diff --git a/maintainers/README.md b/maintainers/README.md
index 91da7847fdbc..ee1762a34536 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -42,7 +42,7 @@ package's `meta.maintainers` list, and send a PR with the changes.
 
 If you're adding yourself as a maintainer as part of another PR (in which
 you become a maintainer of a package, for example), make your change to
-`maintainer-list.nix` in a separate commit.
+`maintainer-list.nix` in a separate commit titled `maintainers: add <name>`.
 
 ### How to lose maintainer status
 
@@ -58,10 +58,34 @@ person as a reviewer, and then waiting a week for a reaction.
 
 The maintainer is welcome to come back at any time.
 
-### Tools for maintainers
+## Tools for maintainers
 
-When a pull request is made against a package, OfBorg will notify the
-appropriate maintainer(s).
+When a pull request is made against a package, nixpkgs CI will notify the appropriate
+maintainer(s) by trying to correlate the files the PR touches with the packages that need rebuilding.
+
+Maintainers can also invoke the [nixpkgs-merge-bot](https://github.com/nixos/nixpkgs-merge-bot)
+to merge pull requests targeting packages they are the maintainer of, which satisfy the current
+security [constraints](https://github.com/NixOS/nixpkgs-merge-bot/blob/main/README.md#constraints).
+Examples: [#397273](https://github.com/NixOS/nixpkgs/pull/397273#issuecomment-2789382120) and [#377027](https://github.com/NixOS/nixpkgs/pull/377027#issuecomment-2614510869)
+
+New maintainers will automatically get invited to join the [NixOS/nixpkgs-maintainers](https://github.com/orgs/NixOS/teams/nixpkgs-maintainers) GitHub team.
+By joining, you will get some triaging rights in the nixpkgs repository, like the ability to close and reopen issues made by others, and managing labels.
+However, the GitHub team invite is usually only sent by email, and is only valid for one week!
+Should it expire, please ask for a re-invite in the [GitHub org owners help desk Matrix channel](https://matrix.to/#/#org_owners:nixos.org).
+
+### Unofficial maintainer tooling
+
+[zh.fail](https://zh.fail/failed/overview.html) tracks all package build failures on `master` grouped by maintainer.
+
+[asymmetric/nixpkgs-update-notifier](https://github.com/asymmetric/nixpkgs-update-notifier) is a matrix
+bot that scrapes the [nixpkgs-update logs](https://nixpkgs-update-logs.nix-community.org/) and notifies
+you if nixpkgs-update/@r-ryantm fails to update any of the packages you've subscribed to.
+
+[repology.org](https://repology.org) tracks and compares the versions of packages between various package repositories, letting you know what packages may be out of date or insecure.
+You can view which packages a specific maintainer maintains and subscribe to updates with atom/rss. Example: [repology.org/maintainer/pbsds](https://repology.org/maintainer/pbsds%40hotmail.com).
+
+[nixpk.gs/pr-tracker](https://nixpk.gs/pr-tracker.html) and [nixpkgs-tracker.ocfox.me](https://nixpkgs-tracker.ocfox.me/)
+can visualize the release status of any nixpkgs pull request.
 
 ## Reviewing contributions
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 17c86233489e..b52b69f170d6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4063,6 +4063,12 @@
       }
     ];
   };
+  cameroncuttingedge = {
+    email = "buckets-taxiway5l@icloud.com";
+    github = "cameroncuttingedge";
+    githubId = 109548666;
+    name = "Cameron Byte";
+  };
   camerondugan = {
     email = "cameron.dugan@protonmail.com";
     github = "camerondugan";
@@ -26579,6 +26585,12 @@
     githubId = 45292658;
     name = "Julius Schmitt";
   };
+  voidnoi = {
+    email = "voidnoi@proton.me";
+    github = "VoidNoi";
+    githubId = 83523507;
+    name = "voidnoi";
+  };
   vojta001 = {
     email = "vojtech.kane@gmail.com";
     github = "vojta001";
diff --git a/nixos/modules/services/mail/postfix-tlspol.nix b/nixos/modules/services/mail/postfix-tlspol.nix
index 01373659da4a..dd49700734df 100644
--- a/nixos/modules/services/mail/postfix-tlspol.nix
+++ b/nixos/modules/services/mail/postfix-tlspol.nix
@@ -10,6 +10,7 @@ let
     hasPrefix
     mkEnableOption
     mkIf
+    mkMerge
     mkOption
     mkPackageOption
     types
@@ -18,6 +19,7 @@ let
   cfg = config.services.postfix-tlspol;
 
   format = pkgs.formats.yaml_1_2 { };
+  configFile = format.generate "postfix-tlspol.yaml" cfg.settings;
 in
 
 {
@@ -121,100 +123,119 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    environment.etc."postfix-tlspol/config.yaml".source =
-      format.generate "postfix-tlspol.yaml" cfg.settings;
-
-    environment.systemPackages = [ cfg.package ];
-
-    # https://github.com/Zuplu/postfix-tlspol#postfix-configuration
-    services.postfix.config = mkIf (config.services.postfix.enable && cfg.configurePostfix) {
-      smtp_dns_support_level = "dnssec";
-      smtp_tls_security_level = "dane";
-      smtp_tls_policy_maps =
-        let
-          address =
-            if (hasPrefix "unix:" cfg.settings.server.address) then
-              cfg.settings.server.address
-            else
-              "inet:${cfg.settings.server.address}";
-        in
-        [ "socketmap:${address}:QUERYwithTLSRPT" ];
-    };
-
-    systemd.services.postfix-tlspol = {
-      after = [
-        "nss-lookup.target"
-        "network-online.target"
-      ];
-      wants = [
-        "nss-lookup.target"
-        "network-online.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-
-      description = "Postfix DANE/MTA-STS TLS policy socketmap service";
-      documentation = [ "https://github.com/Zuplu/postfix-tlspol" ];
-
-      # https://github.com/Zuplu/postfix-tlspol/blob/main/init/postfix-tlspol.service
-      serviceConfig = {
-        ExecStart = toString [
-          (lib.getExe cfg.package)
-          "-config"
-          "/etc/postfix-tlspol/config.yaml"
-        ];
-        ExecReload = "${lib.getExe' pkgs.util-linux "kill"} -HUP $MAINPID";
-        Restart = "always";
-        RestartSec = 5;
-
-        DynamicUser = true;
-
-        CacheDirectory = "postfix-tlspol";
-        CapabilityBoundingSet = [ "" ];
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        ReadOnlyPaths = [ "/etc/postfix-tlspol/config.yaml" ];
-        RemoveIPC = true;
-        RestrictAddressFamilies =
-          [
-            "AF_INET"
-            "AF_INET6"
-          ]
-          ++ lib.optionals (lib.hasPrefix "unix:" cfg.settings.server.address) [
-            "AF_UNIX"
-          ];
-        RestrictNamespace = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged @resources"
-        ];
-        SystemCallErrorNumber = "EPERM";
-        SecureBits = [
-          "noroot"
-          "noroot-locked"
-        ];
-        RuntimeDirectory = "postfix-tlspol";
-        RuntimeDirectoryMode = "1750";
-        WorkingDirectory = "/var/cache/postfix-tlspol";
-        UMask = "0117";
+  config = mkMerge [
+    (mkIf (cfg.enable && config.services.postfix.enable && cfg.configurePostfix) {
+      # https://github.com/Zuplu/postfix-tlspol#postfix-configuration
+      services.postfix.config = {
+        smtp_dns_support_level = "dnssec";
+        smtp_tls_security_level = "dane";
+        smtp_tls_policy_maps =
+          let
+            address =
+              if (hasPrefix "unix:" cfg.settings.server.address) then
+                cfg.settings.server.address
+              else
+                "inet:${cfg.settings.server.address}";
+          in
+          [ "socketmap:${address}:QUERYwithTLSRPT" ];
       };
-    };
-  };
+
+      systemd.services.postfix = {
+        wants = [ "postfix-tlspol.service" ];
+        after = [ "postfix-tlspol.service" ];
+      };
+
+      users.users.postfix.extraGroups = [ "postfix-tlspol" ];
+    })
+
+    (mkIf cfg.enable {
+      environment.etc."postfix-tlspol/config.yaml".source = configFile;
+
+      environment.systemPackages = [ cfg.package ];
+
+      users.users.postfix-tlspol = {
+        isSystemUser = true;
+        group = "postfix-tlspol";
+      };
+      users.groups.postfix-tlspol = { };
+
+      systemd.services.postfix-tlspol = {
+        after = [
+          "nss-lookup.target"
+          "network-online.target"
+        ];
+        wants = [
+          "nss-lookup.target"
+          "network-online.target"
+        ];
+        wantedBy = [ "multi-user.target" ];
+
+        description = "Postfix DANE/MTA-STS TLS policy socketmap service";
+        documentation = [ "https://github.com/Zuplu/postfix-tlspol" ];
+
+        reloadTriggers = [ configFile ];
+
+        # https://github.com/Zuplu/postfix-tlspol/blob/main/init/postfix-tlspol.service
+        serviceConfig = {
+          ExecStart = toString [
+            (lib.getExe cfg.package)
+            "-config"
+            "/etc/postfix-tlspol/config.yaml"
+          ];
+          ExecReload = "${lib.getExe' pkgs.util-linux "kill"} -HUP $MAINPID";
+          Restart = "always";
+          RestartSec = 5;
+
+          User = "postfix-tlspol";
+          Group = "postfix-tlspol";
+
+          CacheDirectory = "postfix-tlspol";
+          CapabilityBoundingSet = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          ReadOnlyPaths = [ "/etc/postfix-tlspol/config.yaml" ];
+          RemoveIPC = true;
+          RestrictAddressFamilies =
+            [
+              "AF_INET"
+              "AF_INET6"
+            ]
+            ++ lib.optionals (lib.hasPrefix "unix:" cfg.settings.server.address) [
+              "AF_UNIX"
+            ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged @resources"
+          ];
+          SystemCallErrorNumber = "EPERM";
+          SecureBits = [
+            "noroot"
+            "noroot-locked"
+          ];
+          RuntimeDirectory = "postfix-tlspol";
+          RuntimeDirectoryMode = "1750";
+          WorkingDirectory = "/var/cache/postfix-tlspol";
+          UMask = "0117";
+        };
+      };
+    })
+  ];
 }
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 2034547db67e..d3b7e3b2e766 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -27,6 +27,9 @@ let
 
     ${optionalString (cfg.extraConfig != null) cfg.extraConfig}
   '';
+
+  inherit (cfg.settings) mailer;
+  useSendmail = mailer.ENABLED && mailer.PROTOCOL == "sendmail";
 in
 
 {
@@ -366,15 +369,6 @@ in
         description = "Path to a file containing the SMTP password.";
       };
 
-      mailerUseSendmail = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Use the operating system's sendmail command instead of SMTP.
-          Note: some sandbox settings will be disabled.
-        '';
-      };
-
       metricsTokenFile = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -422,120 +416,157 @@ in
             };
           }
         '';
-        type = types.submodule {
-          freeformType = format.type;
-          options = {
-            log = {
-              ROOT_PATH = mkOption {
-                default = "${cfg.stateDir}/log";
-                defaultText = literalExpression ''"''${config.${opt.stateDir}}/log"'';
-                type = types.str;
-                description = "Root path for log files.";
+        type = types.submodule (
+          { config, options, ... }:
+          {
+            freeformType = format.type;
+            options = {
+              log = {
+                ROOT_PATH = mkOption {
+                  default = "${cfg.stateDir}/log";
+                  defaultText = literalExpression ''"''${config.${opt.stateDir}}/log"'';
+                  type = types.str;
+                  description = "Root path for log files.";
+                };
+                LEVEL = mkOption {
+                  default = "Info";
+                  type = types.enum [
+                    "Trace"
+                    "Debug"
+                    "Info"
+                    "Warn"
+                    "Error"
+                    "Critical"
+                  ];
+                  description = "General log level.";
+                };
               };
-              LEVEL = mkOption {
-                default = "Info";
-                type = types.enum [
-                  "Trace"
-                  "Debug"
-                  "Info"
-                  "Warn"
-                  "Error"
-                  "Critical"
-                ];
-                description = "General log level.";
+
+              mailer = {
+                ENABLED = lib.mkOption {
+                  type = lib.types.bool;
+                  default = false;
+                  description = "Whether to use an email service to send notifications.";
+                };
+
+                PROTOCOL = lib.mkOption {
+                  type = lib.types.enum [
+                    null
+                    "smtp"
+                    "smtps"
+                    "smtp+starttls"
+                    "smtp+unix"
+                    "sendmail"
+                    "dummy"
+                  ];
+                  default = null;
+                  description = "Which mail server protocol to use.";
+                };
+
+                SENDMAIL_PATH = lib.mkOption {
+                  type = lib.types.path;
+                  # somewhat duplicated with useSendmail but cannot be deduped because of infinite recursion
+                  default =
+                    if config.mailer.ENABLED && config.mailer.PROTOCOL == "sendmail" then
+                      "/run/wrappers/bin/sendmail"
+                    else
+                      "sendmail";
+                  defaultText = lib.literalExpression ''if config.${options.mailer.ENABLED} && config.${options.mailer.PROTOCOL} == "sendmail" then "/run/wrappers/bin/sendmail" else "sendmail"'';
+                  description = "Path to sendmail binary or script.";
+                };
+              };
+
+              server = {
+                PROTOCOL = mkOption {
+                  type = types.enum [
+                    "http"
+                    "https"
+                    "fcgi"
+                    "http+unix"
+                    "fcgi+unix"
+                  ];
+                  default = "http";
+                  description = ''Listen protocol. `+unix` means "over unix", not "in addition to."'';
+                };
+
+                HTTP_ADDR = mkOption {
+                  type = types.either types.str types.path;
+                  default =
+                    if lib.hasSuffix "+unix" cfg.settings.server.PROTOCOL then "/run/gitea/gitea.sock" else "0.0.0.0";
+                  defaultText = literalExpression ''if lib.hasSuffix "+unix" cfg.settings.server.PROTOCOL then "/run/gitea/gitea.sock" else "0.0.0.0"'';
+                  description = "Listen address. Must be a path when using a unix socket.";
+                };
+
+                HTTP_PORT = mkOption {
+                  type = types.port;
+                  default = 3000;
+                  description = "Listen port. Ignored when using a unix socket.";
+                };
+
+                DOMAIN = mkOption {
+                  type = types.str;
+                  default = "localhost";
+                  description = "Domain name of your server.";
+                };
+
+                ROOT_URL = mkOption {
+                  type = types.str;
+                  default = "http://${cfg.settings.server.DOMAIN}:${toString cfg.settings.server.HTTP_PORT}/";
+                  defaultText = literalExpression ''"http://''${config.services.gitea.settings.server.DOMAIN}:''${toString config.services.gitea.settings.server.HTTP_PORT}/"'';
+                  description = "Full public URL of gitea server.";
+                };
+
+                STATIC_ROOT_PATH = mkOption {
+                  type = types.either types.str types.path;
+                  default = cfg.package.data;
+                  defaultText = literalExpression "config.${opt.package}.data";
+                  example = "/var/lib/gitea/data";
+                  description = "Upper level of template and static files path.";
+                };
+
+                DISABLE_SSH = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = "Disable external SSH feature.";
+                };
+
+                SSH_PORT = mkOption {
+                  type = types.port;
+                  default = 22;
+                  example = 2222;
+                  description = ''
+                    SSH port displayed in clone URL.
+                    The option is required to configure a service when the external visible port
+                    differs from the local listening port i.e. if port forwarding is used.
+                  '';
+                };
+              };
+
+              service = {
+                DISABLE_REGISTRATION = mkEnableOption "the registration lock" // {
+                  description = ''
+                    By default any user can create an account on this `gitea` instance.
+                    This can be disabled by using this option.
+
+                    *Note:* please keep in mind that this should be added after the initial
+                    deploy as the first registered user will be the administrator.
+                  '';
+                };
+              };
+
+              session = {
+                COOKIE_SECURE = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = ''
+                    Marks session cookies as "secure" as a hint for browsers to only send
+                    them via HTTPS. This option is recommend, if gitea is being served over HTTPS.
+                  '';
+                };
               };
             };
-
-            server = {
-              PROTOCOL = mkOption {
-                type = types.enum [
-                  "http"
-                  "https"
-                  "fcgi"
-                  "http+unix"
-                  "fcgi+unix"
-                ];
-                default = "http";
-                description = ''Listen protocol. `+unix` means "over unix", not "in addition to."'';
-              };
-
-              HTTP_ADDR = mkOption {
-                type = types.either types.str types.path;
-                default =
-                  if lib.hasSuffix "+unix" cfg.settings.server.PROTOCOL then "/run/gitea/gitea.sock" else "0.0.0.0";
-                defaultText = literalExpression ''if lib.hasSuffix "+unix" cfg.settings.server.PROTOCOL then "/run/gitea/gitea.sock" else "0.0.0.0"'';
-                description = "Listen address. Must be a path when using a unix socket.";
-              };
-
-              HTTP_PORT = mkOption {
-                type = types.port;
-                default = 3000;
-                description = "Listen port. Ignored when using a unix socket.";
-              };
-
-              DOMAIN = mkOption {
-                type = types.str;
-                default = "localhost";
-                description = "Domain name of your server.";
-              };
-
-              ROOT_URL = mkOption {
-                type = types.str;
-                default = "http://${cfg.settings.server.DOMAIN}:${toString cfg.settings.server.HTTP_PORT}/";
-                defaultText = literalExpression ''"http://''${config.services.gitea.settings.server.DOMAIN}:''${toString config.services.gitea.settings.server.HTTP_PORT}/"'';
-                description = "Full public URL of gitea server.";
-              };
-
-              STATIC_ROOT_PATH = mkOption {
-                type = types.either types.str types.path;
-                default = cfg.package.data;
-                defaultText = literalExpression "config.${opt.package}.data";
-                example = "/var/lib/gitea/data";
-                description = "Upper level of template and static files path.";
-              };
-
-              DISABLE_SSH = mkOption {
-                type = types.bool;
-                default = false;
-                description = "Disable external SSH feature.";
-              };
-
-              SSH_PORT = mkOption {
-                type = types.port;
-                default = 22;
-                example = 2222;
-                description = ''
-                  SSH port displayed in clone URL.
-                  The option is required to configure a service when the external visible port
-                  differs from the local listening port i.e. if port forwarding is used.
-                '';
-              };
-            };
-
-            service = {
-              DISABLE_REGISTRATION = mkEnableOption "the registration lock" // {
-                description = ''
-                  By default any user can create an account on this `gitea` instance.
-                  This can be disabled by using this option.
-
-                  *Note:* please keep in mind that this should be added after the initial
-                  deploy as the first registered user will be the administrator.
-                '';
-              };
-            };
-
-            session = {
-              COOKIE_SECURE = mkOption {
-                type = types.bool;
-                default = false;
-                description = ''
-                  Marks session cookies as "secure" as a hint for browsers to only send
-                  them via HTTPS. This option is recommend, if gitea is being served over HTTPS.
-                '';
-              };
-            };
-          };
-        };
+          }
+        );
       };
 
       extraConfig = mkOption {
@@ -663,15 +694,9 @@ in
           })
         ]);
 
-        mailer = mkMerge [
-          (mkIf (cfg.mailerPasswordFile != null) {
-            PASSWD = "#mailerpass#";
-          })
-          (mkIf cfg.mailerUseSendmail {
-            PROTOCOL = "sendmail";
-            SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
-          })
-        ];
+        mailer = mkIf (cfg.mailerPasswordFile != null) {
+          PASSWD = "#mailerpass#";
+        };
 
         metrics = mkIf (cfg.metricsTokenFile != null) {
           TOKEN = "#metricstoken#";
@@ -884,18 +909,18 @@ in
           cfg.repositoryRoot
           cfg.stateDir
           cfg.lfs.contentDir
-        ] ++ optional cfg.mailerUseSendmail "/var/lib/postfix/queue/maildrop";
+        ] ++ lib.optional (useSendmail && config.services.postfix.enable) "/var/lib/postfix/queue/maildrop";
         UMask = "0027";
         # Capabilities
         CapabilityBoundingSet = "";
         # Security
-        NoNewPrivileges = optional (!cfg.mailerUseSendmail) true;
+        NoNewPrivileges = !useSendmail;
         # Sandboxing
         ProtectSystem = "strict";
         ProtectHome = true;
         PrivateTmp = true;
         PrivateDevices = true;
-        PrivateUsers = optional (!cfg.mailerUseSendmail) true;
+        PrivateUsers = !useSendmail;
         ProtectHostname = true;
         ProtectClock = true;
         ProtectKernelTunables = true;
@@ -906,7 +931,7 @@ in
           "AF_UNIX"
           "AF_INET"
           "AF_INET6"
-        ] ++ optional cfg.mailerUseSendmail "AF_NETLINK";
+        ] ++ lib.optional (useSendmail && config.services.postfix.enable) "AF_NETLINK";
         RestrictNamespaces = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
@@ -916,10 +941,14 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "~@cpu-emulation @debug @keyring @mount @obsolete @setuid"
-          "setrlimit"
-        ] ++ optional (!cfg.mailerUseSendmail) "~@privileged";
+        SystemCallFilter =
+          [
+            "~@cpu-emulation @debug @keyring @mount @obsolete @setuid"
+            "setrlimit"
+          ]
+          ++ lib.optionals (!useSendmail) [
+            "~@privileged"
+          ];
       };
 
       environment = {
@@ -997,7 +1026,6 @@ in
   };
 
   meta.maintainers = with lib.maintainers; [
-    ma27
     techknowlogick
     SuperSandro2000
   ];
diff --git a/nixos/tests/postfix-tlspol.nix b/nixos/tests/postfix-tlspol.nix
index 0c76257f6a5a..0d03c1d82052 100644
--- a/nixos/tests/postfix-tlspol.nix
+++ b/nixos/tests/postfix-tlspol.nix
@@ -8,15 +8,20 @@
   meta.maintainers = with lib.maintainers; [ hexa ];
 
   nodes.machine = {
+    services.postfix.enable = true;
     services.postfix-tlspol.enable = true;
-  };
 
-  enableOCR = true;
+    services.dnsmasq = {
+      enable = true;
+      settings.selfmx = true;
+    };
+  };
 
   testScript = ''
     import json
 
     machine.wait_for_unit("postfix-tlspol.service")
+    machine.succeed("getent group postfix-tlspol | grep :postfix")
 
     with subtest("Interact with the service"):
       machine.succeed("postfix-tlspol -purge")
@@ -24,6 +29,10 @@
       response = json.loads((machine.succeed("postfix-tlspol -query localhost")))
       machine.log(json.dumps(response, indent=2))
 
+      assert response["dane"]["policy"] == "", f"Unexpected DANE policy for localhost: {response["dane"]["policy"]}"
+      assert response["mta-sts"]["policy"] == "", f"Unexpected MTA-STS policy for localhost: {response["mta-sts"]["policy"]}"
+
+    machine.log(machine.execute("systemd-analyze security postfix-tlspol.service | grep -v ✓")[1])
   '';
 
 }
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix b/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
index 0ba3b4e34175..d24598086008 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-saturn.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-saturn";
-  version = "0-unstable-2025-03-16";
+  version = "0-unstable-2025-06-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-saturn-libretro";
-    rev = "06c9daa7ff6de42955437d29a80d8fc4ececc8d3";
-    hash = "sha256-HTOT4/NmfcVjte61FjkqL9neKVQrH7P4dZjmIC9fy0k=";
+    rev = "e6c4275f1bc93163a35db30cbd5399c046cf112d";
+    hash = "sha256-CnjBf/dWkbzwhvsnmYAJFC254mQ7+QkcLu4GavZhg5s=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/video/kodi/addons/formula1/default.nix b/pkgs/applications/video/kodi/addons/formula1/default.nix
index 8c2ff2e7b429..7ca5ddb67627 100644
--- a/pkgs/applications/video/kodi/addons/formula1/default.nix
+++ b/pkgs/applications/video/kodi/addons/formula1/default.nix
@@ -10,11 +10,11 @@
 buildKodiAddon rec {
   pname = "formula1";
   namespace = "plugin.video.formula1";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-tyVq/yfnPQ5NAnlYCT8lF/s2voh4NOQPRawXX1+ryTU=";
+    sha256 = "sha256-zOEf1CXywEqUpBhan03xjVQ3Rjp3h08X2OgQ4GAjwJQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/video/kodi/addons/sendtokodi/default.nix b/pkgs/applications/video/kodi/addons/sendtokodi/default.nix
index 6db0cb685c9c..1fa75900b7d4 100644
--- a/pkgs/applications/video/kodi/addons/sendtokodi/default.nix
+++ b/pkgs/applications/video/kodi/addons/sendtokodi/default.nix
@@ -4,42 +4,41 @@
   fetchFromGitHub,
   kodi,
   inputstreamhelper,
+  requests,
 }:
 
 buildKodiAddon rec {
   pname = "sendtokodi";
   namespace = "plugin.video.sendtokodi";
-  version = "0.9.557";
+  version = "0.9.924";
 
   src = fetchFromGitHub {
     owner = "firsttris";
     repo = "plugin.video.sendtokodi";
-    rev = "v${version}";
-    hash = "sha256-Ga+9Q7x8+sEmQmteHbSyCahZ/T/l28BAEM84w7bf7z8=";
+    tag = "v${version}";
+    hash = "sha256-ycp5/NbRX2rcRRpbpX6LlplyxdfoIwCw39EyQDcyzOU=";
   };
 
   patches = [
-    # Unconditionally depend on packaged yt-dlp. This removes the ability to
-    # use youtube_dl, which is unmaintained and considered vulnerable (see
-    # CVE-2024-38519).
-    ./use-packaged-yt-dlp.patch
+    # Use yt-dlp, only. This removes the ability to use youtube_dl, which is
+    # unmaintained and considered vulnerable (see CVE-2024-38519).
+    ./use-yt-dlp-only.patch
   ];
 
   propagatedBuildInputs = [
     inputstreamhelper
+    requests
   ];
 
   postPatch = ''
-    # Remove vendored youtube-dl and yt-dlp libraries.
-    rm -r lib/
+    # Remove youtube-dl, which is unmaintained and vulnerable.
+    rm -r lib/youtube_dl lib/youtube_dl_version
+    # Replace yt-dlp with our own packaged version thereof.
+    rm -r lib/yt_dlp
+    echo "${lib.strings.getVersion kodi.pythonPackages.yt-dlp}" >lib/yt_dlp_version
+    ln -s ${kodi.pythonPackages.yt-dlp}/${kodi.pythonPackages.python.sitePackages}/yt_dlp lib/
   '';
 
-  passthru = {
-    # Instead of the vendored libraries, we propagate yt-dlp via the Python
-    # path.
-    pythonPath = with kodi.pythonPackages; makePythonPath [ yt-dlp ];
-  };
-
   meta = with lib; {
     homepage = "https://github.com/firsttris/plugin.video.sendtokodi";
     description = "Plays various stream sites on Kodi using yt-dlp";
diff --git a/pkgs/applications/video/kodi/addons/sendtokodi/use-packaged-yt-dlp.patch b/pkgs/applications/video/kodi/addons/sendtokodi/use-yt-dlp-only.patch
similarity index 50%
rename from pkgs/applications/video/kodi/addons/sendtokodi/use-packaged-yt-dlp.patch
rename to pkgs/applications/video/kodi/addons/sendtokodi/use-yt-dlp-only.patch
index b53e1a434fff..fb889b2b2319 100644
--- a/pkgs/applications/video/kodi/addons/sendtokodi/use-packaged-yt-dlp.patch
+++ b/pkgs/applications/video/kodi/addons/sendtokodi/use-yt-dlp-only.patch
@@ -1,18 +1,18 @@
 diff --git a/service.py b/service.py
-index 024ad9a..6ef71dd 100644
+index 5d588682..99123b4b 100644
 --- a/service.py
 +++ b/service.py
-@@ -243,11 +243,8 @@ def playlistIndex(url, playlist):
+@@ -323,12 +323,7 @@ if not sys.argv[2]:
+     xbmcaddon.Addon().openSettings()
+     exit()
  
- 
- # Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+)
+-# Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+)
 -if xbmcplugin.getSetting(int(sys.argv[1]),"resolver") == "0" or sys.version_info[0] == 2:
--    from lib.youtube_dl import YoutubeDL
+-    from youtube_dl import YoutubeDL
 -else:
--    from lib.yt_dlp import YoutubeDL
--    
+-   # import lib.yt_dlp as yt_dlp
+-    from yt_dlp import YoutubeDL
 +from yt_dlp import YoutubeDL
-+
+ 
  # patch broken strptime (see above)
  patch_strptime()
- 
diff --git a/pkgs/by-name/bi/bitwarden-desktop/fix-lock-files.diff b/pkgs/by-name/bi/bitwarden-desktop/fix-lock-files.diff
new file mode 100644
index 000000000000..0fb95a72f799
--- /dev/null
+++ b/pkgs/by-name/bi/bitwarden-desktop/fix-lock-files.diff
@@ -0,0 +1,282 @@
+diff --git a/apps/cli/package.json b/apps/cli/package.json
+index 2ec4e6f697..db5981b5ec 100644
+--- a/apps/cli/package.json
++++ b/apps/cli/package.json
+@@ -85,7 +85,7 @@
+     "multer": "1.4.5-lts.2",
+     "node-fetch": "2.6.12",
+     "node-forge": "1.3.1",
+-    "open": "10.1.2",
++    "open": "8.4.2",
+     "papaparse": "5.5.3",
+     "proper-lockfile": "4.1.2",
+     "rxjs": "7.8.1",
+diff --git a/apps/desktop/desktop_native/Cargo.lock b/apps/desktop/desktop_native/Cargo.lock
+index 05663ea7e0..eadd75e598 100644
+--- a/apps/desktop/desktop_native/Cargo.lock
++++ b/apps/desktop/desktop_native/Cargo.lock
+@@ -162,7 +162,7 @@ dependencies = [
+  "serde_repr",
+  "tokio",
+  "url",
+- "zbus 5.6.0",
++ "zbus",
+ ]
+ 
+ [[package]]
+@@ -900,7 +900,7 @@ dependencies = [
+  "widestring",
+  "windows 0.61.1",
+  "windows-future",
+- "zbus 4.4.0",
++ "zbus",
+  "zbus_polkit",
+  "zeroizing-alloc",
+ ]
+@@ -2063,10 +2063,10 @@ dependencies = [
+  "sha2",
+  "subtle",
+  "tokio",
+- "zbus 5.6.0",
+- "zbus_macros 5.6.0",
++ "zbus",
++ "zbus_macros",
+  "zeroize",
+- "zvariant 5.5.1",
++ "zvariant",
+ ]
+ 
+ [[package]]
+@@ -2715,17 +2715,6 @@ dependencies = [
+  "syn",
+ ]
+ 
+-[[package]]
+-name = "sha1"
+-version = "0.10.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+-dependencies = [
+- "cfg-if",
+- "cpufeatures",
+- "digest",
+-]
+-
+ [[package]]
+ name = "sha2"
+ version = "0.10.8"
+@@ -3921,9 +3910,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "zbus"
+-version = "4.4.0"
++version = "5.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "bb97012beadd29e654708a0fdb4c84bc046f537aecfde2c3ee0a9e4b4d48c725"
++checksum = "59c333f648ea1b647bc95dc1d34807c8e25ed7a6feff3394034dc4776054b236"
+ dependencies = [
+  "async-broadcast",
+  "async-executor",
+@@ -3938,90 +3927,37 @@ dependencies = [
+  "enumflags2",
+  "event-listener",
+  "futures-core",
+- "futures-sink",
+- "futures-util",
+- "hex",
+- "nix",
+- "ordered-stream",
+- "rand 0.8.5",
+- "serde",
+- "serde_repr",
+- "sha1",
+- "static_assertions",
+- "tracing",
+- "uds_windows",
+- "windows-sys 0.52.0",
+- "xdg-home",
+- "zbus_macros 4.4.0",
+- "zbus_names 3.0.0",
+- "zvariant 4.2.0",
+-]
+-
+-[[package]]
+-name = "zbus"
+-version = "5.6.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2522b82023923eecb0b366da727ec883ace092e7887b61d3da5139f26b44da58"
+-dependencies = [
+- "async-broadcast",
+- "async-recursion",
+- "async-trait",
+- "enumflags2",
+- "event-listener",
+- "futures-core",
+  "futures-lite",
+  "hex",
+  "nix",
+  "ordered-stream",
+  "serde",
+  "serde_repr",
++ "static_assertions",
+  "tokio",
+  "tracing",
+  "uds_windows",
+  "windows-sys 0.59.0",
+  "winnow",
+- "zbus_macros 5.6.0",
+- "zbus_names 4.2.0",
+- "zvariant 5.5.1",
++ "xdg-home",
++ "zbus_macros",
++ "zbus_names",
++ "zvariant",
+ ]
+ 
+ [[package]]
+ name = "zbus_macros"
+-version = "4.4.0"
++version = "5.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "267db9407081e90bbfa46d841d3cbc60f59c0351838c4bc65199ecd79ab1983e"
++checksum = "f325ad10eb0d0a3eb060203494c3b7ec3162a01a59db75d2deee100339709fc0"
+ dependencies = [
+  "proc-macro-crate",
+  "proc-macro2",
+  "quote",
+  "syn",
+- "zvariant_utils 2.1.0",
+-]
+-
+-[[package]]
+-name = "zbus_macros"
+-version = "5.6.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "05d2e12843c75108c00c618c2e8ef9675b50b6ec095b36dc965f2e5aed463c15"
+-dependencies = [
+- "proc-macro-crate",
+- "proc-macro2",
+- "quote",
+- "syn",
+- "zbus_names 4.2.0",
+- "zvariant 5.5.1",
+- "zvariant_utils 3.2.0",
+-]
+-
+-[[package]]
+-name = "zbus_names"
+-version = "3.0.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "4b9b1fef7d021261cc16cba64c351d291b715febe0fa10dc3a443ac5a5022e6c"
+-dependencies = [
+- "serde",
+- "static_assertions",
+- "zvariant 4.2.0",
++ "zbus_names",
++ "zvariant",
++ "zvariant_utils",
+ ]
+ 
+ [[package]]
+@@ -4033,20 +3969,20 @@ dependencies = [
+  "serde",
+  "static_assertions",
+  "winnow",
+- "zvariant 5.5.1",
++ "zvariant",
+ ]
+ 
+ [[package]]
+ name = "zbus_polkit"
+-version = "4.0.0"
++version = "5.0.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "00a29bfa927b29f91b7feb4e1990f2dd1b4604072f493dc2f074cf59e4e0ba90"
++checksum = "ad23d5c4d198c7e2641b33e6e0d1f866f117408ba66fe80bbe52e289eeb77c52"
+ dependencies = [
+  "enumflags2",
+  "serde",
+  "serde_repr",
+  "static_assertions",
+- "zbus 4.4.0",
++ "zbus",
+ ]
+ 
+ [[package]]
+@@ -4149,19 +4085,6 @@ dependencies = [
+  "syn",
+ ]
+ 
+-[[package]]
+-name = "zvariant"
+-version = "4.2.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2084290ab9a1c471c38fc524945837734fbf124487e105daec2bb57fd48c81fe"
+-dependencies = [
+- "endi",
+- "enumflags2",
+- "serde",
+- "static_assertions",
+- "zvariant_derive 4.2.0",
+-]
+-
+ [[package]]
+ name = "zvariant"
+ version = "5.5.1"
+@@ -4173,21 +4096,8 @@ dependencies = [
+  "serde",
+  "url",
+  "winnow",
+- "zvariant_derive 5.5.1",
+- "zvariant_utils 3.2.0",
+-]
+-
+-[[package]]
+-name = "zvariant_derive"
+-version = "4.2.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "73e2ba546bda683a90652bac4a279bc146adad1386f25379cf73200d2002c449"
+-dependencies = [
+- "proc-macro-crate",
+- "proc-macro2",
+- "quote",
+- "syn",
+- "zvariant_utils 2.1.0",
++ "zvariant_derive",
++ "zvariant_utils",
+ ]
+ 
+ [[package]]
+@@ -4200,18 +4110,7 @@ dependencies = [
+  "proc-macro2",
+  "quote",
+  "syn",
+- "zvariant_utils 3.2.0",
+-]
+-
+-[[package]]
+-name = "zvariant_utils"
+-version = "2.1.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c51bcff7cc3dbb5055396bcf774748c3dab426b4b8659046963523cee4808340"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "syn",
++ "zvariant_utils",
+ ]
+ 
+ [[package]]
+diff --git a/package-lock.json b/package-lock.json
+index 5df63a79dd..702b6d1c81 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -225,7 +225,7 @@
+         "multer": "1.4.5-lts.2",
+         "node-fetch": "2.6.12",
+         "node-forge": "1.3.1",
+-        "open": "10.1.2",
++        "open": "8.4.2",
+         "papaparse": "5.5.3",
+         "proper-lockfile": "4.1.2",
+         "rxjs": "7.8.1",
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 0bfb9cc7c1c5..42652ea47797 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -5,7 +5,7 @@
   cargo,
   copyDesktopItems,
   darwin,
-  electron_34,
+  electron_36,
   fetchFromGitHub,
   gnome-keyring,
   jq,
@@ -25,7 +25,7 @@
 let
   description = "Secure and free password manager for all of your devices";
   icon = "bitwarden";
-  electron = electron_34;
+  electron = electron_36;
 
   # argon2 npm dependency is using `std::basic_string<uint8_t>`, which is no longer allowed in LLVM 19
   buildNpmPackage' = buildNpmPackage.override {
@@ -34,21 +34,27 @@ let
 in
 buildNpmPackage' rec {
   pname = "bitwarden-desktop";
-  version = "2025.5.1";
+  version = "2025.6.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-1gxd73E7Y7e1A6yU+J3XYQ4QzXZTxuKd+AE+t8HD478=";
+    hash = "sha256-KI6oIMNtqfywVqeTdzthSHBnAlF55cINTr04LNSq0AM=";
   };
 
   patches = [
     ./electron-builder-package-lock.patch
     ./dont-auto-setup-biometrics.patch
-    ./set-exe-path.patch # ensures `app.getPath("exe")` returns our wrapper, not ${electron}/bin/electron
-    ./skip-afterpack-and-aftersign.patch # on linux: don't flip fuses, don't create wrapper script, on darwin: don't try copying safari extensions, don't try re-signing app
-    ./dont-use-platform-triple.patch # since out arch doesn't match upstream, we'll generate and use desktop_napi.node instead of desktop_napi.${platform}-${arch}.node
+    # The nixpkgs tooling trips over upstreams inconsistent lock files, so we fixed them by running npm install open@10.2.1 and cargo b
+    ./fix-lock-files.diff
+
+    # ensures `app.getPath("exe")` returns our wrapper, not ${electron}/bin/electron
+    ./set-exe-path.patch
+    # on linux: don't flip fuses, don't create wrapper script, on darwin: don't try copying safari extensions, don't try re-signing app
+    ./skip-afterpack-and-aftersign.patch
+    # since out arch doesn't match upstream, we'll generate and use desktop_napi.node instead of desktop_napi.${platform}-${arch}.node
+    ./dont-use-platform-triple.patch
   ];
 
   postPatch = ''
@@ -76,7 +82,7 @@ buildNpmPackage' rec {
     "--ignore-scripts"
   ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-0IoBPRGdtkMeTrT5cqZLHB/WrUCONtsJ6YHh0y4K5Ls=";
+  npmDepsHash = "sha256-52cLVrfbeNeRH7OKN5QZdGD5VkUVliN0Rn/cbdohsG0=";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit
@@ -86,7 +92,7 @@ buildNpmPackage' rec {
       cargoRoot
       patches
       ;
-    hash = "sha256-ZD/UPYRa+HR7hyWDP6S/BKvQpYRDwWQJV6iGF9LT2uY=";
+    hash = "sha256-mt7zWKgH21khAIrfpBFzb+aS2V2mV56zMqCSLzDhGfQ=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index e07db8e7e67c..a1637948f347 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.6.1";
+  version = "2025.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-iM9AbL8K7Ka2B50/slp/Cfgb4kWWmOhZcMe0Ph3WnP0=";
+    hash = "sha256-45DhWxBvItl70mx/H42o9PqlIipvzIA/A9H6pKDO2fo=";
   };
 
   build-systems = with python.pkgs; [
diff --git a/pkgs/by-name/eu/euphonica/package.nix b/pkgs/by-name/eu/euphonica/package.nix
new file mode 100644
index 000000000000..02a024b807a9
--- /dev/null
+++ b/pkgs/by-name/eu/euphonica/package.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cargo,
+  meson,
+  ninja,
+  pkg-config,
+  rustPlatform,
+  rustc,
+  wrapGAppsHook4,
+  cairo,
+  dbus,
+  gdk-pixbuf,
+  glib,
+  gtk4,
+  libadwaita,
+  openssl,
+  pango,
+  pipewire,
+  sqlite,
+  desktop-file-utils,
+  libxml2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "euphonica";
+  version = "0.94.1-alpha";
+
+  src = fetchFromGitHub {
+    owner = "htkhiem";
+    repo = "euphonica";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1d2GZSTr0HnVC7D6T7LFeL8kXfwGBhjqZ3lC4ZjpOtM=";
+    fetchSubmodules = true;
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-vb9THfSTN27rOfIlpCPkAJm+eLnh+RptOYWLS8hGDpw=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    meson
+    ninja
+    pkg-config
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+    desktop-file-utils
+  ];
+
+  buildInputs = [
+    cairo
+    dbus
+    gdk-pixbuf
+    glib
+    gtk4
+    libadwaita
+    openssl
+    pango
+    pipewire
+    sqlite
+    libxml2
+  ];
+
+  meta = {
+    description = "MPD client with delusions of grandeur, made with Rust, GTK and Libadwaita";
+    homepage = "https://github.com/htkhiem/euphonica";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ paperdigits ];
+    mainProgram = "euphonica";
+    platforms = with lib.platforms; linux;
+  };
+})
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index 3490a80f9cac..5e78747dcc88 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -5,15 +5,15 @@
   makeWrapper,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2025-06-21";
+  version = "2025-06-27";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
-    rev = "refs/tags/${version}";
-    hash = "sha256-6mXku+SW6xmSYxd40Ilis8H/2Ozm6eUecLQHy1xeKtM=";
+    tag = finalAttrs.version;
+    hash = "sha256-Gm3SRdt6a3hSe64iP7j+5HQ5bGZ6s3eKvxFlCkQWZHo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -26,19 +26,19 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Archive of public exploits and corresponding vulnerable software";
     homepage = "https://gitlab.com/exploit-database/exploitdb";
-    license = with licenses; [
+    license = with lib.licenses; [
       gpl2Plus
       gpl3Plus
       mit
     ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       applePrincess
       fab
     ];
     mainProgram = "searchsploit";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/gi/github-distributed-owners/package.nix b/pkgs/by-name/gi/github-distributed-owners/package.nix
new file mode 100644
index 000000000000..4d8c8500e6d1
--- /dev/null
+++ b/pkgs/by-name/gi/github-distributed-owners/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "github-distributed-owners";
+  version = "0.1.11";
+
+  src = fetchFromGitHub {
+    owner = "andrewring";
+    repo = "github-distributed-owners";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oLRcH1lgRxlYIlyk3bPWO5YmCIq462YUjBjMSPOF7Ic=";
+  };
+
+  cargoHash = "sha256-pt/GoXF/uSU78pZqG8PgFe+tlbwZH2qpGQD7jgC52NM=";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Generate GitHub CODEOWNERS files from OWNERS files distributed through the file tree";
+    homepage = "https://github.com/andrewring/github-distributed-owners";
+    changelog = "https://github.com/andrewring/github-distributed-owners/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ cameroncuttingedge ];
+    mainProgram = "github-distributed-owners";
+  };
+})
diff --git a/pkgs/by-name/ko/komodo/package.nix b/pkgs/by-name/ko/komodo/package.nix
index 04525c148423..5be7c5360373 100644
--- a/pkgs/by-name/ko/komodo/package.nix
+++ b/pkgs/by-name/ko/komodo/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "komodo";
-  version = "1.18.3";
+  version = "1.18.4";
 
   src = fetchFromGitHub {
     owner = "moghtech";
     repo = "komodo";
     tag = "v${version}";
-    hash = "sha256-OBap1gKxFUh1QoR5waXi2IrWiTydhp/VtL9rGnEDJSI=";
+    hash = "sha256-allGKoeI3mlMWbF9WsDbX/4eGdBT/eoF71uAk5iK0e4=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-P7s+uEnh8CUmRLiBLz/yNbox8auHU5zFk8IiWGW0rAs=";
+  cargoHash = "sha256-nlCGrPlH+AZNz7BYDcoU0WBHBft4DnO4WfqGD5wVLmQ=";
 
   # disable for check. document generation is fail
   # > error: doctest failed, to rerun pass `-p komodo_client --doc`
diff --git a/pkgs/by-name/me/mesos-dns/package.nix b/pkgs/by-name/me/mesos-dns/package.nix
index d70fa1793cce..ecd23ade69ad 100644
--- a/pkgs/by-name/me/mesos-dns/package.nix
+++ b/pkgs/by-name/me/mesos-dns/package.nix
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/m3scluster/mesos-dns/releases/tag/v${finalAttrs.version}";
     description = "DNS-based service discovery for Mesos";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ aaronjheng ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "mesos-dns";
   };
 })
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index 354d77be9b5d..3ab197888b85 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.16.0";
+  version = "2.16.1";
 
   src = fetchFromGitHub {
     rev = "mimir-${version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-75KHS+jIPEvcB7SHBBcBi5uycwY7XR4RNc1khNYVZFE=";
+    hash = "sha256-+GFsWBjZHxRe3a2/ZT0zkoRXDTR4qopTUcU5Fx9t5xA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index ff6ae4b75440..84e93dc8cb72 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -26,13 +26,13 @@
   xorg,
 }:
 let
-  version = "2.16.3";
+  version = "2.17.1";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-mtzr/rRzcYcZl9tUkhxEKoFQWm1QTToOYZJXhynwDmk=";
+    hash = "sha256-6FvP/HgomsPxqCtKrZFxMlD2fFyT2e/JII2L7ANiOao=";
   };
 
   python = python3.override {
@@ -69,7 +69,7 @@ let
 
       pnpmDeps = pnpm.fetchDeps {
         inherit pname version src;
-        hash = "sha256-Z7c+AstVnxbPnEhc51qSqOYhRXqNJVwTvgHFcFp+pYg=";
+        hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
       };
 
       nativeBuildInputs =
diff --git a/pkgs/by-name/pl/plemoljp-hs/package.nix b/pkgs/by-name/pl/plemoljp-hs/package.nix
index fac60650ba94..edd261d80865 100644
--- a/pkgs/by-name/pl/plemoljp-hs/package.nix
+++ b/pkgs/by-name/pl/plemoljp-hs/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp-hs";
-  version = "2.0.4";
+  version = "3.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_HS_v${version}.zip";
-    hash = "sha256-+pRbMgRaIbsXo8e7rQre377F8LhbK9rBjG/vYrdeFQM=";
+    hash = "sha256-V21T8ktNZE4nq3SH6aN9iIJHmGTkZuMsvT84yHbwSqI=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pl/plemoljp-nf/package.nix b/pkgs/by-name/pl/plemoljp-nf/package.nix
index 8834539535cb..b54b18dada26 100644
--- a/pkgs/by-name/pl/plemoljp-nf/package.nix
+++ b/pkgs/by-name/pl/plemoljp-nf/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp-nf";
-  version = "2.0.4";
+  version = "3.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_NF_v${version}.zip";
-    hash = "sha256-6CMeo6YtWbEH/6xDD1yERhlMiCcOafAsQzcHeWQxuo4=";
+    hash = "sha256-m8zR9ySl88DnVzG4fKJtc9WjSLDMLU4YDX+KXhcP2WU=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pl/plemoljp/package.nix b/pkgs/by-name/pl/plemoljp/package.nix
index 981c486953b1..4aee3298f8b8 100644
--- a/pkgs/by-name/pl/plemoljp/package.nix
+++ b/pkgs/by-name/pl/plemoljp/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp";
-  version = "2.0.4";
+  version = "3.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_v${version}.zip";
-    hash = "sha256-pajE86IK05mm3Z507bvoMGy8JJwuGWZnUiSrXndiBTk=";
+    hash = "sha256-R4zC1pnM72FVqBQ5d03z8vyVccsM163BE15m2hdEnSA=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/se/serenityos-emoji-font/package.nix b/pkgs/by-name/se/serenityos-emoji-font/package.nix
new file mode 100644
index 000000000000..e51ad304a65a
--- /dev/null
+++ b/pkgs/by-name/se/serenityos-emoji-font/package.nix
@@ -0,0 +1,112 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  fetchzip,
+  python3Packages,
+  fetchpatch2,
+  parallel,
+}:
+let
+
+  pixart2svg = stdenvNoCC.mkDerivation {
+    name = "pixart2svg";
+    version = "0-unstable-2021-07-18";
+
+    src = fetchzip {
+      name = "pixart2svg";
+      url = "https://gist.github.com/m13253/66284bc244deeff0f0f8863c206421c7/archive/f9454958dc0a33cea787cc6fbd7e8e34ba6eb23b.zip";
+      hash = "sha256-lNA3qWK/bnUcMM/jrCGEgaX+HAk/DjKJnkE8niYmBDU=";
+    };
+
+    patches =
+      let
+        urlFor =
+          name:
+          "https://raw.githubusercontent.com/linusg/serenityos-emoji-font/11c84f33777a5d5bbe97ef2ffe8b74af7d72d27f/patches/${name}.patch";
+      in
+      [
+        (fetchpatch2 {
+          url = urlFor "0001-pixart2svg-rgba";
+          extraPrefix = "./";
+          hash = "sha256-/4a6btqp/6yiBnFhr4vI+SWfOopUjzDfOeW1Fs6Z5yU=";
+        })
+        (fetchpatch2 {
+          url = urlFor "0002-pixart2svg-no-style";
+          extraPrefix = "./";
+          hash = "sha256-FVurs+bEOat74d2egl21JS5ywdkFKKIsqXSFGSJI8MI=";
+        })
+        (fetchpatch2 {
+          url = urlFor "0003-pixart2svg-imageio-deprecation-warning";
+          extraPrefix = "./";
+          hash = "sha256-Vo3JIcXof+AtuEbsczNS3CUaBUEncCR0pnIuY4uF7R4=";
+        })
+      ];
+
+    installPhase = ''
+      mkdir -p $out
+      cp ./pixart2svg.py $out
+    '';
+  };
+
+in
+stdenvNoCC.mkDerivation {
+  name = "serenityos-emoji-font";
+  version = "0-unstable-2025-05-31";
+
+  src = fetchFromGitHub {
+    name = "serenity";
+    owner = "SerenityOS";
+    repo = "serenity";
+    rev = "35fd7a6770144259a05d41dfffbc8092495c4bf2";
+    hash = "sha256-i48egESwQKhcEAObSg2zqubgNdkXE5FlNa+Jukvg2X8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [
+      pixart2svg
+      parallel
+    ]
+    ++ (with python3Packages; [
+      imageio
+      nanoemoji
+      numpy
+    ]);
+
+  buildPhase = ''
+    runHook preBuild
+
+    mkdir -p svgfiles
+
+    total=$(ls -1 Base/res/emoji/*.png | wc -l)
+
+    parallel -j$NIX_BUILD_CORES \
+      echo [{#}/$total] Converting {/} \; python3 ${pixart2svg}/pixart2svg.py {} svgfiles/{/.}.svg \
+      ::: Base/res/emoji/*.png;
+
+    nanoemoji --family "SerenityOS Emoji" --output_file "SerenityOS-Emoji.ttf" --color_format glyf_colr_1 svgfiles/*.svg
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp build/SerenityOS-Emoji.ttf $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "SerenityOS pixel art emojis as a TTF";
+    homepage = "https://emoji.serenityos.org/";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [
+      voidnoi
+    ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/sh/shaperglot-cli/package.nix b/pkgs/by-name/sh/shaperglot-cli/package.nix
index 711959f26b34..94e17013e15c 100644
--- a/pkgs/by-name/sh/shaperglot-cli/package.nix
+++ b/pkgs/by-name/sh/shaperglot-cli/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "shaperglot-cli";
-  version = "0-unstable-2025-05-30";
+  version = "0-unstable-2025-06-20";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "shaperglot";
-    rev = "92878be90fabb7bdd93afd81121f4ed885f33d06";
-    hash = "sha256-Hrl/SVmRCEJLk+MR5fA4H0MTjy9hGgrM/HvAK3/lLIc=";
+    rev = "0c521f32f8fe5c927a4aac2236307547fa281972";
+    hash = "sha256-V7eBt0m82mW4NALWZeYVJD4TeU5l0kaOJPyDFxRSIUs=";
   };
 
-  cargoHash = "sha256-bWdO3YCWxKwgGjDdquY9COT5Ma2rRloOyWj51JZ45BE=";
+  cargoHash = "sha256-19amPodlTIxuBue8UT5PfWHUe4evmJsAHcrIAx6YVSk=";
 
   cargoBuildFlags = [
     "--package=shaperglot-cli"
diff --git a/pkgs/by-name/te/texlab/package.nix b/pkgs/by-name/te/texlab/package.nix
index 2a0bb57ad6e1..5e5f1b0a98b4 100644
--- a/pkgs/by-name/te/texlab/package.nix
+++ b/pkgs/by-name/te/texlab/package.nix
@@ -14,17 +14,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "5.23.0";
+  version = "5.23.1";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = "texlab";
     tag = "v${version}";
-    hash = "sha256-bKjogyIPrP3USDHsI4m8u44T+WYF1kyDz8eRpZ4j/xU=";
+    hash = "sha256-QGC2UFmbMCMr0i853M5mdXklqZFYy00fbqeLllpQ4Sg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Dblnlh9l3tQI4IYWVZdpLz0Hyvg4SY6O5R3Naz515QQ=";
+  cargoHash = "sha256-hJDKzHrNUmN4jqp4P1Is3mYvRC5H3nnHtIW7xjDH+xo=";
 
   outputs = [ "out" ] ++ lib.optional (!isCross) "man";
 
diff --git a/pkgs/by-name/tr/trickest-cli/package.nix b/pkgs/by-name/tr/trickest-cli/package.nix
index be9c68543242..03204b1428f2 100644
--- a/pkgs/by-name/tr/trickest-cli/package.nix
+++ b/pkgs/by-name/tr/trickest-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "trickest-cli";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "trickest";
     repo = "trickest-cli";
     tag = "v${version}";
-    hash = "sha256-43rLYXvAIr3wWImNLSHI/2g8AyxD557ZivWpC3he60o=";
+    hash = "sha256-OuCiW/5g4swtSpqM2rhLyB1syiRkyTbJsghEvyosz/A=";
   };
 
   vendorHash = "sha256-Ae0fNzYOAeCMrNFVhw4VvG/BkOMcguIMiBvLGt7wxEo=";
diff --git a/pkgs/by-name/up/upbound/sources-main.json b/pkgs/by-name/up/upbound/sources-main.json
index cbdbbe3b9af6..9d0d2cd9ba00 100644
--- a/pkgs/by-name/up/upbound/sources-main.json
+++ b/pkgs/by-name/up/upbound/sources-main.json
@@ -8,38 +8,38 @@
   "fetchurlAttrSet": {
     "docker-credential-up": {
       "aarch64-darwin": {
-        "hash": "sha256-EPJXlxa4Vx7jzdX5/ekIer/EKTAFuqWBcAp4mYyS+JA=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/docker-credential-up/darwin_arm64.tar.gz"
+        "hash": "sha256-ByiFy8k6qwKXTp7iLoojUNNKhhZnbqc6ms6g+r4f9u0=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/docker-credential-up/darwin_arm64.tar.gz"
       },
       "aarch64-linux": {
-        "hash": "sha256-cM8F+Qyg34ypdIusI2jFOzoxM3B+tLRyvmqdeUSpz0c=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/docker-credential-up/linux_arm64.tar.gz"
+        "hash": "sha256-qis91nt43HGEfuqcCH5ri/s4QiHiMrRMTinSUjQeI3o=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/docker-credential-up/linux_arm64.tar.gz"
       },
       "x86_64-darwin": {
-        "hash": "sha256-jvBe0GEDNMj3HlbMBFcwS1CA2y3QnDkYgv943GW0tLs=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/docker-credential-up/darwin_amd64.tar.gz"
+        "hash": "sha256-s2ORdd3G87Vo9I5zSZXGisjSMr0x86sCu6WOxOZBWTk=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/docker-credential-up/darwin_amd64.tar.gz"
       },
       "x86_64-linux": {
-        "hash": "sha256-c/tjuO3j+pYFlyGRAeA3jJLit4sZqreEzMa0LRxnTv0=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/docker-credential-up/linux_amd64.tar.gz"
+        "hash": "sha256-5q/XactXioaOqUYwrojg5xgZg+pKjqnxR9tB8ILaaHg=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/docker-credential-up/linux_amd64.tar.gz"
       }
     },
     "up": {
       "aarch64-darwin": {
-        "hash": "sha256-ecNGveGSxYsKFGkAqWNkpr8RKquL1k+/8LsZBNEgWq8=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/up/darwin_arm64.tar.gz"
+        "hash": "sha256-Rud8CPSlxl08cRjChFsZFG6Mfro8BiRWN7f2+DRwUsE=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/up/darwin_arm64.tar.gz"
       },
       "aarch64-linux": {
-        "hash": "sha256-70c9eE+SewPICRPzIdOmAj503xB/cL5ud2sQc4uJkJQ=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/up/linux_arm64.tar.gz"
+        "hash": "sha256-KN84vzXue9Tc8O9Ci/4emI7GOX8pETcVc/hpFuBJmy4=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/up/linux_arm64.tar.gz"
       },
       "x86_64-darwin": {
-        "hash": "sha256-DQZNsUYLM97zo7ua5xmxSqkxbC91qqLe49yI6X9ELbM=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/up/darwin_amd64.tar.gz"
+        "hash": "sha256-qHN7PSqU5nK5Dh8k4HEjwTmjN/yIoJh7VBoQ/dJS3/s=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/up/darwin_amd64.tar.gz"
       },
       "x86_64-linux": {
-        "hash": "sha256-WmsFhA5fteS3+12wPAGym0TZHax+v3zicbh+48aaW0Q=",
-        "url": "https://cli.upbound.io/main/v0.39.0-43.g3cca6045/bundle/up/linux_amd64.tar.gz"
+        "hash": "sha256-mw80qJ+9CRQFFKF7bhWiEYcW1P7Jm4dqkXTN+F8erPM=",
+        "url": "https://cli.upbound.io/main/v0.39.0-87.g20595f83/bundle/up/linux_amd64.tar.gz"
       }
     }
   },
@@ -49,5 +49,5 @@
     "x86_64-darwin",
     "x86_64-linux"
   ],
-  "version": "0.39.0-43.g3cca6045"
+  "version": "0.39.0-87.g20595f83"
 }
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index beeb87c5306f..3cf936d69336 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -126,8 +126,6 @@ extra-packages:
 
 # keep-sorted start skip_lines=1 case=no
 package-maintainers:
-  abbradar:
-    - Agda
   alexfmpe:
     - aeson-gadt-th
     - android-activity
@@ -377,6 +375,7 @@ package-maintainers:
     - warp-systemd
     - amazonka
   ncfavier:
+    - Agda
     - irc-client
     - lambdabot
     - shake
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 755fcf702c1f..98b9531e2295 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -1605,8 +1605,8 @@ self: {
       description = "A dependently typed functional programming language and proof assistant";
       license = lib.licenses.mit;
       maintainers = [
-        lib.maintainers.abbradar
         lib.maintainers.iblech
+        lib.maintainers.ncfavier
         lib.maintainers.turion
       ];
     }
diff --git a/pkgs/development/python-modules/aiolifx-themes/default.nix b/pkgs/development/python-modules/aiolifx-themes/default.nix
index 20cf615b03ee..a128aa45da26 100644
--- a/pkgs/development/python-modules/aiolifx-themes/default.nix
+++ b/pkgs/development/python-modules/aiolifx-themes/default.nix
@@ -13,16 +13,16 @@
 
 buildPythonPackage rec {
   pname = "aiolifx-themes";
-  version = "0.6.11";
+  version = "1.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "Djelibeybi";
     repo = "aiolifx-themes";
     tag = "v${version}";
-    hash = "sha256-H5fjmGfvC/d1qTzEHtmGDPlZ0aY1UaTYPOqUAxDmb3I=";
+    hash = "sha256-02ciRYc5aQ1nES/uctKUWwyBM9dO0hZ5OEWC5MT4Nuo=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/asdf-standard/default.nix b/pkgs/development/python-modules/asdf-standard/default.nix
index a5eef1142cd4..c7355350b6e6 100644
--- a/pkgs/development/python-modules/asdf-standard/default.nix
+++ b/pkgs/development/python-modules/asdf-standard/default.nix
@@ -2,27 +2,21 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  importlib-resources,
-  pythonOlder,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "asdf-standard";
-  version = "1.2.0";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.7";
+  version = "1.3.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "asdf_standard";
     inherit version;
-    hash = "sha256-5wmRL68L4vWEOiOvJzHm927WwnmynfWYnhUgmS+jxc8=";
+    hash = "sha256-WViWHzmd6tIACnhyTaN/Wu6wSZp4C72a5Pw+y+Pq7WQ=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
-
-  propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [ importlib-resources ];
+  build-system = [ setuptools-scm ];
 
   # Circular dependency on asdf
   doCheck = false;
@@ -32,6 +26,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Standards document describing ASDF";
     homepage = "https://github.com/asdf-format/asdf-standard";
+    changelog = "https://github.com/asdf-format/asdf-standard/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/bottleneck/default.nix b/pkgs/development/python-modules/bottleneck/default.nix
index 46abe5a8c483..b5d54810b5f0 100644
--- a/pkgs/development/python-modules/bottleneck/default.nix
+++ b/pkgs/development/python-modules/bottleneck/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "bottleneck";
-  version = "1.4.2";
+  version = "1.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+o6OF5nepUg85maUYmYPnZqVZJ9vmKgNMVuE7In0SfQ=";
+    hash = "sha256-yGAkLPIOadWqsuw8XWyMKhXxnkslsouPyiwqEs766dg=";
   };
 
   propagatedBuildInputs = [ numpy ];
diff --git a/pkgs/development/python-modules/cmd2/default.nix b/pkgs/development/python-modules/cmd2/default.nix
index 8bef95fd7f5b..8079242826ff 100644
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@@ -7,38 +7,27 @@
   fetchPypi,
   glibcLocales,
   gnureadline,
-  importlib-metadata,
   pyperclip,
   pytest-cov-stub,
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
   setuptools-scm,
-  typing-extensions,
   wcwidth,
 }:
 
 buildPythonPackage rec {
   pname = "cmd2";
-  version = "2.6.0";
+  version = "2.6.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jP+rp4EFJkIcqzv6AQG0kH4SmP8rzYEZYVllourl2V8=";
+    hash = "sha256-ZQpYkr8psjPT1ndbXjzIE2SM/w15E09weYH2a6rtn0I=";
   };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Fake the impure dependencies pbpaste and pbcopy
-    mkdir bin
-    echo '#!${stdenv.shell}' > bin/pbpaste
-    echo '#!${stdenv.shell}' > bin/pbcopy
-    chmod +x bin/{pbcopy,pbpaste}
-    export PATH=$(realpath bin):$PATH
-  '';
-
   build-system = [ setuptools-scm ];
 
   dependencies = [
@@ -48,7 +37,7 @@ buildPythonPackage rec {
     wcwidth
   ] ++ lib.optional stdenv.hostPlatform.isDarwin gnureadline;
 
-  doCheck = !stdenv.hostPlatform.isDarwin;
+  doCheck = true;
 
   nativeCheckInputs = [
     glibcLocales
diff --git a/pkgs/development/python-modules/compliance-trestle/default.nix b/pkgs/development/python-modules/compliance-trestle/default.nix
index 409d08fabffb..2a77ebb46b24 100644
--- a/pkgs/development/python-modules/compliance-trestle/default.nix
+++ b/pkgs/development/python-modules/compliance-trestle/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "compliance-trestle";
-  version = "3.8.1";
+  version = "3.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oscal-compass";
     repo = "compliance-trestle";
     tag = "v${version}";
-    hash = "sha256-aEIV3XfoRnyMfR0nssmxIkQwrsx7DXxqidOZ8wZ+lWw=";
+    hash = "sha256-WWqrUfDlzpZAXtOlq3Uq8AmUOerUmMCr9KPjdjk4JHg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/cucumber-tag-expressions/default.nix b/pkgs/development/python-modules/cucumber-tag-expressions/default.nix
index 9857fd8e0b70..300ec1eadf87 100644
--- a/pkgs/development/python-modules/cucumber-tag-expressions/default.nix
+++ b/pkgs/development/python-modules/cucumber-tag-expressions/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "cucumber-tag-expressions";
-  version = "6.1.2";
+  version = "6.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cucumber";
     repo = "tag-expressions";
     tag = "v${version}";
-    hash = "sha256-ptDsN6loFXrKT1xeR138kXzA5TbHPH1G7I/25ZD8Nj4=";
+    hash = "sha256-m6CmRs/Fz2e9GTtHrE3FF8GPK2vs6i37xcI3BM64rlc=";
   };
 
   sourceRoot = "${src.name}/python";
diff --git a/pkgs/development/python-modules/diffusers/default.nix b/pkgs/development/python-modules/diffusers/default.nix
index 7b729242c3dd..db078ceace15 100644
--- a/pkgs/development/python-modules/diffusers/default.nix
+++ b/pkgs/development/python-modules/diffusers/default.nix
@@ -45,14 +45,14 @@
 
 buildPythonPackage rec {
   pname = "diffusers";
-  version = "0.32.2";
+  version = "0.34.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "diffusers";
     tag = "v${version}";
-    hash = "sha256-TwmII38EA0Vux+Jh39pTAA6r+FRNuKHQWOOqsEe2Z+E=";
+    hash = "sha256-e7969HsHS1wUG9LKREc7FPe2eBeUVPSW2I+BisBPt3M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-leaflet/default.nix b/pkgs/development/python-modules/django-leaflet/default.nix
index 17c1362591d4..d68a6f15d084 100644
--- a/pkgs/development/python-modules/django-leaflet/default.nix
+++ b/pkgs/development/python-modules/django-leaflet/default.nix
@@ -9,15 +9,15 @@
 
 buildPythonPackage rec {
   pname = "django-leaflet";
-  version = "0.31.0";
+  version = "0.32.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     pname = "django_leaflet";
     inherit version;
-    hash = "sha256-+yt1+Er/YNQFhlkwDzGnEVVMZdEout5fqAiGN/sHUfc=";
+    hash = "sha256-ATzLBu4IBxyuyYpl3/1oqzaU2vznLK/zTz1481VoriU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-prometheus/default.nix b/pkgs/development/python-modules/django-prometheus/default.nix
index d07951e64222..0cac925692c6 100644
--- a/pkgs/development/python-modules/django-prometheus/default.nix
+++ b/pkgs/development/python-modules/django-prometheus/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "django-prometheus";
-  version = "2.4.0";
+  version = "2.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-commons";
     repo = "django-prometheus";
     tag = "v${version}";
-    hash = "sha256-cKkpsV3w2SUvQuSBm0MlTsomdrU4h7CS5L+nKFvrKA8=";
+    hash = "sha256-Bf1JSh9ibiPOa252IPld1FvHTPbCsB/amtlQdRQwoWY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/evolutionhttp/default.nix b/pkgs/development/python-modules/evolutionhttp/default.nix
index bb9151973627..446fa362d497 100644
--- a/pkgs/development/python-modules/evolutionhttp/default.nix
+++ b/pkgs/development/python-modules/evolutionhttp/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "evolutionhttp";
-  version = "0.0.18";
+  version = "0.0.19";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LZ9IQJ2qVdCbhOECbPOjikeJA0aGKLdZURG6tjIrkT4=";
+    hash = "sha256-VhWYhkrZVUDu1I6ZZTZlTUhNfpma29tEYBLoT7xBd1M=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 2328f4ab0918..9eeb2a4e10be 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.8.2";
+  version = "1.8.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = "fastcore";
     tag = version;
-    hash = "sha256-GoOddw2kxOMqmV6m8E6vWdpFLyGGkooMtgE1WTAWm7U=";
+    hash = "sha256-PZamAF6LaBgSlLNkaKRFHnibmcnplCShQXa2DwvObjc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/gidgethub/default.nix b/pkgs/development/python-modules/gidgethub/default.nix
index ac7549c9891e..d2a96289020a 100644
--- a/pkgs/development/python-modules/gidgethub/default.nix
+++ b/pkgs/development/python-modules/gidgethub/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   pythonOlder,
-  flit,
+  flit-core,
   uritemplate,
   pyjwt,
   pytestCheckHook,
@@ -16,19 +16,19 @@
 
 buildPythonPackage rec {
   pname = "gidgethub";
-  version = "5.3.0";
-  format = "pyproject";
+  version = "5.4.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ns59N/vOuBm4BWDn7Vj5NuSKZdN+xfVtt5FFFWtCaiU=";
+    hash = "sha256-dHDXcj18F0NHGi1i55yHUvuhKxwJcuS61XJSM4pQHb0=";
   };
 
-  nativeBuildInputs = [ flit ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     uritemplate
     pyjwt
   ] ++ pyjwt.optional-dependencies.crypto;
diff --git a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
index 57bd81774604..855d7f872c87 100644
--- a/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-appengine-logging";
-  version = "1.6.1";
+  version = "1.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_appengine_logging";
     inherit version;
-    hash = "sha256-+XveNsf3/1QRI8JXCBMVi92gw/I4XI0y/fEhHFYa5W0=";
+    hash = "sha256-SJCShGTJjanuzHv04FQuuiVRUSwCZUYsEPOj0qZCS5A=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
index 7486fb4b065c..f0ce8de62179 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery-datatransfer";
-  version = "3.19.1";
+  version = "3.19.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_bigquery_datatransfer";
     inherit version;
-    hash = "sha256-L7em/I7t7htI5zdGwSKDs35b2t/pvIXl1lUSMM6BdRo=";
+    hash = "sha256-l/9g7Sc6umoVdPf6kzE08gRmLH6co2dLJ8mdLPLXtN8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index f38283312b7e..b8991f3b924e 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-monitoring";
-  version = "2.27.1";
+  version = "2.27.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_monitoring";
     inherit version;
-    hash = "sha256-9HAJAKZYzWybf3FLsp0Af6zvDPDWKNAHVpnDpzvOilU=";
+    hash = "sha256-0PACBaX5RTDccsO5b2gb4Uq98dYUTa5dK5IrVKkMQ/o=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 0e22cb8961cf..fc48572f9b1d 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.23.3";
+  version = "2.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_secret_manager";
     inherit version;
-    hash = "sha256-WYxMCp0Q1J1QDrSuoyVd/yUKovksAo9cl+OzZ/doyAg=";
+    hash = "sha256-zlc9QP/C+30BcZJDqU7heqJD6mQqaubDN1AeWPv2QrU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/habanero/default.nix b/pkgs/development/python-modules/habanero/default.nix
index 8c187be4cbba..b00bbc3aa18f 100644
--- a/pkgs/development/python-modules/habanero/default.nix
+++ b/pkgs/development/python-modules/habanero/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "habanero";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sckott";
     repo = "habanero";
     tag = "v${version}";
-    hash = "sha256-tEsuCOuRXJleiv02VGLVSg0ykh3Yu77uZzE6vhf5PaQ=";
+    hash = "sha256-XI+UOm3xONBNVSlywfBhnsCA9RdpEwDQ4oQixn4UBKk=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/html-sanitizer/default.nix b/pkgs/development/python-modules/html-sanitizer/default.nix
index aec0c2039155..c978fdd02f6a 100644
--- a/pkgs/development/python-modules/html-sanitizer/default.nix
+++ b/pkgs/development/python-modules/html-sanitizer/default.nix
@@ -2,12 +2,17 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   hatchling,
+
+  # dependencies
   lxml,
   lxml-html-clean,
   beautifulsoup4,
+
+  # tests
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -15,8 +20,6 @@ buildPythonPackage rec {
   version = "2.4.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "matthiask";
     repo = "html-sanitizer";
@@ -24,9 +27,9 @@ buildPythonPackage rec {
     hash = "sha256-6OWFLsuefeDzQ1uHnLmboKDgrbY/xJCwqsSQlDaJlRs=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     lxml
     lxml-html-clean
     beautifulsoup4
@@ -40,15 +43,19 @@ buildPythonPackage rec {
     # Tests are sensitive to output
     "test_billion_laughs"
     "test_10_broken_html"
+
+    # Mismatch snapshot (AssertionError)
+    # https://github.com/matthiask/html-sanitizer/issues/53
+    "test_keep_typographic_whitespace"
   ];
 
   pythonImportsCheck = [ "html_sanitizer" ];
 
-  meta = with lib; {
+  meta = {
     description = "Allowlist-based and very opinionated HTML sanitizer";
     homepage = "https://github.com/matthiask/html-sanitizer";
     changelog = "https://github.com/matthiask/html-sanitizer/blob/${version}/CHANGELOG.rst";
-    license = with licenses; [ bsd3 ];
-    maintainers = with maintainers; [ fab ];
+    license = with lib.licenses; [ bsd3 ];
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/in-n-out/default.nix b/pkgs/development/python-modules/in-n-out/default.nix
index 3a5e3287b022..320841f5d4dd 100644
--- a/pkgs/development/python-modules/in-n-out/default.nix
+++ b/pkgs/development/python-modules/in-n-out/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   cython,
   fetchPypi,
-  future,
   pytestCheckHook,
   pythonAtLeast,
   pythonOlder,
@@ -15,7 +14,7 @@
 buildPythonPackage rec {
   pname = "in-n-out";
   version = "0.2.1";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -25,14 +24,12 @@ buildPythonPackage rec {
     hash = "sha256-Q83it96YHUGm1wYYore9mJSBCVkipT6tTcdfK71d/+o=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     cython
     hatchling
     hatch-vcs
   ];
 
-  propagatedBuildInputs = [ future ];
-
   nativeCheckInputs = [
     pytestCheckHook
     toolz
diff --git a/pkgs/development/python-modules/kde-material-you-colors/default.nix b/pkgs/development/python-modules/kde-material-you-colors/default.nix
index d8c2d8b14329..792ebaffaf32 100644
--- a/pkgs/development/python-modules/kde-material-you-colors/default.nix
+++ b/pkgs/development/python-modules/kde-material-you-colors/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "kde-material-you-colors";
-  version = "1.10.0";
+  version = "1.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "kde-material-you-colors";
     tag = "v${version}";
-    hash = "sha256-qT2F3OtRzYagbBH/4kijuy4udD6Ak74WacIhfzaNWqo=";
+    hash = "sha256-qiaFHu4eyX73cAbMdoP46SiiFjNWx2vXWVzEbCsTNBI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/kombu/default.nix b/pkgs/development/python-modules/kombu/default.nix
index 31b5effc79de..4b690d59e0f8 100644
--- a/pkgs/development/python-modules/kombu/default.nix
+++ b/pkgs/development/python-modules/kombu/default.nix
@@ -13,6 +13,7 @@
   hypothesis,
   kazoo,
   msgpack,
+  packaging,
   pycurl,
   pymongo,
   #, pyro4
@@ -30,20 +31,21 @@
 
 buildPythonPackage rec {
   pname = "kombu";
-  version = "5.5.3";
+  version = "5.5.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AhoOEfz82bAmDvH7ZAiMDpK+uXbrWcHfyn3dStRWLqI=";
+    hash = "sha256-iGYAFoJ16+rak7iI6DE1L+V4FoNC8NHVgz2Iug2Ec2M=";
   };
 
   build-system = [ setuptools ];
 
   propagatedBuildInputs = [
     amqp
+    packaging
     tzdata
     vine
   ] ++ lib.optionals (pythonOlder "3.10") [ typing-extensions ];
diff --git a/pkgs/development/python-modules/langchain-openai/default.nix b/pkgs/development/python-modules/langchain-openai/default.nix
index 4ff42d68e82e..f8b180ee0384 100644
--- a/pkgs/development/python-modules/langchain-openai/default.nix
+++ b/pkgs/development/python-modules/langchain-openai/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-openai";
-  version = "0.3.23";
+  version = "0.3.24";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-openai==${version}";
-    hash = "sha256-o/DDHV2niEDp0kFJ+XuUXH7TSL/cBXwrI4lYLyD2SHc=";
+    hash = "sha256-eJqI7R1YzmVrZ+OoK2qtxkM2odpEDjszbBRD+2Gog9o=";
   };
 
   sourceRoot = "${src.name}/libs/partners/openai";
diff --git a/pkgs/development/python-modules/lxml-html-clean/default.nix b/pkgs/development/python-modules/lxml-html-clean/default.nix
index 36c2e7e478eb..07fbef60093a 100644
--- a/pkgs/development/python-modules/lxml-html-clean/default.nix
+++ b/pkgs/development/python-modules/lxml-html-clean/default.nix
@@ -2,10 +2,9 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   lxml,
   unittestCheckHook,
-  pythonOlder,
-  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -13,8 +12,6 @@ buildPythonPackage rec {
   version = "0.4.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "fedora-python";
     repo = "lxml_html_clean";
@@ -22,6 +19,22 @@ buildPythonPackage rec {
     hash = "sha256-KGUFRbcaeDcX2jyoyyZMZsVTbN+h8uy+ugcritkZe38=";
   };
 
+  # Disable failing snapshot tests (AssertionError)
+  # https://github.com/fedora-python/lxml_html_clean/issues/24
+  # As this derivation must use unittestCheckHook, we cannot use disabledTests
+  postPatch = ''
+    substituteInPlace tests/test_clean.py \
+      --replace-fail \
+        "test_host_whitelist_valid" \
+        "DISABLED_test_host_whitelist_valid" \
+      --replace-fail \
+        "test_host_whitelist_invalid" \
+        "DISABLED_test_host_whitelist_invalid" \
+      --replace-fail \
+        "test_host_whitelist_sneaky_userinfo" \
+        "DISABLED_test_host_whitelist_sneaky_userinfo"
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [ lxml ];
@@ -30,11 +43,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "lxml_html_clean" ];
 
-  meta = with lib; {
+  meta = {
     description = "Separate project for HTML cleaning functionalities copied from lxml.html.clean";
     homepage = "https://github.com/fedora-python/lxml_html_clean/";
     changelog = "https://github.com/fedora-python/lxml_html_clean/blob/${version}/CHANGES.rst";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/mdformat-gfm-alerts/default.nix b/pkgs/development/python-modules/mdformat-gfm-alerts/default.nix
index 14852b7de2f2..3a997e5e421b 100644
--- a/pkgs/development/python-modules/mdformat-gfm-alerts/default.nix
+++ b/pkgs/development/python-modules/mdformat-gfm-alerts/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "mdformat-gfm-alerts";
-  version = "1.0.1";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "KyleKing";
     repo = "mdformat-gfm-alerts";
     tag = "v${version}";
-    hash = "sha256-2EYdNCyS1LxcEnCXkOugAAGx5XLWV4cWTNkXjR8RVQo=";
+    hash = "sha256-Hfi4Ek91G8WHAWjv7m52ZnT5Je9QyZT4yWSecaeTcvA=";
   };
 
   build-system = [ flit-core ];
@@ -34,9 +34,8 @@ buildPythonPackage rec {
   meta = {
     description = "Format 'GitHub Markdown Alerts', which use blockquotes to render admonitions";
     homepage = "https://github.com/KyleKing/mdformat-gfm-alerts";
-    changelog = "https://github.com/KyleKing/mdformat-gfm-alerts/releases/tag/v${version}";
+    changelog = "https://github.com/KyleKing/mdformat-gfm-alerts/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sigmanificient ];
-    broken = true; # broken test due to changes in mdformat; compare https://github.com/KyleKing/mdformat-admon/issues/25
   };
 }
diff --git a/pkgs/development/python-modules/microsoft-kiota-http/default.nix b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
index dd0eb55a7dbb..310ad5d1a9e9 100644
--- a/pkgs/development/python-modules/microsoft-kiota-http/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-http";
-  version = "1.9.3";
+  version = "1.9.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,8 +24,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
-    tag = "microsoft-kiota-http-v${version}";
-    hash = "sha256-FUfVkJbpD0X7U7DPzyoh+84Bk7C07iLT9dmbUeliFu8=";
+    tag = "microsoft-kiota-serialization-text-v${version}";
+    hash = "sha256-59vuJc7Wb/6PsPA4taAFA2UK8bdz+raZ+NB4S8LahtM=";
   };
 
   sourceRoot = "${src.name}/packages/http/httpx/";
diff --git a/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix b/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
index aed71a8e2113..76cddd6eafde 100644
--- a/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-git-revision-date-localized-plugin/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-git-revision-date-localized-plugin";
-  version = "1.3.0";
+  version = "1.4.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "timvink";
     repo = "mkdocs-git-revision-date-localized-plugin";
     tag = "v${version}";
-    hash = "sha256-Z0a/V8wyo15E7bTumLRM+0QxMGXlxVc1Sx9uXlDbg+8=";
+    hash = "sha256-xSm+Qvk1DU5CEZpR+69oIAKnIrg/J7iECNHEZQlf/7o=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/moviepy/default.nix b/pkgs/development/python-modules/moviepy/default.nix
index 272eb3ad8843..139a4227fad9 100644
--- a/pkgs/development/python-modules/moviepy/default.nix
+++ b/pkgs/development/python-modules/moviepy/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "moviepy";
-  version = "2.1.2";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Zulko";
     repo = "moviepy";
     tag = "v${version}";
-    hash = "sha256-dha+rPBkcEyqQ7EfnFg81GDq0Lc2uoQ3meCTjdajaBM=";
+    hash = "sha256-3vt/EyEOv6yNPgewkgcWcjM0TbQ6IfkR6nytS/WpRyg=";
   };
 
   build-system = [ setuptools ];
@@ -108,7 +108,7 @@ buildPythonPackage rec {
   meta = {
     description = "Video editing with Python";
     homepage = "https://zulko.github.io/moviepy/";
-    changelog = "https://github.com/Zulko/moviepy/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Zulko/moviepy/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/nominal-api-protos/default.nix b/pkgs/development/python-modules/nominal-api-protos/default.nix
index 59d978720958..2e080e4ff2c3 100644
--- a/pkgs/development/python-modules/nominal-api-protos/default.nix
+++ b/pkgs/development/python-modules/nominal-api-protos/default.nix
@@ -11,6 +11,7 @@ buildPythonPackage rec {
   version = "0.708.0";
   pyproject = true;
 
+  # nixpkgs-update: no auto update
   src = fetchPypi {
     inherit version;
     pname = "nominal_api_protos";
diff --git a/pkgs/development/python-modules/nominal-api/default.nix b/pkgs/development/python-modules/nominal-api/default.nix
index 23973567b65f..0554264d1f3f 100644
--- a/pkgs/development/python-modules/nominal-api/default.nix
+++ b/pkgs/development/python-modules/nominal-api/default.nix
@@ -12,6 +12,7 @@ buildPythonPackage rec {
   version = "0.708.0";
   pyproject = true;
 
+  # nixpkgs-update: no auto update
   src = fetchPypi {
     inherit version;
     pname = "nominal_api";
diff --git a/pkgs/development/python-modules/param/default.nix b/pkgs/development/python-modules/param/default.nix
index 6db3615d92a1..f7a93cad160e 100644
--- a/pkgs/development/python-modules/param/default.nix
+++ b/pkgs/development/python-modules/param/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
 
   # build-system
   hatchling,
@@ -17,19 +16,17 @@
 
 buildPythonPackage rec {
   pname = "param";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "holoviz";
     repo = "param";
     tag = "v${version}";
-    hash = "sha256-3aqABliOk+JtR84J/qiwda4yAkVgG2lJWewhQuSUgtA=";
+    hash = "sha256-tucF37o4Yf1OkGz4TUUFI/cGNlVLvTMcak+SmbztCMA=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     hatchling
     hatch-vcs
   ];
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 32362feb636c..f7f34151809d 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "1.7.4";
+  version = "1.7.6";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     tag = "v${version}";
-    hash = "sha256-0Xfy1HKaVraEjhB6CS6V+EkU5gmKr6SQse+p7l1x8d8=";
+    hash = "sha256-x3UiEO2dduMHpDkMZAdpUBNR9VStM7qInEXxZeHqeTM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pudb/default.nix b/pkgs/development/python-modules/pudb/default.nix
index 730c1fa1daa1..3d143bfb2b3d 100644
--- a/pkgs/development/python-modules/pudb/default.nix
+++ b/pkgs/development/python-modules/pudb/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pudb";
-  version = "2024.1.3";
+  version = "2025.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Jk8jngU45S6D09AgFDEAsxccrhcidnS7G5+LB180hJw=";
+    hash = "sha256-pSiynGnOixgqM3hyxfBGBx9taNNBXG179TvSfCZPWNA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pyahocorasick/default.nix b/pkgs/development/python-modules/pyahocorasick/default.nix
index 83e75000f19d..8ed4bf2659ac 100644
--- a/pkgs/development/python-modules/pyahocorasick/default.nix
+++ b/pkgs/development/python-modules/pyahocorasick/default.nix
@@ -3,23 +3,22 @@
   buildPythonPackage,
   fetchFromGitHub,
   pytestCheckHook,
-  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pyahocorasick";
-  version = "2.1.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "WojciechMula";
     repo = "pyahocorasick";
-    tag = version;
-    hash = "sha256-SCIgu0uEjiSUiIP0WesJG+y+3ZqFBfI5PdgUzviOVrs=";
+    tag = "v${version}";
+    hash = "sha256-lFJhHDN9QAKw5dqzgjRxcs+7+LuTqP9qQ68B5LlCNmU=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "ahocorasick" ];
@@ -32,8 +31,8 @@ buildPythonPackage rec {
       key strings occurrences at once in some input text.
     '';
     homepage = "https://github.com/WojciechMula/pyahocorasick";
-    changelog = "https://github.com/WojciechMula/pyahocorasick/blob/${version}/CHANGELOG.rst";
-    license = with licenses; [ bsd3 ];
+    changelog = "https://github.com/WojciechMula/pyahocorasick/blob/${src.tag}/CHANGELOG.rst";
+    license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/pyipp/default.nix b/pkgs/development/python-modules/pyipp/default.nix
index 63645b80a40e..311b836eb12d 100644
--- a/pkgs/development/python-modules/pyipp/default.nix
+++ b/pkgs/development/python-modules/pyipp/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pyipp";
-  version = "0.17.1";
+  version = "0.17.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "ctalkington";
     repo = "python-ipp";
     tag = version;
-    hash = "sha256-V+hf3UgTUnRTBtFP83s2zPWzCpAamSsx9Lj1l9lcW6k=";
+    hash = "sha256-YlIc/FNM3SdYQj0DN0if3R7h0383V5CHGpD7FHErWhA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-sql/default.nix b/pkgs/development/python-modules/python-sql/default.nix
index f41e54f406aa..f42a3cf0d79c 100644
--- a/pkgs/development/python-modules/python-sql/default.nix
+++ b/pkgs/development/python-modules/python-sql/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "python-sql";
-  version = "1.5.2";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "python_sql";
     inherit version;
-    hash = "sha256-c19SNyGHy5VrGu6MoHADn3O6iRO7i33vlC78FNUGzTY=";
+    hash = "sha256-WzShJOitdMU6zZckhoS1v7tFODiPZnZmKYGjJxg+w2w=";
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/pythonfinder/default.nix b/pkgs/development/python-modules/pythonfinder/default.nix
index f8883feef364..1ca8f1d78e48 100644
--- a/pkgs/development/python-modules/pythonfinder/default.nix
+++ b/pkgs/development/python-modules/pythonfinder/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pythonfinder";
-  version = "2.1.0";
+  version = "3.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "sarugaku";
     repo = "pythonfinder";
     tag = version;
-    hash = "sha256-CbaKXD7Sde8euRqvc/IHoXoSMF+dNd7vT9LkLWq4/IU=";
+    hash = "sha256-Qym/t+IejBMFHvBfIm+G5+J3GBC9O3RFrwSqHLuxwcg=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     description = "Cross platform search tool for finding Python";
     mainProgram = "pyfinder";
     homepage = "https://github.com/sarugaku/pythonfinder";
-    changelog = "https://github.com/sarugaku/pythonfinder/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/sarugaku/pythonfinder/blob/${src.tag}/CHANGELOG.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ cpcloud ];
   };
diff --git a/pkgs/development/python-modules/r2pipe/default.nix b/pkgs/development/python-modules/r2pipe/default.nix
index a1de5b4107c3..d72e70e9f10e 100644
--- a/pkgs/development/python-modules/r2pipe/default.nix
+++ b/pkgs/development/python-modules/r2pipe/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "r2pipe";
-  version = "1.9.4";
+  version = "1.9.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ah3kb+Hk1pMlQ8D1SMPAISbL2n6TDG0Ih9ezmW7oIRk=";
+    hash = "sha256-OAS3Yr1CmMMuhEP/tRO9YAdYZ3emib0huXl3/rjLLJk=";
   };
 
   # Tiny sanity check to make sure r2pipe finds radare2 (since r2pipe doesn't
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 4f864da9c6cc..7de7eb2564f3 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.9.5";
+  version = "1.9.6";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-eiX5kg/euf+V9x8tBtzMhq8b7xaFbMww5DuQIKWoBQs=";
+    hash = "sha256-/uzLkxqSVKjSYmFeDMo7EzcLbxGXGHlkg0ufhPRsGpY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sv-ttk/default.nix b/pkgs/development/python-modules/sv-ttk/default.nix
index 542ef1d2ed27..13a3162291ee 100644
--- a/pkgs/development/python-modules/sv-ttk/default.nix
+++ b/pkgs/development/python-modules/sv-ttk/default.nix
@@ -8,15 +8,15 @@
 
 buildPythonPackage rec {
   pname = "sv-ttk";
-  version = "2.6.0";
+  version = "2.6.1";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit version;
     pname = "sv_ttk";
-    hash = "sha256-P9RAOWyV4w6I9ob88ovkJUgPcyDWvzRvnOpdb1ZwLMI=";
+    hash = "sha256-R1idXiA5jPQE6DYvJPPtSPODDNCs4FbYM1T6Jdjk/kg=";
   };
 
   # No tests available
diff --git a/pkgs/development/python-modules/tracerite/default.nix b/pkgs/development/python-modules/tracerite/default.nix
index 9a4d9df7a0a7..38054a3ebdb5 100644
--- a/pkgs/development/python-modules/tracerite/default.nix
+++ b/pkgs/development/python-modules/tracerite/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "tracerite";
-  version = "1.1.1";
+  version = "1.1.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,14 +20,13 @@ buildPythonPackage rec {
     owner = "sanic-org";
     repo = "tracerite";
     tag = "v${version}";
-    hash = "sha256-rI1MNdYl/P64tUHyB3qV9gfLbGbCVOXnEFoqFTkaqgg=";
+    hash = "sha256-T210vRXFWlTs5ke13DVvZEVsonXiT+g6xSI63+DxLXc=";
   };
 
   build-system = [ setuptools-scm ];
 
   dependencies = [
     html5tagger
-    setuptools
   ];
 
   postInstall = ''
@@ -42,7 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Tracebacks for Humans in Jupyter notebooks";
     homepage = "https://github.com/sanic-org/tracerite";
-    changelog = "https://github.com/sanic-org/tracerite/releases/tag/v${version}";
+    changelog = "https://github.com/sanic-org/tracerite/releases/tag/${src.tag}";
     license = licenses.unlicense;
     maintainers = with maintainers; [ p0lyw0lf ];
   };
diff --git a/pkgs/development/python-modules/trafilatura/default.nix b/pkgs/development/python-modules/trafilatura/default.nix
index ecbad785b0f1..57d236ffeb03 100644
--- a/pkgs/development/python-modules/trafilatura/default.nix
+++ b/pkgs/development/python-modules/trafilatura/default.nix
@@ -1,17 +1,22 @@
 {
   lib,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   certifi,
   charset-normalizer,
   courlan,
-  fetchPypi,
   htmldate,
   justext,
   lxml,
-  pytestCheckHook,
-  pythonOlder,
-  setuptools,
   urllib3,
+
+  # tests
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -19,11 +24,11 @@ buildPythonPackage rec {
   version = "2.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-zrcJSm7Ml+cv6nPH26NnFMXFtXe2Rw5FINyok3BtYkc=";
+  src = fetchFromGitHub {
+    owner = "adbar";
+    repo = "trafilatura";
+    tag = "v${version}";
+    hash = "sha256-Cf1W3JEGSMkVmRZVTXYsXzZK/Nt/aDG890Sf0/0OZAA=";
   };
 
   postPatch = ''
@@ -48,6 +53,15 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
+    # TypeError: argument of type 'NoneType' is not iterable
+    # https://github.com/adbar/trafilatura/issues/805
+    "test_external"
+    "test_extract"
+
+    # AttributeError: 'NoneType' object has no attribute 'find'
+    # https://github.com/adbar/trafilatura/issues/805
+    "test_table_processing"
+
     # Disable tests that require an internet connection
     "test_cli_pipeline"
     "test_crawl_page"
diff --git a/pkgs/development/python-modules/west/default.nix b/pkgs/development/python-modules/west/default.nix
index d8823b927bb0..54957ee4c74c 100644
--- a/pkgs/development/python-modules/west/default.nix
+++ b/pkgs/development/python-modules/west/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "west";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-iTIANL6HCZ0W519HYKwNHtZ+iXiSjkaKuZPj+6DP6S8=";
+    hash = "sha256-kIoHrnzDNKiMsvBptDBITf392gw0ItFLniOkMDDPnMY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index f2f9e0777792..7bd3d5489260 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2025.6.2";
+  version = "2025.6.3";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-Hdk7Lf0J4wgx+xhrKtBgBtO+DzCqQ2sih5DaoYcsWww=";
+    hash = "sha256-FGjnZJ7lTZ+qmjMV66PRbndFjw7Hzq3y3nq62eQ+I+U=";
   };
 
   build-system = [