "dbt.adapters.snowflake" ];
 
   meta = {
     description = "Plugin enabling dbt to work with Snowflake";
-    homepage = "https://github.com/dbt-labs/dbt-snowflake";
-    changelog = "https://github.com/dbt-labs/dbt-snowflake/blob/${src.tag}/CHANGELOG.md";
+    homepage = "https://github.com/dbt-labs/dbt-adapters/blob/main/dbt-snowflake";
+    changelog = "https://github.com/dbt-labs/dbt-adapters/blob/main/dbt-snowflake/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ tjni ];
   };
diff --git a/pkgs/development/python-modules/dvclive/default.nix b/pkgs/development/python-modules/dvclive/default.nix
index 31d2539af170..e681d16fa3b2 100644
--- a/pkgs/development/python-modules/dvclive/default.nix
+++ b/pkgs/development/python-modules/dvclive/default.nix
@@ -1,14 +1,24 @@
 {
   lib,
   buildPythonPackage,
-  datasets,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools-scm,
+
+  # dependencies
   dvc,
   dvc-render,
   dvc-studio-client,
-  fastai,
-  fetchFromGitHub,
   funcy,
   gto,
+  psutil,
+  pynvml,
+  ruamel-yaml,
+  scmrepo,
+
+  # optional-dependencies
+  # all
   jsonargparse,
   lightgbm,
   lightning,
@@ -18,31 +28,27 @@
   optuna,
   pandas,
   pillow,
-  psutil,
-  pynvml,
-  pythonOlder,
-  ruamel-yaml,
   scikit-learn,
-  scmrepo,
-  setuptools-scm,
   tensorflow,
   torch,
   transformers,
   xgboost,
+  # huggingface
+  datasets,
+  # fastai
+  fastai,
 }:
 
 buildPythonPackage rec {
   pname = "dvclive";
-  version = "3.48.4";
+  version = "3.48.5";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "iterative";
     repo = "dvclive";
     tag = version;
-    hash = "sha256-fs0NbsjpGaR4cXE/ajfeF6ZJ3fc7K28KDJ0LIJ/vsdg=";
+    hash = "sha256-ucMtYHDwdpyYnnC7QCn5T6gCS8SarohKh6lxFXtPXgc=";
   };
 
   build-system = [ setuptools-scm ];
@@ -53,10 +59,10 @@ buildPythonPackage rec {
     dvc-studio-client
     funcy
     gto
-    ruamel-yaml
-    scmrepo
     psutil
     pynvml
+    ruamel-yaml
+    scmrepo
   ];
 
   optional-dependencies = {
@@ -114,11 +120,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "dvclive" ];
 
-  meta = with lib; {
+  meta = {
     description = "Library for logging machine learning metrics and other metadata in simple file formats";
     homepage = "https://github.com/iterative/dvclive";
     changelog = "https://github.com/iterative/dvclive/releases/tag/${src.tag}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index 429dce1b4594..6182440701b0 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -6,8 +6,7 @@
   # Build-time dependencies:
   addDriverRunpath,
   autoAddDriverRunpath,
-  #bazel_6,
-  bazel,
+  bazel_7,
   binutils,
   buildBazelPackage,
   buildPythonPackage,
@@ -226,7 +225,7 @@ let
 
     # See https://github.com/google/jax/blob/main/.bazelversion for the latest.
     #bazel = bazel_6;
-    bazel = bazel;
+    bazel = bazel_7;
 
     src = fetchFromGitHub {
       owner = "google";
diff --git a/pkgs/development/python-modules/kubernetes-asyncio/default.nix b/pkgs/development/python-modules/kubernetes-asyncio/default.nix
index 456ce3e9b6cd..d9069357f0bb 100644
--- a/pkgs/development/python-modules/kubernetes-asyncio/default.nix
+++ b/pkgs/development/python-modules/kubernetes-asyncio/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "kubernetes-asyncio";
-  version = "32.3.0";
+  version = "33.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tomplus";
     repo = "kubernetes_asyncio";
     tag = version;
-    hash = "sha256-EqFecu389zS/DqwoMz9ptaLv+jwJhABTEdMv8nwCSTQ=";
+    hash = "sha256-Ei5Y2IBBk8AoMQQBHOvKkJ1H+9dmnz22qrrZKrWazVE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
index ab54499442bf..476b5256a634 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-postgres";
-  version = "0.6.1";
+  version = "0.6.3";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_vector_stores_postgres";
     inherit version;
-    hash = "sha256-E+PFvOTRO3FGGSwFwEUe0fEpmuE/fmRtiCGHwO53qm4=";
+    hash = "sha256-sV0ufDvyoLGHVJNKhM9TJEA7lAHisxvNsAQY7S0Ddww=";
   };
 
   pythonRemoveDeps = [ "psycopg2-binary" ];
diff --git a/pkgs/development/python-modules/mitmproxy-linux/default.nix b/pkgs/development/python-modules/mitmproxy-linux/default.nix
index 41467db01625..1af784ed3611 100644
--- a/pkgs/development/python-modules/mitmproxy-linux/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-linux/default.nix
@@ -12,7 +12,8 @@ buildPythonPackage {
   pyproject = true;
 
   postPatch = ''
-    substituteInPlace mitmproxy-linux/build.rs \
+    substituteInPlace ../mitmproxy-rs-*-vendor/aya-build-*/src/lib.rs \
+      --replace-fail '"+nightly",' "" \
       --replace-fail '"-Z",' "" \
       --replace-fail '"build-std=core",' ""
 
diff --git a/pkgs/development/python-modules/mitmproxy-macos/default.nix b/pkgs/development/python-modules/mitmproxy-macos/default.nix
index caf00819f313..606ae484f274 100644
--- a/pkgs/development/python-modules/mitmproxy-macos/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-macos/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     format = "wheel";
     dist = "py3";
     python = "py3";
-    hash = "sha256-sNguT3p72v9+FU5XFLYV6p0fO6WvGYerPy68GINwbyA=";
+    hash = "sha256-NArp10yhERk7Hhw5fIU+ekbupyldyzpLQdKgebiUpOM=";
   };
 
   # repo has no python tests
diff --git a/pkgs/development/python-modules/mitmproxy-rs/default.nix b/pkgs/development/python-modules/mitmproxy-rs/default.nix
index f0598f51944a..023ffdca0ab9 100644
--- a/pkgs/development/python-modules/mitmproxy-rs/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-rs/default.nix
@@ -11,21 +11,21 @@
 
 buildPythonPackage rec {
   pname = "mitmproxy-rs";
-  version = "0.12.3";
+  version = "0.12.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mitmproxy";
     repo = "mitmproxy_rs";
     tag = "v${version}";
-    hash = "sha256-bWvSaUx5nv8d17eOWyYlhSDi71rHycrFoDGRuQEL7LU=";
+    hash = "sha256-Wd/4XzSMQ3qgacFUlxReQFyonUbTqWKDCk3m+kWhXy0=";
   };
 
   buildAndTestSubdir = "mitmproxy-rs";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-9J5RVGCXyMOcCYUP+LS92Xv1krA+feoMqFgeFExxxqY=";
+    hash = "sha256-Q5EBI5uXJgbI9NMblkTT/GweopnTr/zUG35i+Aoe3QA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 2632ecf82108..a3bc6a665655 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -38,14 +38,14 @@
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "12.1.1";
+  version = "12.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mitmproxy";
     repo = "mitmproxy";
     tag = "v${version}";
-    hash = "sha256-RTHL5+lbR+AbkiE4+z4ZbxZSV2E4NGTmShbMIMRKJPA=";
+    hash = "sha256-XYZ14JlVYG/OLlEze+C1L/HP3HD5GEW+jG2YYSXW/8Y=";
   };
 
   pythonRelaxDeps = [
@@ -55,6 +55,8 @@ buildPythonPackage rec {
     "passlib"
     "pyopenssl"
     "tornado"
+    "typing-extensions"
+    "urwid"
   ];
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index 3abe96a35935..827ac4bc8686 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  buildPythonPackage,
   fetchFromGitHub,
 
   # build-system
@@ -7,12 +8,13 @@
 
   # dependencies
   alembic,
-  buildPythonPackage,
   cachetools,
   click,
   cloudpickle,
+  cryptography,
   databricks-sdk,
   docker,
+  fastapi,
   flask,
   gitpython,
   graphene,
@@ -34,6 +36,7 @@
   scipy,
   sqlalchemy,
   sqlparse,
+  uvicorn,
 
   # tests
   aiohttp,
@@ -44,7 +47,6 @@
   botocore,
   catboost,
   datasets,
-  fastapi,
   google-cloud-storage,
   httpx,
   jwt,
@@ -65,20 +67,19 @@
   tensorflow,
   torch,
   transformers,
-  uvicorn,
   xgboost,
 }:
 
 buildPythonPackage rec {
   pname = "mlflow";
-  version = "3.1.4";
+  version = "3.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mlflow";
     repo = "mlflow";
     tag = "v${version}";
-    hash = "sha256-GU1CVwc31bLai8QoXch/UTx//+OG2V/6jG9Ocz4MDuA=";
+    hash = "sha256-5zObSnGx7+cCrqRfvcnprQN05NqVBCeWcAZEE1Jpeuo=";
   };
 
   pythonRelaxDeps = [
@@ -97,8 +98,10 @@ buildPythonPackage rec {
     cachetools
     click
     cloudpickle
+    cryptography
     databricks-sdk
     docker
+    fastapi
     flask
     gitpython
     graphene
@@ -122,6 +125,7 @@ buildPythonPackage rec {
     shap
     sqlalchemy
     sqlparse
+    uvicorn
   ];
 
   pythonImportsCheck = [ "mlflow" ];
@@ -135,7 +139,6 @@ buildPythonPackage rec {
     botocore
     catboost
     datasets
-    fastapi
     google-cloud-storage
     httpx
     jwt
diff --git a/pkgs/development/python-modules/numbagg/default.nix b/pkgs/development/python-modules/numbagg/default.nix
index 6ec6156d5def..98b3eecc2e7b 100644
--- a/pkgs/development/python-modules/numbagg/default.nix
+++ b/pkgs/development/python-modules/numbagg/default.nix
@@ -21,7 +21,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.9.0";
+  version = "0.9.1";
   pname = "numbagg";
   pyproject = true;
 
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "numbagg";
     repo = "numbagg";
     tag = "v${version}";
-    hash = "sha256-BuD5hjAd++pW4pEQyl0UP9gd3J8SjJirtpxVE53BLpM=";
+    hash = "sha256-IathtnmGlgug+u7AS1ulgf2462br5DdU3TJBDlBPf08=";
   };
 
   build-system = [
@@ -59,7 +59,7 @@ buildPythonPackage rec {
   meta = {
     description = "Fast N-dimensional aggregation functions with Numba";
     homepage = "https://github.com/numbagg/numbagg";
-    changelog = "https://github.com/numbagg/numbagg/releases/tag/${version}";
+    changelog = "https://github.com/numbagg/numbagg/releases/tag/v${version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ flokli ];
   };
diff --git a/pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix b/pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix
index 4f54cca42a7b..1462b8a1fd2b 100644
--- a/pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix
+++ b/pkgs/development/python-modules/pylibjpeg-libjpeg/default.nix
@@ -11,6 +11,7 @@
   pydicom,
   pylibjpeg-data,
   pylibjpeg,
+  libjpeg-tools,
 }:
 
 let
@@ -25,13 +26,15 @@ let
       owner = "pydicom";
       repo = "pylibjpeg-libjpeg";
       tag = "v${self.version}";
-      hash = "sha256-xqSA1cutTsH9k4l9CW96n/CURzkAyDi3PZylZeedVjA=";
-      fetchSubmodules = true;
+      hash = "sha256-P01pofPLTOa5ynsCkLnxiMzVfCg4tbT+/CcpPTeSViw=";
     };
 
     postPatch = ''
       substituteInPlace pyproject.toml \
         --replace-fail 'poetry-core >=1.8,<2' 'poetry-core'
+      rmdir lib/libjpeg
+      cp -r ${libjpeg-tools.src} lib/libjpeg
+      chmod u+w lib/libjpeg
     '';
 
     build-system = [
diff --git a/pkgs/development/python-modules/pymc/default.nix b/pkgs/development/python-modules/pymc/default.nix
index bc85ec17a518..836ee2f3f183 100644
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
 
   # build-system
   setuptools,
@@ -32,15 +33,21 @@ buildPythonPackage rec {
     hash = "sha256-zh6FsCEviuyqapguTrUDsWKq70ef0IKRhnn2dkgQ/KA=";
   };
 
+  patches = [
+    # TODO: remove at next release
+    # https://github.com/pymc-devs/pytensor/pull/1471
+    (fetchpatch2 {
+      name = "pytensor-2-32-compat";
+      url = "https://github.com/pymc-devs/pymc/commit/59176b6adda88971e546a0cf93ca04424af5197f.patch";
+      hash = "sha256-jkDwlKwxbn9DwpkxEbSXk/kbGjT/Xu8bsZHFBWYpMgA=";
+    })
+  ];
+
   build-system = [
     setuptools
     versioneer
   ];
 
-  pythonRelaxDeps = [
-    "pytensor"
-  ];
-
   dependencies = [
     arviz
     cachetools
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index c8ee9f5670e3..11c9d59b119f 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.18.1";
+  version = "1.18.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     tag = "v${version}";
-    hash = "sha256-X/0cNMzNjDJqBRiP4kuua4oJVG+0oRbjoZVYP0D4f9M=";
+    hash = "sha256-kGcDZp1oLkjHy/+iAdnsAceSY+jX9+hw3mFxCaT18YA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index d5212c6533bd..3eb16dd31ec0 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -83,6 +83,11 @@ buildPythonPackage rec {
   '';
 
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Numerical assertion error
+    # tests.unittest_tools.WrongValue: WrongValue
+    "test_op_sd"
+    "test_op_ss"
+
     # pytensor.link.c.exceptions.CompileError: Compilation failed (return status=1)
     "OpFromGraph"
     "add"
@@ -123,6 +128,7 @@ buildPythonPackage rec {
     "test_modes"
     "test_mul_s_v_grad"
     "test_multiple_outputs"
+    "test_nnet"
     "test_not_inplace"
     "test_numba_Cholesky_grad"
     "test_numba_pad"
diff --git a/pkgs/development/python-modules/reorder-python-imports/default.nix b/pkgs/development/python-modules/reorder-python-imports/default.nix
index edb7175db01a..b18033e88fd7 100644
--- a/pkgs/development/python-modules/reorder-python-imports/default.nix
+++ b/pkgs/development/python-modules/reorder-python-imports/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "reorder-python-imports";
-  version = "3.13.0";
+  version = "3.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "asottile";
     repo = "reorder_python_imports";
     tag = "v${version}";
-    hash = "sha256-N0hWrrUeojlUDZx2Azs/y2kCaknQ62hHdp0J2ZXPElY=";
+    hash = "sha256-oBzEPKcJO/M13+KSLZYSeMgwo28J7TZOj6H2YHkFWHU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tree-sitter/default.nix b/pkgs/development/python-modules/tree-sitter/default.nix
index 74d54cfedbd6..300366a8a4d0 100644
--- a/pkgs/development/python-modules/tree-sitter/default.nix
+++ b/pkgs/development/python-modules/tree-sitter/default.nix
@@ -3,8 +3,11 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
-  pythonOlder,
+
+  # build-system
   setuptools,
+
+  # tests
   tree-sitter-python,
   tree-sitter-rust,
   tree-sitter-html,
@@ -14,14 +17,12 @@
 
 buildPythonPackage rec {
   pname = "tree-sitter";
-  version = "0.25.0";
+  version = "0.25.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FciHdc8k2wZne6/mLfBYpkV9im3eZ7qkjdNyO5BeeaY=";
+    hash = "sha256-zXYa0OTR/IiksbgIO64G1PlzrPb18pu/E+qWCcHeycE=";
   };
 
   # see https://github.com/tree-sitter/py-tree-sitter/issues/330#issuecomment-2629403946
diff --git a/pkgs/development/python-modules/unifi/default.nix b/pkgs/development/python-modules/unifi/default.nix
deleted file mode 100644
index daebd11ee3c0..000000000000
--- a/pkgs/development/python-modules/unifi/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  urllib3,
-}:
-
-buildPythonPackage rec {
-  pname = "unifi";
-  version = "1.2.5";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0prgx01hzs49prrazgxrinm7ivqzy57ch06qm2h7s1p957sazds8";
-  };
-
-  propagatedBuildInputs = [ urllib3 ];
-
-  # upstream has no tests
-  doCheck = false;
-
-  meta = with lib; {
-    description = "API towards the Ubiquity Networks UniFi controller";
-    homepage = "https://pypi.python.org/pypi/unifi/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ peterhoeg ];
-  };
-}
diff --git a/pkgs/os-specific/linux/scx/scx_cscheds.nix b/pkgs/os-specific/linux/scx/scx_cscheds.nix
index dc9e138cd7f4..23c183bf8a2a 100644
--- a/pkgs/os-specific/linux/scx/scx_cscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_cscheds.nix
@@ -17,15 +17,6 @@
   libseccomp,
 }:
 
-let
-  # Fixes a bug with the meson build script where it specifies
-  # /bin/bash twice in the script
-  misbehaviorBash = writeShellScript "bash" ''
-    shift 1
-    exec ${lib.getExe bash} "$@"
-  '';
-
-in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
   pname = "scx_cscheds";
   inherit (scx-common) version src;
@@ -66,7 +57,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     cp ${finalAttrs.fetchBpftool} meson-scripts/fetch_bpftool
     cp ${finalAttrs.fetchLibbpf} meson-scripts/fetch_libbpf
     substituteInPlace meson.build \
-      --replace-fail '[build_bpftool' "['${misbehaviorBash}', build_bpftool"
+      --replace-fail '[build_bpftool' "['${lib.getExe bash}', build_bpftool"
 
     # TODO: Remove in next release.
     substituteInPlace lib/scxtest/overrides.h \
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 7731ef1b3906..afc0a3b14538 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -612,6 +612,7 @@ mapAliases {
   citra = throw "citra has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
   citra-nightly = throw "citra-nightly has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
   citra-canary = throw "citra-canary has been removed from nixpkgs, as it has been taken down upstream"; # added 2024-03-04
+  ci-edit = throw "'ci-edit' has been removed due to lack of maintenance upstream"; # Added 2025-08-26
   cloog = throw "cloog has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   cloog_0_18_0 = throw "cloog_0_18_0 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   cloogppl = throw "cloogppl has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b303b5444d82..6806540f7d95 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4343,11 +4343,6 @@ with pkgs;
 
   translatepy = with python3.pkgs; toPythonApplication translatepy;
 
-  inherit (callPackage ../applications/office/trilium { })
-    trilium-desktop
-    trilium-server
-    ;
-
   trytond = with python3Packages; toPythonApplication trytond;
 
   ttfautohint = libsForQt5.callPackage ../tools/misc/ttfautohint { };
@@ -7579,6 +7574,9 @@ with pkgs;
     ffmpeg_7
     ffmpeg_7-headless
     ffmpeg_7-full
+    ffmpeg_8
+    ffmpeg_8-headless
+    ffmpeg_8-full
     ffmpeg
     ffmpeg-headless
     ffmpeg-full
@@ -11207,10 +11205,6 @@ with pkgs;
 
   qgis = callPackage ../applications/gis/qgis { };
 
-  spatialite-gui = callPackage ../by-name/sp/spatialite-gui/package.nix {
-    wxGTK = wxGTK32;
-  };
-
   ### APPLICATIONS
 
   _2bwm = callPackage ../applications/window-managers/2bwm {
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index cb4854915657..5c035de23c1f 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -828,6 +828,7 @@ mapAliases ({
   ufoLib2 = ufolib2; # added 2024-01-07
   ukrainealarm = throw "ukrainealarm has been removed, as it has been replaced as a home-assistant dependency by uasiren."; # added 2024-01-05
   unblob-native = throw "unblob-native has been removed because its functionality is merged into unblob 25.4.14."; # Added 2025-05-02
+  unifi = throw "'unifi' has been removed as upstream was archived in 2017"; # Added 2025-08-25
   unittest2 = throw "unittest2 has been removed as it's a backport of unittest that's unmaintained and not needed beyond Python 3.4."; # added 2022-12-01
   update_checker = update-checker; # added 2024-01-07
   uproot3 = throw "uproot3 has been removed, use uproot instead"; # added 2022-12-13
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1933dcc869dc..63a2b6385f5d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19265,8 +19265,6 @@ self: super: with self; {
 
   unidiff = callPackage ../development/python-modules/unidiff { };
 
-  unifi = callPackage ../development/python-modules/unifi { };
-
   unifi-ap = callPackage ../development/python-modules/unifi-ap { };
 
   unifi-discovery = callPackage ../development/python-modules/unifi-discovery { };