diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 331e80e39beb..1a39ae78c427 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -295,6 +295,11 @@
     name = "6543";
     keys = [ { fingerprint = "8722 B61D 7234 1082 553B  201C B8BE 6D61 0E61 C862"; } ];
   };
+  _66HEX = {
+    name = "Marek Jóźwiak";
+    github = "66HEX";
+    githubId = 168720167;
+  };
   _6AA4FD = {
     email = "f6442954@gmail.com";
     github = "6AA4FD";
@@ -8140,6 +8145,13 @@
     githubId = 7494394;
     name = "Karim Elatov";
   };
+  eldios = {
+    email = "emanuele.lele.calo@gmail.com";
+    github = "eldios";
+    githubId = 483767;
+    name = "Emanuele 'Lele' Calo";
+    keys = [ { fingerprint = "AA6B C774 3F8F 9AD8 4BBA  15C7 2CCB F4B7 1EFF DD46"; } ];
+  };
   eleanor = {
     email = "dejan@proteansec.com";
     github = "proteansec";
@@ -16145,7 +16157,11 @@
   };
   liamthexpl0rer = {
     name = "Liam";
-    matrix = "@liamthexpl0rer:matrix.org";
+    matrix = "@liamthexpl0rer:l14mx.de";
+    keys = [
+      { fingerprint = "3C0A 0FC8 E406 E602 50F3  FCFD 7633 7F2C A1CB 537D"; }
+      { fingerprint = "CC53 895B 3CC7 7B29 AA46  55EF 6DF0 2F41 092A 9B30"; }
+    ];
     github = "liamthexpl0rer";
     githubId = 119797945;
   };
@@ -23866,6 +23882,12 @@
     name = "Roland Conybeare";
     keys = [ { fingerprint = "bw5Cr/4ul1C2UvxopphbZbFI1i5PCSnOmPID7mJ/Ogo"; } ];
   };
+  rdk31 = {
+    email = "nixpkgs@rdk31.com";
+    github = "rdk31";
+    githubId = 16737959;
+    name = "rdk31";
+  };
   rdnetto = {
     email = "rdnetto@gmail.com";
     github = "rdnetto";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 3f6378485322..2342c75b3ba2 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -350,6 +350,7 @@
   ./programs/tsm-client.nix
   ./programs/turbovnc.nix
   ./programs/udevil.nix
+  ./programs/upki.nix
   ./programs/usbtop.nix
   ./programs/vim.nix
   ./programs/virt-manager.nix
diff --git a/nixos/modules/programs/upki.nix b/nixos/modules/programs/upki.nix
new file mode 100644
index 000000000000..abbb26332ef0
--- /dev/null
+++ b/nixos/modules/programs/upki.nix
@@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.upki;
+  format = pkgs.formats.toml { };
+  configFile = format.generate "upki.toml" cfg.settings;
+in
+{
+  options.services.upki = {
+    enable = lib.mkEnableOption "upki certificate infrastructure cache updates";
+
+    package = lib.mkPackageOption pkgs "upki" { };
+
+    interval = lib.mkOption {
+      type = lib.types.str;
+      default = "2h";
+      example = "1h";
+      description = "How often to update the upki cache.";
+    };
+
+    settings = lib.mkOption {
+      inherit (format) type;
+      default = { };
+      description = "Settings written to the upki config file.";
+      example = lib.literalExpression ''
+        {
+          cache-dir = "/var/cache/upki";
+          revocation.fetch-url = "https://upki.rustls.dev/";
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    services.upki.settings = {
+      cache-dir = lib.mkDefault "/var/cache/upki";
+      revocation.fetch-url = lib.mkDefault "https://upki.rustls.dev/";
+    };
+
+    users.users.upki = {
+      isSystemUser = true;
+      group = "upki";
+    };
+    users.groups.upki = { };
+
+    systemd.services.upki-fetch = {
+      description = "Update the upki cache";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${lib.getExe cfg.package} --config-file ${configFile} fetch";
+        User = "upki";
+        Group = "upki";
+        CacheDirectory = "upki";
+        CacheDirectoryMode = "0755";
+        UMask = "0022";
+
+        # Hardening
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = "@system-service";
+      };
+    };
+
+    systemd.timers.upki-fetch = {
+      description = "Update the upki cache every ${cfg.interval}";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnActiveSec = "0";
+        OnUnitActiveSec = cfg.interval;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/tasks/filesystems/btrfs.nix b/nixos/modules/tasks/filesystems/btrfs.nix
index 1cff79f887b6..e3f3fe29e3ae 100644
--- a/nixos/modules/tasks/filesystems/btrfs.nix
+++ b/nixos/modules/tasks/filesystems/btrfs.nix
@@ -85,16 +85,20 @@ in
 
     (mkIf inInitrd {
       boot.initrd.kernelModules = [ "btrfs" ];
-      boot.initrd.availableKernelModules = [
-        "crc32c"
-      ]
-      ++ optionals (config.boot.kernelPackages.kernel.kernelAtLeast "5.5") [
-        # The canonical names of these modules are not very stable, so use the algorithm names that the btrfs module expects.
-        # See: https://github.com/torvalds/linux/blob/v6.19-rc1/fs/btrfs/super.c#L2705-L2708
-        "xxhash64"
-        "sha256" # Should be baked into our kernel, just to be sure
-        "blake2b-256"
-      ];
+      boot.initrd.availableKernelModules = (
+        mkIf (config.boot.kernelPackages.kernel.kernelOlder "7.0") (
+          [
+            "crc32c"
+          ]
+          ++ optionals (config.boot.kernelPackages.kernel.kernelAtLeast "5.5") [
+            # The canonical names of these modules are not very stable, so use the algorithm names that the btrfs module expects.
+            # See: https://github.com/torvalds/linux/blob/v6.19-rc1/fs/btrfs/super.c#L2705-L2708
+            "xxhash64"
+            "sha256" # Should be baked into our kernel, just to be sure
+            "blake2b-256"
+          ]
+        )
+      );
 
       boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable) ''
         copy_bin_and_libs ${pkgs.btrfs-progs}/bin/btrfs
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ba6cbeaa6604..819ad84608a9 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7464,6 +7464,21 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  herdr-splits-nvim = buildVimPlugin {
+    pname = "herdr-splits.nvim";
+    version = "0.5.2";
+    src = fetchFromGitHub {
+      owner = "lmilojevicc";
+      repo = "herdr-splits.nvim";
+      tag = "v0.5.2";
+      hash = "sha256-2h9HGQcIwKIE5uKuRVwtIfKNn0urQttvg5b95kavzgo=";
+      fetchSubmodules = true;
+    };
+    meta.homepage = "https://github.com/lmilojevicc/herdr-splits.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   hex-nvim = buildVimPlugin {
     pname = "hex.nvim";
     version = "0-unstable-2025-07-27";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 2272394c8bbe..e625f8bac8f9 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -531,6 +531,7 @@ https://github.com/Zeioth/heirline-components.nvim/,,
 https://github.com/rebelot/heirline.nvim/,,
 https://github.com/qvalentin/helm-ls.nvim/,,
 https://github.com/OXY2DEV/helpview.nvim/,,
+https://github.com/lmilojevicc/herdr-splits.nvim/,,
 https://github.com/RaafatTurki/hex.nvim/,,
 https://github.com/Yggdroot/hiPairs/,,
 https://github.com/tzachar/highlight-undo.nvim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
index ee700b47f216..a011c25677aa 100644
--- a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
@@ -18,7 +18,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     # it does not matter which binary is fetched. Using only a single
     # hash makes this easier to maintain.
     arch = "linux-x64";
-    hash = "sha256-tt7EjsMp60Qs9rngWYHPMMV+rBUt6FTZwkPoGb6Sl0w=";
+    hash = "sha256-/dRXNWsYV1dGfwrcr6auLhqhm7tUbWizwPsYM5eARww=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index f78ba2306d10..8935ef5e314f 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "154.0b9";
+  version = "154.0b10";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a374ecaf21678f0cca685eed7a09763b3f14ac3d4415c27227a4e06f050042df5e31ade4188d3ab7191102b811b1161638336b41d9de82b9527d39049fe0d3d2";
+    sha512 = "ddbe3ff45217a16df9eecfac52fcb12425accae76457e7054b20bd085f5b22908940a20448f213c3dc62d1276bb1c81f38194432336ba97459b2c17393ebd3cd";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index 1314ad2eb9d8..d9918265f160 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "154.0b9";
+  version = "154.0b10";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "83d15ab019fd49076f21574770c27e04d431b5b230d4bb3246a2c9190e26ae3f626bdb8241905bc91b87803586f312e4f6cfd7ce7908e5766fb1aa6a0669cff6";
+    sha512 = "e2275579e4769a0690010d8fbba528a0e347d86f0dc981d1702b3e627d9c73f3fd7399d3e618c514bf6a3c0059fa3aa5a29f9cdec802e52955a03b1122ca8d39";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index f7887a87a722..18e222d54438 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -225,9 +225,13 @@ stdenv.mkDerivation (finalAttrs: {
 
     mkdir -p $out/opt/${binaryName}/modules/discord_krisp/KMS/logs
 
+    # Chromium 148 multiplies Plasma's GTK DPI scale by the native Wayland surface
+    # scale, which makes the UI too large. See #551645
     wrapProgramShell $out/opt/${binaryName}/${binaryName} \
         "''${gappsWrapperArgs[@]}" \
+        --run 'case ":''${XDG_CURRENT_DESKTOP:-}:" in *:KDE:*) discordKdeWayland=1 ;; *) unset discordKdeWayland ;; esac' \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+        --add-flags "\''${WAYLAND_DISPLAY:+\''${discordKdeWayland:+--force-device-scale-factor=1}}" \
         ${lib.strings.optionalString withTTS ''
           --run 'if [[ "''${NIXOS_SPEECH:-default}" != "False" ]]; then NIXOS_SPEECH=True; else unset NIXOS_SPEECH; fi' \
           --add-flags "\''${NIXOS_SPEECH:+--enable-speech-dispatcher}" \
diff --git a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
index fd1d8d0a3ee5..df135d161922 100644
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "advanced-scene-switcher";
-  version = "1.35.1";
+  version = "1.36.1";
 
   src = fetchFromGitHub {
     owner = "WarmUpTill";
     repo = "SceneSwitcher";
     rev = version;
-    hash = "sha256-gfJtkX6OGqy+hUXvLXaOETvfIX+TRNEj0IwZnE9t81E=";
+    hash = "sha256-padrHEGUtgXV0ee5mgIHSLHjh+6npL/vZAEJ8nARML0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ai/airshipper/package.nix b/pkgs/by-name/ai/airshipper/package.nix
index 3e21da8fefb4..e8d7864d54c8 100644
--- a/pkgs/by-name/ai/airshipper/package.nix
+++ b/pkgs/by-name/ai/airshipper/package.nix
@@ -16,62 +16,48 @@
   alsa-lib,
   stdenv,
   libxcb,
-  bzip2,
-  cmake,
-  fontconfig,
-  freetype,
   pkg-config,
   makeWrapper,
   writeShellScript,
   patchelf,
 }:
 let
-  version = "0.17.0";
-  # Patch for airshipper to install veloren
-  patch =
-    let
-      runtimeLibs = [
-        udev
-        alsa-lib
-        (lib.getLib stdenv.cc.cc)
-        libxkbcommon
-        libxcb
-        libx11
-        libxcursor
-        libxrandr
-        libxi
-        vulkan-loader
-        libGL
-      ];
-    in
-    writeShellScript "patch" ''
-      echo "making binaries executable"
-      chmod +x {veloren-voxygen,veloren-server-cli}
-      echo "patching dynamic linkers"
-      ${patchelf}/bin/patchelf \
-        --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
-        veloren-server-cli
+  # Patch for airshipper to install veloren client
+  patchVoxygen =
+    runtimeLibs:
+    writeShellScript "voxygen-patch" ''
+      echo "making veloren-voxygen executable"
+      chmod +x veloren-voxygen
+      echo "patching veloren-voxygen dynamic linker"
       ${patchelf}/bin/patchelf \
         --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
         --set-rpath "${lib.makeLibraryPath runtimeLibs}" \
         veloren-voxygen
     '';
+  # Patch for airshipper to install veloren server
+  patchServer = writeShellScript "server-cli-patch" ''
+    echo "making veloren-server-cli executable"
+    chmod +x veloren-server-cli
+    echo "patching veloren-server-cli dynamic linker"
+    ${patchelf}/bin/patchelf \
+      --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" \
+      veloren-server-cli
+  '';
 in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "airshipper";
-  inherit version;
+  version = "0.17.0";
 
   src = fetchFromGitLab {
     owner = "Veloren";
     repo = "airshipper";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-M89RswC08MZnNfk2T1+rtDajTpDGTnJoZ2U8bU5U2+0=";
   };
 
   cargoHash = "sha256-ry0hFvMDnotDQu6mqgyt+6hKOvGRJLmZKs3SxEVtDRg=";
 
   buildInputs = [
-    fontconfig
     openssl
     wayland
     wayland-protocols
@@ -80,9 +66,10 @@ rustPlatform.buildRustPackage {
     libxrandr
     libxi
     libxcursor
+    vulkan-loader
+    libGL
   ];
   nativeBuildInputs = [
-    cmake
     pkg-config
     makeWrapper
   ];
@@ -94,30 +81,40 @@ rustPlatform.buildRustPackage {
     install -Dm444    "client/assets/net.veloren.airshipper.png"  "$out/share/icons/net.veloren.airshipper.png"
   '';
 
-  postFixup =
-    let
-      libPath = lib.makeLibraryPath [
-        libGL
-        vulkan-loader
-        wayland
-        wayland-protocols
-        bzip2
-        fontconfig
-        freetype
-        libxkbcommon
-        libx11
-        libxrandr
-        libxi
-        libxcursor
-      ];
-    in
-    ''
-      # We set LD_LIBRARY_PATH instead of using patchelf in order to propagate the libs
-      # to both Airshipper itself as well as the binaries downloaded by Airshipper.
-      wrapProgram "$out/bin/airshipper" \
-        --set VELOREN_PATCHER "${patch}" \
-        --prefix LD_LIBRARY_PATH : "${libPath}"
-    '';
+  passthru = {
+    inherit patchVoxygen patchServer;
+    runtimeLibs = [
+      udev
+      alsa-lib
+      (lib.getLib stdenv.cc.cc)
+      libxkbcommon
+      libxcb
+      libx11
+      libxcursor
+      libxrandr
+      libxi
+      vulkan-loader
+      libGL
+      wayland
+      wayland-protocols
+    ];
+  };
+
+  postFixup = ''
+    ${patchelf}/bin/patchelf \
+      --set-rpath ${
+        lib.makeLibraryPath (
+          finalAttrs.buildInputs
+          ++ [
+            (lib.getLib stdenv.cc.cc)
+            stdenv.cc.libc
+          ]
+        )
+      } "$out/bin/airshipper"
+    wrapProgram "$out/bin/airshipper" \
+      --set VELOREN_VOXYGEN_PATCHER "${finalAttrs.passthru.patchVoxygen finalAttrs.passthru.runtimeLibs}" \
+      --set VELOREN_SERVER_CLI_PATCHER "${finalAttrs.passthru.patchServer}"
+  '';
 
   doCheck = false;
   cargoBuildFlags = [
@@ -136,4 +133,4 @@ rustPlatform.buildRustPackage {
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ yusdacra ];
   };
-}
+})
diff --git a/pkgs/by-name/an/antidote/package.nix b/pkgs/by-name/an/antidote/package.nix
index c43edd94d092..1cd59589f8cb 100644
--- a/pkgs/by-name/an/antidote/package.nix
+++ b/pkgs/by-name/an/antidote/package.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.2.2";
+  version = "2.3.0";
   pname = "antidote";
 
   src = fetchFromGitHub {
     owner = "mattmc3";
     repo = "antidote";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K2IzFUkiuAdEsm7p0u9HVFB5DTOy3v4wSZk8io7i8dU=";
+    hash = "sha256-qPkXbKm0EEivwtQyuVcKPfQYPAJ4MDY/9h3dMzUmDqI=";
   };
 
   dontPatch = true;
diff --git a/pkgs/by-name/an/antigravity-ide/information.json b/pkgs/by-name/an/antigravity-ide/information.json
index 3b25a0456a2e..b30d4a8321c1 100644
--- a/pkgs/by-name/an/antigravity-ide/information.json
+++ b/pkgs/by-name/an/antigravity-ide/information.json
@@ -1,18 +1,18 @@
 {
-  "version": "2.1.1",
+  "version": "2.5.5",
   "vscodeVersion": "1.107.0",
   "sources": {
     "x86_64-linux": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.1.1-6123990880747520/linux-x64/Antigravity%20IDE.tar.gz",
-      "sha256": "5b2cebf7d33a68d003fd8f1fa988d1600905ace22504a085e5384214290878bd"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.5.5-4923483625488384/linux-x64/Antigravity%20IDE.tar.gz",
+      "sha256": "0c5233b297d2b3aebb61af49f8944012c2953d361a5ebb16978490636917f831"
     },
     "aarch64-linux": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.1.1-6123990880747520/linux-arm/Antigravity%20IDE.tar.gz",
-      "sha256": "c6b6fef97cfc078ae7f92d02f9483a12437b6602c7d322a7d445668c2f0c16a6"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.5.5-4923483625488384/linux-arm/Antigravity%20IDE.tar.gz",
+      "sha256": "88c167108980c33a223a8d7f0aa6aaf4dec61f0cc3950235a2698e9ffc38a49e"
     },
     "aarch64-darwin": {
-      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.1.1-6123990880747520/darwin-arm/Antigravity%20IDE.zip",
-      "sha256": "3491f5bc9faad111e5be6d9126bf5d566a0c591bd159a61ef0dcdd30c58672aa"
+      "url": "https://edgedl.me.gvt1.com/edgedl/release2/j0qc3/antigravity/stable/2.5.5-4923483625488384/darwin-arm/Antigravity%20IDE.zip",
+      "sha256": "33338ced839cb00fcc779ab96e4cdc79e06c894bc21cdb02249715286700c648"
     }
   }
 }
diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index f0715ceff5d1..da19c09a27f3 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.45.0";
+  version = "0.45.1";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-njMkegbthIvJAI0tlSVg1G+/wRwSqWwXu4ZjM216Lys=";
+    hash = "sha256-YNn49WuILwe3gyvHSKh3dH5BZKhtR+YeSCCGDu0qulg=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-1i5NK6B1bT5UAac5VPVZcReFI24r6wboy+d1eSdbfXU=";
+  cargoHash = "sha256-6ZqV9SJes6++TJxcj/Dmi8DyaoTa164CKi4C/EyfnuQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/au/ausweisapp/package.nix b/pkgs/by-name/au/ausweisapp/package.nix
index 9a610a0684bd..ff15ceade5b2 100644
--- a/pkgs/by-name/au/ausweisapp/package.nix
+++ b/pkgs/by-name/au/ausweisapp/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ausweisapp";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp";
     rev = finalAttrs.version;
-    hash = "sha256-y9F/dQZHbUFDRZDpdGtNCjTIypS2l4XJLbUZHjliEDA=";
+    hash = "sha256-rxlJ2+IG0XmZ2Oyfk5n1TGDF76KhLahe8KvJ70QX5tQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/av/aver/package.nix b/pkgs/by-name/av/aver/package.nix
index 42906c213757..4623299de089 100644
--- a/pkgs/by-name/av/aver/package.nix
+++ b/pkgs/by-name/av/aver/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aver";
-  version = "0.27.1";
+  version = "0.28.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "jasisz";
     repo = "aver";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pP9+PBScmufBfSpaLPyG1Wn8W4U5TYm707EK3VmCPsA=";
+    hash = "sha256-xHaxfQCNLAeuvuiYVzYBjNu8f7KKojVjcnhZfpvdHTk=";
   };
 
-  cargoHash = "sha256-/xfEl8VN9gY8L4e5UKRT+WuLb16vRH6hQdQ47y4/3uU=";
+  cargoHash = "sha256-ls1whoSoEcIBWzMuEI4vnzc896oDbPjbkwLaHJpYDvQ=";
 
   cargoBuildFlags = [
     "--workspace"
diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index b25568341333..121be27e9d30 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -68,6 +68,20 @@ stdenv.mkDerivation (finalAttrs: {
     ]
   );
 
+  # AWS-LC's generated *-targets.cmake files hardcode _IMPORT_PREFIX to $out
+  # and set INTERFACE_INCLUDE_DIRECTORIES to "$out/include", but headers live
+  # in $dev/include under multi-output splitting. Clear the broken claim so
+  # consumers fall back to stdenv's normal include-path propagation via
+  # buildInputs (which correctly resolves to $dev/include).
+  postFixup = ''
+    for f in $out/lib/{crypto,ssl}/cmake/*/*-targets.cmake; do
+      substituteInPlace "$f" \
+        --replace-fail \
+          'INTERFACE_INCLUDE_DIRECTORIES "\$<\$<BOOL:1>:>;''${_IMPORT_PREFIX}/include"' \
+          'INTERFACE_INCLUDE_DIRECTORIES ""'
+    done
+  '';
+
   __darwinAllowLocalNetworking = true;
 
   passthru = {
diff --git a/pkgs/by-name/aw/aws-sam-cli/package.nix b/pkgs/by-name/aw/aws-sam-cli/package.nix
index bddeaeb6d778..6498cfcb1a28 100644
--- a/pkgs/by-name/aw/aws-sam-cli/package.nix
+++ b/pkgs/by-name/aw/aws-sam-cli/package.nix
@@ -11,14 +11,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "aws-sam-cli";
-  version = "1.163.0";
+  version = "1.165.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sam-cli";
     tag = "v${version}";
-    hash = "sha256-ydyuQHdLWet5+HkPCmHiKqTFY8+nVOXTlPFfOckzOXE=";
+    hash = "sha256-tEsKNhEAMQCsFemsb2Epnc6pVd2kDvOEceMhldqNZn4=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/ba/bashd/package.nix b/pkgs/by-name/ba/bashd/package.nix
new file mode 100644
index 000000000000..26c25680b589
--- /dev/null
+++ b/pkgs/by-name/ba/bashd/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  nix-update-script,
+  shellcheck,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "bashd";
+  version = "0.2.3";
+
+  src = fetchFromGitHub {
+    owner = "matkrin";
+    repo = "bashd";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-KTfoOEdgPWVe/1HQnBsTOzhZDK1DP5NRiJewTh+DGmg=";
+  };
+
+  vendorHash = "sha256-B4szacVckxUeF0xndHX3T6FnGTF0BkGo9k8uZUWURVM=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  ldflags = [
+    "-X main.VERSION=${finalAttrs.version}"
+  ];
+
+  preFixup = ''
+    wrapProgram "$out/bin/bashd" --prefix PATH : ${lib.makeBinPath [ shellcheck ]}
+  '';
+
+  passthru.updateScript = nix-update-script { };
+  __structuredAttrs = true;
+
+  meta = {
+    homepage = "https://github.com/matkrin/bashd";
+    description = "Bash language server";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ supermarin ];
+    mainProgram = "bashd";
+  };
+})
diff --git a/pkgs/by-name/c3/c3c/package.nix b/pkgs/by-name/c3/c3c/package.nix
index 761b7d9bd695..84416288ca4a 100644
--- a/pkgs/by-name/c3/c3c/package.nix
+++ b/pkgs/by-name/c3/c3c/package.nix
@@ -19,13 +19,13 @@ in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
 
   pname = "c3c${optionalString debug "-debug"}";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "c3lang";
     repo = "c3c";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6XUMlF9SRQ9aqVRl5BQdELVsj/DyXhCnH85QrbK8Xxo=";
+    hash = "sha256-zOKAXagdhtz8GZn5ss4v0kB8mdPbs6ki3JyL6vRGavE=";
   };
 
   cmakeBuildType = if debug then "Debug" else "Release";
diff --git a/pkgs/by-name/ca/cadabra2/package.nix b/pkgs/by-name/ca/cadabra2/package.nix
index 8f2db33d4b22..d083edc8de9d 100644
--- a/pkgs/by-name/ca/cadabra2/package.nix
+++ b/pkgs/by-name/ca/cadabra2/package.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
     (lib.cmakeBool "PACKAGING_MODE" true)
 
-    (lib.cmakeBool "BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "BUILD_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py b/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
index b078774f4c6c..bff0df9b76c3 100644
--- a/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
+++ b/pkgs/by-name/ca/calamares-nixos-extensions/src/modules/nixos/main.py
@@ -20,9 +20,10 @@ _ = gettext.translation(
 # The following strings contain pieces of a nix-configuration file.
 # They are adapted from the default config generated from the nixos-generate-config command.
 
-cfghead = """# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
+cfghead = """\
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
 
 { config, pkgs, ... }:
 
@@ -33,20 +34,23 @@ cfghead = """# Edit this configuration file to define what should be installed o
     ];
 
 """
-cfgbootefi = """  # Bootloader.
+cfgbootefi = """\
+  # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
 """
 
-cfgbootbios = """  # Bootloader.
+cfgbootbios = """\
+  # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "@@bootdev@@";
   boot.loader.grub.useOSProber = true;
 
 """
 
-cfgbootbiosbtrfs = """  # Bootloader.
+cfgbootbiosbtrfs = """\
+  # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
   boot.loader.grub.device = "@@bootdev@@";
   boot.loader.grub.useOSProber = true;
@@ -55,12 +59,14 @@ cfgbootbiosbtrfs = """  # Bootloader.
 
 """
 
-cfgbootnone = """  # Disable bootloader.
+cfgbootnone = """\
+  # Disable bootloader.
   boot.loader.grub.enable = false;
 
 """
 
-cfgbootgrubcrypt = """  # Setup keyfile
+cfgbootgrubcrypt = """\
+  # Setup keyfile
   boot.initrd.secrets = {
     "/boot/crypto_keyfile.bin" = null;
   };
@@ -69,7 +75,8 @@ cfgbootgrubcrypt = """  # Setup keyfile
 
 """
 
-cfgnetwork = """  networking.hostName = "@@hostname@@"; # Define your hostname.
+cfgnetwork = """\
+  networking.hostName = "@@hostname@@"; # Define your hostname.
   # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
 
   # Configure network proxy if necessary
@@ -78,32 +85,38 @@ cfgnetwork = """  networking.hostName = "@@hostname@@"; # Define your hostname.
 
 """
 
-cfgnetworkmanager = """  # Enable networking
+cfgnetworkmanager = """\
+  # Enable networking
   networking.networkmanager.enable = true;
 
 """
 
-cfgconnman = """  # Enable networking
+cfgconnman = """\
+  # Enable networking
   services.connman.enable = true;
 
 """
 
-cfgnmapplet = """  # Enable network manager applet
+cfgnmapplet = """\
+  # Enable network manager applet
   programs.nm-applet.enable = true;
 
 """
 
-cfgtime = """  # Set your time zone.
+cfgtime = """\
+  # Set your time zone.
   time.timeZone = "@@timezone@@";
 
 """
 
-cfglocale = """  # Select internationalisation properties.
+cfglocale = """\
+  # Select internationalisation properties.
   i18n.defaultLocale = "@@LANG@@";
 
 """
 
-cfglocaleextra = """  i18n.extraLocaleSettings = {
+cfglocaleextra = """\
+  i18n.extraLocaleSettings = {
     LC_ADDRESS = "@@LC_ADDRESS@@";
     LC_IDENTIFICATION = "@@LC_IDENTIFICATION@@";
     LC_MEASUREMENT = "@@LC_MEASUREMENT@@";
@@ -117,16 +130,15 @@ cfglocaleextra = """  i18n.extraLocaleSettings = {
 
 """
 
-cfggnome = """  # Enable the X11 windowing system.
-  services.xserver.enable = true;
-
+cfggnome = """\
   # Enable the GNOME Desktop Environment.
-  services.xserver.displayManager.gdm.enable = true;
-  services.xserver.desktopManager.gnome.enable = true;
+  services.displayManager.gdm.enable = true;
+  services.desktopManager.gnome.enable = true;
 
 """
 
-cfgplasma6 = """  # Enable the X11 windowing system.
+cfgplasma6 = """\
+  # Enable the X11 windowing system.
   # You can disable this if you're only using the Wayland session.
   services.xserver.enable = true;
 
@@ -136,7 +148,8 @@ cfgplasma6 = """  # Enable the X11 windowing system.
 
 """
 
-cfgxfce = """  # Enable the X11 windowing system.
+cfgxfce = """\
+  # Enable the X11 windowing system.
   services.xserver.enable = true;
 
   # Enable the XFCE Desktop Environment.
@@ -145,7 +158,8 @@ cfgxfce = """  # Enable the X11 windowing system.
 
 """
 
-cfgpantheon = """  # Enable the X11 windowing system.
+cfgpantheon = """\
+  # Enable the X11 windowing system.
   services.xserver.enable = true;
 
   # Enable the Pantheon Desktop Environment.
@@ -154,7 +168,8 @@ cfgpantheon = """  # Enable the X11 windowing system.
 
 """
 
-cfgcinnamon = """  # Enable the X11 windowing system.
+cfgcinnamon = """\
+  # Enable the X11 windowing system.
   services.xserver.enable = true;
 
   # Enable the Cinnamon Desktop Environment.
@@ -163,7 +178,8 @@ cfgcinnamon = """  # Enable the X11 windowing system.
 
 """
 
-cfgmate = """  # Enable the X11 windowing system.
+cfgmate = """\
+  # Enable the X11 windowing system.
   services.xserver.enable = true;
 
   # Enable the MATE Desktop Environment.
@@ -172,7 +188,8 @@ cfgmate = """  # Enable the X11 windowing system.
 
 """
 
-cfgenlightenment = """  # Enable the X11 windowing system.
+cfgenlightenment = """\
+  # Enable the X11 windowing system.
   services.xserver.enable = true;
 
   # Enable the Enlightenment Desktop Environment.
@@ -184,7 +201,8 @@ cfgenlightenment = """  # Enable the X11 windowing system.
 
 """
 
-cfglxqt = """  # Enable the X11 windowing system.
+cfglxqt = """\
+  # Enable the X11 windowing system.
   services.xserver.enable = true;
 
   # Enable the LXQT Desktop Environment.
@@ -193,7 +211,8 @@ cfglxqt = """  # Enable the X11 windowing system.
 
 """
 
-cfglumina = """  # Enable the X11 windowing system.
+cfglumina = """\
+  # Enable the X11 windowing system.
   services.xserver.enable = true;
 
   # Enable the Lumina Desktop Environment.
@@ -202,7 +221,8 @@ cfglumina = """  # Enable the X11 windowing system.
 
 """
 
-cfgbudgie = """  # Enable the X11 windowing system.
+cfgbudgie = """\
+  # Enable the X11 windowing system.
   services.xserver.enable = true;
 
   # Enable the Budgie Desktop environment.
@@ -211,19 +231,22 @@ cfgbudgie = """  # Enable the X11 windowing system.
 
 """
 
-cfgkeymap = """  # Configure keymap in X11
+cfgkeymap = """\
+  # Configure keymap in X11
   services.xserver.xkb = {
     layout = "@@kblayout@@";
     variant = "@@kbvariant@@";
   };
 
 """
-cfgconsole = """  # Configure console keymap
+cfgconsole = """\
+  # Configure console keymap
   console.keyMap = "@@vconsole@@";
 
 """
 
-cfgmisc = """  # Enable CUPS to print documents.
+cfgmisc = """\
+  # Enable CUPS to print documents.
   services.printing.enable = true;
 
   # Enable sound with pipewire.
@@ -237,16 +260,16 @@ cfgmisc = """  # Enable CUPS to print documents.
     # If you want to use JACK applications, uncomment this
     #jack.enable = true;
 
-    # use the example session manager (no others are packaged yet so this is enabled by default,
-    # no need to redefine it in your config for now)
-    #media-session.enable = true;
+    # Use the WirePlumber session manager
+    #wireplumber.enable = true;
   };
 
   # Enable touchpad support (enabled default in most desktopManager).
-  # services.xserver.libinput.enable = true;
+  # services.libinput.enable = true;
 
 """
-cfgusers = """  # Define a user account. Don't forget to set a password with ‘passwd’.
+cfgusers = """\
+  # Define a user account. Don't forget to set a password with ‘passwd’.
   users.users."@@username@@" = {
     isNormalUser = true;
     description = "@@fullname@@";
@@ -256,43 +279,43 @@ cfgusers = """  # Define a user account. Don't forget to set a password with ‘
 
 """
 
-cfgfirefox = """  # Install firefox.
+cfgfirefox = """\
+  # Install firefox.
   programs.firefox.enable = true;
 
 """
 
-cfgautologin = """  # Enable automatic login for the user.
+cfgautologin = """\
+  # Enable automatic login for the user.
   services.displayManager.autoLogin.enable = true;
   services.displayManager.autoLogin.user = "@@username@@";
 
 """
 
-cfgautologingdm = """  # Workaround for GNOME autologin: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
-  systemd.services."getty@tty1".enable = false;
-  systemd.services."autovt@tty1".enable = false;
-
-"""
-
-cfgautologintty = """  # Enable automatic login for the user.
+cfgautologintty = """\
+  # Enable automatic login for the user.
   services.getty.autologinUser = "@@username@@";
 
 """
 
-cfgunfree = """  # Allow unfree packages
+cfgunfree = """\
+  # Allow unfree packages
   nixpkgs.config.allowUnfree = true;
 
 """
 
-cfgpkgs = """  # List packages installed in system profile. To search, run:
-  # $ nix search wget
-  environment.systemPackages = with pkgs; [
-  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
-  #  wget
-  ];
+cfgpkgs = """\
+  # List packages installed in system profile.
+  # You can use https://search.nixos.org/ to find more packages (and options).
+  # environment.systemPackages = with pkgs; [
+  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #   wget
+  # ];
 
 """
 
-cfgtail = """  # Some programs need SUID wrappers, can be configured further or are
+cfgtail = """\
+  # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.
   # programs.mtr.enable = true;
   # programs.gnupg.agent = {
@@ -311,18 +334,35 @@ cfgtail = """  # Some programs need SUID wrappers, can be configured further or
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;
 
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
   system.stateVersion = "@@nixosversion@@"; # Did you read the comment?
 
 }
 """
 
-cfglatestkernel = """  # Use latest kernel.
+cfglatestkernel = """\
+  # Use latest kernel.
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
 """
@@ -880,8 +920,6 @@ def run():
             and gs.value("packagechooser_packagechooser") != ""
         ):
             cfg += cfgautologin
-            if gs.value("packagechooser_packagechooser") == "gnome":
-                cfg += cfgautologingdm
         elif gs.value("autoLoginUser") is not None:
             cfg += cfgautologintty
 
diff --git a/pkgs/by-name/ca/cargo-xwin/package.nix b/pkgs/by-name/ca/cargo-xwin/package.nix
index 4786535a02d2..a771564f8d5e 100644
--- a/pkgs/by-name/ca/cargo-xwin/package.nix
+++ b/pkgs/by-name/ca/cargo-xwin/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-xwin";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-pWaJKk4XgBeY4llRTHvuMg0mAfEV4GFpeWGaM8eYsN4=";
+    hash = "sha256-JQYAYCCN/dWvX1oqFX/MjvtPuCA3k8WbHmmGBxG9ylA=";
   };
 
-  cargoHash = "sha256-iO0uAYdi8Vy9gi7lHsGRmhDsVNQCqo4E/nbTfI32jDs=";
+  cargoHash = "sha256-FRK4bCTPAPWGov8vEFr9XdqCNoeXeyFdyiWV5x+4WYY=";
 
   meta = {
     description = "Cross compile Cargo project to Windows MSVC target with ease";
diff --git a/pkgs/by-name/ce/cewler/package.nix b/pkgs/by-name/ce/cewler/package.nix
index 2b8d93ea574e..9be9c96768aa 100644
--- a/pkgs/by-name/ce/cewler/package.nix
+++ b/pkgs/by-name/ce/cewler/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cewler";
-  version = "1.3.1";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "roys";
     repo = "cewler";
     rev = "v${version}";
-    hash = "sha256-Od9O71122jVwqZ5ntoBQQtyNQjt2RRbZT8DzWFPUN84=";
+    hash = "sha256-9P8vFacbw0pgthYqJY/aPuV39VQuMAA8o7yJ8HkD7RQ=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/ch/chainsaw/package.nix b/pkgs/by-name/ch/chainsaw/package.nix
index d0a1fafb8a0d..57ac6f5b0a7e 100644
--- a/pkgs/by-name/ch/chainsaw/package.nix
+++ b/pkgs/by-name/ch/chainsaw/package.nix
@@ -1,39 +1,43 @@
 {
   lib,
-  rustPlatform,
   fetchFromGitHub,
+  rustPlatform,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chainsaw";
-  version = "2.16.2";
+  version = "2.16.3";
 
   src = fetchFromGitHub {
     owner = "WithSecureLabs";
     repo = "chainsaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EKL2MTo5qirpY4TCWwBptpRWJRd6Yp/dLz/5sIsdsbg=";
+    hash = "sha256-dG3WxAWnMBMlV3HxI9E7EDvZgK+qYZwRiZVNRf7jekY=";
   };
 
-  cargoHash = "sha256-bbgRqp3bNw2U69aVqwvJNWOKgW0YhR8SlqzH9jdrHZU=";
+  cargoHash = "sha256-t9Adw4W7m1jWsLhwEtIgJjAWDxRkpOzssKe98InOExQ=";
 
-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  ldflags = [ "-s" ];
+
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
   checkFlags = [
-    # failed
+    # Tests are failing
     "--skip=analyse_srum_database_json"
     "--skip=search_jq_simple_string"
     "--skip=search_q_jsonl_simple_string"
     "--skip=search_q_simple_string"
   ];
 
+  doInstallCheck = true;
+
   meta = {
     description = "Rapidly Search and Hunt through Windows Forensic Artefacts";
     homepage = "https://github.com/WithSecureLabs/chainsaw";
-    changelog = "https://github.com/WithSecureLabs/chainsaw/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/WithSecureLabs/chainsaw/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "chainsaw";
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index 77913252e76e..fcee4c1e1ab8 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -2,6 +2,9 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  getent,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -21,12 +24,23 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "apps/cnspec" ];
 
+  nativeInstallCheckInputs = [
+    getent
+    writableTmpDirAsHomeHook
+    versionCheckHook
+  ];
+
   ldflags = [
     "-s"
-    "-w"
-    "-X=go.mondoo.com/cnspec.Version=${finalAttrs.version}"
+    "-X=go.mondoo.com/cnspec/v${(lib.versions.major finalAttrs.version)}.Version=${finalAttrs.version}"
   ];
 
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = "HOME PATH";
+
+  versionCheckProgramArg = [ "version" ];
+
   meta = {
     description = "Open source, cloud-native security and policy project";
     homepage = "https://github.com/mondoohq/cnspec";
@@ -36,5 +50,6 @@ buildGoModule (finalAttrs: {
       fab
       mariuskimmina
     ];
+    mainProgram = "cnspec";
   };
 })
diff --git a/pkgs/by-name/co/collada-dom/package.nix b/pkgs/by-name/co/collada-dom/package.nix
index b4e8ac23cdab..a2f97441cb32 100644
--- a/pkgs/by-name/co/collada-dom/package.nix
+++ b/pkgs/by-name/co/collada-dom/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    (lib.cmakeBool "OPT_COMPILE_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "OPT_COMPILE_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
   doCheck = true;
diff --git a/pkgs/by-name/co/comfyui/package.nix b/pkgs/by-name/co/comfyui/package.nix
index 85aff9f52f0b..3d19ff7358f2 100644
--- a/pkgs/by-name/co/comfyui/package.nix
+++ b/pkgs/by-name/co/comfyui/package.nix
@@ -74,7 +74,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "comfyui";
-  version = "0.32.0";
+  version = "0.33.1";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -83,7 +83,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "Comfy-Org";
     repo = "ComfyUI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LlJHF/wEL8HhJAKw2DaxsoMltLpV3DtFWDlTW3AZZuI=";
+    hash = "sha256-r6amApYXBjfE8+UvhiJ/7VcUibd4kd5i+JLPXxo8H9w=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/co/commafeed/package.nix b/pkgs/by-name/co/commafeed/package.nix
index 7e626e0b8ab0..07f90cee6a01 100644
--- a/pkgs/by-name/co/commafeed/package.nix
+++ b/pkgs/by-name/co/commafeed/package.nix
@@ -12,13 +12,13 @@
   stdenv,
 }:
 let
-  version = "7.2.1";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "Athou";
     repo = "commafeed";
     tag = version;
-    hash = "sha256-yZ73RX9yqZ1RPBglqW33F5pfWzduMd1O7P5FWhCoY6I=";
+    hash = "sha256-VCN8NBVGQl7/D3fESxiw3ipUoK3qBM0SSnEYBB0E+64=";
   };
 
   frontend = buildNpmPackage {
@@ -28,7 +28,7 @@ let
 
     sourceRoot = "${src.name}/commafeed-client";
 
-    npmDepsHash = "sha256-rx7tAk9X6X0hpGs1arsLl5ItNUOnwud+7EgNMp7LwtE=";
+    npmDepsHash = "sha256-usdJEjW/Oz993Ik8JZnEQ08ArqmLx/3hSdhlUJgCrig=";
 
     nativeBuildInputs = [ biome ];
 
@@ -54,7 +54,7 @@ maven.buildMavenPackage {
 
   pname = "commafeed";
 
-  mvnHash = "sha256-2s95x2wVe+dsxpohu2OaK7y+o3Om9C/IBuLFEGM3TfQ=";
+  mvnHash = "sha256-Gi+KMrdSXlnI34wvAYnJffVCa3WUYkPEFIv382+mwj4=";
   mvnJdk = jdk25;
 
   mvnParameters = lib.escapeShellArgs [
diff --git a/pkgs/by-name/co/coroot-node-agent/package.nix b/pkgs/by-name/co/coroot-node-agent/package.nix
index 645eb8197861..e5770a3fa120 100644
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -31,7 +31,10 @@ buildGoModule (finalAttrs: {
     description = "Prometheus exporter based on eBPF";
     homepage = "https://github.com/coroot/coroot-node-agent";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ errnoh ];
+    maintainers = with lib.maintainers; [
+      errnoh
+      allsimon
+    ];
     mainProgram = "coroot-node-agent";
   };
 })
diff --git a/pkgs/by-name/cr/crystfel/link-to-argp-standalone-if-needed.patch b/pkgs/by-name/cr/crystfel/link-to-argp-standalone-if-needed.patch
deleted file mode 100644
index 7c3b2b330dd9..000000000000
--- a/pkgs/by-name/cr/crystfel/link-to-argp-standalone-if-needed.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/meson.build b/meson.build
-index e9bea380..53e4373e 100644
---- a/meson.build
-+++ b/meson.build
-@@ -206,10 +206,16 @@ if asapodep.found()
-   indexamajig_sources += ['src/im-asapo.c']
- endif
- 
-+if build_machine.system() == 'darwin' or build_machine.system() == 'freebsd' or not cc.links('#include <argp.h>\nstatic error_t parse_opt (int key, char *arg, struct argp_state *state) { argp_usage(state); return 0; }; void main() {}')
-+    argpdep = cc.find_library('argp')
-+else
-+    argpdep = dependency('', required : false)
-+endif
-+
- indexamajig = executable('indexamajig', indexamajig_sources,
-                          dependencies: [mdep, rtdep, libcrystfeldep, gsldep,
-                                         pthreaddep, zmqdep, asapodep, asapoproddep,
--                                        fftwdep, cjsondep],
-+                                        fftwdep, cjsondep, argpdep],
-                          install: true,
-                          install_rpath: crystfel_rpath)
- 
diff --git a/pkgs/by-name/cr/crystfel/package.nix b/pkgs/by-name/cr/crystfel/package.nix
index 1b5fdbd9d8b6..d6581ae4b8cb 100644
--- a/pkgs/by-name/cr/crystfel/package.nix
+++ b/pkgs/by-name/cr/crystfel/package.nix
@@ -122,10 +122,10 @@ let
 
   xgandalf = stdenv.mkDerivation rec {
     pname = "xgandalf";
-    version = "c6c5003ff1086e8c0fb5313660b4f02f3a3aab7b";
+    version = "8a63600ec778b155031adc3c151424aaced6a0cc";
     src = fetchurl {
       url = "https://gitlab.desy.de/thomas.white/xgandalf/-/archive/${version}/xgandalf-${version}.tar.gz";
-      hash = "sha256-/uZlBwAINSoYqgLQFTMz8rS1Rpadu79JkO6Bu/+Nx9E=";
+      hash = "sha256-UhFbpv+4qMwxEQIJpVpMzSg46P0vm0dkEyJDzxVu6XY=";
     };
 
     nativeBuildInputs = [
@@ -138,10 +138,10 @@ let
 
   pinkIndexer = stdenv.mkDerivation rec {
     pname = "pinkindexer";
-    version = "15caa21191e27e989b750b29566e4379bc5cd21a";
+    version = "85f3883f8c1fe98a03e5f3d371f2da4fee97894e";
     src = fetchurl {
       url = "https://gitlab.desy.de/thomas.white/pinkindexer/-/archive/${version}/pinkindexer-${version}.tar.gz";
-      hash = "sha256-v/SCJiHAV05Lc905y/dE8uBXlW+lLX9wau4XORYdbQg=";
+      hash = "sha256-W4COYdeESP0S2KhB2UdaJSbxNiFm5yyapKkmICDtP0A=";
     };
 
     nativeBuildInputs = [
@@ -154,10 +154,10 @@ let
 
   fdip = stdenv.mkDerivation rec {
     pname = "fdip";
-    version = "5628fedddd79323b4b26df9b85e9543d83286d4c";
+    version = "631792e90ed2c3e226dce77bf97917305293ac66";
     src = fetchurl {
       url = "https://gitlab.desy.de/thomas.white/fdip/-/archive/${version}/fdip-${version}.tar.gz";
-      hash = "sha256-EaihnW7p//ecgMn+KKlfmBeXrnAqs+HdhN+ovuSrtiQ=";
+      hash = "sha256-nnvOPl35NgtJ13fgWWAuVhtWT/JOk2DyYmBgI0ojZ2o=";
     };
 
     nativeBuildInputs = [
@@ -221,10 +221,10 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crystfel";
-  version = "0.12.0";
+  version = "0.13.0";
   src = fetchurl {
     url = "https://www.desy.de/~twhite/crystfel/crystfel-${version}.tar.gz";
-    sha256 = "sha256-H/caXhsIdgsiat3UTi1QMF9J22dtyEB6YEIn9f8wWB4=";
+    sha256 = "sha256-6Fz7W8kRKlaTmnL+21t20UgkTjr3oC08IOzAGOseaQU=";
   };
   nativeBuildInputs = [
     meson
@@ -261,12 +261,6 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals withBitshuffle [ hdf5-external-filter-plugins ];
 
-  patches = [
-    # on darwin at least, we need to link to a separate argp library;
-    # this patch adds a test for this and the necessary linker options
-    ./link-to-argp-standalone-if-needed.patch
-  ];
-
   # CrystFEL calls mosflm by searching PATH for it. We could've create a wrapper script that sets the PATH, but
   # we'd have to do that for every CrystFEL executable (indexamajig, crystfel, partialator). Better to just
   # hard-code mosflm's path once.
diff --git a/pkgs/by-name/do/doppler/package.nix b/pkgs/by-name/do/doppler/package.nix
index 80ca08143821..68257d322685 100644
--- a/pkgs/by-name/do/doppler/package.nix
+++ b/pkgs/by-name/do/doppler/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "doppler";
-  version = "3.76.1";
+  version = "3.76.4";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = finalAttrs.version;
-    hash = "sha256-8df60dWV/8ZezCAXVT7wmzCCB/TyljzAszv8sy7qRjU=";
+    hash = "sha256-GkM4pSmMIjoyOMPmtb4GoSrZdz69kL1s1r+krRhedR8=";
   };
 
   vendorHash = "sha256-rDpr4qWhMWXEhgZrmoW5tzPZif3KAv3gDtJNtXzbVq0=";
diff --git a/pkgs/by-name/fl/flatpak/flatpak-spawn-env.patch b/pkgs/by-name/fl/flatpak/flatpak-spawn-env.patch
deleted file mode 100644
index 2210bbc93cc0..000000000000
--- a/pkgs/by-name/fl/flatpak/flatpak-spawn-env.patch
+++ /dev/null
@@ -1,467 +0,0 @@
-From 82d4d8c458b9f18a14e83a3f5181ec8237c47790 Mon Sep 17 00:00:00 2001
-From: Sebastian Wick <sebastian.wick@redhat.com>
-Date: Mon, 6 Jul 2026 17:24:50 +0200
-Subject: [PATCH 1/5] Revert "portal: Clear the environment via flatpak
- arguments"
-
-This reverts commit a57f6bc3721059e48060e102de3367c6297e9e51.
-
-The run-environ from the calling instance is a host-like environment
-(e.g. on NixOS it contains /nix/store paths). Passing it via --env
-injects it into the sandbox payload environment where those paths don't
-exist.
-
-Revert the commit, so we pass run-environ as the envp for spawning
-flatpak run again to let it make host-level decisions (DISPLAY,
-FLATPAK_GL_DRIVERS, XDG_RUNTIME_DIR, etc.) without leaking into the
-sandbox.
-
-It also passes --clear-env unconditionally, because we'd build up the
-environment, but the wrong one. We will implement --clear-env properly
-again in the next few commits.
-
-Closes: #6717
-Fixes: a57f6bc3 ("portal: Clear the environment via flatpak arguments")
----
- portal/flatpak-portal.c | 54 +++++++++++++++++++++--------------------
- 1 file changed, 28 insertions(+), 26 deletions(-)
-
-diff --git a/portal/flatpak-portal.c b/portal/flatpak-portal.c
-index f9304464a6..ddf4996e16 100644
---- a/portal/flatpak-portal.c
-+++ b/portal/flatpak-portal.c
-@@ -64,6 +64,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC (PortalFlatpakUpdateMonitorSkeleton, g_object_unre
- /* Should be roughly 2 seconds */
- #define CHILD_STATUS_CHECK_ATTEMPTS 20
- 
-+static GStrv original_environ = NULL;
- static GHashTable *client_pid_data_hash = NULL;
- static GDBusConnection *session_bus = NULL;
- static GNetworkMonitor *network_monitor = NULL;
-@@ -907,22 +908,17 @@ handle_spawn (PortalFlatpak         *object,
-       return G_DBUS_METHOD_INVOCATION_HANDLED;
-     }
- 
--  if ((flatpak = g_getenv ("FLATPAK_PORTAL_MOCK_FLATPAK")) != NULL)
--    g_ptr_array_add (flatpak_argv, g_strdup (flatpak));
--  else if ((flatpak = g_getenv ("FLATPAK")) != NULL)
--    g_ptr_array_add (flatpak_argv, g_strdup (flatpak));
-+  /* TODO: Ideally we should let `flatpak run` inherit the run environment
-+   * of the instance, in case e.g. a LD_LIBRARY_PATH is needed to be able
-+   * to run `flatpak run`, but tell it to start from a blank environment
-+   * when running the Flatpak app; but this isn't currently possible, so
-+   * for now we preserve existing behaviour. */
-+  if (arg_flags & FLATPAK_SPAWN_FLAGS_CLEAR_ENV)
-+    {
-+      char *empty[] = { NULL };
-+      env = g_strdupv (empty);
-+    }
-   else
--    g_ptr_array_add (flatpak_argv, g_strdup (FLATPAK_BINDIR "/flatpak"));
--
--  g_ptr_array_add (flatpak_argv, g_strdup ("run"));
--
--  /* If we don't clear the env, the flatpak portal service environment would
--   * leak into the flatpak instance. By default we reuse the environment of
--   * the calling instance by passing it as arguments after the --clear-env.
--   */
--  g_ptr_array_add (flatpak_argv, g_strdup ("--clear-env"));
--
--  if (!(arg_flags & FLATPAK_SPAWN_FLAGS_CLEAR_ENV))
-     {
-       static const char * const mock_run_environ[] = { "FOO=bar", NULL };
- 
-@@ -935,8 +931,8 @@ handle_spawn (PortalFlatpak         *object,
-         {
-           if (g_error_matches (error, G_FILE_ERROR, G_FILE_ERROR_NOENT))
-             {
--              g_warning ("Environment for \"flatpak run\" was not found, "
--                         "falling back to a clean environment");
-+              g_warning ("Environment for \"flatpak run\" was not found, falling back to current environment");
-+              env = g_strdupv (original_environ);
-             }
-           else
-             {
-@@ -947,16 +943,17 @@ handle_spawn (PortalFlatpak         *object,
-               return G_DBUS_METHOD_INVOCATION_HANDLED;
-             }
-         }
--      else
--        {
--          for (i = 0; env != NULL && env[i] != NULL; i++)
--            {
--              g_string_append (env_string, env[i]);
--              g_string_append_c (env_string, '\0');
--            }
--        }
-     }
- 
-+  if ((flatpak = g_getenv ("FLATPAK_PORTAL_MOCK_FLATPAK")) != NULL)
-+    g_ptr_array_add (flatpak_argv, g_strdup (flatpak));
-+  else if ((flatpak = g_getenv ("FLATPAK")) != NULL)
-+    g_ptr_array_add (flatpak_argv, g_strdup (flatpak));
-+  else
-+    g_ptr_array_add (flatpak_argv, g_strdup (FLATPAK_BINDIR "/flatpak"));
-+
-+  g_ptr_array_add (flatpak_argv, g_strdup ("run"));
-+
-   sandboxed = (arg_flags & FLATPAK_SPAWN_FLAGS_SANDBOX) != 0;
- 
-   if (sandboxed)
-@@ -1507,7 +1504,7 @@ handle_spawn (PortalFlatpak         *object,
-    * to work around a deadlock in GLib < 2.60 */
-   if (!g_spawn_async_with_pipes (NULL,
-                                  (char **) flatpak_argv->pdata,
--                                 NULL,
-+                                 env,
-                                  G_SPAWN_SEARCH_PATH | G_SPAWN_DO_NOT_REAP_CHILD | G_SPAWN_LEAVE_DESCRIPTORS_OPEN,
-                                  child_setup_func, &child_setup_data,
-                                  &pid,
-@@ -3017,6 +3014,10 @@ main (int    argc,
-     { NULL }
-   };
- 
-+  /* Save the enviroment before changing anything, so that subprocesses
-+   * can get the unchanged version */
-+  original_environ = g_get_environ ();
-+
-   setlocale (LC_ALL, "");
- 
-   g_setenv ("GIO_USE_VFS", "local", TRUE);
-@@ -3119,5 +3120,6 @@ main (int    argc,
-   main_loop = g_main_loop_new (NULL, FALSE);
-   g_main_loop_run (main_loop);
- 
-+  g_strfreev (original_environ);
-   return 0;
- }
-
-From 08bb74fde8d53fef1b236454c673c70f6d78bea4 Mon Sep 17 00:00:00 2001
-From: Sebastian Wick <sebastian.wick@redhat.com>
-Date: Mon, 6 Jul 2026 17:36:13 +0200
-Subject: [PATCH 2/5] portal: Clear error after warning to avoid issues on the
- next error
-
----
- portal/flatpak-portal.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/portal/flatpak-portal.c b/portal/flatpak-portal.c
-index ddf4996e16..d59b3d6265 100644
---- a/portal/flatpak-portal.c
-+++ b/portal/flatpak-portal.c
-@@ -942,6 +942,8 @@ handle_spawn (PortalFlatpak         *object,
-                                                      error->message);
-               return G_DBUS_METHOD_INVOCATION_HANDLED;
-             }
-+
-+          g_clear_error (&error);
-         }
-     }
- 
-
-From 700f17e94c4e26cfea051c0fdc82314d8d10d009 Mon Sep 17 00:00:00 2001
-From: Sebastian Wick <sebastian.wick@redhat.com>
-Date: Mon, 6 Jul 2026 17:36:41 +0200
-Subject: [PATCH 3/5] portal: Pass run-environ to the spawned flatpak process,
- not the sandbox
-
-Instead of modifying the host-like run environment to clear the sandbox
-environment, we'll use the new --clear-env flag which does the correct
-thing.
-
-Assisted-by: Claude:opus-4.6
-Closes: #5271
----
- portal/flatpak-portal.c | 14 +++-----------
- 1 file changed, 3 insertions(+), 11 deletions(-)
-
-diff --git a/portal/flatpak-portal.c b/portal/flatpak-portal.c
-index d59b3d6265..5cd2e98bff 100644
---- a/portal/flatpak-portal.c
-+++ b/portal/flatpak-portal.c
-@@ -908,17 +908,6 @@ handle_spawn (PortalFlatpak         *object,
-       return G_DBUS_METHOD_INVOCATION_HANDLED;
-     }
- 
--  /* TODO: Ideally we should let `flatpak run` inherit the run environment
--   * of the instance, in case e.g. a LD_LIBRARY_PATH is needed to be able
--   * to run `flatpak run`, but tell it to start from a blank environment
--   * when running the Flatpak app; but this isn't currently possible, so
--   * for now we preserve existing behaviour. */
--  if (arg_flags & FLATPAK_SPAWN_FLAGS_CLEAR_ENV)
--    {
--      char *empty[] = { NULL };
--      env = g_strdupv (empty);
--    }
--  else
-     {
-       static const char * const mock_run_environ[] = { "FOO=bar", NULL };
- 
-@@ -956,6 +945,9 @@ handle_spawn (PortalFlatpak         *object,
- 
-   g_ptr_array_add (flatpak_argv, g_strdup ("run"));
- 
-+  if (arg_flags & FLATPAK_SPAWN_FLAGS_CLEAR_ENV)
-+    g_ptr_array_add (flatpak_argv, g_strdup ("--clear-env"));
-+
-   sandboxed = (arg_flags & FLATPAK_SPAWN_FLAGS_SANDBOX) != 0;
- 
-   if (sandboxed)
-
-From 04aa33fbb0f207aae43ef90c38d5b6bbaff0df62 Mon Sep 17 00:00:00 2001
-From: Sebastian Wick <sebastian.wick@redhat.com>
-Date: Mon, 6 Jul 2026 17:40:49 +0200
-Subject: [PATCH 4/5] portal: Cleanup getting the host-like environment for
- flatpak-run
-
----
- portal/flatpak-portal.c | 58 ++++++++++++++++++++++-------------------
- 1 file changed, 31 insertions(+), 27 deletions(-)
-
-diff --git a/portal/flatpak-portal.c b/portal/flatpak-portal.c
-index 5cd2e98bff..183d3fe477 100644
---- a/portal/flatpak-portal.c
-+++ b/portal/flatpak-portal.c
-@@ -908,33 +908,37 @@ handle_spawn (PortalFlatpak         *object,
-       return G_DBUS_METHOD_INVOCATION_HANDLED;
-     }
- 
--    {
--      static const char * const mock_run_environ[] = { "FOO=bar", NULL };
--
--      if (testing)
--        env = g_strdupv ((GStrv) mock_run_environ);
--      else
--        env = flatpak_instance_get_run_environ (instance, &error);
--
--      if (env == NULL)
--        {
--          if (g_error_matches (error, G_FILE_ERROR, G_FILE_ERROR_NOENT))
--            {
--              g_warning ("Environment for \"flatpak run\" was not found, falling back to current environment");
--              env = g_strdupv (original_environ);
--            }
--          else
--            {
--              g_dbus_method_invocation_return_error (invocation, G_DBUS_ERROR,
--                                                     G_DBUS_ERROR_INVALID_ARGS,
--                                                     "Could not load environment for \"flatpak run\": %s",
--                                                     error->message);
--              return G_DBUS_METHOD_INVOCATION_HANDLED;
--            }
--
--          g_clear_error (&error);
--        }
--    }
-+  /* Pass the calling instance's run-environ as the envp for spawning
-+   * flatpak run, so it can make host-level decisions (DISPLAY, GL drivers,
-+   * XDG_RUNTIME_DIR, etc.) based on the original environment. This must NOT
-+   * go into --env-fd, because run-environ is host-like and --env-fd injects
-+   * into the sandbox payload environment.
-+   */
-+  {
-+    static const char * const mock_run_environ[] = { "FOO=bar", NULL };
-+
-+    if (testing)
-+      env = g_strdupv ((GStrv) mock_run_environ);
-+    else
-+      env = flatpak_instance_get_run_environ (instance, &error);
-+
-+    if (env == NULL)
-+      {
-+        if (!g_error_matches (error, G_FILE_ERROR, G_FILE_ERROR_NOENT))
-+          {
-+            g_dbus_method_invocation_return_error (invocation, G_DBUS_ERROR,
-+                                                   G_DBUS_ERROR_INVALID_ARGS,
-+                                                   "Could not load environment for \"flatpak run\": %s",
-+                                                   error->message);
-+            return G_DBUS_METHOD_INVOCATION_HANDLED;
-+          }
-+
-+        g_clear_error (&error);
-+        g_warning ("Environment for \"flatpak run\" was not found, "
-+                   "falling back to current environment");
-+        env = g_strdupv (original_environ);
-+      }
-+  }
- 
-   if ((flatpak = g_getenv ("FLATPAK_PORTAL_MOCK_FLATPAK")) != NULL)
-     g_ptr_array_add (flatpak_argv, g_strdup (flatpak));
-
-From 254b24275567178626b5efb5d6ead2b0c2483cb7 Mon Sep 17 00:00:00 2001
-From: Sebastian Wick <sebastian.wick@redhat.com>
-Date: Mon, 29 Jun 2026 15:11:26 +0200
-Subject: [PATCH 5/5] portal: Test that the different envs get created as
- expected
-
-Assisted-by: Claude:opus-4.6
----
- tests/mock-flatpak.c |  15 +++++-
- tests/test-portal.c  | 113 +++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 127 insertions(+), 1 deletion(-)
-
-diff --git a/tests/mock-flatpak.c b/tests/mock-flatpak.c
-index c340c781c9..ac27c4d031 100644
---- a/tests/mock-flatpak.c
-+++ b/tests/mock-flatpak.c
-@@ -28,7 +28,8 @@
- 
- int
- main (int argc,
--      char **argv)
-+      char **argv,
-+      char **envp)
- {
-   int i;
- 
-@@ -37,6 +38,18 @@ main (int argc,
-   for (i = 0; i < argc; i++)
-     g_print ("argv[%d] = %s\n", i, argv[i]);
- 
-+  for (i = 0; envp != NULL && envp[i] != NULL; i++)
-+    {
-+      const char *eq = strchr (envp[i], '=');
-+
-+      if (eq != NULL)
-+        {
-+          g_autofree char *key = g_strndup (envp[i], eq - envp[i]);
-+
-+          g_print ("inherited[%s] = %s\n", key, eq + 1);
-+        }
-+    }
-+
-   for (i = 0; i < argc; i++)
-     {
-       if (g_str_has_prefix (argv[i], "--env-fd="))
-diff --git a/tests/test-portal.c b/tests/test-portal.c
-index 4d9e6385b8..40df8241a7 100644
---- a/tests/test-portal.c
-+++ b/tests/test-portal.c
-@@ -422,6 +422,118 @@ test_fd_passing (Fixture *f,
-     }
- }
- 
-+static char *
-+spawn_and_capture_output (Fixture *f,
-+                          guint flags,
-+                          GVariant *envs)
-+{
-+  g_autoptr(GError) error = NULL;
-+  g_autoptr(GUnixFDList) fds_in = g_unix_fd_list_new ();
-+  g_autoptr(GUnixFDList) fds_out = NULL;
-+  g_auto(GVariantBuilder) fd_map_builder = {};
-+  g_autofree char *stdout_path = NULL;
-+  glnx_autofd int stdout_fd = -1;
-+  guint pid;
-+  gboolean ok;
-+  const char * const argv[] = { "hello", NULL };
-+  gsize times_exited = 0;
-+  gulong handler_id;
-+  char *output;
-+  int handle;
-+
-+  stdout_path = g_strdup ("/tmp/flatpak-portal-test.XXXXXX");
-+  stdout_fd = g_mkstemp (stdout_path);
-+  g_assert_no_errno (stdout_fd);
-+  g_assert_no_errno (unlink (stdout_path));
-+
-+  g_variant_builder_init (&fd_map_builder, G_VARIANT_TYPE ("a{uh}"));
-+
-+  handle = g_unix_fd_list_append (fds_in, stdout_fd, &error);
-+  g_assert_no_error (error);
-+  g_variant_builder_add (&fd_map_builder, "{uh}",
-+                         (guint32) STDOUT_FILENO, (gint32) handle);
-+
-+  handler_id = g_signal_connect (f->proxy, "spawn-exited",
-+                                 G_CALLBACK (count_successful_exit_cb),
-+                                 &times_exited);
-+
-+  ok = portal_flatpak_call_spawn_sync (f->proxy,
-+                                       "/",
-+                                       argv,
-+                                       g_variant_builder_end (&fd_map_builder),
-+                                       envs,
-+                                       flags,
-+                                       g_variant_new ("a{sv}", NULL),
-+                                       fds_in,
-+                                       &pid,
-+                                       &fds_out,
-+                                       NULL,
-+                                       &error);
-+  g_assert_no_error (error);
-+  g_assert_true (ok);
-+
-+  while (times_exited == 0)
-+    g_main_context_iteration (NULL, TRUE);
-+
-+  g_signal_handler_disconnect (f->proxy, handler_id);
-+
-+  g_assert_no_errno (lseek (stdout_fd, 0, SEEK_SET));
-+  output = glnx_fd_readall_utf8 (stdout_fd, NULL, NULL, &error);
-+  g_assert_no_error (error);
-+  g_assert_nonnull (output);
-+
-+  return output;
-+}
-+
-+static void
-+test_spawn_env (Fixture *f,
-+                gconstpointer context G_GNUC_UNUSED)
-+{
-+  g_autofree char *output = NULL;
-+
-+  fixture_start_portal (f);
-+
-+  /* The mock run-environ (FOO=bar) should be in the spawned process
-+   * environment, not injected into the sandbox via --env-fd */
-+  output = spawn_and_capture_output (f, FLATPAK_SPAWN_FLAGS_NONE,
-+                                     g_variant_new ("a{ss}", NULL));
-+  g_test_message ("Output (default): %s", output);
-+  g_assert_nonnull (strstr (output, "inherited[FOO] = bar"));
-+  g_assert_null (strstr (output, "env[FOO] = bar"));
-+  g_assert_null (strstr (output, "--clear-env"));
-+  g_clear_pointer (&output, g_free);
-+
-+  /* With CLEAR_ENV, --clear-env should be passed to flatpak run, but
-+   * the run-environ should still be in the spawned process environment */
-+  output = spawn_and_capture_output (f, FLATPAK_SPAWN_FLAGS_CLEAR_ENV,
-+                                     g_variant_new ("a{ss}", NULL));
-+  g_test_message ("Output (clear-env): %s", output);
-+  g_assert_nonnull (strstr (output, "inherited[FOO] = bar"));
-+  g_assert_null (strstr (output, "env[FOO] = bar"));
-+  g_assert_nonnull (strstr (output, "--clear-env"));
-+  g_clear_pointer (&output, g_free);
-+
-+  /* Env vars passed explicitly via D-Bus arg_envs should end up in
-+   * --env-fd (sandbox payload), not in the process environment */
-+  {
-+    g_auto(GVariantBuilder) env_builder = {};
-+
-+    g_variant_builder_init (&env_builder, G_VARIANT_TYPE ("a{ss}"));
-+    g_variant_builder_add (&env_builder, "{ss}", "BAZ", "qux");
-+
-+    output = spawn_and_capture_output (f, FLATPAK_SPAWN_FLAGS_NONE,
-+                                       g_variant_builder_end (&env_builder));
-+    g_test_message ("Output (with arg_envs): %s", output);
-+    g_assert_nonnull (strstr (output, "env[BAZ] = qux"));
-+    g_assert_null (strstr (output, "inherited[BAZ] = qux"));
-+    g_assert_nonnull (strstr (output, "inherited[FOO] = bar"));
-+    g_clear_pointer (&output, g_free);
-+  }
-+
-+  g_subprocess_send_signal (f->portal, SIGTERM);
-+  g_subprocess_wait (f->portal, NULL, NULL);
-+}
-+
- static void
- test_replace (Fixture *f,
-               gconstpointer context G_GNUC_UNUSED)
-@@ -478,6 +590,7 @@ main (int argc,
-   g_test_add ("/help", Fixture, NULL, setup, test_help, teardown);
-   g_test_add ("/basic", Fixture, NULL, setup, test_basic, teardown);
-   g_test_add ("/fd-passing", Fixture, NULL, setup, test_fd_passing, teardown);
-+  g_test_add ("/spawn-env", Fixture, NULL, setup, test_spawn_env, teardown);
-   g_test_add ("/replace", Fixture, NULL, setup, test_replace, teardown);
- 
-   return g_test_run ();
diff --git a/pkgs/by-name/fl/flatpak/package.nix b/pkgs/by-name/fl/flatpak/package.nix
index 6b7cea1c7987..c18e8c656407 100644
--- a/pkgs/by-name/fl/flatpak/package.nix
+++ b/pkgs/by-name/fl/flatpak/package.nix
@@ -80,7 +80,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak";
-  version = "1.18.0";
+  version = "1.18.1";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pYV6ZsQDndoF2SvcsrAz14jNJYlhAWfw7F8OyNT6xvI=";
+    hash = "sha256-vGg/yRbtIcBSS7Bk81jCrBhYa47IjHby9/KJh3UhYxw=";
   };
 
   patches = [
@@ -115,10 +115,6 @@ stdenv.mkDerivation (finalAttrs: {
     # https://github.com/NixOS/nixpkgs/issues/53441
     ./unset-env-vars.patch
 
-    # Fix portal flatpak-spawn environment handling regression
-    # https://github.com/flatpak/flatpak/pull/6721
-    ./flatpak-spawn-env.patch
-
     # The icon validator needs to access the gdk-pixbuf loaders in the Nix store
     # and cannot bind FHS paths since those are not available on NixOS.
     finalAttrs.passthru.icon-validator-patch
diff --git a/pkgs/by-name/fr/frame-media-converter/package.nix b/pkgs/by-name/fr/frame-media-converter/package.nix
new file mode 100644
index 000000000000..30cbf845a7e2
--- /dev/null
+++ b/pkgs/by-name/fr/frame-media-converter/package.nix
@@ -0,0 +1,111 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  makeWrapper,
+  alsa-lib,
+  ffmpeg,
+  fontconfig,
+  freetype,
+  libdrm,
+  libGL,
+  libx11,
+  libxcb,
+  libxkbcommon,
+  vulkan-loader,
+  wayland,
+}:
+
+let
+  cargoFlags = [
+    "--package"
+    "frame-app"
+  ];
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "frame-media-converter";
+  version = "0.31.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "66HEX";
+    repo = "frame";
+    tag = finalAttrs.version;
+    hash = "sha256-QBwwa5z0BbNa0p7MbV2J+K+NOe0cFxXq9LyvalKTMFY=";
+  };
+
+  cargoHash = "sha256-HJZEY4noPypIXHB6ZMtPKuBawaMmmEpVbfo44v6tKws=";
+  cargoBuildFlags = cargoFlags;
+  cargoTestFlags = cargoFlags;
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    fontconfig
+    freetype
+    libdrm
+    libGL
+    libx11
+    libxcb
+    libxkbcommon
+    vulkan-loader
+    wayland
+  ];
+
+  postInstall = ''
+    install -Dm444 frame-app/resources/frame.desktop.in \
+      $out/share/applications/frame.desktop
+    substituteInPlace $out/share/applications/frame.desktop \
+      --replace-fail '$APP_NAME' Frame \
+      --replace-fail '$APP_CLI' frame \
+      --replace-fail '$APP_ICON' frame
+
+    for icon in \
+      32:32x32.png \
+      64:64x64.png \
+      128:128x128.png \
+      256:128x128@2x.png \
+      512:icon.png
+    do
+      size="''${icon%%:*}"
+      file="''${icon#*:}"
+      install -Dm444 "frame-app/resources/app-icons/$file" \
+        "$out/share/icons/hicolor/''${size}x''${size}/apps/frame.png"
+    done
+  '';
+
+  postFixup = ''
+    patchelf $out/bin/frame --add-rpath ${
+      lib.makeLibraryPath [
+        libGL
+        vulkan-loader
+        wayland
+      ]
+    }
+
+    wrapProgram $out/bin/frame \
+      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]} \
+      --set FRAME_USE_SYSTEM_MEDIA_TOOLS 1 \
+      --set FRAME_UPDATE_EXPLANATION \
+        'This Nixpkgs build is managed by Nix. Install updates through your Nix profile, flake, or NixOS configuration.'
+  '';
+
+  meta = {
+    description = "Native desktop interface for FFmpeg media conversion";
+    homepage = "https://github.com/66HEX/frame";
+    changelog = "https://github.com/66HEX/frame/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "frame";
+    maintainers = [ lib.maintainers._66HEX ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+  };
+})
diff --git a/pkgs/by-name/gh/gh-gei/package.nix b/pkgs/by-name/gh/gh-gei/package.nix
index cbf2dcd3e6ad..03d441137218 100644
--- a/pkgs/by-name/gh/gh-gei/package.nix
+++ b/pkgs/by-name/gh/gh-gei/package.nix
@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "gh-gei";
-  version = "1.31.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "gh-gei";
     rev = "v${version}";
-    hash = "sha256-i79W9XYIwa0R0gsH9FwcBsY7UzMjACfjk9S4D9GWpsY=";
+    hash = "sha256-i7XWGYDB5izL6QH8BRCppz01xNuBDGNy0rMCxSuQFXU=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx;
diff --git a/pkgs/by-name/gh/gh-stack/package.nix b/pkgs/by-name/gh/gh-stack/package.nix
index c1b76a48d624..b3f836cde536 100644
--- a/pkgs/by-name/gh/gh-stack/package.nix
+++ b/pkgs/by-name/gh/gh-stack/package.nix
@@ -30,6 +30,10 @@ buildGoModule (finalAttrs: {
     "-X=github.com/github/gh-stack/cmd.Version=${finalAttrs.version}"
   ];
 
+  postInstall = ''
+    install -Dm444 skills/gh-stack/SKILL.md $out/share/skills/gh-stack/gh-stack/SKILL.md
+  '';
+
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
diff --git a/pkgs/by-name/gi/git-pkgs/package.nix b/pkgs/by-name/gi/git-pkgs/package.nix
index 044e1d570bf9..2482fd9032c8 100644
--- a/pkgs/by-name/gi/git-pkgs/package.nix
+++ b/pkgs/by-name/gi/git-pkgs/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "git-pkgs";
-  version = "0.18.2";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "git-pkgs";
     repo = "git-pkgs";
     tag = "v${version}";
-    hash = "sha256-C4T4xkNrMIMuRLhua0fTXDpIz0qq5EaqVnSKWUc7Sm0=";
+    hash = "sha256-G2YcixQ7NrljVKhpset7bc/dmqcc3cgQyMMWlJmKSDw=";
   };
 
-  vendorHash = "sha256-d5Me/VgXXC2FyxG17rXg1FmOIi1fJqBmBU+bF5u0j/8=";
+  vendorHash = "sha256-r8VGoLtgE36UsV2Eg8kOJ62LG7qMTGR6/zDOayZ/aVI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gi/gitea/package.nix b/pkgs/by-name/gi/gitea/package.nix
index 191debfcf551..72a33ae59aff 100644
--- a/pkgs/by-name/gi/gitea/package.nix
+++ b/pkgs/by-name/gi/gitea/package.nix
@@ -30,7 +30,7 @@ let
       inherit (finalAttrs) pname version src;
       inherit pnpm;
       fetcherVersion = 4;
-      hash = "sha256-VAXSj+AYV6uEdCAD/sEzeydqn4cqNL+ITfrGq41jaLI=";
+      hash = "sha256-rduD3GqgdUlF95HTnKe8smToyHop4RrO6QDTRzh2RCk=";
     };
 
     nativeBuildInputs = [
@@ -53,13 +53,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "gitea";
-  version = "1.27.1";
+  version = "1.27.2";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OCThp8432WAD+9v7c7phY2u4JndXAfve4XRbJTLdn6g=";
+    hash = "sha256-376YyRYcZGya/k5zg2zL2iqtrE7r2Q/DMd3DbOnKyOA=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/go/go-mockery/package.nix b/pkgs/by-name/go/go-mockery/package.nix
index 7cad1976b419..af01bb79e0a5 100644
--- a/pkgs/by-name/go/go-mockery/package.nix
+++ b/pkgs/by-name/go/go-mockery/package.nix
@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-mockery";
-  version = "3.5.5";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-paoI7KkpLbpQyEwS/oW8Ck9KiJRTUxzFzihsnFyhrCw=";
+    hash = "sha256-lPyoWjLaRhE4SpVahJd8T3LsCyfdFMIsuxmWODRoLL0=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-YOhlytIMgMHwj2BM/6vOeheyQd4nUuDWpkwLdCqru8c=";
+  vendorHash = "sha256-izMi4MqbfKX1PmNMWyCwBOWqiPZfth/ZSzsuEcTN6Pg=";
 
   ldflags = [
     "-s"
@@ -41,8 +41,11 @@ buildGoModule (finalAttrs: {
   prePatch = ''
     # remove test.ci's dependency on lint since we don't need it and
     # it tries to use remote golangci-lint
+    # remove test.ci's git-state check, which runs `git diff --exit-code`;
+    # the source has no .git directory, so the check cannot work here
     substituteInPlace Taskfile.yml \
       --replace-fail "deps: [lint]" "" \
+      --replace-fail "      - task: git-state" "" \
       --replace-fail "go run gotest.tools/gotestsum" "gotestsum"
 
     # patch scripts used in e2e testing
diff --git a/pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.2.patch b/pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.2.patch
deleted file mode 100644
index 5c754660bef1..000000000000
--- a/pkgs/by-name/gr/grig/0001-Fix-grig-for-hamlib-4.6.2.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff --git a/src/rig-selector.c b/src/rig-selector.c
-index 425d41a..e040c0e 100644
---- a/src/rig-selector.c
-+++ b/src/rig-selector.c
-@@ -46,7 +46,7 @@ static void add     (GtkWidget *, gpointer);
- static void delete  (GtkWidget *, gpointer);
- static void edit    (GtkWidget *, gpointer);
- static void cancel  (GtkWidget *, gpointer);
--static void connect (GtkWidget *, gpointer);
-+static void connectrig (GtkWidget *, gpointer);
- static void selection_changed (GtkTreeSelection *sel, gpointer data);
- 
- static void render_civ (GtkTreeViewColumn *col,
-@@ -191,7 +191,7 @@ rig_selector_execute ()
-     g_signal_connect (G_OBJECT (cancbut), "clicked",
-                       G_CALLBACK (cancel), window);
-     g_signal_connect (G_OBJECT (conbut), "clicked",
--                      G_CALLBACK (connect), window);
-+                      G_CALLBACK (connectrig), window);
-     g_signal_connect (G_OBJECT (delbut), "clicked",
-                       G_CALLBACK (delete), NULL);
-     g_signal_connect (G_OBJECT (newbut), "clicked",
-@@ -439,7 +439,7 @@ static void cancel (GtkWidget *button, gpointer window)
-  * simply destroys the rig selector window and whereby control is returned
-  * to the main() function.
-  */
--static void connect (GtkWidget *button, gpointer window)
-+static void connectrig (GtkWidget *button, gpointer window)
- {
-     
-     
--- 
-2.47.0
-
diff --git a/pkgs/by-name/gr/grig/package.nix b/pkgs/by-name/gr/grig/package.nix
deleted file mode 100644
index b1b250723845..000000000000
--- a/pkgs/by-name/gr/grig/package.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoreconfHook,
-  pkg-config,
-  wrapGAppsHook3,
-  gtk2,
-  hamlib_4,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "grig";
-  version = "0.9.0";
-
-  src = fetchFromGitHub {
-    owner = "fillods";
-    repo = "grig";
-    rev = "GRIG-${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    sha256 = "sha256-OgIgHW9NMW/xSSti3naIR8AQWUtNSv5bYdOcObStBlM=";
-  };
-
-  patches = [
-    # https://github.com/fillods/grig/issues/22
-    ./0001-Fix-grig-for-hamlib-4.6.2.patch
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-    wrapGAppsHook3
-  ];
-  buildInputs = [
-    hamlib_4
-    gtk2
-  ];
-
-  meta = {
-    description = "Simple Ham Radio control (CAT) program based on Hamlib";
-    mainProgram = "grig";
-    longDescription = ''
-      Grig is a graphical user interface for the Ham Radio Control Libraries.
-      It is intended to be simple and generic, presenting the user with the
-      same interface regardless of which radio they use.
-    '';
-    homepage = "https://groundstation.sourceforge.net/grig/";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [
-      mafo
-    ];
-  };
-})
diff --git a/pkgs/by-name/ha/harper-desktop/package.nix b/pkgs/by-name/ha/harper-desktop/package.nix
index 98448c621860..367254108641 100644
--- a/pkgs/by-name/ha/harper-desktop/package.nix
+++ b/pkgs/by-name/ha/harper-desktop/package.nix
@@ -8,14 +8,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "harper-desktop";
-  version = "2.7.0";
+  version = "2.8.0";
 
   __structuredAttrs = true;
   strictDeps = true;
 
   src = fetchurl {
     url = "https://github.com/Automattic/harper/releases/download/v${finalAttrs.version}/Harper_${finalAttrs.version}_universal.dmg";
-    hash = "sha256-/hVrBnfCun4nmx1k8eJZHdP5pZBJ52GpKkjt9gJ8FC0=";
+    hash = "sha256-qF9FGsSGzf9lD1jXutFgKTGmgKdgSDXKraFKPA3tvJY=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index 9aa68c9cf85b..8ee55e63deda 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "harper";
-  version = "2.7.0";
+  version = "2.8.0";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Automattic";
     repo = "harper";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-neXBLfpqrrT7GWTEVs03AA5+ixSLIrRUuzRdXsXfS4Q=";
+    hash = "sha256-jbJ2bYLIhxd6troB6JAKYmhvfhU+kwmOSYZpWCIjxpQ=";
   };
 
-  cargoHash = "sha256-dp2VPKoOVmB1rD8ET5I3zAvGKZQMmw5wdWUwr3TMk+k=";
+  cargoHash = "sha256-ZxRG79CggsM8MbeXMCKU5/N7vlng3xex/mAfYkkDwew=";
 
   cargoBuildFlags = [
     "--package=harper-cli"
@@ -33,8 +33,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   passthru = {
-    tests = vscode-extensions.elijah-potter.harper;
-    updateScript = nix-update-script { };
+    tests.vscode = vscode-extensions.elijah-potter.harper;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "tests.vscode"
+      ];
+    };
   };
 
   nativeInstallCheckInputs = [
diff --git a/pkgs/by-name/in/intel-llvm/unified-runtime.nix b/pkgs/by-name/in/intel-llvm/unified-runtime.nix
index 41bdfd477ce0..8ae7309bd566 100644
--- a/pkgs/by-name/in/intel-llvm/unified-runtime.nix
+++ b/pkgs/by-name/in/intel-llvm/unified-runtime.nix
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     filecheck
   ];
 
-  postPatch = lib.optionalString finalAttrs.doCheck ''
+  postPatch = lib.optionalString finalAttrs.finalPackage.doCheck ''
     # These tests don't run without setting UR_DPCXX,
     # however they aren't properly excluded, causing lit to fail.
     rm test/adapters/hip/lit.cfg.py
@@ -139,9 +139,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     (lib.cmakeBool "UR_ENABLE_LATENCY_HISTOGRAM" true)
 
-    (lib.cmakeBool "UR_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "UR_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
     # The test hello_world.test depends on the hello_world example, so build examples when testing
-    (lib.cmakeBool "UR_BUILD_EXAMPLES" finalAttrs.doCheck)
+    (lib.cmakeBool "UR_BUILD_EXAMPLES" finalAttrs.finalPackage.doCheck)
 
     (lib.cmakeBool "UR_BUILD_ADAPTER_L0" levelZeroSupport)
     (lib.cmakeBool "UR_BUILD_ADAPTER_L0_V2" levelZeroSupport)
diff --git a/pkgs/by-name/jb/jbang/package.nix b/pkgs/by-name/jb/jbang/package.nix
index a2a6a029f981..f5a18c5cc5d9 100644
--- a/pkgs/by-name/jb/jbang/package.nix
+++ b/pkgs/by-name/jb/jbang/package.nix
@@ -10,7 +10,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.136.0";
+  version = "0.141.0";
   pname = "jbang";
 
   __structuredAttrs = true;
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-MsP4iLquOwJWlV7EPxSuAPWuyTv1PPSyQCrVdq4lPlM=";
+    sha256 = "sha256-fw87WrmqdVH+NJ+rAnuMukz7qMTRg6CMgLVg/+JPahI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/jr/jrl-cmakemodules/package.nix b/pkgs/by-name/jr/jrl-cmakemodules/package.nix
index 01440ba49408..4c4c8969b506 100644
--- a/pkgs/by-name/jr/jrl-cmakemodules/package.nix
+++ b/pkgs/by-name/jr/jrl-cmakemodules/package.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeBool "JRL_CMAKEMODULES_GENERATE_API_DOC" true)
-    (lib.cmakeBool "JRL_CMAKEMODULES_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "JRL_CMAKEMODULES_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
   doCheck = true;
diff --git a/pkgs/by-name/lc/lcevcdec/package.nix b/pkgs/by-name/lc/lcevcdec/package.nix
index ac235b1e5d4e..a4ffa83bebab 100644
--- a/pkgs/by-name/lc/lcevcdec/package.nix
+++ b/pkgs/by-name/lc/lcevcdec/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lcevcdec";
-  version = "4.2.0";
+  version = "4.2.1";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "v-novaltd";
     repo = "LCEVCdec";
     tag = finalAttrs.version;
-    hash = "sha256-EVp+ucydbBWlMMXbldkwDEbFlM88UIts8f/PspIqqSY=";
+    hash = "sha256-syVpcbBPpWGRZ/fRy1QKC/kCokQ9IXcteMfg883362E=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libbacktrace/package.nix b/pkgs/by-name/li/libbacktrace/package.nix
index 0e4f30d052ba..97f9b7f71fd6 100644
--- a/pkgs/by-name/li/libbacktrace/package.nix
+++ b/pkgs/by-name/li/libbacktrace/package.nix
@@ -1,5 +1,8 @@
 {
+  stdenvNoCC,
   stdenv,
+  overrideCC,
+  buildPackages,
   lib,
   fetchFromGitHub,
   enableStatic ? stdenv.hostPlatform.isStatic,
@@ -8,6 +11,33 @@
   autoreconfHook,
 }:
 
+let
+  # With GCC NG, `libstdc++` links this rather than compiling its own copy,
+  # which puts it below the C++ standard library rather than above; built with
+  # the ordinary `stdenv` the two would create a cycle.
+  #
+  # I would rather this bootstrapping detail not leak into the `package.nix`,
+  # but I don't see another solution available since all-package.nix overrides
+  # of "by-name" packages are no longer allowed.
+  #
+  # TODO: hoist this back out to a `stdenvNoCXX` in `all-packages.nix`,
+  # where the next package needing a hosted-but-C++-free compiler can
+  # share it. `nixpkgs-vet` blocks that today: it wants `strictDeps` and
+  # `__structuredAttrs`, but this is only relevant for derivations made
+  # with `stdenv.mkDerivation` --- `stdenv` itself is *not* such a
+  # derivation!
+  stdenv' =
+    if stdenvNoCC.hostPlatform.useLLVM or false then
+      overrideCC stdenvNoCC buildPackages.llvmPackages.clangNoLibcxx
+    else if stdenvNoCC.hostPlatform.useGccNG or false then
+      overrideCC stdenvNoCC buildPackages.gccNGPackages.gccWithLibatomic
+    else
+      stdenv;
+in
+let
+  stdenv = stdenv';
+in
+
 stdenv.mkDerivation {
   pname = "libbacktrace";
   version = "0-unstable-2026-05-03";
diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix
index e50f8656c1c0..0e23409dcd67 100644
--- a/pkgs/by-name/li/libgcrypt/package.nix
+++ b/pkgs/by-name/li/libgcrypt/package.nix
@@ -104,12 +104,17 @@ stdenv.mkDerivation (finalAttrs: {
     sed -i 's,\(-lcap\),-L${libcap.lib}/lib \1,' $lib/lib/libgcrypt.la
   '';
 
-  # TODO: figure out why this is even necessary and why the missing dylib only crashes
-  # random instead of every test
-  preCheck = lib.optionalString (stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isStatic) ''
-    mkdir -p $lib/lib
-    cp src/.libs/libgcrypt.20.dylib $lib/lib
-  '';
+  preCheck =
+    # glibc loads libgcc_s dynamically when a thread exits
+    lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.cc.isClang) ''
+      export LD_LIBRARY_PATH="${buildPackages.stdenv.cc.cc.libgcc}/lib''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+    ''
+    # TODO: figure out why this is even necessary and why the missing dylib only crashes
+    # random instead of every test
+    + lib.optionalString (stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isStatic) ''
+      mkdir -p $lib/lib
+      cp src/.libs/libgcrypt.20.dylib $lib/lib
+    '';
 
   doCheck = true;
   enableParallelChecking = true;
diff --git a/pkgs/by-name/li/libopenshot/package.nix b/pkgs/by-name/li/libopenshot/package.nix
index 1eec1eaf174e..db0c8c55b496 100644
--- a/pkgs/by-name/li/libopenshot/package.nix
+++ b/pkgs/by-name/li/libopenshot/package.nix
@@ -3,15 +3,22 @@
   stdenv,
   fetchFromGitHub,
   alsa-lib,
+  catch2_3,
   cmake,
   cppzmq,
+  ctestCheckHook,
   doxygen,
-  ffmpeg,
+  # FIXME: unpin when libopenshot supports ffmpeg 9 (AVCodec.{pix_fmts,sample_fmts,...} removed)
+  ffmpeg_8,
+  glib,
   imagemagick,
   jsoncpp,
   libopenshot-audio,
   llvmPackages,
+  opencv4,
+  pipewire,
   pkg-config,
+  protobuf,
   python3,
   qt6,
   swig,
@@ -21,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libopenshot";
-  version = "0.7.0-unstable-2026-04-21";
+  version = "0.7.0-unstable-2026-07-22";
 
   src = fetchFromGitHub {
     owner = "OpenShot";
     repo = "libopenshot";
-    rev = "a58565292cb84438b1c6a039c343b4c65003bd82";
-    hash = "sha256-zUzyi/VydrxDLCY7E/LBr7+btthOjal3c7md6PTXQWA=";
+    rev = "eac81cf91555438c54fbadef7fdd05bf803f26ee";
+    hash = "sha256-XeEXvKi5O/0J6rEc8rZs4+x/ImF4X0GFw/dOWn9HCCQ=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -39,15 +46,19 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     doxygen
     pkg-config
+    protobuf
     swig
   ];
 
   buildInputs = [
+    catch2_3
     cppzmq
-    ffmpeg
+    ffmpeg_8
     imagemagick
     jsoncpp
     libopenshot-audio
+    (opencv4.override { ffmpeg_8-headless = ffmpeg_8; })
+    protobuf
     python3
     qt6.qtbase
     qt6.qtmultimedia
@@ -56,6 +67,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
+    glib
+    pipewire
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     llvmPackages.openmp
@@ -68,6 +81,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
+  nativeCheckInputs = [ ctestCheckHook ];
+
+  # Spherical metadata is not round-tripped when writing/reading with FFmpeg 8
+  ctestFlags = [
+    "--exclude-regex"
+    "^SphericalMetadata"
+  ];
+
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_RUBY" false)
     (lib.cmakeBool "ENABLE_PYTHON" true)
diff --git a/pkgs/by-name/li/libresplit/package.nix b/pkgs/by-name/li/libresplit/package.nix
index 1d987f13a68c..adc7c021c474 100644
--- a/pkgs/by-name/li/libresplit/package.nix
+++ b/pkgs/by-name/li/libresplit/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  stdenv,
   fetchFromGitHub,
   gtk3,
   jansson,
@@ -12,7 +12,7 @@
   wrapGAppsHook3,
 }:
 
-gcc15Stdenv.mkDerivation {
+stdenv.mkDerivation {
   pname = "libresplit";
   version = "0-unstable-2026-02-11";
 
diff --git a/pkgs/by-name/lu/lua-language-server/package.nix b/pkgs/by-name/lu/lua-language-server/package.nix
index e7931a9fe0dc..e7a178978608 100644
--- a/pkgs/by-name/lu/lua-language-server/package.nix
+++ b/pkgs/by-name/lu/lua-language-server/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lua-language-server";
-  version = "3.19.0";
+  version = "3.19.1";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-TW7BkWNYl5Ndc5sx86Y8LsqVu3Qvh0LMqHyZyW36qso=";
+    hash = "sha256-3Sm958Fr5wn54B+aJMaK+cR/F10dPIcGvBrhjHTy2us=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ma/marble-shell-theme/package.nix b/pkgs/by-name/ma/marble-shell-theme/package.nix
index a6a8e80d42c9..91b25f1797c5 100644
--- a/pkgs/by-name/ma/marble-shell-theme/package.nix
+++ b/pkgs/by-name/ma/marble-shell-theme/package.nix
@@ -14,13 +14,13 @@ assert lib.assertMsg (colors != [ ]) "The `colors` list can not be empty";
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "marble-shell-theme";
-  version = "48.3.2";
+  version = "50.0.0";
 
   src = fetchFromGitHub {
     owner = "imarkoff";
     repo = "Marble-shell-theme";
     tag = finalAttrs.version;
-    hash = "sha256-EYQmtVq852YG4Pmk6Nj4RF+aZUJmIZwhegHIR+Xxu8A=";
+    hash = "sha256-zvDVOLWdcKwSM0Y6bax5l7CdCb3alBCdL07hPCcYffY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/md/mdbook-mermaid/package.nix b/pkgs/by-name/md/mdbook-mermaid/package.nix
index f2cbc854e9e8..464fed824006 100644
--- a/pkgs/by-name/md/mdbook-mermaid/package.nix
+++ b/pkgs/by-name/md/mdbook-mermaid/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdbook-mermaid";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "badboy";
     repo = "mdbook-mermaid";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9aiu3mQaRgVVhtX/v2hMPzclnVQIhUz4gVy0Xc84zO8=";
+    hash = "sha256-hcvX664QoM1wo7oHM68O7rmH+KAkrQZvtXQiwWmm+e8=";
   };
 
-  cargoHash = "sha256-MDtXgNiN4tVgP/98fbcL9WQXAJire+c3lmnc12KhQ50=";
+  cargoHash = "sha256-9uE3Xb4LhzGoB9lcusvyKm28X0uvgYVRzIju+Ozlc6A=";
 
   meta = {
     description = "Preprocessor for mdbook to add mermaid.js support";
diff --git a/pkgs/by-name/me/melange/package.nix b/pkgs/by-name/me/melange/package.nix
index ab4509ae491f..916e9c6dfc02 100644
--- a/pkgs/by-name/me/melange/package.nix
+++ b/pkgs/by-name/me/melange/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "melange";
-  version = "0.41.1";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "melange";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qbbt5TDqyWqf0/TZfFJ9Nf1hmOq8Jh4husJpVEJy1o0=";
+    hash = "sha256-gv6Y+VImdXICrqt2YDr4ROoL6xJSuRE1XyAasSM3dW4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-SfYzWPe6TaGrBhnnO9sFPhCsFwSCcr1TflDZD7ZNVL8=";
+  vendorHash = "sha256-cyhegU/jGLVRidAEAq2XY9agjmMr28u7Hf9cZ67um1g=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/mo/moonshine/package.nix b/pkgs/by-name/mo/moonshine/package.nix
index c0d792c09e22..4564f66c6f08 100644
--- a/pkgs/by-name/mo/moonshine/package.nix
+++ b/pkgs/by-name/mo/moonshine/package.nix
@@ -23,25 +23,25 @@ let
   inputtino-src = fetchFromGitHub {
     owner = "games-on-whales";
     repo = "inputtino";
-    rev = "f4ce2b0df536ef309e9ff318f75b460f7097d7c1";
-    hash = "sha256-mAAXbIK7aNSLyN7OZX9YeesMvT6OZmT9uAx0md6pyRM=";
+    rev = "d28ec79eb63324e68d73a7de22bcb5ff0a6f6bf8";
+    hash = "sha256-xzDsJggQVX5e1twwNvqw5hDXei6OMYA4s5zU4zfp/H0=";
   };
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moonshine";
-  version = "0.13.5";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "hgaiser";
     repo = "moonshine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DwRUVMAm4fSqZu6jECeasiRpnwBt7thWkXzztNRIjcs=";
+    hash = "sha256-TvL3s738wooQwZfBKyCqp0V8qcYFtJL98tsxlSX8fLM=";
   };
 
   __structuredAttrs = true;
   strictDeps = true;
 
-  cargoHash = "sha256-M/VNPnccqK3koa0TeMd+tml79O7BKLxHmrGcGPemGhI=";
+  cargoHash = "sha256-PAC8PcGOXxFNN8Eeiik4JrXeH2H+YcqRaBpJVtUoZ44=";
 
   # Build Moonshine binary and Vulkan layer
   cargoBuildFlags = [
@@ -88,6 +88,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     # udev rules for input
     install -Dm644 dist/60-moonshine.rules "$out/lib/udev/rules.d/60-moonshine.rules"
+
+    # polkit rule for sleep inhibitor
+    install -Dm644 dist/50-moonshine-inhibit-sleep.rules \
+      "$out/share/polkit-1/rules.d/50-moonshine-inhibit-sleep.rules"
   '';
 
   postFixup = ''
@@ -118,7 +122,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/hgaiser/moonshine";
     changelog = "https://github.com/hgaiser/moonshine/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [ neobrain ];
+    maintainers = with lib.maintainers; [
+      neobrain
+      anish
+    ];
     mainProgram = "moonshine";
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/mt/mtpfs/package.nix b/pkgs/by-name/mt/mtpfs/package.nix
deleted file mode 100644
index f65389f29f2d..000000000000
--- a/pkgs/by-name/mt/mtpfs/package.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoreconfHook,
-  pkg-config,
-  fuse,
-  libmtp,
-  glib,
-  libmad,
-  libid3tag,
-  unstableGitUpdater,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "mtpfs";
-  version = "0-unstable-2024-12-10";
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-  buildInputs = [
-    fuse
-    libmtp
-    glib
-    libid3tag
-    libmad
-  ];
-
-  src = fetchFromGitHub {
-    owner = "cjd";
-    repo = "mtpfs";
-    rev = "1177d6cfd8916915f5db7d9b5c6fc9e6eafae6e6";
-    hash = "sha256-/84C8FUW+7U7u7yOzVB6ROoIUKtyIBG0wdD5t53yays=";
-  };
-
-  # Use unstable version to pull in gcc-15 fix until the next release
-  # is out: https://github.com/cjd/mtpfs/pull/28
-  passthru.updateScript = unstableGitUpdater {
-  };
-
-  meta = {
-    homepage = "https://github.com/cjd/mtpfs";
-    description = "FUSE Filesystem providing access to MTP devices";
-    platforms = lib.platforms.all;
-    license = lib.licenses.gpl3;
-    maintainers = [ lib.maintainers.qknight ];
-    broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/mtpfs.x86_64-darwin
-    mainProgram = "mtpfs";
-  };
-})
diff --git a/pkgs/by-name/mu/multi-scrobbler/package.nix b/pkgs/by-name/mu/multi-scrobbler/package.nix
index c6d160a25d88..b264b213790c 100644
--- a/pkgs/by-name/mu/multi-scrobbler/package.nix
+++ b/pkgs/by-name/mu/multi-scrobbler/package.nix
@@ -9,18 +9,18 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "multi-scrobbler";
-  version = "0.15.0";
+  version = "0.16.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "FoxxMD";
     repo = "multi-scrobbler";
     tag = finalAttrs.version;
-    hash = "sha256-vhda31xPLxGmnaU/3AnsrcafPvSE1IIbuRmj6xlttjc=";
+    hash = "sha256-R+CwL+Kp3C5wg1LFt0XlksMtRFt+7YItR3t4QPpND6w=";
   };
 
   npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-dxNHz/r+ai8R9X+yVo5YaBWHPcvQKQUXa499HafAB00=";
+  npmDepsHash = "sha256-aqwiOajXjB6FbHzhXxTSpSxDBWkdYj9O+I1XqoEWgbE=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/na/nanoboyadvance/fix-toml11-4.0.patch b/pkgs/by-name/na/nanoboyadvance/fix-toml11-4.0.patch
deleted file mode 100644
index a430bcf49764..000000000000
--- a/pkgs/by-name/na/nanoboyadvance/fix-toml11-4.0.patch
+++ /dev/null
@@ -1,381 +0,0 @@
-From 41aa0b0c81d6e7b604c1646d52d8418ed2d8d99a Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Mon, 15 Sep 2025 20:45:57 +0100
-Subject: [PATCH] Platform: Core: Update to toml11 4.4.0
-
-Comments are now preserved by default, and the APi gets a bit
-simpler. Many Linux distributions have already moved to the new major
-version, so this eases packaging.
----
- src/platform/core/CMakeLists.txt              |   4 +-
- src/platform/core/include/platform/config.hpp |   4 +-
- src/platform/core/src/config.cpp              | 176 ++++++++----------
- src/platform/qt/src/config.cpp                |  88 ++++-----
- src/platform/qt/src/config.hpp                |   4 +-
- 5 files changed, 121 insertions(+), 155 deletions(-)
-
-diff --git a/src/platform/core/CMakeLists.txt b/src/platform/core/CMakeLists.txt
-index ddb4241f..02a97420 100644
---- a/src/platform/core/CMakeLists.txt
-+++ b/src/platform/core/CMakeLists.txt
-@@ -35,11 +35,11 @@ glad_add_library(glad_gl_core_33 STATIC
- )
- 
- if(USE_SYSTEM_TOML11)
--  find_package(toml11 3.7 REQUIRED)
-+  find_package(toml11 4.0 REQUIRED)
- else()
-   FetchContent_Declare(toml11
-     GIT_REPOSITORY https://github.com/ToruNiina/toml11.git
--    GIT_TAG        d4eb5f3c9d8557b3820c80d55c41068839341b27 # v3.8.1
-+    GIT_TAG        be08ba2be2a964edcdb3d3e3ea8d100abc26f286 # v4.4.0
-   )
-   set(toml11_INSTALL OFF CACHE BOOL "" FORCE)
-   FetchContent_MakeAvailable(toml11)
-diff --git a/src/platform/core/include/platform/config.hpp b/src/platform/core/include/platform/config.hpp
-index 89c6278a..7b0233d4 100644
---- a/src/platform/core/include/platform/config.hpp
-+++ b/src/platform/core/include/platform/config.hpp
-@@ -47,9 +47,7 @@ struct PlatformConfig : Config {
- 
- protected:
-   virtual void LoadCustomData(toml::value const& data) {}
--  virtual void SaveCustomData(
--    toml::basic_value<toml::preserve_comments>& data
--  ) {};
-+  virtual void SaveCustomData(toml::value& data) {}
- };
- 
- } // namespace nba
-diff --git a/src/platform/core/src/config.cpp b/src/platform/core/src/config.cpp
-index be382c94..e6a8e221 100644
---- a/src/platform/core/src/config.cpp
-+++ b/src/platform/core/src/config.cpp
-@@ -29,124 +29,108 @@ void PlatformConfig::Load(std::string const& path) {
-   }
- 
-   if(data.contains("general")) {
--    auto general_result = toml::expect<toml::value>(data.at("general"));
--
--    if(general_result.is_ok()) {
--      auto general = general_result.unwrap();
--      this->bios_path = toml::find_or<std::string>(general, "bios_path", "bios.bin");
--      this->skip_bios = toml::find_or<toml::boolean>(general, "bios_skip", false);
--      this->save_folder = toml::find_or<std::string>(general, "save_folder", "");
--    }
-+    auto general = data.at("general");
-+    this->bios_path = toml::find_or<std::string>(general, "bios_path", "bios.bin");
-+    this->skip_bios = toml::find_or<bool>(general, "bios_skip", false);
-+    this->save_folder = toml::find_or<std::string>(general, "save_folder", "");
-   }
- 
-   if(data.contains("cartridge")) {
--    auto cartridge_result = toml::expect<toml::value>(data.at("cartridge"));
--
--    if(cartridge_result.is_ok()) {
--      auto cartridge = cartridge_result.unwrap();
--      auto save_type = toml::find_or<std::string>(cartridge, "save_type", "detect");
--
--      const std::map<std::string, Config::BackupType> save_types{
--        { "detect",     Config::BackupType::Detect    },
--        { "none",       Config::BackupType::None      },
--        { "sram",       Config::BackupType::SRAM      },
--        { "flash64",    Config::BackupType::FLASH_64  },
--        { "flash128",   Config::BackupType::FLASH_128 },
--        { "eeprom512",  Config::BackupType::EEPROM_4  },
--        { "eeprom8192", Config::BackupType::EEPROM_64 }
--      };
--
--      auto match = save_types.find(save_type);
--
--      if(match == save_types.end()) {
--        Log<Warn>("Config: backup type '{0}' is not valid, defaulting to auto-detect.", save_type);
--        this->cartridge.backup_type = Config::BackupType::Detect;
--      } else {
--        this->cartridge.backup_type = match->second;
--      }
--
--      this->cartridge.force_rtc = toml::find_or<toml::boolean>(cartridge, "force_rtc", false);
--      this->cartridge.force_solar_sensor = toml::find_or<toml::boolean>(cartridge, "force_solar_sensor", false);
--      this->cartridge.solar_sensor_level = toml::find_or<int>(cartridge, "solar_sensor_level", 156);
-+    auto cartridge = data.at("cartridge");
-+    auto save_type = toml::find_or<std::string>(cartridge, "save_type", "detect");
-+
-+    const std::map<std::string, Config::BackupType> save_types{
-+      { "detect",     Config::BackupType::Detect    },
-+      { "none",       Config::BackupType::None      },
-+      { "sram",       Config::BackupType::SRAM      },
-+      { "flash64",    Config::BackupType::FLASH_64  },
-+      { "flash128",   Config::BackupType::FLASH_128 },
-+      { "eeprom512",  Config::BackupType::EEPROM_4  },
-+      { "eeprom8192", Config::BackupType::EEPROM_64 }
-+    };
-+
-+    auto match = save_types.find(save_type);
-+
-+    if(match == save_types.end()) {
-+      Log<Warn>("Config: backup type '{0}' is not valid, defaulting to auto-detect.", save_type);
-+      this->cartridge.backup_type = Config::BackupType::Detect;
-+    } else {
-+      this->cartridge.backup_type = match->second;
-     }
-+
-+    this->cartridge.force_rtc = toml::find_or<bool>(cartridge, "force_rtc", false);
-+    this->cartridge.force_solar_sensor = toml::find_or<bool>(cartridge, "force_solar_sensor", false);
-+    this->cartridge.solar_sensor_level = toml::find_or<int>(cartridge, "solar_sensor_level", 156);
-   }
- 
-   if(data.contains("video")) {
--    auto video_result = toml::expect<toml::value>(data.at("video"));
--
--    if(video_result.is_ok()) {
--      auto video = video_result.unwrap();
-+    auto video = data.at("video");
-   
--      const std::map<std::string, Video::Filter> filters{
--        { "nearest", Video::Filter::Nearest },
--        { "linear",  Video::Filter::Linear  },
--        { "sharp",   Video::Filter::Sharp   },
--        { "xbrz",    Video::Filter::xBRZ    },
--        { "lcd1x",   Video::Filter::Lcd1x   }
--      };
--
--      const std::map<std::string, Video::Color> color_corrections{
--        { "none",  Video::Color::No    },
--        { "higan", Video::Color::higan },
--        { "agb",   Video::Color::AGB   }
--      };
--
--      auto filter = toml::find_or<std::string>(video, "filter", "nearest");
--      auto filter_match = filters.find(filter);
--      if(filter_match != filters.end()) {
--        this->video.filter = filter_match->second;
--      }
--
--      auto color_correction = toml::find_or<std::string>(video, "color_correction", "ags");
--      auto color_correction_match = color_corrections.find(color_correction);
--      if(color_correction_match != color_corrections.end()) {
--        this->video.color = color_correction_match->second;  
--      }
--
--      this->video.lcd_ghosting = toml::find_or<bool>(video, "lcd_ghosting", true);
-+    const std::map<std::string, Video::Filter> filters{
-+      { "nearest", Video::Filter::Nearest },
-+      { "linear",  Video::Filter::Linear  },
-+      { "sharp",   Video::Filter::Sharp   },
-+      { "xbrz",    Video::Filter::xBRZ    },
-+      { "lcd1x",   Video::Filter::Lcd1x   }
-+    };
-+
-+    const std::map<std::string, Video::Color> color_corrections{
-+      { "none",  Video::Color::No    },
-+      { "higan", Video::Color::higan },
-+      { "agb",   Video::Color::AGB   }
-+    };
-+
-+    auto filter = toml::find_or<std::string>(video, "filter", "nearest");
-+    auto filter_match = filters.find(filter);
-+    if(filter_match != filters.end()) {
-+      this->video.filter = filter_match->second;
-     }
-+
-+    auto color_correction = toml::find_or<std::string>(video, "color_correction", "ags");
-+    auto color_correction_match = color_corrections.find(color_correction);
-+    if(color_correction_match != color_corrections.end()) {
-+      this->video.color = color_correction_match->second;  
-+    }
-+
-+    this->video.lcd_ghosting = toml::find_or<bool>(video, "lcd_ghosting", true);
-   }
- 
-   if(data.contains("audio")) {
--    auto audio_result = toml::expect<toml::value>(data.at("audio"));
--
--    if(audio_result.is_ok()) {
--      auto audio = audio_result.unwrap();
--      auto resampler = toml::find_or<std::string>(audio, "resampler", "cosine");
--
--      const std::map<std::string, Config::Audio::Interpolation> resamplers{
--        { "cosine",  Config::Audio::Interpolation::Cosine   },
--        { "cubic",   Config::Audio::Interpolation::Cubic    },
--        { "sinc64",  Config::Audio::Interpolation::Sinc_64  },
--        { "sinc128", Config::Audio::Interpolation::Sinc_128 },
--        { "sinc256", Config::Audio::Interpolation::Sinc_256 }
--      };
--
--      auto match = resamplers.find(resampler);
--
--      if(match == resamplers.end()) {
--        Log<Warn>("Config: unknown resampling algorithm: {} (defaulting to cosine).", resampler);
--        this->audio.interpolation = Config::Audio::Interpolation::Cosine;
--      } else {
--        this->audio.interpolation = match->second;
--      }
--
--      this->audio.volume = toml::find_or<int>(audio, "volume", 100);
--      this->audio.mp2k_hle_enable = toml::find_or<toml::boolean>(audio, "mp2k_hle_enable", false);
--      this->audio.mp2k_hle_cubic = toml::find_or<toml::boolean>(audio, "mp2k_hle_cubic", true);
--      this->audio.mp2k_hle_force_reverb = toml::find_or<toml::boolean>(audio, "mp2k_hle_force_reverb", true);
-+    auto audio = data.at("audio");
-+    auto resampler = toml::find_or<std::string>(audio, "resampler", "cosine");
-+
-+    const std::map<std::string, Config::Audio::Interpolation> resamplers{
-+      { "cosine",  Config::Audio::Interpolation::Cosine   },
-+      { "cubic",   Config::Audio::Interpolation::Cubic    },
-+      { "sinc64",  Config::Audio::Interpolation::Sinc_64  },
-+      { "sinc128", Config::Audio::Interpolation::Sinc_128 },
-+      { "sinc256", Config::Audio::Interpolation::Sinc_256 }
-+    };
-+
-+    auto match = resamplers.find(resampler);
-+
-+    if(match == resamplers.end()) {
-+      Log<Warn>("Config: unknown resampling algorithm: {} (defaulting to cosine).", resampler);
-+      this->audio.interpolation = Config::Audio::Interpolation::Cosine;
-+    } else {
-+      this->audio.interpolation = match->second;
-     }
-+
-+    this->audio.volume = toml::find_or<int>(audio, "volume", 100);
-+    this->audio.mp2k_hle_enable = toml::find_or<bool>(audio, "mp2k_hle_enable", false);
-+    this->audio.mp2k_hle_cubic = toml::find_or<bool>(audio, "mp2k_hle_cubic", true);
-+    this->audio.mp2k_hle_force_reverb = toml::find_or<bool>(audio, "mp2k_hle_force_reverb", true);
-   }
- 
-   LoadCustomData(data);
- }
- 
- void PlatformConfig::Save(std::string const& path) {
--  toml::basic_value<toml::preserve_comments> data;
-+  toml::value data;
- 
-   if(std::filesystem::exists(path)) {
-     try {
--      data = toml::parse<toml::preserve_comments>(path);
-+      data = toml::parse(path);
-     } catch (std::exception& ex) {
-       Log<Error>("Config: error while parsing TOML configuration: {0}", ex.what());
-       return;
-diff --git a/src/platform/qt/src/config.cpp b/src/platform/qt/src/config.cpp
-index 7fbc712b..7a658fca 100644
---- a/src/platform/qt/src/config.cpp
-+++ b/src/platform/qt/src/config.cpp
-@@ -9,66 +9,52 @@
- 
- void QtConfig::LoadCustomData(toml::value const& data) {
-   if(data.contains("input")) {
--    auto input_result = toml::expect<toml::value>(data.at("input"));
--
--    if(input_result.is_ok()) {
--      using Map = Input::Map;
--
--      auto input_ = input_result.unwrap();
--
--      input.controller_guid = toml::find_or<std::string>(input_, "controller_guid", "");
--      input.hold_fast_forward = toml::find_or<bool>(input_, "hold_fast_forward", true);
--
--      const auto get_map = [&](toml::value const& value, std::string key) {
--        return Map::FromArray(toml::find_or<std::array<int, 5>>(value, key, {0, -1, -1, -1, 0}));
--      };
--
--      input.fast_forward = get_map(input_, "fast_forward");
--    
--      if(input_.contains("gba")) {
--        auto gba_result = toml::expect<toml::value>(input_.at("gba"));
--
--        if(gba_result.is_ok()) {
--          auto gba = gba_result.unwrap();
--
--          input.gba[0] = get_map(gba, "a");
--          input.gba[1] = get_map(gba, "b");
--          input.gba[2] = get_map(gba, "select");
--          input.gba[3] = get_map(gba, "start");
--          input.gba[4] = get_map(gba, "right");
--          input.gba[5] = get_map(gba, "left");
--          input.gba[6] = get_map(gba, "up");
--          input.gba[7] = get_map(gba, "down");
--          input.gba[8] = get_map(gba, "r");
--          input.gba[9] = get_map(gba, "l");
--        }
--      }
-+    using Map = Input::Map;
-+
-+    auto input_ = data.at("input");
-+
-+    input.controller_guid = toml::find_or<std::string>(input_, "controller_guid", "");
-+    input.hold_fast_forward = toml::find_or<bool>(input_, "hold_fast_forward", true);
-+
-+    const auto get_map = [&](toml::value const& value, std::string key) {
-+      return Map::FromArray(toml::find_or<std::array<int, 5>>(value, key, {0, -1, -1, -1, 0}));
-+    };
-+
-+    input.fast_forward = get_map(input_, "fast_forward");
-+  
-+    if(input_.contains("gba")) {
-+      auto gba = input_.at("gba");
-+
-+      input.gba[0] = get_map(gba, "a");
-+      input.gba[1] = get_map(gba, "b");
-+      input.gba[2] = get_map(gba, "select");
-+      input.gba[3] = get_map(gba, "start");
-+      input.gba[4] = get_map(gba, "right");
-+      input.gba[5] = get_map(gba, "left");
-+      input.gba[6] = get_map(gba, "up");
-+      input.gba[7] = get_map(gba, "down");
-+      input.gba[8] = get_map(gba, "r");
-+      input.gba[9] = get_map(gba, "l");
-     }
-   }
- 
-   if(data.contains("window")) {
--    auto window_result = toml::expect<toml::value>(data.at("window"));
--
--    if(window_result.is_ok()) {
--      auto window_ = window_result.unwrap();
--
--      window.scale = toml::find_or<int>(window_, "scale", 2);
--      window.maximum_scale = toml::find_or<int>(window_, "maximum_scale", 0);
--      window.fullscreen = toml::find_or<bool>(window_, "fullscreen", false);
--      window.fullscreen_show_menu = toml::find_or<bool>(window_, "fullscreen_show_menu", false);
--      window.lock_aspect_ratio = toml::find_or<bool>(window_, "lock_aspect_ratio", true);
--      window.use_integer_scaling = toml::find_or<bool>(window_, "use_integer_scaling", false);
--      window.show_fps = toml::find_or<bool>(window_, "show_fps", false);
--      window.pause_emulator_when_inactive = toml::find_or<bool>(window_, "pause_emulator_when_inactive", true);
--    }
-+    auto window_ = data.at("window");
-+
-+    window.scale = toml::find_or<int>(window_, "scale", 2);
-+    window.maximum_scale = toml::find_or<int>(window_, "maximum_scale", 0);
-+    window.fullscreen = toml::find_or<bool>(window_, "fullscreen", false);
-+    window.fullscreen_show_menu = toml::find_or<bool>(window_, "fullscreen_show_menu", false);
-+    window.lock_aspect_ratio = toml::find_or<bool>(window_, "lock_aspect_ratio", true);
-+    window.use_integer_scaling = toml::find_or<bool>(window_, "use_integer_scaling", false);
-+    window.show_fps = toml::find_or<bool>(window_, "show_fps", false);
-+    window.pause_emulator_when_inactive = toml::find_or<bool>(window_, "pause_emulator_when_inactive", true);
-   }
- 
-   recent_files = toml::find_or<std::vector<std::string>>(data, "recent_files", {});
- }
- 
--void QtConfig::SaveCustomData(
--  toml::basic_value<toml::preserve_comments>& data
--) {
-+void QtConfig::SaveCustomData(toml::value& data) {
-   data["input"]["controller_guid"] = input.controller_guid;
-   data["input"]["fast_forward"] = input.fast_forward.Array();
-   data["input"]["hold_fast_forward"] = input.hold_fast_forward;
-diff --git a/src/platform/qt/src/config.hpp b/src/platform/qt/src/config.hpp
-index 91af8291..b305bf79 100644
---- a/src/platform/qt/src/config.hpp
-+++ b/src/platform/qt/src/config.hpp
-@@ -117,9 +117,7 @@ struct QtConfig final : nba::PlatformConfig {
- protected:
-   void LoadCustomData(toml::value const& data) override;
- 
--  void SaveCustomData(
--    toml::basic_value<toml::preserve_comments>& data
--  ) override;
-+  void SaveCustomData(toml::value& data) override;
- 
- private:
-   auto GetConfigPath() const -> std::string {
diff --git a/pkgs/by-name/na/nanoboyadvance/package.nix b/pkgs/by-name/na/nanoboyadvance/package.nix
index 23d62ac6f6a6..e6e7548d49f8 100644
--- a/pkgs/by-name/na/nanoboyadvance/package.nix
+++ b/pkgs/by-name/na/nanoboyadvance/package.nix
@@ -1,60 +1,56 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
-  fetchpatch,
+  fetchFromCodeberg,
   cmake,
   python3Packages,
-  libsForQt5,
   SDL2,
-  fmt,
-  toml11,
-  libunarr,
+  qt6,
+  zlib,
+  bzip2,
+  xz,
+  gtk3,
 }:
 
-let
-  gladSrc = fetchFromGitHub {
-    owner = "Dav1dde";
-    repo = "glad";
-    rev = "v2.0.5";
-    hash = "sha256-Ba7nbd0DxDHfNXXu9DLfnxTQTiJIQYSES9CP5Bfq4K0=";
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "nanoboyadvance";
-  version = "1.8.2";
+  version = "1.8.3";
 
-  src = fetchFromGitHub {
+  src = fetchFromCodeberg {
     owner = "nba-emu";
     repo = "NanoBoyAdvance";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IH2X0B3HwEG0/wvKacLVPBQad14W0HBy5VFHjk8vgJk=";
+    hash = "sha256-G/STYu8vOTqoGAGfpPelYV/m0Cth4xMMD1QJ6TbqAF4=";
   };
 
-  patches = [
-    # <https://github.com/nba-emu/NanoBoyAdvance/pull/410>
-    ./fix-toml11-4.0.patch
-  ];
+  postPatch = ''
+    # don’t install unarr library to the package output
+    substituteInPlace thirdparty/CMakeLists.txt \
+      --replace-fail 'add_subdirectory(unarr-1.1.1-patch)' 'add_subdirectory(unarr-1.1.1-patch EXCLUDE_FROM_ALL)'
+  '';
 
   nativeBuildInputs = [
     cmake
     python3Packages.jinja2
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
-    libsForQt5.qtbase
     SDL2
-    fmt
-    toml11
-    libunarr
+    qt6.qtsvg
+    qt6.qtbase
+    zlib
+    bzip2
+    xz
+    gtk3
   ];
 
+  preConfigure = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    export AR="gcc-ar"
+    export RANLIB="gcc-ranlib"
+  '';
+
   cmakeFlags = [
-    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GLAD" "${gladSrc}")
-    (lib.cmakeBool "USE_SYSTEM_FMT" true)
-    (lib.cmakeBool "USE_SYSTEM_TOML11" true)
-    (lib.cmakeBool "USE_SYSTEM_UNARR" true)
     (lib.cmakeBool "PORTABLE_MODE" false)
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -68,12 +64,23 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s "$out/Applications/NanoBoyAdvance.app/Contents/MacOS/NanoBoyAdvance" "$out/bin/NanoBoyAdvance"
   '';
 
+  preFixup = ''
+    qtWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}"
+      --set QT_QPA_PLATFORM xcb
+      --set SDL_VIDEODRIVER x11
+    )
+  '';
+
   meta = {
     description = "Cycle-accurate Nintendo Game Boy Advance emulator";
-    homepage = "https://github.com/nba-emu/NanoBoyAdvance";
+    homepage = "https://nanoboyadvance.eu/";
     license = lib.licenses.gpl3Plus;
     mainProgram = "NanoBoyAdvance";
-    maintainers = with lib.maintainers; [ tomasajt ];
+    maintainers = with lib.maintainers; [
+      tomasajt
+      lukas-sgx
+    ];
     platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/by-name/ni/nim-atlas/package.nix b/pkgs/by-name/ni/nim-atlas/package.nix
index bc35b46ba46d..45fc0714523a 100644
--- a/pkgs/by-name/ni/nim-atlas/package.nix
+++ b/pkgs/by-name/ni/nim-atlas/package.nix
@@ -5,20 +5,33 @@
   openssl,
 }:
 
+let
+  # Atlas needs the dep in a certain place, easier to download and and place in deps/ folder
+  sat = fetchFromGitHub {
+    owner = "nim-lang";
+    repo = "sat";
+    # The atlas nimble file (https://github.com/nim-lang/atlas/blob/master/atlas.nimble) doesn't
+    # provide a version and upstream sat package has no version tags. This is the latest commit
+    # as of 2026-08-14
+    rev = "9d52513b3c68bfb929dbd687d4fb2836cfee6936";
+    hash = "sha256-y9kFjYFrmVejIE8fSh4AehaNnCO/UISssrnGwwcnJLk=";
+  };
+in
 buildNimPackage (
-  final: prev: {
+  final: prev: rec {
     pname = "atlas";
-    version = "unstable-2023-09-22";
+    version = "0.14.12";
     src = fetchFromGitHub {
       owner = "nim-lang";
       repo = "atlas";
-      rev = "ab22f997c22a644924c1a9b920f8ce207da9b77f";
-      hash = "sha256-TsZ8TriVuKEY9/mV6KR89eFOgYrgTqXmyv/vKu362GU=";
+      rev = "${version}";
+      hash = "sha256-7LPjxqsWlZ0tjsXfMF0q93O9VLDgT+7J20QrJ+1ihDg=";
     };
     buildInputs = [ openssl ];
-    prePatch = ''
-      rm config.nims
-    ''; # never trust a .nims file
+    preConfigure = ''
+      mkdir deps
+      cp -r ${sat} deps/sat
+    '';
     doCheck = false; # tests will clone repos
     meta = final.src.meta // {
       description = "Nim package cloner";
diff --git a/pkgs/by-name/ni/nixl/package.nix b/pkgs/by-name/ni/nixl/package.nix
index 74e914163b61..c99b83dafabe 100644
--- a/pkgs/by-name/ni/nixl/package.nix
+++ b/pkgs/by-name/ni/nixl/package.nix
@@ -36,7 +36,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "nixl";
-  version = "1.3.2";
+  version = "1.4.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,7 +45,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ai-dynamo";
     repo = "nixl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aSZ9kiEAQlVFW3+XJih5Ujk1mxOvaepX19u3Xfz4iSg=";
+    hash = "sha256-fOtPutRgKscP396J0Rh6V9PIQ+LsE7h71vtduviHvWI=";
   };
 
   postPatch =
@@ -64,17 +64,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
       substituteInPlace src/plugins/ucx/ucx_backend.cpp \
         --replace-fail 'io_->post(' 'asio::post(*io_, '
     ''
-    # Fix UB: explicit destructor call on lock_guard (GCC 15 -Werror=maybe-uninitialized)
-    # Replace lock_guard + manual destructor with unique_lock + unlock()
-    + ''
-      substituteInPlace src/plugins/libfabric/libfabric_backend.cpp \
-        --replace-fail \
-          'std::lock_guard<std::mutex> lock(connection_state_mutex_);' \
-          'std::unique_lock<std::mutex> lock(connection_state_mutex_);' \
-        --replace-fail \
-          'lock.~lock_guard();' \
-          'lock.unlock();'
-    ''
     # Fix GDS plugin: Nix uses lib/ not lib64/
     + ''
       substituteInPlace src/plugins/cuda_gds/meson.build src/plugins/gds_mt/meson.build \
diff --git a/pkgs/by-name/np/npm-check-updates/package.nix b/pkgs/by-name/np/npm-check-updates/package.nix
index 6365ae5be6e2..67ed69ed1e4b 100644
--- a/pkgs/by-name/np/npm-check-updates/package.nix
+++ b/pkgs/by-name/np/npm-check-updates/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "npm-check-updates";
-  version = "19.3.2";
+  version = "23.0.2";
 
   src = fetchFromGitHub {
     owner = "raineorshine";
     repo = "npm-check-updates";
     tag = "v${version}";
-    hash = "sha256-rQRBPfP7w9a2qCjOxNtl9mmSJiYZYbJyyOh3FEfckxk=";
+    hash = "sha256-XCUtMEYEkBvn5Y32uLrbvCdpSTXOEdq2Pf9tPo6JWLI=";
   };
 
-  npmDepsHash = "sha256-wcpaJv8ji5Yr8Whp+fk+CYp4w3WcnYo20q/Injf/7Z8=";
+  npmDepsHash = "sha256-dsgvdgJzpxKhMjfIVO7Tnu4xxvTJYyk8Wjth7++ZHdo=";
 
   postPatch = ''
     sed -i '/"prepare"/d' package.json
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 00a3b513cf5c..d0eb5e7f76ab 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -111,12 +111,12 @@ let
   # vendored in-tree. Pre-stage the pin (tracks upstream's
   # `LLAMA_CPP_VERSION` file) so the FetchContent step uses our copy
   # instead of trying to clone over the network in the sandbox.
-  llamaCppVersion = "b10242";
+  llamaCppVersion = "b10380";
   llamaCppSrc = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = llamaCppVersion;
-    hash = "sha256-mBqO6h9eiSAXqiHy1H3aK2ACbz1aYagmjAN7IpXNTcw=";
+    hash = "sha256-HT0QuIFJz5cgH2qinxhtyLEL/RrUpziZuntj/EDQtzI=";
   };
 
   wrapperOptions = [
@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.32.7";
+  version = "0.32.11";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dCUDeAdzJETCMumbSMSkmc6n3uQR36jvjBnn+gaVr/U=";
+    hash = "sha256-TD/EH1/0LholwtNxcM9IyQP8Zgh2+04k+lKZkCj5F4M=";
   };
 
   vendorHash = "sha256-HMwoaFBMbpoy8f0I+O+i7kIa9BslLu3FcVWeaIOkpvs=";
@@ -225,6 +225,10 @@ goBuild (finalAttrs: {
     # OLLAMA_LLAMA_CPP_SKIP_COMPAT_PATCH=ON to the child build) — the
     # caller has to. The apply-patch.cmake script is idempotent so this
     # is safe to re-run.
+    if [[ ${llamaCppVersion} != $(cat LLAMA_CPP_VERSION) ]]; then
+      echo "llama-cpp version mismatch, expected ${llamaCppVersion}, but found $(cat LLAMA_CPP_VERSION)"
+      exit 1
+    fi
     cp -r ${llamaCppSrc} $TMPDIR/llama-cpp-src
     chmod -R +w $TMPDIR/llama-cpp-src
     ( cd $TMPDIR/llama-cpp-src && \
@@ -377,6 +381,7 @@ goBuild (finalAttrs: {
       service-rocm = nixosTests.ollama-rocm;
       service-vulkan = nixosTests.ollama-vulkan;
     };
+    updateScript = ./update.sh;
   }
   // lib.optionalAttrs (!enableRocm && !enableCuda && !enableVulkan) { updateScript = ./update.sh; };
 
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 6d60fad24ad3..05124b06d79a 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -6,7 +6,6 @@
   ncurses,
   gettext,
   pigeon,
-  go-mockery,
   protoc-go-inject-tag,
   libxcrypt,
   vips,
@@ -20,7 +19,8 @@ let
   bingoBinsMakefile = builtins.concatStringsSep "\n" (
     lib.mapAttrsToList (n: v: "${n} := ${v}\n\\$(${n}):") {
       GO_XGETTEXT = "xgettext";
-      MOCKERY = "mockery";
+      # no need to generate mocks, as they are in-repo already
+      MOCKERY = "true";
       PIGEON = "pigeon";
       PROTOC_GO_INJECT_TAG = "protoc-go-inject-tag";
     }
@@ -76,7 +76,6 @@ buildGoModule (finalAttrs: {
     ncurses
     gettext
     pigeon
-    go-mockery
     protoc-go-inject-tag
     pkg-config
   ];
diff --git a/pkgs/by-name/op/openlogi/package.nix b/pkgs/by-name/op/openlogi/package.nix
index 7bb48e4a0bb4..1d3d98309e70 100644
--- a/pkgs/by-name/op/openlogi/package.nix
+++ b/pkgs/by-name/op/openlogi/package.nix
@@ -4,15 +4,37 @@
   rustPlatform,
   fetchFromGitHub,
   cargo-bundle,
-  libicns,
-  resvg,
+  fontconfig,
+  freetype,
+  libGL,
+  libxcb,
+  libxkbcommon,
+  makeBinaryWrapper,
   nix-update-script,
+  openssl,
+  pkg-config,
   versionCheckHook,
+  vulkan-loader,
+  wayland,
 }:
 
+let
+  # crates/openlogi-gui/build.rs embeds gpui-component's themes, which live at
+  # that repo's root rather than inside the crate, so cargo vendoring drops them.
+  # Fetch the rev Cargo.lock pins and point build.rs's OPENLOGI_THEMES_DIR
+  # escape hatch at it. This pin follows Cargo.lock rather than openlogi's
+  # version, and nix-update does not maintain it.
+  gpuiComponentThemes = fetchFromGitHub {
+    owner = "longbridge";
+    repo = "gpui-component";
+    rev = "031555662e99a1b5a549990b47f246d475b8288a";
+    hash = "sha256-yOXdgxQgfvGN2/+OdDnl1pYti0DoGFvS3Tyqvj3Bkng=";
+  };
+in
+
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "openlogi";
-  version = "0.3.4";
+  version = "0.6.25";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -21,12 +43,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "AprilNEA";
     repo = "OpenLogi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-04o/Ry65CdNtycgJfqhXwTD5InUwfkr88xQ+I/5Pe4o=";
+    hash = "sha256-JziSstP3TdPVuqpZHtStT5fEy431tdFW7nB6bZvMyVA=";
   };
 
-  cargoHash = "sha256-nKQRcRsEq5JJpn0DZIssS/wAwVsj4kq9J2WmQXJ3smY=";
+  cargoHash = "sha256-MVmPZ2IDss6+HmHKGdg4Q3g4W/fJgaQRGKoeUKDiEFU=";
 
   postPatch = ''
+    grep -q 'gpui-component?rev=${gpuiComponentThemes.rev}' Cargo.lock || {
+      echo "ERROR: gpui-component revision needs update (must match Cargo.lock)"
+      exit 1
+    }
+
     # gpui-component generates its IconName enum from a sibling assets directory,
     # but cargo vendoring stores gpui-component-assets as a separate package.
     for component in "$cargoDepsCopy"/source-git-*/gpui-component-[0-9]*; do
@@ -42,15 +69,33 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   nativeBuildInputs = [
-    cargo-bundle
-    libicns
-    resvg
     rustPlatform.bindgenHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    cargo-bundle
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    makeBinaryWrapper
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    fontconfig
+    freetype
+    libGL
+    libxcb
+    libxkbcommon
+    openssl
+    vulkan-loader
+    wayland
   ];
 
   cargoBuildFlags = [
     "--package=openlogi"
     "--package=openlogi-gui"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "--package=openlogi-agent"
   ];
 
   cargoTestFlags = [ "--workspace" ];
@@ -59,29 +104,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "gpui_platform/runtime_shaders"
   ];
 
-  # Upstream intentionally fetches optional device images on first launch
-  # unless OPENLOGI_BUNDLE_ASSETS is set while bundling.
-  preBuild = ''
-    iconset=$(mktemp -d)
-    for size in 16 32 128 256 512; do
-      resvg \
-        --width "$size" \
-        --height "$size" \
-        design/icon/openlogi.svg \
-        "$iconset/icon_''${size}x''${size}.png"
-    done
-
-    mkdir -p crates/openlogi-gui/icon
-    png2icns crates/openlogi-gui/icon/AppIcon.icns "$iconset"/*.png
-
-    rm -rf crates/openlogi-gui/assets
-    mkdir -p crates/openlogi-gui/assets
-  '';
+  env.OPENLOGI_THEMES_DIR = "${gpuiComponentThemes}/themes";
 
   installPhase = ''
     runHook preInstall
 
     release_target="target/${stdenv.hostPlatform.rust.cargoShortTarget}/release"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
     mv "$release_target/openlogi-gui" target/release/openlogi-gui
 
     pushd crates/openlogi-gui
@@ -92,10 +122,49 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mkdir -p "$out/Applications" "$out/bin"
     mv "$app_path" "$out/Applications/"
     install -Dm755 "$release_target/openlogi" "$out/bin/openlogi"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    install -Dm755 "$release_target/openlogi" "$out/bin/openlogi"
+    install -Dm755 "$release_target/openlogi-gui" "$out/bin/openlogi-gui"
+    install -Dm755 "$release_target/openlogi-agent" "$out/bin/openlogi-agent"
 
+    # Upstream's own packaging inputs, installed verbatim rather than
+    # re-authored here (they are what the .deb/.rpm ship).
+    install -Dm644 packaging/linux/udev/70-openlogi.rules \
+      "$out/lib/udev/rules.d/70-openlogi.rules"
+    install -Dm644 packaging/linux/desktop/openlogi.desktop \
+      "$out/share/applications/openlogi.desktop"
+    install -Dm644 packaging/linux/systemd/openlogi-agent.service \
+      "$out/share/systemd/user/openlogi-agent.service"
+
+    # The unit hardcodes /usr/bin (upstream's install.sh rewrites it for a
+    # custom PREFIX); point it at the store path instead.
+    substituteInPlace "$out/share/systemd/user/openlogi-agent.service" \
+      --replace-fail "ExecStart=/usr/bin/openlogi-agent" \
+                     "ExecStart=$out/bin/openlogi-agent"
+
+    install -Dm644 design/icon/openlogi.png \
+      "$out/share/icons/hicolor/1024x1024/apps/openlogi.png"
+  ''
+  + ''
     runHook postInstall
   '';
 
+  # GPUI (Blade) dlopen()s its Vulkan/Wayland/GL backends at runtime, so they
+  # are invisible to the linker and must be on the wrapper's search path.
+  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    wrapProgram "$out/bin/openlogi-gui" \
+      --suffix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          libGL
+          libxcb
+          libxkbcommon
+          vulkan-loader
+          wayland
+        ]
+      }"
+  '';
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
@@ -112,6 +181,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ];
     mainProgram = "openlogi";
     maintainers = with lib.maintainers; [ imcvampire ];
-    platforms = lib.platforms.darwin;
+    platforms = lib.platforms.darwin ++ [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
   };
 })
diff --git a/pkgs/applications/science/misc/openmvs/default.nix b/pkgs/by-name/op/openmvs/package.nix
similarity index 84%
rename from pkgs/applications/science/misc/openmvs/default.nix
rename to pkgs/by-name/op/openmvs/package.nix
index ff6d7bf9faac..3a089ae20a08 100644
--- a/pkgs/applications/science/misc/openmvs/default.nix
+++ b/pkgs/by-name/op/openmvs/package.nix
@@ -14,8 +14,9 @@
   libtiff,
   mpfr,
   nanoflann,
+  nix-update-script,
+  llvmPackages,
   opencv,
-  openmp,
   pkg-config,
   python3Packages,
   stdenv,
@@ -28,30 +29,32 @@ let
     buildInputs = old.buildInputs ++ [ zstd ];
   });
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "2.4.0";
   pname = "openmvs";
 
   src = fetchFromGitHub {
     owner = "cdcseacave";
     repo = "openmvs";
-    rev = "v${version}";
-    hash = "sha256-0tL2tqHYBQMGL9k+NqTUxieWuDP3YB6X9DcXYnlGWWg=";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
+    hash = "sha256-0tL2tqHYBQMGL9k+NqTUxieWuDP3YB6X9DcXYnlGWWg=";
   };
 
-  # SSE is enabled by default
-  cmakeFlags = [
-    (lib.cmakeFeature "Python3_EXECUTABLE" (lib.getExe python3Packages.python))
-  ]
-  ++ lib.optional (!stdenv.hostPlatform.isx86_64) "-DOpenMVS_USE_SSE=OFF";
-
   postPatch = ''
     substituteInPlace CMakeLists.txt --replace-fail \
       'FIND_PACKAGE(Boost REQUIRED COMPONENTS iostreams program_options system serialization OPTIONAL_COMPONENTS ''${Boost_EXTRA_COMPONENTS})' \
       'FIND_PACKAGE(Boost REQUIRED COMPONENTS iostreams program_options serialization OPTIONAL_COMPONENTS ''${Boost_EXTRA_COMPONENTS})'
   '';
 
+  cmakeFlags = [
+    (lib.cmakeFeature "Python3_EXECUTABLE" (lib.getExe python3Packages.python))
+  ]
+  # SSE is enabled by default
+  ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [
+    (lib.cmakeBool "OpenMVS_USE_SSE" false)
+  ];
+
   buildInputs = [
     boostWithZstd
     ceres-solver
@@ -66,7 +69,7 @@ stdenv.mkDerivation rec {
     mpfr
     nanoflann
     opencv
-    openmp
+    llvmPackages.openmp
     vcg
   ];
 
@@ -94,9 +97,12 @@ stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Open Multi-View Stereo reconstruction library";
     homepage = "https://github.com/cdcseacave/openMVS";
+    changelog = "https://github.com/cdcseacave/openMVS/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
@@ -104,4 +110,4 @@ stdenv.mkDerivation rec {
       miniharinn
     ];
   };
-}
+})
diff --git a/pkgs/by-name/op/openshot-qt/package.nix b/pkgs/by-name/op/openshot-qt/package.nix
index ae7e4b63b647..1344bf74036e 100644
--- a/pkgs/by-name/op/openshot-qt/package.nix
+++ b/pkgs/by-name/op/openshot-qt/package.nix
@@ -10,12 +10,12 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "openshot-qt";
-  version = "3.5.1-unstable-2026-04-22";
+  version = "3.5.1-unstable-2026-07-23";
   src = fetchFromGitHub {
     owner = "OpenShot";
     repo = "openshot-qt";
-    rev = "930ff919762570eaf35a879574da8f8da9f196be";
-    hash = "sha256-o0BPEzkEAyoZkPkiR9G8i2nANgDFI4wjD5b9hGOqB0c=";
+    rev = "9cd2b3f3ee9024c3496487a2de30a402515ed659";
+    hash = "sha256-SoEt3tuydz+JUzhvUa7Pejxd1LYNia17YvGmVlnh48I=";
   };
   format = "setuptools";
 
diff --git a/pkgs/by-name/pa/parla/package.nix b/pkgs/by-name/pa/parla/package.nix
index 094170800b93..c2ebabb04cbc 100644
--- a/pkgs/by-name/pa/parla/package.nix
+++ b/pkgs/by-name/pa/parla/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "parla";
-  version = "0.7.6";
+  version = "0.7.8";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "trufae";
     repo = "parla";
     tag = finalAttrs.version;
-    hash = "sha256-1gruDZCgGr8N8mWpYWs2p8HrXRX52DJ/rowvg/1/2Gk=";
+    hash = "sha256-hFAt2P6U9GtV80HeUBMVATv7T5UsCEGTOv9s1khChus=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index da0e7edc4749..4f2dab61b765 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -69,6 +69,12 @@ buildNpmPackage (finalAttrs: {
     runHook postBuild
   '';
 
+  dontNpmPrune = true;
+
+  preInstall = ''
+    npm prune --omit=dev --no-save
+  '';
+
   # npm workspace symlinks in the output point into packages/ which
   # doesn't exist there. Replace runtime deps with built content and
   # delete the rest.
diff --git a/pkgs/by-name/pi/picolibc/package.nix b/pkgs/by-name/pi/picolibc/package.nix
index edaa901b7786..0bffb8ddd2e9 100644
--- a/pkgs/by-name/pi/picolibc/package.nix
+++ b/pkgs/by-name/pi/picolibc/package.nix
@@ -78,7 +78,7 @@ stdenvNoLibc.mkDerivation (finalAttrs: {
     # rejects -ftls-model; fall back to non-thread-local errno.
     (lib.mesonBool "thread-local-storage" false)
   ]
-  ++ lib.optionals finalAttrs.doCheck [
+  ++ lib.optionals finalAttrs.finalPackage.doCheck [
     (lib.mesonBool "tests" true)
     (lib.mesonBool "native-tests" canExecute)
     (lib.mesonBool "native-math-tests" canExecute)
diff --git a/pkgs/by-name/pi/pinentry-egui/package.nix b/pkgs/by-name/pi/pinentry-egui/package.nix
new file mode 100644
index 000000000000..916ff8448c73
--- /dev/null
+++ b/pkgs/by-name/pi/pinentry-egui/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  expat,
+  fontconfig,
+  freetype,
+  libGL,
+  libxkbcommon,
+  wayland,
+  libx11,
+  libxcursor,
+  libxi,
+  libxrandr,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "pinentry-egui";
+  version = "0-unstable-2026-07-10";
+
+  src = fetchFromGitHub {
+    owner = "dsociative";
+    repo = "pinentry-egui";
+    rev = "c81bf237048f5b296488751467bb2975982d05af";
+    hash = "sha256-xUhPaXiysXbOctM3FO6WgafVPUOQ+9lP2d4U9PBxCvk=";
+  };
+
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-81W3NOQ6EOV3bMt7SYtg3AjAgmdHZ81gEtQkaOYVFIk=";
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    expat
+    fontconfig
+    freetype
+    libGL
+    libxkbcommon
+    wayland
+    libx11
+    libxcursor
+    libxi
+    libxrandr
+  ];
+
+  postFixup = ''
+    patchelf $out/bin/pinentry-egui \
+      --add-rpath ${
+        lib.makeLibraryPath [
+          libGL
+          libxkbcommon
+          wayland
+        ]
+      }
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Modern, native Wayland pinentry implementation for GPG using egui";
+    homepage = "https://github.com/dsociative/pinentry-egui";
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
+    maintainers = with lib.maintainers; [ colemickens ];
+    mainProgram = "pinentry-egui";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pr/prime-server/package.nix b/pkgs/by-name/pr/prime-server/package.nix
index fecc0f89387d..7224dae07643 100644
--- a/pkgs/by-name/pr/prime-server/package.nix
+++ b/pkgs/by-name/pr/prime-server/package.nix
@@ -8,17 +8,18 @@
   zeromq,
   czmq,
   libsodium,
+  runCommand,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prime-server";
-  version = "0.7.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "kevinkreiser";
     repo = "prime_server";
     tag = finalAttrs.version;
-    sha256 = "0izmmvi3pvidhlrgfpg4ccblrw6fil3ddxg5cfxsz4qbh399x83w";
+    hash = "sha256-B6vy/y4PDEpnxXuMpAisBq5avNpW84q/+9zbuNBOnko=";
     fetchSubmodules = true;
   };
 
@@ -26,30 +27,39 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
   ];
-  buildInputs = [
+  buildInputs = [ libsodium ];
+  propagatedBuildInputs = [
     curl
-    zeromq
     czmq
-    libsodium
+    zeromq
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    [
-      # https://github.com/kevinkreiser/prime_server/issues/95
-      "-Wno-error=unused-variable"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # logging.hpp calls sprintf, which the macOS SDK marks deprecated. The
-      # build uses -Werror, so the deprecation stops it.
-      "-Wno-error=deprecated-declarations"
-    ]
-  );
+  passthru.tests.simple =
+    runCommand "prime-server-test"
+      {
+        nativeBuildInputs = [
+          finalAttrs.finalPackage
+          curl
+        ];
+      }
+      ''
+        prime_serverd tcp://127.0.0.1:8001 1 0 &
+        pid=$!
+        trap 'kill $pid' EXIT
+
+        test "$(curl -fsS --retry 30 --retry-delay 1 --retry-connrefused 'http://127.0.0.1:8001/is_prime?possible_prime=17')" = 17
+
+        touch "$out"
+      '';
 
   meta = {
     description = "Non-blocking (web)server API for distributed computing and SOA based on zeromq";
     homepage = "https://github.com/kevinkreiser/prime_server";
     license = lib.licenses.bsd2;
-    maintainers = [ lib.maintainers.Thra11 ];
+    maintainers = with lib.maintainers; [
+      Thra11
+      karlbeecken
+    ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/qx/qxmpp/package.nix b/pkgs/by-name/qx/qxmpp/package.nix
index afc6aba94b68..dd04353ae4b0 100644
--- a/pkgs/by-name/qx/qxmpp/package.nix
+++ b/pkgs/by-name/qx/qxmpp/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_DOCUMENTATION" false)
     (lib.cmakeBool "BUILD_EXAMPLES" false)
-    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "BUILD_OMEMO" withOmemo)
     (lib.cmakeBool "WITH_ENCRYPTION" withEncryption)
     (lib.cmakeBool "WITH_GSTREAMER" withGstreamer)
diff --git a/pkgs/by-name/ra/radicle-desktop/package.nix b/pkgs/by-name/ra/radicle-desktop/package.nix
index 25e83ab44e24..b10fed53e593 100644
--- a/pkgs/by-name/ra/radicle-desktop/package.nix
+++ b/pkgs/by-name/ra/radicle-desktop/package.nix
@@ -26,13 +26,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-desktop";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "z4D5UCArafTzTQpDZNQRuqswh3ury";
     tag = "releases/${finalAttrs.version}";
-    hash = "sha256-yT51MCHt00JEUbuC6rcXN3L4Vul3aBa8YCgpGVzM5rQ=";
+    hash = "sha256-L5QfFvswU/iPgObhh09/SAlMRy5w+Qs1kXDGpY31wjA=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head
@@ -53,10 +53,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-HsPz3S2TL7TJzDU7c7IWgT7kO+FkloMsAWc8g5ZKofw=";
+    hash = "sha256-4gRc/nNrOEi7PU+5bSsR22z3f55cINebSrlFQ1NGTfk=";
   };
 
-  cargoHash = "sha256-BTSmfMrxNwAdoPuYn4hbx9C9myE1wJh+1FXPG78IgeU=";
+  cargoHash = "sha256-DZM1YX3lzCvKGtrSxxeJkinR91HFWe5SpdqQ+oP1Hgc=";
 
   twemojiAssets = fetchFromGitHub {
     owner = "twitter";
diff --git a/pkgs/by-name/ra/ratspeak/package.nix b/pkgs/by-name/ra/ratspeak/package.nix
new file mode 100644
index 000000000000..c005a239ab9a
--- /dev/null
+++ b/pkgs/by-name/ra/ratspeak/package.nix
@@ -0,0 +1,118 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  cargo-tauri,
+  alsa-lib,
+  dbus,
+  glib-networking,
+  libayatana-appindicator,
+  libsoup_3,
+  openssl,
+  pcsclite,
+  perl,
+  pkg-config,
+  udev,
+  webkitgtk_4_1,
+  wrapGAppsHook4,
+}:
+
+let
+  # Ratspeak resolves its protocol crates by relative path from sibling
+  # checkouts (../rsReticulum and friends). Upstream does not tag the
+  # siblings together with every app release, so each one is pinned to the
+  # revision current at the v1.0.25 release date.
+  rsReticulum = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "rsReticulum";
+    rev = "17e6107aa8fb9a5b0c2cac2f4fe4b68655593bd8";
+    hash = "sha256-0HjeGZ57eiz9z9akc+ESdZLAN+/uR9LyNaMLgYiTPO8=";
+  };
+  rsLXMF = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "rsLXMF";
+    rev = "393478019b3a076abc7af5f0d2c7b980b3329550";
+    hash = "sha256-uCoU4HtdRy6sB8vi5BtifKFAy0a7FPuHuuRb1EJTJ2c=";
+  };
+  rsLXST = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "rsLXST";
+    rev = "e3f80815bcf1c1d6af1c07135dfe05b6163d596a";
+    hash = "sha256-921xMNdneOTurUoUR5ImPEB8ztfEQLl9jCZY+s9Cjuo=";
+  };
+  lrgp-rs = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "lrgp-rs";
+    rev = "0b55361ebf91c1caa09d5ed8ab88ac0a6d955de6";
+    hash = "sha256-MZGWGCWLc+suHCD9NFV6m8A4EP4pLfogaqm93pMk/ss=";
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ratspeak";
+  version = "1.0.25";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "Ratspeak";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HJH31dAnmSK85AkX+ufvmo+Nmd9X6xmLO06Lys8kces=";
+  };
+
+  # The app expects the protocol repos next to its own checkout.
+  postUnpack = ''
+    cp -r ${rsReticulum} rsReticulum
+    cp -r ${rsLXMF} rsLXMF
+    cp -r ${rsLXST} rsLXST
+    cp -r ${lrgp-rs} lrgp-rs
+    chmod -R u+w rsReticulum rsLXMF rsLXST lrgp-rs
+  '';
+
+  cargoHash = "sha256-XumEJazJux0FFLS6qcruaXdOLsZ9hfn8Q/hA9Ot4RzM=";
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = finalAttrs.cargoRoot;
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    perl
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ wrapGAppsHook4 ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+    dbus
+    glib-networking
+    libayatana-appindicator
+    libsoup_3
+    openssl
+    pcsclite
+    udev
+    webkitgtk_4_1
+  ];
+
+  # The dashboard ships modular CSS; the app serves the concatenated file.
+  preBuild = ''
+    bash dashboard/build-css.sh
+  '';
+
+  # The tray icon library is dlopened at runtime, not linked.
+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libayatana-appindicator ]}
+    )
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Reticulum and LXMF client with messaging, file sharing, voice calls and LoRa support";
+    homepage = "https://github.com/ratspeak/Ratspeak";
+    changelog = "https://github.com/ratspeak/Ratspeak/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ eldios ];
+    platforms = lib.platforms.linux;
+    mainProgram = "ratspeak";
+  };
+})
diff --git a/pkgs/by-name/ra/ratspeak/update.sh b/pkgs/by-name/ra/ratspeak/update.sh
new file mode 100755
index 000000000000..66dec65a58d4
--- /dev/null
+++ b/pkgs/by-name/ra/ratspeak/update.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Update ratspeak to the latest upstream release tag.
+#
+# Ratspeak resolves its protocol crates from sibling checkouts, so a version
+# bump means updating five pins together: the app tag plus the four sibling
+# revisions current at that tag's date. Requires: curl, jq, nix, sed.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+github_api() {
+    curl -sfL -H "Accept: application/vnd.github+json" \
+        ${GITHUB_TOKEN:+-H "Authorization: Bearer $GITHUB_TOKEN"} \
+        "https://api.github.com/$1"
+}
+
+# Works both from the standalone packaging flake and from a nixpkgs checkout.
+build() {
+    if [ -f flake.nix ]; then
+        nix build .#ratspeak
+    else
+        nix-build "$(git rev-parse --show-toplevel)" -A ratspeak --no-out-link
+    fi
+}
+
+prefetch() {
+    nix flake prefetch --json "github:ratspeak/$1/$2" | jq -r .hash
+}
+
+current=$(sed -nE 's/^ *version = "([^"]+)";$/\1/p' package.nix | head -1)
+# releases/latest skips pre-releases (rc tags) on purpose.
+tag=${RATSPEAK_TAG:-$(github_api repos/ratspeak/Ratspeak/releases/latest | jq -r .tag_name)}
+new=${tag#v}
+
+if [ "$new" = "$current" ] && [ -z "${RATSPEAK_TAG:-}" ]; then
+    echo "ratspeak is up to date ($current)"
+    exit 0
+fi
+
+tag_date=$(github_api "repos/ratspeak/Ratspeak/commits/$tag" | jq -r .commit.committer.date)
+echo "updating ratspeak $current -> $new (tagged $tag_date)"
+
+sed -i -E "s|^( *version = )\"[^\"]+\";|\1\"$new\";|" package.nix
+
+app_hash=$(prefetch Ratspeak "$tag")
+sed -i "/repo = \"Ratspeak\";/,/hash = / s|hash = \".*\";|hash = \"$app_hash\";|" package.nix
+
+for repo in rsReticulum rsLXMF rsLXST lrgp-rs; do
+    rev=$(github_api "repos/ratspeak/$repo/commits?until=$tag_date&per_page=1" | jq -r '.[0].sha')
+    hash=$(prefetch "$repo" "$rev")
+    echo "  $repo -> $rev"
+    sed -i \
+        -e "/repo = \"$repo\";/,/hash = / s|rev = \".*\";|rev = \"$rev\";|" \
+        -e "/repo = \"$repo\";/,/hash = / s|hash = \".*\";|hash = \"$hash\";|" \
+        package.nix
+done
+
+# Two-pass cargoHash: reset to the fake hash, read the real one from the
+# vendor mismatch error, write it back. The build failure is expected here,
+# so it must not trip set -e/pipefail.
+fake="sha256-$(printf 'A%.0s' {1..43})="
+sed -i -E "s|^( *cargoHash = )\".*\";|\1\"$fake\";|" package.nix
+build_log=$(build 2>&1 || true)
+cargo_hash=$(printf '%s\n' "$build_log" | sed -nE 's/^ *got: *(sha256-.*)$/\1/p' | head -1)
+if [ -z "$cargo_hash" ]; then
+    echo "error: could not extract cargoHash from build output" >&2
+    exit 1
+fi
+sed -i -E "s|^( *cargoHash = )\".*\";|\1\"$cargo_hash\";|" package.nix
+
+echo "verifying build..."
+build
+echo "ratspeak updated to $new"
diff --git a/pkgs/by-name/rb/rbdoom-3-bfg/package.nix b/pkgs/by-name/rb/rbdoom-3-bfg/package.nix
index ac07681663c9..67467b8ede94 100644
--- a/pkgs/by-name/rb/rbdoom-3-bfg/package.nix
+++ b/pkgs/by-name/rb/rbdoom-3-bfg/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postPatch = ''
-    substituteInPlace neo/extern/nvrhi/tools/shaderCompiler/CMakeLists.txt \
-      --replace "AppleClang" "Clang"
+    substituteInPlace neo/extern/ShaderMake/CMakeLists.txt \
+      --replace-fail "AppleClang" "Clang"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index ec42b0d34fab..6aff57e12ac8 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -7,10 +7,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.27.19";
+  version = "1.27.32";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-efu5QQRzZan6S0mfNuxnCJMGnLCM+BSwMXpAqOPrqhI=";
+    hash = "sha256-CwiQFMu/N+Dj8pntSMy8OjjCfbgZBSV2pEBRPk7njfs=";
   };
   appimageContents = appimageTools.extract { inherit pname version src; };
 in
diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index 3e47f2c9d0ce..0f37c334af04 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     "install"
     "install-lib-headers"
   ]
-  ++ lib.optionals (!enableStatic) [
+  ++ lib.optionals (!enableStatic && !stdenv.hostPlatform.isWindows) [
     "install-lib-so-link"
   ];
 
diff --git a/pkgs/by-name/ro/roam-research/common.nix b/pkgs/by-name/ro/roam-research/common.nix
deleted file mode 100644
index d284c83ee5aa..000000000000
--- a/pkgs/by-name/ro/roam-research/common.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ fetchurl }:
-let
-  pname = "roam-research";
-  version = "0.0.24";
-in
-{
-  inherit pname version;
-  sources = {
-    aarch64-darwin = fetchurl {
-      url = "https://roam-electron-deploy.s3.us-east-2.amazonaws.com/Roam+Research-${version}-arm64.dmg";
-      hash = "sha256-fPtJAKfh65/dEryi0kdg+1hLfdvzBU87uS0y6eaaVy4=";
-    };
-    x86_64-linux = fetchurl {
-      url = "https://roam-electron-deploy.s3.us-east-2.amazonaws.com/${pname}_${version}_amd64.deb";
-      hash = "sha256-vpceynkr0/IOSqdmtVxKliSIJEGvLhczqgrsQyqPVIo=";
-    };
-  };
-}
diff --git a/pkgs/by-name/ro/roam-research/darwin.nix b/pkgs/by-name/ro/roam-research/darwin.nix
deleted file mode 100644
index 00603c518486..000000000000
--- a/pkgs/by-name/ro/roam-research/darwin.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  lib,
-  stdenv,
-  _7zz,
-  fetchurl,
-}:
-let
-  common = import ./common.nix { inherit fetchurl; };
-  inherit (stdenv.hostPlatform) system;
-in
-stdenv.mkDerivation rec {
-  inherit (common) pname version;
-  src = common.sources.${system} or (throw "Source for ${pname} is not available for ${system}");
-
-  appName = "Roam Research";
-
-  sourceRoot = ".";
-
-  nativeBuildInputs = [ _7zz ];
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/Applications"
-    cp -R *.app "$out/Applications"
-
-    mkdir -p $out/bin
-    ln -s "$out/Applications/${appName}.app/Contents/MacOS/${appName}" "$out/bin/${appName}"
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Note-taking tool for networked thought";
-    homepage = "https://roamresearch.com/";
-    maintainers = with lib.maintainers; [ dbalan ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    platforms = [
-      "aarch64-darwin"
-    ];
-    mainProgram = "roam-research";
-  };
-}
diff --git a/pkgs/by-name/ro/roam-research/linux.nix b/pkgs/by-name/ro/roam-research/linux.nix
deleted file mode 100644
index 775f412f3206..000000000000
--- a/pkgs/by-name/ro/roam-research/linux.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchurl,
-  alsa-lib,
-  atk,
-  cairo,
-  cups,
-  dbus,
-  dpkg,
-  expat,
-  gdk-pixbuf,
-  glib,
-  gtk3,
-  libx11,
-  libxscrnsaver,
-  libxcomposite,
-  libxcursor,
-  libxdamage,
-  libxext,
-  libxfixes,
-  libxi,
-  libxrandr,
-  libxrender,
-  libxtst,
-  libdrm,
-  libpulseaudio,
-  libxcb,
-  libxkbcommon,
-  libxshmfence,
-  libgbm,
-  nspr,
-  nss,
-  pango,
-  udev,
-}:
-
-let
-  common = import ./common.nix { inherit fetchurl; };
-  inherit (stdenv.hostPlatform) system;
-  libPath = lib.makeLibraryPath [
-    alsa-lib
-    atk
-    cairo
-    cups
-    dbus
-    expat
-    gdk-pixbuf
-    glib
-    gtk3
-    libx11
-    libxcomposite
-    libxdamage
-    libxext
-    libxfixes
-    libxi
-    libxrandr
-    libdrm
-    libxcb
-    libxkbcommon
-    libxshmfence
-    libgbm
-    nspr
-    nss
-    pango
-    stdenv.cc.cc
-    libxscrnsaver
-    libxcursor
-    libxrender
-    libxtst
-    libpulseaudio
-    udev
-  ];
-in
-stdenv.mkDerivation rec {
-  inherit (common) pname version;
-  src = common.sources.${system} or (throw "Source for ${pname} is not available for ${system}");
-
-  nativeBuildInputs = [ dpkg ];
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    mv opt "$out/"
-
-    ln -s "$out/opt/Roam Research/roam-research" "$out/bin/roam-research"
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${libPath}:$out/opt/Roam Research:\$ORIGIN" "$out/opt/Roam Research/roam-research"
-
-    mv usr/* "$out/"
-
-    substituteInPlace $out/share/applications/roam-research.desktop \
-      --replace "/opt/Roam Research/roam-research" "roam-research"
-  '';
-
-  # autoPatchelfHook/patchelf are not used because they cause the binary to coredump.
-  dontPatchELF = true;
-
-  meta = {
-    description = "Note-taking tool for networked thought";
-    homepage = "https://roamresearch.com/";
-    maintainers = with lib.maintainers; [ dbalan ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "roam-research";
-  };
-}
diff --git a/pkgs/by-name/ro/roam-research/package.nix b/pkgs/by-name/ro/roam-research/package.nix
deleted file mode 100644
index 3edbbe1a5081..000000000000
--- a/pkgs/by-name/ro/roam-research/package.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ stdenv, callPackage, ... }@args:
-let
-  extraArgs = removeAttrs args [ "callPackage" ];
-in
-if stdenv.hostPlatform.isDarwin then
-  callPackage ./darwin.nix (extraArgs // { })
-else
-  callPackage ./linux.nix (extraArgs // { })
diff --git a/pkgs/by-name/ro/routedns/package.nix b/pkgs/by-name/ro/routedns/package.nix
index 80b0f9156c97..accbfe1844a9 100644
--- a/pkgs/by-name/ro/routedns/package.nix
+++ b/pkgs/by-name/ro/routedns/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "routedns";
-  version = "0.1.226";
+  version = "0.1.233";
 
   src = fetchFromGitHub {
     owner = "folbricht";
     repo = "routedns";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-pGAzdZDZeWgw+BIL5JmrqrllxN7w+Se9yWRVozzgt6s=";
+    hash = "sha256-2Cc7TDv6VxNwr9y+xOcBt1PzQMmq0lguLwQoRRkaasQ=";
   };
 
   vendorHash = "sha256-w8rZue6/cc8wg40Ey+P216cQGhbCznjSsLi1G4YfRsI=";
diff --git a/pkgs/by-name/ru/runapp/package.nix b/pkgs/by-name/ru/runapp/package.nix
index 908b436ba1d8..6e6d9b1dbc02 100644
--- a/pkgs/by-name/ru/runapp/package.nix
+++ b/pkgs/by-name/ru/runapp/package.nix
@@ -1,12 +1,12 @@
 {
   fetchFromGitHub,
-  gcc15Stdenv,
+  stdenv,
   lib,
   nix-update-script,
   pkg-config,
   systemd,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "runapp";
   version = "0.5.1";
 
diff --git a/pkgs/by-name/sc/scion/package.nix b/pkgs/by-name/sc/scion/package.nix
index 4b0fd2a7eabb..e9d052067ea0 100644
--- a/pkgs/by-name/sc/scion/package.nix
+++ b/pkgs/by-name/sc/scion/package.nix
@@ -4,25 +4,32 @@
   fetchFromGitHub,
   nix-update-script,
   nixosTests,
+  ciMode ? true, # Override to false to run time-sensitive tests locally
 }:
 buildGoModule (finalAttrs: {
   pname = "scion";
 
-  version = "0.12.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "scionproto";
     repo = "scion";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J51GIQQhS623wFUU5dI/TwT2rkDH69518lpdCLZ/iM0=";
+    hash = "sha256-UQgCjX9xYClsBviNwCmxHXAJ7MNce7olpzaCM2ybuc0=";
   };
 
-  vendorHash = "sha256-Ew/hQM8uhaM89sCcPKUBbiGukDq3h5x+KID3w/8BDHg=";
+  __structuredAttrs = true;
+
+  # Tests bind to localhost
+  __darwinAllowLocalNetworking = true;
+
+  vendorHash = "sha256-A9K2/bWYUdMA8ypSisxk4NMOavHz51FaHEaxahz+0ek=";
 
   excludedPackages = [
     "acceptance"
     "demo"
     "tools"
+    "private/underlay/ebpf"
     "pkg/private/xtest/graphupdater"
   ];
 
@@ -38,6 +45,11 @@ buildGoModule (finalAttrs: {
 
   doCheck = true;
 
+  # Upstream disables time-sensitive tests and adjusts timeouts in CI
+  preCheck = lib.optionalString ciMode ''
+    export CI=42
+  '';
+
   tags = [ "sqlite_mattn" ];
 
   passthru = {
diff --git a/pkgs/by-name/sl/slurm/package.nix b/pkgs/by-name/sl/slurm/package.nix
index 95b4f3fcdb10..8d342d5649fb 100644
--- a/pkgs/by-name/sl/slurm/package.nix
+++ b/pkgs/by-name/sl/slurm/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slurm";
-  version = "26-05-2-1";
+  version = "26-05-3-1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "slurm";
     # The release tags use - instead of .
     tag = "slurm-${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-HkBHwN/j0do+CPpouG6qswZEOeY17owmA980wVubiw4=";
+    hash = "sha256-pyzESnZoFxy3A2p3b23SimTUurMlB63VV7dqcXZ43Hw=";
   };
 
   outputs = [
diff --git a/pkgs/development/compilers/smlnj/hashes.json b/pkgs/by-name/sm/smlnj-legacy/hashes-legacy.json
similarity index 100%
rename from pkgs/development/compilers/smlnj/hashes.json
rename to pkgs/by-name/sm/smlnj-legacy/hashes-legacy.json
diff --git a/pkgs/by-name/sm/smlnj-legacy/package.nix b/pkgs/by-name/sm/smlnj-legacy/package.nix
new file mode 100644
index 000000000000..c6f11b63185c
--- /dev/null
+++ b/pkgs/by-name/sm/smlnj-legacy/package.nix
@@ -0,0 +1,109 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+let
+  version = "110.99.9";
+
+  arch = if stdenv.hostPlatform.is64bit then "64" else "32";
+
+  hashes = builtins.fromJSON (builtins.readFile ./hashes-legacy.json);
+
+  fetchSource =
+    name:
+    fetchurl {
+      url = "https://smlnj.cs.uchicago.edu/dist/working/${version}/${name}";
+      hash = hashes.${name};
+    };
+
+  bootSource = if stdenv.hostPlatform.is64bit then "boot.amd64-unix.tgz" else "boot.x86-unix.tgz";
+
+  sources = map fetchSource [
+    bootSource
+    "config.tgz"
+    "cm.tgz"
+    "compiler.tgz"
+    "runtime.tgz"
+    "system.tgz"
+    "MLRISC.tgz"
+    "smlnj-lib.tgz"
+    "old-basis.tgz"
+    "ckit.tgz"
+    "nlffi.tgz"
+    "cml.tgz"
+    "eXene.tgz"
+    "ml-lpt.tgz"
+    "ml-lex.tgz"
+    "ml-yacc.tgz"
+    "ml-burg.tgz"
+    "pgraph.tgz"
+    "trace-debug-profile.tgz"
+    "heap2asm.tgz"
+    "smlnj-c.tgz"
+    "doc.tgz"
+    "asdl.tgz"
+  ];
+
+in
+stdenv.mkDerivation {
+  pname = "smlnj";
+  inherit version sources;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  unpackPhase = ''
+    for s in "''${sources[@]}"; do
+      b=$(basename $s)
+      cp $s ''${b#*-}
+    done
+    unpackFile config.tgz
+    mkdir base
+    ./config/unpack $TMP runtime
+  '';
+
+  postPatch = ''
+    sed -i '/^PATH=/d' config/_arch-n-opsys base/runtime/config/gen-posix-names.sh
+    echo SRCARCHIVEURL="file:/$TMP" > config/srcarchiveurl
+  '';
+
+  buildPhase = ''
+    ./config/install.sh -default ${arch}
+  '';
+
+  installPhase = ''
+    mkdir -pv $out
+    cp -rv bin lib $out
+
+    cd $out/bin
+    for i in *; do
+      sed -i "2iSMLNJ_HOME=$out/" $i
+    done
+  '';
+
+  passthru.updateScript = ./update-legacy.sh;
+
+  meta = {
+    description = "Standard ML of New Jersey, a compiler";
+    homepage = "https://smlnj.org";
+    downloadPage = "https://smlnj.org/dist/working/${version}/install.html";
+    changelog = "https://smlnj.org/dist/working/${version}/${version}-README.html";
+    license = lib.licenses.bsd3;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryNativeCode
+    ];
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+      "aarch64-darwin"
+    ];
+    maintainers = with lib.maintainers; [
+      skyesoss
+      thoughtpolice
+    ];
+    mainProgram = "sml";
+    broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
+  };
+}
diff --git a/pkgs/development/compilers/smlnj/update.sh b/pkgs/by-name/sm/smlnj-legacy/update-legacy.sh
similarity index 96%
rename from pkgs/development/compilers/smlnj/update.sh
rename to pkgs/by-name/sm/smlnj-legacy/update-legacy.sh
index a5c9cd96d055..d2863b3749b7 100755
--- a/pkgs/development/compilers/smlnj/update.sh
+++ b/pkgs/by-name/sm/smlnj-legacy/update-legacy.sh
@@ -6,8 +6,8 @@ set -euo pipefail
 
 dir="$(dirname "$0")"
 url="https://smlnj.cs.uchicago.edu/dist/working/"
-hashfile="$dir/hashes.json"
-nixfile="$dir/default.nix"
+hashfile="$dir/hashes-legacy.json"
+nixfile="$dir/package.nix"
 
 version="$(curl --silent "$url" \
     | sed -n 's:.*<b>\([0-9]\{3\}\.[0-9.-]\+\)</b>.*:\1:p' \
diff --git a/pkgs/by-name/t3/t3code/unwrapped.nix b/pkgs/by-name/t3/t3code/unwrapped.nix
index a0535506d9f1..e74cfebc115b 100644
--- a/pkgs/by-name/t3/t3code/unwrapped.nix
+++ b/pkgs/by-name/t3/t3code/unwrapped.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (
   in
   {
     pname = "t3code-unwrapped";
-    version = "0.0.32";
+    version = "0.0.33";
     strictDeps = true;
     __structuredAttrs = true;
 
@@ -45,7 +45,7 @@ stdenv.mkDerivation (
       owner = "pingdotgg";
       repo = "t3code";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-Gmn3Fz0E32TnHPEun6cReXcW/dxfl6qI1TIFHzdWRzU=";
+      hash = "sha256-qZi9hMGzqpmnpqvvVtsQvkZIiVqTgOMWv1y15MiSAYg=";
     };
 
     postPatch = ''
diff --git a/pkgs/by-name/ti/timemachine/package.nix b/pkgs/by-name/ti/timemachine/package.nix
deleted file mode 100644
index 72f4afa55e41..000000000000
--- a/pkgs/by-name/ti/timemachine/package.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoconf,
-  automake,
-  pkg-config,
-  gtk2,
-  libjack2,
-  libsndfile,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "timemachine";
-  version = "0.3.4";
-  src = fetchFromGitHub {
-    owner = "swh";
-    repo = "timemachine";
-    rev = "v${finalAttrs.version}";
-    sha256 = "16fgyw6jnscx9279dczv72092dddghwlp53rkfw469kcgvjhwx0z";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    autoconf
-    automake
-  ];
-  buildInputs = [
-    gtk2
-    libjack2
-    libsndfile
-  ];
-
-  preConfigure = "./autogen.sh";
-
-  env.NIX_LDFLAGS = "-lm";
-
-  meta = {
-    description = "JACK audio recorder";
-    homepage = "http://plugin.org.uk/timemachine/";
-    license = lib.licenses.lgpl2;
-    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.nico202 ];
-    mainProgram = "timemachine";
-  };
-})
diff --git a/pkgs/by-name/tr/trivy/package.nix b/pkgs/by-name/tr/trivy/package.nix
index f745f30f2f42..87d67bb2bd52 100644
--- a/pkgs/by-name/tr/trivy/package.nix
+++ b/pkgs/by-name/tr/trivy/package.nix
@@ -10,19 +10,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "trivy";
-  version = "0.73.0";
+  version = "0.74.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = "trivy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+iJb/Eg97kjNzg6OTuEWXAPJ/32FpfVU2ED4/6A4U+I=";
+    hash = "sha256-OXOT8qwqh8Gy+IJcvBza5nai5bvNMcAMeeT+b2zuWDg=";
   };
 
   # Hash mismatch on across Linux and Darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-0upMQ2fKKfaHAL/SVyzPpdRoBwMNS9PdHPHGAmEm148=";
+  vendorHash = "sha256-ajXgC6CCw0IaS/e3k0wGNIUOs9mTBIEuV21ZnwZj7SQ=";
 
   subPackages = [ "cmd/trivy" ];
 
diff --git a/pkgs/by-name/un/unified-memory-framework/package.nix b/pkgs/by-name/un/unified-memory-framework/package.nix
index 62a66ff99354..b1ac7501e56c 100644
--- a/pkgs/by-name/un/unified-memory-framework/package.nix
+++ b/pkgs/by-name/un/unified-memory-framework/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_cudart
   ]
-  ++ lib.optionals finalAttrs.doCheck [
+  ++ lib.optionals finalAttrs.finalPackage.doCheck [
     numactl
     gtest
     gbenchmark
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     (lib.cmakeBool "UMF_BUILD_LIBUMF_POOL_JEMALLOC" useJemalloc)
 
-    (lib.cmakeBool "UMF_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "UMF_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
     # We won't be able to run these inside the sandbox, so no use in building them
     (lib.cmakeBool "UMF_BUILD_GPU_TESTS" false)
     (lib.cmakeBool "UMF_BUILD_BENCHMARKS" false)
diff --git a/pkgs/by-name/up/upki/package.nix b/pkgs/by-name/up/upki/package.nix
new file mode 100644
index 000000000000..a9352d23b382
--- /dev/null
+++ b/pkgs/by-name/up/upki/package.nix
@@ -0,0 +1,103 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  buildPackages,
+  stdenv,
+  testers,
+  versionCheckHook,
+  rustc,
+  cacert,
+  pkg-config,
+  openssl,
+  cargo-c,
+  validatePkgConfig,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "upki";
+  version = "1.0.0-beta.3";
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "rustls";
+    repo = "upki";
+    tag = "upki-${finalAttrs.version}";
+    hash = "sha256-GZkXxidIjG76yIzAcMRsRorMVYpImFN5Q2pe2YgiEUs=";
+  };
+
+  cargoHash = "sha256-/z11KuGP3A3fh/Jk2Kx26x7okh6brHs+t/XC7BuPgcA=";
+
+  cargoBuildFlags = [
+    "--package=upki-cli"
+    "--package=upki-openssl"
+  ];
+
+  cargoInstallFlags = [
+    "--package=upki-cli"
+  ];
+
+  nativeBuildInputs = [
+    cargo-c
+    pkg-config
+  ];
+  buildInputs = [ openssl ];
+
+  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+  postBuild = ''
+    ${buildPackages.rust.envVars.setEnv} cargo cbuild --release --frozen \
+      --package=upki \
+      --prefix=$out \
+      --target=${stdenv.hostPlatform.rust.rustcTarget}
+    ${buildPackages.rust.envVars.setEnv} cargo cbuild --release --frozen \
+      --package=upki-openssl \
+      --prefix=$out \
+      --target=${stdenv.hostPlatform.rust.rustcTarget}
+  '';
+
+  postInstall = ''
+    ${buildPackages.rust.envVars.setEnv} cargo cinstall --release --frozen \
+      --package=upki \
+      --prefix=$out \
+      --target=${stdenv.hostPlatform.rust.rustcTarget}
+    ${buildPackages.rust.envVars.setEnv} cargo cinstall --release --frozen \
+      --package=upki-openssl \
+      --prefix=$out \
+      --target=${stdenv.hostPlatform.rust.rustcTarget}
+    cp $out/include/upki/upki.h $out/include/upki_openssl/upki.h
+  '';
+
+  nativeInstallCheckInputs = [
+    pkg-config
+    versionCheckHook
+    validatePkgConfig
+  ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version=unstable" ];
+    };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Platform-independent browser-grade certificate infrastructure";
+    homepage = "https://github.com/rustls/upki";
+    changelog = "https://github.com/rustls/upki/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.OR [
+      lib.licenses.mit
+      lib.licenses.asl20
+    ];
+    maintainers = [ lib.maintainers.skyesoss ];
+    mainProgram = "upki";
+    pkgConfigModules = [
+      "upki"
+      "upki_openssl"
+    ];
+    platforms = rustc.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/wo/worker/package.nix b/pkgs/by-name/wo/worker/package.nix
index f28ceebd0ae8..f3f03471fb3b 100644
--- a/pkgs/by-name/wo/worker/package.nix
+++ b/pkgs/by-name/wo/worker/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "worker";
-  version = "5.2.2";
+  version = "5.3.1";
 
   src = fetchurl {
     url = "http://www.boomerangsworld.de/cms/worker/downloads/worker-${finalAttrs.version}.tar.gz";
-    hash = "sha256-xJxdOb6eEr8suf3u/vouYCGzTFugJpLtoKyCMeuoJv4=";
+    hash = "sha256-7w8Kpi1dzBZjHKzEwavPR/4Qwo+wl2FejSCDdORjALY=";
   };
 
   buildInputs = [ libx11 ];
diff --git a/pkgs/by-name/xm/xmake/package.nix b/pkgs/by-name/xm/xmake/package.nix
index affd69c4e88e..eb9a2303e9ac 100644
--- a/pkgs/by-name/xm/xmake/package.nix
+++ b/pkgs/by-name/xm/xmake/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xmake";
-  version = "3.0.9";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "xmake-io";
     repo = "xmake";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JoIXsEvcB65NQ7G06HgNIDqMSVzxlX7jOVxe1bWaEAQ=";
+    hash = "sha256-gcPOOAS1JSze+sgeWzGvXijxDmuJKbuNFP0MX2D4Rtg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/compilers/gcc/ng/common/default.nix b/pkgs/development/compilers/gcc/ng/common/default.nix
index 9929fee1e655..bd3c12496714 100644
--- a/pkgs/development/compilers/gcc/ng/common/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/default.nix
@@ -109,7 +109,6 @@ makeScopeWithSplicing' {
         bintools = binutils;
       };
 
-      libbacktrace = callPackage ./libbacktrace { };
       libiberty = callPackage ./libiberty { };
       libsanitizer = callPackage ./libsanitizer { };
       libquadmath = callPackage ./libquadmath { };
diff --git a/pkgs/development/compilers/gcc/ng/common/gcc/default.nix b/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
index fd282acfda67..d653673ff6b3 100644
--- a/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
@@ -16,7 +16,6 @@
   langObjCpp ? stdenv.targetPlatform.isDarwin,
   langJit ? false,
   enablePlugin ? lib.systems.equals stdenv.hostPlatform stdenv.buildPlatform,
-  runCommand,
   buildPackages,
   isl,
   zlib,
@@ -35,6 +34,8 @@
   fromVCS ? false,
   getVersionFile,
   buildGccPackages,
+  libbacktrace,
+  autoreconfHook269,
   bintools,
   # Build the shared runtime libraries, and so have the driver's specs emit
   # `-lgcc_s`. Derived the way the monolithic build derives it.
@@ -119,10 +120,44 @@ stdenv.mkDerivation (finalAttrs: {
     })
 
     (getVersionFile "gcc/fix-collect2-paths.diff")
+
+    # From the posting to gcc-patches, which covers every component that links
+    # libbacktrace. Take only this component's non-generated files: the
+    # generated ones are rebuilt by `autoreconfHook269` below, against a GCC
+    # slightly different from the one the patch was made against.
+    (fetchpatch {
+      name = "system-libbacktrace.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260814013206.3818461-1-git@JohnEricson.me/raw";
+      includes = [
+        "config/libbacktrace.m4"
+        "gcc/configure.ac"
+        "gcc/Makefile.in"
+      ];
+      hash = "sha256-i+J4B5f+zrXERPqJxwjEm/JHZhDsV6Gmxx/n9+G0shM=";
+    })
   ];
 
   enableParallelBuilding = true;
 
+  # The patches above touch `gcc/configure.ac`, and this is the one component
+  # whose `configure` nothing regenerates on its own -- it has no
+  # `Makefile.am`, so it is not part of any `autoreconf` the other packages
+  # run. Only `gcc` is named, because reconfiguring the whole monorepo is both
+  # slow and unnecessary.
+  #
+  # Regenerating rather than carrying `configure` in the patch keeps that patch
+  # to what was actually written, and lets it apply to a tree whose generated
+  # files have moved on.
+  autoreconfFlags = "--verbose --force gcc";
+
+  # `aclocal` finds the macro added under `config/` through `ACLOCAL_AMFLAGS`
+  # in a `Makefile.am`, which `gcc` does not have. Without this the macro is
+  # simply undefined, and `autoconf` leaves its name in the script as literal
+  # shell rather than failing.
+  preAutoreconf = ''
+    export ACLOCAL_PATH="$PWD/config''${ACLOCAL_PATH:+:$ACLOCAL_PATH}"
+  '';
+
   hardeningDisable = [
     "format" # Some macro-indirect formatting in e.g. libcpp
   ];
@@ -154,6 +189,7 @@ stdenv.mkDerivation (finalAttrs: {
   depsBuildTarget = [ (bintools.bintools or bintools) ];
 
   nativeBuildInputs = [
+    autoreconfHook269
     texinfo
     which
     gettext
@@ -165,6 +201,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    libbacktrace
     gmp
     libmpc
     mpfr
@@ -211,11 +248,6 @@ stdenv.mkDerivation (finalAttrs: {
     + ''
       cd "$buildRoot"
 
-      mkdir -p "$buildRoot/libbacktrace/.libs"
-      cp ${buildGccPackages.libbacktrace}/lib/libbacktrace.a "$buildRoot/libbacktrace/.libs/libbacktrace.a"
-      cp -r ${buildGccPackages.libbacktrace}/lib/*.la "$buildRoot/libbacktrace"
-      cp -r ${buildGccPackages.libbacktrace.dev}/include/*.h "$buildRoot/libbacktrace"
-
       mkdir -p "$buildRoot/libiberty/pic"
       cp ${buildGccPackages.libiberty}/lib/libiberty.a "$buildRoot/libiberty"
       cp ${buildGccPackages.libiberty}/lib/libiberty_pic.a "$buildRoot/libiberty/pic/libiberty.a"
@@ -296,6 +328,7 @@ stdenv.mkDerivation (finalAttrs: {
     # the driver finds them on `PATH` under their target-prefixed names, via
     # the `find_a_program` patches above.
     "--with-system-zlib"
+    "--with-system-libbacktrace"
     "--without-included-gettext"
     "--enable-linker-build-id"
     # Deliberately *no* `--with-sysroot` / `--with-native-system-header-dir`
diff --git a/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix b/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix
deleted file mode 100644
index 75cf777746a7..000000000000
--- a/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix
+++ /dev/null
@@ -1,84 +0,0 @@
-{
-  lib,
-  stdenv,
-  gcc_meta,
-  release_version,
-  version,
-  monorepoSrc ? null,
-  runCommand,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libbacktrace";
-  inherit version;
-
-  src = runCommand "libbacktrace-src-${version}" { src = monorepoSrc; } (
-    ''
-      runPhase unpackPhase
-
-      mkdir -p "$out/gcc"
-      cp gcc/BASE-VER "$out/gcc"
-      cp gcc/DATESTAMP "$out/gcc"
-
-      cp -r include "$out"
-      cp -r libbacktrace "$out"
-
-      cp config.guess "$out"
-      cp config.rpath "$out"
-      cp config.sub "$out"
-      cp config-ml.in "$out"
-      cp ltmain.sh "$out"
-      cp install-sh "$out"
-      cp move-if-change "$out"
-      cp mkinstalldirs "$out"
-      cp test-driver "$out"
-
-    ''
-    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
-    + ''
-      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
-    ''
-  );
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  enableParallelBuilding = true;
-
-  sourceRoot = "${finalAttrs.src.name}/libbacktrace";
-
-  preConfigure = ''
-    mkdir ../../build
-    cd ../../build
-    configureScript=../$sourceRoot/configure
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # GNU debuglink is not supported on macOS (Mach-O format)
-    # Skip the gnudebuglink tests which fail on Darwin
-    export libbacktrace_cv_objcopy_debuglink=no
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/lib"
-    cp .libs/*.a "$out/lib"
-    cp libbacktrace*.la "$out/lib"
-
-    mkdir -p "$dev/include"
-    cp backtrace-supported.h "$dev/include"
-
-    runHook postInstall
-  '';
-
-  doCheck = true;
-
-  passthru = {
-    isGNU = true;
-  };
-
-  meta = gcc_meta // {
-    homepage = "https://gcc.gnu.org/";
-  };
-})
diff --git a/pkgs/development/compilers/gcc/ng/common/libgfortran/default.nix b/pkgs/development/compilers/gcc/ng/common/libgfortran/default.nix
index 7b294b56bbae..e18e9ef0c3e0 100644
--- a/pkgs/development/compilers/gcc/ng/common/libgfortran/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libgfortran/default.nix
@@ -7,6 +7,7 @@
   version,
   getVersionFile,
   monorepoSrc ? null,
+  fetchpatch,
   autoreconfHook269,
   libiberty,
   buildPackages,
@@ -26,6 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  buildInputs = [ libbacktrace ];
+
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [
     autoreconfHook269
@@ -35,6 +38,21 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     (getVersionFile "libgfortran/force-regular-dirs.patch")
+
+    # From the posting to gcc-patches, which covers every component that links
+    # libbacktrace. Take only this component's non-generated files: the
+    # generated ones are rebuilt by `autoreconfHook269` below, against a GCC
+    # slightly different from the one the patch was made against.
+    (fetchpatch {
+      name = "system-libbacktrace.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260814013206.3818461-1-git@JohnEricson.me/raw";
+      includes = [
+        "config/libbacktrace.m4"
+        "libgfortran/configure.ac"
+        "libgfortran/Makefile.am"
+      ];
+      hash = "sha256-QB+Wto9V1XXYhUhUSeP7Mxoj/iZQdMOT+7aSWyHjXX0=";
+    })
   ];
 
   autoreconfFlags = "--install --force --verbose . libgfortran";
@@ -87,16 +105,10 @@ stdenv.mkDerivation (finalAttrs: {
     )
     mkdir -p "$buildRoot/gcc/include"
 
-    mkdir -p "$buildRoot/gcc/libbacktrace/.libs"
-    cp ${libbacktrace}/lib/libbacktrace.a "$buildRoot/gcc/libbacktrace/.libs/libbacktrace.a"
-    cp -r ${libbacktrace}/lib/*.la "$buildRoot/gcc/libbacktrace"
-    cp -r ${libbacktrace.dev}/include/*.h "$buildRoot/gcc/libbacktrace"
-
     mkdir -p "$buildRoot/gcc/libgcc"
     ln -s "${libgcc.dev}/include/gthr-default.h" "$buildRoot/gcc/libgcc"
 
     mkdir -p "$buildRoot/gcc/${stdenv.hostPlatform.config}/libgfortran"
-    ln -s "$buildRoot/gcc/libbacktrace" "$buildRoot/gcc/${stdenv.buildPlatform.config}/libbacktrace"
     ln -s "$buildRoot/gcc/libgcc" "$buildRoot/gcc/${stdenv.buildPlatform.config}/libgcc"
     cd "$buildRoot/gcc/${stdenv.hostPlatform.config}/libgfortran"
     configureScript=$sourceRoot/configure
@@ -166,6 +178,8 @@ stdenv.mkDerivation (finalAttrs: {
     # $CC cannot link binaries, let alone run then
     "cross_compiling=true"
     "--with-toolexeclibdir=${placeholder "dev"}/lib"
+
+    "--with-system-libbacktrace"
   ];
 
   # Set the variable back the way it was, see corresponding code in
diff --git a/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix b/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
index 08865b5ff519..7aa83baae41f 100644
--- a/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
@@ -11,6 +11,7 @@
   runCommand,
   gettext,
   libgcc,
+  libbacktrace,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libstdcxx";
@@ -76,6 +77,24 @@ stdenv.mkDerivation (finalAttrs: {
       ];
     })
     (getVersionFile "libstdcxx/force-regular-dirs.patch")
+
+    # From the posting to gcc-patches, which covers every component that links
+    # libbacktrace. Take only this component's non-generated files: the
+    # generated ones are rebuilt by `autoreconfHook269` below, against a GCC
+    # slightly different from the one the patch was made against.
+    (fetchpatch {
+      name = "system-libbacktrace.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260814013206.3818461-1-git@JohnEricson.me/raw";
+      includes = [
+        "config/libbacktrace.m4"
+        "libstdc++-v3/acinclude.m4"
+        "libstdc++-v3/src/Makefile.am"
+        "libstdc++-v3/src/c++23/Makefile.am"
+        "libstdc++-v3/src/c++23/stacktrace.cc"
+        "libstdc++-v3/src/experimental/Makefile.am"
+      ];
+      hash = "sha256-qcs5N+KgBs2FScqGUZRYbAKkI2oDnm+G/ZN9RCAgZpw=";
+    })
   ];
 
   postUnpack = ''
@@ -90,6 +109,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  buildInputs = [ libbacktrace ];
+
   nativeBuildInputs = [
     autoreconfHook269
     gettext
@@ -168,12 +189,15 @@ stdenv.mkDerivation (finalAttrs: {
     "cross_compiling=true"
     "--disable-multilib"
 
+    "--with-system-libbacktrace"
+
     # `gnu` is the glibc locale model: `config/locale/gnu/ctype_members.cc`
     # reads `__ctype_b`, which only glibc has. Forcing it everywhere breaks any
     # other libc -- on musl the build fails converting `const unsigned short *`
     # to `const ctype_base::mask *`. Configure picks the right model from the
     # host triple on its own, as it does for the monolithic build, which passes
     # no `--enable-clocale` at all.
+
     "--disable-libstdcxx-pch"
     "--disable-vtable-verify"
     "--enable-libstdcxx-visibility"
diff --git a/pkgs/development/compilers/jetbrains-jdk/21.nix b/pkgs/development/compilers/jetbrains-jdk/21.nix
index 821202d6da21..55a2b5ee4d19 100644
--- a/pkgs/development/compilers/jetbrains-jdk/21.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/21.nix
@@ -21,6 +21,5 @@ callPackage ./common.nix
     # run `git log -1 --pretty=%ct` in jdk repo for new value on update
     sourceDateEpoch = 1765114563;
     srcHash = "sha256-Qmffu7p6frBoH2Zh+EiqvEoMNNBE79qfkgLSC3+XuI0=";
-    homePath = "${jetbrains.jdk-21}/lib/openjdk";
     jcefPackage = jetbrains.jcef-21;
   }
diff --git a/pkgs/development/compilers/jetbrains-jdk/common.nix b/pkgs/development/compilers/jetbrains-jdk/common.nix
index 4a685776d46a..5c384711c3e6 100644
--- a/pkgs/development/compilers/jetbrains-jdk/common.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/common.nix
@@ -35,7 +35,6 @@
   build,
   sourceDateEpoch,
   srcHash,
-  homePath,
   jcefPackage ? null,
   extraBuildPhase ? "",
   vendorVersionString ? null,
@@ -182,13 +181,15 @@ jdk.overrideAttrs (oldAttrs: {
       if [ "$output" = debug ]; then continue; fi
       LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
     done
-    # Add the local library paths to remove dependencies on the bootstrap
+    # Add the local library paths and drop rpath entries pointing at the
+    # boot JDK
     for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
       if [ "$output" = debug ]; then continue; fi
       OUTPUTDIR=$(eval echo \$$output)
       BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
       echo "$BINLIBS" | while read i; do
-        patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+        OLD_RPATH="$(patchelf --print-rpath "$i" 2>/dev/null | tr ':' '\n' | grep -v "^${jdk}" | tr '\n' ':')" || true
+        patchelf --set-rpath "$LIBDIRS:''${OLD_RPATH%:}" "$i" || true
       done
     done
   '';
@@ -229,8 +230,4 @@ jdk.overrideAttrs (oldAttrs: {
 
     broken = stdenv.hostPlatform.isDarwin;
   };
-
-  passthru = oldAttrs.passthru // {
-    home = homePath;
-  };
 })
diff --git a/pkgs/development/compilers/jetbrains-jdk/default.nix b/pkgs/development/compilers/jetbrains-jdk/default.nix
index 0bd358489aa9..3ac13b17a69e 100644
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@@ -40,7 +40,6 @@ callPackage ./common.nix
     # run `git log -1 --pretty=%ct` in jdk repo for new value on update
     sourceDateEpoch = 1780959777;
     srcHash = "sha256-N+7D++Cxu0RGWChEWW8gtNz7E2I8qM2AFbXv4luAXto=";
-    homePath = "${jetbrains.jdk}/lib/openjdk";
     jcefPackage = jetbrains.jcef;
     extraBuildPhase = ''
       cp -r ${gtk-protocols.out} gtk-shell.xml
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index f7f8a8d1fbee..af9fcec0eb7e 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -28,8 +28,6 @@ let
   versionMap = {
     # Necessary for Nyxt
     "2.4.6".sha256 = "sha256-pImQeELa4JoXJtYphb96VmcKrqLz7KH7cCO8pnw/MJE=";
-    # Necessary for stumpwm
-    "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg=";
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
     "2.6.6".sha256 = "sha256-plp6MIEqr1SSXRGSubnoEPUnx5kRxgALdUgQWu99o0s=";
diff --git a/pkgs/development/compilers/smlnj/default.nix b/pkgs/development/compilers/smlnj/default.nix
index 0882b425b7e0..2906d9ca6da9 100644
--- a/pkgs/development/compilers/smlnj/default.nix
+++ b/pkgs/development/compilers/smlnj/default.nix
@@ -1,100 +1,96 @@
 {
   lib,
   stdenv,
+  callPackage,
+  fetchFromGitHub,
   fetchurl,
+  automake,
+  autoconf,
+  versionCheckHook,
 }:
 let
-  version = "110.99.9";
-  baseurl = "https://smlnj.cs.uchicago.edu/dist/working/${version}";
+  version = "2026.1";
+  src = fetchFromGitHub {
+    owner = "smlnj";
+    repo = "smlnj";
+    tag = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-n5oWhignhFl8B/cXSO3g/KQXInZqT1A0Mp8GzLeGqNc=";
+  };
 
-  arch = if stdenv.hostPlatform.is64bit then "64" else "32";
+  llvm = callPackage ./llvm.nix { inherit src version; };
 
-  hashes = builtins.fromJSON (builtins.readFile ./hashes.json);
-
-  fetchSource =
-    name:
-    fetchurl {
-      url = "${baseurl}/${name}";
-      hash = hashes.${name};
-    };
-
-  bootSource = if stdenv.hostPlatform.is64bit then "boot.amd64-unix.tgz" else "boot.x86-unix.tgz";
-
-  sources = map fetchSource [
-    bootSource
-    "config.tgz"
-    "cm.tgz"
-    "compiler.tgz"
-    "runtime.tgz"
-    "system.tgz"
-    "MLRISC.tgz"
-    "smlnj-lib.tgz"
-    "old-basis.tgz"
-    "ckit.tgz"
-    "nlffi.tgz"
-    "cml.tgz"
-    "eXene.tgz"
-    "ml-lpt.tgz"
-    "ml-lex.tgz"
-    "ml-yacc.tgz"
-    "ml-burg.tgz"
-    "pgraph.tgz"
-    "trace-debug-profile.tgz"
-    "heap2asm.tgz"
-    "smlnj-c.tgz"
-    "doc.tgz"
-    "asdl.tgz"
-  ];
+  bootFile =
+    if stdenv.hostPlatform.isUnix && stdenv.hostPlatform.isx86_64 then
+      fetchurl {
+        url = "https://smlnj.cs.uchicago.edu/dist/working/${version}/boot.amd64-unix.tgz";
+        hash = "sha256-caFguKkhFOjgJDtcOcF6YAbzFl2nQYXbtWCjvaBjL6o=";
+      }
+    else if stdenv.hostPlatform.isUnix && stdenv.hostPlatform.isAarch64 then
+      fetchurl {
+        url = "https://smlnj.cs.uchicago.edu/dist/working/${version}/boot.arm64-unix.tgz";
+        hash = "sha256-qygH0n163jiwm4CsltPeCCpHqnBxCHKP5O20GZyq1/0=";
+      }
+    else
+      throw "Unsupported host platform: ${stdenv.hostPlatform.config}";
 
 in
 stdenv.mkDerivation {
   pname = "smlnj";
-  inherit version sources;
+  inherit src version;
 
-  unpackPhase = ''
-    for s in $sources; do
-      b=$(basename $s)
-      cp $s ''${b#*-}
-    done
-    unpackFile config.tgz
-    mkdir base
-    ./config/unpack $TMP runtime
-  '';
+  nativeBuildInputs = [
+    autoconf
+    automake
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   patchPhase = ''
-    sed -i '/^PATH=/d' config/_arch-n-opsys base/runtime/config/gen-posix-names.sh
-    echo SRCARCHIVEURL="file:/$TMP" > config/srcarchiveurl
+    runHook prePatch
+
+    unpackFile ${bootFile}
+    mkdir -pv runtime/bin runtime/lib
+    ln -s ${llvm}/bin/llvm-config     runtime/bin/llvm-config
+    ln -s ${llvm}/lib/libCFGCodeGen.a runtime/lib/libCFGCodeGen.a
+
+    runHook postPatch
   '';
 
   buildPhase = ''
-    ./config/install.sh -default ${arch}
-  '';
+    runHook preBuild
 
-  installPhase = ''
+    export INSTALLDIR=$out
     mkdir -pv $out
-    cp -rv bin lib $out
+    ./build.sh
 
-    cd $out/bin
-    for i in *; do
-      sed -i "2iSMLNJ_HOME=$out/" $i
-    done
+    runHook postBuild
   '';
 
-  passthru.updateScript = ./update.sh;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "@SMLversion";
+  doInstallCheck = true;
+
+  passthru.llvm = llvm;
 
   meta = {
-    description = "Standard ML of New Jersey, a compiler";
-    homepage = "http://smlnj.org";
+    description = "Standard ML of New Jersey, a Standard ML compiler";
+    homepage = "https://smlnj.org";
+    downloadPage = "https://smlnj.org/dist/working/${version}/install.html";
+    changelog = "https://smlnj.org/dist/working/${version}/README.html";
     license = lib.licenses.bsd3;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryNativeCode
+    ];
+    maintainers = [ lib.maintainers.skyesoss ];
+    mainProgram = "sml";
     platforms = [
       "x86_64-linux"
-      "i686-linux"
+      "aarch64-linux"
       "aarch64-darwin"
     ];
-    maintainers = with lib.maintainers; [
-      skyesoss
-      thoughtpolice
-    ];
-    mainProgram = "sml";
+    broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
   };
 }
diff --git a/pkgs/development/compilers/smlnj/llvm.nix b/pkgs/development/compilers/smlnj/llvm.nix
new file mode 100644
index 000000000000..f07c9391e614
--- /dev/null
+++ b/pkgs/development/compilers/smlnj/llvm.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  git,
+  python3,
+  ninja,
+  src,
+  version,
+}:
+let
+  targets =
+    lib.optional stdenv.targetPlatform.isx86_64 "X86"
+    ++ lib.optional stdenv.targetPlatform.isAarch64 "AArch64";
+in
+stdenv.mkDerivation {
+  pname = "smlnj-llvm";
+  inherit src version;
+  sourceRoot = "${src.name}/runtime/llvm21";
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    cmake
+    git
+    python3
+    ninja
+  ];
+
+  cmakeFlags = [
+    "--preset=smlnj-llvm-release"
+    (lib.cmakeFeature "LLVM_TARGETS_TO_BUILD" (lib.concatStringsSep ";" targets))
+    (lib.cmakeBool "LLVM_ENABLE_DUMP" true)
+  ];
+
+  meta = {
+    description = "Custom LLVM for Standard ML of New Jersey";
+    homepage = "https://smlnj.org";
+    license = lib.licenses.bsd3;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
+    maintainers = with lib.maintainers; [
+      skyesoss
+    ];
+  };
+}
diff --git a/pkgs/development/libraries/gtksourceview/3.x.nix b/pkgs/development/libraries/gtksourceview/3.x.nix
index 4b64f435c72a..69021bdcfa07 100644
--- a/pkgs/development/libraries/gtksourceview/3.x.nix
+++ b/pkgs/development/libraries/gtksourceview/3.x.nix
@@ -24,6 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
   version = "3.24.11";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src =
     let
       inherit (finalAttrs) pname version;
@@ -51,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     perl
     gobject-introspection
     vala
+    libxml2 # xmllint
   ];
 
   nativeCheckInputs = [
@@ -81,11 +85,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = stdenv.hostPlatform.isLinux;
   checkPhase = ''
+    runHook preCheck
+
     NO_AT_BRIDGE=1 \
     XDG_DATA_DIRS="$XDG_DATA_DIRS:${shared-mime-info}/share" \
     xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
       --config-file=${dbus}/share/dbus-1/session.conf \
       make check
+
+    runHook postCheck
   '';
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/development/libraries/gtksourceview/4.x.nix b/pkgs/development/libraries/gtksourceview/4.x.nix
index aa57a11453f7..74c2c68efada 100644
--- a/pkgs/development/libraries/gtksourceview/4.x.nix
+++ b/pkgs/development/libraries/gtksourceview/4.x.nix
@@ -28,6 +28,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
   version = "4.8.4";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   outputs = [
     "out"
     "dev"
@@ -70,6 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     perl
     gobject-introspection
     vala
+    libxml2 # xmllint
   ];
 
   buildInputs = [
@@ -100,9 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "if generate_vapi" "if false"
   '';
 
-  # Broken by PCRE 2 bump in GLib.
-  # https://gitlab.gnome.org/GNOME/gtksourceview/-/issues/283
-  doCheck = false;
+  doCheck = stdenv.hostPlatform.isLinux;
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/development/libraries/gtksourceview/5.x.nix b/pkgs/development/libraries/gtksourceview/5.x.nix
index 4e63c082a5ad..e75b616bbb55 100644
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "gtksourceview";
   version = "5.20.0";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   outputs = [
     "out"
     "dev"
@@ -55,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     vala
     gi-docgen
     gtk4 # for gtk4-update-icon-cache checked during configure
+    libxml2 # xmllint
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index 1892cbdaa803..c72fb989532f 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -260,7 +260,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS";
     description = "Set of libraries for development of security-enabled client and server applications";
-    changelog = "https://github.com/mozilla/nss/blob/master/doc/rst/releases/nss_${underscoreVersion}.rst";
+    changelog = "https://github.com/mozilla/nss/blob/master/doc/src/releases/nss_${underscoreVersion}.md";
     maintainers = with lib.maintainers; [
       hexa
       ajs124
diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index 81261040032a..4bbe446610e2 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -5,8 +5,8 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.126";
-  hash = "sha256-+yiBEc8WLZ6qiO8MBQBiIXfm4OEJ9EFgmw2rY+U/bp8=";
+  version = "3.127";
+  hash = "sha256-SiaKDkDTHqhTCs/pcwOAk0lgIayeMKOwGLAZr9WKS4Q=";
   filename = "latest.nix";
   versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/ocaml-modules/sqlite3/default.nix b/pkgs/development/ocaml-modules/sqlite3/default.nix
index b7aaadbb3d94..f6f368de6b82 100644
--- a/pkgs/development/ocaml-modules/sqlite3/default.nix
+++ b/pkgs/development/ocaml-modules/sqlite3/default.nix
@@ -9,13 +9,13 @@
 
 buildDunePackage rec {
   pname = "sqlite3";
-  version = "5.3.1";
+  version = "5.4.1";
   duneVersion = "3";
   minimalOCamlVersion = "4.12";
 
   src = fetchurl {
     url = "https://github.com/mmottl/sqlite3-ocaml/releases/download/${version}/sqlite3-${version}.tbz";
-    hash = "sha256-Ox8eZS4r6PbJh8nei52ftUyf25SKwIUMi5UEv4L+6mE=";
+    hash = "sha256-cp7Bk/sZkrsaK85nNq28gqpb20XUHIy3FfhNVmOiYTU=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 1c68f44e324d..1939b406b46c 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -188,7 +188,7 @@ buildPythonPackage (finalAttrs: {
 
   # Disable on aarch64-linux due to broken onnxruntime
   # https://github.com/microsoft/onnxruntime/issues/10038
-  pythonImportsCheck = lib.optionals finalAttrs.doCheck [ "chromadb" ];
+  pythonImportsCheck = lib.optionals finalAttrs.finalPackage.doCheck [ "chromadb" ];
 
   # Test collection breaks on aarch64-linux
   doCheck = with stdenv.buildPlatform; !(isAarch && isLinux);
diff --git a/pkgs/development/python-modules/comfy-kitchen/default.nix b/pkgs/development/python-modules/comfy-kitchen/default.nix
index 4c90d1f39877..dbf5ab8991ec 100644
--- a/pkgs/development/python-modules/comfy-kitchen/default.nix
+++ b/pkgs/development/python-modules/comfy-kitchen/default.nix
@@ -17,14 +17,15 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "comfy-kitchen";
-  version = "0.2.30";
+  version = "0.2.31";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Comfy-Org";
     repo = "comfy-kitchen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n4U7AQQgDtEM5QBTia9V2WSP+CEnpG/Z+tp7I+YyCYA=";
+    fetchSubmodules = true;
+    hash = "sha256-apa7N9Y0bt4fpbMTP0qRUC0QnMuJvoxoCOeWONWCExo=";
   };
 
   buildInputs = lib.optionals cudaSupport (
diff --git a/pkgs/development/python-modules/comfyui-workflow-templates-core/default.nix b/pkgs/development/python-modules/comfyui-workflow-templates-core/default.nix
index 4200b4d2233f..deb4225b8347 100644
--- a/pkgs/development/python-modules/comfyui-workflow-templates-core/default.nix
+++ b/pkgs/development/python-modules/comfyui-workflow-templates-core/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comfyui-workflow-templates-core";
-  version = "0.3.307";
+  version = "0.3.312";
   pyproject = true;
 
   src = fetchPypi {
     pname = "comfyui_workflow_templates_core";
     inherit (finalAttrs) version;
-    hash = "sha256-GIvshis5CvvmuY4IvEziIWSWo5DRg4s6RYpd2MnBGuE=";
+    hash = "sha256-OWhVWGEqf3cZRH1njGLpk6LcAme32JtZZ5mBO875/Zo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/comfyui-workflow-templates-json/default.nix b/pkgs/development/python-modules/comfyui-workflow-templates-json/default.nix
index aad214946a3a..9c09fa53fc0d 100644
--- a/pkgs/development/python-modules/comfyui-workflow-templates-json/default.nix
+++ b/pkgs/development/python-modules/comfyui-workflow-templates-json/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comfyui-workflow-templates-json";
-  version = "0.1.42";
+  version = "0.1.47";
   pyproject = true;
 
   src = fetchPypi {
     pname = "comfyui_workflow_templates_json";
     inherit (finalAttrs) version;
-    hash = "sha256-Plyqq6rXdSWJc+NHs7rDRdFrYlaSWSWm/+DXMd7/q3I=";
+    hash = "sha256-BHqYrvNcphUsqY9K09xg8Yev52TTt0Fr5QW7LnFzLPk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/comfyui-workflow-templates-media-assets-01/default.nix b/pkgs/development/python-modules/comfyui-workflow-templates-media-assets-01/default.nix
index b420467457ce..060161bb3bb3 100644
--- a/pkgs/development/python-modules/comfyui-workflow-templates-media-assets-01/default.nix
+++ b/pkgs/development/python-modules/comfyui-workflow-templates-media-assets-01/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comfyui-workflow-templates-media-assets-01";
-  version = "0.1.26";
+  version = "0.1.28";
   pyproject = true;
 
   src = fetchPypi {
     pname = "comfyui_workflow_templates_media_assets_01";
     inherit (finalAttrs) version;
-    hash = "sha256-mjjf45ybwP8ymOxhoHRqEsgNewtF4BhKLpFeDje946M=";
+    hash = "sha256-GVqoISv6e2yhOmX9JihGEkRAZFW/kRbobdZpWszkmWA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/comfyui-workflow-templates/default.nix b/pkgs/development/python-modules/comfyui-workflow-templates/default.nix
index 2859d44b3b48..799ba072816f 100644
--- a/pkgs/development/python-modules/comfyui-workflow-templates/default.nix
+++ b/pkgs/development/python-modules/comfyui-workflow-templates/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comfyui-workflow-templates";
-  version = "0.11.39";
+  version = "0.11.41";
   pyproject = true;
 
   src = fetchPypi {
     pname = "comfyui_workflow_templates";
     inherit (finalAttrs) version;
-    hash = "sha256-1RGGThxYFKlheesrlsLQV5+ynX6LnqFBU+qcGsCW0EI=";
+    hash = "sha256-vzTTCvGVM9ckvF9mSY5umpZ784CfScEcLiNrzJAq/N0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-payments/default.nix b/pkgs/development/python-modules/django-payments/default.nix
index 804dd0048019..0916cd8467c1 100644
--- a/pkgs/development/python-modules/django-payments/default.nix
+++ b/pkgs/development/python-modules/django-payments/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "django-payments";
-  version = "4.0.0";
+  version = "4.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "django-payments";
     tag = "v${version}";
-    hash = "sha256-AWWgjLIt3uG5QUVkHLaxWVwqq2dfuPbxUn8VwqMlPwo=";
+    hash = "sha256-vEmmX+IjE6HaIq/i1h2xc5ArkNlenVhD19mBgHvvmbM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/gftools/default.nix b/pkgs/development/python-modules/gftools/default.nix
index 2c4419985cd1..e13b7af1b60e 100644
--- a/pkgs/development/python-modules/gftools/default.nix
+++ b/pkgs/development/python-modules/gftools/default.nix
@@ -58,14 +58,14 @@ let
 in
 buildPythonPackage rec {
   pname = "gftools";
-  version = "0.9.998";
+  version = "0.9.999";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "gftools";
     tag = "v${version}";
-    hash = "sha256-wR2X1IEeEbQpedAgA44Es7CE/yCOs3TJemMYuL15fWw=";
+    hash = "sha256-jKd/i0qXzPJNOxzO2Ds3BxP2RDoelNhKutqeaz/yQww=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/glueviz/default.nix b/pkgs/development/python-modules/glueviz/default.nix
index f9485e0b62e3..4c698cf396b1 100644
--- a/pkgs/development/python-modules/glueviz/default.nix
+++ b/pkgs/development/python-modules/glueviz/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "glueviz";
-  version = "1.24.1";
+  version = "1.27.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "glue-viz";
     repo = "glue";
     tag = "v${version}";
-    hash = "sha256-21XFH1fIt8vLd0blZJn6ZRmLJaof/E30zHrBVLjXOaA=";
+    hash = "sha256-9uILbcf/Fy0GT4WG+NuGKmbiQIjrAFeOlCCYau1mHqg=";
   };
 
   buildInputs = [ pyqt-builder ];
diff --git a/pkgs/development/python-modules/jupyterlab/default.nix b/pkgs/development/python-modules/jupyterlab/default.nix
index 14f3391f329d..936e2cb8474e 100644
--- a/pkgs/development/python-modules/jupyterlab/default.nix
+++ b/pkgs/development/python-modules/jupyterlab/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyterlab";
-  version = "4.5.8";
+  version = "4.5.10";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
     owner = "jupyterlab";
     repo = "jupyterlab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OtytFZdgGzbQF3icglwRpAn0HhJNyjI6oNS01gfpzkA=";
+    hash = "sha256-MEAZNahss5NpHJmYVFCTRvcdSq2Rx4xP6p8k5zeWyCg=";
   };
 
   nativeBuildInputs = [
@@ -46,7 +46,7 @@ buildPythonPackage (finalAttrs: {
   offlineCache = yarn-berry_3.fetchYarnBerryDeps {
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/jupyterlab/staging";
-    hash = "sha256-wgqwEl01VinYU5haL1X8Na1lNNcyqCfRaRBze4ypPPo=";
+    hash = "sha256-i0ZoLjUt0w/C62XzoN4wp6l7m3M8Nz/VfyDFIRYSSE0=";
   };
 
   preBuild = ''
@@ -77,7 +77,7 @@ buildPythonPackage (finalAttrs: {
   makeWrapperArgs = [
     "--set"
     "JUPYTERLAB_DIR"
-    "$out/share/jupyter/lab"
+    "${placeholder "out"}/share/jupyter/lab"
   ];
 
   # Depends on npm
diff --git a/pkgs/development/python-modules/langchain-sail/default.nix b/pkgs/development/python-modules/langchain-sail/default.nix
new file mode 100644
index 000000000000..425d663345cd
--- /dev/null
+++ b/pkgs/development/python-modules/langchain-sail/default.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  langchain-core,
+  langchain-community,
+  langchain-classic,
+
+  # tests
+  pytestCheckHook,
+  pytest-asyncio,
+
+  # passthru
+  nix-update-script,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "langchain-sail";
+  version = "0.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "lakehq";
+    repo = "langchain-sail";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-geXv2vzvRyjVyslTam1yIkRsgmyTr5A84BIVsqXODes=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    langchain-core
+    langchain-community
+    langchain-classic
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  # The integration tests need pyspark-client (not packaged) and a running Sail
+  # server, so only the unit tests can run in the sandbox.
+  enabledTestPaths = [ "tests/unit_tests" ];
+
+  pythonImportsCheck = [ "langchain_sail" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "LangChain integration for Sail, a Spark-compatible compute engine on Apache Arrow and DataFusion";
+    homepage = "https://github.com/lakehq/langchain-sail";
+    changelog = "https://github.com/lakehq/langchain-sail/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.davidlghellin ];
+  };
+})
diff --git a/pkgs/development/python-modules/nixl/default.nix b/pkgs/development/python-modules/nixl/default.nix
index 9430aa850c5e..0fcf38c6ec4c 100644
--- a/pkgs/development/python-modules/nixl/default.nix
+++ b/pkgs/development/python-modules/nixl/default.nix
@@ -63,13 +63,18 @@ buildPythonPackage.override { inherit (nixl) stdenv; } (finalAttrs: {
     torch
   ];
 
-  # Install the `nixl` shim module (re-exports nixl_cu{12,13}).
-  # Upstream builds this as a separate wheel via `uv build` (nixl-meta), but that doesn't work in
+  # Install the `nixl` shim module (re-exports nixl_cu{12,13}) along with its `nixl_meta_utils`
+  # helper.
+  # Upstream builds these as a separate wheel via `uv build` (nixl-meta), but that doesn't work in
   # the sandbox.
   postInstall = ''
     install -Dm644 \
       src/bindings/python/nixl-meta/nixl/__init__.py \
       "$out/${python.sitePackages}/nixl/__init__.py"
+
+    install -Dm644 \
+      src/bindings/python/nixl-meta/nixl_meta_utils.py \
+      "$out/${python.sitePackages}/nixl_meta_utils.py"
   '';
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/prefect/default.nix b/pkgs/development/python-modules/prefect/default.nix
index 900f3de319e8..4bcc471e36f8 100644
--- a/pkgs/development/python-modules/prefect/default.nix
+++ b/pkgs/development/python-modules/prefect/default.nix
@@ -108,7 +108,7 @@ buildPythonPackage (finalAttrs: {
         'default-version = "3.6.24+nogit"' \
         'default-version = "${finalAttrs.version}"'
   ''
-  + lib.optionalString finalAttrs.doCheck ''
+  + lib.optionalString finalAttrs.finalPackage.doCheck ''
     substituteInPlace src/prefect/__init__.py \
       --replace-fail \
         '__development_base_path__: pathlib.Path = __module_path__.parents[1]' \
diff --git a/pkgs/development/python-modules/pycep-parser/default.nix b/pkgs/development/python-modules/pycep-parser/default.nix
index 775fb4a3a335..77d8f1992614 100644
--- a/pkgs/development/python-modules/pycep-parser/default.nix
+++ b/pkgs/development/python-modules/pycep-parser/default.nix
@@ -13,22 +13,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycep-parser";
-  version = "0.7.0";
+  version = "0.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gruebel";
     repo = "pycep";
     tag = finalAttrs.version;
-    hash = "sha256-pEFgpLfGcJhUWfs/nG1r7GfIS045cfNh7MVQokluXmM=";
+    hash = "sha256-Z7OJWnVXINo4vdAVCm60l3TaoegKqaavG9pOsc+0NX4=";
   };
 
   build-system = [ uv-build ];
 
-  # We can't use pythonRelaxDeps to relax the build-system
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "uv_build~=0.9.0" "uv_build"
+      --replace-fail "uv-build~=0.12.0" "uv-build"
   '';
 
   nativeBuildInputs = [ pyprojectVersionPatchHook ];
diff --git a/pkgs/development/python-modules/scheduler/default.nix b/pkgs/development/python-modules/scheduler/default.nix
index 493d59fdc591..af14bdc9214b 100644
--- a/pkgs/development/python-modules/scheduler/default.nix
+++ b/pkgs/development/python-modules/scheduler/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "scheduler";
-  version = "0.8.8";
+  version = "0.8.11";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RXWhLNJp5OSJZAmDb9kRVgy2P7djQ2DuYqovpOxJX/0=";
+    hash = "sha256-siNKBpRIphervFEbnhj0jE3rPc2dzFFyHZyQ7ylDtyo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix b/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
index 802082fd6bfa..75e11a4fdc05 100644
--- a/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
+++ b/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
@@ -54,7 +54,9 @@ buildPythonPackage (finalAttrs: {
 
   # When doCheck is disabled, nnativeCheckInputs are not available and the package fails to import:
   #   ModuleNotFoundError: No module named 'snakemake'
-  pythonImportsCheck = lib.optionals finalAttrs.doCheck [ "snakemake_storage_plugin_xrootd" ];
+  pythonImportsCheck = lib.optionals finalAttrs.finalPackage.doCheck [
+    "snakemake_storage_plugin_xrootd"
+  ];
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/starfile/default.nix b/pkgs/development/python-modules/starfile/default.nix
new file mode 100644
index 000000000000..97ecdca4f31f
--- /dev/null
+++ b/pkgs/development/python-modules/starfile/default.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+  hatch-vcs,
+
+  # dependencies
+  numpy,
+  pandas,
+  pyarrow,
+
+  # tests
+  typing-extensions,
+  pytestCheckHook,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "starfile";
+  version = "0.5.13";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "teamtomo";
+    repo = "starfile";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-klGGDvfRIBAwUoPvEG5qYukzWO94otUmBoMIkjf307I=";
+  };
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  nativeCheckInputs = [
+    typing-extensions
+    pytestCheckHook
+  ];
+
+  dependencies = [
+    numpy
+    pandas
+    pyarrow
+  ];
+
+  disabledTestPaths = [
+    # These tests assume string columns use the NumPy object dtype.
+    # Pandas 3 now uses StringDtype instead.
+    "tests/test_parsing.py::test_quote_loop"
+    "tests/test_parsing.py::test_parse_as_string"
+
+    # recent Pandas may return a read-only array from .values, which breaks the test
+    "tests/test_parsing.py::test_parse_na"
+  ];
+
+  pythonImportsCheck = [ "starfile" ];
+
+  meta = {
+    changelog = "https://github.com/teamtomo/starfile/releases/tag/v${finalAttrs.version}";
+    description = "STAR file I/O in Python";
+    homepage = "https://teamtomo.org/starfile";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ rdk31 ];
+  };
+})
diff --git a/pkgs/development/python-modules/zm-py/default.nix b/pkgs/development/python-modules/zm-py/default.nix
index 38d6b5c705c0..395d18d07691 100644
--- a/pkgs/development/python-modules/zm-py/default.nix
+++ b/pkgs/development/python-modules/zm-py/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "zm-py";
-  version = "0.5.4";
+  version = "0.5.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rohankapoorcom";
     repo = "zm-py";
     tag = "v${version}";
-    hash = "sha256-n9FRX2Pnn96H0HVT4SHLJgONc0XzQ005itMNpvl9IYg=";
+    hash = "sha256-0AfRgznm+6/ttZ5V5Tuh+5QG2b3BfMLNQMvlH0yTnr8=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index f645cf6dd4cf..95d589220a20 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -364,14 +364,7 @@ in
       '';
     };
 
-  ubootNanoPCT4 = buildUBoot rec {
-    rkbin = fetchFromGitHub {
-      owner = "armbian";
-      repo = "rkbin";
-      rev = "3bd0321cae5ef881a6005fb470009ad5a5d1462d";
-      sha256 = "09r4dzxsbs3pff4sh70qnyp30s3rc7pkc46v1m3152s7jqjasp31";
-    };
-
+  ubootNanoPCT4 = buildUBoot {
     defconfig = "nanopc-t4-rk3399_defconfig";
 
     extraMeta = {
@@ -383,10 +376,6 @@ in
       "u-boot.itb"
       "idbloader.img"
     ];
-    postBuild = ''
-      ./tools/mkimage -n rk3399 -T rksd -d ${rkbin}/rk33/rk3399_ddr_800MHz_v1.24.bin idbloader.img
-      cat ${rkbin}/rk33/rk3399_miniloader_v1.19.bin >> idbloader.img
-    '';
   };
 
   ubootNanoPCT6 = buildUBoot {
diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 069fb6cd4d66..0e1b774515d7 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -569,7 +569,8 @@ lib.makeOverridable (
           "riscv32-linux"
           "riscv64-linux"
         ]
-        ++ lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
+        # Generic scripts/install.sh is only available on LoongArch64 since 6.16.
+        ++ lib.optional (lib.versionOlder version "6.16") "loongarch64-linux";
       timeout = 14400; # 4 hours
       identifiers.cpeParts = {
         part = "o";
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 63ab1afbe697..6a7b4b0b7475 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -789,7 +789,7 @@ stdenv.mkDerivation (finalAttrs: {
           systemd-repart-basic
           systemd-repart-create-root
           systemd-repart-encrypt-tpm2
-          # systemd-repart-factory-reset # broken upstream
+          systemd-repart-factory-reset
           ;
       }
       // {
@@ -798,11 +798,11 @@ stdenv.mkDerivation (finalAttrs: {
           fsck-systemd-stage-1
           hibernate-systemd-stage-1
           switchTest
-          # systemd # broken on master
+          systemd
           systemd-analyze
           systemd-bpf
           systemd-confinement
-          # systemd-coredump # broken on master
+          systemd-coredump
           systemd-cryptenroll
           systemd-credentials-tpm2
           systemd-escaping
@@ -821,7 +821,7 @@ stdenv.mkDerivation (finalAttrs: {
           systemd-initrd-networkd-openvpn
           systemd-initrd-vlan
           systemd-journal
-          # systemd-journal-gateway # broken on master
+          systemd-journal-gateway
           systemd-journal-upload
           # systemd-machinectl # broken on master
           systemd-networkd
@@ -842,12 +842,13 @@ stdenv.mkDerivation (finalAttrs: {
           systemd-sysusers-mutable
           systemd-sysusers-immutable
           systemd-sysusers-password-option-override-ordering
-          # systemd-timesyncd-nscd-dnssec # broken on master
+          systemd-timesyncd
+          systemd-timesyncd-nscd-dnssec
           systemd-user-linger
           systemd-user-tmpfiles-rules
           systemd-misc
           systemd-userdbd
-          # systemd-homed # broken on master
+          systemd-homed
           ;
       };
 
diff --git a/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix b/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix
index 0242678f4cd8..8b44b118290d 100644
--- a/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "dummylabs";
   domain = "watchman";
-  version = "0.8.3";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "dummylabs";
     repo = "thewatchman";
     tag = "v${version}";
-    hash = "sha256-5BXIKh8uPKuxsLbxu0fUbuCR2LYOXk1HpOvrqehg0u0=";
+    hash = "sha256-y9Qug+ftJDZXUHCsmx+/KqauczoHPPHiCtnnngdJBu8=";
   };
 
   ignoreVersionRequirement = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 821d764c5b56..a086ec1d5fc9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1051,6 +1051,7 @@ mapAliases {
   graphia = throw "'graphia' has been removed due to being unmaintained and broken"; # Added 2026-05-05
   graphite-gtk-theme = throw "'graphite-gtk-theme' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
   graphite-kde-theme = throw "'graphite-kde-theme' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
+  grig = throw "'grig' has been removed as it depended on the deprecated GTK 2 engine."; # Added 2026-08-14
   gringo = throw "'gringo' has been renamed to/replaced by 'clingo'"; # Converted to throw 2025-10-27
   grip = throw "'grip' has been removed because it depended on the deprecated GTK2 engine."; # Added 2026-07-30
   grub2_full = throw "'grub2_full' has been renamed to/replaced by 'grub2'"; # Converted to throw 2025-10-27
@@ -1682,6 +1683,7 @@ mapAliases {
   msalsdk-dbusclient = throw "'msalsdk-dbusclient' has been removed, as it is no longer needed by 'intune-portal'"; # Added 2026-02-11
   msgpack = throw "msgpack has been split into msgpack-c and msgpack-cxx"; # Added 2025-09-14
   msp430NewlibCross = throw "'msp430NewlibCross' has been renamed to/replaced by 'msp430Newlib'"; # Converted to throw 2025-10-27
+  mtpfs = throw "'mtpfs' has been removed as it is unmaintained, and depends on the unmaintained fuse2 library"; # Added 2026-08-05
   mullvad-closest = throw "'mullvad-closest' has been removed as it was unmaintained. Consider using 'mullvad-compass' instead."; # Added 2026-01-13
   multipass = throw "multipass was dropped since it was unmaintained."; # Added 2025-11-29
   mumps_par = throw "'mumps_par' has been renamed to/replaced by 'mumps-mpi'"; # Converted to throw 2025-10-27
@@ -2147,6 +2149,7 @@ mapAliases {
   rke2_1_31 = throw "'rke2_1_31' has been removed from nixpkgs as it has reached end of life"; # Added 2025-12-08
   rke2_1_32 = throw "'rke2_1_32' has been removed from nixpkgs as it has reached end of life"; # Added 2026-04-04
   rl_json = throw "'rl_json' has been renamed to/replaced by 'tclPackages.rl_json'"; # Converted to throw 2025-10-27
+  roam-research = throw "'roam-research' has been removed from nixpkgs due to lack of maintenance"; # Added 2026-08-14
   rockbox_utility = throw "'rockbox_utility' has been renamed to/replaced by 'rockbox-utility'"; # Converted to throw 2025-10-27
   rockcraft = throw "rockcraft was removed in Sep 25 following removal of LXD from nixpkgs"; # Added 2025-09-18
   rofi-emoji-wayland = throw "'rofi-emoji-wayland' has been merged into `rofi-emoji as 'rofi-wayland' has been merged into 'rofi'"; # Added 2025-09-06
@@ -2425,6 +2428,7 @@ mapAliases {
   tibia = throw "'tibia' has been removed from nixpkgs due to being broken and unmaintained"; # Added 2026-05-16
   ticpp = throw "'ticpp' has been removed due to being unmaintained"; # Added 2025-09-10
   tidb = throw "TiDB has been removed because of hard dependency on TiKV which is challenging to package"; # Added 2026-05-03
+  timemachine = throw "'timemachine' has been removed as it depended on the deprecated GTK 2 engine"; # Added 2026-08-13
   timescaledb = throw "'timescaledb' has been removed. Use 'postgresqlPackages.timescaledb' instead."; # Added 2025-07-19
   tinyxml2 = throw "The 'tinyxml2' alias has been removed, use 'tinyxml' for https://sourceforge.net/projects/tinyxml/ or 'tinyxml-2' for https://github.com/leethomason/tinyxml2"; # Added 2025-10-11
   tkcvs = throw "'tkcvs' has been renamed to/replaced by 'tkrev'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 17754b9aa31d..ec92562a1abc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2608,10 +2608,6 @@ with pkgs;
 
   open-interpreter = with python3Packages; toPythonApplication open-interpreter;
 
-  openmvs = callPackage ../applications/science/misc/openmvs {
-    inherit (llvmPackages) openmp;
-  };
-
   openntpd_nixos = openntpd.override {
     privsepUser = "ntp";
     privsepPath = "/var/empty";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 47a7d798790d..8717864e0e09 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9069,6 +9069,8 @@ self: super: with self; {
 
   langchain-protocol = callPackage ../development/python-modules/langchain-protocol { };
 
+  langchain-sail = callPackage ../development/python-modules/langchain-sail { };
+
   langchain-tests = callPackage ../development/python-modules/langchain-tests { };
 
   langchain-text-splitters = callPackage ../development/python-modules/langchain-text-splitters { };
@@ -19613,6 +19615,8 @@ self: super: with self; {
 
   stanza = callPackage ../development/python-modules/stanza { };
 
+  starfile = callPackage ../development/python-modules/starfile { };
+
   starkbank-ecdsa = callPackage ../development/python-modules/starkbank-ecdsa { };
 
   starlark = callPackage ../development/python-modules/starlark { };