diff --git a/doc/contributing/reviewing-contributions.chapter.md b/doc/contributing/reviewing-contributions.chapter.md
index c291ef5b1293..f4a4403c8db3 100644
--- a/doc/contributing/reviewing-contributions.chapter.md
+++ b/doc/contributing/reviewing-contributions.chapter.md
@@ -16,7 +16,7 @@ This section has been moved to [nixos/README.md](https://github.com/NixOS/nixpkg
 
 ## New modules {#reviewing-contributions-new-modules}
 
-This section has been moved to [nixos/README.md](https://github.com/NixOS/nixpkgs/blob/master/nixos/README.md).
+This section has been moved to [nixos/README.md](https://github.com/NixOS/nixpkgs/blob/master/nixos/README.md#new-modules).
 
 ## Individual maintainer list {#reviewing-contributions-individual-maintainer-list}
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 90d5bc9c18e5..2ce0ea992d7c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23687,6 +23687,12 @@
     githubId = 158321;
     name = "Stewart Mackenzie";
   };
+  skaphi = {
+    name = "Oskar Philipsson";
+    email = "oskar.philipsson@gmail.com";
+    github = "skaphi";
+    githubId = 41991455;
+  };
   skeuchel = {
     name = "Steven Keuchel";
     email = "steven.keuchel@gmail.com";
diff --git a/nixos/README-modular-services.md b/nixos/README-modular-services.md
new file mode 100644
index 000000000000..6bb5c83626f5
--- /dev/null
+++ b/nixos/README-modular-services.md
@@ -0,0 +1,97 @@
+
+# Writing and Reviewing Modular Services
+
+## Status
+
+Modular Services are, as of writing, a new feature with support in NixOS.
+It is in development, and be considerate of the fact that the intermediate outcome of RFC 163 is that we should try a module-based approach to portable services; it is not yet a widely agreed upon solution.
+
+## Relation to NixOS Modules
+
+- A modular service is not a replacement for a NixOS module, but may be in the future.
+- Using a modular service to implement a NixOS module is an expected use case, but exposes the NixOS module to a degree of uncertainty that is not acceptable for widely used modules yet.
+
+## Maintainership
+
+If you contribute a modular service, you must mark yourself as maintainer of the modular service.
+The maintainership of a modular service does not need to be the same as the maintainership of a NixOS module.
+If you are not a maintainer of the NixOS module, you should offer to join the NixOS module's `meta.maintainers` team, so that you are included in reviews and discussions, most of which also affect the modular service.
+The NixOS module maintainers have no obligation towards the modular service, except perhaps to notify you if they notice that the modular service breaks.
+
+## Minimum Standard
+
+Modular services **MUST** be accompanied by a **NixOS VM test** that exercises the modular service.
+
+Modular services **MUST** have a `meta.maintainers` module attribute that lists the maintainers of the modular service.
+
+## Reviewing Modular Services
+
+When reviewing a modular service, you should check the following. Details and rationale are provided below.
+
+```markdown
+- [ ] Has a NixOS VM test
+- [ ] Has a `meta.maintainers` attribute
+- [ ] Systemd-specific definitions are behind `optionalAttrs (options ? systemd)` to promote portability.
+- [ ] `_class = "service"`
+- [ ] Modular services provided through `passthru.services` must override the default of the package option using `finalAttrs.finalPackage`
+- [ ] Is the modular services infrastructure sufficient for this service? If one or more features are not covered, comment in https://github.com/NixOS/nixpkgs/issues/428084
+```
+
+## Details
+
+### NixOS VM test
+
+See the initial [Modular Services PR](https://github.com/NixOS/nixpkgs/pull/372170) for an [example](https://github.com/NixOS/nixpkgs/pull/372170/files#diff-e7fe16489cf3cd08ecc22b2c7896039d407a329b75691c046c95447423b3153f) of a NixOS VM test.
+TBD: describe best practices here.
+
+### `_class = "service"`
+
+A [`_class`](https://nixos.org/manual/nixpkgs/unstable/#module-system-lib-evalModules-param-class) declaration ensures a clear error when the module is accidentally imported into a configuration that isn't a modular service, such as a NixOS configuration.
+
+Provide it as the first attribute in the module:
+
+```nix
+{ lib, config, ... }:
+{
+  _class = "service";
+
+  options = {
+    # ...
+  };
+  config = {
+    # ...
+  };
+}
+```
+
+### Overriding the package default
+
+When a modular service is provided through `passthru.services`, it must override the default of the package option using [`finalAttrs.finalPackage`](https://nixos.org/manual/nixpkgs/unstable/#mkderivation-recursive-attributes).
+If this is not possible, or if the module is not represented by a single package, consider exposing the modular service directly by file path only.
+
+Otherwise, since some packages are *defined* by an override, the modular service would launch a wrong package, if it builds at all.
+
+Example:
+
+`package.nix`
+```nix
+{
+  stdenv,
+  nixosTests,
+# ...
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "example";
+  # ...
+
+  passthru = {
+    services = {
+      default = {
+        imports = [ ./service.nix ];
+        example.package = finalAttrs.finalPackage;
+        # ...
+      };
+    };
+  };
+})
+```
diff --git a/nixos/README.md b/nixos/README.md
index 65bcafabe913..2d166c0c18b0 100644
--- a/nixos/README.md
+++ b/nixos/README.md
@@ -116,3 +116,5 @@ Sample template for a new module review is provided below.
 
 ##### Comments
 ```
+
+See also [./README-modular-services.md](./README-modular-services.md).
diff --git a/nixos/doc/manual/development/modular-services.md b/nixos/doc/manual/development/modular-services.md
index c34871f7725f..963da8f32b0b 100644
--- a/nixos/doc/manual/development/modular-services.md
+++ b/nixos/doc/manual/development/modular-services.md
@@ -83,6 +83,10 @@ Moving their logic into separate Nix files may still be beneficial for the effic
 
 <!-- TODO example of a single-instance service -->
 
+## Writing and Reviewing a Modular Service {#modular-service-review}
+
+Refer to the contributor documentation in [`nixos/README-modular-services.md`](https://github.com/NixOS/nixpkgs/blob/master/nixos/README-modular-services.md).
+
 ## Portable Service Options {#modular-service-options-portable}
 
 ```{=include=} options
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index cf54c4ce7982..892c9400406b 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -26,6 +26,9 @@
   "modular-service-portability": [
     "index.html#modular-service-portability"
   ],
+  "modular-service-review": [
+    "index.html#modular-service-review"
+  ],
   "modular-services": [
     "index.html#modular-services"
   ],
diff --git a/nixos/modules/services/system/kerberos/default.nix b/nixos/modules/services/system/kerberos/default.nix
index 5e7210ca7629..5dfc3bed844f 100644
--- a/nixos/modules/services/system/kerberos/default.nix
+++ b/nixos/modules/services/system/kerberos/default.nix
@@ -7,6 +7,7 @@
 
 let
   inherit (lib) mkOption types;
+  inherit (lib.types) listOf str;
   cfg = config.services.kerberos_server;
   inherit (config.security.krb5) package;
 
@@ -41,6 +42,14 @@ in
         '';
         default = { };
       };
+
+      extraKDCArgs = mkOption {
+        type = listOf str;
+        description = ''
+          Extra arguments to pass to the KDC process. See {manpage}`kdc(8)`.
+        '';
+        default = [ ];
+      };
     };
   };
 
diff --git a/nixos/modules/services/system/kerberos/heimdal.nix b/nixos/modules/services/system/kerberos/heimdal.nix
index 6daa86e79aae..2094a4dceb24 100644
--- a/nixos/modules/services/system/kerberos/heimdal.nix
+++ b/nixos/modules/services/system/kerberos/heimdal.nix
@@ -2,11 +2,14 @@
   pkgs,
   config,
   lib,
+  utils,
   ...
 }:
 
 let
   inherit (lib) mapAttrs;
+  inherit (utils) escapeSystemdExecArgs;
+
   cfg = config.services.kerberos_server;
   package = config.security.krb5.package;
 
@@ -94,7 +97,13 @@ in
         "info:heimdal"
       ];
       serviceConfig = {
-        ExecStart = "${package}/libexec/kdc --config-file=/etc/heimdal-kdc/kdc.conf";
+        ExecStart = escapeSystemdExecArgs (
+          [
+            "${package}/libexec/kdc"
+            "--config-file=/etc/heimdal-kdc/kdc.conf"
+          ]
+          ++ cfg.extraKDCArgs
+        );
         Slice = "system-kerberos-server.slice";
         StateDirectory = "heimdal";
       };
diff --git a/nixos/modules/services/system/kerberos/mit.nix b/nixos/modules/services/system/kerberos/mit.nix
index f1caa92c04df..0011f4cf1431 100644
--- a/nixos/modules/services/system/kerberos/mit.nix
+++ b/nixos/modules/services/system/kerberos/mit.nix
@@ -2,11 +2,14 @@
   pkgs,
   config,
   lib,
+  utils,
   ...
 }:
 
 let
   inherit (lib) mapAttrs;
+  inherit (utils) escapeSystemdExecArgs;
+
   cfg = config.services.kerberos_server;
   package = config.security.krb5.package;
   PIDFile = "/run/kdc.pid";
@@ -91,7 +94,14 @@ in
       serviceConfig = {
         Type = "forking";
         PIDFile = PIDFile;
-        ExecStart = "${package}/bin/krb5kdc -P ${PIDFile}";
+        ExecStart = escapeSystemdExecArgs (
+          [
+            "${package}/bin/krb5kdc"
+            "-P"
+            "${PIDFile}"
+          ]
+          ++ cfg.extraKDCArgs
+        );
         Slice = "system-kerberos-server.slice";
         StateDirectory = "krb5kdc";
       };
diff --git a/nixos/modules/system/service/portable/service.nix b/nixos/modules/system/service/portable/service.nix
index b62b23e09a67..78c516e34e28 100644
--- a/nixos/modules/system/service/portable/service.nix
+++ b/nixos/modules/system/service/portable/service.nix
@@ -44,5 +44,9 @@ in
         '';
       };
     };
+    # TODO: use https://github.com/NixOS/nixpkgs/pull/431450
+    meta = lib.mkOption {
+      description = "The maintainers of this module. This is currently a placeholder option whose value may not evaluate to anything useful until https://github.com/NixOS/nixpkgs/pull/431450 is available and used here.";
+    };
   };
 }
diff --git a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
index ec7e3909c091..ec50658c1c78 100644
--- a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2025-05-23";
+  version = "0-unstable-2025-08-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "6365a756c02d25c76bf90c78e42316b46f876c49";
-    hash = "sha256-7bL+3+AfbN9FBhMaF8FzZhGZ0OgKGCT+M/5KVYd9Tt0=";
+    rev = "228c14e10e9a8fae0ead8adf30daad2cdd8655b9";
+    hash = "sha256-89/1axjha8Pv2MVWIr1P3TGq43HwhHeUZRUHkes52tk=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index c83df456a717..ec63d4335d24 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -212,7 +212,7 @@ rec {
     fi
 
     # Set up automatic kernel module loading.
-    export MODULE_DIR=${kernel}/lib/modules/
+    export MODULE_DIR=${lib.getOutput "modules" kernel}/lib/modules/
     ${coreutils}/bin/cat <<EOF > /run/modprobe
     #! ${bash}/bin/sh
     export MODULE_DIR=$MODULE_DIR
diff --git a/pkgs/by-name/ac/actual-server/package.nix b/pkgs/by-name/ac/actual-server/package.nix
index eafbd1a588f4..a8f4c4a8aef0 100644
--- a/pkgs/by-name/ac/actual-server/package.nix
+++ b/pkgs/by-name/ac/actual-server/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  jq,
   makeWrapper,
   nodejs_22,
   python3,
@@ -10,13 +11,13 @@
 }:
 let
   yarn-berry = yarn-berry_4;
-  version = "25.7.1";
+  version = "25.8.0";
   src = fetchFromGitHub {
     name = "actualbudget-actual-source";
     owner = "actualbudget";
     repo = "actual";
     tag = "v${version}";
-    hash = "sha256-BXF9VL2HTNOOsX+l6G+5CHRi+ycGJTizky8cypijR7M=";
+    hash = "sha256-9Ov9AR+WEKtjiX+C2lvjxerc295DWSRHpTb4Lu1stoo=";
   };
   translations = fetchFromGitHub {
     name = "actualbudget-translations-source";
@@ -24,8 +25,8 @@ let
     repo = "translations";
     # Note to updaters: this repo is not tagged, so just update this to the Git
     # tip at the time the update is performed.
-    rev = "319e1b8f099b77c2ff939c8728182a0a3afdec49";
-    hash = "sha256-63Uc/2HTYOm2hQEr7grhNTLWtage6oyl4J/a6fGonVI=";
+    rev = "c1c2f298013ca3223e6cd6a4a4720bca5e8b8274";
+    hash = "sha256-3dtdymdKfEzUIzButA3L88GrehO4EjCrd/gq0Y5bcuE=";
   };
 
 in
@@ -60,6 +61,11 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Allow `remove-untranslated-languages` to do its job.
     chmod -R u+w ./packages/desktop-client/locale
+
+    # Disable the postinstall script for `protoc-gen-js` because it tries to
+    # use network in buildPhase. It's just used as a dev tool and the generated
+    # protobuf code is committed in the repository.
+    cat <<< $(${lib.getExe jq} '.dependenciesMeta."protoc-gen-js".built = false' ./package.json) > ./package.json
   '';
 
   buildPhase = ''
@@ -76,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-SPLosaI2r8PshhqG+dbJktVmjcaDX1GmIXBO0bF+mY4=";
+    hash = "sha256-kbQjtZivn9ni6PLk04kAJTzhhGgubhnxgHqMnGwEXZk=";
   };
 
   pname = "actual-server";
diff --git a/pkgs/by-name/an/ante/package.nix b/pkgs/by-name/an/ante/package.nix
index 7dbb7bcaf0cf..31db0243ecd9 100644
--- a/pkgs/by-name/an/ante/package.nix
+++ b/pkgs/by-name/an/ante/package.nix
@@ -1,54 +1,70 @@
 {
+  stdenv,
   fetchFromGitHub,
   lib,
+  zlib,
   libffi,
   libxml2,
-  llvmPackages_16,
+  llvmPackages_18,
   ncurses,
+  darwin,
   rustPlatform,
 }:
 
 rustPlatform.buildRustPackage {
   pname = "ante";
-  version = "unstable-2023-12-18";
+  version = "0-unstable-2025-07-12";
   src = fetchFromGitHub {
     owner = "jfecher";
     repo = "ante";
-    rev = "e38231ffa51b84a2ca53b4b0439d1ca5e0dea32a";
-    hash = "sha256-UKEoOm+Jc0YUwO74Tn038MLeX/c3d2z8I0cTBVfX61U=";
+    rev = "e1f68f00937ae39badcc42a48c0078b608f294bf";
+    fetchSubmodules = true;
+    hash = "sha256-mbjV7S705bSseA/P31jiJiktpUEQ8hS+M4kcs2AM1/Y=";
   };
 
-  cargoHash = "sha256-uOOSxRoc59XzJT5oVO2NOYC0BwrNq4X6Jd/gQz0ZBp8=";
+  cargoHash = "sha256-cRF1JFqWpGGQO3fIGcatVY1pp65CvNeM/6LFYDJxdpM=";
 
-  /*
-     https://crates.io/crates/llvm-sys#llvm-compatibility
-     llvm-sys requires a specific version of llvmPackages,
-     that is not the same as the one included by default with rustPlatform.
-  */
-  nativeBuildInputs = [ llvmPackages_16.llvm ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ llvmPackages_18.llvm ];
   buildInputs = [
+    zlib
     libffi
     libxml2
     ncurses
   ];
 
   postPatch = ''
-    substituteInPlace tests/golden_tests.rs --replace \
+    substituteInPlace tests/golden_tests.rs --replace-fail \
       'target/debug' "target/$(rustc -vV | sed -n 's|host: ||p')/release"
+
+    substituteInPlace src/util/mod.rs \
+      --replace-fail '"gcc"' '"${lib.getExe llvmPackages_18.clang}"'
   '';
   preBuild =
     let
-      major = lib.versions.major llvmPackages_16.llvm.version;
-      minor = lib.versions.minor llvmPackages_16.llvm.version;
+      major = lib.versions.major llvmPackages_18.llvm.version;
+      minor = lib.versions.minor llvmPackages_18.llvm.version;
       llvm-sys-ver = "${major}${builtins.substring 0 1 minor}";
     in
     ''
       # On some architectures llvm-sys is not using the package listed inside nativeBuildInputs
-      export LLVM_SYS_${llvm-sys-ver}_PREFIX=${llvmPackages_16.llvm.dev}
+      export LLVM_SYS_${llvm-sys-ver}_PREFIX=${llvmPackages_18.llvm.dev}
       export ANTE_STDLIB_DIR=$out/lib
       mkdir -p $ANTE_STDLIB_DIR
       cp -r $src/stdlib/* $ANTE_STDLIB_DIR
     '';
+  # Ante uses the default LLVM target which, because we currently
+  # don’t include a Darwin version in the target, seemingly defaults
+  # to the host macOS version, which makes `ld(1)` warn about the
+  # mismatching deployment targets, which breaks the tests.
+  #
+  # TODO: Remove this once it stops being necessary.
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export MACOSX_DEPLOYMENT_TARGET=$(
+      ${lib.getExe' darwin.DarwinTools "sw_vers"} -productVersion
+    )
+  '';
 
   meta = with lib; {
     homepage = "https://antelang.org/";
diff --git a/pkgs/by-name/av/avalonia/package.nix b/pkgs/by-name/av/avalonia/package.nix
index 61e21f616fe0..0d5ae0a43190 100644
--- a/pkgs/by-name/av/avalonia/package.nix
+++ b/pkgs/by-name/av/avalonia/package.nix
@@ -46,14 +46,14 @@ stdenvNoCC.mkDerivation (
     }
     rec {
       pname = "Avalonia";
-      version = "11.3.3";
+      version = "11.3.4";
 
       src = fetchFromGitHub {
         owner = "AvaloniaUI";
         repo = "Avalonia";
         tag = version;
         fetchSubmodules = true;
-        hash = "sha256-+u0VCUqGT6D84GdApkThJB295nHIZInRtPFWr9UOsFk=";
+        hash = "sha256-zEQKflqdM3ZGm6aMk1zlKHHH3efTX0OZ+xRFwlLAu2M=";
       };
 
       patches = [
diff --git a/pkgs/by-name/bo/bookstack/package.nix b/pkgs/by-name/bo/bookstack/package.nix
index c570f4d75a35..8e0448d60990 100644
--- a/pkgs/by-name/bo/bookstack/package.nix
+++ b/pkgs/by-name/bo/bookstack/package.nix
@@ -8,16 +8,16 @@
 
 php83.buildComposerProject2 (finalAttrs: {
   pname = "bookstack";
-  version = "25.07";
+  version = "25.07.1";
 
   src = fetchFromGitHub {
     owner = "bookstackapp";
     repo = "bookstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NlG5b/uiXplvV4opL6+SMDh4UhHAhN1wuGX7eyEnTew=";
+    hash = "sha256-POStEhG8c3gQyAT9KsRZYEafN3OrI3X/Esar/ZCBrZA=";
   };
 
-  vendorHash = "sha256-8wnNHFo+faut7qqHHy9/jvcUfLFD45uapBFGP4xAYFs=";
+  vendorHash = "sha256-LQKZjGabmAcpK1j+J5uwu/vCk3EHLB2UvuUpAr0pFxc=";
 
   passthru = {
     phpPackage = php83;
diff --git a/pkgs/by-name/ca/cargo-tally/package.nix b/pkgs/by-name/ca/cargo-tally/package.nix
index f341b57c8037..2b0bf29e67a8 100644
--- a/pkgs/by-name/ca/cargo-tally/package.nix
+++ b/pkgs/by-name/ca/cargo-tally/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.67";
+  version = "1.0.68";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-Jt7pEpy06xoYWLIMustYvVB81fcGEK7GYvh5ukDUiQ0=";
+    hash = "sha256-OJI0GDQqf15dFC9ckQDg43QQzowI5R6iMEMwfadzRZU=";
   };
 
-  cargoHash = "sha256-gXFcsaXaCkX4wQ9/eHr9CUI/r6KEAfZ8HYiDqBRtQeA=";
+  cargoHash = "sha256-UrMdyFcvBXsRJfIuDOKVIIkoOnwjJZPbAptusG8Tgwo=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";
diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index 6f5d8dc24195..30552686f8d1 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cook-cli";
-  version = "0.12.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${version}";
-    hash = "sha256-2vY68PUoHDyyH3hJ/Fvjxbof7RzWFWYTg1UhsjWNpww=";
+    hash = "sha256-jaAgmqUuqldcBlrwqXsausXPP35RZqM1VasYyA0pPO8=";
   };
 
-  cargoHash = "sha256-H4soSp9fDwrqcv3eL5WqGYHWAt07gyVLoEVp1VbYchQ=";
+  cargoHash = "sha256-JVWa5vQcskXEgOqAxr2CKQDMjYakA1HqinDbKfRp/Wo=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/cu/cubeb/package.nix b/pkgs/by-name/cu/cubeb/package.nix
index cf87bc2b9069..706c98dddbbb 100644
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cubeb";
-  version = "0-unstable-2025-08-05";
+  version = "0-unstable-2025-08-13";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cubeb";
-    rev = "d78a19ba4a892abfdfd7eeeb19fa7ffe3d80938c";
-    hash = "sha256-sjv5XKZu9uX2y2HN+BFttOsb6bECEpl0oRneYxNOZgU=";
+    rev = "46b2f23a2929fc367a8cd07a43975dda1e2ebc69";
+    hash = "sha256-7Y1Sshr1TXBhuNS/tmbT4UL74TycWZvTVyz1yYSXhbY=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index f3112688e9d7..6b6e4072d5ce 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -41,17 +41,17 @@ let
 in
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "9.0.3";
+  version = "9.1.0";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-Zanx6Hg05+mvxdga8zQoCv13/kdAMnyCBMfuihvQv3M=";
+    hash = "sha256-w8tFpJeEx0rgzz0z3916FKEjvpewsCAXDWdSTSXo/bg=";
   };
 
-  vendorHash = "sha256-PvqG4ogIiFeDN7gwM+cECXFjo9FBkdzglf+nuLqAZhE=";
+  vendorHash = "sha256-vjsrnPg5D9+Ugf3Oeajkif6YmUX3D88QULYVgXiLJ/o=";
 
   # See upstream Makefile
   # https://code.forgejo.org/forgejo/runner/src/branch/main/Makefile
diff --git a/pkgs/by-name/ga/gale/package.nix b/pkgs/by-name/ga/gale/package.nix
index a4588738b211..7631b0e56b4e 100644
--- a/pkgs/by-name/ga/gale/package.nix
+++ b/pkgs/by-name/ga/gale/package.nix
@@ -20,13 +20,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gale";
-  version = "1.9.2";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "Kesomannen";
     repo = "gale";
     tag = finalAttrs.version;
-    hash = "sha256-AADU89Nxy7dpmamRdvCSe5ItwoVsRvgQocoMKs7qUZo=";
+    hash = "sha256-LdMuAQ7eTPiEZRxxjGdycrI53JwJQ3grK5QORPhfo50=";
   };
 
   postPatch = ''
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-+eSEOcmrY+3LpOssJzXHFQYKkvdacl5K6FPfcf7LTUQ=";
+  cargoHash = "sha256-0wWU9Tf5NlYXrflIDghEwyjeR8j96CK0TATU1tWO418=";
 
   nativeBuildInputs = [
     jq
diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 204a7075b6e9..1ac015eb2dff 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "ghostfolio";
-  version = "2.189.0";
+  version = "2.191.1";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = version;
-    hash = "sha256-rHqg7ziUdir6jWL4Xo/n9I2lNCmpBWFI34LQAS5mPsM=";
+    hash = "sha256-goaR1R1jgcZ7mPeSBYAu+kd59GCIThdjvuq1t5rTdRI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-hRDBNt2JIdjWYJLmW5BkW5wJ8yzcqQRwS2jRJKFrZL0=";
+  npmDepsHash = "sha256-RkpVmpKYHen06LxcQ1gFx6L8P/WOnjkVaHcDk8uqAKI=";
 
   nativeBuildInputs = [
     prisma
diff --git a/pkgs/by-name/gi/ginkgo/package.nix b/pkgs/by-name/gi/ginkgo/package.nix
index 4d9107f2a17c..4d72bf7040ed 100644
--- a/pkgs/by-name/gi/ginkgo/package.nix
+++ b/pkgs/by-name/gi/ginkgo/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "2.23.4";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-bTgZHO9dArqYKCqruQPzpiLFtzK9RzxOonwl0SmoNQc=";
+    sha256 = "sha256-uFWoIkUTDx9egox3pZ3J6rmyz/1K5OnPPLW20YVapf0=";
   };
-  vendorHash = "sha256-iwKOgeUbzlfrto5t0utEdKb+PVqcpmViuDhK2PBAzHw=";
+  vendorHash = "sha256-dpTueiGR0sibaTnVJxHLTTK7cp8MbAO992qIsXBKufM=";
 
   # integration tests expect more file changes
   # types tests are missing CodeLocation
diff --git a/pkgs/by-name/go/go-sendxmpp/package.nix b/pkgs/by-name/go/go-sendxmpp/package.nix
index 44a1310a345d..e2cc18dad348 100644
--- a/pkgs/by-name/go/go-sendxmpp/package.nix
+++ b/pkgs/by-name/go/go-sendxmpp/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-sendxmpp";
-  version = "0.14.1";
+  version = "0.15.0";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "mdosch";
     repo = "go-sendxmpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nQ2URhkOp0mb4u4IG3wzGIdhP6svDVMctbu2CHQXj2Y=";
+    hash = "sha256-S4KoCMlW+uUJcQTYkEtlRT4IAALfRFSj2UDZk4A5e5g=";
   };
 
-  vendorHash = "sha256-aMhUsYsQvnhEVkWbjbh84bbStQ4b/0ZHEvzEhXSlFyw=";
+  vendorHash = "sha256-Qe95u+M9X45cVO9MNLPxoyMyoWOAYYQ2n/GorD/PMIA=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index 2c645fbdb1ef..56afa174378f 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.21.6";
+  version = "2.21.7";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-kMz97dsWUbP4taRjxS84I+NWPyefVlP/WaY6pk7K6Q0=";
+    hash = "sha256-uHM/rqKwHs+THH4+jdGXfbPe2A+NtkbN2OUcsnJL8R0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ig/igir/package.nix b/pkgs/by-name/ig/igir/package.nix
index 44ecd284648b..79900e342480 100644
--- a/pkgs/by-name/ig/igir/package.nix
+++ b/pkgs/by-name/ig/igir/package.nix
@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "igir";
-  version = "4.1.2";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "emmercm";
     repo = "igir";
     rev = "v${version}";
-    hash = "sha256-L9bY3ep0HqRimYTqfW1yqbnnas4gjsD2emtJnWxGQaQ=";
+    hash = "sha256-t0iGQC3U95707n4iVLbWynh3CadOPFKBEoXPg4rNjVo=";
   };
 
-  npmDepsHash = "sha256-56pTJ1VZcoqDb56qzvfxEZUubu82n55O5R0JFRNy5HE=";
+  npmDepsHash = "sha256-qFgyqh3e2A6D+MaEUoV1jGRp1wJKvB8Dcr5XPrezlSk=";
 
   # I have no clue why I have to do this
   postPatch = ''
diff --git a/pkgs/by-name/md/mdsf/package.nix b/pkgs/by-name/md/mdsf/package.nix
index 0637d345e27b..c9bdd1c25159 100644
--- a/pkgs/by-name/md/mdsf/package.nix
+++ b/pkgs/by-name/md/mdsf/package.nix
@@ -7,7 +7,7 @@
 }:
 let
   pname = "mdsf";
-  version = "0.5.1";
+  version = "0.10.4";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -16,17 +16,48 @@ rustPlatform.buildRustPackage {
     owner = "hougesen";
     repo = "mdsf";
     tag = "v${version}";
-    hash = "sha256-KHTWE3ENRc/VHrgwAag6DsnEU3c8Nqw15jR5jWlNrk4=";
+    hash = "sha256-NH3DE6ef1HuS5ADVFros+iDQMZVVgG8V9OuFzzkig8g=";
   };
 
-  cargoHash = "sha256-kgqRwYjDc/eV9wv1G6aAhfrGpoYDPCFfqaTm+T2p7uw=";
+  cargoHash = "sha256-dGqFRXezzqOpHA74fnLUGQAI8KgbPmWIL46UP0wza40=";
 
   checkFlags = [
-    "--skip=tests::it_should_add_go_package_if_missing"
-    "--skip=tests::it_should_format_the_code"
-    "--skip=tests::it_should_format_the_codeblocks_that_start_with_whitespace"
-    "--skip=tests::it_should_not_care_if_go_package_is_set"
-    "--skip=tests::it_should_not_modify_outside_blocks"
+    # Failing due to the method under test trying to create a directory & write to the filesystem
+    "--skip=caching::test_cache_entry::it_should_work"
+    # Permissions denied due to the test trying to remove a directory
+    "--skip=commands::prune_cache::test_run::it_should_remove_cache_directory"
+    # Permissions denied due to the test trying to write to a file
+    "--skip=config::test_config::it_should_error_on_broken_config"
+    # The following tests try to create tmp files
+    "--skip=format::accepts_multiple_file_paths"
+    "--skip=format::accepts_multiple_file_paths_with_thread_argument"
+    "--skip=format::accepts_multiple_file_paths_with_thread_argument_zero"
+    "--skip=format::format_with_cache_arg"
+    "--skip=format::formats_broken_input"
+    "--skip=format::formats_broken_input_stdin"
+    "--skip=format::formats_broken_input_with_debug_arg"
+    "--skip=format::on_missing_tool_binary_fail_cli"
+    "--skip=format::on_missing_tool_binary_fail_config"
+    "--skip=format::on_missing_tool_binary_fail_fast_cli"
+    "--skip=format::on_missing_tool_binary_fail_fast_config"
+    "--skip=format::on_missing_tool_binary_ignore_cli"
+    "--skip=format::on_missing_tool_binary_ignore_config"
+    "--skip=format::on_missing_tool_binary_prioritize_cli"
+    "--skip=format::supports_config_path_argument"
+    # Depends on one of gofumpt, gofmt, or crlfmt being available
+    "--skip=test_lib::it_should_add_go_package_if_missing"
+    # The following tests depend on rustfmt being available
+    "--skip=test_lib::it_should_format_the_code"
+    "--skip=test_lib::it_should_format_the_codeblocks_that_start_with_whitespace"
+    "--skip=test_lib::it_should_not_care_if_go_package_is_set"
+    "--skip=test_lib::it_should_not_modify_outside_blocks"
+    # The following tests try to interact with the file system
+    "--skip=verify::accepts_multiple_file_paths_broken"
+    "--skip=verify::accepts_multiple_file_paths_mixed"
+    "--skip=verify::fails_with_broken_input"
+    # The following tests try to interact with stdin
+    "--skip=verify::success_with_formatted_input_stdin"
+    "--skip=verify::supports_log_level_argument"
   ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -34,7 +65,7 @@ rustPlatform.buildRustPackage {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Tool for formatting a linting markdown code snippets using language specific tools";
+    description = "Format markdown code blocks using your favorite tools";
     homepage = "https://github.com/hougesen/mdsf";
     changelog = "https://github.com/hougesen/mdsf/releases";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/mo/mockgen/package.nix b/pkgs/by-name/mo/mockgen/package.nix
index 0a146317b339..62c07b79cf70 100644
--- a/pkgs/by-name/mo/mockgen/package.nix
+++ b/pkgs/by-name/mo/mockgen/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "mockgen";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "uber-go";
     repo = "mock";
     rev = "v${version}";
-    sha256 = "sha256-650GRaSlGg+ZszACtvn8pJPEnD9NUXM/liLNK7kte6c=";
+    sha256 = "sha256-gYUL+ucnKQncudQDcRt8aDqM7xE5XSKHh4X0qFrvfGs=";
   };
 
-  vendorHash = "sha256-0OnK5/e0juEYrNJuVkr+tK66btRW/oaHpJSDakB32Bc=";
+  vendorHash = "sha256-Cf7lKfMuPFT/I1apgChUNNCG2C7SrW7ncF8OusbUs+A=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/mu/muffon/package.nix b/pkgs/by-name/mu/muffon/package.nix
index 70030c4925e8..8cb1e4ad2523 100644
--- a/pkgs/by-name/mu/muffon/package.nix
+++ b/pkgs/by-name/mu/muffon/package.nix
@@ -7,10 +7,10 @@
 
 let
   pname = "muffon";
-  version = "2.2.0";
+  version = "2.3.0";
   src = fetchurl {
     url = "https://github.com/staniel359/muffon/releases/download/v${version}/muffon-${version}-linux-x86_64.AppImage";
-    hash = "sha256-VzT/jlNmUYFmUUqi8EzE4ilawezqhSgXHz32+S3FMTo=";
+    hash = "sha256-C9oaRXS4w89i4tq/hWh5n5uHUETzaoEid49OII/+5dg=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname src version; };
 in
diff --git a/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch b/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
index 8b29420c64bb..f2359a8228bc 100644
--- a/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
+++ b/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
@@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 3cab120d..abc526b1 100644
+index a4794196..66525432 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -128,7 +128,7 @@ target_link_libraries(
+@@ -140,7 +140,7 @@ target_link_libraries(
            lodepng
            qhullstatic_r
            tinyobjloader
@@ -12,52 +12,19 @@ index 3cab120d..abc526b1 100644
  
  set_target_properties(
 diff --git a/cmake/MujocoDependencies.cmake b/cmake/MujocoDependencies.cmake
-index 78522705..7c64e22a 100644
+index cb17621a..e1bd0e9d 100644
 --- a/cmake/MujocoDependencies.cmake
 +++ b/cmake/MujocoDependencies.cmake
-@@ -93,28 +93,36 @@ set(BUILD_SHARED_LIBS
+@@ -93,8 +93,6 @@ set(BUILD_SHARED_LIBS
  if(NOT TARGET lodepng)
    FetchContent_Declare(
      lodepng
 -    GIT_REPOSITORY https://github.com/lvandeve/lodepng.git
 -    GIT_TAG ${MUJOCO_DEP_VERSION_lodepng}
    )
-+endif()
- 
--  FetchContent_GetProperties(lodepng)
--  if(NOT lodepng_POPULATED)
--    FetchContent_Populate(lodepng)
--    # This is not a CMake project.
--    set(LODEPNG_SRCS ${lodepng_SOURCE_DIR}/lodepng.cpp)
--    set(LODEPNG_HEADERS ${lodepng_SOURCE_DIR}/lodepng.h)
--    add_library(lodepng STATIC ${LODEPNG_HEADERS} ${LODEPNG_SRCS})
--    target_compile_options(lodepng PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
--    target_link_options(lodepng PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
--    target_include_directories(lodepng PUBLIC ${lodepng_SOURCE_DIR})
-+if(NOT TARGET lodepng)
-+  if(NOT MUJOCO_USE_SYSTEM_lodepng)
-+    fetchcontent_declare(
-+      lodepng
-+      GIT_REPOSITORY https://github.com/lvandeve/lodepng.git
-+      GIT_TAG ${MUJOCO_DEP_VERSION_lodepng}
-+    )
-+
-+    FetchContent_GetProperties(lodepng)
-+    if(NOT lodepng_POPULATED)
-+      FetchContent_Populate(lodepng)
-+      # This is not a CMake project.
-+      set(LODEPNG_SRCS ${lodepng_SOURCE_DIR}/lodepng.cpp)
-+      set(LODEPNG_HEADERS ${lodepng_SOURCE_DIR}/lodepng.h)
-+      add_library(lodepng STATIC ${LODEPNG_HEADERS} ${LODEPNG_SRCS})
-+      target_compile_options(lodepng PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
-+      target_link_options(lodepng PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
-+      target_include_directories(lodepng PUBLIC ${lodepng_SOURCE_DIR})
-+    endif()
-+  else()
-+    find_package(lodepng REQUIRED)
-   endif()
- endif()
  
+   FetchContent_GetProperties(lodepng)
+@@ -113,8 +111,6 @@ endif()
  if(NOT TARGET marchingcubecpp)
    FetchContent_Declare(
      marchingcubecpp
@@ -66,19 +33,9 @@ index 78522705..7c64e22a 100644
    )
  
    FetchContent_GetProperties(marchingcubecpp)
-@@ -124,119 +132,157 @@ if(NOT TARGET marchingcubecpp)
-   endif()
- endif()
- 
-+option(MUJOCO_USE_SYSTEM_qhull "Use installed qhull version." OFF)
-+mark_as_advanced(MUJOCO_USE_SYSTEM_qhull)
-+
- set(QHULL_ENABLE_TESTING OFF)
- 
- findorfetch(
+@@ -130,13 +126,9 @@ findorfetch(
    USE_SYSTEM_PACKAGE
--  OFF
-+  ${MUJOCO_USE_SYSTEM_qhull}
+   OFF
    PACKAGE_NAME
 -  qhull
 +  Qhull
@@ -91,46 +48,7 @@ index 78522705..7c64e22a 100644
    TARGETS
    qhull
    EXCLUDE_FROM_ALL
- )
--# MuJoCo includes a file from libqhull_r which is not exported by the qhull include directories.
--# Add it to the target.
--target_include_directories(
--  qhullstatic_r INTERFACE $<BUILD_INTERFACE:${qhull_SOURCE_DIR}/src/libqhull_r>
--)
--target_compile_options(qhullstatic_r PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
--target_link_options(qhullstatic_r PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
-+if(NOT MUJOCO_USE_SYSTEM_qhull)
-+  # MuJoCo includes a file from libqhull_r which is not exported by the qhull include directories.
-+  # Add it to the target.
-+  target_include_directories(
-+    qhullstatic_r INTERFACE $<BUILD_INTERFACE:${qhull_SOURCE_DIR}/src/libqhull_r>
-+  )
-+  target_compile_options(qhullstatic_r PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
-+  target_link_options(qhullstatic_r PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
-+else()
-+  if(NOT TARGET qhullstatic_r)
-+    add_library(qhullstatic_r INTERFACE)
-+    set_target_properties(qhullstatic_r PROPERTIES INTERFACE_LINK_LIBRARIES Qhull::qhull_r)
-+
-+    # Workaround as headers are installed in <prefix>/include/libqhull_r/something.h
-+    # but mujoco include them as #include <something.h>
-+    get_property(qhull_include_dirs TARGET Qhull::qhull_r PROPERTY INTERFACE_INCLUDE_DIRECTORIES)
-+    foreach(qhull_include_dir IN LISTS qhull_include_dirs)
-+      target_include_directories(qhullstatic_r INTERFACE ${qhull_include_dirs}/libqhull_r)
-+    endforeach()
-+    target_include_directories(qhullstatic_r INTERFACE )
-+  endif()
-+endif()
-+
-+option(MUJOCO_USE_SYSTEM_tinyxml2 "Use installed tinyxml2 version." OFF)
-+mark_as_advanced(MUJOCO_USE_SYSTEM_tinyxml2)
- 
- set(tinyxml2_BUILD_TESTING OFF)
- findorfetch(
-   USE_SYSTEM_PACKAGE
--  OFF
-+  ${MUJOCO_USE_SYSTEM_tinyxml2}
-   PACKAGE_NAME
+@@ -157,12 +149,8 @@ findorfetch(
    tinyxml2
    LIBRARY_NAME
    tinyxml2
@@ -143,21 +61,8 @@ index 78522705..7c64e22a 100644
 +  tinyxml2::tinyxml2
    EXCLUDE_FROM_ALL
  )
--target_compile_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
--target_link_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
-+if(NOT MUJOCO_USE_SYSTEM_tinyxml2)
-+  target_compile_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
-+  target_link_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
-+endif()
-+
-+option(MUJOCO_USE_SYSTEM_tinyobjloader "Use installed tinyobjloader version." OFF)
-+mark_as_advanced(MUJOCO_USE_SYSTEM_tinyobjloader)
- 
- findorfetch(
-   USE_SYSTEM_PACKAGE
--  OFF
-+  ${MUJOCO_USE_SYSTEM_tinyobjloader}
-   PACKAGE_NAME
+ target_compile_options(tinyxml2 PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
+@@ -175,35 +163,32 @@ findorfetch(
    tinyobjloader
    LIBRARY_NAME
    tinyobjloader
@@ -170,17 +75,6 @@ index 78522705..7c64e22a 100644
    EXCLUDE_FROM_ALL
  )
  
-+if(MUJOCO_USE_SYSTEM_tinyobjloader)
-+  # As of tinyobjloader v2.0.0rc10, the tinyobjloader target is named tinyobjloader in the build,
-+  # but tinyobjloader::tinyobjloader when it is installed. To deal with this, if tinyobjloader is
-+  # found in the system, we create an ALIAS
-+  # The following is equivalent to add_library(tinyobjloader ALIAS tinyobjloader::tinyobjloader),
-+  # but compatible with CMake 3.16 . Once the minimum CMake is bumped to CMake 3.18, we can use
-+  # the simpler version
-+  add_library(tinyobjloader INTERFACE IMPORTED)
-+  set_target_properties(tinyobjloader PROPERTIES INTERFACE_LINK_LIBRARIES tinyobjloader::tinyobjloader)
-+endif()
-+
 +option(MUJOCO_USE_SYSTEM_sdflib "Use installed sdflib version." OFF)
 +mark_as_advanced(MUJOCO_USE_SYSTEM_sdflib)
 +
@@ -207,22 +101,14 @@ index 78522705..7c64e22a 100644
  )
 -target_compile_options(SdfLib PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
 -target_link_options(SdfLib PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
-+
 +if(NOT MUJOCO_USE_SYSTEM_sdflib)
 +  target_compile_options(SdfLib PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
 +  target_link_options(SdfLib PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
 +endif()
-+
-+option(MUJOCO_USE_SYSTEM_ccd "Use installed ccd version." OFF)
-+mark_as_advanced(MUJOCO_USE_SYSTEM_ccd)
  
  set(ENABLE_DOUBLE_PRECISION ON)
  set(CCD_HIDE_ALL_SYMBOLS ON)
- findorfetch(
-   USE_SYSTEM_PACKAGE
--  OFF
-+  ${MUJOCO_USE_SYSTEM_ccd}
-   PACKAGE_NAME
+@@ -214,10 +199,6 @@ findorfetch(
    ccd
    LIBRARY_NAME
    ccd
@@ -233,55 +119,7 @@ index 78522705..7c64e22a 100644
    TARGETS
    ccd
    EXCLUDE_FROM_ALL
- )
--target_compile_options(ccd PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
--target_link_options(ccd PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
--
--# libCCD has an unconditional `#define _CRT_SECURE_NO_WARNINGS` on Windows.
--# TODO(stunya): Remove this after https://github.com/danfis/libccd/pull/77 is merged.
--if(WIN32)
--  if(MSVC)
--    # C4005 is the MSVC equivalent of -Wmacro-redefined.
--    target_compile_options(ccd PRIVATE /wd4005)
--  else()
--    target_compile_options(ccd PRIVATE -Wno-macro-redefined)
-+
-+if(NOT MUJOCO_USE_SYSTEM_ccd)
-+  target_compile_options(ccd PRIVATE ${MUJOCO_MACOS_COMPILE_OPTIONS})
-+  target_link_options(ccd PRIVATE ${MUJOCO_MACOS_LINK_OPTIONS})
-+  # This is necessary to ensure that the any library that consumes the ccd
-+  # compiled internally by MuJoCo (as static library) has CCD_EXPORT correctly
-+  # defined as an empty string. For ccd itself, this is ensured by the variable
-+  # CCD_HIDE_ALL_SYMBOLS set to ON before the call to findorfetch
-+  # See https://github.com/danfis/libccd/pull/79
-+  target_compile_definitions(ccd INTERFACE CCD_STATIC_DEFINE)
-+
-+  # libCCD has an unconditional `#define _CRT_SECURE_NO_WARNINGS` on Windows.
-+  # TODO(stunya): Remove this after https://github.com/danfis/libccd/pull/77 is merged.
-+  if(WIN32)
-+    if(MSVC)
-+      # C4005 is the MSVC equivalent of -Wmacro-redefined.
-+      target_compile_options(ccd PRIVATE /wd4005)
-+    else()
-+      target_compile_options(ccd PRIVATE -Wno-macro-redefined)
-+    endif()
-   endif()
- endif()
- 
- if(MUJOCO_BUILD_TESTS)
-+  option(MUJOCO_USE_SYSTEM_abseil "Use installed abseil version." OFF)
-+  mark_as_advanced(MUJOCO_USE_SYSTEM_abseil)
-+
-   set(ABSL_PROPAGATE_CXX_STD ON)
- 
-   # This specific version of Abseil does not have the following variable. We need to work with BUILD_TESTING
-@@ -249,15 +295,11 @@ if(MUJOCO_BUILD_TESTS)
-   set(ABSL_BUILD_TESTING OFF)
-   findorfetch(
-     USE_SYSTEM_PACKAGE
--    OFF
-+    ${MUJOCO_USE_SYSTEM_abseil}
-     PACKAGE_NAME
+@@ -254,10 +235,6 @@ if(MUJOCO_BUILD_TESTS)
      absl
      LIBRARY_NAME
      abseil-cpp
@@ -292,13 +130,7 @@ index 78522705..7c64e22a 100644
      TARGETS
      absl::core_headers
      EXCLUDE_FROM_ALL
-@@ -276,22 +318,20 @@ if(MUJOCO_BUILD_TESTS)
- 
-   findorfetch(
-     USE_SYSTEM_PACKAGE
--    OFF
-+    ${MUJOCO_USE_SYSTEM_gtest}
-     PACKAGE_NAME
+@@ -281,14 +258,9 @@ if(MUJOCO_BUILD_TESTS)
      GTest
      LIBRARY_NAME
      googletest
@@ -315,19 +147,7 @@ index 78522705..7c64e22a 100644
      EXCLUDE_FROM_ALL
    )
  
-+  option(MUJOCO_USE_SYSTEM_benchmark "Use installed benchmark version." OFF)
-+  mark_as_advanced(MUJOCO_USE_SYSTEM_benchmark)
-+
-   set(BENCHMARK_EXTRA_FETCH_ARGS "")
-   if(WIN32 AND NOT MSVC)
-     set(BENCHMARK_EXTRA_FETCH_ARGS
-@@ -310,15 +350,11 @@ if(MUJOCO_BUILD_TESTS)
- 
-   findorfetch(
-     USE_SYSTEM_PACKAGE
--    OFF
-+    ${MUJOCO_USE_SYSTEM_benchmark}
-     PACKAGE_NAME
+@@ -315,10 +287,6 @@ if(MUJOCO_BUILD_TESTS)
      benchmark
      LIBRARY_NAME
      benchmark
@@ -338,22 +158,14 @@ index 78522705..7c64e22a 100644
      TARGETS
      benchmark::benchmark
      benchmark::benchmark_main
-@@ -328,15 +364,18 @@ if(MUJOCO_BUILD_TESTS)
- endif()
+@@ -329,14 +297,12 @@ endif()
  
  if(MUJOCO_TEST_PYTHON_UTIL)
-+  option(MUJOCO_USE_SYSTEM_Eigen3 "Use installed Eigen3 version." OFF)
-+  mark_as_advanced(MUJOCO_USE_SYSTEM_Eigen3)
-+
    add_compile_definitions(EIGEN_MPL2_ONLY)
 -  if(NOT TARGET eigen)
--    # Support new IN_LIST if() operator.
--    set(CMAKE_POLICY_DEFAULT_CMP0057 NEW)
 +  if(NOT TARGET Eigen3::Eigen)
-+    if(NOT MUJOCO_USE_SYSTEM_Eigen3)
-+      # Support new IN_LIST if() operator.
-+      set(CMAKE_POLICY_DEFAULT_CMP0057 NEW)
-+    endif()
+     # Support new IN_LIST if() operator.
+     set(CMAKE_POLICY_DEFAULT_CMP0057 NEW)
  
      FetchContent_Declare(
        Eigen3
@@ -362,26 +174,6 @@ index 78522705..7c64e22a 100644
      )
  
      FetchContent_GetProperties(Eigen3)
-@@ -348,6 +387,19 @@ if(MUJOCO_TEST_PYTHON_UTIL)
-       set_target_properties(
-         Eigen3::Eigen PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${eigen3_SOURCE_DIR}"
-       )
-+
-+      fetchcontent_getproperties(Eigen3)
-+      # if(NOT Eigen3_POPULATED)
-+      #   fetchcontent_populate(Eigen3)
-+
-+      #   # Mark the library as IMPORTED as a workaround for https://gitlab.kitware.com/cmake/cmake/-/issues/15415
-+      #   add_library(Eigen3::Eigen INTERFACE IMPORTED)
-+      #   set_target_properties(
-+      #     Eigen3::Eigen PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${eigen3_SOURCE_DIR}"
-+      #   )
-+      # endif()
-+    else()
-+      find_package(Eigen3 REQUIRED)
-     endif()
-   endif()
- endif()
 diff --git a/plugin/sdf/CMakeLists.txt b/plugin/sdf/CMakeLists.txt
 index 8b834971..25021fa1 100644
 --- a/plugin/sdf/CMakeLists.txt
diff --git a/pkgs/by-name/rt/rtklib-ex/package.nix b/pkgs/by-name/rt/rtklib-ex/package.nix
new file mode 100644
index 000000000000..f996f266b3ea
--- /dev/null
+++ b/pkgs/by-name/rt/rtklib-ex/package.nix
@@ -0,0 +1,54 @@
+{
+  stdenv,
+  cmake,
+  nix-update-script,
+  blas,
+  lapack,
+  lib,
+  fetchFromGitHub,
+  qt6,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rtklib-ex";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "rtklibexplorer";
+    repo = "RTKLIB";
+    tag = "v${version}";
+    hash = "sha256-j00VEQvxOiAc3EQX3x2b3RxYkbtvCZ17ugnW6b6ChWU=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    blas
+    lapack
+    qt6.wrapQtAppsHook
+    qt6.qttools
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtserialport
+  ];
+
+  doCheck = true;
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_INSTALL_DATAROOTDIR" "${placeholder "out"}/share")
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Open Source Program Package for GNSS Positioning";
+    homepage = "https://rtkexplorer.com";
+    changelog = "https://github.com/rtklibexplorer/RTKLIB/releases/tag/${src.tag}";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.skaphi ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ru/rundeck/package.nix b/pkgs/by-name/ru/rundeck/package.nix
index c56b3c2082cd..d778eb973a97 100644
--- a/pkgs/by-name/ru/rundeck/package.nix
+++ b/pkgs/by-name/ru/rundeck/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rundeck";
-  version = "5.13.0-20250625";
+  version = "5.14.1-20250818";
 
   src = fetchurl {
     url = "https://packagecloud.io/pagerduty/rundeck/packages/java/org.rundeck/rundeck-${finalAttrs.version}.war/artifacts/rundeck-${finalAttrs.version}.war/download?distro_version_id=167";
-    hash = "sha256-RqyJ0/gZQ1gIYSPoYfGGN5VB5ubUMl00pHPlw6v6tBQ=";
+    hash = "sha256-x+Le75dX5NcnOAMK77VyKltbwqNy0tfpXB/HeXKCS4A=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index 8a8e55ae5fbd..c71b190539f2 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -13,6 +13,7 @@
   gsl,
   man,
   pkg-config,
+  writableTmpDirAsHomeHook,
 
   unstableGitUpdater,
   writeScript,
@@ -183,6 +184,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [
     man
     pkg-config
+    writableTmpDirAsHomeHook
   ];
 
   installCheckInputs = [
@@ -190,19 +192,18 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   /*
-    XXX: The upstream assumes that `$HOME` is `/home/$USER`, and the source files
-    lie in `$HOME/cl` . The script presented here uses a fake `$USER` and a
-    symbolic linked `$HOME/cl` , which make the test suite work but do not meet
-    the conditions completely.
+    The test suite assumes that "there are two subdirectories of the home directory referred to: cl and test",
+    where `cl` is "the s7 source directory" and `test` is "a safe place to write temp files".
   */
   installCheckPhase = ''
     runHook preInstallCheck
 
+    ln -sr . $HOME/cl
+    mkdir $HOME/test
+
     $CC s7.c -c -o s7.o
     $CC ffitest.c s7.o -o ffitest
     mv ffitest $dst_bin
-    mkdir -p nix-build/home
-    ln -sr . nix-build/home/cl
 
     ${lib.optionalString withArb ''
       substituteInPlace s7test.scm \
@@ -211,7 +212,7 @@ stdenv.mkDerivation (finalAttrs: {
       cp $out/lib/libarb_s7.so .
     ''}
 
-    USER=nix-s7-builder PATH="$dst_bin:$PATH" HOME=$PWD/nix-build/home \
+    PATH="$dst_bin:$PATH" \
         s7-repl s7test.scm
 
     rm $dst_bin/ffitest
diff --git a/pkgs/by-name/sp/spacetimedb/fetchers.nix b/pkgs/by-name/sp/spacetimedb/fetchers.nix
new file mode 100644
index 000000000000..b98b4aa6fa12
--- /dev/null
+++ b/pkgs/by-name/sp/spacetimedb/fetchers.nix
@@ -0,0 +1,21 @@
+# not a stable interface, do not reference outside the deno package but make a
+# copy if you need
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+{
+  fetchLibrustyV8 =
+    args:
+    fetchurl {
+      name = "librusty_v8-${args.version}";
+      url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+      sha256 = args.shas.${stdenv.hostPlatform.system};
+      meta = {
+        inherit (args) version;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    };
+}
diff --git a/pkgs/by-name/sp/spacetimedb/librusty_v8.nix b/pkgs/by-name/sp/spacetimedb/librusty_v8.nix
new file mode 100644
index 000000000000..d44e299628a3
--- /dev/null
+++ b/pkgs/by-name/sp/spacetimedb/librusty_v8.nix
@@ -0,0 +1,12 @@
+# auto-generated file -- DO NOT EDIT!
+{ fetchLibrustyV8 }:
+
+fetchLibrustyV8 {
+  version = "137.2.1";
+  shas = {
+    x86_64-linux = "sha256-1mV+UjvJsIyLFpBGVDrGxr/rqUgKzRRFwgnMyYTb/pM=";
+    aarch64-linux = "sha256-Rp7chA+GjsozCkMQrDnOoi4VhVJdrFZd1BuLfcRhGjw=";
+    x86_64-darwin = "sha256-tDMk+F6D/h4osYlzT2qAhqfHYUSDk3nL4RxEKjhBhD0=";
+    aarch64-darwin = "sha256-1eBUjKFalb/CIPfHYP8SvqIaxRep8vU6u9QFShOMUsQ=";
+  };
+}
diff --git a/pkgs/by-name/sp/spacetimedb/package.nix b/pkgs/by-name/sp/spacetimedb/package.nix
index 00e7bffea4bf..b7101fe064e6 100644
--- a/pkgs/by-name/sp/spacetimedb/package.nix
+++ b/pkgs/by-name/sp/spacetimedb/package.nix
@@ -1,24 +1,28 @@
 {
   lib,
+  callPackage,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
   perl,
   git,
   versionCheckHook,
+  librusty_v8 ? callPackage ./librusty_v8.nix {
+    inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
+  },
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spacetimedb";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "clockworklabs";
     repo = "spacetimedb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6Fqv3g9e/9i5JMYHwbymm0n2mBEI0207TAyu/nF39Xk=";
+    hash = "sha256-KslKsTVhc4xz1XMkkk40tqVZnLoL9UuSPvFHvdZ5vrI=";
   };
 
-  cargoHash = "sha256-N7A7GAdk9j84qtKHTMtloU469FRwiYtqUdSytFVidlA=";
+  cargoHash = "sha256-DpGKSWCXSp7fvA1OdZ4YZnanvmKlnxBGsyhEThNwkGo=";
 
   nativeBuildInputs = [
     pkg-config
@@ -34,6 +38,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   doInstallCheck = true;
+
+  env.RUSTY_V8_ARCHIVE = librusty_v8;
+
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/spacetime";
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 4b4776588274..4022ce0795c3 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.1-alpha.18";
+  version = "0.0.1-alpha.19";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-ik46vDshBujxuMN7BYKCUxUjFc+sZ3jUTRfV0eKJMu0=";
+    hash = "sha256-CCk6ZrhEFMLYtjNrzp7PBH2W4QFSH1Bqlw+Wh2OPFC4=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-2U5qK8gxuRACZ4lML085+No5ppmotTPnm35ZF9ydR4M=";
+  cargoHash = "sha256-TNXWRBJInnLiFyf29O8c6ZE7Qhb6sXM0fPRDqMPWSSw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/we/wechat/darwin.nix b/pkgs/by-name/we/wechat/darwin.nix
index e82885d27d6f..3ecc69dba97a 100644
--- a/pkgs/by-name/we/wechat/darwin.nix
+++ b/pkgs/by-name/we/wechat/darwin.nix
@@ -17,6 +17,11 @@ stdenvNoCC.mkDerivation {
 
   # dmg is APFS formatted
   nativeBuildInputs = [ _7zz ];
+  # ERROR: Dangerous link path was ignored : WeChat.app/Contents/MacOS/WeChatAppEx.app/Contents/Frameworks/WeChatAppEx Framework.framework/Versions/C/Libraries/xfile/libxfile_skia.dylib : ../xeditor/libxeditor_app.dylib
+  unpackCmd = ''
+    7zz x -snld "$curSrc"
+  '';
+
   sourceRoot = ".";
 
   installPhase = ''
diff --git a/pkgs/by-name/we/wechat/package.nix b/pkgs/by-name/we/wechat/package.nix
index d68959fcdf4a..1849187a4b0c 100644
--- a/pkgs/by-name/we/wechat/package.nix
+++ b/pkgs/by-name/we/wechat/package.nix
@@ -30,14 +30,14 @@ let
       # https://dldir1.qq.com/weixin/mac/mac-release.xml
       any-darwin =
         let
-          version = "4.0.6.25-29387";
+          version = "4.1.0.19-29668";
           version' = lib.replaceString "-" "_" version;
         in
         {
           inherit version;
           src = fetchurl {
             url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_${version'}.dmg";
-            hash = "sha256-vdeUUJdbIxT8tX5Xo9QIzbWTwRjtSXwrNoImMwt5xkY=";
+            hash = "sha256-EAKfskB3zY4C05MVCoyxzW6wuRw8b2nXIynyEjx8Rvw=";
           };
         };
     in
diff --git a/pkgs/by-name/wx/wxwidgets_3_3/package.nix b/pkgs/by-name/wx/wxwidgets_3_3/package.nix
new file mode 100644
index 000000000000..8da1ac6fa22e
--- /dev/null
+++ b/pkgs/by-name/wx/wxwidgets_3_3/package.nix
@@ -0,0 +1,138 @@
+{
+  lib,
+  stdenv,
+  curl,
+  expat,
+  fetchFromGitHub,
+  gspell,
+  gst_all_1,
+  gtk3,
+  libGL,
+  libGLU,
+  libSM,
+  libXinerama,
+  libXtst,
+  libXxf86vm,
+  libnotify,
+  libpng,
+  libsecret,
+  libtiff,
+  libjpeg_turbo,
+  libxkbcommon,
+  zlib,
+  pcre2,
+  pkg-config,
+  xorgproto,
+  compat30 ? false,
+  compat32 ? true,
+  withMesa ? !stdenv.hostPlatform.isDarwin,
+  withWebKit ? true,
+  webkitgtk_4_1,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wxwidgets";
+  version = "3.3.1";
+
+  src = fetchFromGitHub {
+    owner = "wxWidgets";
+    repo = "wxWidgets";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-eYmZrh9lvDnJ3VAS+TllT21emtKBPAOhqIULw1dTPhk=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
+    libpng
+    libtiff
+    libjpeg_turbo
+    zlib
+    pcre2
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    curl
+    gspell # wxTextCtrl spell checking
+    gtk3
+    libSM
+    libXinerama
+    libXtst
+    libXxf86vm
+    libnotify # wxNotificationMessage backend
+    libsecret # wxSecretStore backend
+    libxkbcommon # proper key codes in key events
+    xorgproto
+  ]
+  ++ lib.optional withMesa libGLU
+  ++ lib.optional (withWebKit && stdenv.hostPlatform.isLinux) webkitgtk_4_1
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    expat
+  ];
+
+  configureFlags = [
+    "--disable-precomp-headers"
+    # This is the default option, but be explicit
+    "--disable-monolithic"
+    "--enable-mediactrl"
+    "--with-nanosvg"
+    "--disable-rpath"
+    "--enable-repro-build"
+    "--enable-webrequest"
+    (if compat30 then "--enable-compat30" else "--disable-compat30")
+    (if compat32 then "--enable-compat32" else "--disable-compat32")
+  ]
+  ++ lib.optional withMesa "--with-opengl"
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "--with-osx_cocoa"
+    "--with-libiconv"
+    "--with-urlsession" # for wxWebRequest
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    "--with-libcurl" # for wxWebRequest
+  ]
+  ++ lib.optionals withWebKit [
+    "--enable-webview"
+    "--enable-webviewwebkit"
+  ];
+
+  SEARCH_LIB = lib.optionalString (
+    !stdenv.hostPlatform.isDarwin
+  ) "${libGLU.out}/lib ${libGL.out}/lib";
+
+  postInstall = "
+    pushd $out/include
+    ln -s wx-*/* .
+    popd
+  ";
+
+  enableParallelBuilding = true;
+
+  passthru = {
+    inherit compat30 compat32;
+  };
+
+  meta = {
+    homepage = "https://www.wxwidgets.org/";
+    description = "Cross-Platform C++ GUI Library";
+    longDescription = ''
+      wxWidgets gives you a single, easy-to-use API for writing GUI applications
+      on multiple platforms that still utilize the native platform's controls
+      and utilities. Link with the appropriate library for your platform and
+      compiler, and your application will adopt the look and feel appropriate to
+      that platform. On top of great GUI functionality, wxWidgets gives you:
+      online help, network programming, streams, clipboard and drag and drop,
+      multithreading, image loading and saving in a variety of popular formats,
+      database support, HTML viewing and printing, and much more.
+    '';
+    license = lib.licenses.wxWindows;
+    maintainers = with lib.maintainers; [
+      tfmoraes
+      fliegendewurst
+      wegank
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 3439c4a4bf9a..544974f145e0 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -58,25 +58,25 @@ let
   # Zoom versions are released at different times per platform and often with different versions.
   # We write them on three lines like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "6.5.9.61929";
-  versions.x86_64-darwin = "6.5.9.61929";
+  versions.aarch64-darwin = "6.5.10.62715";
+  versions.x86_64-darwin = "6.5.10.62715";
 
   # This is the fallback version so that evaluation can produce a meaningful result.
-  versions.x86_64-linux = "6.5.9.3723";
+  versions.x86_64-linux = "6.5.10.3973";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-2V4Cad7/YcI5rSuUu8GI1GCEgio/rG/ZRpedNKqoGvc=";
+      hash = "sha256-O7h+4mfoUSoFd8c7K+C9W6L46PgJvDKj1qb+DG0leco=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-RO+kIHvmvCj9bun2BeCzAm9XMYQOobYyVKqA5ruG0I8=";
+      hash = "sha256-S1pyrguOjEGW87HM+K1B/FI55WJp7Xu8cXvdpRA0sJ8=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-OOa4zRRekXEWLl+BH3bPtCQzRaQAo742C9EqPTZnDR8=";
+      hash = "sha256-OXuhVpWAyfQYdEnjF7I6gOJeDCS1GlSonN5cdvvtJL0=";
     };
   };
 
@@ -209,6 +209,7 @@ let
       pkgs.xorg.libXtst
       pkgs.xorg.libxcb
       pkgs.xorg.libxshmfence
+      pkgs.xorg.xcbutilcursor
       pkgs.xorg.xcbutilimage
       pkgs.xorg.xcbutilkeysyms
       pkgs.xorg.xcbutilrenderutil
diff --git a/pkgs/development/python-modules/google-cloud-compute/default.nix b/pkgs/development/python-modules/google-cloud-compute/default.nix
index 214dc438e5df..d73c8ed9dcca 100644
--- a/pkgs/development/python-modules/google-cloud-compute/default.nix
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-compute";
-  version = "1.34.0";
+  version = "1.35.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_compute";
     inherit version;
-    hash = "sha256-SS6X//PEBs6/R/687KDAq0maMBwhUhPt1Pg/JDdfccI=";
+    hash = "sha256-8TlG3b6ifOqlXMOjICYXfRr20kenbp7UQHJWBn+r2s8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/hf-xet/default.nix b/pkgs/development/python-modules/hf-xet/default.nix
index 39b8a914051b..049d870a81d7 100644
--- a/pkgs/development/python-modules/hf-xet/default.nix
+++ b/pkgs/development/python-modules/hf-xet/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "hf-xet";
-  version = "1.1.7";
+  version = "1.1.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "xet-core";
     tag = "v${version}";
-    hash = "sha256-jOw9ltijM4KB3MyJ5z3XpIpNc2D9DVEP3CyyT6r8xlY=";
+    hash = "sha256-6KANNPFFZCpmDPnMgIBDBypYkkkeI0Las7BFiCHwzXI=";
   };
 
   sourceRoot = "${src.name}/hf_xet";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
       src
       sourceRoot
       ;
-    hash = "sha256-WoMs7GeELuhZitv59aD6X43wiscSFMKKW7mYxaPZ/mQ=";
+    hash = "sha256-G/O2PxdXDCFBSy0PvC8uvRhWib4+DAKPeK5WNV1gxAY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/lifelines/default.nix b/pkgs/development/python-modules/lifelines/default.nix
index c8e2a07bf5b1..d6fb49c7db6f 100644
--- a/pkgs/development/python-modules/lifelines/default.nix
+++ b/pkgs/development/python-modules/lifelines/default.nix
@@ -16,15 +16,14 @@
   pythonOlder,
   scikit-learn,
   scipy,
+  setuptools,
   sybil,
 }:
 
 buildPythonPackage rec {
   pname = "lifelines";
   version = "0.30.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.9";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CamDavidsonPilon";
@@ -33,7 +32,9 @@ buildPythonPackage rec {
     hash = "sha256-rbt0eON8Az5jDvj97RDn3ppWyjbrSa/xumbwhq21g6g=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     autograd
     autograd-gamma
     formulaic
@@ -57,13 +58,17 @@ buildPythonPackage rec {
 
   disabledTestPaths = [ "lifelines/tests/test_estimation.py" ];
 
-  disabledTests = [ "test_datetimes_to_durations_with_different_frequencies" ];
+  disabledTests = [
+    "test_datetimes_to_durations_with_different_frequencies"
+    # AssertionError
+    "test_mice_scipy"
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "Survival analysis in Python";
     homepage = "https://lifelines.readthedocs.io";
     changelog = "https://github.com/CamDavidsonPilon/lifelines/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ swflint ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ swflint ];
   };
 }
diff --git a/pkgs/development/python-modules/lm-eval/default.nix b/pkgs/development/python-modules/lm-eval/default.nix
index ea57224a4d6c..fa1830e3bd4d 100644
--- a/pkgs/development/python-modules/lm-eval/default.nix
+++ b/pkgs/development/python-modules/lm-eval/default.nix
@@ -2,46 +2,64 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools-scm,
+
+  # dependencies
   accelerate,
-  aiohttp,
-  antlr4-python3-runtime,
-  causal-conv1d,
   datasets,
   dill,
   evaluate,
-  hf-transfer,
-  immutabledict,
   jsonlines,
-  langdetect,
-  mamba-ssm,
   more-itertools,
-  nltk,
   numexpr,
-  numpy,
-  optimum,
-  pandas,
   peft,
   pybind11,
   pytablewriter,
-  pytestCheckHook,
-  requests,
   rouge-score,
   sacrebleu,
   scikit-learn,
-  sentencepiece,
   sqlitedict,
-  sympy,
-  tenacity,
-  tiktoken,
   torch,
-  tqdm,
   tqdm-multiprocess,
   transformers,
-  vllm,
-  wandb,
   word2number,
   zstandard,
+
+  # optional-dependencies
+  # api
+  aiohttp,
+  requests,
+  tenacity,
+  tiktoken,
+  tqdm,
+  # hf_transfer
+  hf-transfer,
+  # ifeval
+  immutabledict,
+  langdetect,
+  nltk,
+  # neuronx
+  optimum,
+  # mamba
+  causal-conv1d,
+  mamba-ssm,
+  # math
+  antlr4-python3-runtime,
+  sympy,
+  # sentencepiece
+  sentencepiece,
+  # vllm
+  vllm,
+  # wandb
+  numpy,
+  pandas,
+  wandb,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -84,34 +102,34 @@ buildPythonPackage rec {
 
   optional-dependencies = {
     api = [
-      requests
       aiohttp
+      requests
       tenacity
-      tqdm
       tiktoken
+      tqdm
     ];
     hf_transfer = [ hf-transfer ];
     ifeval = [
-      langdetect
       immutabledict
+      langdetect
       nltk
     ];
     neuronx = [ optimum ] ++ optimum.optional-dependencies.neuronx;
     mamba = [
-      mamba-ssm
       causal-conv1d
+      mamba-ssm
     ];
     math = [
-      sympy
       antlr4-python3-runtime
+      sympy
     ];
     optimum = [ optimum ] ++ optimum.optional-dependencies.openvino;
     sentencepiece = [ sentencepiece ];
     vllm = [ vllm ];
     wandb = [
-      wandb
-      pandas
       numpy
+      pandas
+      wandb
     ];
     # Still missing dependencies for the following:
     # deepsparse, gptq, ibm_watsonx_ai, multilingual, promptsource, sparseml,
@@ -122,16 +140,16 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ]
   ++ optional-dependencies.api;
 
-  preCheck = ''
-    export HOME=$TMP
-  '';
-
   disabledTests = [
     "test_deepsparse" # deepsparse is not available
-    "test_model_tokenized_call_usage" # downloads a model
+
+    # download models from the internet
+    "test_get_batched_requests_with_no_ssl"
+    "test_model_tokenized_call_usage"
   ];
 
   disabledTestPaths = [
@@ -142,9 +160,13 @@ buildPythonPackage rec {
     "tests/test_prompt.py"
     "tests/test_task_manager.py"
     "tests/test_tasks.py"
+    "tests/test_unitxt_tasks.py"
 
     # optimum-intel is not available
     "tests/models/test_openvino.py"
+
+    # zeno-client is not packaged
+    "tests/scripts/test_zeno_visualize.py"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/mlx-lm/default.nix b/pkgs/development/python-modules/mlx-lm/default.nix
index 44040dd7f0b9..ff926ff5305e 100644
--- a/pkgs/development/python-modules/mlx-lm/default.nix
+++ b/pkgs/development/python-modules/mlx-lm/default.nix
@@ -2,13 +2,20 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
+
+  # dependencies
   jinja2,
   mlx,
   numpy,
   protobuf,
   pyyaml,
   transformers,
+
+  # tests
+  lm-eval,
   sentencepiece,
   pytestCheckHook,
   writableTmpDirAsHomeHook,
@@ -40,9 +47,10 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    writableTmpDirAsHomeHook
+    lm-eval
     pytestCheckHook
     sentencepiece
+    writableTmpDirAsHomeHook
   ];
 
   pythonImportsCheck = [
@@ -62,6 +70,7 @@ buildPythonPackage rec {
     "tests/test_prompt_cache.py::TestPromptCache::test_cache_with_generate"
     "tests/test_prompt_cache.py::TestPromptCache::test_trim_cache_with_generate"
     # RuntimeError: [metal_kernel] No GPU back-end.
+    "tests/test_losses.py"
     "tests/test_models.py::TestModels::test_bitnet"
   ];
 
diff --git a/pkgs/development/python-modules/pydevccu/default.nix b/pkgs/development/python-modules/pydevccu/default.nix
index ace4e1f48a14..c7c72dd62b46 100644
--- a/pkgs/development/python-modules/pydevccu/default.nix
+++ b/pkgs/development/python-modules/pydevccu/default.nix
@@ -2,13 +2,14 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  orjson,
   pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pydevccu";
-  version = "0.1.14";
+  version = "0.1.15";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -17,7 +18,7 @@ buildPythonPackage rec {
     owner = "SukramJ";
     repo = "pydevccu";
     tag = version;
-    hash = "sha256-UiMY9qz2b8Mdi8L9mB5jcC7fF8/YUYYiNbaWsXze0vA=";
+    hash = "sha256-wyv/ObAIZmkiytNSVNfbM8M5rkJc5czc1N6PJJd5A6Q=";
   };
 
   postPatch = ''
@@ -25,8 +26,12 @@ buildPythonPackage rec {
       --replace-fail "setuptools==75.6.0" setuptools
   '';
 
+  pythonRelaxDeps = [ "orjson" ];
+
   build-system = [ setuptools ];
 
+  dependencies = [ orjson ];
+
   # Module has no tests
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix b/pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix
index 6aba631c7a1b..1c4f97581c70 100644
--- a/pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix
+++ b/pkgs/development/python-modules/pylibjpeg-openjpeg/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pylibjpeg-openjpeg";
-  version = "2.4.0";
+  version = "2.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "pydicom";
     repo = "pylibjpeg-openjpeg";
     tag = "v${version}";
-    hash = "sha256-T38Ur5NLF9iPTrDwT3GYgI6621A90zWP/leUxSqA70w=";
+    hash = "sha256-siZ/Mm1wmd7dWhGa4rdH9Frxis2jB9av/Kw2dEe5dpI=";
   };
 
   # don't use vendored openjpeg submodule:
@@ -69,7 +69,7 @@ buildPythonPackage rec {
   meta = {
     description = "J2K and JP2 plugin for pylibjpeg";
     homepage = "https://github.com/pydicom/pylibjpeg-openjpeg";
-    changelog = "https://github.com/pydicom/pylibjpeg-openjpeg/releases/tag/v${version}";
+    changelog = "https://github.com/pydicom/pylibjpeg-openjpeg/releases/tag/${src.tag}";
     license = [ lib.licenses.mit ];
     maintainers = with lib.maintainers; [ bcdarwin ];
     # darwin: numerous test failures, test dependency pydicom is marked as unsupported
diff --git a/pkgs/development/python-modules/spectral-cube/default.nix b/pkgs/development/python-modules/spectral-cube/default.nix
index ae8b62ce0858..e1ea25db65bc 100644
--- a/pkgs/development/python-modules/spectral-cube/default.nix
+++ b/pkgs/development/python-modules/spectral-cube/default.nix
@@ -25,16 +25,21 @@
 
 buildPythonPackage rec {
   pname = "spectral-cube";
-  version = "0.6.6";
+  version = "0.6.6-unstable-2025-06-11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "radio-astro-tools";
     repo = "spectral-cube";
-    tag = "v${version}";
-    hash = "sha256-fBjbovBXqUfX8rG8gEM3BY5p0BLfa4n1PMbPpPJPDgQ=";
+    # tag = "v${version}";
+    # Unreleased PR with several build and test fixes: https://github.com/radio-astro-tools/spectral-cube/pull/951
+    rev = "f95ba1ca1823758d340ce0bfd3181ae3bc041b93";
+    hash = "sha256-LUWdxA7gfZI2MDpKuk+DiEJtXyWeS8co+3tZt97Uh3w=";
   };
 
+  # remove after update to 0.6.7
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = "0.6.6";
+
   build-system = [ setuptools-scm ];
 
   dependencies = [
@@ -60,104 +65,7 @@ buildPythonPackage rec {
     cd build/lib
   '';
 
-  pytestFlags = [
-    # FutureWarning: Can't acquire a memory view of a Dask array. This will raise in the future
-    # https://github.com/radio-astro-tools/spectral-cube/issues/943
-    "-Wignore::FutureWarning"
-  ];
-
-  disabledTests = [
-    # AttributeError: 'DaskSpectralCube' object has no attribute 'dtype'
-    "test_key_access_valid"
-
-    # For some reason, those tests are failing with "FutureWarning: Can't acquire a memory view of a Dask array."
-    # without being caught by the `-W ignore::FutureWarning` flag above.
-    "test_1d_slice_reductions"
-    "test_1d_slice_round"
-    "test_1d_slices"
-    "test_1dcomparison_mask_1d_index"
-    "test_1dmask_indexing"
-    "test_2dcomparison_mask_1d_index"
-    "test_3d_beams_roundtrip"
-    "test_4d_beams_roundtrip"
-    "test_LDO_arithmetic"
-    "test_add"
-    "test_apply_everywhere"
-    "test_apply_everywhere_plusminus"
-    "test_apply_function_parallel_shape"
-    "test_attributes"
-    "test_basic_arrayness"
-    "test_basic_unit_conversion"
-    "test_basic_unit_conversion_beams"
-    "test_beam_jpix_checks_array"
-    "test_beam_jtok"
-    "test_beam_jtok_2D"
-    "test_beam_jtok_array"
-    "test_beam_proj_meta"
-    "test_beams_convolution"
-    "test_beams_convolution_equal"
-    "test_casa_read_basic"
-    "test_convolution"
-    "test_convolve_to_equal"
-    "test_convolve_to_jybeam_multibeams"
-    "test_convolve_to_jybeam_onebeam"
-    "test_convolve_to_with_bad_beams"
-    "test_cube_add"
-    "test_cube_stacking"
-    "test_cube_with_swapped_axes"
-    "test_div"
-    "test_filled"
-    "test_getitem"
-    "test_getitem_vrsc"
-    "test_how_withfluxunit"
-    "test_initialization_from_units"
-    "test_mask_none"
-    "test_mosaic_cube"
-    "test_mul"
-    "test_mul_cubes"
-    "test_multibeams_unit_conversions_general_1D"
-    "test_numpy_ma_tools"
-    "test_oned_slic"
-    "test_oned_slice_beams"
-    "test_padding_direction"
-    "test_pow"
-    "test_preserves_header_meta_values"
-    "test_proj_meta"
-    "test_regression_719"
-    "test_repr_1d"
-    "test_slice_wcs"
-    "test_slicing"
-    "test_spatial_smooth_g2d"
-    "test_spatial_smooth_maxfilter"
-    "test_spatial_smooth_median"
-    "test_spatial_smooth_t2d"
-    "test_spatial_world"
-    "test_spectral_interpolate"
-    "test_spectral_interpolate_reversed"
-    "test_spectral_interpolate_varying_chunksize"
-    "test_spectral_interpolate_with_fillvalue"
-    "test_spectral_interpolate_with_mask"
-    "test_spectral_slice_preserve_units"
-    "test_spectral_smooth"
-    "test_spectral_units"
-    "test_stacking"
-    "test_stacking_badvels"
-    "test_stacking_noisy"
-    "test_stacking_reversed_specaxis"
-    "test_stacking_woffset"
-    "test_stacking_wpadding"
-    "test_subtract"
-    "test_subtract_cubes"
-    "test_unit_conversions_general"
-    "test_unit_conversions_general_1D"
-    "test_unit_conversions_general_2D"
-    "test_varyres_mask"
-    "test_varyres_spectra"
-    "test_varyres_unitconversion_roundtrip"
-    "test_with_flux_unit"
-    "test_with_spectral_unit"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
     # Flaky: AssertionError: assert diffvals.max()*u.B <= 1*u.MB
     "test_reproject_3D_memory"
   ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index c093af2656fe..9e16ce250940 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1443";
+  version = "3.0.1446";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-2M5lLjKd60xiSoxoJ9W34DkwCDKrSTbuif7ZP3NxjRI=";
+    hash = "sha256-+lYLCcuM1BX80qEKYoYe/Zuqlk/QbebGICgoLqNbhts=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tensorflow/binary-hashes.nix b/pkgs/development/python-modules/tensorflow/binary-hashes.nix
index dd536885ace8..340bbb82ef4f 100644
--- a/pkgs/development/python-modules/tensorflow/binary-hashes.nix
+++ b/pkgs/development/python-modules/tensorflow/binary-hashes.nix
@@ -1,72 +1,72 @@
 {
-  version = "2.19.0";
+  version = "2.19.1";
   version_jetson = "2.16.1+nv24.08";
   x86_64-linux_39 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow_cpu-2.19.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-    sha256 = "13xvghhqjlq5l6gnnlkslqyk7iwy2lbhblz70pa0wrsvdiwp9k86";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow_cpu-2.19.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+    sha256 = "1bhnz7w6xsh0qvnv8a4yq9n47jnp12b6k0ddhxy8xf5w1f7acj5s";
   };
   x86_64-linux_310 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow_cpu-2.19.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-    sha256 = "0lgjy7frlh5ax97pc5x2cdq560ybizjrdxms57rcx8r9x8wskrff";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow_cpu-2.19.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+    sha256 = "1slbr25402zxwg6lmvxxvnb4iq6dwlwlyl6hnjf8ggxfjj8j1rwa";
   };
   x86_64-linux_311 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow_cpu-2.19.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-    sha256 = "0l8wgqjhp0srqs4rkij881nxifdzaxkin237wfjqh8h1wdd312ck";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow_cpu-2.19.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+    sha256 = "1bjd3r0s3wsilwfrjfbkaw1dnb0ybfgk1gap6xbyfry216yp4v8b";
   };
   x86_64-linux_312 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow_cpu-2.19.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-    sha256 = "1wxpgzs3d0wblvvg02267j0bw9b8j4dlfspfmp6r8hd6dk9bx78b";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow_cpu-2.19.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+    sha256 = "0xn4a3knjm122b7hfxmlqc68bv09dm3gs5hnvdkc213bm07v5d1c";
   };
   x86_64-linux_39_gpu = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-    sha256 = "14vgkx1wjf0jiali4lm3x8n6z29m8vdhjva4yvabzc9b1s1757w4";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+    sha256 = "1bzxqd4h8p9xd5sf31462kmzwalp31cwn1f4sv20rviyripvcrks";
   };
   x86_64-linux_310_gpu = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-    sha256 = "1s1myi67iqhjxvfvjv8pl26hxjcgya9k1r1hblh8hm0h933xdql3";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+    sha256 = "1niiz477vliyk5imw3zlc6s81swc19jlnlkhwcamarnwxi67sdqi";
   };
   x86_64-linux_311_gpu = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-    sha256 = "1r4ghr51h2bb7dj8q6wydgnvzw0f48b6kkygl6gq0yf9d9w4f1rr";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+    sha256 = "03km8nasrm9367w908iza0ik2rfw5m3vpagfbrp5fq1197mj8mcf";
   };
   x86_64-linux_312_gpu = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-    sha256 = "1xm66mwrdxrqs9i68dlahqrd5imgibcz5f3i4ksyg4yp9icjd2z2";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+    sha256 = "1yzq9q0j5sk0z7pcn4xnrrp2wvv7hhbd6hc2cv8x42pf7w7rb9im";
   };
   aarch64-linux_39 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-    sha256 = "121amcj78mkkvs2fclc7z669q45x4sa7x6vlzggrm09b0nr7zf4w";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+    sha256 = "068nyc9frm19n569kg67c2r04c6azi6q5h16mb6pr9wr6adv93wk";
   };
   aarch64-linux_310 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-    sha256 = "0p4fjsal8kfizcz456lbbqg2i35ljxhdqij7vhsfbvismqy2jf9b";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+    sha256 = "0jvz6w04wz624wi78nf2701l4lskwbyb189fp2zmivi8356l0xwh";
   };
   aarch64-linux_311 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-    sha256 = "1670dv3kbmxiz4v0ivmkbiiiaa1sbc2x841z6kmy03mcb3wkybf9";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+    sha256 = "127i5gh411y0g15jgckrmyzqkc2wf02wg1xjsa126zw3a71fvpi2";
   };
   aarch64-linux_312 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-    sha256 = "020kppmgmv4hnz3dqmam01gq95s69xjn6zn6k25l08zf6fyvzx0h";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+    sha256 = "1fz3l95gp3i9zig04cdhznkskrh2x0f7ymacjf8gsi8522v7h3jc";
   };
   aarch64-linux_310_jetson = {
     url = "https://developer.download.nvidia.com/compute/redist/jp/v61/tensorflow/tensorflow-2.16.1+nv24.08-cp310-cp310-linux_aarch64.whl";
     sha256 = "0z18zdcjc2dingl94kivhd5cpzbvkjp9j12q57acjppp4hyd6g7f";
   };
   aarch64-darwin_39 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp39-cp39-macosx_12_0_arm64.whl";
-    sha256 = "02fb702d2wmdgrjq8jj46bp51sh1l9j4q9z231x151z2i3sdn5dd";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp39-cp39-macosx_12_0_arm64.whl";
+    sha256 = "0kdmpsghc7lyi2ny44rls92073bg24nzpv1xhmym0jyfngdv9wq4";
   };
   aarch64-darwin_310 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp310-cp310-macosx_12_0_arm64.whl";
-    sha256 = "0d6anjqkm5vq22awxhcwivjdshnlzmby80by3icyjcihbkr08mn9";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp310-cp310-macosx_12_0_arm64.whl";
+    sha256 = "1r7r07f2ysx8jki2s23yvfdnn1dngxmlm80fsfnnpd1wabp4hcgd";
   };
   aarch64-darwin_311 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp311-cp311-macosx_12_0_arm64.whl";
-    sha256 = "05f12garj6ad4vcxxpi0vihps4gh9y30bffp2qy1k36qi8kn5m38";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp311-cp311-macosx_12_0_arm64.whl";
+    sha256 = "0w4p4vi61srkg5fiqccw1lq2wd4xia0sabq4gq7fy6q56q9ll9wa";
   };
   aarch64-darwin_312 = {
-    url = "https://storage.googleapis.com/tensorflow/versions/2.19.0/tensorflow-2.19.0-cp312-cp312-macosx_12_0_arm64.whl";
-    sha256 = "1bibid6mrgmjra291pmb7b5sf49f8jpi3n8x8mdwjhfmxfz1c6c2";
+    url = "https://storage.googleapis.com/tensorflow/versions/2.19.1/tensorflow-2.19.1-cp312-cp312-macosx_12_0_arm64.whl";
+    sha256 = "0m4k4i136yn42z61j0r3jw9wskg9grlwc62jd9y84297m1lr7ih2";
   };
 }
diff --git a/pkgs/development/python-modules/tensorflow/prefetcher.sh b/pkgs/development/python-modules/tensorflow/prefetcher.sh
index 9bdf9bf3930e..d168c04629c5 100755
--- a/pkgs/development/python-modules/tensorflow/prefetcher.sh
+++ b/pkgs/development/python-modules/tensorflow/prefetcher.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-version="2.19.0"
+version="2.19.1"
 version_jetson="2.16.1+nv24.08"
 
 bucket="https://storage.googleapis.com/tensorflow/versions/${version}"
diff --git a/pkgs/tools/virtualization/cloud-init/default.nix b/pkgs/tools/virtualization/cloud-init/default.nix
index 7c77372609da..4d1d3d212fe7 100644
--- a/pkgs/tools/virtualization/cloud-init/default.nix
+++ b/pkgs/tools/virtualization/cloud-init/default.nix
@@ -17,7 +17,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cloud-init";
-  version = "25.1.4";
+  version = "25.2";
   pyproject = true;
 
   namePrefix = "";
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "canonical";
     repo = "cloud-init";
     tag = version;
-    hash = "sha256-Ubu0uhpRrr4eV4ztOq/l004/+B2kjBWjRNwYcuHCfbU=";
+    hash = "sha256-Ww76dhfoGrIbxPiXHxDjpgPsinmfrs42NnGmzhBeGC0=";
   };
 
   patches = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3713af31dfda..b997bcb93b6d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2191,6 +2191,7 @@ mapAliases {
   wmii_hg = wmii;
   wrapGAppsHook = wrapGAppsHook3; # Added 2024-03-26
   write_stylus = styluslabs-write-bin; # Added 2024-10-09
+  wxGTK33 = wxwidgets_3_3; # Added 2025-07-20
 
   ### X ###