diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index 2651ebb072d7..8f895908d2b9 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -437,6 +437,10 @@
   There is also a breaking change in the handling of CUDA. Instead of using a CUDA compatible jaxlib
   as before, you can use plugins like `python3Packages.jax-cuda12-plugin`.
 
+- Added `allowVariants` to gate availability of package sets like `pkgsLLVM`, `pkgsMusl`, `pkgsZig`, etc. This was done in an effort to
+  decrease evaluation times by limiting the number of instances of nixpkgs to evaluate. The option will be removed in the future as a
+  new mechanism is in the works for handling cross compilation.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-nixpkgs-release-25.05-notable-changes}
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index f4d26579cd86..b8c88e074bc4 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -3,8 +3,6 @@
 ## Highlights {#sec-nixpkgs-release-25.11-highlights}
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Added `allowVariants` to gate availability of package sets like `pkgsLLVM`, `pkgsMusl`, `pkgsZig`, etc. This option will be removed in a future release.
-
 - The initial work to support native compilation on LoongArch64 has completed, with further changes currently
   in preparation. In accordance with the [Software Development and Build Convention for LoongArch Architectures](https://github.com/loongson/la-softdev-convention),
   this release sets the default march level to `la64v1.0`, covering the desktop and server processors of 3X5000
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 77f949a68e16..d9731063b760 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3059,6 +3059,12 @@
     github = "benhiemer";
     githubId = 16649926;
   };
+  benjajaja = {
+    name = "Benjamin Große";
+    email = "ste3ls@gmail.com";
+    github = "benjajaja";
+    githubId = 310215;
+  };
   benjaminedwardwebb = {
     name = "Ben Webb";
     email = "benjaminedwardwebb@gmail.com";
@@ -18717,6 +18723,12 @@
     name = "Philipp Rintz";
     matrix = "@philipp:srv.icu";
   };
+  p0lyw0lf = {
+    email = "p0lyw0lf@protonmail.com";
+    name = "PolyWolf";
+    github = "p0lyw0lf";
+    githubId = 31190026;
+  };
   p3psi = {
     name = "Elliot Boo";
     email = "p3psi.boo@gmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 65bac7327ed9..d86c9b80de3a 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -12,6 +12,8 @@
 
 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
 
+- [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 04c6cd103a49..235be6b19b00 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1580,6 +1580,7 @@
   ./services/web-apps/kimai.nix
   ./services/web-apps/komga.nix
   ./services/web-apps/lanraragi.nix
+  ./services/web-apps/lasuite-docs.nix
   ./services/web-apps/lemmy.nix
   ./services/web-apps/limesurvey.nix
   ./services/web-apps/mainsail.nix
diff --git a/nixos/modules/security/default.nix b/nixos/modules/security/default.nix
index c8baad1a3dd9..5170383d6f5e 100644
--- a/nixos/modules/security/default.nix
+++ b/nixos/modules/security/default.nix
@@ -5,7 +5,7 @@ in
 {
   options = {
     security.lsm = lib.mkOption {
-      type = lib.types.uniq (lib.types.listOf lib.types.str);
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       description = ''
         A list of the LSMs to initialize in order.
@@ -13,16 +13,26 @@ in
     };
   };
 
-  config = lib.mkIf (lib.lists.length cfg.lsm > 0) {
-    assertions = [
-      {
-        assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0;
-        message = "security parameter in boot.kernelParams cannot be used when security.lsm is used";
-      }
-    ];
+  config = lib.mkMerge [
+    {
+      # We set the default LSM's here due to them not being present if set when enabling AppArmor.
+      security.lsm = [
+        "landlock"
+        "yama"
+        "bpf"
+      ];
+    }
+    (lib.mkIf (lib.lists.length cfg.lsm > 0) {
+      assertions = [
+        {
+          assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0;
+          message = "security parameter in boot.kernelParams cannot be used when security.lsm is used";
+        }
+      ];
 
-    boot.kernelParams = [
-      "lsm=${lib.concatStringsSep "," cfg.lsm}"
-    ];
-  };
+      boot.kernelParams = [
+        "lsm=${lib.concatStringsSep "," cfg.lsm}"
+      ];
+    })
+  ];
 }
diff --git a/nixos/modules/services/misc/atuin.nix b/nixos/modules/services/misc/atuin.nix
index 59bdae638870..e7a793fe834b 100644
--- a/nixos/modules/services/misc/atuin.nix
+++ b/nixos/modules/services/misc/atuin.nix
@@ -93,7 +93,12 @@ in
     systemd.services.atuin = {
       description = "atuin server";
       requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ];
-      after = [ "network.target" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      after = [
+        "network-online.target"
+      ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      wants = [
+        "network-online.target"
+      ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
@@ -139,18 +144,14 @@ in
         UMask = "0077";
       };
 
-      environment =
-        {
-          ATUIN_HOST = cfg.host;
-          ATUIN_PORT = toString cfg.port;
-          ATUIN_MAX_HISTORY_LENGTH = toString cfg.maxHistoryLength;
-          ATUIN_OPEN_REGISTRATION = lib.boolToString cfg.openRegistration;
-          ATUIN_PATH = cfg.path;
-          ATUIN_CONFIG_DIR = "/run/atuin"; # required to start, but not used as configuration is via environment variables
-        }
-        // lib.optionalAttrs (cfg.database.uri != null) {
-          ATUIN_DB_URI = cfg.database.uri;
-        };
+      environment = {
+        ATUIN_HOST = cfg.host;
+        ATUIN_PORT = toString cfg.port;
+        ATUIN_MAX_HISTORY_LENGTH = toString cfg.maxHistoryLength;
+        ATUIN_OPEN_REGISTRATION = lib.boolToString cfg.openRegistration;
+        ATUIN_PATH = cfg.path;
+        ATUIN_CONFIG_DIR = "/run/atuin"; # required to start, but not used as configuration is via environment variables
+      } // lib.optionalAttrs (cfg.database.uri != null) { ATUIN_DB_URI = cfg.database.uri; };
     };
 
     networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
diff --git a/nixos/modules/services/web-apps/lasuite-docs.nix b/nixos/modules/services/web-apps/lasuite-docs.nix
new file mode 100644
index 000000000000..eb1c44c2e87b
--- /dev/null
+++ b/nixos/modules/services/web-apps/lasuite-docs.nix
@@ -0,0 +1,514 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    mapAttrs
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    mkOption
+    types
+    optional
+    optionalString
+    ;
+
+  cfg = config.services.lasuite-docs;
+
+  pythonEnvironment = mapAttrs (
+    _: value:
+    if value == null then
+      "None"
+    else if value == true then
+      "True"
+    else if value == false then
+      "False"
+    else
+      toString value
+  ) cfg.settings;
+
+  commonServiceConfig = {
+    RuntimeDirectory = "lasuite-docs";
+    StateDirectory = "lasuite-docs";
+    WorkingDirectory = "/var/lib/lasuite-docs";
+
+    User = "lasuite-docs";
+    DynamicUser = true;
+    SupplementaryGroups = mkIf cfg.redis.createLocally [
+      config.services.redis.servers.lasuite-docs.group
+    ];
+    # hardening
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProtectSystem = "strict";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    UMask = "0077";
+  };
+in
+{
+  options.services.lasuite-docs = {
+    enable = mkEnableOption "SuiteNumérique Docs";
+
+    backendPackage = mkPackageOption pkgs "lasuite-docs" { };
+
+    frontendPackage = mkPackageOption pkgs "lasuite-docs-frontend" { };
+
+    bind = mkOption {
+      type = types.str;
+      default = "unix:/run/lasuite-docs/gunicorn.sock";
+      example = "127.0.0.1:8000";
+      description = ''
+        The path, host/port or file descriptior to bind the gunicorn socket to.
+
+        See  <https://docs.gunicorn.org/en/stable/settings.html#bind> for possible options.
+      '';
+    };
+
+    enableNginx = mkEnableOption "enable and configure Nginx for reverse proxying" // {
+      default = true;
+    };
+
+    secretKeyPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to the Django secret key.
+
+        The key can be generated using:
+        ```
+        python3 -c 'import secrets; print(secrets.token_hex())'
+        ```
+
+        If not set, the secret key will be automatically generated.
+      '';
+    };
+
+    s3Url = mkOption {
+      type = types.str;
+      description = ''
+        URL of the S3 bucket.
+      '';
+    };
+
+    postgresql = {
+      createLocally = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Configure local PostgreSQL database server for docs.
+        '';
+      };
+    };
+
+    redis = {
+      createLocally = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Configure local Redis cache server for docs.
+        '';
+      };
+    };
+
+    collaborationServer = {
+      package = mkPackageOption pkgs "lasuite-docs-collaboration-server" { };
+
+      port = mkOption {
+        type = types.port;
+        default = 4444;
+        description = ''
+          Port used by the collaboration server to listen.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = types.attrsOf (
+            types.oneOf [
+              types.str
+              types.bool
+            ]
+          );
+
+          options = {
+            PORT = mkOption {
+              type = types.str;
+              default = toString cfg.collaborationServer.port;
+              readOnly = true;
+              description = "Port used by collaboration server to listen to";
+            };
+
+            COLLABORATION_BACKEND_BASE_URL = mkOption {
+              type = types.str;
+              default = "https://${cfg.domain}";
+              defaultText = lib.literalExpression "https://\${cfg.domain}";
+              description = "URL to the backend server base";
+            };
+          };
+        };
+        default = { };
+        example = ''
+          {
+            COLLABORATION_LOGGING = true;
+          }
+        '';
+        description = ''
+          Configuration options of collaboration server.
+
+          See https://github.com/suitenumerique/docs/blob/v${cfg.collaborationServer.package.version}/docs/env.md
+        '';
+      };
+    };
+
+    gunicorn = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [
+          "--name=impress"
+          "--workers=3"
+        ];
+        description = ''
+          Extra arguments to pass to the gunicorn process.
+        '';
+      };
+    };
+
+    celery = {
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = ''
+          Extra arguments to pass to the celery process.
+        '';
+      };
+    };
+
+    domain = mkOption {
+      type = types.str;
+      description = ''
+        Domain name of the docs instance.
+      '';
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (
+          types.nullOr (
+            types.oneOf [
+              types.str
+              types.bool
+              types.path
+              types.int
+            ]
+          )
+        );
+
+        options = {
+          DJANGO_CONFIGURATION = mkOption {
+            type = types.str;
+            internal = true;
+            default = "Production";
+            description = "The configuration that Django will use";
+          };
+
+          DJANGO_SETTINGS_MODULE = mkOption {
+            type = types.str;
+            internal = true;
+            default = "impress.settings";
+            description = "The configuration module that Django will use";
+          };
+
+          DJANGO_SECRET_KEY_FILE = mkOption {
+            type = types.path;
+            default =
+              if cfg.secretKeyPath == null then "/var/lib/lasuite-docs/django_secret_key" else cfg.secretKeyPath;
+            description = "The path to the file containing Django's secret key";
+          };
+
+          DATA_DIR = mkOption {
+            type = types.path;
+            default = "/var/lib/lasuite-docs";
+            description = "Path to the data directory";
+          };
+
+          DJANGO_ALLOWED_HOSTS = mkOption {
+            type = types.str;
+            default = if cfg.enableNginx then "localhost,127.0.0.1,${cfg.domain}" else "";
+            defaultText = lib.literalExpression ''
+              if cfg.enableNginx then "localhost,127.0.0.1,$${cfg.domain}" else ""
+            '';
+            description = "Comma-separated list of hosts that are able to connect to the server";
+          };
+
+          DB_NAME = mkOption {
+            type = types.str;
+            default = "lasuite-docs";
+            description = "Name of the database";
+          };
+
+          DB_USER = mkOption {
+            type = types.str;
+            default = "lasuite-docs";
+            description = "User of the database";
+          };
+
+          DB_HOST = mkOption {
+            type = types.nullOr types.str;
+            default = if cfg.postgresql.createLocally then "/run/postgresql" else null;
+            description = "Host of the database";
+          };
+
+          REDIS_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "unix://${config.services.redis.servers.lasuite-docs.unixSocket}?db=0"
+              else
+                null;
+            description = "URL of the redis backend";
+          };
+
+          CELERY_BROKER_URL = mkOption {
+            type = types.nullOr types.str;
+            default =
+              if cfg.redis.createLocally then
+                "redis+socket://${config.services.redis.servers.lasuite-docs.unixSocket}?db=1"
+              else
+                null;
+            description = "URL of the redis backend for celery";
+          };
+        };
+      };
+      default = { };
+      example = ''
+        {
+          DJANGO_ALLOWED_HOSTS = "*";
+        }
+      '';
+      description = ''
+        Configuration options of docs.
+
+        See https://github.com/suitenumerique/docs/blob/v${cfg.backendPackage.version}/docs/env.md
+
+        `REDIS_URL` and `CELERY_BROKER_URL` are set if `services.lasuite-docs.redis.createLocally` is true.
+        `DB_HOST` is set if `services.lasuite-docs.postgresql.createLocally` is true.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to environment file.
+
+        This can be useful to pass secrets to docs via tools like `agenix` or `sops`.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.lasuite-docs = {
+      description = "Docs from SuiteNumérique";
+      after =
+        [ "network.target" ]
+        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        ln -sfT ${cfg.backendPackage}/share/static /var/lib/lasuite-docs/static
+
+        if [ ! -f .version ]; then
+          touch .version
+        fi
+
+        if [ "${cfg.backendPackage.version}" != "$(cat .version)" ]; then
+          ${getExe cfg.backendPackage} migrate
+          echo -n "${cfg.backendPackage.version}" > .version
+        fi
+        ${optionalString (cfg.secretKeyPath == null) ''
+          if [[ ! -f /var/lib/lasuite-docs/django_secret_key ]]; then
+            (
+              umask 0377
+              tr -dc A-Za-z0-9 < /dev/urandom | head -c64 | ${pkgs.moreutils}/bin/sponge /var/lib/lasuite-docs/django_secret_key
+            )
+          fi
+        ''}
+      '';
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.backendPackage "gunicorn")
+            "--bind=${cfg.bind}"
+          ]
+          ++ cfg.gunicorn.extraArgs
+          ++ [ "impress.wsgi:application" ]
+        );
+        EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+        MemoryDenyWriteExecute = true;
+      } // commonServiceConfig;
+    };
+
+    systemd.services.lasuite-docs-celery = {
+      description = "Docs Celery broker from SuiteNumérique";
+      after =
+        [ "network.target" ]
+        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
+      wants =
+        (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
+      wantedBy = [ "multi-user.target" ];
+
+      environment = pythonEnvironment;
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.backendPackage "celery")
+          ]
+          ++ cfg.celery.extraArgs
+          ++ [
+            "--app=impress.celery_app"
+            "worker"
+          ]
+        );
+        EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+        MemoryDenyWriteExecute = true;
+      } // commonServiceConfig;
+    };
+
+    systemd.services.lasuite-docs-collaboration-server = {
+      description = "Docs Collaboration Server from SuiteNumérique";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = cfg.collaborationServer.settings;
+
+      serviceConfig = {
+        ExecStart = getExe cfg.collaborationServer.package;
+      } // commonServiceConfig;
+    };
+
+    services.postgresql = mkIf cfg.postgresql.createLocally {
+      enable = true;
+      ensureDatabases = [ "lasuite-docs" ];
+      ensureUsers = [
+        {
+          name = "lasuite-docs";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.redis.servers.lasuite-docs = mkIf cfg.redis.createLocally { enable = true; };
+
+    services.nginx = mkIf cfg.enableNginx {
+      enable = true;
+
+      virtualHosts.${cfg.domain} = {
+        extraConfig = ''
+          error_page 401 /401;
+          error_page 403 /403;
+          error_page 404 /404;
+        '';
+
+        root = cfg.frontendPackage;
+
+        locations."~ '^/docs/[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/?$'" = {
+          tryFiles = "$uri /docs/[id]/index.html";
+        };
+
+        locations."/api" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/admin" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/collaboration/ws/" = {
+          proxyPass = "http://localhost:${toString cfg.collaborationServer.port}";
+          recommendedProxySettings = true;
+          proxyWebsockets = true;
+        };
+
+        locations."/collaboration/api/" = {
+          proxyPass = "http://localhost:${toString cfg.collaborationServer.port}";
+          recommendedProxySettings = true;
+        };
+
+        locations."/media-auth" = {
+          proxyPass = "http://${cfg.bind}";
+          recommendedProxySettings = true;
+          extraConfig = ''
+            rewrite $/(.*)^ /api/v1.0/documents/$1 break;
+            proxy_set_header X-Original-URL $request_uri;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header X-Original-Method $request_method;
+          '';
+        };
+
+        locations."/media/" = {
+          proxyPass = cfg.s3Url;
+          recommendedProxySettings = true;
+          extraConfig = ''
+            auth_request /media-auth;
+            auth_request_set $authHeader $upstream_http_authorization;
+            auth_request_set $authDate $upstream_http_x_amz_date;
+            auth_request_set $authContentSha256 $upstream_http_x_amz_content_sha256;
+
+            proxy_set_header Authorization $authHeader;
+            proxy_set_header X-Amz-Date $authDate;
+            proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
+
+            add_header Content-Security-Policy "default-src 'none'" always;
+          '';
+        };
+      };
+    };
+  };
+
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = [ lib.maintainers.soyouzpanda ];
+  };
+}
diff --git a/nixos/modules/services/web-apps/mealie.nix b/nixos/modules/services/web-apps/mealie.nix
index 46571fea4617..b8f65b1fb98e 100644
--- a/nixos/modules/services/web-apps/mealie.nix
+++ b/nixos/modules/services/web-apps/mealie.nix
@@ -76,7 +76,7 @@ in
         API_PORT = toString cfg.port;
         BASE_URL = "http://localhost:${toString cfg.port}";
         DATA_DIR = "/var/lib/mealie";
-        NLTK_DATA = pkgs.nltk-data.averaged_perceptron_tagger_eng;
+        NLTK_DATA = pkgs.nltk-data.averaged-perceptron-tagger-eng;
       } // (builtins.mapAttrs (_: val: toString val) cfg.settings);
 
       serviceConfig = {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 933eaab3b0a9..5dda007c5982 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -711,6 +711,7 @@ in
   languagetool = handleTest ./languagetool.nix { };
   lanraragi = handleTest ./lanraragi.nix { };
   latestKernel.login = handleTest ./login.nix { latestKernel = true; };
+  lasuite-docs = runTest ./web-apps/lasuite-docs.nix;
   lavalink = runTest ./lavalink.nix;
   leaps = handleTest ./leaps.nix { };
   lemmy = handleTest ./lemmy.nix { };
diff --git a/nixos/tests/web-apps/lasuite-docs.nix b/nixos/tests/web-apps/lasuite-docs.nix
new file mode 100644
index 000000000000..49af73a7f604
--- /dev/null
+++ b/nixos/tests/web-apps/lasuite-docs.nix
@@ -0,0 +1,168 @@
+{ lib, ... }:
+let
+  domain = "docs.local";
+  oidcDomain = "127.0.0.1:8080";
+  s3Domain = "127.0.0.1:9000";
+
+  minioAccessKey = "a8dff633d164068418a5";
+  minioSecretKey = "d546ea5f9c9bfdcf83755a7c09f2f7fb";
+in
+
+{
+  name = "lasuite-docs";
+  meta.maintainers = with lib.maintainers; [
+    soyouzpanda
+  ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.diskSize = 4 * 1024;
+      virtualisation.memorySize = 4 * 1024;
+
+      networking.hosts."127.0.0.1" = [ domain ];
+
+      environment.systemPackages = with pkgs; [
+        jq
+        minio-client
+      ];
+
+      services.lasuite-docs = {
+        enable = true;
+        enableNginx = true;
+        redis.createLocally = true;
+        postgresql.createLocally = true;
+
+        inherit domain;
+        s3Url = "http://${s3Domain}/lasuite-docs";
+
+        settings = {
+          DJANGO_SECRET_KEY_FILE = pkgs.writeText "django-secret-file" ''
+            8540db59c03943d48c3ed1a0f96ce3b560e0f45274f120f7ee4dace3cc366a6b
+          '';
+
+          OIDC_OP_JWKS_ENDPOINT = "http://${oidcDomain}/dex/keys";
+          OIDC_OP_AUTHORIZATION_ENDPOINT = "http://${oidcDomain}/dex/auth/mock";
+          OIDC_OP_TOKEN_ENDPOINT = "http://${oidcDomain}/dex/token";
+          OIDC_OP_USER_ENDPOINT = "http://${oidcDomain}/dex/userinfo";
+          OIDC_RP_CLIENT_ID = "lasuite-docs";
+          OIDC_RP_SIGN_ALGO = "RS256";
+          OIDC_RP_SCOPES = "openid email";
+          OIDC_RP_CLIENT_SECRET = "lasuitedocsclientsecret";
+
+          LOGIN_REDIRECT_URL = "http://${domain}";
+          LOGIN_REDIRECT_URL_FAILURE = "http://${domain}";
+          LOGOUT_REDIRECT_URL = "http://${domain}";
+
+          AWS_S3_ENDPOINT_URL = "http://${s3Domain}";
+          AWS_S3_ACCESS_KEY_ID = minioAccessKey;
+          AWS_S3_SECRET_ACCESS_KEY = minioSecretKey;
+          AWS_STORAGE_BUCKET_NAME = "lasuite-docs";
+          MEDIA_BASE_URL = "http://${domain}";
+
+          # Disable HTTPS feature in tests because we're running on a HTTP connection
+          DJANGO_SECURE_PROXY_SSL_HEADER = "";
+          DJANGO_SECURE_SSL_REDIRECT = false;
+          DJANGO_CSRF_COOKIE_SECURE = false;
+          DJANGO_SESSION_COOKIE_SECURE = false;
+          DJANGO_CSRF_TRUSTED_ORIGINS = "http://*";
+        };
+      };
+
+      services.dex = {
+        enable = true;
+        settings = {
+          issuer = "http://${oidcDomain}/dex";
+          storage = {
+            type = "postgres";
+            config.host = "/var/run/postgresql";
+          };
+          web.http = "127.0.0.1:8080";
+          oauth2.skipApprovalScreen = true;
+          staticClients = [
+            {
+              id = "lasuite-docs";
+              name = "Docs";
+              redirectURIs = [ "http://${domain}/api/v1.0/callback/" ];
+              secretFile = "/etc/dex/lasuite-docs";
+            }
+          ];
+          connectors = [
+            {
+              type = "mockPassword";
+              id = "mock";
+              name = "Example";
+              config = {
+                username = "admin";
+                password = "password";
+              };
+            }
+          ];
+        };
+      };
+
+      services.minio = {
+        enable = true;
+        rootCredentialsFile = "/etc/minio/minio-root-credentials";
+      };
+
+      environment.etc."dex/lasuite-docs" = {
+        mode = "0400";
+        user = "dex";
+        text = "lasuitedocsclientsecret";
+      };
+
+      environment.etc."minio/minio-root-credentials" = {
+        mode = "0400";
+        text = ''
+          MINIO_ROOT_USER=${minioAccessKey}
+          MINIO_ROOT_PASSWORD=${minioSecretKey}
+        '';
+      };
+
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "dex" ];
+        ensureUsers = [
+          {
+            name = "dex";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+
+  testScript = ''
+    with subtest("Wait for units to start"):
+      machine.wait_for_unit("dex.service")
+      machine.wait_for_unit("minio.service")
+      machine.wait_for_unit("lasuite-docs.service")
+      machine.wait_for_unit("lasuite-docs-celery.service")
+      machine.wait_for_unit("lasuite-docs-collaboration-server.service")
+
+    with subtest("Create S3 bucket"):
+      machine.succeed("mc config host add minio http://${s3Domain} ${minioAccessKey} ${minioSecretKey} --api s3v4")
+      machine.succeed("mc mb lasuite-docs")
+
+    with subtest("Wait for web servers to start"):
+      machine.wait_until_succeeds("curl -fs 'http://${domain}/api/v1.0/authenticate/'", timeout=120)
+      machine.wait_until_succeeds("curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-docs&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid'", timeout=120)
+
+    with subtest("Login"):
+      state, nonce = machine.succeed("curl -fs -c cjar 'http://${domain}/api/v1.0/authenticate/' -w '%{redirect_url}' | sed -n 's/.*state=\\(.*\\)&nonce=\\(.*\\)/\\1 \\2/p'").strip().split(' ')
+
+      oidc_state = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock?client_id=lasuite-docs&response_type=code&redirect_uri=http://${domain}/api/v1.0/callback/&scope=openid+email&state={state}&nonce={nonce}' | sed -n 's/.*state=\\(.*\\)\">.*/\\1/p'").strip()
+
+      code = machine.succeed(f"curl -fs '${oidcDomain}/dex/auth/mock/login?back=&state={oidc_state}' -d 'login=admin&password=password' -w '%{{redirect_url}}' | sed -n 's/.*code=\\(.*\\)&.*/\\1/p'").strip()
+      print(f"Got approval code {code}")
+
+      machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/callback/?code={code}&state={state}'")
+
+    with subtest("Create a document"):
+      csrf_token = machine.succeed("grep csrftoken cjar | cut -f 7 | tr -d '\n'")
+
+      document_id = machine.succeed(f"curl -fs -c cjar -b cjar 'http://${domain}/api/v1.0/documents/' -X POST -H 'X-CSRFToken: {csrf_token}' -H 'Referer: http://${domain}' | jq .id -r").strip()
+
+      print(f"Created document with id {document_id}")
+  '';
+}
diff --git a/pkgs/applications/editors/jetbrains/bin/darwin.nix b/pkgs/applications/editors/jetbrains/bin/darwin.nix
index 14673f41debb..fa73088e7287 100644
--- a/pkgs/applications/editors/jetbrains/bin/darwin.nix
+++ b/pkgs/applications/editors/jetbrains/bin/darwin.nix
@@ -15,7 +15,7 @@
   plugins ? [ ],
   buildNumber,
   ...
-}:
+}@args:
 
 let
   loname = lib.toLower productShort;
@@ -29,6 +29,7 @@ stdenvNoCC.mkDerivation {
     ;
   passthru.buildNumber = buildNumber;
   passthru.product = product;
+  passthru.tests = args.passthru.tests;
   meta = meta // {
     mainProgram = loname;
   };
diff --git a/pkgs/applications/editors/jetbrains/bin/linux.nix b/pkgs/applications/editors/jetbrains/bin/linux.nix
index 123bf81d2dde..6b0c1c313508 100644
--- a/pkgs/applications/editors/jetbrains/bin/linux.nix
+++ b/pkgs/applications/editors/jetbrains/bin/linux.nix
@@ -35,6 +35,7 @@
   extraLdPath ? [ ],
   extraWrapperArgs ? [ ],
   extraBuildInputs ? [ ],
+  ...
 }@args:
 
 let
@@ -48,6 +49,7 @@ lib.makeOverridable mkDerivation (
   rec {
     inherit pname version src;
     passthru.buildNumber = buildNumber;
+    passthru.tests = args.passthru.tests;
     meta = args.meta // {
       mainProgram = pname;
     };
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index efb86750d905..71eaaa2e9ba2 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -77,6 +77,7 @@ let
       extraWrapperArgs ? [ ],
       extraLdPath ? [ ],
       extraBuildInputs ? [ ],
+      extraTests ? { },
     }:
     mkJetBrainsProductCore {
       inherit
@@ -100,6 +101,9 @@ let
       inherit (ideInfo."${pname}") wmClass product;
       productShort = ideInfo."${pname}".productShort or ideInfo."${pname}".product;
       meta = mkMeta ideInfo."${pname}".meta fromSource;
+      passthru.tests = extraTests // {
+        plugins = callPackage ./plugins/tests.nix { ideName = pname; };
+      };
       libdbm =
         if ideInfo."${pname}".meta.isOpenSource then
           communitySources."${pname}".libdbm
diff --git a/pkgs/applications/editors/jetbrains/plugins/tests.nix b/pkgs/applications/editors/jetbrains/plugins/tests.nix
index b80e190fc6d5..bb182e599cac 100644
--- a/pkgs/applications/editors/jetbrains/plugins/tests.nix
+++ b/pkgs/applications/editors/jetbrains/plugins/tests.nix
@@ -1,36 +1,135 @@
-{ jetbrains, writeText }:
+{
+  jetbrains,
+  symlinkJoin,
+  lib,
+  runCommand,
+  # If not set, all IDEs are tested.
+  ideName ? null,
+}:
 
+let
+
+  # Known broken plugins, PLEASE remove entries here whenever possible.
+  broken-plugins = [
+    "github-copilot" # GitHub Copilot: https://github.com/NixOS/nixpkgs/issues/400317
+  ];
+
+  ides =
+    if ideName == null then
+      with jetbrains;
+      [
+        aqua
+        clion
+        datagrip
+        dataspell
+        gateway
+        goland
+        idea-community-src
+        idea-community-bin
+        idea-ultimate
+        mps
+        phpstorm
+        pycharm-community-src
+        pycharm-community-bin
+        pycharm-professional
+        rider
+        ruby-mine
+        rust-rover
+        webstorm
+        writerside
+      ]
+    else
+      [ (jetbrains.${ideName}) ];
+in
 {
   # Check to see if the process for adding plugins is breaking anything, instead of the plugins themselves
-  default =
+  empty =
     let
       modify-ide = ide: jetbrains.plugins.addPlugins ide [ ];
-      ides =
-        with jetbrains;
-        map modify-ide [
-          clion
-          datagrip
-          dataspell
-          goland
-          idea-community
-          idea-ultimate
-          mps
-          phpstorm
-          pycharm-community
-          pycharm-professional
-          rider
-          ruby-mine
-          rust-rover
-          webstorm
-        ];
-      paths = builtins.concatStringsSep " " ides;
     in
-    writeText "jb-ides" paths;
+    symlinkJoin {
+      name = "jetbrains-test-plugins-empty";
+      paths = (map modify-ide ides);
+    };
 
-  idea-ce-with-plugins = jetbrains.plugins.addPlugins jetbrains.idea-community [
-    "ideavim"
-    "nixidea"
-    # test JAR plugins
-    "wakatime"
-  ];
+  # Test all plugins. This will only build plugins compatible with the IDE and version. It will fail if the plugin is marked
+  # as compatible, but the build version is somehow not in the "builds" map (as that would indicate that something with update_plugins.py went wrong).
+  all =
+    let
+      plugins-json = builtins.fromJSON (builtins.readFile ./plugins.json);
+      plugins-for =
+        with lib.asserts;
+        ide:
+        builtins.map (plugin: plugin.name) (
+          builtins.filter (
+            plugin:
+            (
+              # Plugin has to not be broken
+              (!builtins.elem plugin.name broken-plugins)
+              # IDE has to be compatible
+              && (builtins.elem ide.pname plugin.compatible)
+              # Assert: The build number needs to be included (if marked compatible)
+              && (assertMsg (builtins.elem ide.buildNumber (builtins.attrNames plugin.builds)) "For plugin ${plugin.name} no entry for IDE build ${ide.buildNumber} is defined, even though ${ide.pname} is on that build.")
+              # The plugin has to exist for the build
+              && (plugin.builds.${ide.buildNumber} != null)
+            )
+          ) (builtins.attrValues plugins-json.plugins)
+        );
+      modify-ide = ide: jetbrains.plugins.addPlugins ide (plugins-for ide);
+    in
+    symlinkJoin {
+      name = "jetbrains-test-plugins-all";
+      paths = (map modify-ide ides);
+    };
+
+  # This test builds the IDEs with some plugins and checks that they can be discovered by the IDE.
+  # Test always succeeds on IDEs that the tested plugins don't support.
+  stored-correctly =
+    let
+      plugins-json = builtins.fromJSON (builtins.readFile ./plugins.json);
+      plugin-ids = [
+        # This is a "normal plugin", it's output must be linked into /${pname}/plugins.
+        "8607" # nixidea
+        # This is a plugin where the output contains a single JAR file. This JAR file needs to be linked directly in /${pname}/plugins.
+        "7425" # wakatime
+      ];
+      check-if-supported =
+        ide:
+        builtins.all (
+          plugin:
+          (builtins.elem ide.pname plugins-json.plugins.${plugin}.compatible)
+          && (plugins-json.plugins.${plugin}.builds.${ide.buildNumber} != null)
+        ) plugin-ids;
+      modify-ide = ide: jetbrains.plugins.addPlugins ide plugin-ids;
+    in
+    runCommand "test-jetbrains-plugins-stored-correctly"
+      {
+        idePaths = (map modify-ide (builtins.filter check-if-supported ides));
+      }
+      # TODO: instead of globbing using $ide/*/plugins we could probably somehow get the package name here properly.
+      ''
+        set -e
+        exec &> >(tee -a "$out")
+
+        IFS=' ' read -ra ideArray <<< "$idePaths"
+        for ide in "''${ideArray[@]}"; do
+          echo "processing $ide"
+
+          echo "> ensure normal plugin is available"
+          (
+            set -x
+            find -L $ide/*/plugins -type f -iname 'NixIDEA-*.jar' | grep .
+          )
+
+          echo "> ensure single JAR file plugin is available"
+          (
+            set -x
+            PATH_TO_LINK=$(find $ide/*/plugins -maxdepth 1 -type l -iname '*wakatime.jar' | grep .)
+            test -f $(readlink $PATH_TO_LINK)
+          )
+          echo ""
+        done
+
+        echo "test done! ok!"
+      '';
 }
diff --git a/pkgs/applications/editors/jetbrains/readme.md b/pkgs/applications/editors/jetbrains/readme.md
index a1c9788e64e3..1fe201860e18 100644
--- a/pkgs/applications/editors/jetbrains/readme.md
+++ b/pkgs/applications/editors/jetbrains/readme.md
@@ -1,12 +1,19 @@
 This directory contains the build expressions needed to build any of the jetbrains IDEs.
 The jdk is in `pkgs/development/compilers/jetbrains-jdk`.
-To test the build process of every IDE (as well as the process for adding plugins), build `jetbrains.plugins.tests.default`.
+
+## Tests:
+- To test the build process of every IDE (as well as the process for adding plugins), build `jetbrains.plugins.tests.empty`.
+- To test the build process with all plugins\* supported by all IDEs, build `jetbrains.plugins.tests.all`.
+- To test only plugins for a specific IDE\*, build `jetbrains.ide-name.tests.plugins.all`.
+- To test that plugins are correctly stored in the plugins directory, build `jetbrains.plugins.tests.stored-correctly`.
+
+\*: Plugins marked as broken in nixpkgs are skipped: When updating/fixing plugins, please check the `broken-plugins` in `plugins/tests.nix` and update it if needed.
 
 ## How to use plugins:
  - Get the ide you want and call `jetbrains.plugins.addPlugins` with a list of plugins you want to add.
  - The list of plugins can be a list of ids or names (as in `plugins/plugins.json`)
  - Example: `jetbrains.plugins.addPlugins jetbrains.pycharm-professional [ "nixidea" ]`
- - The list can also contain a drv giving a `.jar` or `.zip` (this is how you use a plugin not added to nixpkgs)
+ - The list can also contain drvs giving the directory contents of the plugin (this is how you use a plugin not added to nixpkgs) or a single `.jar` (executable). For an example, look at the implementation of `fetchPluginSrc` in `plugins/default.nix`.
 
 ### How to add a new plugin to nixpkgs
  - Find the page for the plugin on https://plugins.jetbrains.com
diff --git a/pkgs/applications/editors/sublime/4/packages.nix b/pkgs/applications/editors/sublime/4/packages.nix
index b125ad8c2896..6e2a275f9e36 100644
--- a/pkgs/applications/editors/sublime/4/packages.nix
+++ b/pkgs/applications/editors/sublime/4/packages.nix
@@ -5,15 +5,15 @@ let
 in
 {
   sublime4 = common {
-    buildVersion = "4192";
-    x64sha256 = "3CMorzQj+JFPTXp6PPhX6Mlcz/kJb2FM2iwUsvrhy+s=";
-    aarch64sha256 = "gVhDBac3kyDU1qIiXoN7Xf5Jvbdnif2QGuFUy2C34Mo=";
+    buildVersion = "4200";
+    x64sha256 = "NvacVRrRjuRgAr5NnFI/5UXZO2f+pnvupzHnJARLRp8=";
+    aarch64sha256 = "z0tqp06ioqqwLhRFmc+eSkI8u5VDwiH32hCVqVSVVmo=";
   } { };
 
   sublime4-dev = common {
-    buildVersion = "4196";
+    buildVersion = "4199";
     dev = true;
-    x64sha256 = "lsvPDqN9YkhDl/4LjLoHkV+Po9lTJpS498awzMMCh3c=";
-    aarch64sha256 = "Bwy69jCKkj8AT8WeMXJ3C+yUk+PArHETyp1ZvMXjR5A=";
+    x64sha256 = "Nrhwv+ox/SW21c8wZtuX9mzHQ+o9ghsI50dU2kDvCX0=";
+    aarch64sha256 = "3vCXj53f2Qlt/Ab3hNNng+Y4Ch85Dp0G8srTVBtd6zU=";
   } { };
 }
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 649130a0da6c..28a3bec2e046 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -3000,6 +3000,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  colorful-winsep-nvim = buildVimPlugin {
+    pname = "colorful-winsep.nvim";
+    version = "2025-04-11";
+    src = fetchFromGitHub {
+      owner = "nvim-zh";
+      repo = "colorful-winsep.nvim";
+      rev = "7bbe4e1353c0fe37c98bad2758aafc410280f6b3";
+      sha256 = "0nm3cr5wzfyanx01nw998cddq1vxww0xn6v8a7db3a2r8fjxp5fx";
+    };
+    meta.homepage = "https://github.com/nvim-zh/colorful-winsep.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   colorizer = buildVimPlugin {
     pname = "colorizer";
     version = "2022-01-03";
@@ -3248,6 +3261,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  contextfiles-nvim = buildVimPlugin {
+    pname = "contextfiles.nvim";
+    version = "2025-05-07";
+    src = fetchFromGitHub {
+      owner = "banjo";
+      repo = "contextfiles.nvim";
+      rev = "d9541105d60c708e2ec6641109f5f2a6179c2a80";
+      sha256 = "1n8nkpy53mqr0hn26lqzcxmp8l6r2873yrsqxrj5cpis0f52qc45";
+    };
+    meta.homepage = "https://github.com/banjo/contextfiles.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   copilot-cmp = buildVimPlugin {
     pname = "copilot-cmp";
     version = "2024-12-11";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 6f39a6589ad6..ea00dc8180fd 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -229,6 +229,7 @@ https://github.com/gorbit99/codewindow.nvim/,HEAD,
 https://github.com/metakirby5/codi.vim/,,
 https://github.com/tjdevries/colorbuddy.nvim/,,
 https://github.com/xzbdmw/colorful-menu.nvim/,HEAD,
+https://github.com/nvim-zh/colorful-winsep.nvim/,HEAD,
 https://github.com/lilydjwg/colorizer/,,
 https://github.com/Domeee/com.cloudedmountain.ide.neovim/,HEAD,
 https://github.com/wincent/command-t/,,
@@ -248,6 +249,7 @@ https://github.com/stevearc/conform.nvim/,HEAD,
 https://github.com/Olical/conjure/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
+https://github.com/banjo/contextfiles.nvim/,HEAD,
 https://github.com/zbirenbaum/copilot-cmp/,HEAD,
 https://github.com/copilotlsp-nvim/copilot-lsp/,HEAD,
 https://github.com/AndreM222/copilot-lualine/,HEAD,
diff --git a/pkgs/applications/emulators/libretro/cores/gambatte.nix b/pkgs/applications/emulators/libretro/cores/gambatte.nix
index 57f1183b4014..03b379bde0e1 100644
--- a/pkgs/applications/emulators/libretro/cores/gambatte.nix
+++ b/pkgs/applications/emulators/libretro/cores/gambatte.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2025-05-02";
+  version = "0-unstable-2025-05-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "a85fe7c20933dbe4680d783d32639a71a85783cb";
-    hash = "sha256-YwQQkRshDDQi9CzqNnhKkj7+A0fkvcEZEg6PySaFDRI=";
+    rev = "0b95f252ba9cdb366b4d87e6236b0a63f4305cba";
+    hash = "sha256-EcTd5ihZcdQ2LJNy8jcD4g6+PhR1Jialjd3xa6tZMew=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index 75b44f6c91bd..ff6fe11e6d50 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -71,7 +71,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.3.3635.12";
+  version = "7.4.3684.38";
 
   suffix =
     {
@@ -84,8 +84,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-Gplg0QD7DcibaOv1Q8RUnefACZdNnM8yKYYiP1dpY58=";
-        x86_64-linux = "sha256-qcV4n9/nAbb0Gw8azorDSjpjy4cXe2XlR94WwuwUEyc=";
+        aarch64-linux = "sha256-SmmmEFSzAGgm9eKeTKpUFuW/UVNyXw8x8c1uRp69fbw=";
+        x86_64-linux = "sha256-h/ZcJq51gsb03V5KFlPOE9H0NonYxJNeWVg2UCQEBPs=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index b4112a6126d6..5c98668d49f8 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,7 +9,7 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.94";
+        stable = "0.0.95";
         ptb = "0.0.143";
         canary = "0.0.678";
         development = "0.0.75";
@@ -26,7 +26,7 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-035nfbEyvdsNxZh6fkXh2JhY7EXQtwUnS4sUKr74MRQ=";
+        hash = "sha256-8NpHTG3ojEr8LCRBE/urgH6xdAHLUhqz+A95obB75y4=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
diff --git a/pkgs/build-support/substitute-files/substitute-all-files.nix b/pkgs/build-support/substitute-files/substitute-all-files.nix
deleted file mode 100644
index b8d1ae8a6834..000000000000
--- a/pkgs/build-support/substitute-files/substitute-all-files.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ lib, stdenv }:
-
-args:
-
-# TODO(@wolfgangwalther): Remove substituteAllFiles after 25.05 branch-off.
-lib.warn
-  "substituteAllFiles is deprecated and will be removed in 25.11. Use replaceVars for each file instead."
-  (
-    stdenv.mkDerivation (
-      {
-        name = if args ? name then args.name else baseNameOf (toString args.src);
-        builder = builtins.toFile "builder.sh" ''
-          set -o pipefail
-
-          eval "$preInstall"
-
-          args=
-
-          pushd "$src"
-          echo -ne "${lib.concatStringsSep "\\0" args.files}" | xargs -0 -n1 -I {} -- find {} -type f -print0 | while read -d "" line; do
-            mkdir -p "$out/$(dirname "$line")"
-            substituteAll "$line" "$out/$line"
-          done
-          popd
-
-          eval "$postInstall"
-        '';
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-      }
-      // args
-    )
-  )
diff --git a/pkgs/build-support/substitute/substitute-all.nix b/pkgs/build-support/substitute/substitute-all.nix
deleted file mode 100644
index 1135c822e22d..000000000000
--- a/pkgs/build-support/substitute/substitute-all.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ lib, stdenvNoCC }:
-# see the substituteAll in the nixpkgs documentation for usage and constraints
-args:
-let
-  # keep this in sync with substituteAll
-  isInvalidArgName = x: builtins.match "^[a-z][a-zA-Z0-9_]*$" x == null;
-  invalidArgs = builtins.filter isInvalidArgName (builtins.attrNames args);
-in
-# TODO(@wolfgangwalther): Remove substituteAll, the nix function, after 25.05 branch-off.
-lib.warn "substituteAll is deprecated and will be removed in 25.11. Use replaceVars instead." (
-  if invalidArgs == [ ] then
-    stdenvNoCC.mkDerivation (
-      {
-        name = if args ? name then args.name else baseNameOf (toString args.src);
-        builder = ./substitute-all.sh;
-        inherit (args) src;
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-      }
-      // args
-    )
-  else
-    throw ''
-      Argument names for `pkgs.substituteAll` must:
-        - start with a lower case ASCII letter
-        - only contain ASCII letters, digits and underscores
-      Found invalid argument names: ${lib.concatStringsSep ", " invalidArgs}.
-    ''
-)
diff --git a/pkgs/by-name/at/atlas/package.nix b/pkgs/by-name/at/atlas/package.nix
index 2f25507a51a3..7b51a249213f 100644
--- a/pkgs/by-name/at/atlas/package.nix
+++ b/pkgs/by-name/at/atlas/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlas";
-  version = "0.33.0";
+  version = "0.33.1";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uMINAdoHYRVaZ7QdxZ0G03cOTRe6ObnIuxo3ic+tMnE=";
+    hash = "sha256-Io7FnPxvr3XIj+Tbf1yVxjTnqoRzQZnaVlImcwBjwXE=";
   };
 
   modRoot = "cmd/atlas";
diff --git a/pkgs/by-name/br/brush/package.nix b/pkgs/by-name/br/brush/package.nix
index 0a9e153f19ba..8c8b8d5ff7be 100644
--- a/pkgs/by-name/br/brush/package.nix
+++ b/pkgs/by-name/br/brush/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "brush";
-  version = "0.2.17";
+  version = "0.2.18";
 
   src = fetchFromGitHub {
     owner = "reubeno";
     repo = "brush";
     tag = "brush-shell-v${version}";
-    hash = "sha256-64xj9yu6OCNTnuymEd5ihdE0s8RWfrSMfTz9TlMQ6Sg=";
+    hash = "sha256-lX8e2gqbZMbsdMD1ZUK0l5xlCq+NkzBDeZSMzrPX+zI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-AIEgSUl3YFCa6FOgoZYpPc1qc2EOfpm1lZEQYlBgkGg=";
+  cargoHash = "sha256-qHbKbWzuOpoRVySZd/yeGnDNbFGb2fQmgz0ETcNLoVE=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/bu/bulloak/package.nix b/pkgs/by-name/bu/bulloak/package.nix
index 8319b0115871..069374c134b3 100644
--- a/pkgs/by-name/bu/bulloak/package.nix
+++ b/pkgs/by-name/bu/bulloak/package.nix
@@ -12,36 +12,36 @@ let
   # svm-rs's source code.
   solc-versions = {
     x86_64-linux = fetchurl {
-      url = "https://raw.githubusercontent.com/ethereum/solc-bin/60de887187e5670c715931a82fdff6677b31f0cb/linux-amd64/list.json";
-      hash = "sha256-zm1cdqSP4Y9UQcq9OV8sXxnzr3+TWdc7mdg+Do8Y7WY=";
+      url = "https://raw.githubusercontent.com/ethereum/solc-bin/bdd7dd3fda6e4a00c0697d891a1a7ae9f2b3a5fd/linux-amd64/list.json";
+      hash = "sha256-H6D6XbIw5sDZlbc2c51vIMRmOqs2nDIcaNzCaOvnLsw=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://raw.githubusercontent.com/ethereum/solc-bin/60de887187e5670c715931a82fdff6677b31f0cb/macosx-amd64/list.json";
-      hash = "sha256-uUdd5gCG7SHQgAW2DQXemTujb8bUJM27J02WjLkQgek=";
+      url = "https://raw.githubusercontent.com/ethereum/solc-bin/bdd7dd3fda6e4a00c0697d891a1a7ae9f2b3a5fd/macosx-amd64/list.json";
+      hash = "sha256-A3A6gtNb129tD5KC0tCXvlzQ11t5SrNrX8tQeq73+mY=";
     };
     aarch64-linux = fetchurl {
-      url = "https://raw.githubusercontent.com/nikitastupin/solc/923ab4b852fadc00ffe87bb76fff21d0613bd280/linux/aarch64/list.json";
-      hash = "sha256-mJaEN63mR3XdK2FmEF+VhLR6JaCCtYkIRq00wYH6Xx8=";
+      url = "https://raw.githubusercontent.com/nikitastupin/solc/99b5867237b37952d372e0dab400d6788feda315/linux/aarch64/list.json";
+      hash = "sha256-u6WRAcnR9mN9ERfFdLOxxSc9ASQIQvmS8uG+Z4H6OAU=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://raw.githubusercontent.com/alloy-rs/solc-builds/260964c1fcae2502c0139070bdc5c83eb7036a68/macosx/aarch64/list.json";
-      hash = "sha256-xrtb3deMDAuDIjzN1pxm5NyW5NW5OyoOHTFsYyWJCYY=";
+      url = "https://raw.githubusercontent.com/alloy-rs/solc-builds/e4b80d33bc4d015b2fc3583e217fbf248b2014e1/macosx/aarch64/list.json";
+      hash = "sha256-h0B1g7x80jU9iCFCMYw+HlmdKQt1wfhIkV5W742kw6w=";
     };
   };
 in
 rustPlatform.buildRustPackage rec {
   pname = "bulloak";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "alexfertel";
     repo = "bulloak";
     rev = "v${version}";
-    hash = "sha256-OAjy8SXaD+2/C5jLNIezv/KdrPHlwJC5L1LwGhqBWQs=";
+    hash = "sha256-8Qp8ceafAkw7Tush/dvBl27q5oNDzbOqyvSLXhjf4fo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-sdnpnKWKCJeBbooM0Qe/wccF1b3LLiTfZe4RdxbJYcs=";
+  cargoHash = "sha256-yaRaB3U8Wxhp7SK5E44CF8AudhG7ar7L5ey+CRVfYqc=";
 
   # tests run in CI on the source repo
   doCheck = false;
diff --git a/pkgs/by-name/cu/cue/package.nix b/pkgs/by-name/cu/cue/package.nix
index 213b86e3f54c..6c767afc5dbc 100644
--- a/pkgs/by-name/cu/cue/package.nix
+++ b/pkgs/by-name/cu/cue/package.nix
@@ -5,18 +5,17 @@
   stdenv,
   installShellFiles,
   testers,
-  cue,
   callPackage,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "cue";
   version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "cue-lang";
     repo = "cue";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-RvdjZ3wSc3IhQvYJL989x33qOtVZ4paoQTLFzWF9xj0=";
   };
 
@@ -29,7 +28,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X cuelang.org/go/cmd/cue/cmd.version=v${version}"
+    "-X cuelang.org/go/cmd/cue/cmd.version=v${finalAttrs.version}"
   ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
@@ -44,9 +43,9 @@ buildGoModule rec {
     tests = {
       test-001-all-good = callPackage ./tests/001-all-good.nix { };
       version = testers.testVersion {
-        package = cue;
+        package = finalAttrs.finalPackage;
         command = "cue version";
-        version = "v${version}";
+        version = "v${finalAttrs.version}";
       };
     };
   };
@@ -58,4 +57,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ aaronjheng ];
     mainProgram = "cue";
   };
-}
+})
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index 243a03e54a24..11e3670eb7cc 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.43.0";
+  version = "2.44.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-gUqNiiPipoxLKwGVsi42PyOnmPbfvUs7UwfqOdmFn/E=";
+    hash = "sha256-cLN1G/Rp1Euc6pp0V/Xd4qmo3x0b+rnNU8PDP5j/PTE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fu/fuse-overlayfs/package.nix b/pkgs/by-name/fu/fuse-overlayfs/package.nix
index 4e85092dbd79..1906c7633f99 100644
--- a/pkgs/by-name/fu/fuse-overlayfs/package.nix
+++ b/pkgs/by-name/fu/fuse-overlayfs/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fuse-overlayfs";
-  version = "1.14";
+  version = "1.15";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "fuse-overlayfs";
     rev = "v${version}";
-    hash = "sha256-A70AxYPKph/5zRNFRDWrwl8Csc8Vf1gmOLJ39ixJgL0=";
+    hash = "sha256-awVDq87lxMtpTADhy8k95N/4yuGH+2Fn94j3JZzkuUY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index e1bfaa98eb11..c18d28e77801 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -32,6 +32,8 @@ buildGoModule rec {
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "GitLab Docker toolset to pack, ship, store, and deliver content";
     license = licenses.asl20;
diff --git a/pkgs/by-name/gz/gz-cmake/package.nix b/pkgs/by-name/gz/gz-cmake/package.nix
index 6ab3dcebd263..38a825b0d4ab 100644
--- a/pkgs/by-name/gz/gz-cmake/package.nix
+++ b/pkgs/by-name/gz/gz-cmake/package.nix
@@ -24,6 +24,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+bMOcGWfcwPhxR9CBp4iH02CZC4oplCjsTDpPDsDnSs=";
   };
 
+  postPatch = ''
+    patchShebangs examples/test_c_child_requires_c_no_deps.bash
+    substituteInPlace examples/CMakeLists.txt --replace-fail \
+      "$""{CMAKE_INSTALL_LIBDIR}" "${if stdenv.isDarwin then "lib" else "lib64"}"
+  '';
+
   nativeBuildInputs = [
     cmake
     doxygen
@@ -37,14 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeCheckInputs = [ python3 ];
 
-  # 98% tests passed, 1 tests failed out of 44
-  # 44 - c_child_requires_c_nodep (Failed)
-  #
-  # Package gz-c_child_private was not found in the pkg-config search path.
-  # Perhaps you should add the directory containing `gz-c_child_private.pc'
-  # to the PKG_CONFIG_PATH environment variable
-  # No package 'gz-c_child_private' found
-  doCheck = false;
+  doCheck = true;
 
   # Extract the version by matching the tag's prefix.
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index 5b663297324f..3b9b94a41e17 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-05-13";
+  version = "0-unstable-2025-05-23";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "8d832ddfda9facf538f3dda9b6985fb0234f151c";
-    hash = "sha256-NnPzzXEqfYjfrimLzK0JOBItfdEJdP/i6SNTuunCGgw=";
+    rev = "7419250703fd5eb50e99bdfb07a86671939103ea";
+    hash = "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/io/iosevka-bin/package.nix b/pkgs/by-name/io/iosevka-bin/package.nix
index d237b16d5b30..b0c8eaef37d7 100644
--- a/pkgs/by-name/io/iosevka-bin/package.nix
+++ b/pkgs/by-name/io/iosevka-bin/package.nix
@@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "33.2.2";
+  version = "33.2.3";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/PkgTTC-${name}-${version}.zip";
diff --git a/pkgs/by-name/io/iosevka-bin/variants.nix b/pkgs/by-name/io/iosevka-bin/variants.nix
index 86ab7a0f219c..4a6a139f90cb 100644
--- a/pkgs/by-name/io/iosevka-bin/variants.nix
+++ b/pkgs/by-name/io/iosevka-bin/variants.nix
@@ -1,93 +1,93 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  Iosevka = "0p386cv1bkbrwx91hxxd0qf9y18sidhj8jzl0b7l0g5gi68v9z67";
-  IosevkaAile = "050j2bhbkl015kkmyz3qzxckfqpy0frg4800biqn20nfh0nd1wmw";
-  IosevkaCurly = "15fs984pbxvazhzcz941zrksg12jrqilflvzcpcnqfg0nyz7w79w";
-  IosevkaCurlySlab = "19n6sx5ag47ysa2qg64n5549r1ig33kzin5ln5mg6x5cfiir6j26";
-  IosevkaEtoile = "1syhrp6cifm989zybh2zvhdk2jwrck8mvmlgppw5wpz4q2d35k30";
-  IosevkaSlab = "16f7j3hqsfk2hnvwwnd5dszwf46r3a18njv1d1szkn2xnw55jgak";
-  IosevkaSS01 = "095rvb62j71hr5n13wxkbq3h36jr5gnv7536zycjlm0h34ff2ryn";
-  IosevkaSS02 = "1k880h5j2ynr88vgflvx7vjk88rh3xs6kblj82pb0li9fvl7c7wd";
-  IosevkaSS03 = "1jp9q00wjz47h66by4jrpfbkmzj15pvz2viqbl0p64kgmjnbak51";
-  IosevkaSS04 = "1djzfhpi92226a606zx9rkf8brvazilafv0bhwsx3zm7msnh1239";
-  IosevkaSS05 = "0k7yzz0xmpwgn9zyiwxz882lwi2xgm9kxp0d5hy684hbzapkydw2";
-  IosevkaSS06 = "1rph461k70yi745l99sfb5i29r0yf0i43v96jj5fgg82rswkjyb8";
-  IosevkaSS07 = "1idkdvfw6267vim2yspdcn8n92i4l7c4dvzgaqm7i3c4jis21cnr";
-  IosevkaSS08 = "02aiksqzccbzmcz81kp1rwxy9wjcanildagjnqksif7md55lsw99";
-  IosevkaSS09 = "1a5vgn5nlb8p5ypz3p9lqs10jfmjgam8iw4i5gm87xl0602nxf4w";
-  IosevkaSS10 = "051hkwkwgjdrb2011rzbq9hy0r26kxakryvhj5wr6cmh4gp59yz8";
-  IosevkaSS11 = "1gqidclxpcqyz3rc3skg3q3h53nhpkpll8ijb4b45sp3bldff110";
-  IosevkaSS12 = "18ijr79d3x4q52h4z4pba1p9l7hn20857v8nqn6nn59j6vrd1b2k";
-  IosevkaSS13 = "1rphwzi8zy39hjka6n5jcmqx9c05wgj0hkndgiyb8mdhi2nxl0wd";
-  IosevkaSS14 = "0ffyp9q5kwvf3d7qzqhaa3dpj0s3d0al76zsa8v92wahc1z20zm7";
-  IosevkaSS15 = "03dnpmjjvgnnagmqghnlxwd33xlg3frz44q0w0ri98pbls1zgysi";
-  IosevkaSS16 = "0vin643dgis6p81a3x4hfp2y9r0f5kmklpl88ql2pprcxlgr71qx";
-  IosevkaSS17 = "129g4d2xjcv0g8079dwsgc16z8dm8hsvk1l86sci32q34iwp53na";
-  IosevkaSS18 = "09m0qsgxqsja76g4ywjlxc4qc7wb0qkmm7mlx4fracy4jdq4niwk";
-  SGr-Iosevka = "0r3yg2gpg52kp6m63x16j6n54sv32q2vf38cm1p5lbpjd9zbfbi8";
-  SGr-IosevkaCurly = "1bba9f2hrxllxm13mc3lsgdf1f6nk5b84jgp6vrp0kgl6m1pkbls";
-  SGr-IosevkaCurlySlab = "18ypl4wrsd13zlb497nldf5lyd9c5ckc06dkq153884k518p51sy";
-  SGr-IosevkaFixed = "0cwv68dpql583ydxnlqkzj7c5hv1lhgkag7rl66yx3zsnxk4mrwb";
-  SGr-IosevkaFixedCurly = "01409k12sbw0hpkfbgj1168yp4pxkzazj3cxqc3kjas24hyk7kp9";
-  SGr-IosevkaFixedCurlySlab = "01y62dl3kcczl6wcsj5ccagf8pbqzmmwzf2kvdi3cr27krla944b";
-  SGr-IosevkaFixedSlab = "1bmw2n7wd8zz97754f9i9ks1nyfbnyl3z6hn4h9b8i7wbgf10123";
-  SGr-IosevkaFixedSS01 = "1scz7ag493v62q5azv2wv5habjmhdxcx56nh45ha65m1p0syjywg";
-  SGr-IosevkaFixedSS02 = "0hzgz8x4x06f3nw7z60zrvg2f28nzpxib1m76dvdq7cf1yjspwrw";
-  SGr-IosevkaFixedSS03 = "0mj7232ppva8hd7212rdz3l6inmgcy1ccicwf74j49zcj6d2i2l1";
-  SGr-IosevkaFixedSS04 = "14mjbkaf5q426225mfia2fpwywh3vq6dsw296acgg5ja80xsfm4r";
-  SGr-IosevkaFixedSS05 = "03ij2jsn1c6imbm42mhirn33dy66jlq6p854ss4scxgki4aiv2lb";
-  SGr-IosevkaFixedSS06 = "1s8ygxi0xgdwk3pvcnvhcbhqrcpmgipvs1w1v7jcb6mg5158s4xl";
-  SGr-IosevkaFixedSS07 = "183k6v2spd20578p8kfga54s9gzpfywjm4frdab0rnyffjhs1inr";
-  SGr-IosevkaFixedSS08 = "17mxmvmvn8l6yhd8ww69w81sv76zih8jhs9msz3ajrsrhq5glb9y";
-  SGr-IosevkaFixedSS09 = "0f8yrdi6n989v9ppb76gswsri9rnzyhi5cxvqmhmwixgb812crlc";
-  SGr-IosevkaFixedSS10 = "0i35zvqbr4sbafi07bvhcj4h1a6g5r3rgba57bi6zwihmmw6ysq8";
-  SGr-IosevkaFixedSS11 = "0zyrg10q3223q26kfnprmfanzck74943gqavyfy4iqq1dlwzq9sz";
-  SGr-IosevkaFixedSS12 = "1n9rcmxz3hwp300qcddlqydmj40ajy15cgv22z82qg608a3l1h14";
-  SGr-IosevkaFixedSS13 = "0b1zcqyn5zblqsz28myjw3py6c9cllml2nisyapsbs4yxy96sck7";
-  SGr-IosevkaFixedSS14 = "";
-  SGr-IosevkaFixedSS15 = "0cc7hik5d9cbfhwmazflwd6h3ddhy88892f1hr2z9bwgri47h2pp";
-  SGr-IosevkaFixedSS16 = "0cdi4jw5lig1i2v54dk35p9wjkl2bld6ldxxrg32smwik9zx9dpc";
-  SGr-IosevkaFixedSS17 = "1g7xqw50i589l5hqgb97gd1phyn9x1sij404k91g331bwmj4icl5";
-  SGr-IosevkaFixedSS18 = "19g3qprnfkr77p8zi14xdzyya5pssmv1rx8vsjahrkbyg2hxwcm7";
-  SGr-IosevkaSlab = "10pjqvqm1kssani9j1p4rryz3kz71jxrzh4xpr687j8sqjr0qkgh";
-  SGr-IosevkaSS01 = "10ls2xwg08m6nkmq9c7zfi9j5b957hwaxkb8yh136w0smd5lql07";
-  SGr-IosevkaSS02 = "121bbkybz8wxmpm0mrfc1fpa2n9l8624lcy867gf25kw4j0z360y";
-  SGr-IosevkaSS03 = "1p75ixf4myfs6wmc3z1jilkip34gjhmkkqs98js4adbzb14ys3fi";
-  SGr-IosevkaSS04 = "1mizbsfh7chzpdjpfbq47bvnz60n954jp7s8ni8mkafl2zm3jdja";
-  SGr-IosevkaSS05 = "0plaby57yqgz97hzypfmzlcp8aijycwnh7276ynzmy4irdiqariq";
-  SGr-IosevkaSS06 = "1gj6syx1zmhxiq2s33zza0wql9in0qcvbckb92yd51xsg8w5fwiq";
-  SGr-IosevkaSS07 = "0pdkwcr8lxq3gm03sv5cbicnb70jxbdymrmwk31lcrq0qf2mg0wl";
-  SGr-IosevkaSS08 = "1bfgv6l056pz421shil0z9vv4slzbqnl4q1dv422isffbxgbn28a";
-  SGr-IosevkaSS09 = "00rslbcc354phz8w5i2q2l9ds0vlpzym1n30rysc9w83yn4qnlnd";
-  SGr-IosevkaSS10 = "004mnamygjfcr09ylhzglxzclfi39yz81kqj87zynklnavb7yvzr";
-  SGr-IosevkaSS11 = "07m80h8kggxzpg2w0f5zx7r3nqjhwmx23l4rldbxgb4qgy08svlb";
-  SGr-IosevkaSS12 = "0pivpcmgxl4pgm4kfaid91jidpxvzdn0ma9dmi68nf0wyjxp9l2r";
-  SGr-IosevkaSS13 = "0nki8q2zykwc9cdrnqr941agfqz5l54nswy6388fmqyxp5d9j1jy";
-  SGr-IosevkaSS14 = "0p57i63v3iii56jj79pzm8jzbapjraiww3lda52wdsa4g3m3pyzl";
-  SGr-IosevkaSS15 = "1izkbr45bccwpx00crk2ib8ixa04j441iv25liib38zn7xgyf2cf";
-  SGr-IosevkaSS16 = "19xc6n5pn3xnng32rck0h5kfwy38yjzygbad4pm3ygqm6rh2rcs4";
-  SGr-IosevkaSS17 = "14n7ikpfry5bavwr9awhli94q46iby5997gdndwjgr0aq8hwk72d";
-  SGr-IosevkaSS18 = "1mif5zsmfs4cdb8y79awnzgk1m053j2fqnspmk4llfgv2knv6y75";
-  SGr-IosevkaTerm = "0q69644wdp5szk7ijzin8877jmfa7c0xw9dd7rznn41140hxy2ld";
-  SGr-IosevkaTermCurly = "0xaw2xmmcnmrxac37x4wwkywzbb1hniv9ngcil89937ih00f3v2l";
-  SGr-IosevkaTermCurlySlab = "1426k5q1kbci4y95yv2cf2b8ajp3q73kpiqg0xn43dp2ji1s7p3j";
-  SGr-IosevkaTermSlab = "0frv0sh6lsysn2xccpq59rlhdclpzqi44v0xw8vrpw1chw18pnqj";
-  SGr-IosevkaTermSS01 = "1dlwfzfjg7ayri9njdyhh8mmgr7lzj698qphgd1kgih9cvpsapxk";
-  SGr-IosevkaTermSS02 = "1j3zyj35dk15v68n7zs78vzgmsdqsvdwmw40zwznzkqy0jsll2ap";
-  SGr-IosevkaTermSS03 = "0bv33c5y1ja50v7l2702k0vlhjrig78i81wqf73cyy7gsis0q0gc";
-  SGr-IosevkaTermSS04 = "186fbcia31jyz2sgz3qpdmyh0g9qag64hcq2dcym2879qmgwzgm1";
-  SGr-IosevkaTermSS05 = "1mbyn3bdj1d23jj0zc89kq8aspa3g8zf3j3fnicw9ffc47a79kzm";
-  SGr-IosevkaTermSS06 = "0ypp71ydfzik6rfg037d928mvn6w7av13k7hkbzggi0q3l51dpl9";
-  SGr-IosevkaTermSS07 = "0a1ma9dxcq642r5090l25vlsc7ga7gylv4yfzcmr5frhi56a39gl";
-  SGr-IosevkaTermSS08 = "14bpsyzadhs8b7jf7fkcrj17pp42iakbvz4fd8ldy6slgzsv1xbb";
-  SGr-IosevkaTermSS09 = "07hwh8547hqsg4w4gdimc5cl3qqlc937xxc50py9r34rflilckzv";
-  SGr-IosevkaTermSS10 = "1iphz3isv37djyc3xl85b5zjp3760bf216fmg5v0lswxsfaisg8c";
-  SGr-IosevkaTermSS11 = "1f6axizf4d6jilcb1riznfrznrlsyf4ddaisr7clx91vd22mrcdl";
-  SGr-IosevkaTermSS12 = "05rx7mrq3nmqb1257gyw6sjq6y6gf2j5bkkabsj2b3iq1hwzkcdd";
-  SGr-IosevkaTermSS13 = "1x0q3cmdzxa6kvdrnqq5znrcici70cwxha9va99d1vadvz2qjbc3";
-  SGr-IosevkaTermSS14 = "07xqpca7ahkawcb4m0wf45ikwvm7nfgc5v10cfpn41jgnfighqf9";
-  SGr-IosevkaTermSS15 = "0ql2sfkayj3vpk86fvw76gnfcpfdaskxymlhb2ij1jz6ckgqgfny";
-  SGr-IosevkaTermSS16 = "1nr6ms7ybgb74k8zb38rb2rl9q20c8shkx2xfdmgx5qg86dwc9pd";
-  SGr-IosevkaTermSS17 = "0c75xp0w59wypiq8zhzpzwa6n8spmvzm1z067fwy8wmq8sp0i500";
-  SGr-IosevkaTermSS18 = "1rq4ra8al9x7dqv6l12y36pm4vrqkqx2c5rgzc3c6awnwk71rqbz";
+  Iosevka = "1ahw97h75xpqcy2czanlh5h1c76bc4sfdvsld8d7q7fjp4kb8b5s";
+  IosevkaAile = "1xjl664qmckjm625g2znwspj99277l0gknqqsv1sn3jdj2nqn6va";
+  IosevkaCurly = "1hj0rr581d76li02852dcqyj17s598nd1vjnnscyswcg6fxpd2bv";
+  IosevkaCurlySlab = "0fh0i9cpp3h7sz7fvpqvh7phybi8pr8r1sp1a8i2d037ryj6766d";
+  IosevkaEtoile = "1z46km7wzjkkz0hjj95iljl27lmf73w3j6yx30zj3337rlrrpi8z";
+  IosevkaSlab = "1n7m5qvgng1i25sfad0sbrbrl3nwhsrn2gvb2v70va4anlxhwpz8";
+  IosevkaSS01 = "0s44v5d9ffghqvi7nz3kndfkrz4bvp75dc99wnx696j7q4h8id75";
+  IosevkaSS02 = "12j4xg4k8mlr3xwl3sjsw2nccq7mwm10ip1lqid12bylxjbaajvl";
+  IosevkaSS03 = "0hqg7sycvab99c93cn4fjmvqmkgjdjqicgd1gnm27swish02hk55";
+  IosevkaSS04 = "0vbzr72g9xi8m8rqz1nd7j2srzs95j39lb6ii1wqg6ffy944k2nk";
+  IosevkaSS05 = "00zxc6dswardw6bbvyrzh98ikvpnnygi614sqi9vch3wj4rdsfc4";
+  IosevkaSS06 = "15dzb5zzm85jwjq7d1yfw4ifhf6g9yrlxpwychnrjdmsjh3vhjpf";
+  IosevkaSS07 = "03nn0d76cvny9g8xgkidjad0jsarnxcw1zmac3gm5swrjja2z9bv";
+  IosevkaSS08 = "1lzia4pb1crsj6h3gxjh6dlnlfkc6a4ff5h7309mg7yjklqi58f4";
+  IosevkaSS09 = "1xlrxryaypid6cg5n21i4grz8dh3lsban2bi4rgldhjc52kc5jfy";
+  IosevkaSS10 = "0qvq509fic4sqfmfxixs3slaqcbd101j55lmxhxd84nm36bpm5hz";
+  IosevkaSS11 = "1ncxz7a0769dgi9k8g4jp1lfpx5r9wyl5sjirbv1vwc9n0m4j0ij";
+  IosevkaSS12 = "1z9cqgxf15w30bnyj3j22a5jm2p9zzym7hz5picxlscyskswn0g6";
+  IosevkaSS13 = "0yyw4xp4c8y7m2z8dswd8pk0hajkaz47qqw1fik1a99sc25d1i0v";
+  IosevkaSS14 = "0l5ya9xlmnkyfbsmb1w8v446diys3x8w4xfqhbq1nggcnj0nj5vw";
+  IosevkaSS15 = "1lgszq2kapsylihqkb3yw0zspxyy1xc80z3b5d2d41lg0a53b7b0";
+  IosevkaSS16 = "0rwvmjkhq55m0fh2bm0nv2xv4xh42hmjfzvkgc2srpadqvrk9sxa";
+  IosevkaSS17 = "01j6867z7lks9f0l4ijahvykchz9w57mr1mq7zzf6xi1lzx92mh6";
+  IosevkaSS18 = "11g8zfj8d6h6fkzppslgpfwblzdnzlpjmv5a6zs0jd9010vkrhn5";
+  SGr-Iosevka = "0bcn6c17s5xj80sjafq8a1dfa1s5rrx6kj697ca7y0qlyb2mr0j1";
+  SGr-IosevkaCurly = "119ljf5wwmv7anp3sam0vri44hzimk1xlx7bnqs1l32vxcj5mgcy";
+  SGr-IosevkaCurlySlab = "12dnwiljccl8xgriqqcxh7kya928cqf2x9l0a50psqawq3vpa573";
+  SGr-IosevkaFixed = "0w2575wq4mqii6kprl171y4mqim52n241iyf5lkvywhswv6x9bbi";
+  SGr-IosevkaFixedCurly = "1rbzfwkmgz8m1w24iwsjmghg9w8dx749hjmmb70kcbix6rp19z9q";
+  SGr-IosevkaFixedCurlySlab = "0yphmb99rx9wg4gw31nlcskprjdshah4jr6kb585m6r79rk5d0wq";
+  SGr-IosevkaFixedSlab = "1wvd04r01ivdrx3g42yzq6qnc6r7zxw48k5g902xj9z2zca941gf";
+  SGr-IosevkaFixedSS01 = "1h6rna54wbf1sc2m2vqlb10br3nppc1caaw3x2lyz5g9bb887jln";
+  SGr-IosevkaFixedSS02 = "1kjclcr2zcbxafjs0amp5hyfwgklb6xdgs5n9xq0np7lxrmg2kfv";
+  SGr-IosevkaFixedSS03 = "1cf0acb07pg7m9k4lin4m9pdi8fsa27vvsy39aklgixfwlv1bzwf";
+  SGr-IosevkaFixedSS04 = "1bv7v3lby0fjzpnqfn4csnsbzcsjdssmgz2cgb6xjx6daxc7sqv9";
+  SGr-IosevkaFixedSS05 = "01wqjf76ahvy2l6g5ipbrm7qzxbwqrl6n2q39ij3c04knkcmj8w6";
+  SGr-IosevkaFixedSS06 = "058w8vhyxicxwamf4sr7g2f63rm1sazdq4fph879ajpp10j79d5r";
+  SGr-IosevkaFixedSS07 = "025n56j65idr7xknj6snnf76xii0pkr2w0zsg1cidzm2gc9j7vw7";
+  SGr-IosevkaFixedSS08 = "0ap9wnk05b96zbwn1hsxii2s9ij4kj308dbj7gc37mgq0yd4n47p";
+  SGr-IosevkaFixedSS09 = "1k5l4rvglcfj5b20c67vh0m1w2gqqg92m7i1vilj0clq1pg6wb2b";
+  SGr-IosevkaFixedSS10 = "1gi63xmd1nf8g53bcfgg0ljnsmn5xkqqn6gb5lgi4yhfjawrd2ll";
+  SGr-IosevkaFixedSS11 = "0m7wp67j7jvqbw5zayfk7sh2zvnh86dd4szb9pq3lnbsv69q2cmc";
+  SGr-IosevkaFixedSS12 = "071v1hmxa8qiv8d9wqwkvjfllqhgzpyj4r7gdvvalfc45b4xapdv";
+  SGr-IosevkaFixedSS13 = "1wxyz8s97x4pcy0zilmfp6syxfm4nbqd0j392lib3pkj9x71qk2c";
+  SGr-IosevkaFixedSS14 = "0m5l9a2n9iayb7k2giz5x7pfy344ys3kbqccsjr30h3aybmd1d31";
+  SGr-IosevkaFixedSS15 = "113z4d0hgfw82q8cchf496xjv2jpqhvxv0004nx6bmi3l63lzdln";
+  SGr-IosevkaFixedSS16 = "12pyndd2hr9n6xs5f3zmlpkrw9bjdk7pjxrz00qwq36f5rh2x9yv";
+  SGr-IosevkaFixedSS17 = "0q65z5dvmq6l5vjy5al0zq5ls1wna06dq03brkq8pvagl03y2yws";
+  SGr-IosevkaFixedSS18 = "05swkkjkdgcfdggq4m7dp5nxrzr3jmm4b6jjicfb39y4m8i0k2wd";
+  SGr-IosevkaSlab = "0hnfhmyh9nb57kl5higiibjxmsc2qpjcyxfirs4nl0pw4gd2z9ah";
+  SGr-IosevkaSS01 = "1c16fpq447nmkfrnn5y9b5bz2zm6w63ip742f1rd9hs9y67mqc5w";
+  SGr-IosevkaSS02 = "0yp8fmqnh25wpsf8ihmd77xq5jrxc8xk92jiglgpw05agl4c2hyd";
+  SGr-IosevkaSS03 = "0sq07vz18ky2c1k4a0w8xsn5h31m1gdwihjkc5r5wqc0cxjzsrr6";
+  SGr-IosevkaSS04 = "0l9qgx060iw2q1rpx83v2qp677d3gl4k8w41y6s69cbql10srqn9";
+  SGr-IosevkaSS05 = "1r1bln5gl7dnqzgdxfzsvm967ph3r52wmlhnnswlr2l3rpkv5f4f";
+  SGr-IosevkaSS06 = "0sfdrknipxrj3m5yqafw81w97p3lg8faz09pd9f7b38v5x5wcxrv";
+  SGr-IosevkaSS07 = "0g1lp71wfdsg9i9dj6jmn6x7m9mkfzjbb0x5fsc7py443lj8fym7";
+  SGr-IosevkaSS08 = "10j5z800sg75w9a7njzkzc94jkbii4hgdwj89wmkkxp32skfvdhq";
+  SGr-IosevkaSS09 = "1fcn2d1kxn8wfv75cgmr9apri27a09z3a30z4nxx445n9x670z6v";
+  SGr-IosevkaSS10 = "0q92piavh41lmc641x0axq1828msmfl7g8j1svfdlxa46a9j7bh5";
+  SGr-IosevkaSS11 = "01k5qnasidkbd7rmjqyw6cdjyv98dyjg8gvzqrjf34018ygn47ah";
+  SGr-IosevkaSS12 = "1w0mz0m7g18n2xsldc1dq1hvvv60hnvcs9h2k11fq7arri3xn7d4";
+  SGr-IosevkaSS13 = "0hwnhl35s1pdn57m2aqza2x0jakhh4gc3gkvzn1df1hjd8da7gf1";
+  SGr-IosevkaSS14 = "02zvfx2x9arrpxxkkjvr46b90lcssa7jmjg1nh2x025f02isi5gw";
+  SGr-IosevkaSS15 = "0kf92n30622mv2blw9ckjy9fjmmpdqlx5cbs8rkdklwsn1zh1y9p";
+  SGr-IosevkaSS16 = "0798w39v0kh1db1adn4saqdd9hjk673s2kgf4jyn5hcmnxdmkpna";
+  SGr-IosevkaSS17 = "0227mrmh7hd3vwjnk9615p997l1zqqmqphxdmshgxjcch4vk3mxp";
+  SGr-IosevkaSS18 = "1y9dg8w1963ipzdri5vlpiax2x8iacw1wl1iy1zjkq5pwzm1fbgd";
+  SGr-IosevkaTerm = "0shp2vacrcvzc9gg2hdsgb2v9yivbvxnl2a61dvj63k7fqfbmkc0";
+  SGr-IosevkaTermCurly = "0284kkwhidhc6qlpgqiaxqw1dr5nb6bbv8f2hg395q6yhmmsrjvl";
+  SGr-IosevkaTermCurlySlab = "1z80knqj3rk90z721c1ybl1qnhlj7draifs6rfbl9126pc4sx9bw";
+  SGr-IosevkaTermSlab = "1zfqpl3sn0925rska1jfj5a6c0s9rbd0d3z080z40py5fdwz821a";
+  SGr-IosevkaTermSS01 = "1wy98qdc69q125hv4n3fi2z2rhdl4xjrs5mzabkzi5n061zzill0";
+  SGr-IosevkaTermSS02 = "0pc3c1983s7vkga73p6dz3851881c0g8ak1sjlmy8yq7ybx0b8f5";
+  SGr-IosevkaTermSS03 = "1lf3mi6z3cif44k8zp248smz1bkmb0zcna1sq0pa6grkis33fjig";
+  SGr-IosevkaTermSS04 = "14h36plbvbkahxhvavxahma8n79gkabgzi7v4bkqz9q7dbzl3qv5";
+  SGr-IosevkaTermSS05 = "1gf04yrbw1fkcm16ja0j81232avrw2hl4x5np7p6x23fskmidqlm";
+  SGr-IosevkaTermSS06 = "1d0mlmfy8x8jw51rr3fp1mahz4q7h9ydy3hwqbacrz2xxg1hm2za";
+  SGr-IosevkaTermSS07 = "0znj6c834iz5cdq9r84jni6rhzrkpg0xd7lsixrydimlrcavrqwh";
+  SGr-IosevkaTermSS08 = "1rkhx6irnd6g6l9xlgqd7sm6q9wknd5kfaxkip4ds9gynmih8r8p";
+  SGr-IosevkaTermSS09 = "0ab3k6y0jkjba84hnw2px9vw9m14q94l6c0j1lnc8yqdn55jabk7";
+  SGr-IosevkaTermSS10 = "069zzvik717wn4yn7f5x1yjd4rgbg2n8j5jwncrn2d0qlmc7kz6k";
+  SGr-IosevkaTermSS11 = "0vzg70icjai477djgx3j4ba4jgzlafmqzq2yx7glrhzfmsfkh8ik";
+  SGr-IosevkaTermSS12 = "19jhp14y8r8q3cwy6674dy6li1gz9pjx163wv13fnnshrbnsax7w";
+  SGr-IosevkaTermSS13 = "03xswh479sqh36pfr2c4kzmj6m5346hgkwd0h9r3q69r40adimvr";
+  SGr-IosevkaTermSS14 = "05vj5fb3zxf4cgvhlf8ic0mig8qc4dzaz107nii894k83mzg6r6x";
+  SGr-IosevkaTermSS15 = "158w6ba9b3j522lfk7886dqc6q79n35csillh9wszrsg2maymlw2";
+  SGr-IosevkaTermSS16 = "0rqhg12m0l9y3wv13sjlbh9ca5skpz8m8785rb42gy9mxyh1phxf";
+  SGr-IosevkaTermSS17 = "097ad53v61zwp17hd4ijihz6i754w0cp4dyx2r8vj1zl5jk71z1z";
+  SGr-IosevkaTermSS18 = "1aa7l55nmj1h7dbcvnk271lkk5m6x161024syqgs102v7615s3sy";
 }
diff --git a/pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix b/pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix
index 0c9bd4266e6b..f0e8e5ce1bdc 100644
--- a/pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix
+++ b/pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kak-tree-sitter-unwrapped";
-  version = "1.1.3";
+  version = "2.0.0";
 
   src = fetchFromSourcehut {
     owner = "~hadronized";
     repo = "kak-tree-sitter";
     rev = "kak-tree-sitter-v${version}";
-    hash = "sha256-vQZ+zQgwIw5ZBdIuMDD37rIdhe+WpNBmq0TciXBNiSU=";
+    hash = "sha256-vFhNxixXsezK3Qm9d5hEiIttSjcuqHfgCHYrEOeKWvs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-dcq25kDS+dFC4eBX6EWANWpeJjwR4q1mQP/2PKPIOsc=";
+  cargoHash = "sha256-tO6i19UuistT4yUc0YzZOh+8M5kXq5l1NUTBUOA3YT8=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ko/kohighlights/package.nix b/pkgs/by-name/ko/kohighlights/package.nix
index d121c6d3119b..59e0094288bf 100644
--- a/pkgs/by-name/ko/kohighlights/package.nix
+++ b/pkgs/by-name/ko/kohighlights/package.nix
@@ -13,6 +13,7 @@
 python3Packages.buildPythonApplication rec {
   pname = "kohighlights";
   version = "2.3.1.0";
+  pyproject = false; # manual install
 
   src = fetchFromGitHub {
     owner = "noembryo";
@@ -23,7 +24,6 @@ python3Packages.buildPythonApplication rec {
 
   dontWrapPythonPrograms = true;
   dontBuild = true;
-  format = "other";
 
   buildInputs =
     [
@@ -57,6 +57,8 @@ python3Packages.buildPythonApplication rec {
     })
   ];
 
+  dontWrapQtApps = true;
+
   installPhase = ''
     runHook preInstall
 
@@ -65,7 +67,8 @@ python3Packages.buildPythonApplication rec {
     cp -r * $out/share/KoHighlights
     makeWrapper ${python3.interpreter} $out/bin/KoHighlights \
       --add-flags "$out/share/KoHighlights/main.py" \
-      --set PYTHONPATH "${python3Packages.makePythonPath dependencies}"
+      --set PYTHONPATH "${python3Packages.makePythonPath dependencies}" \
+      ''${qtWrapperArgs[@]}
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/la/lasuite-docs-collaboration-server/environment_variables.patch b/pkgs/by-name/la/lasuite-docs-collaboration-server/environment_variables.patch
new file mode 100644
index 000000000000..e84fcb2ccc34
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-docs-collaboration-server/environment_variables.patch
@@ -0,0 +1,43 @@
+From ab1de49ad9c23e73cddc4dd82a9fede4f56d28d0 Mon Sep 17 00:00:00 2001
+From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
+Date: Tue, 29 Apr 2025 17:09:51 +0200
+Subject: [PATCH 2/2] =?UTF-8?q?=E2=9C=A8(frontend)=20support=20`=5FFILE`?=
+ =?UTF-8?q?=20envuronment=20variables=20for=20secrets?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Allow configuration variables that handles secrets to be read from a
+file given in an environment variable.
+---
+ src/frontend/servers/y-provider/src/env.ts | 13 +++++++++----
+ 1 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/servers/y-provider/src/env.ts b/servers/y-provider/src/env.ts
+index fe281930..e0e02cf5 100644
+--- a/servers/y-provider/src/env.ts
++++ b/servers/y-provider/src/env.ts
+@@ -1,11 +1,16 @@
++import { readFileSync } from 'fs';
++
+ export const COLLABORATION_LOGGING =
+   process.env.COLLABORATION_LOGGING || 'false';
+ export const COLLABORATION_SERVER_ORIGIN =
+   process.env.COLLABORATION_SERVER_ORIGIN || 'http://localhost:3000';
+-export const COLLABORATION_SERVER_SECRET =
+-  process.env.COLLABORATION_SERVER_SECRET || 'secret-api-key';
+-export const Y_PROVIDER_API_KEY =
+-  process.env.Y_PROVIDER_API_KEY || 'yprovider-api-key';
++export const COLLABORATION_SERVER_SECRET = process.env
++  .COLLABORATION_SERVER_SECRET_FILE
++  ? readFileSync(process.env.COLLABORATION_SERVER_SECRET_FILE, 'utf-8')
++  : process.env.COLLABORATION_SERVER_SECRET || 'secret-api-key';
++export const Y_PROVIDER_API_KEY = process.env.Y_PROVIDER_API_KEY_FILE
++  ? readFileSync(process.env.Y_PROVIDER_API_KEY_FILE, 'utf-8')
++  : process.env.Y_PROVIDER_API_KEY || 'yprovider-api-key';
+ export const PORT = Number(process.env.PORT || 4444);
+ export const SENTRY_DSN = process.env.SENTRY_DSN || '';
+ export const COLLABORATION_BACKEND_BASE_URL =
+-- 
+2.47.2
+
diff --git a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
new file mode 100644
index 000000000000..1173bc7e8247
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  fetchYarnDeps,
+  nodejs,
+  fixup-yarn-lock,
+  yarn,
+  makeWrapper,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lasuite-docs-collaboration-server";
+  version = "3.3.0";
+
+  src = fetchFromGitHub {
+    owner = "suitenumerique";
+    repo = "docs";
+    tag = "v${version}";
+    hash = "sha256-SLTNkK578YhsDtVBS4vH0E/rXx+rXZIyXMhqwr95QEA=";
+  };
+
+  sourceRoot = "source/src/frontend";
+
+  patches = [
+    # Support for $ENVIRONMENT_VARIABLE_FILE to be able to pass secret file
+    # See: https://github.com/suitenumerique/docs/pull/912
+    ./environment_variables.patch
+  ];
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/src/frontend/yarn.lock";
+    hash = "sha256-ei4xj+W2j5O675cpMAG4yCB3cPLeYwMhqKTacPWFjoo=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    fixup-yarn-lock
+    yarn
+    makeWrapper
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror "$offlineCache"
+    fixup-yarn-lock yarn.lock
+
+    # Fixup what fixup-yarn-lock does not fix. Result in error if not fixed.
+    substituteInPlace yarn.lock \
+      --replace-fail '"@fastify/otel@https://codeload.github.com/getsentry/fastify-otel/tar.gz/ae3088d65e286bdc94ac5d722573537d6a6671bb"' '"@fastify/otel@^0.8.0"'
+
+    yarn install \
+        --frozen-lockfile \
+        --force \
+        --production=false \
+        --ignore-engines \
+        --ignore-platform \
+        --ignore-scripts \
+        --no-progress \
+        --non-interactive \
+        --offline
+
+    patchShebangs node_modules
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn --offline COLLABORATION_SERVER run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{lib,bin}
+    cp -r {apps,node_modules,packages,servers} $out/lib
+
+    makeWrapper ${lib.getExe nodejs} "$out/bin/docs-collaboration-server" \
+      --add-flags "$out/lib/servers/y-provider/dist/start-server.js" \
+      --set NODE_PATH "$out/lib/node_modules"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A collaborative note taking, wiki and documentation platform that scales. Built with Django and React. Opensource alternative to Notion or Outline";
+    homepage = "https://github.com/suitenumerique/docs";
+    changelog = "https://github.com/suitenumerique/docs/blob/${src.tag}/CHANGELOG.md";
+    mainProgram = "docs-collaboration-server";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ soyouzpanda ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/la/lasuite-docs-frontend/package.nix b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
new file mode 100644
index 000000000000..af557cd9e2f7
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  fetchYarnDeps,
+  nodejs,
+  fixup-yarn-lock,
+  yarn,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lasuite-docs-frontend";
+  version = "3.3.0";
+
+  src = fetchFromGitHub {
+    owner = "suitenumerique";
+    repo = "docs";
+    tag = "v${version}";
+    hash = "sha256-SLTNkK578YhsDtVBS4vH0E/rXx+rXZIyXMhqwr95QEA=";
+  };
+
+  sourceRoot = "source/src/frontend";
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/src/frontend/yarn.lock";
+    hash = "sha256-ei4xj+W2j5O675cpMAG4yCB3cPLeYwMhqKTacPWFjoo=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    fixup-yarn-lock
+    yarn
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror "$offlineCache"
+    fixup-yarn-lock yarn.lock
+
+    # Fixup what fixup-yarn-lock does not fix. Result in error if not fixed.
+    substituteInPlace yarn.lock \
+      --replace-fail '"@fastify/otel@https://codeload.github.com/getsentry/fastify-otel/tar.gz/ae3088d65e286bdc94ac5d722573537d6a6671bb"' '"@fastify/otel@^0.8.0"'
+
+    yarn install \
+        --frozen-lockfile \
+        --force \
+        --production=false \
+        --ignore-engines \
+        --ignore-platform \
+        --ignore-scripts \
+        --no-progress \
+        --non-interactive \
+        --offline
+
+    patchShebangs node_modules
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn --offline app:build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r apps/impress/out/ $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A collaborative note taking, wiki and documentation platform that scales. Built with Django and React. Opensource alternative to Notion or Outline";
+    homepage = "https://github.com/suitenumerique/docs";
+    changelog = "https://github.com/suitenumerique/docs/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ soyouzpanda ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/la/lasuite-docs/environment_variables.patch b/pkgs/by-name/la/lasuite-docs/environment_variables.patch
new file mode 100644
index 000000000000..618a809a5a7b
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-docs/environment_variables.patch
@@ -0,0 +1,109 @@
+From dd7d54e64bbdb853ff60162908f142cb34034cdd Mon Sep 17 00:00:00 2001
+From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
+Date: Mon, 28 Apr 2025 18:18:39 +0200
+Subject: [PATCH 1/2] =?UTF-8?q?=E2=9C=A8(backend)=20support=20`=5FFILE`=20?=
+ =?UTF-8?q?environment=20variables=20for=20secrets?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Allow configuration variables that handles secrets, like
+`DJANGO_SECRET_KEY` to be able to read from a file which is given
+through an environment file.
+
+For example, if `DJANGO_SECRET_KEY_FILE` is set to
+`/var/lib/docs/django-secret-key`, the value of `DJANGO_SECRET_KEY` will
+be the content of `/var/lib/docs/django-secret-key`.
+---
+ src/backend/impress/settings.py | 19 ++++++++++---------
+ 1 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/impress/settings.py b/impress/settings.py
+index 571d7052..23c75a98 100755
+--- a/impress/settings.py
++++ b/impress/settings.py
+@@ -18,6 +18,7 @@ from django.utils.translation import gettext_lazy as _
+ 
+ import sentry_sdk
+ from configurations import Configuration, values
++from lasuite.configuration.values import SecretFileValue
+ from sentry_sdk.integrations.django import DjangoIntegration
+ from sentry_sdk.integrations.logging import ignore_logger
+ 
+@@ -65,7 +66,7 @@ class Base(Configuration):
+ 
+     # Security
+     ALLOWED_HOSTS = values.ListValue([])
+-    SECRET_KEY = values.Value(None)
++    SECRET_KEY = SecretFileValue(None)
+     SERVER_TO_SERVER_API_TOKENS = values.ListValue([])
+ 
+     # Application definition
+@@ -84,7 +85,7 @@ class Base(Configuration):
+                 "impress", environ_name="DB_NAME", environ_prefix=None
+             ),
+             "USER": values.Value("dinum", environ_name="DB_USER", environ_prefix=None),
+-            "PASSWORD": values.Value(
++            "PASSWORD": SecretFileValue(
+                 "pass", environ_name="DB_PASSWORD", environ_prefix=None
+             ),
+             "HOST": values.Value(
+@@ -122,10 +123,10 @@ class Base(Configuration):
+     AWS_S3_ENDPOINT_URL = values.Value(
+         environ_name="AWS_S3_ENDPOINT_URL", environ_prefix=None
+     )
+-    AWS_S3_ACCESS_KEY_ID = values.Value(
++    AWS_S3_ACCESS_KEY_ID = SecretFileValue(
+         environ_name="AWS_S3_ACCESS_KEY_ID", environ_prefix=None
+     )
+-    AWS_S3_SECRET_ACCESS_KEY = values.Value(
++    AWS_S3_SECRET_ACCESS_KEY = SecretFileValue(
+         environ_name="AWS_S3_SECRET_ACCESS_KEY", environ_prefix=None
+     )
+     AWS_S3_REGION_NAME = values.Value(
+@@ -384,7 +385,7 @@ class Base(Configuration):
+     EMAIL_BRAND_NAME = values.Value(None)
+     EMAIL_HOST = values.Value(None)
+     EMAIL_HOST_USER = values.Value(None)
+-    EMAIL_HOST_PASSWORD = values.Value(None)
++    EMAIL_HOST_PASSWORD = SecretFileValue(None)
+     EMAIL_LOGO_IMG = values.Value(None)
+     EMAIL_PORT = values.PositiveIntegerValue(None)
+     EMAIL_USE_TLS = values.BooleanValue(False)
+@@ -407,7 +408,7 @@ class Base(Configuration):
+     COLLABORATION_API_URL = values.Value(
+         None, environ_name="COLLABORATION_API_URL", environ_prefix=None
+     )
+-    COLLABORATION_SERVER_SECRET = values.Value(
++    COLLABORATION_SERVER_SECRET = SecretFileValue(
+         None, environ_name="COLLABORATION_SERVER_SECRET", environ_prefix=None
+     )
+     COLLABORATION_WS_URL = values.Value(
+@@ -477,7 +478,7 @@ class Base(Configuration):
+     OIDC_RP_CLIENT_ID = values.Value(
+         "impress", environ_name="OIDC_RP_CLIENT_ID", environ_prefix=None
+     )
+-    OIDC_RP_CLIENT_SECRET = values.Value(
++    OIDC_RP_CLIENT_SECRET = SecretFileValue(
+         None,
+         environ_name="OIDC_RP_CLIENT_SECRET",
+         environ_prefix=None,
+@@ -592,7 +593,7 @@ class Base(Configuration):
+     AI_FEATURE_ENABLED = values.BooleanValue(
+         default=False, environ_name="AI_FEATURE_ENABLED", environ_prefix=None
+     )
+-    AI_API_KEY = values.Value(None, environ_name="AI_API_KEY", environ_prefix=None)
++    AI_API_KEY = SecretFileValue(None, environ_name="AI_API_KEY", environ_prefix=None)
+     AI_BASE_URL = values.Value(None, environ_name="AI_BASE_URL", environ_prefix=None)
+     AI_MODEL = values.Value(None, environ_name="AI_MODEL", environ_prefix=None)
+     AI_ALLOW_REACH_FROM = values.Value(
+@@ -613,7 +614,7 @@ class Base(Configuration):
+     }
+ 
+     # Y provider microservice
+-    Y_PROVIDER_API_KEY = values.Value(
++    Y_PROVIDER_API_KEY = SecretFileValue(
+         environ_name="Y_PROVIDER_API_KEY",
+         environ_prefix=None,
+     )
+
diff --git a/pkgs/by-name/la/lasuite-docs/package.nix b/pkgs/by-name/la/lasuite-docs/package.nix
new file mode 100644
index 000000000000..9ccb81cfe890
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-docs/package.nix
@@ -0,0 +1,119 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  nixosTests,
+}:
+let
+  python = python3.override {
+    self = python3;
+    packageOverrides = self: super: {
+      django = super.django_5_2;
+    };
+  };
+in
+
+python.pkgs.buildPythonApplication rec {
+  pname = "lasuite-docs";
+  version = "3.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "suitenumerique";
+    repo = "docs";
+    tag = "v${version}";
+    hash = "sha256-SLTNkK578YhsDtVBS4vH0E/rXx+rXZIyXMhqwr95QEA=";
+  };
+
+  sourceRoot = "source/src/backend";
+
+  patches = [
+    # Support for $ENVIRONMENT_VARIABLE_FILE to be able to pass secret files
+    # See: https://github.com/suitenumerique/docs/pull/912
+    ./environment_variables.patch
+    # Support configuration throught environment variables for SECURE_*
+    ./secure_settings.patch
+  ];
+
+  build-system = with python.pkgs; [ setuptools ];
+
+  dependencies = with python.pkgs; [
+    beautifulsoup4
+    boto3
+    celery
+    django
+    django-configurations
+    django-cors-headers
+    django-countries
+    django-extensions
+    django-filter
+    django-lasuite
+    django-parler
+    django-redis
+    django-storages
+    django-timezone-field
+    django-treebeard
+    djangorestframework
+    drf-spectacular
+    drf-spectacular-sidecar
+    dockerflow
+    easy-thumbnails
+    factory-boy
+    gunicorn
+    jsonschema
+    lxml
+    markdown
+    mozilla-django-oidc
+    nested-multipart-parser
+    openai
+    psycopg
+    pycrdt
+    pyjwt
+    pyopenssl
+    python-magic
+    redis
+    requests
+    sentry-sdk
+    whitenoise
+  ];
+
+  pythonRelaxDeps = true;
+
+  postBuild = ''
+    export DATA_DIR=$(pwd)/data
+    ${python.pythonOnBuildForHost.interpreter} manage.py collectstatic --no-input --clear
+  '';
+
+  postInstall =
+    let
+      pythonPath = python.pkgs.makePythonPath dependencies;
+    in
+    ''
+      mkdir -p $out/{bin,share}
+
+      cp ./manage.py $out/bin/.manage.py
+      cp -r data/static $out/share
+      chmod +x $out/bin/.manage.py
+
+      makeWrapper $out/bin/.manage.py $out/bin/docs \
+        --prefix PYTHONPATH : "${pythonPath}"
+      makeWrapper ${lib.getExe python.pkgs.celery} $out/bin/celery \
+        --prefix PYTHONPATH : "${pythonPath}:$out/${python.sitePackages}"
+      makeWrapper ${lib.getExe python.pkgs.gunicorn} $out/bin/gunicorn \
+        --prefix PYTHONPATH : "${pythonPath}:$out/${python.sitePackages}"
+    '';
+
+  passthru.tests = {
+    login-and-create-doc = nixosTests.lasuite-docs;
+  };
+
+  meta = {
+    description = "A collaborative note taking, wiki and documentation platform that scales. Built with Django and React. Opensource alternative to Notion or Outline";
+    homepage = "https://github.com/suitenumerique/docs";
+    changelog = "https://github.com/suitenumerique/docs/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ soyouzpanda ];
+    mainProgram = "docs";
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/la/lasuite-docs/secure_settings.patch b/pkgs/by-name/la/lasuite-docs/secure_settings.patch
new file mode 100644
index 000000000000..f679c96b0fc5
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-docs/secure_settings.patch
@@ -0,0 +1,36 @@
+diff --git a/impress/settings.py b/impress/settings.py
+index 9d825095..518aca7f 100755
+--- a/impress/settings.py
++++ b/impress/settings.py
+@@ -822,19 +822,24 @@ class Production(Base):
+     #
+     # In other cases, you should comment the following line to avoid security issues.
+     # SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+-    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+-    SECURE_HSTS_SECONDS = 60
+-    SECURE_HSTS_PRELOAD = True
+-    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+-    SECURE_SSL_REDIRECT = True
++    SECURE_PROXY_SSL_HEADER = values.TupleValue(("HTTP_X_FORWARDED_PROTO", "https"),
++                                                environ_name="SECURE_PROXY_SSL_HEADER")
++    SECURE_HSTS_SECONDS = values.IntegerValue(
++        60, environ_name="SECURE_HSTS_SECONDS")
++    SECURE_HSTS_PRELOAD = values.BooleanValue(
++        True, environ_name="SECURE_HSTS_PRELOAD")
++    SECURE_HSTS_INCLUDE_SUBDOMAINS = values.BooleanValue(
++        True, environ_name="SECURE_HSTS_INCLUDE_SUBDOMAINS")
++    SECURE_SSL_REDIRECT = values.BooleanValue(
++        True, environ_name="SECURE_SSL_REDIRECT")
+     SECURE_REDIRECT_EXEMPT = [
+         "^__lbheartbeat__",
+         "^__heartbeat__",
+     ]
+ 
+     # Modern browsers require to have the `secure` attribute on cookies with `Samesite=none`
+-    CSRF_COOKIE_SECURE = True
+-    SESSION_COOKIE_SECURE = True
++    CSRF_COOKIE_SECURE = values.BooleanValue(True, environ_name="CSRF_COOKIE_SECURE")
++    SESSION_COOKIE_SECURE = values.BooleanValue(True, environ_name="SESSION_COOKIE_SECURE")
+ 
+     # Privacy
+     SECURE_REFERRER_POLICY = "same-origin"
diff --git a/pkgs/by-name/le/legcord/package.nix b/pkgs/by-name/le/legcord/package.nix
index 2b493f03ba00..70641f0a7add 100644
--- a/pkgs/by-name/le/legcord/package.nix
+++ b/pkgs/by-name/le/legcord/package.nix
@@ -13,16 +13,15 @@
   libpulseaudio,
   nix-update-script,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "legcord";
-  version = "1.1.3";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "Legcord";
     repo = "Legcord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e8RhTx16y0hxXoOSztIs5pvI7Vzc9vKUsp1RRbt4Q78=";
+    hash = "sha256-e2ylcK4hjQNUGFn6AefwG+yJOiWiDOKEGeMSwOXBY6I=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-gLjpnpLKJCOOFidSR9r64cBVkMg38/slMsJ7KolScWI=";
+    hash = "sha256-nobOORfhwlGEvNt+MfDKd3rXor6tJHDulz5oD1BGY4I=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/li/libcpuid/package.nix b/pkgs/by-name/li/libcpuid/package.nix
index f7240bdabf54..39af93507db1 100644
--- a/pkgs/by-name/li/libcpuid/package.nix
+++ b/pkgs/by-name/li/libcpuid/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcpuid";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "anrieff";
     repo = "libcpuid";
     rev = "v${version}";
-    hash = "sha256-/28yo1V4/xYMirt2bNTB/l9Xl8NgRmxTitOW21TY8gE=";
+    hash = "sha256-m/4PJGknuoiWR40aIHtkaHuMEROjsYQ9ZgmJtHdzeSU=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/by-name/li/libosmocore/package.nix b/pkgs/by-name/li/libosmocore/package.nix
index 368853d48455..4b21695d7546 100644
--- a/pkgs/by-name/li/libosmocore/package.nix
+++ b/pkgs/by-name/li/libosmocore/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libosmocore";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "osmocom";
     repo = "libosmocore";
     rev = version;
-    hash = "sha256-W5XLiIgevGtHRjrRTx/7rnPYacOAW9QJW0rocyWgFt4=";
+    hash = "sha256-JR1L2ffVqvhylrYWPnWKQ/iihx6in7B3iP6Mo0MHbpw=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libyang/package.nix b/pkgs/by-name/li/libyang/package.nix
index 93215e51fb84..90cad5b99f1f 100644
--- a/pkgs/by-name/li/libyang/package.nix
+++ b/pkgs/by-name/li/libyang/package.nix
@@ -7,8 +7,9 @@
   cmake,
   pkg-config,
 
-  # run time
+  # dependencies
   pcre2,
+  xxHash,
 
   # update script
   gitUpdater,
@@ -16,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libyang";
-  version = "3.7.8";
+  version = "3.12.2";
 
   src = fetchFromGitHub {
     owner = "CESNET";
     repo = "libyang";
     rev = "v${version}";
-    hash = "sha256-5oJV8gr2rwvSdpX5w3gmIw/LTrWtXVnl6oLr/soNTDk=";
+    hash = "sha256-iHIHXrGAGZ5vYA/pbFmHVVczRtH34lC5IIqyj0SF1r4=";
   };
 
   outputs = [
@@ -35,6 +36,10 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
+  buildInputs = [
+    xxHash
+  ];
+
   propagatedBuildInputs = [
     pcre2
   ];
diff --git a/pkgs/by-name/ln/lnd/package.nix b/pkgs/by-name/ln/lnd/package.nix
index ec161dd4219f..2bf48b1af1e9 100644
--- a/pkgs/by-name/ln/lnd/package.nix
+++ b/pkgs/by-name/ln/lnd/package.nix
@@ -23,16 +23,16 @@
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.18.5-beta";
+  version = "0.19.0-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    hash = "sha256-7Y1GcZoj7Uk0PGd0B0J4hXpb5voqmM2f/Ie4FRHI3iQ=";
+    hash = "sha256-eKRgkD/kUz0MkK624R3OahTHOrdP18nBuSZP1volHq8=";
   };
 
-  vendorHash = "sha256-IY7lcEYeFlknyFWEy+lEsbOYfvhN5ApJUnJX0gmIV/w=";
+  vendorHash = "sha256-A7veNDrPke1N+1Ctg4cMqjPhTwyVfbkGMi/YP1xIUqY=";
 
   subPackages = [
     "cmd/lncli"
diff --git a/pkgs/by-name/ls/lsp-plugins/package.nix b/pkgs/by-name/ls/lsp-plugins/package.nix
index 437b5863859a..68c38135426f 100644
--- a/pkgs/by-name/ls/lsp-plugins/package.nix
+++ b/pkgs/by-name/ls/lsp-plugins/package.nix
@@ -21,7 +21,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lsp-plugins";
-  version = "1.2.21";
+  version = "1.2.22";
 
   outputs = [
     "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/lsp-plugins/lsp-plugins/releases/download/${finalAttrs.version}/lsp-plugins-src-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ri2h0FV+1kU3HVSneQYSQKApXjmcKqRByW+iNtduEtk=";
+    hash = "sha256-u5cnBIKwTBJpZDqDc7VUJV3eKHscXdvFZ6yU3kgVp1s=";
   };
 
   # By default, GStreamer plugins are installed right alongside GStreamer itself
diff --git a/pkgs/by-name/ma/mask/package.nix b/pkgs/by-name/ma/mask/package.nix
index d1b1e0ff96ce..92b8d4602a5d 100644
--- a/pkgs/by-name/ma/mask/package.nix
+++ b/pkgs/by-name/ma/mask/package.nix
@@ -1,32 +1,58 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   rustPlatform,
+  versionCheckHook,
+  nix-update-script,
+
+  # tests
+  nodejs,
+  python3,
+  php,
+  ruby,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mask";
   version = "0.11.6";
 
   src = fetchFromGitHub {
     owner = "jacobdeichert";
     repo = "mask";
-    rev = "mask/${version}";
+    tag = "mask/${finalAttrs.version}";
     hash = "sha256-xGD23pso5iS+9dmfTMNtR6YqUqKnzJTzMl+OnRGpL3g=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-JaYr6J3NOwVIHzGO4wLkke5O/T/9WUDENPgLP5Fwyhg=";
 
-  # tests require mask to be installed
-  doCheck = false;
+  preCheck = ''
+    export PATH=$PATH:$PWD/target/${stdenv.hostPlatform.rust.rustcTarget}/$cargoBuildType
+  '';
 
-  meta = with lib; {
+  nativeCheckInputs = [
+    nodejs
+    python3
+    php
+    ruby
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=^mask/(.*)$" ]; };
+
+  meta = {
     description = "CLI task runner defined by a simple markdown file";
     mainProgram = "mask";
     homepage = "https://github.com/jacobdeichert/mask";
-    changelog = "https://github.com/jacobdeichert/mask/blob/mask/${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda ];
+    changelog = "https://github.com/jacobdeichert/mask/blob/mask/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      figsoda
+      defelo
+    ];
   };
-}
+})
diff --git a/pkgs/by-name/md/mdfried/package.nix b/pkgs/by-name/md/mdfried/package.nix
new file mode 100644
index 000000000000..3b96cd56de0a
--- /dev/null
+++ b/pkgs/by-name/md/mdfried/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mdfried";
+  version = "0.12.1";
+
+  src = fetchFromGitHub {
+    owner = "benjajaja";
+    repo = "mdfried";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pSJexHOfGB8KGTpPrqw+dgymDXyux0uH6CDsZcnsHlE=";
+  };
+
+  cargoHash = "sha256-ZcWoYfvYmesi7JPOeSmIj0L9qlsoOYf6SMO0XQy6KwA=";
+
+  doCheck = true;
+
+  meta = {
+    description = "Markdown viewer TUI for the terminal, with big text and image rendering";
+    homepage = "https://github.com/benjajaja/mdfried";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ benjajaja ];
+    platforms = lib.platforms.unix;
+    mainProgram = "mdfried";
+  };
+})
diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix
index 0092eab6b5f3..6a7897f9a79f 100644
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@@ -109,7 +109,7 @@ pythonpkgs.buildPythonApplication rec {
 
   # Needed for tests
   preCheck = ''
-    export NLTK_DATA=${nltk-data.averaged_perceptron_tagger_eng}
+    export NLTK_DATA=${nltk-data.averaged-perceptron-tagger-eng}
   '';
 
   disabledTestPaths = [
diff --git a/pkgs/by-name/me/mergiraf/package.nix b/pkgs/by-name/me/mergiraf/package.nix
index 4d60d995b184..3642d9f256e3 100644
--- a/pkgs/by-name/me/mergiraf/package.nix
+++ b/pkgs/by-name/me/mergiraf/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mergiraf";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "mergiraf";
     repo = "mergiraf";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CQriH0vZ+ZBSIZcj0MKQEojpugS2g4sCuDICmwLCUBE=";
+    hash = "sha256-HtIrl9q64JLV/ufJ2g9OrQDDOkcwvyn4+l6/dUqwXkw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nsWRysIupGC3w0L7OMChcgPPTHSwnmcKv58BTn51cY4=";
+  cargoHash = "sha256-xe+JbXKOfxj0XSUM3zW0cYkWo22nyTOp+mOudv3UbE4=";
 
   nativeCheckInputs = [
     git
diff --git a/pkgs/by-name/nd/ndstrim/package.nix b/pkgs/by-name/nd/ndstrim/package.nix
index 130f7f3dbc44..9545b7627ffe 100644
--- a/pkgs/by-name/nd/ndstrim/package.nix
+++ b/pkgs/by-name/nd/ndstrim/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch,
   rustPlatform,
 }:
 
@@ -16,31 +15,9 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-KgtejBbFg6+klc8OpCs1CIb+7uVPCtP0/EM671vxauk=";
   };
 
-  patches = [
-    # https://github.com/Nemris/ndstrim/pull/1
-    (fetchpatch {
-      name = "update-cargo-lock.patch";
-      url = "https://github.com/Nemris/ndstrim/commit/8147bb31a8fb5765f33562957a61cb6ddbe65513.patch";
-      hash = "sha256-HsCc5un9dg0gRkRjwxtjms0cugqWhcTthGfcF50EgYA=";
-    })
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-wRMMWeZDk9Xt3263pq20Qioy1x8egiPhuoPxmpNTq8M=";
 
-  # TODO: remove this after upstream merge above patch.
-  # Without the workaround below the build results in the following error:
-  # Validating consistency between /build/source/Cargo.lock and /build/ndstrim-0.2.1-vendor.tar.gz/Cargo.lock
-  # <hash>
-  # < version = "0.2.1"
-  # ---
-  # > version = "0.1.0"
-  #
-  # ERROR: cargoHash or cargoSha256 is out of date
-  postPatch = ''
-    cargoSetupPostPatchHook() { true; }
-  '';
-
   meta = with lib; {
     description = "Trim the excess padding found in Nintendo DS(i) ROMs";
     homepage = "https://github.com/Nemris/ndstrim";
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
index 3fe47acc1bb6..2c7150875b5a 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
@@ -61,19 +61,39 @@ class BuildAttr:
         return cls(Path(file or "default.nix"), attr)
 
 
-def discover_git(location: Path) -> str | None:
+def discover_git(location: Path) -> Path | None:
+    """
+    Discover the current git repository in the given location.
+    """
     current = location.resolve()
     previous = None
 
     while current.is_dir() and current != previous:
         dotgit = current / ".git"
         if dotgit.is_dir():
-            return str(current)
+            return current
         elif dotgit.is_file():  # this is a worktree
             with dotgit.open() as f:
                 dotgit_content = f.read().strip()
                 if dotgit_content.startswith("gitdir: "):
-                    return dotgit_content.split("gitdir: ")[1]
+                    return Path(dotgit_content.split("gitdir: ")[1])
+        previous = current
+        current = current.parent
+
+    return None
+
+
+def discover_closest_flake(location: Path) -> Path | None:
+    """
+    Discover the closest flake.nix file starting from the given location upwards.
+    """
+    current = location.resolve()
+    previous = None
+
+    while current.is_dir() and current != previous:
+        flake_file = current / "flake.nix"
+        if flake_file.is_file():
+            return current
         previous = current
         current = current.parent
 
@@ -110,7 +130,15 @@ class Flake:
             path = Path(path_str)
             git_repo = discover_git(path)
             if git_repo is not None:
-                return cls(f"git+file://{git_repo}", nixos_attr)
+                url = f"git+file://{git_repo}"
+                flake_path = discover_closest_flake(path)
+                if (
+                    flake_path is not None
+                    and flake_path != git_repo
+                    and flake_path.is_relative_to(git_repo)
+                ):
+                    url += f"?dir={flake_path.relative_to(git_repo)}"
+                return cls(url, nixos_attr)
             return cls(path, nixos_attr)
 
     @classmethod
diff --git a/pkgs/by-name/nv/nvme-rs/package.nix b/pkgs/by-name/nv/nvme-rs/package.nix
new file mode 100644
index 000000000000..3620fe08c45d
--- /dev/null
+++ b/pkgs/by-name/nv/nvme-rs/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  openssl,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nvme-rs";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "liberodark";
+    repo = "nvme-rs";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yM0jzqO+BpsIcr+IMZf5idAY4DTpLxP1VGISzhWhOlI=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-V9drHGeY0dvMVdCd016kELGZe7r/Qhia8fGRI9CO/ns=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Lightweight tool for monitoring NVMe drive health with email alerts";
+    homepage = "https://github.com/liberodark/nvme-rs";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ liberodark ];
+    platforms = lib.platforms.linux;
+    mainProgram = "nvme-rs";
+  };
+})
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 74d8ed423840..24869c436da3 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -306,8 +306,8 @@ python.pkgs.buildPythonApplication rec {
       tesseract5
       ;
     nltkData = with nltk-data; [
-      punkt_tab
-      snowball_data
+      punkt-tab
+      snowball-data
       stopwords
     ];
     tests = { inherit (nixosTests) paperless; };
diff --git a/pkgs/by-name/pr/protolint/package.nix b/pkgs/by-name/pr/protolint/package.nix
index de46acfae0fd..240e7bc8b7e3 100644
--- a/pkgs/by-name/pr/protolint/package.nix
+++ b/pkgs/by-name/pr/protolint/package.nix
@@ -40,7 +40,7 @@ buildGoModule rec {
     homepage = "https://github.com/yoheimuta/protolint";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = [ maintainers.zane ];
+    maintainers = [ ];
     mainProgram = "protolint";
   };
 }
diff --git a/pkgs/by-name/rs/rssguard/package.nix b/pkgs/by-name/rs/rssguard/package.nix
index 881e7a97605e..95654c1282b3 100644
--- a/pkgs/by-name/rs/rssguard/package.nix
+++ b/pkgs/by-name/rs/rssguard/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "4.8.3";
+  version = "4.8.4";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     tag = version;
-    sha256 = "sha256-1y3hmAuIOhh1L+x4ZOPy7ixAizVNPtQjxL3mgNWgx9A=";
+    sha256 = "sha256-CWRsuIvjgQHnCfHVUvellFLma8vvqoROfPjKOIuCSCI=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/sl/sleek/Cargo.lock b/pkgs/by-name/sl/sleek/Cargo.lock
deleted file mode 100644
index b7f385d76c7c..000000000000
--- a/pkgs/by-name/sl/sleek/Cargo.lock
+++ /dev/null
@@ -1,470 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "anstream"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e579a7752471abc2a8268df8b20005e3eadd975f585398f17efcfd8d4927371"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is-terminal",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41ed9a86bf92ae6580e0a31281f65a1b1d867c0cc68d5346e2ae128dddfa6a7d"
-
-[[package]]
-name = "anstyle-parse"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e765fd216e48e067936442276d1d57399e37bce53c264d6fefbe298080cb57ee"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
-dependencies = [
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcd8291a340dd8ac70e18878bc4501dd7b4ff970cfa21c207d36ece51ea88fd"
-dependencies = [
- "anstyle",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "cc"
-version = "1.0.79"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
-
-[[package]]
-name = "clap"
-version = "4.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93aae7a4192245f70fe75dd9157fc7b4a5bf53e88d30bd4396f7d8f9284d5acc"
-dependencies = [
- "clap_builder",
- "clap_derive",
- "once_cell",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f423e341edefb78c9caba2d9c7f7687d0e72e89df3ce3394554754393ac3990"
-dependencies = [
- "anstream",
- "anstyle",
- "bitflags",
- "clap_lex",
- "once_cell",
- "strsim",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "191d9573962933b4027f932c600cd252ce27a8ad5979418fe78e43c07996f27b"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da6da31387c7e4ef160ffab6d5e7f00c42626fe39aea70a7b0f1773f7dd6c1b"
-
-[[package]]
-name = "colorchoice"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
-
-[[package]]
-name = "either"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
-
-[[package]]
-name = "errno"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d6a0976c999d473fe89ad888d5a284e55366d9dc9038b1ba2aa15128c4afa0"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
-name = "glob"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
-
-[[package]]
-name = "io-lifetimes"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c66c74d2ae7e79a5a8f7ac924adbe38ee42a859c6539ad869eb51f0b52dc220"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adcf93614601c8129ddf72e2d5633df827ba6551541c6d8c59520a371475be1f"
-dependencies = [
- "hermit-abi",
- "io-lifetimes",
- "rustix",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "itertools"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.141"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3304a64d199bb964be99741b7a14d26972741915b3649639149b2479bb46f4b5"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d59d8c75012853d2e872fb56bc8a2e53718e2cafe1a4c823143141c6d90c322f"
-
-[[package]]
-name = "memchr"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
-
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.56"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b63bdb0cd06f1f4dedf69b254734f9b45af66e4a031e42a7480257d9898b435"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rustix"
-version = "0.37.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aef160324be24d31a62147fae491c14d2204a3865c7ca8c3b0d7f7bcb3ea635"
-dependencies = [
- "bitflags",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "sleek"
-version = "0.3.0"
-dependencies = [
- "clap",
- "glob",
- "sqlformat",
- "thiserror",
-]
-
-[[package]]
-name = "sqlformat"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c12bc9199d1db8234678b7051747c07f517cdcf019262d1847b94ec8b1aee3e"
-dependencies = [
- "itertools",
- "nom",
- "unicode_categories",
-]
-
-[[package]]
-name = "strsim"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
-
-[[package]]
-name = "syn"
-version = "2.0.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c9da457c5285ac1f936ebd076af6dac17a61cfe7826f2076b4d015cf47bc8ec"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978c9a314bd8dc99be594bc3c175faaa9794be04a5a5e153caba6915336cebac"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5464a87b239f13a63a501f2701565754bae92d243d4bb7eb12f6d57d2269bf4"
-
-[[package]]
-name = "unicode_categories"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
-
-[[package]]
-name = "utf8parse"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
-
-[[package]]
-name = "windows-sys"
-version = "0.45.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
-dependencies = [
- "windows-targets 0.42.2",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.0",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b1eb6f0cd7c80c79759c929114ef071b87354ce476d9d94271031c0497adfd5"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.0",
- "windows_aarch64_msvc 0.48.0",
- "windows_i686_gnu 0.48.0",
- "windows_i686_msvc 0.48.0",
- "windows_x86_64_gnu 0.48.0",
- "windows_x86_64_gnullvm 0.48.0",
- "windows_x86_64_msvc 0.48.0",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
diff --git a/pkgs/by-name/sl/sleek/package.nix b/pkgs/by-name/sl/sleek/package.nix
index afe3db6eaf27..3a1fbfda5a4b 100644
--- a/pkgs/by-name/sl/sleek/package.nix
+++ b/pkgs/by-name/sl/sleek/package.nix
@@ -15,14 +15,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-VQ0LmKhFsC12qoXCFHxtV5E+J7eRvZMVH0j+5r8pDk8=";
   };
 
-  # 0.3.0 has been tagged before the actual Cargo.lock bump, resulting in an inconsistent lock file.
-  # To work around this, the Cargo.lock below is from the commit right after the tag:
-  # https://github.com/nrempel/sleek/commit/18c5457a813a16e3eebfc1c6f512131e6e8daa02
-  postPatch = ''
-    ln -s --force ${./Cargo.lock} Cargo.lock
-  '';
-
-  cargoLock.lockFile = ./Cargo.lock;
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-vq4e/2+YfMw2n8ZMYPa/3HtNk9pCtXWN/u1MzhBkZJQ=";
 
   meta = with lib; {
     description = "CLI tool for formatting SQL";
diff --git a/pkgs/by-name/tr/trino-cli/package.nix b/pkgs/by-name/tr/trino-cli/package.nix
index 77231e48edda..b0a116e1d5be 100644
--- a/pkgs/by-name/tr/trino-cli/package.nix
+++ b/pkgs/by-name/tr/trino-cli/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "trino-cli";
-  version = "439";
+  version = "475";
 
   jarfilename = "${pname}-${version}-executable.jar";
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://maven/io/trino/${pname}/${version}/${jarfilename}";
-    sha256 = "sha256-ANrv3+hpRn00zFAu6FHltk6seQ4lP2esDIhsJrctfY0=";
+    sha256 = "sha256-NGfouDTSk1M51pEkQbDCzFGCe3jpZd/8FYGGyBzsArI=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ty/typst/package.nix b/pkgs/by-name/ty/typst/package.nix
index 7efdd3424d2d..eda1ea51344f 100644
--- a/pkgs/by-name/ty/typst/package.nix
+++ b/pkgs/by-name/ty/typst/package.nix
@@ -36,6 +36,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   env = {
     GEN_ARTIFACTS = "artifacts";
     OPENSSL_NO_VENDOR = true;
+    # to not have "unknown hash" in help output
+    TYPST_VERSION = finalAttrs.version;
   };
 
   # Fix for "Found argument '--test-threads' which wasn't expected, or isn't valid in this context"
diff --git a/pkgs/by-name/un/unstructured-api/package.nix b/pkgs/by-name/un/unstructured-api/package.nix
index 96a5a15584d8..adf9fa83dd96 100644
--- a/pkgs/by-name/un/unstructured-api/package.nix
+++ b/pkgs/by-name/un/unstructured-api/package.nix
@@ -152,7 +152,7 @@ let
 
     paths = [
       nltk-data.punkt
-      nltk-data.averaged_perceptron_tagger
+      nltk-data.averaged-perceptron-tagger
     ];
   };
 in
diff --git a/pkgs/by-name/un/unzoo/package.nix b/pkgs/by-name/un/unzoo/package.nix
deleted file mode 100644
index dcb2fe0bbe43..000000000000
--- a/pkgs/by-name/un/unzoo/package.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "unzoo";
-  version = "4.4";
-
-  src = fetchFromGitHub {
-    owner = "museoa";
-    repo = "unzoo";
-    rev = version;
-    hash = "sha256-oPq1I7EsvHaJ7anHbm/KWrYrxJkM79rLhgRfSAdoLtk=";
-  };
-
-  outputs = [
-    "out"
-    "doc"
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    ${stdenv.cc.targetPrefix}cc -o unzoo -DSYS_IS_UNIX src/unzoo.c
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $doc/share/doc/unzoo
-    cp unzoo $out/bin
-    cp README.TXT $doc/share/doc/unzoo
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/museoa/unzoo/";
-    description = "Manipulate archives of files in Zoo compressed form";
-    license = licenses.publicDomain;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.all;
-    mainProgram = "unzoo";
-  };
-}
diff --git a/pkgs/by-name/ve/veroroute/package.nix b/pkgs/by-name/ve/veroroute/package.nix
new file mode 100644
index 000000000000..502cb79e1001
--- /dev/null
+++ b/pkgs/by-name/ve/veroroute/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  libsForQt5,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "veroroute";
+  version = "2.39";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/veroroute/veroroute-${finalAttrs.version}.tar.gz";
+    hash = "sha256-+qX8NFkPkQGW29uQUEuetgW3muDP56lMJgrGCAo+5pc=";
+  };
+
+  nativeBuildInputs = [
+    libsForQt5.qmake
+    libsForQt5.wrapQtAppsHook
+  ];
+  buildInputs = [
+    libsForQt5.qtbase
+  ];
+
+  preConfigure = ''
+    cd Src/
+  '';
+
+  meta = {
+    description = "Qt based Veroboard/Perfboard/PCB layout and routing application";
+    homepage = "https://sourceforge.net/projects/veroroute";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      nh2
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index ced4d0aab432..d96f9e5556d8 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -61,23 +61,23 @@ let
   # and often with different versions. We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "6.4.6.53970";
-  versions.x86_64-darwin = "6.4.6.53970";
-  versions.x86_64-linux = "6.4.6.1370";
+  versions.aarch64-darwin = "6.4.10.56141";
+  versions.x86_64-darwin = "6.4.10.56141";
+  versions.x86_64-linux = "6.4.10.2027";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-yNsiFZNte4432d8DUyDhPUOVbLul7gUdvr+3qK/Y+tk=";
+      hash = "sha256-LIQl+s/2WfYFIEG/ZsvpWlsWRhToB+5+ymAXCMhDqWE=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-Ut93qQFFN0d58wXD5r8u0B17HbihFg3FgY3a1L8nsIA=";
+      hash = "sha256-jP9ajDCo8iImS8YGFLjNMOLLh9g8uSqYIRl3aqhJAaM=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-Y+8garSqDcKLCVv1cTiqGEfrGKpK3UoXIq8X4E8CF+8=";
+      hash = "sha256-BwYO8IlQJjZwwn/qokZ+gAgcgmAjG34uExHCajchVqs=";
     };
   };
 
@@ -245,7 +245,10 @@ let
     version = versions.${system} or throwSystem;
 
     targetPkgs = pkgs: (linuxGetDependencies pkgs) ++ [ unpacked ];
-    extraPreBwrapCmds = "unset QT_PLUGIN_PATH";
+    extraPreBwrapCmds = ''
+      unset QT_PLUGIN_PATH
+      unset LANG  # would break settings dialog on non-"en_XX" locales
+    '';
     extraBwrapArgs = [ "--ro-bind ${unpacked}/opt /opt" ];
     runScript = "/opt/zoom/ZoomLauncher";
 
diff --git a/pkgs/by-name/zz/zziplib/package.nix b/pkgs/by-name/zz/zziplib/package.nix
index d37001c0f5ca..867c3a3e890f 100644
--- a/pkgs/by-name/zz/zziplib/package.nix
+++ b/pkgs/by-name/zz/zziplib/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zziplib";
-  version = "0.13.78";
+  version = "0.13.79";
 
   src = fetchFromGitHub {
     owner = "gdraheim";
     repo = "zziplib";
     rev = "v${version}";
-    hash = "sha256-8QxQrxqYO4LtB8prMqgz5a0QqvSKL7KzTkgi+VdHp6A=";
+    hash = "sha256-PUG6MAglYJXJzQMWM7KfLFbHG3bva7FyaP+HdCsRnZQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/zig/default.nix b/pkgs/development/compilers/zig/default.nix
index 037e5e2d735a..20e2a8f24b2a 100644
--- a/pkgs/development/compilers/zig/default.nix
+++ b/pkgs/development/compilers/zig/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   callPackage,
-  llvmPackages_16,
   llvmPackages_17,
   llvmPackages_18,
   llvmPackages_19,
@@ -17,9 +16,9 @@ let
       llvmPackages = llvmPackages_18;
       hash = "sha256-5qSiTq+UWGOwjDVZMIrAt2cDKHkyNPBSAEjpRQUByFM=";
     };
-    "0.14.0" = {
+    "0.14.1" = {
       llvmPackages = llvmPackages_19;
-      hash = "sha256-VyteIp5ZRt6qNcZR68KmM7CvN2GYf8vj5hP+gHLkuVk=";
+      hash = "sha256-DhVJIY/z12PJZdb5j4dnCRb7k1CmeQVOnayYRP8azDI=";
     };
   } // zigVersions;
 
diff --git a/pkgs/development/python-modules/aider-chat/default.nix b/pkgs/development/python-modules/aider-chat/default.nix
index 4aa6ae731311..bc4534b8da61 100644
--- a/pkgs/development/python-modules/aider-chat/default.nix
+++ b/pkgs/development/python-modules/aider-chat/default.nix
@@ -125,7 +125,7 @@ let
   aider-nltk-data = symlinkJoin {
     name = "aider-nltk-data";
     paths = [
-      nltk-data.punkt_tab
+      nltk-data.punkt-tab
       nltk-data.stopwords
     ];
   };
diff --git a/pkgs/development/python-modules/bdffont/default.nix b/pkgs/development/python-modules/bdffont/default.nix
index 8dc2349f202c..385114a6b9a3 100644
--- a/pkgs/development/python-modules/bdffont/default.nix
+++ b/pkgs/development/python-modules/bdffont/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "bdffont";
-  version = "0.0.30";
+  version = "0.0.31";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "bdffont";
     inherit version;
-    hash = "sha256-DKZZSXZ3+s92K7RI1lMb8Er5+Tzj9AFJXgNwGs5qeMU=";
+    hash = "sha256-jE6k1gym4UCHpQJTPEip+c5e+9QxNpT41v3fK9WVoLc=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/coiled/default.nix b/pkgs/development/python-modules/coiled/default.nix
index 8b6ddd80424b..e26e6255e1f0 100644
--- a/pkgs/development/python-modules/coiled/default.nix
+++ b/pkgs/development/python-modules/coiled/default.nix
@@ -39,12 +39,12 @@
 
 buildPythonPackage rec {
   pname = "coiled";
-  version = "1.95.0";
+  version = "1.96.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+YmBKfiJYJVjpSrPGXlzMbQtweObLrLZr1c+aJ58fu4=";
+    hash = "sha256-iyjZGg7RNaguHVZFMSS65OiO0HC3bqZL7yeOaSGr+IE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/coredis/default.nix b/pkgs/development/python-modules/coredis/default.nix
index 439612fdf4b3..5f4f4c6c24ae 100644
--- a/pkgs/development/python-modules/coredis/default.nix
+++ b/pkgs/development/python-modules/coredis/default.nix
@@ -2,40 +2,52 @@
   lib,
   async-timeout,
   buildPythonPackage,
+  setuptools,
+  versioneer,
   deprecated,
   fetchFromGitHub,
+  packaging,
   pympler,
   pytest-asyncio,
   pytest-lazy-fixtures,
   pytestCheckHook,
-  pythonOlder,
   redis,
+  typing-extensions,
   wrapt,
 }:
 
 buildPythonPackage rec {
   pname = "coredis";
-  version = "4.20.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.8";
+  version = "4.22.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alisaifee";
-    repo = pname;
+    repo = "coredis";
     tag = version;
-    hash = "sha256-N7RQEgpBnXa+xtthySfec1Xw3JHtGCT2ZjmOK7H5B+A=";
+    hash = "sha256-EMiZkKUcVbinWtYimNSQ715PH7pCrXpNKqseLFCu/48=";
   };
 
   postPatch = ''
+    sed -i '/mypy==/d' pyproject.toml
+    sed -i '/packaging/d' pyproject.toml
+    sed -i '/pympler/d' pyproject.toml
+    sed -i '/types_deprecated/d' pyproject.toml
     substituteInPlace pytest.ini \
-      --replace "-K" ""
+      --replace-fail "-K" ""
   '';
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+    versioneer
+  ];
+
+  dependencies = [
     async-timeout
     deprecated
+    packaging
     pympler
+    typing-extensions
     wrapt
   ];
 
@@ -56,11 +68,11 @@ buildPythonPackage rec {
     "tests/test_utils.py"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Async redis client with support for redis server, cluster & sentinel";
     homepage = "https://github.com/alisaifee/coredis";
     changelog = "https://github.com/alisaifee/coredis/blob/${src.tag}/HISTORY.rst";
-    license = licenses.mit;
-    teams = [ teams.wdz ];
+    license = lib.licenses.mit;
+    teams = [ lib.teams.wdz ];
   };
 }
diff --git a/pkgs/development/python-modules/hiredis/default.nix b/pkgs/development/python-modules/hiredis/default.nix
index 0f1ac23d7b4c..9cffa09895f9 100644
--- a/pkgs/development/python-modules/hiredis/default.nix
+++ b/pkgs/development/python-modules/hiredis/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "hiredis";
-  version = "3.1.0";
+  version = "3.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     repo = "hiredis-py";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-ID5OJdARd2N2GYEpcYOpxenpZlhWnWr5fAClAgqEgGg=";
+    hash = "sha256-z28fBGqZE88vQuJfb39AEN3hGEZMz5gq71IdlpO5VAg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ingredient-parser-nlp/default.nix b/pkgs/development/python-modules/ingredient-parser-nlp/default.nix
index 88d03d362361..ee07bd34acd3 100644
--- a/pkgs/development/python-modules/ingredient-parser-nlp/default.nix
+++ b/pkgs/development/python-modules/ingredient-parser-nlp/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage rec {
 
   # Needed for tests
   preCheck = ''
-    export NLTK_DATA=${nltk-data.averaged_perceptron_tagger_eng}
+    export NLTK_DATA=${nltk-data.averaged-perceptron-tagger-eng}
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
index 25e20e1aff16..dfdd52372c14 100644
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -25,6 +25,7 @@
   pillow,
   pytestCheckHook,
   tabulate,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -68,6 +69,7 @@ buildPythonPackage rec {
     pillow
     pytestCheckHook
     tabulate
+    writableTmpDirAsHomeHook
   ];
 
   postPatch = ''
@@ -97,11 +99,9 @@ buildPythonPackage rec {
   # The setup.py does all the configuration
   dontUseCmakeConfigure = true;
 
+  # detecting source dir as a python package confuses pytest
   preCheck = ''
-    export HOME=$(mktemp -d)
-
-    # detecting source dir as a python package confuses pytest
-    mv onnx/__init__.py onnx/__init__.py.hidden
+    rm onnx/__init__.py
   '';
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/onnxmltools/default.nix b/pkgs/development/python-modules/onnxmltools/default.nix
index 6458a8323b77..350cea07a6d0 100644
--- a/pkgs/development/python-modules/onnxmltools/default.nix
+++ b/pkgs/development/python-modules/onnxmltools/default.nix
@@ -2,10 +2,16 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   numpy,
   onnx,
   skl2onnx,
-  # native check inputs
+
+  # tests
   pytestCheckHook,
   pandas,
   xgboost,
@@ -18,7 +24,7 @@
 buildPythonPackage rec {
   pname = "onnxmltools";
   version = "1.13";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "onnx";
@@ -27,7 +33,18 @@ buildPythonPackage rec {
     hash = "sha256-uNd7N7/FgX8zaJp8ouvftwGqGqas8lZRXFmjpS+t2B4=";
   };
 
-  propagatedBuildInputs = [
+  postPatch = ''
+    substituteInPlace onnxmltools/proto/__init__.py \
+      --replace-fail \
+        "from onnx.helper import split_complex_to_pairs" \
+        "from onnx.helper import _split_complex_to_pairs as split_complex_to_pairs"
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     numpy
     onnx
     skl2onnx
@@ -51,10 +68,11 @@ buildPythonPackage rec {
     # h20
   ];
 
-  meta = with lib; {
+  meta = {
     description = "ONNXMLTools enables conversion of models to ONNX";
     homepage = "https://github.com/onnx/onnxmltools";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ happysalada ];
+    changelog = "https://github.com/onnx/onnxmltools/blob/v${version}/CHANGELOGS.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ happysalada ];
   };
 }
diff --git a/pkgs/development/python-modules/onnxruntime-tools/default.nix b/pkgs/development/python-modules/onnxruntime-tools/default.nix
index 462cdb7f2336..ac4a7b830795 100644
--- a/pkgs/development/python-modules/onnxruntime-tools/default.nix
+++ b/pkgs/development/python-modules/onnxruntime-tools/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     hash = "sha256-Hf+Ii1xIKsW8Yn8S4QhEX+/LPWAMQ/Y2M5dTFv5hetg=";
   };
 
-  propagatedBuildInputs = [
+  dependencies = [
     coloredlogs
     numpy
     onnx
@@ -42,10 +42,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "onnxruntime_tools" ];
 
-  meta = with lib; {
+  meta = {
     description = "Transformers Model Optimization Tool of ONNXRuntime";
     homepage = "https://pypi.org/project/onnxruntime-tools/";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ happysalada ];
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ happysalada ];
   };
 }
diff --git a/pkgs/development/python-modules/openusd/default.nix b/pkgs/development/python-modules/openusd/default.nix
index 6084cca6478e..073a4b1145fc 100644
--- a/pkgs/development/python-modules/openusd/default.nix
+++ b/pkgs/development/python-modules/openusd/default.nix
@@ -121,7 +121,6 @@ buildPythonPackage rec {
       materialx
       opencolorio
       openimageio
-      opensubdiv
       ptex
       tbb
     ]
@@ -139,6 +138,7 @@ buildPythonPackage rec {
       boost
       jinja2
       numpy
+      opensubdiv
       pyopengl
       distutils
     ]
diff --git a/pkgs/development/python-modules/sanic/default.nix b/pkgs/development/python-modules/sanic/default.nix
index b794cd283159..d3174581741c 100644
--- a/pkgs/development/python-modules/sanic/default.nix
+++ b/pkgs/development/python-modules/sanic/default.nix
@@ -117,7 +117,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/sanic-org/sanic/";
     changelog = "https://github.com/sanic-org/sanic/releases/tag/${src.tag}";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ p0lyw0lf ];
     mainProgram = "sanic";
   };
 }
diff --git a/pkgs/development/python-modules/tinygrad/default.nix b/pkgs/development/python-modules/tinygrad/default.nix
index cf4e0c43162a..c7b75ac452ab 100644
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@@ -178,6 +178,11 @@ buildPythonPackage rec {
       # AssertionError: 2.1376906810000946 not less than 2.0
       "test_recursive_pad"
 
+      # Since updated onnx to 1.18.0:
+      # onnxruntime.capi.onnxruntime_pybind11_state.Fail: [ONNXRuntimeError] : 1 : FAIL : Load model from ...
+      # Unsupported model IR version: 11, max supported IR version: 10
+      "test_quant_128"
+
       # Require internet access
       "test_benchmark_openpilot_model"
       "test_bn_alone"
diff --git a/pkgs/development/python-modules/tracerite/default.nix b/pkgs/development/python-modules/tracerite/default.nix
index 1a590780cdfc..9a4d9df7a0a7 100644
--- a/pkgs/development/python-modules/tracerite/default.nix
+++ b/pkgs/development/python-modules/tracerite/default.nix
@@ -44,6 +44,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/sanic-org/tracerite";
     changelog = "https://github.com/sanic-org/tracerite/releases/tag/v${version}";
     license = licenses.unlicense;
-    maintainers = [ ];
+    maintainers = with maintainers; [ p0lyw0lf ];
   };
 }
diff --git a/pkgs/development/python-modules/type-infer/default.nix b/pkgs/development/python-modules/type-infer/default.nix
index 4ce88d3b049f..4b8ef9e99d5e 100644
--- a/pkgs/development/python-modules/type-infer/default.nix
+++ b/pkgs/development/python-modules/type-infer/default.nix
@@ -24,7 +24,7 @@ let
     name = "nltk-test-data";
     paths = [
       nltk-data.punkt
-      nltk-data.punkt_tab
+      nltk-data.punkt-tab
       nltk-data.stopwords
     ];
   };
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 762833d3eddd..4e7b391f840a 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -43,13 +43,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "20.3.0-55895";
+  version = "20.3.1-55959";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-Bs1hgEr5y9TYMGPXGrIOmqMgeyc6wHVo1x7OijTYifY=";
+    hash = "sha256-/J6NouI2htptG06Undeg1rUfbWUu6q/nV2P9D+sS7OA=";
   };
 
   hardeningDisable = [
diff --git a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
index 3df4dc27651b..d6eb9f676414 100644
--- a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "jmcollin78";
   domain = "versatile_thermostat";
-  version = "7.3.0";
+  version = "7.3.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     rev = "refs/tags/${version}";
-    hash = "sha256-nDKKsVOXAl3hNSzKFk3iKSBZFpPY5WI8jhRaw/mCeL0=";
+    hash = "sha256-sRmf+6rOWnbLZaO5kJw+9Udsyj6fX2BeFh8tN9xkZRk=";
   };
 
   passthru.updateScript = gitUpdater { ignoredVersions = "(Alpha|Beta|alpha|beta).*"; };
diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index ffaf4ee7a957..7f6d40483cc2 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -3,6 +3,7 @@
   lib,
   fetchFromGitHub,
   python3,
+  extraPythonPackages ? ps: [ ],
   unstableGitUpdater,
   makeWrapper,
   writeShellScript,
@@ -29,7 +30,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     (python3.withPackages (
-      p: with p; [
+      p:
+      with p;
+      [
         python-can
         cffi
         pyserial
@@ -38,6 +41,7 @@ stdenv.mkDerivation rec {
         markupsafe
         numpy
       ]
+      ++ extraPythonPackages p
     ))
   ];
 
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index d668d02a0156..078f48f7233a 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -41,7 +41,7 @@ let
 in
 buildGoModule rec {
   pname = "grafana";
-  version = "12.0.0";
+  version = "12.0.0+security-01";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -53,7 +53,7 @@ buildGoModule rec {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-VibGeRU0qCkEWUw9yVzG6LG1nomDsn17DBYAfV2eN5E=";
+    hash = "sha256-4i9YHhoneptF72F4zvV+KVUJiP8xfiowPJExQ9iteK4=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
diff --git a/pkgs/tools/text/nltk-data/default.nix b/pkgs/tools/text/nltk-data/default.nix
index d9613b86637a..e4aa7f06c355 100644
--- a/pkgs/tools/text/nltk-data/default.nix
+++ b/pkgs/tools/text/nltk-data/default.nix
@@ -10,12 +10,16 @@ let
     version = "0-unstable-2024-07-29";
     nativeBuildInputs = [ unzip ];
     dontBuild = true;
+    dontFixup = true;
     meta = with lib; {
       description = "NLTK Data";
       homepage = "https://github.com/nltk/nltk_data";
       license = licenses.asl20;
       platforms = platforms.all;
-      maintainers = with maintainers; [ happysalada ];
+      maintainers = with maintainers; [
+        bengsparks
+        happysalada
+      ];
     };
   };
   makeNltkDataPackage =
@@ -50,41 +54,212 @@ let
         '';
       }
     );
+
+  makeChunker =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "chunkers";
+      hash = "sha256-kemjqaCM9hlKAdMw8oVJnp62EAC9rMQ50dKg7wlAwEc=";
+    };
+
+  makeCorpus =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "corpora";
+      hash = "sha256-8lMjW5YI8h6dHJ/83HVY2OYGDyKPpgkUAKPISiAKqqk=";
+    };
+
+  makeGrammar =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "grammars";
+      hash = "sha256-pyLEcX3Azv8j1kCGvVYonuiNgVJxtWt7veU0S/yNbIM=";
+    };
+
+  makeHelp =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "help";
+      hash = "sha256-97mYLNES5WujLF5gD8Ul4cJ6LqSzz+jDzclUsdBeHNE=";
+    };
+
+  makeMisc =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "misc";
+      hash = "sha256-XtizfEsc8TYWqvvC/eSFdha2ClC5/ZiJM8nue0vXLb4=";
+    };
+
+  makeModel =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "models";
+      hash = "sha256-iq3weEgCci6rgLW2j28F2eRLprJtInGXKe/awJPSVG4=";
+    };
+
+  makeTagger =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "taggers";
+      hash = "sha256-tl3Cn2okhBkUtTXvAmFRx72Brez6iTGRdmFTwFmpk3M=";
+    };
+
+  makeTokenizer =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "tokenizers";
+      hash = "sha256-OzMkruoYbFKqzuimOXIpE5lhHz8tmSqOFoLT+fjdTVg=";
+    };
+
+  makeStemmer =
+    pname:
+    makeNltkDataPackage {
+      inherit pname;
+      location = "stemmers";
+      hash = "sha256-mNefwOPVJGz9kXV3LV4DuV7FJpNir/Nwg4ujd0CogEk=";
+    };
 in
 lib.makeScope newScope (self: {
-  punkt = makeNltkDataPackage {
-    pname = "punkt";
-    location = "tokenizers";
-    hash = "sha256-OzMkruoYbFKqzuimOXIpE5lhHz8tmSqOFoLT+fjdTVg=";
-  };
-  punkt_tab = makeNltkDataPackage {
-    pname = "punkt_tab";
-    location = "tokenizers";
-    hash = "sha256-OzMkruoYbFKqzuimOXIpE5lhHz8tmSqOFoLT+fjdTVg=";
-  };
-  averaged_perceptron_tagger = makeNltkDataPackage {
-    pname = "averaged_perceptron_tagger";
-    location = "taggers";
-    hash = "sha256-tl3Cn2okhBkUtTXvAmFRx72Brez6iTGRdmFTwFmpk3M=";
-  };
-  averaged_perceptron_tagger_eng = makeNltkDataPackage {
-    pname = "averaged_perceptron_tagger_eng";
-    location = "taggers";
-    hash = "sha256-tl3Cn2okhBkUtTXvAmFRx72Brez6iTGRdmFTwFmpk3M=";
-  };
-  snowball_data = makeNltkDataPackage {
-    pname = "snowball_data";
-    location = "stemmers";
-    hash = "sha256-mNefwOPVJGz9kXV3LV4DuV7FJpNir/Nwg4ujd0CogEk=";
-  };
-  stopwords = makeNltkDataPackage {
-    pname = "stopwords";
-    location = "corpora";
-    hash = "sha256-8lMjW5YI8h6dHJ/83HVY2OYGDyKPpgkUAKPISiAKqqk=";
-  };
-  wordnet = makeNltkDataPackage {
-    pname = "wordnet";
-    location = "corpora";
-    hash = "sha256-8lMjW5YI8h6dHJ/83HVY2OYGDyKPpgkUAKPISiAKqqk=";
-  };
+  ## Chunkers
+  maxent-ne-chunker = makeChunker "maxent_ne_chunker";
+  maxent-ne-chunker-tab = makeChunker "maxent_ne_chunker_tab";
+
+  ## Corpora
+  abc = makeCorpus "abc";
+  alpino = makeCorpus "alpino";
+  bcp47 = makeCorpus "bcp47";
+  biocreative-ppi = makeCorpus "biocreative_ppi";
+  brown = makeCorpus "brown";
+  brown-tei = makeCorpus "brown_tei";
+  cess-cat = makeCorpus "cess_cat";
+  cess-esp = makeCorpus "cess_esp";
+  chat80 = makeCorpus "chat80";
+  city-database = makeCorpus "city_database";
+  cmudict = makeCorpus "cmudict";
+  comparative-sentences = makeCorpus "comparative_sentences";
+  comtrans = makeCorpus "comtrans";
+  conll2000 = makeCorpus "conll2000";
+  conll2002 = makeCorpus "conll2002";
+  conll2007 = makeCorpus "conll2007";
+  crubadan = makeCorpus "crubadan";
+  dependency-treebank = makeCorpus "dependency_treebank";
+  dolch = makeCorpus "dolch";
+  europarl-raw = makeCorpus "europarl_raw";
+  extended-omw = makeCorpus "extended_omw";
+  floresta = makeCorpus "floresta";
+  framenet-v15 = makeCorpus "framenet_v15";
+  framenet-v17 = makeCorpus "framenet_v17";
+  gazetteers = makeCorpus "gazetteers";
+  genesis = makeCorpus "genesis";
+  gutenberg = makeCorpus "gutenberg";
+  ieer = makeCorpus "ieer";
+  inaugural = makeCorpus "inaugural";
+  indian = makeCorpus "indian";
+  jeita = makeCorpus "jeita";
+  kimmo = makeCorpus "kimmo";
+  knbc = makeCorpus "knbc";
+  lin-thesaurus = makeCorpus "lin_thesaurus";
+  mac-morpho = makeCorpus "mac_morpho";
+  machado = makeCorpus "machado";
+  masc-tagged = makeCorpus "masc_tagged";
+  movie-reviews = makeCorpus "movie_reviews";
+  mte-teip5 = makeCorpus "mte_teip5";
+  names = makeCorpus "names";
+  nombank-1-0 = makeCorpus "nombank.1.0";
+  nonbreaking-prefixes = makeCorpus "nonbreaking_prefixes";
+  nps-chat = makeCorpus "nps_chat";
+  omw = makeCorpus "omw";
+  omw-1-4 = makeCorpus "omw-1.4";
+  opinion-lexicon = makeCorpus "opinion_lexicon";
+  panlex-swadesh = makeCorpus "panlex_swadesh";
+  paradigms = makeCorpus "paradigms";
+  pe08 = makeCorpus "pe08";
+  pil = makeCorpus "pil";
+  pl196x = makeCorpus "pl196x";
+  ppattach = makeCorpus "ppattach";
+  problem-reports = makeCorpus "problem_reports";
+  product-reviews-1 = makeCorpus "product_reviews_1";
+  product-reviews-2 = makeCorpus "product_reviews_2";
+  propbank = makeCorpus "propbank";
+  pros-cons = makeCorpus "pros_cons";
+  ptb = makeCorpus "ptb";
+  qc = makeCorpus "qc";
+  reuters = makeCorpus "reuters";
+  rte = makeCorpus "rte";
+  semcor = makeCorpus "semcor";
+  senseval = makeCorpus "senseval";
+  sentence-polarity = makeCorpus "sentence_polarity";
+  sentiwordnet = makeCorpus "sentiwordnet";
+  shakespeare = makeCorpus "shakespeare";
+  sinica-treebank = makeCorpus "sinica_treebank";
+  smultron = makeCorpus "smultron";
+  state-union = makeCorpus "state_union";
+  stopwords = makeCorpus "stopwords";
+  subjectivity = makeCorpus "subjectivity";
+  swadesh = makeCorpus "swadesh";
+  switchboard = makeCorpus "switchboard";
+  timit = makeCorpus "timit";
+  toolbox = makeCorpus "toolbox";
+  treebank = makeCorpus "treebank";
+  twitter-samples = makeCorpus "twitter_samples";
+  udhr = makeCorpus "udhr";
+  udhr2 = makeCorpus "udhr2";
+  unicode-samples = makeCorpus "unicode_samples";
+  universal-treebanks-v20 = makeCorpus "universal_treebanks_v20";
+  verbnet = makeCorpus "verbnet";
+  verbnet3 = makeCorpus "verbnet3";
+  webtext = makeCorpus "webtext";
+  wordnet = makeCorpus "wordnet";
+  wordnet-ic = makeCorpus "wordnet_ic";
+  wordnet2021 = makeCorpus "wordnet2021";
+  wordnet2022 = makeCorpus "wordnet2022";
+  wordnet31 = makeCorpus "wordnet31";
+  words = makeCorpus "words";
+  ycoe = makeCorpus "ycoe";
+
+  ## Grammars
+  basque-grammars = makeGrammar "basque_grammars";
+  book-grammars = makeGrammar "book_grammars";
+  large-grammars = makeGrammar "large_grammars";
+  sample-grammars = makeGrammar "sample_grammars";
+  spanish-grammars = makeGrammar "spanish_grammars";
+
+  ## Help
+  tagsets-json = makeHelp "tagsets_json";
+
+  ## Misc
+  mwa-ppdb = makeMisc "mwa_ppdb";
+  perluniprops = makeMisc "perluniprops";
+
+  ## Models
+  bllip-wsj-no-aux = makeModel "bllip_wsj_no_aux";
+  moses-sample = makeModel "moses_sample";
+  wmt15-eval = makeModel "wmt15_eval";
+  word2vec-sample = makeModel "word2vec_sample";
+
+  ## Taggers
+  averaged-perceptron-tagger = makeTagger "averaged_perceptron_tagger";
+  averaged-perceptron-tagger-eng = makeTagger "averaged_perceptron_tagger_eng";
+  averaged-perceptron-tagger-ru = makeTagger "averaged_perceptron_tagger_ru";
+  averaged-perceptron-tagger-rus = makeTagger "averaged_perceptron_tagger_rus";
+  maxent-treebank-pos-tagger = makeTagger "maxent_treebank_pos_tagger";
+  maxent-treebank-pos-tagger-tab = makeTagger "maxent_treebank_pos_tagger_tab";
+  universal-tagset = makeTagger "universal_tagset";
+
+  ## Tokenizers
+  punkt = makeTokenizer "punkt";
+  punkt-tab = makeTokenizer "punkt_tab";
+
+  ## Stemmers
+  porter-test = makeStemmer "porter_test";
+  rslp = makeStemmer "rslp";
+  snowball-data = makeStemmer "snowball_data";
 })
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 6282093db163..a6cf0e2bdd4d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1620,6 +1620,7 @@ mapAliases {
   qtcurve = throw "'qtcurve' has been renamed to/replaced by 'libsForQt5.qtcurve'"; # Converted to throw 2024-10-17
   qtile-unwrapped = python3.pkgs.qtile; # Added 2023-05-12
   quantum-espresso-mpi = quantum-espresso; # Added 2023-11-23
+  quaternion-qt5 = throw "'quaternion-qt5' has been removed as quaternion dropped Qt5 support with v0.0.97.1"; # Added 2025-05-24
   quickbms = throw "'quickbms' has been removed due to being unmaintained for many years."; # Added 2025-05-17
   quicklispPackages = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
   quicklispPackagesABCL = throw "Lisp packages have been redesigned. See 'lisp-modules' in the nixpkgs manual."; # Added 2024-05-07
@@ -1806,6 +1807,8 @@ mapAliases {
   strawberry-qt5 = throw "strawberry-qt5 has been replaced by strawberry-qt6"; # Added 2024-11-22
   strelka = throw "strelka depends on Python 2.6+, and does not support Python 3."; # Added 2025-03-17
   subberthehut = throw "'subberthehut' has been removed as it was unmaintained upstream"; # Added 2025-05-17
+  substituteAll = throw "`substituteAll` has been removed. Use `replaceVars` instead."; # Added 2025-05-23
+  substituteAllFiles = throw "`substituteAllFiles` has been removed. Use `replaceVars` for each file instead."; # Added 2025-05-23
   suidChroot = throw "'suidChroot' has been dropped as it was unmaintained, failed to build and had questionable security considerations"; # Added 2025-05-17
   suitesparse_4_2 = throw "'suitesparse_4_2' has been removed as it was unmaintained upstream"; # Added 2025-05-17
   suitesparse_4_4 = throw "'suitesparse_4_4' has been removed as it was unmaintained upstream"; # Added 2025-05-17
@@ -1945,6 +1948,7 @@ mapAliases {
   unifiStable = throw "'unifiStable' has been removed since UniFi no longer has LTS and stable releases. Use `pkgs.unifi` instead."; # Converted to throw 2024-04-11
   unl0kr = throw "'unl0kr' is now included with buffybox. Use `pkgs.buffybox` instead."; # Removed 2024-12-20
   untrunc = throw "'untrunc' has been renamed to/replaced by 'untrunc-anthwlock'"; # Converted to throw 2024-10-17
+  unzoo = throw "'unzoo' has been removed since it is unmaintained upstream and doesn't compile with newer versions of GCC anymore"; # Removed 2025-05-24
   uq = throw "'uq' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   urxvt_autocomplete_all_the_things = throw "'urxvt_autocomplete_all_the_things' has been renamed to/replaced by 'rxvt-unicode-plugins.autocomplete-all-the-things'"; # Converted to throw 2024-10-17
   urxvt_bidi = throw "'urxvt_bidi' has been renamed to/replaced by 'rxvt-unicode-plugins.bidi'"; # Converted to throw 2024-10-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9456fb6e02d1..d8b7fafcfa38 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -843,10 +843,6 @@ with pkgs;
 
   substitute = callPackage ../build-support/substitute/substitute.nix { };
 
-  substituteAll = callPackage ../build-support/substitute/substitute-all.nix { };
-
-  substituteAllFiles = callPackage ../build-support/substitute-files/substitute-all-files.nix { };
-
   replaceDependencies = callPackage ../build-support/replace-dependencies.nix { };
 
   replaceDependency =
@@ -1931,9 +1927,6 @@ with pkgs;
     charles5
     ;
 
-  quaternion-qt5 =
-    libsForQt5.callPackage ../applications/networking/instant-messengers/quaternion
-      { };
   quaternion-qt6 =
     qt6Packages.callPackage ../applications/networking/instant-messengers/quaternion
       { };
@@ -2343,7 +2336,7 @@ with pkgs;
 
   mpd-sima = python3Packages.callPackage ../tools/audio/mpd-sima { };
 
-  nltk-data = callPackage ../tools/text/nltk-data { };
+  nltk-data = lib.recurseIntoAttrs (callPackage ../tools/text/nltk-data { });
 
   seabios-coreboot = seabios.override { ___build-type = "coreboot"; };
   seabios-csm = seabios.override { ___build-type = "csm"; };