diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 69d0d9418ecc..7cce9ae31148 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17059,6 +17059,11 @@
     githubId = 401263;
     keys = [ { fingerprint = "1147 43F1 E707 6F3E 6F4B  2C96 B9A8 B592 F126 F8E8"; } ];
   };
+  macaquinyho = {
+    github = "macaquinyho";
+    githubId = 14185777;
+    name = "Arnau Valls";
+  };
   macbucheron = {
     name = "Nathan Deprat";
     github = "Macbucheron1";
diff --git a/nixos/doc/manual/development/state-revision.section.md b/nixos/doc/manual/development/state-revision.section.md
new file mode 100644
index 000000000000..8a8f13aeda74
--- /dev/null
+++ b/nixos/doc/manual/development/state-revision.section.md
@@ -0,0 +1,57 @@
+# State revision {#sec-state-revision}
+
+NixOS includes a {option}`system.stateVersion` option, used by some modules for a
+variety of reasons related to non-backward-compatible changes to software or
+the module itself.
+Module authors are discouraged from adding new uses of
+{option}`system.stateVersion` to their module.
+
+However, when the alternatives are impractical, modules that wish to consume
+{option}`system.stateVersion` should instead define their own `stateRevision`
+option using `utils.mkStateRevisionOption`.
+There should be no uses of `config.system.stateVersion` directly in the module.
+
+(Note the name difference: the {option}`system.stateVersion` option, with a V,
+takes a value that looks like "YY.MM".
+A `stateRevision` option, with an R, takes a non-negative integer value.)
+
+Modules should also add the value of their `stateRevision` option to
+`system.moduleStateRevisions."your.module.stateRevision"`, when the module is
+enabled.
+This is a purely informative option that exists to help describe the effects of
+changing {option}`system.stateVersion`.
+
+Example:
+
+```nix
+{
+  lib,
+  config,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.whatever;
+in
+{
+  options.services.whatever = {
+    enable = lib.mkEnableOption "whatever, a service that does whatever";
+    stateRevision = utils.mkStateRevisionOption {
+      descriptionName = "the whatever service";
+      migrations = {
+        "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.whatever = {
+      # ...
+      serviceConfig.StateDirectory = if cfg.stateRevision < 1 then "old_name" else "new_name";
+    };
+
+    # Important: this is inside the `lib.mkIf cfg.enable`
+    system.moduleStateRevisions."services.whatever.stateRevision" = cfg.stateRevision;
+  };
+}
+```
diff --git a/nixos/doc/manual/development/writing-modules.chapter.md b/nixos/doc/manual/development/writing-modules.chapter.md
index a58ebb1709ab..626834fc3e66 100644
--- a/nixos/doc/manual/development/writing-modules.chapter.md
+++ b/nixos/doc/manual/development/writing-modules.chapter.md
@@ -220,4 +220,5 @@ importing-modules.section.md
 replace-modules.section.md
 freeform-modules.section.md
 settings-options.section.md
+state-revision.section.md
 ```
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 28db6d9841c3..36c508d901ba 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -235,6 +235,9 @@
   "sec-override-nixos-test": [
     "index.html#sec-override-nixos-test"
   ],
+  "sec-state-revision": [
+    "index.html#sec-state-revision"
+  ],
   "sec-wireless-declarative": [
     "index.html#sec-wireless-declarative"
   ],
diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 487b20f53d8c..964ca580ce1a 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -6,8 +6,10 @@
 
 let
   inherit (lib)
+    all
     any
     attrNames
+    concatImapStringsSep
     concatMapStringsSep
     concatStringsSep
     elem
@@ -27,8 +29,11 @@ let
     isList
     isPath
     isString
+    length
     listToAttrs
+    literalMD
     mapAttrs
+    mkOption
     nameValuePair
     optionalString
     removePrefix
@@ -36,8 +41,10 @@ let
     splitString
     stringToCharacters
     types
+    versionOlder
     ;
 
+  inherit (lib.lists) findFirstIndex;
   inherit (lib.strings) toJSON escapeC;
 in
 
@@ -604,6 +611,123 @@ let
         lib.listToAttrs
       ];
     };
+
+    /**
+      Creates a per-module `stateRevision` option that takes an int value, with a
+      default that is derived from `system.stateVersion`.
+
+      # Inputs
+
+      `descriptionName`
+      : A human-friendly name for your module, used for the description of the
+        created option.
+
+      `migrations`
+      : Attribute set that maps from values of `system.stateVersion`
+        (representing the breakpoints at which the default value of this option
+        will change) to Markdown instructions to users for manually migrating
+        their data to this breakpoint. The migration instructions will be
+        included in the NixOS documentation for this option. (These instructions
+        must only contain Markdown inlines, because they will be rendered in a
+        table. In particular, lists will not render correctly.)
+
+        `migrations` will also be exposed as an attribute on the result.
+
+      # Examples
+      :::{.example}
+      ## `lib.options.mkStateRevisionOption` usage example
+
+      ```nix
+      exampleModule =
+        { lib, config, utils, ... }:
+        {
+          options.services.whatever = {
+            stateRevision = utils.mkStateRevisionOption {
+              descriptionName = "the whatever service";
+              migrations = {
+                "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
+                "26.11" = "Run the `upgrade_whatever` utility.";
+                };
+              };
+            };
+          };
+        }
+
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "25.11"; }
+      ]).config.services.whatever.stateRevision # => 0
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "26.05"; }
+      ]).config.services.whatever.stateRevision # => 1
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "27.05"; }
+      ]).config.services.whatever.stateRevision # => 2
+      ```
+
+      :::
+
+      Modules should use this function when they change how data managed by the
+      module is persisted on the system between NixOS releases.
+
+      The default value of the option will be the number of attributes in the
+      `migrations` parameter with name less than or equal to the value of
+      `system.stateVersion`.
+
+      When using this function, don't forget to add the option's value to
+      `system.moduleStateRevisions."your.module.stateRevision"` when your module is
+      enabled.
+    */
+    mkStateRevisionOption =
+      {
+        descriptionName,
+        migrations,
+      }:
+      let
+        versions = attrNames migrations;
+        maxVal = length versions;
+      in
+      assert all (v: builtins.match "[0-9]{2}\\.[0-9]{2}" v != null) versions;
+      mkOption {
+        type = types.ints.between 0 maxVal;
+        description = ''
+          This option versions the format of state persisted by
+          ${descriptionName}. Its default value depends on the value of
+          {option}`system.stateVersion`.
+
+          Users who wish to increment this option will need to take manual
+          migration steps to preserve their data. **If you perform these
+          migrations, rolling back to an older generation will require also
+          reversing the migrations to the state expected by that generation.**
+          The migrations needed to advance to each value of this option are as
+          follows (perform all instructions after the row for the current
+          `stateRevision`, up to and including the row for the new
+          `stateRevision`):
+
+          | `stateRevision` | Migration instructions |
+          |-----------------|------------------------|
+          | 0               | (none)                 |
+          ${concatImapStringsSep "\n" (
+            v: sv: "| ${toString v} | ${replaceStrings [ "\n" ] [ " " ] migrations.${sv}} |"
+          ) versions}
+
+          Note that you do **not** need to change {option}`system.stateVersion`
+          in order to update this option. {option}`system.stateVersion` only
+          determines the default value of this option. Most users should not
+          change {option}`system.stateVersion` at all.
+        '';
+        default = findFirstIndex (versionOlder config.system.stateVersion) maxVal versions;
+        defaultText = literalMD ''
+          If {option}`system.stateVersion` is:
+          ${concatImapStringsSep "\n" (v: sv: "* &lt;${sv}: ${toString (v - 1)}") versions}
+          * otherwise: ${toString maxVal}
+        '';
+      }
+      // {
+        inherit migrations;
+      };
   };
 in
 utils
diff --git a/nixos/modules/config/xdg/portals/wlr.nix b/nixos/modules/config/xdg/portals/wlr.nix
index a5997adb803a..1ad004d4798b 100644
--- a/nixos/modules/config/xdg/portals/wlr.nix
+++ b/nixos/modules/config/xdg/portals/wlr.nix
@@ -12,7 +12,7 @@ let
 in
 {
   meta = {
-    maintainers = with lib.maintainers; [ minijackson ];
+    maintainers = [ ];
   };
 
   options.xdg.portal.wlr = {
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index b61e00d647b2..6270eb663db8 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -254,6 +254,30 @@ in
       '';
     };
 
+    moduleStateRevisions = mkOption {
+      type =
+        let
+          baseType = types.attrsOf types.ints.unsigned;
+          isStateRevisionOption = x: lib.isOption x && x ? migrations;
+        in
+        types.addCheck baseType (
+          attrs:
+          builtins.all (
+            attrPath: isStateRevisionOption (lib.attrByPath (lib.splitString "." attrPath) null options)
+          ) (builtins.attrNames attrs)
+        )
+        // {
+          description = "${baseType.description}, in which every attribute name is the path to an option created with mkStateRevisionOption";
+        };
+      default = { };
+      internal = true;
+      description = ''
+        NixOS modules should set attributes on this option. Users should leave
+        it alone. Future tooling may use it to determine the consequences of
+        updating {option}`system.stateVersion`.
+      '';
+    };
+
     configurationRevision = mkOption {
       type = types.nullOr types.str;
       default = null;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 1ffc2a70a7fe..7a7d54a9c6dd 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -357,6 +357,7 @@
   ./programs/wayland/gtklock.nix
   ./programs/wayland/hyprland.nix
   ./programs/wayland/hyprlock.nix
+  ./programs/wayland/kanshi.nix
   ./programs/wayland/labwc.nix
   ./programs/wayland/mango.nix
   ./programs/wayland/miracle-wm.nix
diff --git a/nixos/modules/programs/wayland/kanshi.nix b/nixos/modules/programs/wayland/kanshi.nix
new file mode 100644
index 000000000000..3ad20dfcb7f6
--- /dev/null
+++ b/nixos/modules/programs/wayland/kanshi.nix
@@ -0,0 +1,46 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.kanshi;
+in
+{
+  options.services.kanshi = {
+    enable = lib.mkEnableOption "kanshi, a Wayland daemon that automatically configures outputs";
+    package = lib.mkPackageOption pkgs "kanshi" { };
+    systemd.target = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The systemd target that will automatically start the Kanshi service.
+      '';
+      default = "graphical-session.target";
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.kanshi ];
+
+    systemd.user.services.kanshi = {
+      unitConfig = {
+        Description = "Dynamic output configuration";
+        Documentation = "man:kanshi(1)";
+        ConditionEnvironment = "WAYLAND_DISPLAY";
+        PartOf = cfg.systemd.target;
+        Requires = cfg.systemd.target;
+        After = cfg.systemd.target;
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe cfg.package}";
+        Restart = "always";
+      };
+
+      wantedBy = [ cfg.systemd.target ];
+    };
+  };
+  meta.maintainers = [ lib.maintainers.macaquinyho ];
+}
diff --git a/nixos/modules/services/misc/seerr.nix b/nixos/modules/services/misc/seerr.nix
index fc91fd8ba30d..e194216e1fc7 100644
--- a/nixos/modules/services/misc/seerr.nix
+++ b/nixos/modules/services/misc/seerr.nix
@@ -2,13 +2,14 @@
   config,
   pkgs,
   lib,
+  utils,
   ...
 }:
 let
   cfg = config.services.seerr;
-  # 26.05 introduced a breaking change which is guarded behind stateVersion to avoid
-  # breaking users.
-  useNewConfigLocation = lib.versionAtLeast config.system.stateVersion "26.05";
+  # 26.05 introduced a breaking change which is guarded behind stateRevision to
+  # avoid breaking users.
+  useNewConfigLocation = cfg.stateRevision >= 1;
 in
 {
   imports = [
@@ -39,8 +40,23 @@ in
     configDir = lib.mkOption {
       type = lib.types.path;
       default = if useNewConfigLocation then "/var/lib/seerr/" else "/var/lib/jellyseerr/config";
+      defaultText = lib.literalMD "{file}`/var/lib/seerr` (or {file}`/var/lib/jellyseerr/config` if {option}`services.seerr.stateRevision` < 1)";
       description = "Config data directory";
     };
+
+    stateRevision = utils.mkStateRevisionOption {
+      descriptionName = "Seerr";
+      migrations = {
+        "26.05" = ''
+          Move {file}`/var/lib/private/jellyseerr/config` to
+          {file}`/var/lib/private/seerr`, if you have not set
+          {option}`services.seerr.configDir`. (If you have set
+          {option}`services.seerr.configDir`, you should also have forced
+          {option}`systemd.services.seerr.serviceConfig.StateDirectory`, and in
+          that case `stateRevision` does not affect your configuration.)
+        '';
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -81,5 +97,7 @@ in
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
+
+    system.moduleStateRevisions."services.seerr.stateRevision" = cfg.stateRevision;
   };
 }
diff --git a/nixos/modules/services/web-apps/mobilizon.nix b/nixos/modules/services/web-apps/mobilizon.nix
index 77a19e60a074..9421e0d361bd 100644
--- a/nixos/modules/services/web-apps/mobilizon.nix
+++ b/nixos/modules/services/web-apps/mobilizon.nix
@@ -479,7 +479,6 @@ in
   };
 
   meta.maintainers = with lib.maintainers; [
-    minijackson
     erictapen
   ];
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index f2ecf4af0975..9185675391c0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1057,6 +1057,7 @@ in
   modularService = pkgs.callPackage ../modules/system/service/systemd/test.nix {
     inherit evalSystem;
   };
+  moduleStateRevisions = pkgs.callPackage ./moduleStateRevisions.nix { };
   molly-brown = runTest ./molly-brown.nix;
   mollysocket = runTest ./mollysocket.nix;
   monado = runTest ./monado.nix;
@@ -1838,7 +1839,7 @@ in
   userborn-mutable-users = runTest ./userborn-mutable-users.nix;
   userborn-static = runTest ./userborn-static.nix;
   ustreamer = runTest ./ustreamer.nix;
-  utils = import ./utils { inherit runTest; };
+  utils = pkgs.callPackage ./utils { inherit runTest; };
   utmp = runTest ./utmp.nix;
   uwsgi = runTest ./uwsgi.nix;
   v2ray = runTest ./v2ray.nix;
diff --git a/nixos/tests/mobilizon.nix b/nixos/tests/mobilizon.nix
index 5800ac702f16..31c7b6652312 100644
--- a/nixos/tests/mobilizon.nix
+++ b/nixos/tests/mobilizon.nix
@@ -8,7 +8,6 @@ in
 {
   name = "mobilizon";
   meta.maintainers = with lib.maintainers; [
-    minijackson
     erictapen
   ];
 
diff --git a/nixos/tests/moduleStateRevisions.nix b/nixos/tests/moduleStateRevisions.nix
new file mode 100644
index 000000000000..3bce4c312488
--- /dev/null
+++ b/nixos/tests/moduleStateRevisions.nix
@@ -0,0 +1,25 @@
+{
+  lib,
+  emptyFile,
+  nixos,
+}:
+let
+  evalModuleStateRevisions =
+    cfg:
+    (nixos [
+      { system.stateVersion = lib.trivial.release; }
+      cfg
+    ]).config.system.moduleStateRevisions;
+
+  # For modules that follow the <module>.enable, <module>.stateRevision pattern:
+  testModule =
+    path:
+    evalModuleStateRevisions (lib.setAttrByPath path { enable = true; })
+    ? "${builtins.concatStringsSep "." path}.stateRevision";
+in
+assert evalModuleStateRevisions { } == { };
+assert testModule [
+  "services"
+  "seerr"
+];
+emptyFile
diff --git a/nixos/tests/powerdns-admin.nix b/nixos/tests/powerdns-admin.nix
index 9165fb15de81..b5a703e9d8da 100644
--- a/nixos/tests/powerdns-admin.nix
+++ b/nixos/tests/powerdns-admin.nix
@@ -132,13 +132,13 @@ let
 
           # Login
           # Outputs 'Redirecting' if successful
-          curl -sSfb session http://127.0.0.1:8000/login \
+          curl -sSf -b session -c session http://127.0.0.1:8000/login \
             -F "_csrf_token=$csrf_token" \
             -F "username=user" \
             -F "password=password" | grep Redirecting
 
           # Check that we are logged in, this redirects to /admin/setting/pdns if we are
-          curl -sSfb session http://127.0.0.1:8000/dashboard/ | grep /admin/setting
+          curl -sSf -b session -c session http://127.0.0.1:8000/dashboard/ | grep /admin/setting
         '';
       };
       unix = {
diff --git a/nixos/tests/utils/default.nix b/nixos/tests/utils/default.nix
index a7c5f242c822..fdcf766ffbac 100644
--- a/nixos/tests/utils/default.nix
+++ b/nixos/tests/utils/default.nix
@@ -1,5 +1,9 @@
-{ runTest }:
+{
+  callPackage,
+  runTest,
+}:
 
 {
   genJqSecretsReplacement = runTest ./genJqSecretsReplacement.nix;
+  mkStateRevisionOption = callPackage ./mkStateRevisionOption.nix { };
 }
diff --git a/nixos/tests/utils/mkStateRevisionOption.nix b/nixos/tests/utils/mkStateRevisionOption.nix
new file mode 100644
index 000000000000..b32a27cec266
--- /dev/null
+++ b/nixos/tests/utils/mkStateRevisionOption.nix
@@ -0,0 +1,39 @@
+{
+  emptyFile,
+  nixos,
+}:
+let
+  result = nixos (
+    { utils, ... }:
+    {
+      options = {
+        stateRevision1 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "27.05" = "...";
+          };
+        };
+        stateRevision2 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "26.11" = "...";
+          };
+        };
+        stateRevision3 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "24.05" = "...";
+            "27.05" = "...";
+          };
+        };
+      };
+      config.system.stateVersion = "26.11";
+    }
+  );
+  inherit (result) config options;
+in
+assert config.stateRevision1 == 0;
+assert config.stateRevision2 == 1;
+assert config.stateRevision3 == 1;
+assert options.stateRevision1.migrations == { "27.05" = "..."; };
+emptyFile
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper.nix b/pkgs/applications/editors/emacs/build-support/wrapper.nix
index 782fa7681974..051e5923d6b0 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper.nix
@@ -174,6 +174,13 @@ runCommand (lib.appendToName "with-packages" emacs).name
           ;; "$out/share/emacs/site-lisp" is added to load-path in wrapper.sh
           ;; "$out/share/emacs/native-lisp" is added to native-comp-eln-load-path in wrapper.sh
           (add-to-list 'exec-path "$out/bin")
+          ;; Also expose extra package binaries via PATH so that subprocesses
+          ;; which rebuild their environment from PATH (e.g. direnv/envrc) can
+          ;; still find them. See https://github.com/purcell/envrc/issues/9
+          (let ((deps-bin "$out/bin")
+                (current-path (or (getenv "PATH") "")))
+            (unless (member deps-bin (split-string current-path path-separator))
+              (setenv "PATH" (concat deps-bin path-separator current-path))))
           ${lib.optionalString withTreeSitter ''
             (add-to-list 'treesit-extra-load-path "$out/lib/")
           ''}
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix
index 005323cf11f0..2d4ec9560ff3 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix
@@ -16,7 +16,7 @@
 melpaBuild (finalAttrs: {
 
   pname = "eaf-browser";
-  version = "0-unstable-2025-06-14";
+  version = "0-unstable-2025-06-13";
 
   src = fetchFromGitHub {
     owner = "emacs-eaf";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-map/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-map/package.nix
index e0f38b15c604..076fde35fddd 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-map/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-map/package.nix
@@ -14,13 +14,13 @@
 melpaBuild (finalAttrs: {
 
   pname = "eaf-map";
-  version = "0-unstable-2025-07-04";
+  version = "0-unstable-2025-07-26";
 
   src = fetchFromGitHub {
     owner = "emacs-eaf";
     repo = "eaf-map";
-    rev = "667865a9422ec71e3518833e1a13806d4f03adfb";
-    hash = "sha256-UgHIzYu/K1NzTDvUn2JkEmiyDEBT9JDmlvp6xG7Nv5k=";
+    rev = "8bec6ab7c1194491ffccbeeec45451d8dc6fb405";
+    hash = "sha256-rwtC4CAOTNmR8sH6P4mKyON65yNYWMBYImQkBGZH0Qs=";
   };
 
   env.npmDeps = fetchNpmDeps {
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-pyqterminal/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-pyqterminal/package.nix
index d60787854748..549973d63631 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-pyqterminal/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-pyqterminal/package.nix
@@ -10,13 +10,13 @@
 melpaBuild {
 
   pname = "eaf-pyqterminal";
-  version = "0-unstable-2025-05-05";
+  version = "0-unstable-2025-10-19";
 
   src = fetchFromGitHub {
     owner = "mumu-lhl";
     repo = "eaf-pyqterminal";
-    rev = "db947f136660adc4c3883b332f4465af82e4c9da";
-    hash = "sha256-0BH29XvBzJPgJBFSKHiKSLo/dpj5rixg7+u+LDpB5+U=";
+    rev = "37b7b2afbdd47c89d85ff6e3412e1dc6c555ab50";
+    hash = "sha256-+RVA+UM473eTPrsX3TpUrzPx8UY5gAgIkMl0CB/iBTw=";
   };
 
   files = ''
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/elpaca/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/elpaca/default.nix
index 9aa784ae73dc..e8059ff3c5a2 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/elpaca/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/elpaca/default.nix
@@ -8,13 +8,13 @@
 
 melpaBuild {
   pname = "elpaca";
-  version = "0-unstable-2025-02-16";
+  version = "0-unstable-2025-11-06";
 
   src = fetchFromGitHub {
     owner = "progfolio";
     repo = "elpaca";
-    rev = "07b3a653e2411f4d4b5902af1c9b3f159e07bec5";
-    hash = "sha256-+YJX2BJxH3D5u7YC/yJskZu0F4Nlat3ZROe+RCZGq9w=";
+    rev = "b5ef5f19ac1224853234c9acdac0ec9ea1c440a1";
+    hash = "sha256-EZ9emYTweRZzMKxZu9nbAaGgE2tInaL7KCKvJ5TaD0g=";
   };
 
   nativeBuildInputs = [ git ];
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/emacs-application-framework/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/emacs-application-framework/package.nix
index 09acf5c1c472..c8b77a01f25a 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/emacs-application-framework/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/emacs-application-framework/package.nix
@@ -54,13 +54,13 @@ in
 melpaBuild (finalAttrs: {
 
   pname = "eaf";
-  version = "0-unstable-2025-08-22";
+  version = "0-unstable-2025-08-29";
 
   src = fetchFromGitHub {
     owner = "emacs-eaf";
     repo = "emacs-application-framework";
-    rev = "dc5f6e7fa21a15b5e05c7722c2b8f32158aeab82";
-    hash = "sha256-wWC5Ma9p/k0GLcGpPn7NO0KqkIXmEbaQc7TJ2ImMIr4=";
+    rev = "ada92215ad864c2d142feb6ad6e1127e90bce668";
+    hash = "sha256-on+cIZW+lV+J4FwPq5HH2C6FPOHRq4+BU+e0shM1l4E=";
   };
 
   packageRequires = [
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/package.nix
index b1a490fb2c9b..92462f083407 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/git-undo/package.nix
@@ -7,13 +7,13 @@
 
 melpaBuild {
   pname = "git-undo";
-  version = "0-unstable-2022-08-07";
+  version = "0-unstable-2025-09-22";
 
   src = fetchFromGitHub {
     owner = "jwiegley";
     repo = "git-undo-el";
-    rev = "3d9c95fc40a362eae4b88e20ee21212d234a9ee6";
-    hash = "sha256-xwVCAdxnIRHrFNWvtlM3u6CShsUiGgl1CiBTsp2x7IM=";
+    rev = "1e94d2dad39ffa168005dee182dde5694416d9c9";
+    hash = "sha256-EppewewNPWVbQN76LVoebtKu+FOFCnWDhDeUognPmAo=";
   };
 
   passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/notdeft-xapian-program.diff b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/notdeft-xapian-program.diff
new file mode 100644
index 000000000000..a7e607ef7e0d
--- /dev/null
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/notdeft-xapian-program.diff
@@ -0,0 +1,23 @@
+diff --git a/notdeft-xapian.el b/notdeft-xapian.el
+index e71ef3e..5fad501 100644
+--- a/notdeft-xapian.el
++++ b/notdeft-xapian.el
+@@ -13,17 +13,7 @@
+ 
+ ;;; Code:
+ 
+-(defcustom notdeft-xapian-program
+-  (let ((dir (expand-file-name
+-              "xapian"
+-               (file-name-directory
+-	        (locate-library "notdeft-xapian.el")))))
+-    (when (and dir (file-directory-p dir))
+-      (cl-some (lambda (cand)
+-                 (let ((exe (expand-file-name cand dir)))
+-                   (when (file-executable-p exe)
+-                     exe)))
+-               '("notdeft-xapian" "notdeft-xapian.exe"))))
++(defcustom notdeft-xapian-program "@notdeft-xapian@"
+   "Xapian backend's executable program path.
+ Specified as an absolute path. Must be set appropriately for the
+ `notdeft-xapian' feature to be usable, on which much of NotDeft
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/package.nix
index ed350c016d4b..d04c58ad42f0 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/notdeft/package.nix
@@ -18,21 +18,23 @@
 
 melpaBuild {
   pname = "notdeft";
-  version = "0-unstable-2025-02-04";
+  version = "0-unstable-2025-06-14";
 
   src = fetchFromGitHub {
     owner = "hasu";
     repo = "notdeft";
-    rev = "de2b6a7666e9e5010184966f89a04241f221afe3";
-    hash = "sha256-B8aVRb8hyAKmHTTVCtDRcb2F0Rs5zhlqyfRe7IxH5jc=";
+    rev = "e0426807f608f550df14b7cd50b8455dee4dbfb3";
+    hash = "sha256-RB7KL04JNJ0d+wH9Q7aHCLYJHevy67XfXEyDxpjTbvg=";
   };
 
   packageRequires = lib.optional withHydra hydra ++ lib.optional withIvy ivy;
 
+  patches = [
+    ./notdeft-xapian-program.diff
+  ];
   postPatch = ''
     substituteInPlace notdeft-xapian.el \
-      --replace-fail 'defcustom notdeft-xapian-program nil' \
-                     "defcustom notdeft-xapian-program \"$out/bin/notdeft-xapian\""
+      --replace-fail "@notdeft-xapian@" "$out/bin/notdeft-xapian"
   '';
 
   files = ''
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/straight/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/straight/default.nix
index 8161a1e68626..8d6e76fb24d5 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/straight/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/straight/default.nix
@@ -8,13 +8,13 @@
 
 melpaBuild {
   pname = "straight";
-  version = "0-unstable-2025-01-30";
+  version = "0-unstable-2025-11-21";
 
   src = fetchFromGitHub {
     owner = "radian-software";
     repo = "straight.el";
-    rev = "44a866f28f3ded6bcd8bc79ddc73b8b5044de835";
-    hash = "sha256-riKagjhCn5NyTerw1WqGOn37TZNfmhPb7DS49TXw1CA=";
+    rev = "4b6289f42a4da0c1bae694ba918b43c72daf0330";
+    hash = "sha256-FlGo+Nl6n+xSwQSIrMHJa7tu+MjLG2Ldxf7poJCz4Nc=";
   };
 
   nativeBuildInputs = [ git ];
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/wat-mode/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/wat-mode/package.nix
index e4bb260d14b4..b5ea34f0b32b 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/wat-mode/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/wat-mode/package.nix
@@ -2,7 +2,7 @@
   lib,
   melpaBuild,
   fetchFromGitHub,
-  unstableGitUpdater,
+  nix-update-script,
 }:
 
 melpaBuild {
@@ -16,7 +16,7 @@ melpaBuild {
     hash = "sha256-jV5V3TRY+D3cPSz3yFwVWn9yInhGOYIaUTPEhsOBxto=";
   };
 
-  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
   meta = {
     homepage = "https://github.com/devonsparks/wat-mode";
diff --git a/pkgs/applications/editors/neovim/gnvim/default.nix b/pkgs/applications/editors/neovim/gnvim/default.nix
index 19ac86417e71..17228c698566 100644
--- a/pkgs/applications/editors/neovim/gnvim/default.nix
+++ b/pkgs/applications/editors/neovim/gnvim/default.nix
@@ -50,6 +50,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "gnvim";
     homepage = "https://github.com/vhakulinen/gnvim";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ minijackson ];
+    maintainers = [ ];
   };
 })
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 0e23dc5ca10c..d239694ce9ca 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -9464,6 +9464,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  lualine-so-fancy-nvim = buildVimPlugin {
+    pname = "lualine-so-fancy.nvim";
+    version = "0-unstable-2025-01-09";
+    src = fetchFromGitHub {
+      owner = "meuter";
+      repo = "lualine-so-fancy.nvim";
+      rev = "6ba7b138f2ca435673eb04c2cf85f0757df69b07";
+      hash = "sha256-Ctdt8kCG+4ynpfEHpvUhFQpbhcaLg0hoPX+yPkUQGS0=";
+    };
+    meta.homepage = "https://github.com/meuter/lualine-so-fancy.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   luasnip-latex-snippets-nvim = buildVimPlugin {
     pname = "luasnip-latex-snippets.nvim";
     version = "1.0.1-unstable-2025-04-22";
@@ -9815,6 +9829,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  md-table-tidy-nvim = buildVimPlugin {
+    pname = "md-table-tidy.nvim";
+    version = "0-unstable-2026-02-23";
+    src = fetchFromGitHub {
+      owner = "timantipov";
+      repo = "md-table-tidy.nvim";
+      rev = "e094d694e9ca97908fe311145b36664556e7c3c2";
+      hash = "sha256-vrsUk8VaivL7ZDTArJ7RkW4nW+Rl2o/FcaKH/NUfW+8=";
+    };
+    meta.homepage = "https://github.com/timantipov/md-table-tidy.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   mediawiki-vim = buildVimPlugin {
     pname = "mediawiki.vim";
     version = "0.2-unstable-2015-11-15";
@@ -13815,6 +13843,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  nvim-toggler = buildVimPlugin {
+    pname = "nvim-toggler";
+    version = "0.3.1";
+    src = fetchFromGitHub {
+      owner = "nguyenvukhang";
+      repo = "nvim-toggler";
+      tag = "v0.3.1";
+      hash = "sha256-6X+m7FeylME0J9hLx45bDqKvHxup3d+Hpa31VESKhrs=";
+    };
+    meta.homepage = "https://github.com/nguyenvukhang/nvim-toggler/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   nvim-tree-lua = buildVimPlugin {
     pname = "nvim-tree.lua";
     version = "1.18.0";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index fe85c36f14fc..8b9f872da199 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -2419,6 +2419,10 @@ assertNoAdditions {
     dependencies = [ self.lualine-nvim ];
   };
 
+  lualine-so-fancy-nvim = super.lualine-so-fancy-nvim.overrideAttrs {
+    dependencies = [ self.lualine-nvim ];
+  };
+
   luasnip-latex-snippets-nvim = super.luasnip-latex-snippets-nvim.overrideAttrs {
     dependencies = [ self.luasnip ];
     # E5108: /luasnip-latex-snippets/luasnippets/tex/utils/init.lua:3: module 'luasnip-latex-snippets.luasnippets.utils.conditions' not found:
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 13a1053997e7..f784797d58d2 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -674,6 +674,7 @@ https://github.com/nvimdev/lspsaga.nvim/,,
 https://github.com/barreiroleo/ltex_extra.nvim/,,
 https://github.com/nvim-java/lua-async/,,
 https://github.com/arkav/lualine-lsp-progress/,,
+https://github.com/meuter/lualine-so-fancy.nvim/,,
 https://github.com/evesdropper/luasnip-latex-snippets.nvim/,,
 https://github.com/alvarosevilla95/luatab.nvim/,,
 https://github.com/lopi-py/luau-lsp.nvim/,,
@@ -699,6 +700,7 @@ https://github.com/kaicataldo/material.vim/,,
 https://github.com/mattn/calendar-vim/,,mattn-calendar-vim
 https://github.com/vim-scripts/mayansmoke/,,
 https://github.com/ravitemer/mcphub.nvim/,,
+https://github.com/timantipov/md-table-tidy.nvim/,,
 https://github.com/chikamichi/mediawiki.vim/,,
 https://github.com/savq/melange-nvim/,,
 https://github.com/mellow-theme/mellow.nvim/,,
@@ -985,6 +987,7 @@ https://github.com/svermeulen/nvim-teal-maker/,,
 https://github.com/norcalli/nvim-terminal.lua/,,
 https://github.com/klen/nvim-test/,,
 https://github.com/chrisgrieser/nvim-tinygit/,,
+https://github.com/nguyenvukhang/nvim-toggler/,,
 https://github.com/nvim-tree/nvim-tree.lua/,,
 https://github.com/nvim-treesitter/nvim-treesitter/,,
 https://github.com/nvim-treesitter/nvim-treesitter-context/,,
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 72f67bb49c83..c7b964898e07 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -34,16 +34,16 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-fWrT06eKxFUcFGMfeNfgPIUoKrUFw86LG8BOAfr+iOo=";
-      aarch64-linux = "sha256-CzQScd1qm4YzqXMkeWqPWCKKWtwmKQ5AsokPy/lmowA=";
-      aarch64-darwin = "sha256-bhbMscqsOU2ux4i2XShdMKgJPN8tuWVSxTzJ0CUvJNM=";
-      armv7l-linux = "sha256-Q84Iac2PEr9pfTtUZPgnrDpdWxl/QCf6FTquw0MJL5I=";
+      x86_64-linux = "sha256-rNrw+lV72hcglW/2XKDeCWXpLWj5fi2yI0GYRACTeu0=";
+      aarch64-linux = "sha256-ID4JWcseHwRulwpYs/32CcOtXs073CLNYhMy7ZRbcHk=";
+      aarch64-darwin = "sha256-j1h03B/uYvJBU6GppfTD8Qu8wo/56KBPyfTNy22dD24=";
+      armv7l-linux = "sha256-gw9Lix8K6/U13+tDQcIUVf0xw5yxkKdR0GE9bTNx17w=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.130.0";
+  version = "1.132.0";
 
   # The update server (update.code.visualstudio.com) expects the version path
   # segment in X.Y.Z form, so we normalize X.Y to X.Y.0 (e.g. "1.110" → "1.110.0").
@@ -51,7 +51,7 @@ let
   downloadVersion = lib.versions.pad 3 version;
 
   # This is used for VS Code - Remote SSH test
-  rev = "1b6a188127eeaf9194f945eb6eb89a657e93c54c";
+  rev = "df53daabb18cd157bdb08c7f01c34df936cf12f4";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -84,7 +84,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-ogtXQGE9/8xQYvN/juDglu6wkHJzYyL8wetF8sWnqd8=";
+      hash = "sha256-rfWBY2apqMQwdF+W/Xg99w52BqNTEZmarFO3CyV668A=";
     };
     stdenv = stdenvNoCC;
   };
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index a9c668651db4..2fe7c7ab6701 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -838,7 +838,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "151.0.7922.75",
+    "version": "151.0.7922.108",
     "deps": {
       "depot_tools": {
         "rev": "94e89b10b92cc9d6e58fc8d1b6474b7d29e8a114",
@@ -850,16 +850,16 @@
         "hash": "sha256-T2LdISIkp8fcUli5ZetTqrESBAc7coJhWdJv7I+o9kk="
       },
       "ungoogled-patches": {
-        "rev": "151.0.7922.75-1",
-        "hash": "sha256-zpW7AGN9VrdlNg+q6BzwN3XW2TACQ07i2IwodSEi3CQ="
+        "rev": "151.0.7922.108-1",
+        "hash": "sha256-EhnX4fkuKTTIF6wztKWitrjNzKUf36fAnr7lUkJqJtQ="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "1ddc0a2003eb30c3990568d74ed0437451e9c374",
-        "hash": "sha256-QKVYipzVK/TUVdI4k8LLNmmhwAR6xP/Bgc1ZmNjySjo=",
+        "rev": "4744b886309d987d292e43232776d2206cccb13d",
+        "hash": "sha256-1i2IAA5sXyMPBzh6xOIY3CllEDtIS9Buk8Z2Vm1JnYw=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -929,8 +929,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "392ccfac4cdbaa282d50d6db2fba742c6b91fb55",
-        "hash": "sha256-D9bOXnU1B1fwQySWS1tah5gT/6n6urjbVE5ydvAsim8="
+        "rev": "a17d5224d83f6018eb6a21a644ad9ef86eac475d",
+        "hash": "sha256-oXjtHByC3KrLgG3by6OdvID4ViM+2AnSft+fcspbNG0="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -1044,8 +1044,8 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "6146421e05bbedf9d9f0fe94f16afdbfb6b8fef1",
-        "hash": "sha256-AYJGyPKCz0SzAYEX2k8B7sMQugBfmmv3IELpuxT0/4U="
+        "rev": "c7282e69291240dbee993364a340934982443334",
+        "hash": "sha256-kYmzjsjMDj96QBwpvZagsqsibouMx/q3UkuMFJd1jt4="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -1099,8 +1099,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "deb254e98496516b3d0bca323ffa49f7b08aec42",
-        "hash": "sha256-yjOrjHNRw6VphX6TLJryYoo3/9vOKMUsyStSUElPTes="
+        "rev": "3edf00b60c60c9248990a39a702ca4882809fe06",
+        "hash": "sha256-14qm+rI536GCqNkd9umSpJ9JoXf/47wuknJsVUb3ty0="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1419,8 +1419,8 @@
       },
       "src/third_party/openh264/src": {
         "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264",
-        "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
-        "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg="
+        "rev": "fca40fc19f5fb854609d297ae4bde71df72787c9",
+        "hash": "sha256-KMn8T8jCs4tdsmrU/fEBd0IWnBdD702x9JdJ0p98ZGk="
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
@@ -1494,8 +1494,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "f4eee5c6735d33a829ab2cfbf3fe23d0376e7992",
-        "hash": "sha256-UKewcYGGJrWA+ZJAp5TA3gGQpns+/5L6PlFxpEHWfG8="
+        "rev": "86bb2f25f46f4d620b4a26e738f59a9b6c22d2eb",
+        "hash": "sha256-tnUcFuwWtw0uGNIsU38M54V1MAYFs7/2yjP9Cs1fEHo="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1664,8 +1664,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "792d9716fea48312ad7ce4413c538e00628b1d50",
-        "hash": "sha256-oOJU+FgNSkvNarn24OFQAhXXmdH8MHAMw/Y9mfRnW4A="
+        "rev": "20ad8d002c17ccc7ccfbefc6c4dcf1242fe80921",
+        "hash": "sha256-J2dblSPMoZTpotDpuPp6beRYv+KtCirqNxEGEQKpqcQ="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 26557089c692..bc84e5c9739a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -101,11 +101,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "baidubce_baiducloud": {
-    "hash": "sha256-vSEPf0r7R5anuaTsAJFIx0GPTtrSKbRqqZoQA67Q2C0=",
+    "hash": "sha256-udlTXCEvvd6rbjIC1SlN/183ngs0ntb4Pgb1QqCC/S0=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.23.5",
+    "rev": "v1.23.6",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -382,13 +382,13 @@
     "vendorHash": "sha256-y9GRTuoh1X6GfGkGZbPpO500y8DoJS1dnwZL3BCTUcY="
   },
   "equinix_equinix": {
-    "hash": "sha256-Tn8CnLx2ibkj7qlzpYCX7Cm+yoTcZujVELMJSbG+/ec=",
+    "hash": "sha256-HwPjxVWIqWxpdIElMgDmOUx7KXr5VEwLVNbTLeEgRRo=",
     "homepage": "https://registry.terraform.io/providers/equinix/equinix",
     "owner": "equinix",
     "repo": "terraform-provider-equinix",
-    "rev": "v4.15.0",
+    "rev": "v5.1.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-WFlKj1IO9ylXn5frdnLcctQawjUXBTqcoMhQUQTU06A="
+    "vendorHash": "sha256-8v7+xVF/X9q7VmjQD4azGIggWpgPGuoNSWetsbKN7LA="
   },
   "exoscale_exoscale": {
     "hash": "sha256-QIYIqJI/xznbkqR8E8R2LwF15M6ZdEntQ8JtdIwZypM=",
@@ -580,11 +580,11 @@
     "vendorHash": "sha256-sPQR+LDZRMXygLUd9xj6/bI+8DhAPKbkytlTzmrEOBU="
   },
   "hashicorp_google": {
-    "hash": "sha256-GmScfhjCEtVb9QVMoAUMOusBUknnbImtgtDlqdkWsEA=",
+    "hash": "sha256-rKwsETOAtmzID3FqtI5CJ1CO+YgL8uL9PwyuV0hZuHc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.42.0",
+    "rev": "v7.43.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-neR/S8EYCwQky1U6EfMjmyCVJPqhckhqdc9As2Nsn1I="
   },
diff --git a/pkgs/build-support/node/import-npm-lock/default.nix b/pkgs/build-support/node/import-npm-lock/default.nix
index e52f10a9cd40..e2f853d24e37 100644
--- a/pkgs/build-support/node/import-npm-lock/default.nix
+++ b/pkgs/build-support/node/import-npm-lock/default.nix
@@ -21,6 +21,11 @@ let
   getName = package: package.name or "unknown";
   getVersion = package: package.version or "0.0.0";
 
+  isDistTag =
+    constraint:
+    match "[a-zA-Z][a-zA-Z0-9._-]*" constraint != null
+    && match "[vxX][0-9xX.].*|[xX]" constraint == null;
+
   # Fetch a module from package-lock.json -> packages
   fetchModule =
     {
@@ -108,8 +113,8 @@ lib.fix (self: {
           # Substitute the constraint with the version of the dependency from the top-level of package-lock.
           if
             (
-              # if the version is `latest`
-              version == "latest"
+              # if the version is a dist tag
+              isDistTag version
               ||
                 # Or if it's a github reference
                 matchGitHubReference version != null
diff --git a/pkgs/by-name/aa/aaphoto/package.nix b/pkgs/by-name/aa/aaphoto/package.nix
index 45f3393abeff..d3b8d672716d 100644
--- a/pkgs/by-name/aa/aaphoto/package.nix
+++ b/pkgs/by-name/aa/aaphoto/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
       saturation and gamma levels of the image by analization.
 
       This can be a solution for those kind of users who are not able to manage
-      and correct images with complicated graphical softwares, or just simply
+      and correct images with complicated graphical software, or just simply
       don't intend to spend a lot of time with manually correcting the images
       one-by-one.
     '';
diff --git a/pkgs/by-name/ac/ac-library/package.nix b/pkgs/by-name/ac/ac-library/package.nix
index bdbb3e5d2355..89d2f69875ea 100644
--- a/pkgs/by-name/ac/ac-library/package.nix
+++ b/pkgs/by-name/ac/ac-library/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstallCheck
   '';
 
-  # We don't need -fno-strict-overflow because it will break UBSanitize's overflow check especially when the operation number is static definded.
+  # We don't need -fno-strict-overflow because it will break UBSanitize's overflow check especially when the operation number is static defined.
   hardeningDisable = [ "strictoverflow" ];
 
   env = {
diff --git a/pkgs/by-name/ad/adios2/package.nix b/pkgs/by-name/ad/adios2/package.nix
index 65afc33e2528..8ede82c56e5f 100644
--- a/pkgs/by-name/ad/adios2/package.nix
+++ b/pkgs/by-name/ad/adios2/package.nix
@@ -126,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs =
     lib.optional mpiSupport mpi
-    # create meta package providing dist-info for python3Pacakges.adios2
+    # create meta package providing dist-info for python3Packages.adios2
     ++ lib.optional pythonSupport (
       python3Packages.mkPythonMetaPackage {
         inherit (finalAttrs) pname version meta;
diff --git a/pkgs/by-name/an/android-translation-layer/package.nix b/pkgs/by-name/an/android-translation-layer/package.nix
index 818f927ceb60..f3094716ea48 100644
--- a/pkgs/by-name/an/android-translation-layer/package.nix
+++ b/pkgs/by-name/an/android-translation-layer/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
     # Required gio-unix dependency is missing in meson.build
     ./add-gio-unix-dep.patch
 
-    # Patch custon Dex install dir
+    # Patch custom Dex install dir
     ./configure-dex-install-dir.patch
   ];
 
diff --git a/pkgs/by-name/an/anyk/package.nix b/pkgs/by-name/an/anyk/package.nix
index b9b453d61c03..4aa75828ad78 100644
--- a/pkgs/by-name/an/anyk/package.nix
+++ b/pkgs/by-name/an/anyk/package.nix
@@ -29,7 +29,7 @@ let
   # We don't really want to use openjdk8 because it's unusable on HiDPI
   # and people are more likely to have a modern OpenJDK installed.
   # We use Maven to resolve these unbundled dependencies.
-  # jdk_headless is just overriden so we don't have to fetch another OpenJDK for no reason.
+  # jdk_headless is just overridden so we don't have to fetch another OpenJDK for no reason.
   soapDeps = (maven.override { jdk_headless = jre; }).buildMavenPackage {
     pname = "anyk-soap-deps";
     version = "1.0.0";
diff --git a/pkgs/by-name/ap/apriltag/package.nix b/pkgs/by-name/ap/apriltag/package.nix
index b8f302fe1d56..1313b61889e1 100644
--- a/pkgs/by-name/ap/apriltag/package.nix
+++ b/pkgs/by-name/ap/apriltag/package.nix
@@ -1,9 +1,12 @@
 {
+  config,
   lib,
   stdenv,
   fetchFromGitHub,
   cmake,
   python3Packages,
+  cudaSupport ? config.cudaSupport,
+  cudaPackages,
   nix-update-script,
 }:
 
@@ -25,9 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-  ];
+  ]
+  ++ lib.optionals cudaSupport [ cudaPackages.cuda_nvcc ];
 
-  buildInputs = [ opencv4WithGtk ];
+  buildInputs = [ opencv4WithGtk ] ++ lib.optionals cudaSupport [ cudaPackages.cuda_cudart ];
 
   cmakeFlags = [ (lib.cmakeBool "BUILD_EXAMPLES" true) ];
 
diff --git a/pkgs/by-name/ap/apvlv/package.nix b/pkgs/by-name/ap/apvlv/package.nix
index f2d15f2fd2b0..706176c19d82 100644
--- a/pkgs/by-name/ap/apvlv/package.nix
+++ b/pkgs/by-name/ap/apvlv/package.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     # UTF-8 locale for translation generation
     LANG = "C.UTF8";
-    # accomodate #include <qt6/poppler-qt6.h>…
+    # accommodate #include <qt6/poppler-qt6.h>…
     NIX_CFLAGS_COMPILE = "-I${qt6Packages.poppler.dev}/include/poppler";
   };
 
diff --git a/pkgs/by-name/ar/art-standalone/package.nix b/pkgs/by-name/ar/art-standalone/package.nix
index e7f3c1987147..680100476ce0 100644
--- a/pkgs/by-name/ar/art-standalone/package.nix
+++ b/pkgs/by-name/ar/art-standalone/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    # Do not hardocde addr2line binary path
+    # Do not hardcode addr2line binary path
     ./no-hardcode-path-addr2line.patch
     ./remove-wolfssljni.patch
   ];
diff --git a/pkgs/by-name/as/asdbctl/package.nix b/pkgs/by-name/as/asdbctl/package.nix
index 60b4087cbe77..65f9993e73d3 100644
--- a/pkgs/by-name/as/asdbctl/package.nix
+++ b/pkgs/by-name/as/asdbctl/package.nix
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doInstallCheck = true;
 
   meta = {
-    description = "Apple Studio Display brightness controll";
+    description = "Apple Studio Display brightness control";
     mainProgram = "asdbctl";
     homepage = "https://github.com/juliuszint/asdbctl";
     changelog = "https://github.com/juliuszint/asdbctl/releases/tag/${finalAttrs.version}";
diff --git a/pkgs/applications/misc/avalonia-ilspy/deps.json b/pkgs/by-name/av/avalonia-ilspy/deps.json
similarity index 100%
rename from pkgs/applications/misc/avalonia-ilspy/deps.json
rename to pkgs/by-name/av/avalonia-ilspy/deps.json
diff --git a/pkgs/applications/misc/avalonia-ilspy/dotnet-8-upgrade.patch b/pkgs/by-name/av/avalonia-ilspy/dotnet-8-upgrade.patch
similarity index 100%
rename from pkgs/applications/misc/avalonia-ilspy/dotnet-8-upgrade.patch
rename to pkgs/by-name/av/avalonia-ilspy/dotnet-8-upgrade.patch
diff --git a/pkgs/applications/misc/avalonia-ilspy/default.nix b/pkgs/by-name/av/avalonia-ilspy/package.nix
similarity index 97%
rename from pkgs/applications/misc/avalonia-ilspy/default.nix
rename to pkgs/by-name/av/avalonia-ilspy/package.nix
index 41b393f3ee84..ac02744718ea 100644
--- a/pkgs/applications/misc/avalonia-ilspy/default.nix
+++ b/pkgs/by-name/av/avalonia-ilspy/package.nix
@@ -18,9 +18,13 @@
   icoutils,
   bintools,
   fixDarwinDylibNames,
-  autoSignDarwinBinariesHook,
+  darwin,
 }:
 
+let
+  inherit (darwin) autoSignDarwinBinariesHook;
+in
+
 buildDotnetModule rec {
   pname = "avalonia-ilspy";
   version = "7.2-rc";
diff --git a/pkgs/applications/misc/avalonia-ilspy/remove-broken-sources.patch b/pkgs/by-name/av/avalonia-ilspy/remove-broken-sources.patch
similarity index 100%
rename from pkgs/applications/misc/avalonia-ilspy/remove-broken-sources.patch
rename to pkgs/by-name/av/avalonia-ilspy/remove-broken-sources.patch
diff --git a/pkgs/applications/window-managers/awesome/default.nix b/pkgs/by-name/aw/awesome/package.nix
similarity index 97%
rename from pkgs/applications/window-managers/awesome/default.nix
rename to pkgs/by-name/aw/awesome/package.nix
index 2891e7a9f529..ee838e6c236e 100644
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/by-name/aw/awesome/package.nix
@@ -38,7 +38,7 @@
   xcbutilxrm,
   hicolor-icon-theme,
   asciidoctor,
-  fontsConf,
+  texFunctions,
   gtk3Support ? false,
   gtk3 ? null,
 }:
@@ -51,6 +51,8 @@ let
     ps.lgi
     ps.ldoc
   ]);
+
+  inherit (texFunctions) fontsConf;
 in
 
 stdenv.mkDerivation rec {
@@ -116,7 +118,7 @@ stdenv.mkDerivation rec {
 
   propagatedUserEnvPkgs = [ hicolor-icon-theme ];
   buildInputs = [
-    cairo
+    (cairo.override { xcbSupport = true; })
     librsvg
     dbus
     gdk-pixbuf
diff --git a/pkgs/by-name/az/azure-cli/extensions-generated.json b/pkgs/by-name/az/azure-cli/extensions-generated.json
index f3553e66b0e4..37dfc9c6e442 100644
--- a/pkgs/by-name/az/azure-cli/extensions-generated.json
+++ b/pkgs/by-name/az/azure-cli/extensions-generated.json
@@ -50,9 +50,9 @@
   },
   "aks-preview": {
     "pname": "aks-preview",
-    "version": "21.0.0b8",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-21.0.0b8-py2.py3-none-any.whl",
-    "hash": "sha256-qjmGi1RBxlmvwR0GnvQr1I272G0lcFinbftVLcJ0h2M=",
+    "version": "21.0.0b13",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-21.0.0b13-py2.py3-none-any.whl",
+    "hash": "sha256-l1LEKBmdG1mPynTYDqkCQxHhBgaFwXa8YYkire1M/Vw=",
     "description": "Provides a preview for upcoming AKS features"
   },
   "alb": {
@@ -92,9 +92,9 @@
   },
   "appnet-preview": {
     "pname": "appnet-preview",
-    "version": "1.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/appnet_preview-1.0.0b2-py3-none-any.whl",
-    "hash": "sha256-JGt61AOwZxk4oxZh4ohktQQH73cBnuHyHwvreev+xH0=",
+    "version": "1.0.0b3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/appnet_preview-1.0.0b3-py3-none-any.whl",
+    "hash": "sha256-2aretbpSZKQCLbTNuYtl83Ws/C0kLzocx4imjB652c8=",
     "description": "Azure CLI commands for working with Azure Kubernetes Application Network resources"
   },
   "arcgateway": {
@@ -155,9 +155,9 @@
   },
   "azure-firewall": {
     "pname": "azure-firewall",
-    "version": "2.2.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.0-py2.py3-none-any.whl",
-    "hash": "sha256-f1ZxkLZVI4+kzUmwOnY8hMaR/nuxqnLM92xlLQG3rIw=",
+    "version": "2.2.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.1-py2.py3-none-any.whl",
+    "hash": "sha256-q4ai0UErqKI97A8OZ4/JkuT1QLOKa36rYZPItiu1r9s=",
     "description": "Manage Azure Firewall resources"
   },
   "azurelargeinstance": {
@@ -204,9 +204,9 @@
   },
   "cdn": {
     "pname": "cdn",
-    "version": "1.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cdn-1.0.0b1-py2.py3-none-any.whl",
-    "hash": "sha256-YybIrCjZnZQ0IFgOZbm4JfMnXNC/Sah8YaZuss1M5B4=",
+    "version": "1.0.0b2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cdn-1.0.0b2-py2.py3-none-any.whl",
+    "hash": "sha256-Dt39rt65jcU6tV9Oo8cwL74xosYFP2o791v83n6QbfM=",
     "description": "Microsoft Azure Command-Line Tools CDN and AFD Extension"
   },
   "change-analysis": {
@@ -267,9 +267,9 @@
   },
   "connectedmachine": {
     "pname": "connectedmachine",
-    "version": "2.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/connectedmachine-2.0.0b2-py3-none-any.whl",
-    "hash": "sha256-LZfsPWODjBB6i3Z/oAGquxlRCS8NKxkp2W3K4j+n9XQ=",
+    "version": "3.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/connectedmachine-3.0.0b1-py3-none-any.whl",
+    "hash": "sha256-IKu0T6vo2F5q2phXb+WkV98iQKPMxFbdvhX7cKyZpaU=",
     "description": "Microsoft Azure Command-Line Tools ConnectedMachine Extension"
   },
   "connectedvmware": {
@@ -330,9 +330,9 @@
   },
   "datadog": {
     "pname": "datadog",
-    "version": "3.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/datadog-3.0.0-py3-none-any.whl",
-    "hash": "sha256-va/om8UaRL+oqYSjNK34UuBlwfH7TyTLCcODzAwh2Og=",
+    "version": "3.1.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/datadog-3.1.0b1-py3-none-any.whl",
+    "hash": "sha256-fULYTfzTLCMVvGn3BzoU1rQ6yepMql5b6tYQduHqj3Y=",
     "description": "Microsoft Azure Command-Line Tools Datadog Extension"
   },
   "datafactory": {
@@ -405,6 +405,13 @@
     "hash": "sha256-bdtqIfedTken/0rh+2F/MhdDtl1+mshQFXUX2/2ejpA=",
     "description": "Microsoft Azure Command-Line Tools DevCenter Extension"
   },
+  "discovery": {
+    "pname": "discovery",
+    "version": "1.0.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/discovery-1.0.1-py3-none-any.whl",
+    "hash": "sha256-meLITo7gB1iIs0T08vDuJaGo263eUbEXdeeYV83EFaM=",
+    "description": "Commands for managing Microsoft Discovery resources including bookshelves, workspaces, supercomputers, and tools"
+  },
   "diskpool": {
     "pname": "diskpool",
     "version": "0.2.0",
@@ -433,6 +440,13 @@
     "hash": "sha256-4Jaf0p22SygVmg722FOp4dkqHKlxYFoBRlvE05gmvEQ=",
     "description": "Microsoft Azure Command-Line Tools DnsResolverManagementClient Extension"
   },
+  "documentdb": {
+    "pname": "documentdb",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/documentdb-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-0ZbE9sj2y12PfLmkTb6H+4d/Qp86GWDuwEpacwKo9BE=",
+    "description": "Microsoft Azure Command-Line Tools Documentdb Extension"
+  },
   "durabletask": {
     "pname": "durabletask",
     "version": "1.0.0b8",
@@ -512,9 +526,9 @@
   },
   "fleet": {
     "pname": "fleet",
-    "version": "1.10.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.10.1-py3-none-any.whl",
-    "hash": "sha256-MEtlIj9z69GM/vktWbethZEr6hXyBpH310PT9A5Rtk8=",
+    "version": "1.11.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.11.0-py3-none-any.whl",
+    "hash": "sha256-RiwOFbhVsswEVMTaaXh5b/lumftpOITd5cBrWIEJsLg=",
     "description": "Microsoft Azure Command-Line Tools Fleet Extension"
   },
   "fluid-relay": {
@@ -603,9 +617,9 @@
   },
   "horizondb": {
     "pname": "horizondb",
-    "version": "1.0.0b4",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/horizondb-1.0.0b4-py2.py3-none-any.whl",
-    "hash": "sha256-2p6sKyNhoBsrwneo7TUwr+MyE/6fhTxFP9apfqexP7Q=",
+    "version": "1.0.0b7",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/horizondb-1.0.0b7-py2.py3-none-any.whl",
+    "hash": "sha256-h+Smm4Pou2vZB/9EFOA/xtAZLYSMUCeiy/K34RKrBig=",
     "description": "Microsoft Azure Command-Line Tools HorizonDB Extension"
   },
   "hpc-cache": {
@@ -764,9 +778,9 @@
   },
   "migrate": {
     "pname": "migrate",
-    "version": "3.0.0b4",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/migrate-3.0.0b4-py3-none-any.whl",
-    "hash": "sha256-4icsf1zk6OUrAgG+P+kdaG3POHnman6dmppwdGzRQzQ=",
+    "version": "3.0.0b5",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/migrate-3.0.0b5-py3-none-any.whl",
+    "hash": "sha256-ZQAUxctPWu/2a5vqiF2WjcpeYRgO8EP6FGkcs7AgCgs=",
     "description": "Support for Azure Migrate preview"
   },
   "mixed-reality": {
@@ -820,10 +834,10 @@
   },
   "networkcloud": {
     "pname": "networkcloud",
-    "version": "5.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/networkcloud-5.0.0b2-py3-none-any.whl",
-    "hash": "sha256-npgLkxwwn3FL7w4q5bpUq2Gghuy/4zsmikW7qs86Fe0=",
-    "description": "Support for Azure Operator Nexus network cloud commands based on 2026-05-01-preview API version"
+    "version": "5.0.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/networkcloud-5.0.1-py3-none-any.whl",
+    "hash": "sha256-B4g+5HIRv8hco7p1w78GlL+5gfwKlGO2USX3jUcogdE=",
+    "description": "Support for Azure Operator Nexus network cloud commands based on 2026-07-01 API version"
   },
   "new-relic": {
     "pname": "new-relic",
@@ -869,9 +883,9 @@
   },
   "oracle-database": {
     "pname": "oracle-database",
-    "version": "2.0.3",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/oracle_database-2.0.3-py3-none-any.whl",
-    "hash": "sha256-Qd9WtF7opKFbotazhgJsCb6CdGO/xQ1/5De+LcIaAiY=",
+    "version": "2.0.5",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/oracle_database-2.0.5-py3-none-any.whl",
+    "hash": "sha256-SkmNXFR9HzH8LkClMHVNfN4IqGf/c+/DTb2JG9lpyXU=",
     "description": "Microsoft Azure Command-Line Tools OracleDatabase Extension"
   },
   "orbital": {
@@ -939,9 +953,9 @@
   },
   "quantum": {
     "pname": "quantum",
-    "version": "1.0.0b16",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b16-py3-none-any.whl",
-    "hash": "sha256-hhDQzA4jtmPyLbd703EYDCmBDjJS2rBTj7Qgx4T4dxQ=",
+    "version": "1.0.0b20",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b20-py3-none-any.whl",
+    "hash": "sha256-VdNEwbLC4flcGdezhOc+y2YfUm5VA8LzVGXBTfT3WiE=",
     "description": "Microsoft Azure Command-Line Tools Quantum Extension"
   },
   "qumulo": {
@@ -1100,9 +1114,9 @@
   },
   "storage-mover": {
     "pname": "storage-mover",
-    "version": "1.3.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/storage_mover-1.3.0-py3-none-any.whl",
-    "hash": "sha256-gPJWrRTS7q4cig11lCpnueSzO/EqjW++YW3yqa/U3oA=",
+    "version": "1.3.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/storage_mover-1.3.1-py3-none-any.whl",
+    "hash": "sha256-XtFAhouEZH9bGjUY6Hgm+aw5OQrzYUpgoEggcAZxNgA=",
     "description": "Microsoft Azure Command-Line Tools StorageMover Extension"
   },
   "storagesync": {
@@ -1163,9 +1177,9 @@
   },
   "virtual-network-manager": {
     "pname": "virtual-network-manager",
-    "version": "3.0.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/virtual_network_manager-3.0.1-py3-none-any.whl",
-    "hash": "sha256-vY9LN/k44HIVB3bkSC+We5/26yzhOVeBYkEeG6wQOT8=",
+    "version": "3.0.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/virtual_network_manager-3.0.2-py3-none-any.whl",
+    "hash": "sha256-FfMTkG6sisvkyhQGYcROhaeZtbzcftMUwpQVf7q25kQ=",
     "description": "Microsoft Azure Command-Line Tools NetworkManagementClient Extension"
   },
   "virtual-network-tap": {
diff --git a/pkgs/by-name/az/azure-cli/extensions-tool.py b/pkgs/by-name/az/azure-cli/extensions-tool.py
index ecf8ecda0c9f..24b10937e968 100644
--- a/pkgs/by-name/az/azure-cli/extensions-tool.py
+++ b/pkgs/by-name/az/azure-cli/extensions-tool.py
@@ -187,7 +187,7 @@ def find_extension_version(
         return None
     if ext_name and latest["metadata"]["name"] != ext_name:
         return None
-    if not requirements and "run_requires" in latest["metadata"]:
+    if not requirements and latest["metadata"].get("run_requires"):
         return None
     return latest
 
@@ -450,12 +450,22 @@ def main() -> None:
     logger.info("updating generated extension set")
 
     extensions_remote_filtered = set()
+    extensions_gained_requirements = set()
     for _ext_name, extension in extensions_remote.items():
-        extension = find_and_transform_extension_version(
-            extension, cli_version, args.extension
+        without_req = find_and_transform_extension_version(
+            extension, cli_version, requirements=False
         )
-        if extension:
-            extensions_remote_filtered.add(extension)
+        if without_req:
+            extensions_remote_filtered.add(without_req)
+            continue
+        # The latest compatible version was dropped by the requirement-less
+        # filter, i.e. it declares run_requires. Keep track of it so we can tell
+        # extensions that merely gained requirements apart from genuine removals.
+        with_req = find_and_transform_extension_version(
+            extension, cli_version, requirements=True
+        )
+        if with_req:
+            extensions_gained_requirements.add(with_req)
 
     extension_file = (
         Path(repo.working_dir) / "pkgs/by-name/az/azure-cli/extensions-generated.json"
@@ -474,9 +484,24 @@ def main() -> None:
     )
     updated = set(filter(_filter_updated, updated))
 
+    # An extension reported as removed that still has a compatible version in the
+    # index was not actually removed: its latest version now declares
+    # requirements, so the requirement-less filter drops it. Report these
+    # separately and leave them untouched instead of removing them.
+    gained_by_pname = {ext.pname: ext for ext in extensions_gained_requirements}
+    gained_requirements = {
+        (prev, gained_by_pname[prev.pname])
+        for prev in removed
+        if prev.pname in gained_by_pname
+    }
+    removed = {prev for prev in removed if prev.pname not in gained_by_pname}
+
     logger.info("initialized extensions:")
     for ext in init:
         logger.info(f"  {ext.pname} {ext.version}")
+    logger.info("extensions that gained requirements (previously without):")
+    for prev, new in gained_requirements:
+        logger.info(f"  {prev.pname} {prev.version} -> {new.version}")
     logger.info("removed extensions:")
     for ext in removed:
         logger.info(f"  {ext.pname} {ext.version}")
diff --git a/pkgs/by-name/az/azure-cli/package.nix b/pkgs/by-name/az/azure-cli/package.nix
index 5a54e47c1eb3..2f63134248d9 100644
--- a/pkgs/by-name/az/azure-cli/package.nix
+++ b/pkgs/by-name/az/azure-cli/package.nix
@@ -26,14 +26,14 @@
 }:
 
 let
-  version = "2.88.0";
+  version = "2.89.0";
 
   src = fetchFromGitHub {
     name = "azure-cli-${version}-src";
     owner = "Azure";
     repo = "azure-cli";
     tag = "azure-cli-${version}";
-    hash = "sha256-9lDDzUuON1fkZzvV6oAzUOZcf+t7biDzPFufZIYQrAY=";
+    hash = "sha256-bNKPp/O5YOhne9OOEjextcXVNtGl1TP+vyFUBmOXt7I=";
   };
 
   # put packages that needs to be overridden in the py package scope
diff --git a/pkgs/by-name/az/azure-cli/python-packages.nix b/pkgs/by-name/az/azure-cli/python-packages.nix
index f91c7f620e21..55df255f748c 100644
--- a/pkgs/by-name/az/azure-cli/python-packages.nix
+++ b/pkgs/by-name/az/azure-cli/python-packages.nix
@@ -182,16 +182,6 @@ let
         overrideAzureMgmtPackage super.azure-mgmt-media "9.0.0" "zip"
           "sha256-TI7l8sSQ2QUgPqiE3Cu/F67Wna+KHbQS3fuIjOb95ZM=";
 
-      # ModuleNotFoundError: No module named 'azure.mgmt.monitor.operations'
-      azure-mgmt-monitor = super.azure-mgmt-monitor.overridePythonAttrs (attrs: rec {
-        version = "7.0.0b1";
-        src = fetchPypi {
-          pname = "azure_mgmt_monitor"; # Different from src.pname in the original package.
-          inherit version;
-          hash = "sha256-WR4YZMw4njklpARkujsRnd6nwTZ8M5vXFcy9AfL9oj4=";
-        };
-      });
-
       # AttributeError: module 'azure.mgmt.rdbms.postgresql_flexibleservers.operations' has no attribute 'BackupsOperations'
       azure-mgmt-rdbms =
         overrideAzureMgmtPackage super.azure-mgmt-rdbms "10.2.0b17" "tar.gz"
@@ -232,11 +222,6 @@ let
         doCheck = false;
       };
 
-      # ImportError: cannot import name 'IPRule' from 'azure.mgmt.signalr.models'
-      azure-mgmt-signalr =
-        overrideAzureMgmtPackage super.azure-mgmt-signalr "2.0.0b2" "tar.gz"
-          "sha256-05PUV8ouAKq/xhGxVEWIzDop0a7WDTV5mGVSC4sv9P4=";
-
       # ImportError: cannot import name 'AdvancedThreatProtectionName' from 'azure.mgmt.sql.models'
       azure-mgmt-sql = super.azure-mgmt-sql.overridePythonAttrs (attrs: rec {
         version = "4.0.0b22";
@@ -247,16 +232,6 @@ let
         };
       });
 
-      # ValueError: The operation 'azure.mgmt.sqlvirtualmachine.operations#SqlVirtualMachinesOperations.begin_create_or_update' is invalid.
-      azure-mgmt-sqlvirtualmachine =
-        overrideAzureMgmtPackage super.azure-mgmt-sqlvirtualmachine "1.0.0b5" "zip"
-          "sha256-ZFgJflgynRSxo+B+Vso4eX1JheWlDQjfJ9QmupXypMc=";
-
-      # ModuleNotFoundError: No module named 'azure.mgmt.synapse.operations._kusto_pool_attached_database_configurations_operations'
-      azure-mgmt-synapse =
-        overrideAzureMgmtPackage super.azure-mgmt-synapse "2.1.0b5" "zip"
-          "sha256-5E6Yf1GgNyNVjd+SeFDbhDxnOA6fOAG6oojxtCP4m+k=";
-
       # Attribute virtual_machines does not exist - nixpkgs has 37.x but azure-cli 2.82.0 requires ~=34.1.0
       azure-mgmt-compute = super.azure-mgmt-compute.overridePythonAttrs (attrs: rec {
         version = "34.1.0";
@@ -267,18 +242,6 @@ let
         };
       });
 
-      # ValueError: The operation 'azure.mgmt.mysqlflexibleservers.operations#LongRunningBackupOperations.begin_delete' is invalid.
-      azure-mgmt-mysqlflexibleservers =
-        super.azure-mgmt-mysqlflexibleservers.overridePythonAttrs
-          (attrs: rec {
-            version = "1.1.0b2";
-            src = fetchPypi {
-              pname = "azure_mgmt_mysqlflexibleservers";
-              inherit version;
-              hash = "sha256-yGpEFn9VOP1uSvpUCV/gYW56/5HulsCVx9wc/kWO+Ro=";
-            };
-          });
-
       # ModuleNotFoundError: No module named 'azure.mgmt.recoveryservicesbackup.activestamp'
       azure-mgmt-recoveryservicesbackup =
         super.azure-mgmt-recoveryservicesbackup.overridePythonAttrs
diff --git a/pkgs/by-name/ba/bazel_8/package.nix b/pkgs/by-name/ba/bazel_8/package.nix
index eb4388d842a1..5c0609ec4cf1 100644
--- a/pkgs/by-name/ba/bazel_8/package.nix
+++ b/pkgs/by-name/ba/bazel_8/package.nix
@@ -129,7 +129,7 @@ stdenv.mkDerivation rec {
     # guarantee that it will always run in any nix context.
     #
     # See also ./bazel_darwin_sandbox.patch in bazel_5. That patch uses
-    # NIX_BUILD_TOP env var to conditionnally disable sleep features inside the
+    # NIX_BUILD_TOP env var to conditionally disable sleep features inside the
     # sandbox.
     #
     # If you want to investigate the sandbox profile path,
diff --git a/pkgs/by-name/ba/bazel_9/package.nix b/pkgs/by-name/ba/bazel_9/package.nix
index 4b7d2b692d7a..4513ec119b2a 100644
--- a/pkgs/by-name/ba/bazel_9/package.nix
+++ b/pkgs/by-name/ba/bazel_9/package.nix
@@ -124,7 +124,7 @@ stdenv.mkDerivation rec {
     # guarantee that it will always run in any nix context.
     #
     # See also ./bazel_darwin_sandbox.patch in bazel_5. That patch uses
-    # NIX_BUILD_TOP env var to conditionnally disable sleep features inside the
+    # NIX_BUILD_TOP env var to conditionally disable sleep features inside the
     # sandbox.
     #
     # If you want to investigate the sandbox profile path,
diff --git a/pkgs/by-name/be/berry/package.nix b/pkgs/by-name/be/berry/package.nix
index 84eb367acb55..6a81420bdfc4 100644
--- a/pkgs/by-name/be/berry/package.nix
+++ b/pkgs/by-name/be/berry/package.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
         windows via a hotkey daemon such as sxhkd or expand functionality via
         shell scripts.
       - Small, hackable source code.
-      - Extensible themeing options with double borders, title bars, and window
+      - Extensible theming options with double borders, title bars, and window
         text.
       - Intuitively place new windows in unoccupied spaces.
       - Virtual desktops.
diff --git a/pkgs/by-name/bi/bibata-cursors-translucent/package.nix b/pkgs/by-name/bi/bibata-cursors-translucent/package.nix
index ed1f4b8457a3..63acc19437a1 100644
--- a/pkgs/by-name/bi/bibata-cursors-translucent/package.nix
+++ b/pkgs/by-name/bi/bibata-cursors-translucent/package.nix
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   meta = {
-    description = "Translucent Varient of the Material Based Cursor";
+    description = "Translucent Variant of the Material Based Cursor";
     homepage = "https://github.com/silica-dev/Bibata_Cursor_Translucent";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/bi/bigpemu/update.sh b/pkgs/by-name/bi/bigpemu/update.sh
index 35bc2506561e..2b21fff67c9b 100755
--- a/pkgs/by-name/bi/bigpemu/update.sh
+++ b/pkgs/by-name/bi/bigpemu/update.sh
@@ -3,7 +3,7 @@
 set -eu -o pipefail
 page="https://www.richwhitehouse.com/jaguar/index.php?content=download"
 extractor='font:contains("Current Version") strong text{}'
-lastest_version="$(curl "$page" | pup "$extractor")"
+latest_version="$(curl "$page" | pup "$extractor")"
 update-source-version \
     --ignore-same-version \
-    bigpemu.unwrapped "$lastest_version"
+    bigpemu.unwrapped "$latest_version"
diff --git a/pkgs/by-name/bl/blink-qt/package.nix b/pkgs/by-name/bl/blink-qt/package.nix
index a4db2740ede7..fdf7bfce63df 100644
--- a/pkgs/by-name/bl/blink-qt/package.nix
+++ b/pkgs/by-name/bl/blink-qt/package.nix
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   };
 
   patches = [
-    # Remove once https://github.com/AGProjects/blink-qt/pull/7 is mereged and tagged
+    # Remove once https://github.com/AGProjects/blink-qt/pull/7 is merged and tagged
     ./fix-none-account.patch
   ];
 
diff --git a/pkgs/by-name/bl/blobtools/package.nix b/pkgs/by-name/bl/blobtools/package.nix
index a7bf7717d918..3dcce0330808 100644
--- a/pkgs/by-name/bl/blobtools/package.nix
+++ b/pkgs/by-name/bl/blobtools/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "https://github.com/AndroidRoot/BlobTools";
-    description = "Tools for modifiying ASUS Transformer firmware";
+    description = "Tools for modifying ASUS Transformer firmware";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ ungeskriptet ];
     mainProgram = "blobpack";
diff --git a/pkgs/by-name/bl/blockhash/package.nix b/pkgs/by-name/bl/blockhash/package.nix
index ff236bf394bb..b986b6bb7a15 100644
--- a/pkgs/by-name/bl/blockhash/package.nix
+++ b/pkgs/by-name/bl/blockhash/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/commonsmachinery/blockhash";
     description = ''
       This is a perceptual image hash calculation tool based on algorithm
-      descibed in Block Mean Value Based Image Perceptual Hashing by Bian Yang,
+      described in Block Mean Value Based Image Perceptual Hashing by Bian Yang,
       Fan Gu and Xiamu Niu.
     '';
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/bl/bluetuith/package.nix b/pkgs/by-name/bl/bluetuith/package.nix
index f2584cfdeb8f..d66020b995e2 100644
--- a/pkgs/by-name/bl/bluetuith/package.nix
+++ b/pkgs/by-name/bl/bluetuith/package.nix
@@ -30,11 +30,11 @@ buildGoModule (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "TUI-based bluetooth connection manager";
+    description = "TUI-based Bluetooth connection manager";
     longDescription = ''
       Bluetuith can transfer files via OBEX, perform authenticated pairing,
-      and (dis)connect different bluetooth devices. It interacts with bluetooth
-      adapters and can toogle their power and discovery state. Bluetuith can also
+      and (dis)connect different Bluetooth devices. It interacts with Bluetooth
+      adapters and can toggle their power and discovery state. Bluetuith can also
       manage Bluetooth-based networking/tethering (PANU/DUN) and remote control
       devices. The TUI has mouse support.
     '';
diff --git a/pkgs/by-name/bl/bluez-alsa/package.nix b/pkgs/by-name/bl/bluez-alsa/package.nix
index 41fe72114c04..f396a7720525 100644
--- a/pkgs/by-name/bl/bluez-alsa/package.nix
+++ b/pkgs/by-name/bl/bluez-alsa/package.nix
@@ -78,9 +78,9 @@ stdenv.mkDerivation (finalAttrs: {
       playback and capture.
 
       Some backstory: Bluez 5 removed built-in support for ALSA in favor of a
-      generic interface for 3rd party appliations. Thereafter, PulseAudio
+      generic interface for 3rd party applications. Thereafter, PulseAudio
       implemented a backend for that interface and became the only way to get
-      Bluetooth audio with Bluez 5. Users prefering ALSA stayed on Bluez 4.
+      Bluetooth audio with Bluez 5. Users preferring ALSA stayed on Bluez 4.
       However, Bluez 4 eventually became deprecated.
 
       This package is a rebirth of a direct interface between ALSA and Bluez 5,
diff --git a/pkgs/by-name/bt/bttf/package.nix b/pkgs/by-name/bt/bttf/package.nix
index 94eb71eb8ec7..e5c86fe0248c 100644
--- a/pkgs/by-name/bt/bttf/package.nix
+++ b/pkgs/by-name/bt/bttf/package.nix
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doInstallCheck = true;
 
   meta = {
-    description = "Command line tool for datetime arithmetic, parsing, formatting and more. Replacment for biff";
+    description = "Command line tool for datetime arithmetic, parsing, formatting and more. Replacement for biff";
     homepage = "https://github.com/BurntSushi/bttf";
     changelog = "https://github.com/BurntSushi/bttf/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [
diff --git a/pkgs/by-name/bu/buildkite-agent/package.nix b/pkgs/by-name/bu/buildkite-agent/package.nix
index 1ff9748cd993..a97deaadf371 100644
--- a/pkgs/by-name/bu/buildkite-agent/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent/package.nix
@@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "buildkite-agent";
-  version = "3.129.0";
+  version = "3.135.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k1q/7KRaIv5SE7CYFAzV8JB+czmX/bvwBp8JY9t77tI=";
+    hash = "sha256-GldeyE1Km5qM4OXMzGW6CV2yP+3fR5XzmLLsvBUV8ZY=";
   };
 
-  vendorHash = "sha256-lRh5cAbg2yr+nvIaSRg3tG0tLvl7aDjyIoIjS1BvXNM=";
+  vendorHash = "sha256-I6qcebTFHrF/SjJUvzBHtbYdN1BafRM6XPGGNbBK7Lc=";
 
   postPatch = ''
     substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
diff --git a/pkgs/by-name/bu/buttermanager/package.nix b/pkgs/by-name/bu/buttermanager/package.nix
index 8a77c96a2614..fef9f87e23b7 100644
--- a/pkgs/by-name/bu/buttermanager/package.nix
+++ b/pkgs/by-name/bu/buttermanager/package.nix
@@ -46,7 +46,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   '';
 
   meta = {
-    description = "Btrfs tool for managing snapshots, balancing filesystems and upgrading the system safetly";
+    description = "Btrfs tool for managing snapshots, balancing filesystems and upgrading the system safely";
     homepage = "https://github.com/egara/buttermanager";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ t4ccer ];
diff --git a/pkgs/by-name/c-/c-intro-and-ref/package.nix b/pkgs/by-name/c-/c-intro-and-ref/package.nix
index a0ecd2f9fb8a..2831155085bb 100644
--- a/pkgs/by-name/c-/c-intro-and-ref/package.nix
+++ b/pkgs/by-name/c-/c-intro-and-ref/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     texliveBasic
   ];
 
-  # Remove pre-built documentaton artifacts
+  # Remove pre-built documentation artifacts
   postConfigure = ''
     make clean
   '';
diff --git a/pkgs/by-name/ca/camera-streamer/package.nix b/pkgs/by-name/ca/camera-streamer/package.nix
index 25503cf16bcb..875bbaeb22f2 100644
--- a/pkgs/by-name/ca/camera-streamer/package.nix
+++ b/pkgs/by-name/ca/camera-streamer/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   };
 
   # not sure why the -Werror isn't being an issue for the project maintainer
-  # my best guess is it's because the project README specifices
+  # my best guess is it's because the project README specifies
   # "Debian Bookworm" as a requirement which provides gcc12 by default
   postPatch = ''
     sed -i 's|git submodule update.*||' Makefile
diff --git a/pkgs/by-name/ca/cargo-codspeed/package.nix b/pkgs/by-name/ca/cargo-codspeed/package.nix
index 3d276079ccb8..d5e4f8277ee5 100644
--- a/pkgs/by-name/ca/cargo-codspeed/package.nix
+++ b/pkgs/by-name/ca/cargo-codspeed/package.nix
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # requires an extra dependency, blit
     "--skip=test_package_in_deps_build"
 
-    # requires criteron, which requires additional dependencies
+    # requires criterion, which requires additional dependencies
     "--skip=test_cargo_config_rustflags"
 
     # requires additional dependencies
diff --git a/pkgs/by-name/ca/catalyst/package.nix b/pkgs/by-name/ca/catalyst/package.nix
index 59fd8080d95b..f9a1a7e58402 100644
--- a/pkgs/by-name/ca/catalyst/package.nix
+++ b/pkgs/by-name/ca/catalyst/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   propagatedBuildInputs =
-    # create meta package providing dist-info for python3Pacakges.catalyst that common cmake build does not do
+    # create meta package providing dist-info for python3Packages.catalyst that common cmake build does not do
     lib.optional pythonSupport (
       python3Packages.mkPythonMetaPackage {
         inherit (finalAttrs) pname version meta;
diff --git a/pkgs/by-name/ca/catnest/package.nix b/pkgs/by-name/ca/catnest/package.nix
index 3e2349818818..8c78f1786416 100644
--- a/pkgs/by-name/ca/catnest/package.nix
+++ b/pkgs/by-name/ca/catnest/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Small, single-file and POSIX-compatible substituion for systemd-sysusers";
+    description = "Small, single-file and POSIX-compatible substitution for systemd-sysusers";
     homepage = "https://github.com/eweOS/catnest";
     license = lib.licenses.mit;
     mainProgram = "catnest";
diff --git a/pkgs/by-name/ch/chez-matchable/package.nix b/pkgs/by-name/ch/chez-matchable/package.nix
index 5242c7bdef90..229bf43e9ddb 100644
--- a/pkgs/by-name/ch/chez-matchable/package.nix
+++ b/pkgs/by-name/ch/chez-matchable/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = false;
 
   meta = {
-    description = "Library for ChezScheme providing the portable hygenic pattern matcher by Alex Shinn";
+    description = "Library for ChezScheme providing the portable hygienic pattern matcher by Alex Shinn";
     homepage = "https://github.com/fedeinthemix/chez-matchable/";
     maintainers = [ lib.maintainers.jitwit ];
     license = lib.licenses.publicDomain;
diff --git a/pkgs/by-name/ci/circleci-cli/package.nix b/pkgs/by-name/ci/circleci-cli/package.nix
index 425dfa68f6ae..70b86c7b2965 100644
--- a/pkgs/by-name/ci/circleci-cli/package.nix
+++ b/pkgs/by-name/ci/circleci-cli/package.nix
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     # Box blurb edited from the AUR package circleci-cli
     description = ''
       Command to enable you to reproduce the CircleCI environment locally and
-      run jobs as if they were running on the hosted CirleCI application.
+      run jobs as if they were running on the hosted CircleCI application.
     '';
     maintainers = [ ];
     mainProgram = "circleci";
diff --git a/pkgs/by-name/cj/cjdns-tools/package.nix b/pkgs/by-name/cj/cjdns-tools/package.nix
index 43c2fb28cafb..37c565083516 100644
--- a/pkgs/by-name/cj/cjdns-tools/package.nix
+++ b/pkgs/by-name/cj/cjdns-tools/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "https://github.com/cjdelisle/cjdns";
-    description = "Tools for cjdns managment";
+    description = "Tools for cjdns management";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
diff --git a/pkgs/by-name/cm/cmctl/package.nix b/pkgs/by-name/cm/cmctl/package.nix
index 9af09c6a382b..484978076461 100644
--- a/pkgs/by-name/cm/cmctl/package.nix
+++ b/pkgs/by-name/cm/cmctl/package.nix
@@ -50,7 +50,7 @@ buildGoModule (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Command line utility to interact with a cert-manager instalation on Kubernetes";
+    description = "Command line utility to interact with a cert-manager installation on Kubernetes";
     mainProgram = "cmctl";
     longDescription = ''
       cert-manager adds certificates and certificate issuers as resource types
diff --git a/pkgs/by-name/co/codebuff/update.sh b/pkgs/by-name/co/codebuff/update.sh
index c37afd4acb79..31478b9668f6 100755
--- a/pkgs/by-name/co/codebuff/update.sh
+++ b/pkgs/by-name/co/codebuff/update.sh
@@ -10,6 +10,6 @@ cd "$(dirname "${BASH_SOURCE[0]}")"
 npm i --package-lock-only codebuff@"$version"
 rm -f package.json
 
-# Update version and hases
+# Update version and hashes
 cd -
 nix-update codebuff --version "$version"
diff --git a/pkgs/by-name/cr/cramfsswap/package.nix b/pkgs/by-name/cr/cramfsswap/package.nix
index 080e4abb847d..f4a09ecc192b 100644
--- a/pkgs/by-name/cr/cramfsswap/package.nix
+++ b/pkgs/by-name/cr/cramfsswap/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Swap endianess of a cram filesystem (cramfs)";
+    description = "Swap endianness of a cram filesystem (cramfs)";
     mainProgram = "cramfsswap";
     homepage = "https://packages.debian.org/sid/utils/cramfsswap";
     license = lib.licenses.gpl2Only;
diff --git a/pkgs/by-name/cs/csa/package.nix b/pkgs/by-name/cs/csa/package.nix
index 348512cacfa4..c48c6c0c8f6b 100644
--- a/pkgs/by-name/cs/csa/package.nix
+++ b/pkgs/by-name/cs/csa/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     longDescription = ''
       CSA means : Contrôle Signal Audio.
       It contains the following plugins:
-      Emphazised Limiter, Cellular Leveler, Simple right/left amplifier. Blind Peak Meter.
+      Emphasised Limiter, Cellular Leveler, Simple right/left amplifier. Blind Peak Meter.
     '';
     license = lib.licenses.gpl3;
     maintainers = [ lib.maintainers.magnetophon ];
diff --git a/pkgs/by-name/da/daemonize/package.nix b/pkgs/by-name/da/daemonize/package.nix
index a08e31d6d3c7..8e7cca0bd418 100644
--- a/pkgs/by-name/da/daemonize/package.nix
+++ b/pkgs/by-name/da/daemonize/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    # conbination of:
+    # combination of:
     # https://github.com/bmc/daemonize/commit/eaf4746d47e171e7b8655690eb1e91fc216f2866
     # https://github.com/bmc/daemonize/pull/39
     ./include-write-prototype.patch
diff --git a/pkgs/by-name/da/datovka/package.nix b/pkgs/by-name/da/datovka/package.nix
index 1c64adf305ad..99429cfb8003 100644
--- a/pkgs/by-name/da/datovka/package.nix
+++ b/pkgs/by-name/da/datovka/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "Client application for operating Czech government-provided Databox infomation system";
+    description = "Client application for operating Czech government-provided Databox information system";
     homepage = "https://www.datovka.cz/";
     license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.mmahut ];
diff --git a/pkgs/by-name/db/dbeaver-bin/update.sh b/pkgs/by-name/db/dbeaver-bin/update.sh
index 8a1e992dcef1..4729fd1c248a 100755
--- a/pkgs/by-name/db/dbeaver-bin/update.sh
+++ b/pkgs/by-name/db/dbeaver-bin/update.sh
@@ -20,7 +20,7 @@ for i in \
     "aarch64-linux linux-aarch64.tar.gz" \
     "aarch64-darwin macos-aarch64.dmg"
 do
-    # shellcheck disable=SC2086 # $i is intentionally splitted to $1 and $2
+    # shellcheck disable=SC2086 # $i is intentionally split to $1 and $2
     set -- $i
     prefetch=$(nix-prefetch-url "https://github.com/dbeaver/dbeaver/releases/download/$latestVersion/dbeaver-ce-$latestVersion-$2")
     hash=$(nix-hash --type sha256 --to-sri "$prefetch")
diff --git a/pkgs/by-name/de/deark/package.nix b/pkgs/by-name/de/deark/package.nix
index c70eb9a2d3b0..dd7a93ebb059 100644
--- a/pkgs/by-name/de/deark/package.nix
+++ b/pkgs/by-name/de/deark/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
       #                copyright messages are not removed, and no monies are exchanged"
       #                + waiver of liability)
       unfreeRedistributable
-      # lzhuf.* (no copywrite notice, predates standardized licenses,
+      # lzhuf.* (no copyright notice, predates standardized licenses,
       #          widely distributed & intent appears to be free use)
       # "By necessity, Deark contains knowledge about how to decode various
       # third-party file formats. This knowledge includes data structures,
diff --git a/pkgs/by-name/de/deepfilternet/package.nix b/pkgs/by-name/de/deepfilternet/package.nix
index 0d2a39c49f80..aba04c170ecf 100644
--- a/pkgs/by-name/de/deepfilternet/package.nix
+++ b/pkgs/by-name/de/deepfilternet/package.nix
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   meta = {
-    description = "Noise supression using deep filtering";
+    description = "Noise suppression using deep filtering";
     homepage = "https://github.com/Rikorose/DeepFilterNet";
     license = with lib.licenses; [
       mit
diff --git a/pkgs/by-name/de/devpi-server/unwrapped.nix b/pkgs/by-name/de/devpi-server/unwrapped.nix
index 4e49c2407af4..d5c74d2e3bb3 100644
--- a/pkgs/by-name/de/devpi-server/unwrapped.nix
+++ b/pkgs/by-name/de/devpi-server/unwrapped.nix
@@ -96,7 +96,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   # root_passwd_hash tries to write to store
-  # TestMirrorIndexThings tries to write to /var through ngnix
+  # TestMirrorIndexThings tries to write to /var through nginx
   # nginx tests try to write to /var
   preCheck = ''
     export PATH=$PATH:$out/bin
diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 96443cc1755b..59dea1e9fb79 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dnscontrol";
-  version = "4.44.1";
+  version = "4.45.0";
 
   src = fetchFromGitHub {
     owner = "DNSControl";
     repo = "dnscontrol";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uilDR4MPc3FO/6i2Gd+sssL+xzVWX4f4yvpnFspKcx0=";
+    hash = "sha256-P3krRUpoNEVNtTREy+YsE8A9pHelaSBbjo/A1mgKIjc=";
   };
 
-  vendorHash = "sha256-tpkPr6An8CvPFK9/oD0U3TEHc2hRK4vqFN71VZzxpXA=";
+  vendorHash = "sha256-DV0JBu95O6s1xt7v8qo9jZUzqF7tnf0/fBgwVWfVIIU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/dn/dnslink-std-go/package.nix b/pkgs/by-name/dn/dnslink-std-go/package.nix
index 07cc12777c12..a94aa8567519 100644
--- a/pkgs/by-name/dn/dnslink-std-go/package.nix
+++ b/pkgs/by-name/dn/dnslink-std-go/package.nix
@@ -14,7 +14,7 @@ buildGoModule (finalAttrs: {
     hash = "sha256-aATnNDUogNS4jBoWxUAFYFMa2ZS0+th3XH+1KWqwfWQ=";
   };
   vendorHash = "sha256-RH55yfIO9jHLbjtEdUF5QpL5ILV5ctX2hBYBJWutmUA=";
-  doCheck = false; # Uses network, unsuprisingly.
+  doCheck = false; # Uses network, unsurprisingly.
   meta = {
     changelog = "https://github.com/dnslink-std/go/releases/tag/v${finalAttrs.version}";
     description = "Reference implementation for DNSLink in golang";
diff --git a/pkgs/by-name/do/docker-sbx/package.nix b/pkgs/by-name/do/docker-sbx/package.nix
index 12903ead4d19..a33f4afc7540 100644
--- a/pkgs/by-name/do/docker-sbx/package.nix
+++ b/pkgs/by-name/do/docker-sbx/package.nix
@@ -15,9 +15,9 @@
 }:
 let
   hashes = {
-    "x86_64-linux" = "sha256-dwq/f5GxOrqGzHu31Ui44HyBLVoQkyGQXnt9oK0H2Zg=";
-    "aarch64-linux" = "sha256-tV65eOO1Zh3cpnGC+1wz086s/7wlnEw8YUGlRcmyvOw=";
-    "aarch64-darwin" = "sha256-uEb+wFj0z3pDQzQ5EyBsZbDDkWrd6iT82xmj2QyKuI8=";
+    "x86_64-linux" = "sha256-nrzqgx1NJw4lrhd3vxXiR1ar+/h5GtJylHVGgoOO0As=";
+    "aarch64-linux" = "sha256-BR/fg0n4pm20epkOEaMM0dLgE6xsjkLkjAcr/OwGodU=";
+    "aarch64-darwin" = "sha256-Fg0eq0R8IA4vVKIqZIkByoDuhVVyTsALYMK9qsPE6hw=";
   };
   platformName = {
     "x86_64-linux" = "linux-amd64";
@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "docker-sbx";
-  version = "0.37.0";
+  version = "0.38.0";
   src =
     let
       throwPlat = throw "Unsupported platform ${stdenvNoCC.hostPlatform.system}";
diff --git a/pkgs/by-name/dq/dq/package.nix b/pkgs/by-name/dq/dq/package.nix
index ae9db4717ede..cc994b790809 100644
--- a/pkgs/by-name/dq/dq/package.nix
+++ b/pkgs/by-name/dq/dq/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Recursive DNS/DNSCurve server and comandline tool";
+    description = "Recursive DNS/DNSCurve server and commandline tool";
     homepage = "https://github.com/janmojzis/dq";
     changelog = "https://github.com/janmojzis/dq/releases/tag/${finalAttrs.version}";
     license = with lib.licenses; [
diff --git a/pkgs/by-name/dr/dragmap/package.nix b/pkgs/by-name/dr/dragmap/package.nix
index 1c2898efb370..8f554102db65 100644
--- a/pkgs/by-name/dr/dragmap/package.nix
+++ b/pkgs/by-name/dr/dragmap/package.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "dragen-os";
     longDescription = ''
       DRAGMAP is an open-source software implementation of the DRAGEN mapper,
-      which the Illumina team created to procude the same results as their
+      which the Illumina team created to produce the same results as their
       proprietary DRAGEN hardware.
     '';
     homepage = "https://github.com/Illumina/DRAGMAP";
diff --git a/pkgs/by-name/dr/drupal/package.nix b/pkgs/by-name/dr/drupal/package.nix
index b9969e825517..39bab023b353 100644
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@@ -8,18 +8,18 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "drupal";
-  version = "11.4.4";
+  version = "11.4.5";
 
   src = fetchFromGitLab {
     domain = "git.drupalcode.org";
     owner = "project";
     repo = "drupal";
     tag = finalAttrs.version;
-    hash = "sha256-lwD4k4orQQD9gl60/Er9s1JTClN2i7b7JxBFuz5h+4s=";
+    hash = "sha256-G5Kk4EVpMXV9H9LFvRJnh1Y1rqL6fA18WoTJs+lRV10=";
   };
 
   composerNoPlugins = false;
-  vendorHash = "sha256-mJwOXz+nn1N7kFKofkuqBcbXJGwJDcgRrhKAhhwydik=";
+  vendorHash = "sha256-P6egjq0lffLGDv3hDJOTvW8Qs3vqR9cT33oURKTfRcQ=";
 
   passthru = {
     tests = {
diff --git a/pkgs/by-name/du/duplicati/update.sh b/pkgs/by-name/du/duplicati/update.sh
index 663b40c08634..8fb6dd0582cf 100755
--- a/pkgs/by-name/du/duplicati/update.sh
+++ b/pkgs/by-name/du/duplicati/update.sh
@@ -3,7 +3,7 @@
 
 set -euo pipefail
 
-OWNNER="duplicati"
+OWNER="duplicati"
 REPO="duplicati"
 
 SCRIPT_DIR=$(dirname "$(readlink -f "$0")")
@@ -12,7 +12,7 @@ TARGET="$SCRIPT_DIR/package.nix"
 TMP=$(mktemp -d)
 trap 'rm -rf "$TMP"' EXIT
 
-TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s "https://api.github.com/repos/$OWNNER/$REPO/tags" |
+TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s "https://api.github.com/repos/$OWNER/$REPO/tags" |
   jq -r '.[].name' |
   grep -E '^v[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+_stable_' |
   sort -Vr |
@@ -22,12 +22,12 @@ VERSION=$(echo "$TAG" | cut -d_ -f1 | sed 's/^v//')
 CHANNEL=$(echo "$TAG" | cut -d_ -f2)
 DATE=$(echo "$TAG" | cut -d_ -f3)
 
-HASH=$(nix-prefetch-github $OWNNER $REPO --rev "$TAG" |
+HASH=$(nix-prefetch-github $OWNER $REPO --rev "$TAG" |
   jq -r '.hash')
 
 curl -sL \
   -o "$TMP/package.json" \
-  "https://raw.githubusercontent.com/$OWNNER/$REPO/$TAG/Duplicati/Server/webroot/ngclient/package.json"
+  "https://raw.githubusercontent.com/$OWNER/$REPO/$TAG/Duplicati/Server/webroot/ngclient/package.json"
 
 NGCLIENT_VERSION=$(
   jq -r '.dependencies["@duplicati/ngclient"]' \
@@ -40,13 +40,13 @@ NGCLIENT_REV=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} \
   jq -r '.items[0].sha')
 
 NGCLIENT_HASH=$(
-  nix-prefetch-github $OWNNER ngclient --rev "$NGCLIENT_REV" |
+  nix-prefetch-github $OWNER ngclient --rev "$NGCLIENT_REV" |
     jq -r .hash
 )
 
 curl -sL \
   -o "$TMP/package-lock.json" \
-  "https://raw.githubusercontent.com/$OWNNER/ngclient/$NGCLIENT_REV/package-lock.json"
+  "https://raw.githubusercontent.com/$OWNER/ngclient/$NGCLIENT_REV/package-lock.json"
 
 NGCLIENT_NPM_DEPS_HASH="$(prefetch-npm-deps "$TMP"/package-lock.json)"
 
diff --git a/pkgs/by-name/ea/eask-cli/package.nix b/pkgs/by-name/ea/eask-cli/package.nix
index 0afd665f83f1..a051cbf1415c 100644
--- a/pkgs/by-name/ea/eask-cli/package.nix
+++ b/pkgs/by-name/ea/eask-cli/package.nix
@@ -33,7 +33,7 @@ buildNpmPackage (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/emacs-eask/cli/blob/${finalAttrs.version}/CHANGELOG.md";
-    description = "CLI for building, runing, testing, and managing your Emacs Lisp dependencies";
+    description = "CLI for building, running, testing, and managing your Emacs Lisp dependencies";
     homepage = "https://emacs-eask.github.io/";
     license = lib.licenses.gpl3Plus;
     mainProgram = "eask";
diff --git a/pkgs/by-name/ed/edgetx/package.nix b/pkgs/by-name/ed/edgetx/package.nix
index 36b4d2af3ee2..7b915408afff 100644
--- a/pkgs/by-name/ed/edgetx/package.nix
+++ b/pkgs/by-name/ed/edgetx/package.nix
@@ -38,7 +38,7 @@ let
     ]
   );
 
-  # paches are needed to fix build with CMake 4
+  # patches are needed to fix build with CMake 4
   yaml-cppSrc = applyPatches {
     inherit (yaml-cpp) src;
     patches = yaml-cpp.patches or [ ];
diff --git a/pkgs/by-name/en/ente-auth/package.nix b/pkgs/by-name/en/ente-auth/package.nix
index 8e401dad5ba9..4bd23dfbe295 100644
--- a/pkgs/by-name/en/ente-auth/package.nix
+++ b/pkgs/by-name/en/ente-auth/package.nix
@@ -34,7 +34,7 @@ flutter.buildFlutterApplication rec {
 
   customSourceBuilders.ente_strings =
     { version, src, ... }:
-    # There currently is no covenient way to setup the flutter SDK outside of apps
+    # There currently is no convenient way to setup the flutter SDK outside of apps
     # and we can't move this to the app's own build phase as it would still reference
     # the immutable source variant without the generated l10n files.
     flutter.buildFlutterApplication {
diff --git a/pkgs/by-name/en/ente-web/package.nix b/pkgs/by-name/en/ente-web/package.nix
index 552f1df0d8f0..5e5edbf27407 100644
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@@ -12,7 +12,7 @@
   wasm-pack,
   writeScript,
   extraBuildEnv ? { },
-  # This package contains serveral sub-applications. This specifies which of them you want to build.
+  # This package contains several sub-applications. This specifies which of them you want to build.
   enteApp ? "photos",
   # Accessing some apps (such as account) directly will result in a hardcoded redirect to ente.io.
   # To prevent users from accidentally logging in to ente.io instead of the selfhosted instance, you
diff --git a/pkgs/by-name/er/er-patcher/package.nix b/pkgs/by-name/er/er-patcher/package.nix
index 6f17a814ca33..ef7431c32ea9 100644
--- a/pkgs/by-name/er/er-patcher/package.nix
+++ b/pkgs/by-name/er/er-patcher/package.nix
@@ -33,7 +33,7 @@ stdenvNoCC.mkDerivation rec {
     longDescription = ''
       A tool aimed at enhancing the experience when playing the game on linux through proton or natively on windows.
       This tool is based on patching the game executable through hex-edits. However it is done in a safe and non-destructive way,
-      that ensures the patched executable is never run with EAC enabled (unless explicity told to do so). Use at your own risk!
+      that ensures the patched executable is never run with EAC enabled (unless explicitly told to do so). Use at your own risk!
     '';
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sigmasquadron ];
diff --git a/pkgs/by-name/er/erigon/package.nix b/pkgs/by-name/er/erigon/package.nix
index bd7a5df7c2fb..50b967731c0f 100644
--- a/pkgs/by-name/er/erigon/package.nix
+++ b/pkgs/by-name/er/erigon/package.nix
@@ -38,7 +38,7 @@ buildGoModule (finalAttrs: {
     # > Some binaries contain forbidden references to /build/.
     #
     # If we need it in the future, we should consider packaging silkworm and silkworm-go
-    # as depenedencies explicitly.
+    # as dependencies explicitly.
     "nosilkworm"
   ];
 
diff --git a/pkgs/by-name/eu/eukleides/package.nix b/pkgs/by-name/eu/eukleides/package.nix
index 91b9f6f4c7f5..a2a3271d824d 100644
--- a/pkgs/by-name/eu/eukleides/package.nix
+++ b/pkgs/by-name/eu/eukleides/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./use-CC.patch
     # allow PostScript transparency in epstopdf call
     ./gs-allowpstransparency.patch
-    # fix curly brace escaping in eukleides.texi for newer texinfo compatiblity
+    # fix curly brace escaping in eukleides.texi for newer texinfo compatibility
     ./texinfo-escape.patch
     (fetchpatch2 {
       url = "https://salsa.debian.org/georgesk/eukleides/-/raw/debian/1.5.4-6/debian/patches/fixes-for-gcc15.patch";
diff --git a/pkgs/applications/window-managers/evilwm/default.nix b/pkgs/by-name/ev/evilwm/package.nix
similarity index 70%
rename from pkgs/applications/window-managers/evilwm/default.nix
rename to pkgs/by-name/ev/evilwm/package.nix
index 11bbebb5dcd6..0aee1d84b74f 100644
--- a/pkgs/applications/window-managers/evilwm/default.nix
+++ b/pkgs/by-name/ev/evilwm/package.nix
@@ -7,16 +7,19 @@
   libxrandr,
   libxrender,
   xorgproto,
-  patches ? [ ],
+  config,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "evilwm";
   version = "1.5";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
-    url = "https://www.6809.org.uk/evilwm/evilwm-${version}.tar.gz";
-    sha256 = "sha256-YQSFJBPm1QZpNh3K3aWiXTnisrDJWmOEAiyQWVeidA8=";
+    url = "https://www.6809.org.uk/evilwm/evilwm-${finalAttrs.version}.tar.gz";
+    hash = "sha256-YQSFJBPm1QZpNh3K3aWiXTnisrDJWmOEAiyQWVeidA8=";
   };
 
   buildInputs = [
@@ -33,8 +36,8 @@ stdenv.mkDerivation rec {
       --replace "CC = gcc" "#CC = gcc"
   '';
 
-  # Allow users set their own list of patches
-  inherit patches;
+  # Allow users to set their own list of patches
+  patches = config.evilwm.patches or [ ];
 
   meta = {
     homepage = "http://www.6809.org.uk/evilwm/";
@@ -49,4 +52,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.all;
     mainProgram = "evilwm";
   };
-}
+})
diff --git a/pkgs/by-name/fa/faas-cli/package.nix b/pkgs/by-name/fa/faas-cli/package.nix
index 2303c76ae5ac..37592ba39503 100644
--- a/pkgs/by-name/fa/faas-cli/package.nix
+++ b/pkgs/by-name/fa/faas-cli/package.nix
@@ -6,8 +6,7 @@
   makeWrapper,
   git,
   installShellFiles,
-  testers,
-  faas-cli,
+  versionCheckHook,
 }:
 let
   faasPlatform =
@@ -26,11 +25,13 @@ buildGoModule (finalAttrs: {
   pname = "faas-cli";
   version = "0.18.12";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
-    rev = finalAttrs.version;
-    sha256 = "sha256-I7P30c7rEVqemgUu/1AtM6jq2f4KB8xyDpjGBMvkLRU=";
+    tag = finalAttrs.version;
+    hash = "sha256-I7P30c7rEVqemgUu/1AtM6jq2f4KB8xyDpjGBMvkLRU=";
   };
 
   vendorHash = null;
@@ -41,7 +42,6 @@ buildGoModule (finalAttrs: {
 
   ldflags = [
     "-s"
-    "-w"
     "-X github.com/openfaas/faas-cli/version.GitCommit=ref/tags/${finalAttrs.version}"
     "-X github.com/openfaas/faas-cli/version.Version=${finalAttrs.version}"
     "-X github.com/openfaas/faas-cli/commands.Platform=${faasPlatform stdenv.hostPlatform}"
@@ -61,10 +61,9 @@ buildGoModule (finalAttrs: {
       --zsh <($out/bin/faas-cli completion --shell zsh)
   '';
 
-  passthru.tests.version = testers.testVersion {
-    command = "${faas-cli}/bin/faas-cli version --short-version --warn-update=false";
-    package = faas-cli;
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
 
   meta = {
     description = "Official CLI for OpenFaaS";
diff --git a/pkgs/by-name/fa/farstream/package.nix b/pkgs/by-name/fa/farstream/package.nix
index 9f4e651c82af..891018437445 100644
--- a/pkgs/by-name/fa/farstream/package.nix
+++ b/pkgs/by-name/fa/farstream/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.freedesktop.org/wiki/Software/Farstream";
-    description = "Audio/Video Communications Framework formely known as farsight";
+    description = "Audio/Video Communications Framework formerly known as farsight";
     platforms = lib.platforms.unix;
     license = lib.licenses.lgpl21;
   };
diff --git a/pkgs/by-name/fa/fast-cli-zig/package.nix b/pkgs/by-name/fa/fast-cli-zig/package.nix
index fa512842d3c2..a245cc4ab911 100644
--- a/pkgs/by-name/fa/fast-cli-zig/package.nix
+++ b/pkgs/by-name/fa/fast-cli-zig/package.nix
@@ -5,7 +5,7 @@
   zig_0_15,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  # fast-cli existed, was removed as noted in aliasses.nix on 2025-11-17. Consider to rename this package after 1 to 2 releases of nixos
+  # fast-cli existed, was removed as noted in aliases.nix on 2025-11-17. Consider to rename this package after 1 to 2 releases of nixos
   pname = "fast-cli-zig";
   version = "0.3.5";
 
diff --git a/pkgs/by-name/fi/fil-plugins/package.nix b/pkgs/by-name/fi/fil-plugins/package.nix
index d863acf2c78b..1c184c71e5ca 100644
--- a/pkgs/by-name/fi/fil-plugins/package.nix
+++ b/pkgs/by-name/fi/fil-plugins/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
       Each section has an active/bypass switch, frequency, bandwidth and gain controls.
       There is also a global bypass switch and gain control.
       The 2nd order resonant filters are implemented using a Mitra-Regalia style lattice filter.
-      All switches and controls are internally smoothed, so they can be used 'live' whithout any clicks or zipper noises.
+      All switches and controls are internally smoothed, so they can be used 'live' without any clicks or zipper noises.
       This should make this plugin a good candidate for use in systems that allow automation of plugin control ports, such as Ardour, or for stage use.
     '';
     homepage = "http://kokkinizita.linuxaudio.org/linuxaudio/ladspa/index.html";
diff --git a/pkgs/by-name/fi/firefox_decrypt/package.nix b/pkgs/by-name/fi/firefox_decrypt/package.nix
index 74b6c316de6c..86989c203f97 100644
--- a/pkgs/by-name/fi/firefox_decrypt/package.nix
+++ b/pkgs/by-name/fi/firefox_decrypt/package.nix
@@ -53,7 +53,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/unode/firefox_decrypt";
-    description = "Tool to extract passwords from profiles of Mozilla Firefox and derivates";
+    description = "Tool to extract passwords from profiles of Mozilla Firefox and derivatives";
     mainProgram = "firefox-decrypt";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/fl/flexibee/package.nix b/pkgs/by-name/fl/flexibee/package.nix
index 6ad85f01f161..5463c90e9b1c 100644
--- a/pkgs/by-name/fl/flexibee/package.nix
+++ b/pkgs/by-name/fl/flexibee/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "Client for an accouting economic system";
+    description = "Client for an accounting economic system";
     homepage = "https://www.flexibee.eu/";
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.mmahut ];
diff --git a/pkgs/by-name/fo/footswitch/package.nix b/pkgs/by-name/fo/footswitch/package.nix
index cb8dadb40690..bd1f6a1e0078 100644
--- a/pkgs/by-name/fo/footswitch/package.nix
+++ b/pkgs/by-name/fo/footswitch/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   doInstallCheck = true;
 
   meta = {
-    description = "Command line utlities for programming PCsensor and Scythe foot switches";
+    description = "Command line utilities for programming PCsensor and Scythe foot switches";
     homepage = "https://github.com/rgerganov/footswitch";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
diff --git a/pkgs/applications/version-management/fossil/default.nix b/pkgs/by-name/fo/fossil/package.nix
similarity index 99%
rename from pkgs/applications/version-management/fossil/default.nix
rename to pkgs/by-name/fo/fossil/package.nix
index d38710a98822..497264e94d93 100644
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/by-name/fo/fossil/package.nix
@@ -13,7 +13,6 @@
   sqlite,
   ed,
   which,
-  tclPackages,
   withJson ? true,
 }:
 
diff --git a/pkgs/by-name/fr/frescobaldi/package.nix b/pkgs/by-name/fr/frescobaldi/package.nix
index b3a673bd85c8..a80c607834d4 100644
--- a/pkgs/by-name/fr/frescobaldi/package.nix
+++ b/pkgs/by-name/fr/frescobaldi/package.nix
@@ -56,7 +56,7 @@ python3Packages.buildPythonApplication rec {
       versions of LilyPond, automatically selects the correct version, Built-in
       LilyPond documentation browser and built-in User Guide, Smart
       layout-control functions like coloring specific objects in the PDF,
-      MusicXML import, Modern user iterface with configurable colors,
+      MusicXML import, Modern user interface with configurable colors,
       fonts and keyboard shortcuts
     '';
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/fr/frigate/package.nix b/pkgs/by-name/fr/frigate/package.nix
index 024fdc31b76d..162e3d86f630 100644
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -103,7 +103,7 @@ python3Packages.buildPythonApplication rec {
     # https://github.com/blakeblackshear/frigate/pull/22089
     ./proc-cmdline-strip.patch
 
-    # Fix more granular dtype resultion in Pandas 3.0
+    # Fix more granular dtype resolution in Pandas 3.0
     ./pandas3-compat.patch
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/by-name/ga/gajim/package.nix
similarity index 95%
rename from pkgs/applications/networking/instant-messengers/gajim/default.nix
rename to pkgs/by-name/ga/gajim/package.nix
index e9b623befca0..b8e701c5eaf9 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/by-name/ga/gajim/package.nix
@@ -16,10 +16,7 @@
   # Optional dependencies
   enableJingle ? true,
   farstream,
-  gstreamer,
-  gst-plugins-base,
-  gst-libav,
-  gst-plugins-good,
+  gst_all_1,
   libnice,
   enableSecrets ? true,
   libsecret,
@@ -35,7 +32,14 @@
   gsound,
   extraPythonPackages ? ps: [ ],
 }:
-
+let
+  inherit (gst_all_1)
+    gstreamer
+    gst-plugins-base
+    gst-libav
+    gst-plugins-good
+    ;
+in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "gajim";
   version = "2.5.0";
@@ -61,7 +65,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   ++ lib.optionals enableJingle [
     farstream
     gst-libav
-    gst-plugins-good
+    (gst-plugins-good.override { gtkSupport = true; })
     libnice
   ]
   ++ lib.optional enableSecrets libsecret
diff --git a/pkgs/by-name/ga/gam/package.nix b/pkgs/by-name/ga/gam/package.nix
index f0cbf861b272..36aab3138bf9 100644
--- a/pkgs/by-name/ga/gam/package.nix
+++ b/pkgs/by-name/ga/gam/package.nix
@@ -47,7 +47,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   # Use XDG-ish dirs for configuration. These would otherwise be in the gam
   # package.
   #
-  # Using --run as `makeWapper` evaluates variables for --set and --set-default
+  # Using --run as `makeWrapper` evaluates variables for --set and --set-default
   # at build time and then single quotes the vars in the wrapper, thus they
   # wouldn't get expanded. But using --run allows setting default vars that are
   # evaluated on run and not during build time.
diff --git a/pkgs/by-name/ga/gaw/package.nix b/pkgs/by-name/ga/gaw/package.nix
index fc43efe26fbb..b259129bc24b 100644
--- a/pkgs/by-name/ga/gaw/package.nix
+++ b/pkgs/by-name/ga/gaw/package.nix
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "gaw";
     longDescription = ''
       Gaw is a software tool for displaying analog waveforms from
-      sampled datas, for example from the output of simulators or
+      sampled data, for example from the output of simulators or
       input from sound cards. Data can be imported to gaw using files,
       direct tcp/ip connection or directly from the sound card.
     '';
diff --git a/pkgs/applications/science/electronics/gerbv/0001-fix-invalid-function-signatures.patch b/pkgs/by-name/ge/gerbv/0001-fix-invalid-function-signatures.patch
similarity index 100%
rename from pkgs/applications/science/electronics/gerbv/0001-fix-invalid-function-signatures.patch
rename to pkgs/by-name/ge/gerbv/0001-fix-invalid-function-signatures.patch
diff --git a/pkgs/applications/science/electronics/gerbv/default.nix b/pkgs/by-name/ge/gerbv/package.nix
similarity index 81%
rename from pkgs/applications/science/electronics/gerbv/default.nix
rename to pkgs/by-name/ge/gerbv/package.nix
index 46a51950cda4..4ac18db31d22 100644
--- a/pkgs/applications/science/electronics/gerbv/default.nix
+++ b/pkgs/by-name/ge/gerbv/package.nix
@@ -12,14 +12,14 @@
   pkg-config,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gerbv";
   version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "gerbv";
     repo = "gerbv";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-sr48RGLYcMKuyH9p+5BhnR6QpKBvNOqqtRryw3+pbBk=";
   };
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    sed -i '/AC_INIT/s/m4_esyscmd.*/${version}])/' configure.ac
+    sed -i '/AC_INIT/s/m4_esyscmd.*/${finalAttrs.version}])/' configure.ac
   '';
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    cairo
+    (cairo.override { x11Support = true; })
     gettext
     gtk2-x11
     libtool
@@ -53,9 +53,9 @@ stdenv.mkDerivation rec {
     description = "Gerber (RS-274X) viewer";
     mainProgram = "gerbv";
     homepage = "https://gerbv.github.io/";
-    changelog = "https://github.com/gerbv/gerbv/releases/tag/v${version}";
+    changelog = "https://github.com/gerbv/gerbv/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ mog ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/gf/gfan/package.nix b/pkgs/by-name/gf/gfan/package.nix
index 8b6bce850f2f..e01e3d8d5b7c 100644
--- a/pkgs/by-name/gf/gfan/package.nix
+++ b/pkgs/by-name/gf/gfan/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-    # On MacOS, we need to adress differences in int64_t types and remove the
+    # On macOS, we need to address differences in int64_t types and remove the
     # "experimental/" library and namespace prefixes as well as references to
     # std::execution.
     ./gfan-0.7-macos.patch
diff --git a/pkgs/by-name/gi/gildas/update.py b/pkgs/by-name/gi/gildas/update.py
index 7f832232326e..f12779b71387 100755
--- a/pkgs/by-name/gi/gildas/update.py
+++ b/pkgs/by-name/gi/gildas/update.py
@@ -80,7 +80,7 @@ def find_latest(srcVersions):
 
 def get_hash(srcVersion):
     """
-    Get the hash of a given source versionn
+    Get the hash of a given source version
 
     """
 
diff --git a/pkgs/by-name/gi/git-point/package.nix b/pkgs/by-name/gi/git-point/package.nix
index 75482bdd8d41..01b5028e4711 100644
--- a/pkgs/by-name/gi/git-point/package.nix
+++ b/pkgs/by-name/gi/git-point/package.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage {
 
   meta = {
     homepage = "https://github.com/Qyriad/git-point";
-    description = "Set arbitrary refs without shooting yourself in the foot, a procelain `git update-ref`";
+    description = "Set arbitrary refs without shooting yourself in the foot, a porcelain `git update-ref`";
     maintainers = [
       lib.maintainers.qyriad
       lib.maintainers.philiptaron
diff --git a/pkgs/by-name/gi/gitlab/package.nix b/pkgs/by-name/gi/gitlab/package.nix
index b66f2c495e03..3af7b1d3e715 100644
--- a/pkgs/by-name/gi/gitlab/package.nix
+++ b/pkgs/by-name/gi/gitlab/package.nix
@@ -123,7 +123,7 @@ let
             '';
           };
 
-          # GitLab publishes a Cargo.lock for gitlab_query_lanaguage that does not contain the `source` attribute
+          # GitLab publishes a Cargo.lock for gitlab_query_language that does not contain the `source` attribute
           # for the `glql` dependency. This is an intentional choice by them that is documented in the README.
           # This code refetches this hash and exposes the lockfile, so that it can be used in later stages.
           nativeBuildInputs = [ cargo ];
diff --git a/pkgs/by-name/gl/glusterfs/package.nix b/pkgs/by-name/gl/glusterfs/package.nix
index cbe98c3ffbac..2bf514005d8d 100644
--- a/pkgs/by-name/gl/glusterfs/package.nix
+++ b/pkgs/by-name/gl/glusterfs/package.nix
@@ -264,7 +264,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Distributed storage system";
     homepage = "https://www.gluster.org";
-    license = lib.licenses.lgpl3Plus; # dual licese: choice of lgpl3Plus or gpl2
+    license = lib.licenses.lgpl3Plus; # dual license: choice of lgpl3Plus or gpl2
     maintainers = [ lib.maintainers.raskin ];
     platforms = with lib.platforms; linux ++ freebsd;
   };
diff --git a/pkgs/tools/networking/gmrender-resurrect/default.nix b/pkgs/by-name/gm/gmrender-resurrect/package.nix
similarity index 88%
rename from pkgs/tools/networking/gmrender-resurrect/default.nix
rename to pkgs/by-name/gm/gmrender-resurrect/package.nix
index b1416829eb39..cff98c690b52 100644
--- a/pkgs/tools/networking/gmrender-resurrect/default.nix
+++ b/pkgs/by-name/gm/gmrender-resurrect/package.nix
@@ -5,18 +5,22 @@
   autoreconfHook,
   pkg-config,
   makeWrapper,
-  gstreamer,
-  gst-plugins-base,
-  gst-plugins-good,
-  gst-plugins-bad,
-  gst-plugins-ugly,
-  gst-libav,
+  gst_all_1,
   libupnp,
 }:
 
 let
   version = "0.3.1";
 
+  inherit (gst_all_1)
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+    gst-plugins-bad
+    gst-plugins-ugly
+    gst-libav
+    ;
+
   pluginPath = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" [
     gstreamer
     gst-plugins-base
@@ -25,6 +29,7 @@ let
     gst-plugins-ugly
     gst-libav
   ];
+
 in
 stdenv.mkDerivation {
   pname = "gmrender-resurrect";
diff --git a/pkgs/by-name/gn/gnome-network-displays/package.nix b/pkgs/by-name/gn/gnome-network-displays/package.nix
index 57e2576d2b7d..0da97b37e2d9 100644
--- a/pkgs/by-name/gn/gnome-network-displays/package.nix
+++ b/pkgs/by-name/gn/gnome-network-displays/package.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     pipewire
     networkmanager
     json-glib
-    # Not stricly required according to configure phase log, but putting it
+    # Not strictly required according to configure phase log, but putting it
     # here adds gio modules to the GIO_EXTRA_MODULES environment variables - as
     # required for TLS. See https://github.com/NixOS/nixpkgs/issues/502092
     glib-networking
diff --git a/pkgs/by-name/gn/gnuplot/package.nix b/pkgs/by-name/gn/gnuplot/package.nix
index 2a9c7f13d07d..5722934e0cb2 100644
--- a/pkgs/by-name/gn/gnuplot/package.nix
+++ b/pkgs/by-name/gn/gnuplot/package.nix
@@ -36,11 +36,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnuplot";
-  version = "6.0.4";
+  version = "6.0.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnuplot/gnuplot-${finalAttrs.version}.tar.gz";
-    hash = "sha256-RY2UdpYl5z1fYjJQD0nLrcsrGDOA1D0iZqD5cBrrnFs=";
+    hash = "sha256-cyN/N/AzBtaL+uEzqaUNXpNBOE4ZjVqzfuypq1NN7tg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/go/go-motion/package.nix b/pkgs/by-name/go/go-motion/package.nix
index 4c246f4a7567..15591ac1166a 100644
--- a/pkgs/by-name/go/go-motion/package.nix
+++ b/pkgs/by-name/go/go-motion/package.nix
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     longDescription = ''
       Motion is a tool that was designed to work with editors. It is providing
       contextual information for a given offset(option) from a file or
-      directory of files. Editors can use these informations to implement
+      directory of files. Editors can use this information to implement
       navigation, text editing, etc... that are specific to a Go source code.
 
       It's optimized and created to work with vim-go, but it's designed to work
diff --git a/pkgs/by-name/go/golex/package.nix b/pkgs/by-name/go/golex/package.nix
index ec8536e71b47..a761f4270316 100644
--- a/pkgs/by-name/go/golex/package.nix
+++ b/pkgs/by-name/go/golex/package.nix
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
   vendorHash = "sha256-Ig4cxZepvmI1EH0j2fuQ33jHOLWfS40UE+A4UHdo8oE=";
 
   meta = {
-    description = "Lex/flex like utility rendering .l formated data to Go source code";
+    description = "Lex/flex like utility rendering .l formatted data to Go source code";
     homepage = "https://pkg.go.dev/modernc.org/golex";
     license = lib.licenses.bsd3;
     mainProgram = "golex";
diff --git a/pkgs/by-name/go/gomuks-web/update.sh b/pkgs/by-name/go/gomuks-web/update.sh
index 20495a10f2fe..65ff23d36fe8 100755
--- a/pkgs/by-name/go/gomuks-web/update.sh
+++ b/pkgs/by-name/go/gomuks-web/update.sh
@@ -3,7 +3,7 @@
 
 set -euo pipefail
 
-# Fetch latest release infor
+# Fetch latest release info
 RELEASE=$(curl -sSL https://api.github.com/repos/tulir/gomuks/releases/latest | jq -r .name)
 
 if [ -z "$RELEASE" ]; then
diff --git a/pkgs/by-name/gp/gpredict/package.nix b/pkgs/by-name/gp/gpredict/package.nix
index e1e6d45f80a0..b17992240c64 100644
--- a/pkgs/by-name/gp/gpredict/package.nix
+++ b/pkgs/by-name/gp/gpredict/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "gpredict";
     longDescription = ''
       Gpredict is a real time satellite tracking and orbit prediction program
-      written using the GTK widgets. Gpredict is targetted mainly towards ham radio
+      written using the GTK widgets. Gpredict is targeted mainly towards ham radio
       operators but others interested in satellite tracking may find it useful as
       well. Gpredict uses the SGP4/SDP4 algorithms, which are compatible with the
       NORAD Keplerian elements.
diff --git a/pkgs/by-name/gp/gprolog/package.nix b/pkgs/by-name/gp/gprolog/package.nix
index 759bf35a104b..e9d884fb1ed8 100644
--- a/pkgs/by-name/gp/gprolog/package.nix
+++ b/pkgs/by-name/gp/gprolog/package.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
       interface, sockets,...).
 
       GNU Prolog also includes an efficient constraint solver over
-      Finite Domains (FD).  This opens contraint logic programming to
+      Finite Domains (FD).  This opens constraint logic programming to
       the user combining the power of constraint programming to the
       declarativity of logic programming.
     '';
diff --git a/pkgs/by-name/gp/gpx-animator/package.nix b/pkgs/by-name/gp/gpx-animator/package.nix
index f274e0304105..377e14cda03a 100644
--- a/pkgs/by-name/gp/gpx-animator/package.nix
+++ b/pkgs/by-name/gp/gpx-animator/package.nix
@@ -58,7 +58,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     longDescription = ''
       GPX Animator generates video from GPX files, it supports:
 
-      - Multiple GPX tracks with mutliple track segments
+      - Multiple GPX tracks with multiple track segments
       - Skipping idle parts
       - Configurable color, label, width and time offset per track
       - Configurable video size, fps and speedup or total video time
diff --git a/pkgs/by-name/gr/grafana/package.nix b/pkgs/by-name/gr/grafana/package.nix
index ff6b81a67b75..e22c097b675a 100644
--- a/pkgs/by-name/gr/grafana/package.nix
+++ b/pkgs/by-name/gr/grafana/package.nix
@@ -21,7 +21,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana";
-  version = "13.1.1";
+  version = "13.1.3";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
     owner = "grafana";
     repo = "grafana";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-e5Potkxm4VB1nUFyvByamsSkWAKMTMzpHIzrKSeRRM4=";
+    hash = "sha256-zAEtEjlqMBnjYLeYTWlJoZG/frxeirYvhff4wrjr1W4=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@@ -49,12 +49,12 @@ buildGoModule (finalAttrs: {
   # Since this is not a dependency attribute the buildPackages has to be specified.
   offlineCache = buildPackages.yarn-berry_4-fetcher.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-c/gCHjwfItp4h+CHa5CPKHhe8/hiqF9MNFin/hK8GmQ=";
+    hash = "sha256-/RDWtuSrfH6VSSbZShrHLiZ9+Ft2Ohpl5bT9/cdwKrA=";
   };
 
   disallowedRequisites = [ finalAttrs.offlineCache ];
 
-  vendorHash = "sha256-tlXBxcXt472A7PHurrbvW/SRlQmum8PUUlkmu5q2Y7Q=";
+  vendorHash = "sha256-OrjNdnDB1lfiig14Ojg24zXa/gOilfZWY4j9hpBZAoQ=";
 
   # Grafana seems to just set it to the latest version available
   # nowadays.
diff --git a/pkgs/by-name/gr/grisbi/package.nix b/pkgs/by-name/gr/grisbi/package.nix
index b18c398fb4d4..cdba1caa4d7b 100644
--- a/pkgs/by-name/gr/grisbi/package.nix
+++ b/pkgs/by-name/gr/grisbi/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Personnal accounting application";
+    description = "Personal accounting application";
     mainProgram = "grisbi";
     longDescription = ''
       Grisbi is an application written by French developers, so it perfectly
diff --git a/pkgs/by-name/gt/gtklock/package.nix b/pkgs/by-name/gt/gtklock/package.nix
index 1023ecefc11e..79f0842878f3 100644
--- a/pkgs/by-name/gt/gtklock/package.nix
+++ b/pkgs/by-name/gt/gtklock/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "GTK-based lockscreen for Wayland";
     longDescription = ''
       Important note: for gtklock to work you need to set "security.pam.services.gtklock = {};" manually.
-      Otherwise you'll lock youself out of desktop and unable to authenticate.
+      Otherwise you'll lock yourself out of desktop and unable to authenticate.
     ''; # Following  nixpkgs/pkgs/applications/window-managers/sway/lock.nix
     homepage = "https://github.com/jovanlanik/gtklock";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/by-name/gu/guile-gnutls/package.nix b/pkgs/by-name/gu/guile-gnutls/package.nix
index 8e33074de73f..a4a492ec8ab3 100644
--- a/pkgs/by-name/gu/guile-gnutls/package.nix
+++ b/pkgs/by-name/gu/guile-gnutls/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "guile-gnutls";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchurl {
     url = "mirror://gnu/gnutls/guile-gnutls-${finalAttrs.version}.tar.gz";
-    hash = "sha256-zABn8+60IbwXJHFAlipJCG31RQ8NPnHFW/VBotK57ys=";
+    hash = "sha256-droqD0ft3n/S9YP8EWLtHOgzm9r36dnMOTh/zJX7k1s=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/he/hekatomb/package.nix b/pkgs/by-name/he/hekatomb/package.nix
index 64700ed42640..d11322875615 100644
--- a/pkgs/by-name/he/hekatomb/package.nix
+++ b/pkgs/by-name/he/hekatomb/package.nix
@@ -40,7 +40,7 @@ python3.pkgs.buildPythonApplication {
   ];
 
   meta = {
-    description = "Tool to connect to LDAP directory to retrieve informations";
+    description = "Tool to connect to LDAP directory to retrieve information";
     homepage = "https://github.com/ProcessusT/HEKATOMB";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
diff --git a/pkgs/by-name/he/herdr/package.nix b/pkgs/by-name/he/herdr/package.nix
index 8f5c12c9d8d5..c61728d73780 100644
--- a/pkgs/by-name/he/herdr/package.nix
+++ b/pkgs/by-name/he/herdr/package.nix
@@ -12,7 +12,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "herdr";
-  version = "0.7.5";
+  version = "0.8.0";
 
   __structuredAttrs = true;
 
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "herdrdev";
     repo = "herdr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3BA8eredGku+vsL2Af7sUf43QiArR5XTHNrI+X11vFM=";
+    hash = "sha256-empFQ+hrnCh2JhOzQRWSCLV0YoZC3DXW3bY6k8YuJjk=";
   };
 
-  cargoHash = "sha256-lWnc0Ka0hp7bbm+dkKKj22Dbk+Cwrld86romXs3lzBs=";
+  cargoHash = "sha256-E1lBgpTFZwNjeALeg/atwbDFL/XQbUnvCdX7ohbAHAc=";
 
   zigDeps = zig_0_15.fetchDeps {
     inherit (finalAttrs) pname version;
@@ -56,7 +56,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   postInstall = ''
-    install -Dm444 SKILL.md -t $out/share/herdr/skills/herdr
+    mkdir --parents "$out"/share/herdr/skills/herdr
+    "$out"/bin/herdr --skill > "$_"/SKILL.md
   ''
   + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd herdr \
@@ -79,7 +80,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Agent multiplexer that lives in your terminal";
     homepage = "https://herdr.dev";
     changelog = "https://github.com/herdrdev/herdr/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.agpl3Plus;
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       kevinpita
       faukah
diff --git a/pkgs/applications/networking/instant-messengers/hydrogen-web/unwrapped.nix b/pkgs/by-name/hy/hydrogen-web-unwrapped/package.nix
similarity index 94%
rename from pkgs/applications/networking/instant-messengers/hydrogen-web/unwrapped.nix
rename to pkgs/by-name/hy/hydrogen-web-unwrapped/package.nix
index adbe9fa9659c..56ba1f6bfe34 100644
--- a/pkgs/applications/networking/instant-messengers/hydrogen-web/unwrapped.nix
+++ b/pkgs/by-name/hy/hydrogen-web-unwrapped/package.nix
@@ -13,10 +13,13 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "hydrogen-web";
   version = "0.5.0";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "hydrogen-web";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-pXrmWPp4/MYIS1FHEGzAxGbh4OnTaiPudg+NauvA6Vc=";
   };
 
diff --git a/pkgs/applications/networking/instant-messengers/hydrogen-web/wrapper.nix b/pkgs/by-name/hy/hydrogen-web/package.nix
similarity index 76%
rename from pkgs/applications/networking/instant-messengers/hydrogen-web/wrapper.nix
rename to pkgs/by-name/hy/hydrogen-web/package.nix
index af89a8d9f82a..b6ff78f800d4 100644
--- a/pkgs/applications/networking/instant-messengers/hydrogen-web/wrapper.nix
+++ b/pkgs/by-name/hy/hydrogen-web/package.nix
@@ -2,16 +2,20 @@
   stdenv,
   jq,
   hydrogen-web-unwrapped,
-  conf ? { },
+  config,
+  conf ? config.hydrogen-web.conf or { },
 }:
 
-if (conf == { }) then
+if conf == { } then
   hydrogen-web-unwrapped
 else
-  stdenv.mkDerivation {
+  stdenv.mkDerivation (finalAttrs: {
     pname = "${hydrogen-web-unwrapped.pname}-wrapped";
     inherit (hydrogen-web-unwrapped) version meta;
 
+    strictDeps = true;
+    __structuredAttrs = true;
+
     dontUnpack = true;
 
     nativeBuildInputs = [ jq ];
@@ -26,4 +30,4 @@ else
 
       runHook postInstall
     '';
-  }
+  })
diff --git a/pkgs/by-name/hy/hyperscrypt-font/package.nix b/pkgs/by-name/hy/hyperscrypt-font/package.nix
index 69bf3da823f3..47796f5b42e0 100644
--- a/pkgs/by-name/hy/hyperscrypt-font/package.nix
+++ b/pkgs/by-name/hy/hyperscrypt-font/package.nix
@@ -37,7 +37,7 @@ stdenvNoCC.mkDerivation rec {
       the sacred lead of stained glass, the lead of print characters
       and the heavy metal. Despite its organic look inherited for the
       molted metal, Hyper Scrypt is based upon a rigorous grid,
-      allowing some neat alignements between shapes in multi lines
+      allowing some neat alignments between shapes in multi lines
       layouts.
     '';
     license = lib.licenses.ofl;
diff --git a/pkgs/by-name/ic/icecast/package.nix b/pkgs/by-name/ic/icecast/package.nix
index 94d50ecdcb8e..9c9659f86a80 100644
--- a/pkgs/by-name/ic/icecast/package.nix
+++ b/pkgs/by-name/ic/icecast/package.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
       It can be used to create an Internet radio station or a privately
       running jukebox and many things in between. It is very versatile
       in that new formats can be added relatively easily and supports
-      open standards for commuincation and interaction.
+      open standards for communication and interaction.
     '';
 
     homepage = "https://www.icecast.org";
diff --git a/pkgs/by-name/ic/iconic/package.nix b/pkgs/by-name/ic/iconic/package.nix
index 9bf12f4a5bf8..5193b6059e96 100644
--- a/pkgs/by-name/ic/iconic/package.nix
+++ b/pkgs/by-name/ic/iconic/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/youpie/Iconic";
-    description = "Easilly add images on top of folders";
+    description = "Easily add images on top of folders";
     mainProgram = "folder_icon";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/id/idevicerestore/package.nix b/pkgs/by-name/id/idevicerestore/package.nix
index 5174a524df2d..63a5154bfd86 100644
--- a/pkgs/by-name/id/idevicerestore/package.nix
+++ b/pkgs/by-name/id/idevicerestore/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
       restore of a firmware to a device.
 
       In general, upgrades and downgrades are possible, however subject to
-      availability of SHSH blobs from Apple for signing the firmare files.
+      availability of SHSH blobs from Apple for signing the firmware files.
 
       To restore a device to some firmware, simply run the following:
       $ sudo idevicerestore -l
diff --git a/pkgs/by-name/if/ifstat-legacy/package.nix b/pkgs/by-name/if/ifstat-legacy/package.nix
index 2661751510e2..b3e59dd11a0c 100644
--- a/pkgs/by-name/if/ifstat-legacy/package.nix
+++ b/pkgs/by-name/if/ifstat-legacy/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Report network interfaces bandwith just like vmstat/iostat do for other system counters - legacy version";
+    description = "Report network interfaces bandwidth just like vmstat/iostat do for other system counters - legacy version";
     homepage = "http://gael.roualland.free.fr/ifstat/";
     maintainers = with lib.maintainers; [ peterhoeg ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/in/intel-media-sdk/package.nix b/pkgs/by-name/in/intel-media-sdk/package.nix
index 12b89950abda..698b2f367477 100644
--- a/pkgs/by-name/in/intel-media-sdk/package.nix
+++ b/pkgs/by-name/in/intel-media-sdk/package.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     ];
     knownVulnerabilities = [
       ''
-        End of life with various local privilege escalation vulnerabilites:
+        End of life with various local privilege escalation vulnerabilities:
           - CVE-2023-22656
           - CVE-2023-45221
           - CVE-2023-47169
diff --git a/pkgs/by-name/ip/iproute2mac/package.nix b/pkgs/by-name/ip/iproute2mac/package.nix
index d5f521081b6a..daabd52b3ce8 100644
--- a/pkgs/by-name/ip/iproute2mac/package.nix
+++ b/pkgs/by-name/ip/iproute2mac/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/brona/iproute2mac";
-    description = "CLI wrapper for basic network utilites on Mac OS X inspired with iproute2 on Linux systems - ip command";
+    description = "CLI wrapper for basic network utilities on Mac OS X inspired with iproute2 on Linux systems - ip command";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jiegec ];
     platforms = lib.platforms.darwin;
diff --git a/pkgs/by-name/ip/ipv6calc/package.nix b/pkgs/by-name/ip/ipv6calc/package.nix
index 4b9cc9d6a144..fa460738f960 100644
--- a/pkgs/by-name/ip/ipv6calc/package.nix
+++ b/pkgs/by-name/ip/ipv6calc/package.nix
@@ -62,11 +62,11 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Calculate/manipulate (not only) IPv6 addresses";
     longDescription = ''
       ipv6calc is a small utility to manipulate (not only) IPv6 addresses and
-      is able to do other tricky things. Intentions were convering a given
-      IPv6 address into compressed format, convering a given IPv6 address into
+      is able to do other tricky things. Intentions were converting a given
+      IPv6 address into compressed format, converting a given IPv6 address into
       the same format like shown in /proc/net/if_inet6 and (because it was not
       difficult) migrating the Perl program ip6_int into.
-      Now only one utiltity is needed to do a lot.
+      Now only one utility is needed to do a lot.
     '';
     homepage = "http://www.deepspace6.net/projects/ipv6calc.html";
     license = lib.licenses.gpl2Only;
diff --git a/pkgs/by-name/ir/iro/package.nix b/pkgs/by-name/ir/iro/package.nix
index 72ec6d88adbf..ee000a5de393 100644
--- a/pkgs/by-name/ir/iro/package.nix
+++ b/pkgs/by-name/ir/iro/package.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {
   cargoHash = "sha256-7QAhgUI6Pu0iqE6JyfYI4x3O/XTDb8B1Sy3hw9EVMYo=";
 
   meta = {
-    description = "CLI tool to convet Hex color code or RGB to color code, RGB, HSL and color name";
+    description = "CLI tool to convert Hex color code or RGB to color code, RGB, HSL and color name";
     homepage = "https://github.com/kyoheiu/iro";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ airrnot ];
diff --git a/pkgs/by-name/ir/irpf/package.nix b/pkgs/by-name/ir/irpf/package.nix
index a965cada07ee..ff9cadd6b702 100644
--- a/pkgs/by-name/ir/irpf/package.nix
+++ b/pkgs/by-name/ir/irpf/package.nix
@@ -86,9 +86,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Brazillian government application for reporting income tax";
+    description = "Brazilian government application for reporting income tax";
     longDescription = ''
-      Brazillian government application for reporting income tax.
+      Brazilian government application for reporting income tax.
 
       IRFP - Imposto de Renda Pessoa Física - Receita Federal do Brasil.
     '';
diff --git a/pkgs/by-name/it/itools/package.nix b/pkgs/by-name/it/itools/package.nix
index e56b771274ec..9b685dd2935e 100644
--- a/pkgs/by-name/it/itools/package.nix
+++ b/pkgs/by-name/it/itools/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
       The itools package is a set of user friendly applications utilizing Arabeyes' ITL library.
 
       The package addresses two main areas - hijri date and prayertime calculation. The package
-      is envisioned to mimick the development of the underlying ITL library and is meant to
+      is envisioned to mimic the development of the underlying ITL library and is meant to
       always give the end-user a simple means to access its functions.
     '';
     homepage = "https://www.arabeyes.org/ITL";
diff --git a/pkgs/by-name/iw/iw4x-launcher/package.nix b/pkgs/by-name/iw/iw4x-launcher/package.nix
index d7723f8e3b73..d7299c441901 100644
--- a/pkgs/by-name/iw/iw4x-launcher/package.nix
+++ b/pkgs/by-name/iw/iw4x-launcher/package.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Official launcher for the IW4x mod";
-    longDescription = "IW4x allows you to relive Call of Duty: Modern Warfare 2 (2009) in a secure environment with expanded modding capabilites";
+    longDescription = "IW4x allows you to relive Call of Duty: Modern Warfare 2 (2009) in a secure environment with expanded modding capabilities";
     homepage = "https://iw4x.io";
     downloadPage = "https://github.com/iw4x/launcher";
     changelog = "https://github.com/iw4x/launcher/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/je/jellycli/package.nix b/pkgs/by-name/je/jellycli/package.nix
index 60c597431132..bcef8b48bd6b 100644
--- a/pkgs/by-name/je/jellycli/package.nix
+++ b/pkgs/by-name/je/jellycli/package.nix
@@ -31,7 +31,7 @@ buildGoModule (finalAttrs: {
     description = "Jellyfin terminal client";
     longDescription = ''
       Terminal music player, works with Jellyfin (>= 10.6) , Emby (>= 4.4), and
-      Subsonic comptabile servers (API >= 1.16), e.g., Navidrome.
+      Subsonic compatible servers (API >= 1.16), e.g., Navidrome.
     '';
     homepage = "https://github.com/tryffel/jellycli";
     license = lib.licenses.gpl3Plus;
diff --git a/pkgs/by-name/jf/jffi/package.nix b/pkgs/by-name/jf/jffi/package.nix
index 8e8b03cba33e..35d9bd67e455 100644
--- a/pkgs/by-name/jf/jffi/package.nix
+++ b/pkgs/by-name/jf/jffi/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ libffi ];
 
-  # The pkg-config script in the build.xml doesn't work propery
+  # The pkg-config script in the build.xml doesn't work properly
   # set the lib path manually to work around this.
   env.LIBFFI_LIBS = "${libffi}/lib/libffi${stdenv.hostPlatform.extensions.sharedLibrary}";
   env.ANT_ARGS = "-Duse.system.libffi=1";
diff --git a/pkgs/by-name/jo/joystickwake/package.nix b/pkgs/by-name/jo/joystickwake/package.nix
index e8001e3273f4..603d4da8f7e9 100644
--- a/pkgs/by-name/jo/joystickwake/package.nix
+++ b/pkgs/by-name/jo/joystickwake/package.nix
@@ -37,7 +37,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
       Linux gamers often find themselves unexpectedly staring at a blank screen, because their display server fails to recognize game controllers as input devices, allowing the screen blanker to activate during gameplay.
       This program works around the problem by temporarily disabling screen blankers when joystick activity is detected.
     '';
-    homepage = "https://github.com/foresto/joystickwake";
+    homepage = "https://codeberg.org/forestix/joystickwake";
     maintainers = with lib.maintainers; [ bertof ];
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/jq/jq/package.nix b/pkgs/by-name/jq/jq/package.nix
index edf9b16ec356..762562f1c7b3 100644
--- a/pkgs/by-name/jq/jq/package.nix
+++ b/pkgs/by-name/jq/jq/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = lib.optionals stdenv.hostPlatform.is32bit [
     # needed because epoch conversion test here is right at the end of 32 bit integer space
     # See also: https://github.com/jqlang/jq/blob/859a8073ee8a21f2133154eea7c2bd5e0d60837f/tests/optional.test#L15-L18
-    # "-D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64" would be preferrable, but breaks with dynamic linking,
+    # "-D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64" would be preferable, but breaks with dynamic linking,
     # unless done globally in stdenv for all of 32 bit.
     ./disable-end-of-epoch-conversion-test.patch
   ];
diff --git a/pkgs/by-name/ka/kahip/package.nix b/pkgs/by-name/ka/kahip/package.nix
index 463b8af72831..9c288e465d9d 100644
--- a/pkgs/by-name/ka/kahip/package.nix
+++ b/pkgs/by-name/ka/kahip/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional pythonSupport python3Packages.pybind11
   ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
 
-  # create meta package providing dist-info for python3Pacakges.kahip that common cmake build does not do
+  # create meta package providing dist-info for python3Packages.kahip that common cmake build does not do
   propagatedBuildInputs = lib.optional pythonSupport (
     python3Packages.mkPythonMetaPackage {
       inherit (finalAttrs) pname version meta;
diff --git a/pkgs/by-name/ka/kanshi/package.nix b/pkgs/by-name/ka/kanshi/package.nix
index f0aca5ea07ef..e1cd6fd68672 100644
--- a/pkgs/by-name/ka/kanshi/package.nix
+++ b/pkgs/by-name/ka/kanshi/package.nix
@@ -8,20 +8,21 @@
   scdoc,
   wayland,
   wayland-scanner,
-  libvarlink,
+  vali,
   libscfg,
+  cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kanshi";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "emersion";
     repo = "kanshi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-90FnVtiYR8AEAddIQe9sfgQDMO8OqlQ8fNy/nJsbhKs=";
+    hash = "sha256-F6wyNFygU3uPBliDPOp5EdTeCx/5ZulnC9MOqYtiVQw=";
   };
 
   strictDeps = true;
@@ -40,8 +41,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     wayland
-    libvarlink
     libscfg
+    vali
   ];
 
   meta = {
diff --git a/pkgs/by-name/ka/kapacitor/package.nix b/pkgs/by-name/ka/kapacitor/package.nix
index edc76575327e..9d224f7ed856 100644
--- a/pkgs/by-name/ka/kapacitor/package.nix
+++ b/pkgs/by-name/ka/kapacitor/package.nix
@@ -24,7 +24,7 @@ let
       # This fixes a linting error due to an unneeded call to `.clone()`
       # that gets enforced by a strict `deny(warnings)` build config.
       # This is already fixed with newer versions of `libflux`, but it
-      # has been changed in a giant commit with a lot of autmated changes:
+      # has been changed in a giant commit with a lot of automated changes:
       # https://github.com/influxdata/flux/commit/e7f7023848929e16ad5bd3b41d217847bd4fd72b#diff-96572e971d9e19b54290a434debbf7db054b21c9ce19035159542756ffb8ab87
       #
       # Can be removed as soon as kapacitor depends on a newer version of `libflux`, cf:
diff --git a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
index eb70ae1b713e..7887a79e0ee6 100644
--- a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
+++ b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
@@ -6,7 +6,7 @@
 }:
 
 buildGoModule (finalAttrs: {
-  # "chatgpt-cli" is taken by another package with the same upsteam name.
+  # "chatgpt-cli" is taken by another package with the same upstream name.
   # To keep "pname" and "package attribute name" identical, the owners name (kardolus) gets prefixed as identifier.
   pname = "kardolus-chatgpt-cli";
   version = "1.11.0";
diff --git a/pkgs/by-name/kc/kcov/package.nix b/pkgs/by-name/kc/kcov/package.nix
index 32541b7c3c39..9a6bd030a7a6 100644
--- a/pkgs/by-name/kc/kcov/package.nix
+++ b/pkgs/by-name/kc/kcov/package.nix
@@ -77,7 +77,7 @@ let
         Kcov is a code coverage tester for compiled programs, Python
         scripts and shell scripts. It allows collecting code coverage
         information from executables without special command-line
-        arguments, and continuosly produces output from long-running
+        arguments, and continuously produces output from long-running
         applications.
       '';
 
diff --git a/pkgs/by-name/ke/keama/package.nix b/pkgs/by-name/ke/keama/package.nix
index 76456ef05e98..766ed518d92c 100644
--- a/pkgs/by-name/ke/keama/package.nix
+++ b/pkgs/by-name/ke/keama/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "Kea Migration Assistent";
+    description = "Kea Migration Assistant";
 
     longDescription = ''
       Kea migration assistant is an experimental tool that reads a ISC DHCP server
diff --git a/pkgs/by-name/kh/khronos/package.nix b/pkgs/by-name/kh/khronos/package.nix
index c7b58843a699..04d3d8b75976 100644
--- a/pkgs/by-name/kh/khronos/package.nix
+++ b/pkgs/by-name/kh/khronos/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    description = "Track each task's time in a simple inobtrusive way";
+    description = "Track each task's time in a simple unobtrusive way";
     homepage = "https://github.com/lainsce/khronos";
     maintainers = with lib.maintainers; [ xiorcale ];
     teams = [ lib.teams.pantheon ];
diff --git a/pkgs/by-name/ki/kicad/update.sh b/pkgs/by-name/ki/kicad/update.sh
index 8bf28d8e6d47..4d0fae3d4c1a 100755
--- a/pkgs/by-name/ki/kicad/update.sh
+++ b/pkgs/by-name/ki/kicad/update.sh
@@ -22,7 +22,7 @@ export TMPDIR=/tmp
 # support parallel instances for each pname
 #   currently risks reusing old data
 # no getting around manually checking if the build product works...
-# if there is, default to commiting?
+# if there is, default to committing?
 #   won't work when running in parallel?
 # remove items left in /nix/store?
 # reuse hashes of already checked revs (to avoid redownloading testing's packages3d)
diff --git a/pkgs/by-name/ki/kirc/package.nix b/pkgs/by-name/ki/kirc/package.nix
index 802b2c9f071e..2a23274d8ddc 100644
--- a/pkgs/by-name/ki/kirc/package.nix
+++ b/pkgs/by-name/ki/kirc/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       It features:
       - No dependencies other than a C99 compiler.
-      - Simple Authentication and Security Layer (SASL) procotol support.
+      - Simple Authentication and Security Layer (SASL) protocol support.
       - Client-to-client (CTCP) protocol support.
       - Transport Layer Security (TLS) protocol support (via external
         utilities).
diff --git a/pkgs/by-name/ku/kubazip/package.nix b/pkgs/by-name/ku/kubazip/package.nix
index 3f6b34b65258..f7634b55d6a7 100644
--- a/pkgs/by-name/ku/kubazip/package.nix
+++ b/pkgs/by-name/ku/kubazip/package.nix
@@ -4,16 +4,17 @@
   fetchFromGitHub,
   cmake,
   ninja,
+  nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kubazip";
-  version = "0.3.11";
+  version = "0.3.15";
 
   src = fetchFromGitHub {
     owner = "kuba--";
     repo = "zip";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TybHYS8QYpGXzmtLygbUp29AX/dgf/I3yQ0Teny7Cg4=";
+    hash = "sha256-phOhhNc59ALKNCCetD3lyRp6ipAlSEMpWTnKPkha3EY=";
   };
 
   postPatch = ''
@@ -38,6 +39,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "v([0-9]+\\.[0-9]+\\.[0-9]+)"
+    ];
+  };
+
   meta = {
     description = "Portable, simple zip library written in C";
     homepage = "https://github.com/kuba--/zip";
diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix
index f64b20b0cc17..060f4a37ff83 100644
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -177,7 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # Only Ladybird and WebContent need wrapped, if Qt is enabled.
-  # On linux we end up wraping some non-Qt apps, like headless-browser.
+  # On linux we end up wrapping some non-Qt apps, like headless-browser.
   dontWrapQtApps = stdenv.hostPlatform.isDarwin;
 
   passthru.tests = {
diff --git a/pkgs/by-name/la/lasuite-docs/package.nix b/pkgs/by-name/la/lasuite-docs/package.nix
index 6584ead2daa5..8d06bc89d59c 100644
--- a/pkgs/by-name/la/lasuite-docs/package.nix
+++ b/pkgs/by-name/la/lasuite-docs/package.nix
@@ -50,7 +50,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   sourceRoot = "${finalAttrs.src.name}/src/backend";
 
   patches = [
-    # Support configuration throught environment variables for SECURE_*
+    # Support configuration through environment variables for SECURE_*
     ./secure_settings.patch
   ];
 
diff --git a/pkgs/by-name/la/lasuite-drive/package.nix b/pkgs/by-name/la/lasuite-drive/package.nix
index 24953084a2b8..59d643744213 100644
--- a/pkgs/by-name/la/lasuite-drive/package.nix
+++ b/pkgs/by-name/la/lasuite-drive/package.nix
@@ -41,7 +41,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   sourceRoot = "${finalAttrs.src.name}/src/backend";
 
   patches = [
-    # Support configuration throught environment variables for SECURE_*
+    # Support configuration through environment variables for SECURE_*
     ./secure_settings.patch
     # Fix some build fields on pyproject
     ./pyproject_build.patch
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index ac5a69718431..188830cf085b 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -40,7 +40,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   sourceRoot = "${finalAttrs.src.name}/src/backend";
 
   patches = [
-    # Support configuration throught environment variables for SECURE_*
+    # Support configuration through environment variables for SECURE_*
     ./secure_settings.patch
   ];
 
diff --git a/pkgs/by-name/le/leaves/package.nix b/pkgs/by-name/le/leaves/package.nix
new file mode 100644
index 000000000000..f3303565b903
--- /dev/null
+++ b/pkgs/by-name/le/leaves/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "leaves";
+  version = "0.2.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "patonw";
+    repo = "leaves";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aTIC9n4NpSW/R/e9Ihn3Oy5Vp36E1t1Ou4cHDUnKrME=";
+  };
+
+  cargoHash = "sha256-W1RWE08HXDhgejWcnUKI6/WTk9CAU6wayrNNl87rvMw=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^v([0-9.]+)$"
+    ];
+  };
+
+  meta = {
+    mainProgram = "leaves";
+    description = "A text-mode disk usage visualization utility";
+    longDescription = ''
+      Leaves is a disk usage analyzer inspired by WinDirStat and QDirStat.
+
+      It shows files and directories in a hierarchy of nested rectangles.
+      The area of a rectangle is proportional to its size.
+      A 200 MB file will have twice the size as a sibling with 100 MB.
+      The parent directory will have about 3 times the area of the smaller file.
+    '';
+    homepage = "https://github.com/patonw/leaves";
+    downloadPage = "https://github.com/patonw/leaves/releases#release-v${finalAttrs.version}";
+    changelog = "https://github.com/patonw/leaves/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+    identifiers = {
+      cpeParts = lib.meta.cpeFullVersionWithVendor "patonw" finalAttrs.version;
+      purlParts = {
+        type = "github";
+        spec = "patonw/leaves@v${finalAttrs.version}";
+      };
+    };
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ KristijanZic ];
+  };
+})
diff --git a/pkgs/by-name/li/libdatovka/package.nix b/pkgs/by-name/li/libdatovka/package.nix
index cb23eb4626af..c0900c2922d5 100644
--- a/pkgs/by-name/li/libdatovka/package.nix
+++ b/pkgs/by-name/li/libdatovka/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "Client library for accessing SOAP services of Czech government-provided Databox infomation system";
+    description = "Client library for accessing SOAP services of Czech government-provided Databox information system";
     homepage = "https://gitlab.nic.cz/datovka/libdatovka";
     license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.ovlach ];
diff --git a/pkgs/by-name/li/libe57format/package.nix b/pkgs/by-name/li/libe57format/package.nix
index be54d811b64a..b52b0336cc5a 100644
--- a/pkgs/by-name/li/libe57format/package.nix
+++ b/pkgs/by-name/li/libe57format/package.nix
@@ -87,6 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
       chpatrick
       nh2
     ];
-    platforms = lib.platforms.linux; # because of the .so buiding in `postInstall` above
+    platforms = lib.platforms.linux; # because of the .so building in `postInstall` above
   };
 })
diff --git a/pkgs/by-name/li/libisds/package.nix b/pkgs/by-name/li/libisds/package.nix
index 47f14612464c..1a99cb241907 100644
--- a/pkgs/by-name/li/libisds/package.nix
+++ b/pkgs/by-name/li/libisds/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=deprecated-declarations" ];
 
   meta = {
-    description = "Client library for accessing SOAP services of Czech government-provided Databox infomation system";
+    description = "Client library for accessing SOAP services of Czech government-provided Databox information system";
     homepage = "http://xpisar.wz.cz/libisds/";
     license = lib.licenses.lgpl3;
     maintainers = [ lib.maintainers.mmahut ];
diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 8551229f2208..a946663f2f4c 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS";
     description = "GLib ICE implementation";
     longDescription = ''
-      Libnice is an implementation of the IETF's Interactice Connectivity
+      Libnice is an implementation of the IETF's Interactive Connectivity
       Establishment (ICE) standard (RFC 5245) and the Session Traversal
       Utilities for NAT (STUN) standard (RFC 5389).
 
diff --git a/pkgs/by-name/li/libtelnet/package.nix b/pkgs/by-name/li/libtelnet/package.nix
index b2243d30113a..42dc062400d3 100644
--- a/pkgs/by-name/li/libtelnet/package.nix
+++ b/pkgs/by-name/li/libtelnet/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   buildInputs = [ zlib ];
 
   meta = {
-    description = "Simple RFC-complient TELNET implementation as a C library";
+    description = "Simple RFC-compliant TELNET implementation as a C library";
     homepage = "https://github.com/seanmiddleditch/libtelnet";
     license = lib.licenses.publicDomain;
     maintainers = [ lib.maintainers.tomberek ];
diff --git a/pkgs/by-name/li/libwtk-sdl2/package.nix b/pkgs/by-name/li/libwtk-sdl2/package.nix
index 41bb6d85ca6a..e6fb96712722 100644
--- a/pkgs/by-name/li/libwtk-sdl2/package.nix
+++ b/pkgs/by-name/li/libwtk-sdl2/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "Simplistic SDL2 GUI framework in early developement";
+    description = "Simplistic SDL2 GUI framework in early development";
     mainProgram = "libwtk-sdl2-test";
     homepage = "https://github.com/muesli4/libwtk-sdl2";
     # See: https://github.com/muesli4/mpd-touch-screen-gui/tree/master/LICENSES
diff --git a/pkgs/by-name/li/libxcb-util/package.nix b/pkgs/by-name/li/libxcb-util/package.nix
index b1239bdb4bfd..136c827b0f95 100644
--- a/pkgs/by-name/li/libxcb-util/package.nix
+++ b/pkgs/by-name/li/libxcb-util/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "XCB utility libraries";
     longDescription = ''
       The XCB util modules provides a number of libraries which sit on top of libxcb, the core
-      X protocol library, and some of the extension libraries. These experimental libraries provid
+      X protocol library, and some of the extension libraries. These experimental libraries provide
       convenience functions and interfaces which make the raw X protocol more usable. Some of the
       libraries also provide client-side code which is not strictly part of the X protocol but which
       have traditionally been provided by Xlib.
diff --git a/pkgs/by-name/li/litemdview/package.nix b/pkgs/by-name/li/litemdview/package.nix
index 1a3a0ba8337d..a0d7b04e88e5 100644
--- a/pkgs/by-name/li/litemdview/package.nix
+++ b/pkgs/by-name/li/litemdview/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://codeberg.org/g0tsu/litemdview";
     description = "Suckless markdown viewer";
     longDescription = ''
-      LiteMDview is a lightweight, extremely fast markdown viewer with lots of useful features. One of them is ability to use your prefered text editor to edit markdown files, every time you save the file, litemdview reloads those changes (I call it live-reload). It has a convinient navigation through local directories, has support for a basic "git-like" folders hierarchy as well as vimwiki projects.
+      LiteMDview is a lightweight, extremely fast markdown viewer with lots of useful features. One of them is ability to use your preferred text editor to edit markdown files, every time you save the file, litemdview reloads those changes (I call it live-reload). It has a convenient navigation through local directories, has support for a basic "git-like" folders hierarchy as well as vimwiki projects.
 
       Features:
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
         - Does not use any of those bloated gecko(servo)-blink engines
         - Lightweight and fast
         - Live reload
-        - Convinient key bindings
+        - Convenient key bindings
         - Supports text zooming
         - Supports images
         - Supports links
diff --git a/pkgs/by-name/ll/lldpd/package.nix b/pkgs/by-name/ll/lldpd/package.nix
index 8b2409643123..d3f4f92ee20c 100644
--- a/pkgs/by-name/ll/lldpd/package.nix
+++ b/pkgs/by-name/ll/lldpd/package.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "802.1ab implementation (LLDP) to help you locate neighbors of all your equipments";
+    description = "802.1ab implementation (LLDP) to help you locate neighbors of all your equipment";
     homepage = "https://lldpd.github.io/";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ fpletz ];
diff --git a/pkgs/by-name/lo/local-ai/package.nix b/pkgs/by-name/lo/local-ai/package.nix
index 7665a69e28d4..68c97ea454ca 100644
--- a/pkgs/by-name/lo/local-ai/package.nix
+++ b/pkgs/by-name/lo/local-ai/package.nix
@@ -433,7 +433,7 @@ let
 
     proxyVendor = true;
 
-    # should be passed as makeFlags, but build system failes with strings
+    # should be passed as makeFlags, but build system fails with strings
     # containing spaces
     env.GO_TAGS = builtins.concatStringsSep " " GO_TAGS;
 
@@ -471,8 +471,8 @@ let
       runHook postInstall
     '';
 
-    # patching rpath with patchelf doens't work. The executable
-    # raises an segmentation fault
+    # patching rpath with patchelf doesn't work. The executable
+    # raises a segmentation fault
     postFixup =
       let
         LD_LIBRARY_PATH =
diff --git a/pkgs/by-name/lu/lua-language-server/package.nix b/pkgs/by-name/lu/lua-language-server/package.nix
index f5ab88f987bf..e7931a9fe0dc 100644
--- a/pkgs/by-name/lu/lua-language-server/package.nix
+++ b/pkgs/by-name/lu/lua-language-server/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lua-language-server";
-  version = "3.18.2";
+  version = "3.19.0";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-c8YxTNmvloN9oabdbl5ZKgXqhxeZ9eVBt3B0Q9wA/GQ=";
+    hash = "sha256-TW7BkWNYl5Ndc5sx86Y8LsqVu3Qvh0LMqHyZyW36qso=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/lu/lubelogger/package.nix b/pkgs/by-name/lu/lubelogger/package.nix
index 9b860480c5a6..f9fb1095c714 100644
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@@ -32,7 +32,7 @@ buildDotnetModule rec {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Vehicle service records and maintainence tracker";
+    description = "Vehicle service records and maintenance tracker";
     longDescription = ''
       A self-hosted, open-source, unconventionally-named vehicle maintenance records and fuel mileage tracker.
     '';
diff --git a/pkgs/by-name/ma/macdylibbundler/package.nix b/pkgs/by-name/ma/macdylibbundler/package.nix
index 10af2eae3486..aac41b58af10 100644
--- a/pkgs/by-name/ma/macdylibbundler/package.nix
+++ b/pkgs/by-name/ma/macdylibbundler/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
       .dylibs as easy as possible. It automatically determines which dylibs are
       needed by your program, copies these libraries inside the app bundle, and
       fixes both them and the executable to be ready for distribution... all
-      this with a single command on the teminal! It will also work if your
+      this with a single command on the terminal! It will also work if your
       program uses plug-ins that have dependencies too.
     '';
     homepage = "https://github.com/auriamg/macdylibbundler";
diff --git a/pkgs/by-name/ma/man-pages/package.nix b/pkgs/by-name/ma/man-pages/package.nix
index 88566c5cc3f7..041f33db37dc 100644
--- a/pkgs/by-name/ma/man-pages/package.nix
+++ b/pkgs/by-name/ma/man-pages/package.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation (finalAttrs: {
   version = "6.18";
 
   # `man` is first: most people installing `man-pages` want man pages.
-  # The binaries could be split to a seperate package (as upstream suggests),
-  # but storing in a seperate not-installed-by-default output is easier,
+  # The binaries could be split to a separate package (as upstream suggests),
+  # but storing in a separate not-installed-by-default output is easier,
   # and has a similar effect.
   outputs = [
     "man"
diff --git a/pkgs/by-name/ma/maskprocessor/package.nix b/pkgs/by-name/ma/maskprocessor/package.nix
index 08265f683b2f..1f9843bba0b6 100644
--- a/pkgs/by-name/ma/maskprocessor/package.nix
+++ b/pkgs/by-name/ma/maskprocessor/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/hashcat/maskprocessor";
-    description = "High-Performance word generator with a per-position configureable charset";
+    description = "High-Performance word generator with a per-position configurable charset";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     changelog = "https://github.com/hashcat/maskprocessor/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
index 195571459403..19845475c05e 100644
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -14,19 +14,19 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.157.2";
+  version = "1.158.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-TUHcNAXrV43+J7jqfstlYdrZrwL5kDCh03yxO+vL/gw=";
+    hash = "sha256-9H2qhEnmqgC3kAdmWWCMay6zZU8czjCX4S2AXHwMBIo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-KM3j2O7J4Sad6jKF2Ca4qkRLj3w7+/UCnK6T6x8kMfs=";
+    hash = "sha256-rYO/1QRYS2J28RvgNXymcOa+2k+Djm+6kFmzUfYXoIQ=";
   };
 
   build-system =
diff --git a/pkgs/by-name/ma/matter-compiler/package.nix b/pkgs/by-name/ma/matter-compiler/package.nix
index 5d17568e92be..169232621efa 100644
--- a/pkgs/by-name/ma/matter-compiler/package.nix
+++ b/pkgs/by-name/ma/matter-compiler/package.nix
@@ -13,8 +13,8 @@ bundlerApp {
 
   meta = {
     description = ''
-      Matter Compiler is a API Blueprint AST Media Types to API Blueprint conversion tool.
-      It composes an API blueprint from its serialzed AST media-type.
+      Matter Compiler is an API Blueprint AST Media Types to API Blueprint conversion tool.
+      It composes an API blueprint from its serialized AST media-type.
     '';
     homepage = "https://github.com/apiaryio/matter_compiler/";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/me/mesa-libclc/package.nix b/pkgs/by-name/me/mesa-libclc/package.nix
new file mode 100644
index 000000000000..9bc61617264e
--- /dev/null
+++ b/pkgs/by-name/me/mesa-libclc/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  buildEnv,
+  cmake,
+  llvmPackages_22,
+  mesa,
+  spirv-llvm-translator,
+}:
+let
+  spirv-llvm-translator' = spirv-llvm-translator.override {
+    inherit (llvmPackages_22) llvm;
+  };
+  tools = buildEnv {
+    name = "mesa-libclc-tools";
+    paths = [
+      llvmPackages_22.clang-unwrapped
+      llvmPackages_22.llvm
+    ];
+    pathsToLink = [ "/bin" ];
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mesa-libclc";
+  version = "22.1.8.3";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "karolherbst";
+    repo = "mesa-libclc";
+    tag = finalAttrs.version;
+    hash = "sha256-YQkVgI5vfQsjf07z5bJ9FCm85TsX7SN2ODEitIB46zg=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    spirv-llvm-translator'
+  ];
+
+  buildInputs = [
+    llvmPackages_22.llvm
+  ];
+
+  cmakeFlags = [
+    "-DLIBCLC_CUSTOM_LLVM_TOOLS_BINARY_DIR=${tools}/bin"
+  ];
+
+  meta = {
+    description = "Mesa fork of libclc, for use with Rusticl";
+    homepage = "https://gitlab.freedesktop.org/karolherbst/mesa-libclc";
+    changelog = "https://gitlab.freedesktop.org/karolherbst/mesa-libclc/-/releases/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    inherit (mesa.meta) maintainers platforms;
+  };
+})
diff --git a/pkgs/by-name/me/meshcentral/package.nix b/pkgs/by-name/me/meshcentral/package.nix
index 568b41107e93..f93385261129 100644
--- a/pkgs/by-name/me/meshcentral/package.nix
+++ b/pkgs/by-name/me/meshcentral/package.nix
@@ -46,7 +46,7 @@ buildNpmPackage (finalAttrs: {
   meta = {
     description = "Computer management web app";
     homepage = "https://meshcentral.com/";
-    maintainers = with lib.maintainers; [ ma27 ];
+    maintainers = [ ];
     license = lib.licenses.asl20;
     mainProgram = "meshcentral";
   };
diff --git a/pkgs/by-name/mf/mfaktc/package.nix b/pkgs/by-name/mf/mfaktc/package.nix
index 1832d5cead95..976a4af5073b 100644
--- a/pkgs/by-name/mf/mfaktc/package.nix
+++ b/pkgs/by-name/mf/mfaktc/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Trial Factoring program using CUDA for GIMPS";
     longDescription = ''
-      CUDA Program for trial factoring Mersenne primes. Intented for use with GIMPS through autoprimenet.py.
+      CUDA Program for trial factoring Mersenne primes. Intended for use with GIMPS through autoprimenet.py.
       Note that the mfaktc.ini file, which is in $out/share, must be symlinked to your working directory.
     '';
     homepage = "https://github.com/primesearch/mfaktc";
diff --git a/pkgs/by-name/mi/miktex/package.nix b/pkgs/by-name/mi/miktex/package.nix
index b8d2d2edf67c..c889d8827fbe 100644
--- a/pkgs/by-name/mi/miktex/package.nix
+++ b/pkgs/by-name/mi/miktex/package.nix
@@ -104,12 +104,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./startup-config-support-nix-store.patch
-    # Miktex will search exectables in "GetMyPrefix(true)/bin".
+    # Miktex will search executables in "GetMyPrefix(true)/bin".
     # The path evaluate to "/usr/bin" in FHS style linux distribution,
     # compared to "/nix/store/.../bin" in NixOS.
     # As a result, miktex will fail to find e.g. 'pkexec','ksudo','gksu'
     # under /run/wrappers/bin in NixOS.
-    # We fix this by adding the PATH environment variable to exectables' search path.
+    # We fix this by adding the PATH environment variable to executables' search path.
     ./find-exectables-in-path.patch
   ];
 
diff --git a/pkgs/by-name/mi/minecraft-server/update.py b/pkgs/by-name/mi/minecraft-server/update.py
index de4c9339c576..6b5678650a58 100755
--- a/pkgs/by-name/mi/minecraft-server/update.py
+++ b/pkgs/by-name/mi/minecraft-server/update.py
@@ -67,7 +67,7 @@ class Version(DataClassJsonMixin):
         """
         If the version has a server download available, return the Download
         object for the server download. If the version does not have a server
-        download avilable, return None.
+        download available, return None.
         """
         downloads = self.get_downloads()
         if "server" in downloads:
@@ -240,7 +240,7 @@ def generate_commit(
     if len(actions) == 1:
         commit_message = commit_body_lines[0]
 
-        # the body should only be the release notes to avoid repeatition
+        # the body should only be the release notes to avoid repetition
         # if the release notes don't exist this will be blank
         commit_body = "\n".join(commit_body_lines[1:]).strip()
     else:
diff --git a/pkgs/by-name/mi/miriway/package.nix b/pkgs/by-name/mi/miriway/package.nix
index 46a42e22bd32..b04e904db8bf 100644
--- a/pkgs/by-name/mi/miriway/package.nix
+++ b/pkgs/by-name/mi/miriway/package.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       At the core of Miriway is miriway-shell, a Mir based Wayland compositor that provides:
 
-      - A "floating windows" window managament policy;
+      - A "floating windows" window management policy;
       - Support for Wayland (and via Xwayland) X11 applications;
       - Dynamic workspaces;
       - Additional Wayland support for "shell components" such as panels and docs; and,
diff --git a/pkgs/by-name/mo/mobilizon/frontend.nix b/pkgs/by-name/mo/mobilizon/frontend.nix
index 6861254546bd..f2a9fbd70e00 100644
--- a/pkgs/by-name/mo/mobilizon/frontend.nix
+++ b/pkgs/by-name/mo/mobilizon/frontend.nix
@@ -24,7 +24,6 @@ buildNpmPackage {
     homepage = "https://joinmobilizon.org/";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [
-      minijackson
       erictapen
     ];
   };
diff --git a/pkgs/by-name/mo/mobilizon/package.nix b/pkgs/by-name/mo/mobilizon/package.nix
index 3409d5b8b97c..e1f458ee11f0 100644
--- a/pkgs/by-name/mo/mobilizon/package.nix
+++ b/pkgs/by-name/mo/mobilizon/package.nix
@@ -157,7 +157,6 @@ beamPackages.mixRelease rec {
     changelog = "https://framagit.org/framasoft/mobilizon/-/releases/${src.tag}";
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [
-      minijackson
       erictapen
     ];
   };
diff --git a/pkgs/by-name/mo/mobsql/package.nix b/pkgs/by-name/mo/mobsql/package.nix
index 4d32a2d0d85e..af5db21d1715 100644
--- a/pkgs/by-name/mo/mobsql/package.nix
+++ b/pkgs/by-name/mo/mobsql/package.nix
@@ -40,7 +40,7 @@ buildGoModule (finalAttrs: {
       source GTFS feed archives into a SQLite database.
       Its internal SQLite schema mirrors GTFS's spec but adds a feed_id field
       to each table (thus allowing multiple feeds to be loaded
-      to the database simulatenously).
+      to the database simultaneously).
     '';
     homepage = "https://git.sr.ht/~mil/mobsql";
     license = lib.licenses.gpl3Plus;
diff --git a/pkgs/by-name/ms/msedit/package.nix b/pkgs/by-name/ms/msedit/package.nix
index e92a75b23d58..4606cf1318e1 100644
--- a/pkgs/by-name/ms/msedit/package.nix
+++ b/pkgs/by-name/ms/msedit/package.nix
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   }
   // lib.optionalAttrs stdenv.hostPlatform.isLinux {
     # https://github.com/microsoft/edit/releases/tag/v2.0.0
-    # see section 'Additonal notes to Building & Packaging
+    # see section 'Additional notes to Building & Packaging
     EDIT_CFG_ICUUC_SONAME = "${lib.getLib icu76}/lib/libicuuc.so.76";
     EDIT_CFG_ICUI18N_SONAME = "${lib.getLib icu76}/lib/libicui18n.so.76";
     EDIT_CFG_ICU_RENAMING_VERSION = 76;
diff --git a/pkgs/by-name/mv/mvapich/package.nix b/pkgs/by-name/mv/mvapich/package.nix
index cd0081708930..be7e3a61085a 100644
--- a/pkgs/by-name/mv/mvapich/package.nix
+++ b/pkgs/by-name/mv/mvapich/package.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-device=ch4:ofi"
   ];
 
-  doCheck = false; # requries bindir/bin/mpicc before install is run
+  doCheck = false; # requires bindir/bin/mpicc before install is run
 
   postInstall = ''
     for e in mpif77 mpif90 mpifort mpichversion mpic++ mpicxx mpicc mpivars; do
diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix
index 9d5b78c1e168..a5cb49301a7b 100644
--- a/pkgs/by-name/my/mysql84/package.nix
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.4.10";
+  version = "8.4.11";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-1XpnMLrvFK4Rj39KbgKEW1tQkzdY32H7BuEE8nzMj5Y=";
+    hash = "sha256-6zBRFk1iXdNGqCA/duDV1dmuxR2+nVF4jjnsaz8TlMI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/netbird/package.nix b/pkgs/by-name/ne/netbird/package.nix
index 8f81ff599cb6..42d0dc836f66 100644
--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@@ -73,13 +73,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "netbird-${componentName}";
-  version = "0.76.1";
+  version = "0.76.2";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "netbird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gxcb1CQ2f8g8wYEt1z2rvJrcoXy2k7pSSMaLmfqmISc=";
+    hash = "sha256-PgJLtT5NEC7gqqZIe9Zi1VRUmzzJ50hbUAtMqaj2dmQ=";
   };
 
   overrideModAttrs = final: prev: {
@@ -93,7 +93,7 @@ buildGoModule (finalAttrs: {
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-KVGCV89qGHrg2GQVw6MnftQswbdihcqozptjf5vs5BA=";
+  vendorHash = "sha256-36XD5NxkDoEwfFeZwHmqVJBy2RonaU1g1Sjy8GgZAD4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ne/netbox_4_5/plugins/netbox-documents/package.nix b/pkgs/by-name/ne/netbox_4_5/plugins/netbox-documents/package.nix
index 3ecc5ebc286e..2110755a3b77 100644
--- a/pkgs/by-name/ne/netbox_4_5/plugins/netbox-documents/package.nix
+++ b/pkgs/by-name/ne/netbox_4_5/plugins/netbox-documents/package.nix
@@ -35,7 +35,7 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "netbox_documents" ];
 
   meta = {
-    description = "Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox";
+    description = "Plugin designed to facilitate the storage of site, circuit, device type and device specific documents within NetBox";
     homepage = "https://github.com/jasonyates/netbox-documents";
     changelog = "https://github.com/jasonyates/netbox-documents/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
diff --git a/pkgs/by-name/ne/netbox_4_5/plugins/netbox-plugin-prometheus-sd/package.nix b/pkgs/by-name/ne/netbox_4_5/plugins/netbox-plugin-prometheus-sd/package.nix
index a6b0084eb39c..b5596ff7a7a7 100644
--- a/pkgs/by-name/ne/netbox_4_5/plugins/netbox-plugin-prometheus-sd/package.nix
+++ b/pkgs/by-name/ne/netbox_4_5/plugins/netbox-plugin-prometheus-sd/package.nix
@@ -48,7 +48,7 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "netbox_prometheus_sd" ];
 
   meta = {
-    description = "Netbox plugin to provide Netbox entires to Prometheus HTTP service discovery";
+    description = "Netbox plugin to provide Netbox entries to Prometheus HTTP service discovery";
     homepage = "https://github.com/FlxPeters/netbox-plugin-prometheus-sd";
     changelog = "https://github.com/FlxPeters/netbox-plugin-prometheus-sd/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index 26e3f21880b0..57fe460e8d54 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -32,11 +32,11 @@
 }:
 let
   pname = "nextcloud-talk-desktop";
-  version = "2.2.1"; # Ensure both hashes (Linux and Darwin) are updated!
+  version = "2.2.3"; # Ensure both hashes (Linux and Darwin) are updated!
 
   hashes = {
-    linux = "sha256-AhNHPejdnGmL55/mHGKkDaGWl2fm7uufX4JaB5VSBos=";
-    darwin = "sha256-TkLAydkedLbi6vqd3kvQNkVnXGSHfF6xTBF3PCOgJ6I=";
+    linux = "sha256-6YoAlMGKPeSJoXd211cufdE/XgroojH3djwaSEwlBjs=";
+    darwin = "sha256-BpyVJXyCYC1qH4ecDobHBVLLTeVDx/MPWBsnXgrnKhE=";
   };
 
   # Only x86_64-linux is supported with Darwin support being universal
diff --git a/pkgs/by-name/nf/nfs-ganesha/package.nix b/pkgs/by-name/nf/nfs-ganesha/package.nix
index 49a7b43fdb8c..01dc73205b77 100644
--- a/pkgs/by-name/nf/nfs-ganesha/package.nix
+++ b/pkgs/by-name/nf/nfs-ganesha/package.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nfs-ganesha";
-  version = "13.0";
+  version = "14.1";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-PAEDBUIMjuMzhSvWn80EtiHOaFPgcJgE9kZVG6nKLZs=";
+    hash = "sha256-fn59QvPt0F6G8wyuX1/GXwvDOj46C7Wk6cVwnwtTmRk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ni/nitrokey-app2/package.nix b/pkgs/by-name/ni/nitrokey-app2/package.nix
index 6dc5284cfe4b..fc9b2c6b2f83 100644
--- a/pkgs/by-name/ni/nitrokey-app2/package.nix
+++ b/pkgs/by-name/ni/nitrokey-app2/package.nix
@@ -61,7 +61,7 @@ python3Packages.buildPythonApplication rec {
     install -Dm755 meta/nk-app2.png $out/share/icons/hicolor/128x128/apps/com.nitrokey.nitrokey-app2.png
   '';
 
-  # wrapQtApps only wrapps binary files and normally skips python programs.
+  # wrapQtApps only wraps binary files and normally skips python programs.
   # Manually pass the qtWrapperArgs from wrapQtAppsHook to wrap python programs.
   preFixup = ''
     makeWrapperArgs+=("''${qtWrapperArgs[@]}")
diff --git a/pkgs/by-name/ni/nix-weather/package.nix b/pkgs/by-name/ni/nix-weather/package.nix
index 00f904a9144d..48ab325dc19f 100644
--- a/pkgs/by-name/ni/nix-weather/package.nix
+++ b/pkgs/by-name/ni/nix-weather/package.nix
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Check Cache Availablility of NixOS Configurations";
+    description = "Check Cache Availability of NixOS Configurations";
     longDescription = ''
       Fast rust tool to check availability of your entire system in caches. It
       so to speak "checks the weather" before going to update. Useful for
diff --git a/pkgs/by-name/ni/nixbit/package.nix b/pkgs/by-name/ni/nixbit/package.nix
index b2fdf1f561c9..a49e2f2f3ddf 100644
--- a/pkgs/by-name/ni/nixbit/package.nix
+++ b/pkgs/by-name/ni/nixbit/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nixbit";
-  version = "0.10.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "pbek";
     repo = "nixbit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ft+R5+j2QXo9rYMDGMKGXbA7aBRTLnRCuDh8vFswKSI=";
+    hash = "sha256-rSbF4id+pUkob+wpeGUCHenssOat1W5HeH2C6cerJE8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/nl/nload/package.nix b/pkgs/by-name/nl/nload/package.nix
index 173961965938..4a965b55effb 100644
--- a/pkgs/by-name/nl/nload/package.nix
+++ b/pkgs/by-name/nl/nload/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
       nload is a console application which monitors network traffic and
       bandwidth usage in real time. It visualizes the in- and outgoing traffic
       using two graphs and provides additional info like total amount of
-      transfered data and min/max network usage.
+      transferred data and min/max network usage.
     '';
     homepage = "https://www.roland-riegel.de/nload/index.html";
     license = lib.licenses.gpl2;
diff --git a/pkgs/by-name/no/noctalia-qs/package.nix b/pkgs/by-name/no/noctalia-qs/package.nix
index f11d123ae1ba..9e0dd1ab1125 100644
--- a/pkgs/by-name/no/noctalia-qs/package.nix
+++ b/pkgs/by-name/no/noctalia-qs/package.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/noctalia-dev/noctalia-qs";
-    description = "Flexbile QtQuick based desktop shell toolkit";
+    description = "Flexible QtQuick based desktop shell toolkit";
     license = lib.licenses.lgpl3Only;
     platforms = lib.platforms.linux;
     mainProgram = "quickshell";
diff --git a/pkgs/by-name/no/node-core-utils/package.nix b/pkgs/by-name/no/node-core-utils/package.nix
index c560a5d6bb62..21ff00f26b55 100644
--- a/pkgs/by-name/no/node-core-utils/package.nix
+++ b/pkgs/by-name/no/node-core-utils/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "node-core-utils";
-  version = "6.4.0";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "nodejs";
     repo = "node-core-utils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VGl2Tz3oErFXrmnekVAGMSYiCn4sFuTWlzn5EWvKbcw=";
+    hash = "sha256-cnnzFa8RK7HSuOcbW1Cwz+gQ1+jbcOYD844F2hXlSBI=";
   };
 
-  npmDepsHash = "sha256-NQSWOALsSfv2rjQW3gQDIYw28zDETRxKYaqHMPgUqew=";
+  npmDepsHash = "sha256-K6wY8NmzrE/uCyK/EAc8oAiO/0jmYYHhgcIO37AANO0=";
 
   dontNpmBuild = true;
   dontNpmPrune = true;
diff --git a/pkgs/by-name/no/noisetorch/package.nix b/pkgs/by-name/no/noisetorch/package.nix
index 99f134fa70c4..8eccce354f2c 100644
--- a/pkgs/by-name/no/noisetorch/package.nix
+++ b/pkgs/by-name/no/noisetorch/package.nix
@@ -41,7 +41,7 @@ buildGoModule (finalAttrs: {
   '';
 
   meta = {
-    description = "Virtual microphone device with noise supression for PulseAudio";
+    description = "Virtual microphone device with noise suppression for PulseAudio";
     homepage = "https://github.com/noisetorch/NoiseTorch";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/no/nomad-autoscaler/package.nix b/pkgs/by-name/no/nomad-autoscaler/package.nix
index 9819a051d5f4..c8a792d492e8 100644
--- a/pkgs/by-name/no/nomad-autoscaler/package.nix
+++ b/pkgs/by-name/no/nomad-autoscaler/package.nix
@@ -78,7 +78,7 @@ let
       runHook postInstall
     '';
 
-    # make toggle-able, so that overrided versions can disable this check if
+    # make toggle-able, so that overridden versions can disable this check if
     # they want newer versions of the plugins without having to modify
     # the output logic
     doInstallCheck = true;
diff --git a/pkgs/by-name/no/notion-app-enhanced/package.nix b/pkgs/by-name/no/notion-app-enhanced/package.nix
index f5f3f9ae041f..45b47395f85a 100644
--- a/pkgs/by-name/no/notion-app-enhanced/package.nix
+++ b/pkgs/by-name/no/notion-app-enhanced/package.nix
@@ -25,7 +25,7 @@ appimageTools.wrapType2 {
   '';
 
   meta = {
-    description = "Notion Desktop builds with Notion Enhancer for Windows, MacOS and Linux";
+    description = "Notion Desktop builds with Notion Enhancer for Windows, macOS and Linux";
     homepage = "https://github.com/notion-enhancer/desktop";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ sei40kr ];
diff --git a/pkgs/by-name/nt/ntirpc/package.nix b/pkgs/by-name/nt/ntirpc/package.nix
index 3eb811cdc7db..b5422f76745b 100644
--- a/pkgs/by-name/nt/ntirpc/package.nix
+++ b/pkgs/by-name/nt/ntirpc/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ntirpc";
-  version = "10.0";
+  version = "14.1";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "ntirpc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZG1YuTBmfkyXn1w9aMZHFbWIAtIeqGiLOxFPPwqCgR4=";
+    hash = "sha256-cOEmlsmXHTXiQcTmCkiQ8PeA+0U3W+xyUQ0Ba8kwvrw=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/oa/oauth2-proxy/package.nix b/pkgs/by-name/oa/oauth2-proxy/package.nix
index 8542c14bf37c..3ca4a13be3ed 100644
--- a/pkgs/by-name/oa/oauth2-proxy/package.nix
+++ b/pkgs/by-name/oa/oauth2-proxy/package.nix
@@ -25,7 +25,7 @@ buildGoModule rec {
   doInstallCheck = true;
 
   meta = {
-    description = "Reverse proxy that provides authentication with Google, Github, or other providers";
+    description = "Reverse proxy that provides authentication with Google, GitHub, or other providers";
     homepage = "https://github.com/oauth2-proxy/oauth2-proxy/";
     license = lib.licenses.mit;
     mainProgram = "oauth2-proxy";
diff --git a/pkgs/by-name/oc/octofetch/package.nix b/pkgs/by-name/oc/octofetch/package.nix
index c1b8bfd09d75..4dcb6ed16280 100644
--- a/pkgs/by-name/oc/octofetch/package.nix
+++ b/pkgs/by-name/oc/octofetch/package.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/azur1s/octofetch";
-    description = "Github user information on terminal";
+    description = "GitHub user information on terminal";
     license = lib.licenses.mit;
     maintainers = [ ];
     mainProgram = "octofetch";
diff --git a/pkgs/by-name/oc/octoprint/plugins.nix b/pkgs/by-name/oc/octoprint/plugins.nix
index ea99883f164d..bd52b6873645 100644
--- a/pkgs/by-name/oc/octoprint/plugins.nix
+++ b/pkgs/by-name/oc/octoprint/plugins.nix
@@ -498,7 +498,7 @@ in
     };
 
     meta = {
-      description = "Simple plugin that add an emergency stop buton on NavBar of OctoPrint";
+      description = "Simple plugin that add an emergency stop button on NavBar of OctoPrint";
       homepage = "https://github.com/Sebclem/OctoPrint-SimpleEmergencyStop";
       license = lib.licenses.agpl3Only;
       maintainers = with lib.maintainers; [ WhittlesJr ];
diff --git a/pkgs/by-name/oc/octosuite/package.nix b/pkgs/by-name/oc/octosuite/package.nix
index 9c66d69ff3a1..7b6ac8856f81 100644
--- a/pkgs/by-name/oc/octosuite/package.nix
+++ b/pkgs/by-name/oc/octosuite/package.nix
@@ -41,7 +41,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   doCheck = false;
 
   meta = {
-    description = "Advanced Github OSINT framework";
+    description = "Advanced GitHub OSINT framework";
     mainProgram = "octosuite";
     homepage = "https://github.com/bellingcat/octosuite";
     changelog = "https://github.com/bellingcat/octosuite/releases/tag/${finalAttrs.version}";
diff --git a/pkgs/by-name/on/onnx/package.nix b/pkgs/by-name/on/onnx/package.nix
index fcab2143a192..387e4410eeb3 100644
--- a/pkgs/by-name/on/onnx/package.nix
+++ b/pkgs/by-name/on/onnx/package.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
     export MAX_JOBS=$NIX_BUILD_CORES
   '';
 
-  # Leave the CMake bulid directory, export the `cmakeFlags` environment variable as CMAKE_ARGS so setup.py will pick
+  # Leave the CMake build directory, export the `cmakeFlags` environment variable as CMAKE_ARGS so setup.py will pick
   # them up, do the python build from the top-level, then resume the C++ build.
   preBuild = ''
     pushd ..
diff --git a/pkgs/by-name/op/openra/updater.sh b/pkgs/by-name/op/openra/updater.sh
index d8b06d17c2e2..30ad2c3b1596 100644
--- a/pkgs/by-name/op/openra/updater.sh
+++ b/pkgs/by-name/op/openra/updater.sh
@@ -18,7 +18,7 @@ if [[ ! -f "$depsFilePath" ]]; then
 fi
 
 # if on bleed, update to the latest commit from the bleed branch
-# otherwise, check Github releases for releases with a matching prefix
+# otherwise, check GitHub releases for releases with a matching prefix
 declare newVersion
 declare newHash
 if [[ "$build" == "bleed" ]]; then
diff --git a/pkgs/by-name/os/osmium/package.nix b/pkgs/by-name/os/osmium/package.nix
index 4a1ec4f33ba9..e951b2d3562f 100644
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osmium";
-  version = "0.0.32-alpha";
+  version = "0.0.33-alpha";
 
   src = fetchurl {
     url = "https://updater.osmium.chat/Osmium-${version}-x64.tar.gz";
-    hash = "sha256-gW8AuO1W2MesYPgmXji8INyXKMXeP85+8MgieEn/UHo=";
+    hash = "sha256-ybv/CCaCqcNvoyTNKQbjSdNxOC81QDnnKjKcw8X9y2Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/os/osmo-hlr/package.nix b/pkgs/by-name/os/osmo-hlr/package.nix
index 27e8fe9cceb6..0f523618be20 100644
--- a/pkgs/by-name/os/osmo-hlr/package.nix
+++ b/pkgs/by-name/os/osmo-hlr/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   meta = {
-    description = "Osmocom implementation of 3GPP Home Location Registr (HLR)";
+    description = "Osmocom implementation of 3GPP Home Location Register (HLR)";
     homepage = "https://osmocom.org/projects/osmo-hlr";
     license = lib.licenses.agpl3Plus;
     maintainers = [ lib.maintainers.markuskowa ];
diff --git a/pkgs/by-name/os/osmo-msc/package.nix b/pkgs/by-name/os/osmo-msc/package.nix
index 9e5e14d7bf87..84c270501c20 100644
--- a/pkgs/by-name/os/osmo-msc/package.nix
+++ b/pkgs/by-name/os/osmo-msc/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   meta = {
-    description = "Osmocom implementation of 3GPP Mobile Swtiching Centre (MSC)";
+    description = "Osmocom implementation of 3GPP Mobile Switching Centre (MSC)";
     mainProgram = "osmo-msc";
     homepage = "https://osmocom.org/projects/osmomsc/wiki";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/by-name/os/ossia-score/package.nix b/pkgs/by-name/os/ossia-score/package.nix
index 406f508a7cae..8693d4dda27e 100644
--- a/pkgs/by-name/os/ossia-score/package.nix
+++ b/pkgs/by-name/os/ossia-score/package.nix
@@ -163,7 +163,6 @@ clangStdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       jcelerier
-      minijackson
     ];
   };
 })
diff --git a/pkgs/by-name/ot/otel-desktop-viewer/package.nix b/pkgs/by-name/ot/otel-desktop-viewer/package.nix
index 50a095b9c449..bc4be8a8fc8a 100644
--- a/pkgs/by-name/ot/otel-desktop-viewer/package.nix
+++ b/pkgs/by-name/ot/otel-desktop-viewer/package.nix
@@ -45,7 +45,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/CtrlSpice/otel-desktop-viewer/releases/tag/v${finalAttrs.version}";
-    description = "Receive & visualize OpenTelemtry traces locally within one CLI tool";
+    description = "Receive & visualize OpenTelemetry traces locally within one CLI tool";
     homepage = "https://github.com/CtrlSpice/otel-desktop-viewer";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/pa/pandoc-katex/package.nix b/pkgs/by-name/pa/pandoc-katex/package.nix
index e281f79b8359..18f50e190c12 100644
--- a/pkgs/by-name/pa/pandoc-katex/package.nix
+++ b/pkgs/by-name/pa/pandoc-katex/package.nix
@@ -25,7 +25,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       mit
     ];
     maintainers = with lib.maintainers; [
-      minijackson
       euxane
     ];
     mainProgram = "pandoc-katex";
diff --git a/pkgs/by-name/pa/pandoc/package.nix b/pkgs/by-name/pa/pandoc/package.nix
index 72faf5ec68f0..4ba727d6b0e0 100644
--- a/pkgs/by-name/pa/pandoc/package.nix
+++ b/pkgs/by-name/pa/pandoc/package.nix
@@ -5,7 +5,7 @@
   haskell,
   removeReferencesTo,
   installShellFiles,
-  selectPandocCLI ? (p: p.pandoc-cli), # The version of pandoc-cli choosen from haskellPackages.
+  selectPandocCLI ? (p: p.pandoc-cli), # The version of pandoc-cli chosen from haskellPackages.
 }:
 
 let
diff --git a/pkgs/by-name/pd/pdfding/package.nix b/pkgs/by-name/pd/pdfding/package.nix
index 59fe84d69daf..2ddf27ff281e 100644
--- a/pkgs/by-name/pd/pdfding/package.nix
+++ b/pkgs/by-name/pd/pdfding/package.nix
@@ -52,7 +52,7 @@ python.pkgs.buildPythonPackage (finalAttrs: {
       ruamel-yaml
       whitenoise
 
-      # dependecies required for django collectstatic
+      # dependencies required for django collectstatic
       cryptography
       pyjwt
       requests
diff --git a/pkgs/by-name/pe/perfect_dark/package.nix b/pkgs/by-name/pe/perfect_dark/package.nix
index 9988fc6b9a11..fb2bd0ebac46 100644
--- a/pkgs/by-name/pe/perfect_dark/package.nix
+++ b/pkgs/by-name/pe/perfect_dark/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch =
-    # The project uses Git to retrieve version informations but our
+    # The project uses Git to retrieve version information but our
     # fetcher deletes the .git directory, so we replace the commands
     # with the correct data directly.
     ''
diff --git a/pkgs/by-name/ph/phd2/package.nix b/pkgs/by-name/ph/phd2/package.nix
index 0d0c3aa74fa4..f4fd4b448a5a 100644
--- a/pkgs/by-name/ph/phd2/package.nix
+++ b/pkgs/by-name/ph/phd2/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   # fixes build error because of missing include
-  # is in masster, should be removed with next release
+  # is in master, should be removed with next release
   patches = [
     (fetchpatch2 {
       url = "https://github.com/OpenPHDGuiding/phd2/commit/0927de6c8943fae7161457008b989bf72a05c638.patch?full_index=1";
diff --git a/pkgs/by-name/ph/photofield/package.nix b/pkgs/by-name/ph/photofield/package.nix
index 65d7c7f3c6c8..7bd7483d4e83 100644
--- a/pkgs/by-name/ph/photofield/package.nix
+++ b/pkgs/by-name/ph/photofield/package.nix
@@ -55,7 +55,7 @@ buildGoModule {
 
   tags = [ "embedui" ];
 
-  doCheck = false; # tries to modify filesytem
+  doCheck = false; # tries to modify filesystem
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/pi/picard/package.nix b/pkgs/by-name/pi/picard/package.nix
index cac8e2bd6906..ddcb9c1ec4a9 100644
--- a/pkgs/by-name/pi/picard/package.nix
+++ b/pkgs/by-name/pi/picard/package.nix
@@ -16,7 +16,7 @@
 }:
 
 let
-  # A few more tests fail with python314Pacakges, indicating the code isn't
+  # A few more tests fail with python314Packages, indicating the code isn't
   # ready for it yet.
   pythonPackages = python313Packages;
   pyqt5 = if enablePlayback then pythonPackages.pyqt5-multimedia else pythonPackages.pyqt5;
diff --git a/pkgs/by-name/pi/pies/package.nix b/pkgs/by-name/pi/pies/package.nix
index e5499a017637..ad51f340a3e6 100644
--- a/pkgs/by-name/pi/pies/package.nix
+++ b/pkgs/by-name/pi/pies/package.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
       notifications to the system administrator, invoking another external
       program, etc.
 
-      Pies can be used for a wide variety of tasks.  Its most obious use
-      is to put in backgound a program which normally cannot detach itself
+      Pies can be used for a wide variety of tasks.  Its most obvious use
+      is to put in background a program which normally cannot detach itself
       from the controlling terminal, such as, e.g., minicom.  It can
       launch and control components of some complex system, such as
       Jabberd or MeTA1 (and it offers much more control over them than the
diff --git a/pkgs/by-name/pl/plex-desktop/update.sh b/pkgs/by-name/pl/plex-desktop/update.sh
index 91c2bd15b7f6..433c8d062657 100755
--- a/pkgs/by-name/pl/plex-desktop/update.sh
+++ b/pkgs/by-name/pl/plex-desktop/update.sh
@@ -3,7 +3,7 @@
 
 
 # executing this script without arguments will
-# - find the newest stable plex-desktop version avaiable on snapcraft (https://snapcraft.io/plex-desktop)
+# - find the newest stable plex-desktop version available on snapcraft (https://snapcraft.io/plex-desktop)
 # - read the current plex-desktop version from the current nix expression
 # - update the nix expression if the versions differ
 # - try to build the updated version, exit if that fails
@@ -20,7 +20,7 @@ plex_nix="$nixpkgs/pkgs/by-name/pl/plex-desktop/package.nix"
 
 
 #
-# find the newest stable plex-desktop version avaiable on snapcraft
+# find the newest stable plex-desktop version available on snapcraft
 #
 
 # create bash array from snap info
diff --git a/pkgs/by-name/pl/plex-htpc/update.sh b/pkgs/by-name/pl/plex-htpc/update.sh
index 687e7e3fd715..433b21a8af05 100755
--- a/pkgs/by-name/pl/plex-htpc/update.sh
+++ b/pkgs/by-name/pl/plex-htpc/update.sh
@@ -3,7 +3,7 @@
 
 
 # executing this script without arguments will
-# - find the newest stable plex-htpc version avaiable on snapcraft (https://snapcraft.io/plex-htpc)
+# - find the newest stable plex-htpc version available on snapcraft (https://snapcraft.io/plex-htpc)
 # - read the current plex-htpc version from the current nix expression
 # - update the nix expression if the versions differ
 # - try to build the updated version, exit if that fails
@@ -20,7 +20,7 @@ plex_nix="$nixpkgs/pkgs/by-name/pl/plex-htpc/package.nix"
 
 
 #
-# find the newest stable plex-htpc version avaiable on snapcraft
+# find the newest stable plex-htpc version available on snapcraft
 #
 
 # create bash array from snap info
diff --git a/pkgs/by-name/pl/plexamp/update-plexamp.sh b/pkgs/by-name/pl/plexamp/update-plexamp.sh
index e241d92b5d87..ddd7abee3ca3 100755
--- a/pkgs/by-name/pl/plexamp/update-plexamp.sh
+++ b/pkgs/by-name/pl/plexamp/update-plexamp.sh
@@ -41,7 +41,7 @@ if diff "$DEFAULT_NIX" "$WORKING_NIX"; then
   exit 0
 fi
 
-# update sha hash (convenietly provided)
+# update sha hash (conveniently provided)
 sed -i "s@hash.* = .*;@hash = \"sha512-$SHA512\";@g" "$WORKING_NIX"
 
 # update the changelog ("just" increment the number)
diff --git a/pkgs/by-name/pl/plikd/package.nix b/pkgs/by-name/pl/plikd/package.nix
index 0e34e021a73d..4dc2d6459c03 100644
--- a/pkgs/by-name/pl/plikd/package.nix
+++ b/pkgs/by-name/pl/plikd/package.nix
@@ -18,7 +18,7 @@ buildGoModule (finalAttrs: {
     hash = "sha256-WCtfkzlZnyzZDwNDBrW06bUbLYTL2C704Y7aXbiVi5c=";
   };
 
-  # TODO build webapp from source (how to hanndle npm and bower deps?)
+  # TODO build webapp from source (how to handle npm and bower deps?)
   src-webapp = fetchurl {
     url = "https://github.com/root-gg/plik/releases/download/${finalAttrs.version}/plik-${finalAttrs.version}-linux-amd64.tar.gz";
     hash = "sha256-taUFXZJeUHYjjhrVlLgKYPxNn6W5o8uoEVcu+f5flCA=";
diff --git a/pkgs/by-name/pm/pmacct/package.nix b/pkgs/by-name/pm/pmacct/package.nix
index e58d1558dd26..f4e89e4779b0 100644
--- a/pkgs/by-name/pm/pmacct/package.nix
+++ b/pkgs/by-name/pm/pmacct/package.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    # Fixes GCC15 compatability
+    # Fixes GCC15 compatibility
     # Can be removed with the next release
     # Custom version of https://github.com/pmacct/pmacct/commit/6466578967d3d39c46f7ec10b308bca36568697d.patch
     # without the copyright date changes.
diff --git a/pkgs/by-name/po/ponysay/package.nix b/pkgs/by-name/po/ponysay/package.nix
index 0fa1c09cc9fb..456a89d371d5 100644
--- a/pkgs/by-name/po/ponysay/package.nix
+++ b/pkgs/by-name/po/ponysay/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Cowsay reimplemention for ponies";
+    description = "Cowsay reimplementation for ponies";
     homepage = "https://github.com/erkin/ponysay";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ bodil ];
diff --git a/pkgs/by-name/po/portablemc/package.nix b/pkgs/by-name/po/portablemc/package.nix
index cd22a688b430..ecf46d3bb844 100644
--- a/pkgs/by-name/po/portablemc/package.nix
+++ b/pkgs/by-name/po/portablemc/package.nix
@@ -36,7 +36,7 @@
   jdk17,
   jdk8,
 
-  # can be overriden to reduce the closure size
+  # can be overridden to reduce the closure size
   jvms ? [
     jdk25
     jdk21
diff --git a/pkgs/by-name/po/pouf/package.nix b/pkgs/by-name/po/pouf/package.nix
index 22ad54f4a30d..01db0b1e851e 100644
--- a/pkgs/by-name/po/pouf/package.nix
+++ b/pkgs/by-name/po/pouf/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   postInstall = "make PREFIX=$out copy-data";
 
   meta = {
-    description = "CLI program for produce fake datas";
+    description = "CLI program for produce fake data";
     homepage = "https://github.com/mothsart/pouf";
     changelog = "https://github.com/mothsart/pouf/releases/tag/${finalAttrs.version}";
     maintainers = with lib.maintainers; [ mothsart ];
diff --git a/pkgs/by-name/po/powerdns-admin/0001-Fix-flask-2.3-issue.patch b/pkgs/by-name/po/powerdns-admin/0001-Fix-flask-2.3-issue.patch
deleted file mode 100644
index 8645e0dbfa7d..000000000000
--- a/pkgs/by-name/po/powerdns-admin/0001-Fix-flask-2.3-issue.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 29b58e29c813d9bf0b31139a19b556614c28638e Mon Sep 17 00:00:00 2001
-From: Flakebi <flakebi@t-online.de>
-Date: Sat, 2 Dec 2023 16:26:22 +0100
-Subject: [PATCH 1/6] Fix flask 2.3 issue
-
-'Blueprint' object has no attribute 'before_app_first_request'
----
- powerdnsadmin/routes/index.py | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/powerdnsadmin/routes/index.py b/powerdnsadmin/routes/index.py
-index d56ce61..2176bd6 100644
---- a/powerdnsadmin/routes/index.py
-+++ b/powerdnsadmin/routes/index.py
-@@ -46,7 +46,6 @@ index_bp = Blueprint('index',
-                      url_prefix='/')
- 
- 
--@index_bp.before_app_first_request
- def register_modules():
-     global google
-     global github
--- 
-2.42.0
-
diff --git a/pkgs/by-name/po/powerdns-admin/0002-Remove-cssrewrite-filter.patch b/pkgs/by-name/po/powerdns-admin/0002-Remove-cssrewrite-filter.patch
index 9b442d5f3d7d..93085ba0375a 100644
--- a/pkgs/by-name/po/powerdns-admin/0002-Remove-cssrewrite-filter.patch
+++ b/pkgs/by-name/po/powerdns-admin/0002-Remove-cssrewrite-filter.patch
@@ -1,34 +1,25 @@
-From c60a9658fe2ca429327680fbffb86f609d98c52c Mon Sep 17 00:00:00 2001
-From: Flakebi <flakebi@t-online.de>
-Date: Sat, 2 Dec 2023 16:27:49 +0100
-Subject: [PATCH 2/6] Remove cssrewrite filter
-
----
- powerdnsadmin/assets.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
 diff --git a/powerdnsadmin/assets.py b/powerdnsadmin/assets.py
-index d46d431..3c582be 100644
+index b339c0e..6cf8087 100644
 --- a/powerdnsadmin/assets.py
 +++ b/powerdnsadmin/assets.py
-@@ -13,7 +13,7 @@ css_login = Bundle(
+@@ -50,7 +50,7 @@ class ModernBrowserCssFilter(Filter):
+ css_login = Bundle(
      'node_modules/@fortawesome/fontawesome-free/css/all.css',
-     'node_modules/icheck/skins/square/blue.css',
      'node_modules/admin-lte/dist/css/adminlte.css',
--    filters=('rcssmin', 'cssrewrite'),
-+    filters=('rcssmin'),
+-    filters=(ModernBrowserCssFilter, 'rcssmin', 'cssrewrite'),
++    filters=(ModernBrowserCssFilter, 'rcssmin'),
      output='generated/login.css')
  
  js_login = Bundle(
-@@ -37,7 +37,7 @@ css_main = Bundle(
+@@ -66,7 +66,7 @@ css_main = Bundle(
      'node_modules/admin-lte/dist/css/adminlte.css',
+     'node_modules/datatables.net-bs5/css/dataTables.bootstrap5.css',
      'custom/css/custom.css',
-     'node_modules/bootstrap-datepicker/dist/css/bootstrap-datepicker.css',
--    filters=('rcssmin', 'cssrewrite'),
-+    filters=('rcssmin'),
+-    filters=(ModernBrowserCssFilter, 'rcssmin', 'cssrewrite'),
++    filters=(ModernBrowserCssFilter, 'rcssmin'),
      output='generated/main.css')
  
  js_main = Bundle(
 -- 
-2.42.0
+2.43.0
 
diff --git a/pkgs/by-name/po/powerdns-admin/0003-Fix-flask-migrate-4.0-compatibility.patch b/pkgs/by-name/po/powerdns-admin/0003-Fix-flask-migrate-4.0-compatibility.patch
deleted file mode 100644
index c9956ae22f75..000000000000
--- a/pkgs/by-name/po/powerdns-admin/0003-Fix-flask-migrate-4.0-compatibility.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 8c320a34bcca6dc2c1b423a1445235bf178b653e Mon Sep 17 00:00:00 2001
-From: Flakebi <flakebi@t-online.de>
-Date: Sat, 2 Dec 2023 16:31:02 +0100
-Subject: [PATCH 3/6] Fix flask-migrate 4.0 compatibility
-
-See https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/1376
----
- migrations/env.py | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/migrations/env.py b/migrations/env.py
-index 4742e14..739d753 100755
---- a/migrations/env.py
-+++ b/migrations/env.py
-@@ -73,7 +73,6 @@ def run_migrations_online():
-     context.configure(connection=connection,
-                       target_metadata=target_metadata,
-                       process_revision_directives=process_revision_directives,
--                      render_as_batch=config.get_main_option('sqlalchemy.url').startswith('sqlite:'),
-                       **current_app.extensions['migrate'].configure_args)
- 
-     try:
--- 
-2.42.0
-
diff --git a/pkgs/by-name/po/powerdns-admin/0004-Fix-flask-session-and-powerdns-admin-compatibility.patch b/pkgs/by-name/po/powerdns-admin/0004-Fix-flask-session-and-powerdns-admin-compatibility.patch
deleted file mode 100644
index b1aaa8c531d1..000000000000
--- a/pkgs/by-name/po/powerdns-admin/0004-Fix-flask-session-and-powerdns-admin-compatibility.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 4b4ac26ef1cbb0b5b2354c251b216498325d0411 Mon Sep 17 00:00:00 2001
-From: Flakebi <flakebi@t-online.de>
-Date: Sat, 2 Dec 2023 16:31:50 +0100
-Subject: [PATCH 4/6] Fix flask-session and powerdns-admin compatibility
-
-flask-session and powerdns-admin both try to add sqlalchemy to flask.
-Reuse the database for flask-session.
----
- powerdnsadmin/__init__.py | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/powerdnsadmin/__init__.py b/powerdnsadmin/__init__.py
-index d447a00..653af33 100755
---- a/powerdnsadmin/__init__.py
-+++ b/powerdnsadmin/__init__.py
-@@ -60,6 +60,7 @@ def create_app(config=None):
-     if 'SESSION_TYPE' in os.environ:
-         app.config['SESSION_TYPE'] = os.environ.get('SESSION_TYPE')
- 
-+    app.config['SESSION_SQLALCHEMY'] = models.base.db
-     sess = Session(app)
- 
-     # create sessions table if using sqlalchemy backend
--- 
-2.42.0
-
diff --git a/pkgs/by-name/po/powerdns-admin/0005-Fix-app-context-and-register-modules.patch b/pkgs/by-name/po/powerdns-admin/0005-Fix-app-context-and-register-modules.patch
deleted file mode 100644
index 3004134a0ac4..000000000000
--- a/pkgs/by-name/po/powerdns-admin/0005-Fix-app-context-and-register-modules.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-diff --git a/powerdnsadmin/__init__.py b/powerdnsadmin/__init__.py
-index 660f96b..4d45c36 100755
---- a/powerdnsadmin/__init__.py
-+++ b/powerdnsadmin/__init__.py
-@@ -72,10 +72,16 @@ def create_app(config=None):
-     # SMTP
-     app.mail = Mail(app)
- 
-+    from powerdnsadmin.routes.index import register_modules
-+
-     # Load app's components
-     assets.init_app(app)
-     models.init_app(app)
--    routes.init_app(app)
-+
-+    with app.app_context():
-+        register_modules()
-+        routes.init_app(app)
-+
-     services.init_app(app)
- 
-     # Register filters
-diff --git a/powerdnsadmin/routes/index.py b/powerdnsadmin/routes/index.py
-index 0918261..870d824 100644
---- a/powerdnsadmin/routes/index.py
-+++ b/powerdnsadmin/routes/index.py
-@@ -52,11 +52,16 @@ def register_modules():
-     global azure
-     global oidc
-     global saml
--    google = google_oauth()
--    github = github_oauth()
--    azure = azure_oauth()
--    oidc = oidc_oauth()
--    saml = SAML()
-+
-+    try:
-+        google = google_oauth()
-+        github = github_oauth()
-+        azure = azure_oauth()
-+        oidc = oidc_oauth()
-+        saml = SAML()
-+    except Exception:
-+        # Database not ready yet, will initialize on first request
-+        pass
- 
- 
- @index_bp.before_request
-@@ -65,6 +70,9 @@ def before_request():
-     g.user = current_user
-     login_manager.anonymous_user = Anonymous
- 
-+    if google is None:
-+        register_modules()
-+
-     # Check site is in maintenance mode
-     maintenance = Setting().get('maintenance')
-     if maintenance and current_user.is_authenticated and current_user.role.name not in [
diff --git a/pkgs/by-name/po/powerdns-admin/0006-Fix-regex.patch b/pkgs/by-name/po/powerdns-admin/0006-Fix-regex.patch
deleted file mode 100644
index 2906d3709b04..000000000000
--- a/pkgs/by-name/po/powerdns-admin/0006-Fix-regex.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff --git a/powerdnsadmin/lib/utils.py b/powerdnsadmin/lib/utils.py
-index f8cc997..0de4c5c 100644
---- a/powerdnsadmin/lib/utils.py
-+++ b/powerdnsadmin/lib/utils.py
-@@ -121,7 +121,7 @@ def display_record_name(data):
-     if record_name == domain_name:
-         return '@'
-     else:
--        return re.sub('\.{}$'.format(domain_name), '', record_name)
-+        return re.sub(r'\.{}$'.format(domain_name), '', record_name)
- 
- 
- def display_master_name(data):
-diff --git a/powerdnsadmin/models/domain.py b/powerdnsadmin/models/domain.py
-index f0b9a30..84c6d1b 100644
---- a/powerdnsadmin/models/domain.py
-+++ b/powerdnsadmin/models/domain.py
-@@ -482,24 +482,24 @@ class Domain(db.Model):
-         if re.search('ip6.arpa', reverse_host_address):
-             for i in range(1, 32, 1):
-                 address = re.search(
--                    '((([a-f0-9]\.){' + str(i) + '})(?P<ipname>.+6.arpa)\.?)',
-+                    r'((([a-f0-9]\.){' + str(i) + r'})(?P<ipname>.+6\.arpa)\.?)',
-                     reverse_host_address)
-                 if None != self.get_id_by_name(address.group('ipname')):
-                     c = i
-                     break
-             return re.search(
--                '((([a-f0-9]\.){' + str(c) + '})(?P<ipname>.+6.arpa)\.?)',
-+                r'((([a-f0-9]\.){' + str(c) + r'})(?P<ipname>.+6\.arpa)\.?)',
-                 reverse_host_address).group('ipname')
-         else:
-             for i in range(1, 4, 1):
-                 address = re.search(
--                    '((([0-9]+\.){' + str(i) + '})(?P<ipname>.+r.arpa)\.?)',
-+                    r'((([0-9]+\.){' + str(i) + r'})(?P<ipname>.+r\.arpa)\.?)',
-                     reverse_host_address)
-                 if None != self.get_id_by_name(address.group('ipname')):
-                     c = i
-                     break
-             return re.search(
--                '((([0-9]+\.){' + str(c) + '})(?P<ipname>.+r.arpa)\.?)',
-+                r'((([0-9]+\.){' + str(c) + r'})(?P<ipname>.+r\.arpa)\.?)',
-                 reverse_host_address).group('ipname')
- 
-     def delete(self, domain_name):
diff --git a/pkgs/by-name/po/powerdns-admin/0007-Fix-oidc.patch b/pkgs/by-name/po/powerdns-admin/0007-Fix-oidc.patch
deleted file mode 100644
index 39623650cd9d..000000000000
--- a/pkgs/by-name/po/powerdns-admin/0007-Fix-oidc.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/powerdnsadmin/routes/index.py b/powerdnsadmin/routes/index.py
-index 23d88bb..edfab3f 100644
---- a/powerdnsadmin/routes/index.py
-+++ b/powerdnsadmin/routes/index.py
-@@ -392,11 +392,38 @@ def login():
-         return authenticate_user(user, 'Azure OAuth')
- 
-     if 'oidc_token' in session:
--        user_data = json.loads(oidc.get('userinfo').text)
--        oidc_username = user_data[Setting().get('oidc_oauth_username')]
--        oidc_first_name = user_data[Setting().get('oidc_oauth_firstname')]
--        oidc_last_name = user_data[Setting().get('oidc_oauth_last_name')]
--        oidc_email = user_data[Setting().get('oidc_oauth_email')]
-+        try:
-+            oidc_metadata = oidc.load_server_metadata()
-+        except Exception as e:
-+            current_app.logger.warning(
-+                'OIDC: unable to load server metadata ({}); '
-+                'falling back to relative userinfo endpoint'.format(e))
-+            oidc_metadata = {}
-+
-+        userinfo_endpoint = oidc_metadata.get('userinfo_endpoint')
-+        try:
-+            if userinfo_endpoint:
-+                userinfo_resp = oidc.get(userinfo_endpoint, timeout=15)
-+            else:
-+                userinfo_resp = oidc.get('userinfo', timeout=15)
-+            userinfo_resp.raise_for_status()
-+            user_data = userinfo_resp.json()
-+        except Exception as e:
-+            current_app.logger.error('OIDC: failed to fetch userinfo: {}'.format(e))
-+            session.pop('oidc_token', None)
-+            return redirect(url_for('index.login'))
-+
-+        oidc_username = user_data.get(Setting().get('oidc_oauth_username'))
-+        oidc_first_name = user_data.get(Setting().get('oidc_oauth_firstname'), '')
-+        oidc_last_name = user_data.get(Setting().get('oidc_oauth_last_name'), '')
-+        oidc_email = user_data.get(Setting().get('oidc_oauth_email'), '')
-+
-+        if not oidc_username:
-+            current_app.logger.error(
-+                'OIDC: username claim "{}" not present in userinfo'.format(
-+                    Setting().get('oidc_oauth_username')))
-+            session.pop('oidc_token', None)
-+            return redirect(url_for('index.login'))
- 
-         user = User.query.filter_by(username=oidc_username).first()
-         if not user:
diff --git a/pkgs/by-name/po/powerdns-admin/0008-Fix-profile-save-overwriting-password-with-empty-val.patch b/pkgs/by-name/po/powerdns-admin/0008-Fix-profile-save-overwriting-password-with-empty-val.patch
deleted file mode 100644
index 22479605cd90..000000000000
--- a/pkgs/by-name/po/powerdns-admin/0008-Fix-profile-save-overwriting-password-with-empty-val.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/powerdnsadmin/models/user.py b/powerdnsadmin/models/user.py
-index 42f894f..f9d845e 100644
---- a/powerdnsadmin/models/user.py
-+++ b/powerdnsadmin/models/user.py
-@@ -435,7 +435,7 @@ class User(db.Model):
-                 name='Administrator').first().id
- 
-         if hasattr(self, "plain_text_password"):
--            if self.plain_text_password != None:
-+            if self.plain_text_password:
-                 self.password = self.get_hashed_password(
-                     self.plain_text_password)
-         else:
-@@ -476,7 +476,7 @@ class User(db.Model):
- 
-         # store new password hash (only if changed)
-         if hasattr(self, "plain_text_password"):
--            if self.plain_text_password != None:
-+            if self.plain_text_password:
-                 user.password = self.get_hashed_password(
-                     self.plain_text_password).decode("utf-8")
- 
-@@ -495,7 +495,7 @@ class User(db.Model):
-         user.lastname = self.lastname if self.lastname else user.lastname
- 
-         if hasattr(self, "plain_text_password"):
--            if self.plain_text_password != None:
-+            if self.plain_text_password:
-                 user.password = self.get_hashed_password(
-                  self.plain_text_password).decode("utf-8") 
diff --git a/pkgs/by-name/po/powerdns-admin/package.nix b/pkgs/by-name/po/powerdns-admin/package.nix
index 424fc71278cd..8c680e97449c 100644
--- a/pkgs/by-name/po/powerdns-admin/package.nix
+++ b/pkgs/by-name/po/powerdns-admin/package.nix
@@ -2,23 +2,29 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchYarnDeps,
-  yarnConfigHook,
+  yarn-berry_4-fetcher,
   nixosTests,
   writeText,
+  runCommand,
   python3,
 }:
 
 let
   pname = "powerdns-admin";
-  version = "0.4.2";
+  version = "0.6.1";
   src = fetchFromGitHub {
     owner = "PowerDNS-Admin";
     repo = "PowerDNS-Admin";
     tag = "v${version}";
-    hash = "sha256-q9mt8wjSNFb452Xsg+qhNOWa03KJkYVGAeCWVSzZCyk=";
+    hash = "sha256-VhUz3Uw2MKN7rJgCrFd5nSN8FVTHM6LHCc01scMNjbc=";
   };
 
+  inherit (yarn-berry_4-fetcher) fetchYarnBerryDeps yarnBerryConfigHook;
+
+  yarnLock = runCommand "yarn-v9.lock" { } ''
+    sed -e 's/^  version: 8$/  version: 9/' ${src}/yarn.lock > $out
+  '';
+
   python = python3;
 
   pythonDeps = with python.pkgs; [
@@ -69,36 +75,50 @@ let
     standard-imghdr
   ];
 
-  all_patches = [
-    ./0001-Fix-flask-2.3-issue.patch
-  ];
-
   assets = stdenv.mkDerivation {
     pname = "${pname}-assets";
     inherit version src;
 
-    offlineCache = fetchYarnDeps {
-      yarnLock = "${src}/yarn.lock";
-      hash = "sha256-rXIts+dgOuZQGyiSke1NIG7b4lFlR/Gfu3J6T3wP3aY=";
+    offlineCache = fetchYarnBerryDeps {
+      inherit yarnLock;
+      hash = "sha256-VVew6/rjc0Uz6xM2komL9Sceym3vFrGnAqrdLtGxQVI=";
     };
 
+    postPatch = ''
+      cp ${yarnLock} yarn.lock
+      # flask-assets needs a real node_modules tree
+      printf 'nodeLinker: node-modules\n' >> .yarnrc.yml
+    '';
+
     nativeBuildInputs = [
-      yarnConfigHook
+      yarnBerryConfigHook
     ]
     ++ pythonDeps;
-    patches = all_patches ++ [
+
+    patches = [
       ./0002-Remove-cssrewrite-filter.patch
     ];
     buildPhase = ''
+      runHook preBuild
+
+      if [ -d node_modules ] && [ ! -d powerdnsadmin/static/node_modules ]; then
+        mv node_modules powerdnsadmin/static/node_modules
+      fi
+
       SESSION_TYPE=filesystem FLASK_APP=./powerdnsadmin/__init__.py flask assets build
+
+      runHook postBuild
     '';
     installPhase = ''
+      runHook preInstall
+
       # https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/54b257768f600c5548a1c7e50eac49c40df49f92/docker/Dockerfile#L43
       mkdir $out
       cp -r powerdnsadmin/static/{generated,assets,img} $out
       find powerdnsadmin/static/node_modules -name webfonts -exec cp -r {} $out \; -printf "Copying %P\n"
       find powerdnsadmin/static/node_modules -name fonts -exec cp -r {} $out \; -printf "Copying %P\n"
-      find powerdnsadmin/static/node_modules/icheck/skins/square -name '*.png' -exec cp {} $out/generated \;
+
+      runHook postInstall
     '';
   };
 
@@ -128,15 +148,6 @@ stdenv.mkDerivation {
     exec python -m gunicorn.app.wsgiapp "powerdnsadmin:create_app()" "$@"
   '';
 
-  patches = all_patches ++ [
-    ./0003-Fix-flask-migrate-4.0-compatibility.patch
-    ./0004-Fix-flask-session-and-powerdns-admin-compatibility.patch
-    ./0005-Fix-app-context-and-register-modules.patch
-    ./0006-Fix-regex.patch
-    ./0007-Fix-oidc.patch
-    ./0008-Fix-profile-save-overwriting-password-with-empty-val.patch
-  ];
-
   postPatch = ''
     rm -r powerdnsadmin/static powerdnsadmin/assets.py
   '';
@@ -162,6 +173,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   passthru = {
     # PYTHONPATH of all dependencies used by the package
     pythonPath = python3.pkgs.makePythonPath pythonDeps;
diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 7b71f7d03b61..8bb9bc6ddadb 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.4.10";
+  version = "0.4.12";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tTr/Aob6jP1YL+n5vGkUkByew73WdP3mqLW5Lci1gNM=";
+    hash = "sha256-FOGycyjldrn0VN22fIv/NUmVxZ2S0GOl70/PzcdazDU=";
   };
 
-  cargoHash = "sha256-He55uH7t7NI5sYgowujqCMK5yjhC2F+8ZLxKG6TLjYY=";
+  cargoHash = "sha256-tGfi5kdw1LQciOeUwceAql7In+ggyatsRC7T0+by9e8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/pr/prism-model-checker/package.nix b/pkgs/by-name/pr/prism-model-checker/package.nix
index 5ab420365150..9ab277bc11ce 100644
--- a/pkgs/by-name/pr/prism-model-checker/package.nix
+++ b/pkgs/by-name/pr/prism-model-checker/package.nix
@@ -92,7 +92,7 @@ stdenv'.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Probabalistic Symbolic Model Checker";
+    description = "Probabilistic Symbolic Model Checker";
 
     homepage = "https://www.prismmodelchecker.org";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/pr/prometheus-chrony-exporter/package.nix b/pkgs/by-name/pr/prometheus-chrony-exporter/package.nix
index 50a441b39410..d31115f774a1 100644
--- a/pkgs/by-name/pr/prometheus-chrony-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-chrony-exporter/package.nix
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  # do not use real BuildDate, but fixed imagenary (commit date) for binary reproducibility
+  # do not use real BuildDate, but fixed imaginary (commit date) for binary reproducibility
   preBuild = ''
     ldflags+=" -X github.com/prometheus/common/version.BuildDate=$(cat BUILD_COMMIT_DATE)"
   '';
diff --git a/pkgs/by-name/pr/prometheus-tibber-exporter/package.nix b/pkgs/by-name/pr/prometheus-tibber-exporter/package.nix
index 174abda37cd2..5ea742174153 100644
--- a/pkgs/by-name/pr/prometheus-tibber-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-tibber-exporter/package.nix
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  # do not use real BuildDate, but fixed imagenary (commit date) for binary reproducibility
+  # do not use real BuildDate, but fixed imaginary (commit date) for binary reproducibility
   preBuild = ''
     ldflags+=" -X github.com/prometheus/common/version.BuildDate=$(cat BUILD_COMMIT_DATE)"
   '';
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index fa05c2bcd53c..c2c63ef04b18 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -47,7 +47,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   /*
     We use the created releases, and not the tags, for the update script as nix-update loads releases.atom
-    that contains both. Sometimes upstream pushes the tags but the Github releases don't get created due to
+    that contains both. Sometimes upstream pushes the tags but the GitHub releases don't get created due to
     CI errors. Last time this happened was on 8-33, where a tag was created but no releases were created.
     As of 2024-03-13, there have been no announcements indicating that the CI has been fixed, and thus
     we avoid nix-update-script and use our own update script instead.
diff --git a/pkgs/by-name/pr/prr/package.nix b/pkgs/by-name/pr/prr/package.nix
index 57c09cb8c8db..e55d685fefde 100644
--- a/pkgs/by-name/pr/prr/package.nix
+++ b/pkgs/by-name/pr/prr/package.nix
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   checkInputs = [ cacert ];
 
   meta = {
-    description = "Tool that brings mailing list style code reviews to Github PRs";
+    description = "Tool that brings mailing list style code reviews to GitHub PRs";
     homepage = "https://github.com/danobi/prr";
     license = lib.licenses.gpl2Only;
     mainProgram = "prr";
diff --git a/pkgs/by-name/pr/prst/package.nix b/pkgs/by-name/pr/prst/package.nix
index 261abf5b0d91..e9f2af023937 100644
--- a/pkgs/by-name/pr/prst/package.nix
+++ b/pkgs/by-name/pr/prst/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
       This utility is best used for systematic searches of large prime numbers, either by public distributed projects or by private individuals.
       It can handle numbers of many popular forms like Proth numbers, Thabit numbers, generalized Fermat numbers, factorials, primorials and arbitrary numbers.
       Mersenne numbers are better handled by GIMPS.
-      It is assumed that input candiates are previously sieved by a sieving utility best suited for the specific form of numbers.
+      It is assumed that input candidates are previously sieved by a sieving utility best suited for the specific form of numbers.
     '';
     homepage = "https://github.com/patnashev/prst";
     maintainers = with lib.maintainers; [ dstremur ];
diff --git a/pkgs/by-name/pr/prusa-slicer/package.nix b/pkgs/by-name/pr/prusa-slicer/package.nix
index 1936fdf88a8a..be48844582c6 100644
--- a/pkgs/by-name/pr/prusa-slicer/package.nix
+++ b/pkgs/by-name/pr/prusa-slicer/package.nix
@@ -209,7 +209,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     "-DSLIC3R_FHS=1"
     "-DSLIC3R_GTK=3"
     "-DCMAKE_CXX_FLAGS=-DBOOST_LOG_DYN_LINK"
-    # there is many different min versions set accross different
+    # there is many different min versions set across different
     # Find*.cmake files, substituting them all is not viable
     "-DCMAKE_POLICY_VERSION_MINIMUM=3.10"
   ];
diff --git a/pkgs/by-name/pu/pulumi-bin/update.sh b/pkgs/by-name/pu/pulumi-bin/update.sh
index 4da7ff0fc381..376fa63458e4 100755
--- a/pkgs/by-name/pu/pulumi-bin/update.sh
+++ b/pkgs/by-name/pu/pulumi-bin/update.sh
@@ -18,7 +18,7 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 VERSION=$1
 
 # An array of plugin names. The respective repository inside Pulumi's
-# Github organization is called pulumi-$name by convention.
+# GitHub organization is called pulumi-$name by convention.
 
 declare -a pulumi_repos
 pulumi_repos=(
diff --git a/pkgs/applications/networking/remote/putty/default.nix b/pkgs/by-name/pu/putty/package.nix
similarity index 79%
rename from pkgs/applications/networking/remote/putty/default.nix
rename to pkgs/by-name/pu/putty/package.nix
index cf810c6e8af4..b16fe3a027ab 100644
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/by-name/pu/putty/package.nix
@@ -6,23 +6,31 @@
   perl,
   pkg-config,
   gtk3,
+  gtk3-x11,
   ncurses,
   copyDesktopItems,
   makeDesktopItem,
 }:
 
-stdenv.mkDerivation rec {
+let
+  gtk3' = if stdenv.hostPlatform.isDarwin then gtk3-x11 else gtk3;
+in
+
+stdenv.mkDerivation (finalAttrs: {
   version = "0.84";
   pname = "putty";
 
   src = fetchurl {
     urls = [
-      "https://the.earth.li/~sgtatham/putty/${version}/${pname}-${version}.tar.gz"
-      "ftp://ftp.wayne.edu/putty/putty-website-mirror/${version}/${pname}-${version}.tar.gz"
+      "https://the.earth.li/~sgtatham/putty/${finalAttrs.version}/putty-${finalAttrs.version}.tar.gz"
+      "ftp://ftp.wayne.edu/putty/putty-website-mirror/${finalAttrs.version}/putty-${finalAttrs.version}.tar.gz"
     ];
     hash = "sha256-BgV4Yq4Zjx29IZ0MdJMIDVn2BhlLtQVsVJ40KqAbaf4=";
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   nativeBuildInputs = [
     cmake
     perl
@@ -30,7 +38,7 @@ stdenv.mkDerivation rec {
     copyDesktopItems
   ];
   buildInputs = lib.optionals stdenv.hostPlatform.isUnix [
-    gtk3
+    gtk3'
     ncurses
   ];
   enableParallelBuilding = true;
@@ -74,4 +82,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
-}
+})
diff --git a/pkgs/by-name/pv/pv-migrate/package.nix b/pkgs/by-name/pv/pv-migrate/package.nix
index 9204b0b3d24f..0ca9ee5ce612 100644
--- a/pkgs/by-name/pv/pv-migrate/package.nix
+++ b/pkgs/by-name/pv/pv-migrate/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "pv-migrate";
-  version = "3.5.0";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "utkuozdemir";
     repo = "pv-migrate";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-2gHWpBPl4Dpt+1WZh2W+p+t1/HWnVtjTaRC1U8dw1ZI=";
+    sha256 = "sha256-ZAQ4jXSV8foQNptg3DOwUjkXQQR89yt/E6PjDIvmy6g=";
   };
 
   subPackages = [ "cmd/pv-migrate" ];
 
-  vendorHash = "sha256-mQIJBmsop3CqtsUv1FbnExfByxiHmS+crcVaTif5JiI=";
+  vendorHash = "sha256-lGUVjCBSrgFPk00usKF8sUnjLyiuSRFmbyBbmDWB/14=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/qg/qgo/package.nix b/pkgs/by-name/qg/qgo/package.nix
index 6f3b6384f660..0d4548016979 100644
--- a/pkgs/by-name/qg/qgo/package.nix
+++ b/pkgs/by-name/qg/qgo/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
       IGS-compatible servers (including some special tweaks for WING and LGS,
       also NNGS was reported to work) and locally against gnugo (or other
       GTP-compliant engines). It also has rudimentary support for editing SGF
-      files and parital support for CyberORO/WBaduk, Tygem, Tom, and eWeiqi
+      files and partial support for CyberORO/WBaduk, Tygem, Tom, and eWeiqi
       (developers of these backends are currently inactive, everybody is welcome
       to take them over).
 
diff --git a/pkgs/by-name/qi/qidi-studio/package.nix b/pkgs/by-name/qi/qidi-studio/package.nix
index 72dc254448be..161fb9cbeeb7 100644
--- a/pkgs/by-name/qi/qidi-studio/package.nix
+++ b/pkgs/by-name/qi/qidi-studio/package.nix
@@ -41,7 +41,7 @@ appimageTools.wrapType2 {
     description = "Slicer for QIDI 3D Printers, based on Bambu Studio";
     longDescription = ''
       QIDI Studio is a professional 3D printer slicing software, which is perfectly compatible with all printers and 3D printing filaments of QIDI Technology.
-      Multi-platform support, simple inerface, easy to use, complate functions, easy to learn 3D printing.
+      Multi-platform support, simple interface, easy to use, complete functions, easy to learn 3D printing.
     '';
     homepage = "https://github.com/QIDITECH/QIDIStudio";
     license = lib.licenses.agpl3Plus;
diff --git a/pkgs/by-name/ql/qlementine-icons/package.nix b/pkgs/by-name/ql/qlementine-icons/package.nix
index a90ff3ce6b61..d1c7aa7a46c4 100644
--- a/pkgs/by-name/ql/qlementine-icons/package.nix
+++ b/pkgs/by-name/ql/qlementine-icons/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
       standard, and vastly expands it, in 16×16 pixels.
 
       The icons are in SVG format, so can be scaled to any size without
-      loosing any quality. However, they've been designed to be used in
+      losing any quality. However, they've been designed to be used in
       `16×16` pixels, to be pixel-perfect.
     '';
     homepage = "https://github.com/oclero/qlementine-icons";
diff --git a/pkgs/by-name/qu/quarto/package.nix b/pkgs/by-name/qu/quarto/package.nix
index f7d808b2cd30..155f9eddf12a 100644
--- a/pkgs/by-name/qu/quarto/package.nix
+++ b/pkgs/by-name/qu/quarto/package.nix
@@ -106,7 +106,6 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/quarto-dev/quarto-cli/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
-      minijackson
       mrtarantoga
     ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/qu/quick-lint-js/package.nix b/pkgs/by-name/qu/quick-lint-js/package.nix
index 8dbf16b71b7e..18bfca68d5d5 100644
--- a/pkgs/by-name/qu/quick-lint-js/package.nix
+++ b/pkgs/by-name/qu/quick-lint-js/package.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    description = "Find bugs in Javascript programs";
+    description = "Find bugs in JavaScript programs";
     mainProgram = "quick-lint-js";
     homepage = "https://quick-lint-js.com";
     downloadPage = "https://github.com/quick-lint/quick-lint-js";
diff --git a/pkgs/by-name/qu/quickjs/package.nix b/pkgs/by-name/qu/quickjs/package.nix
index 6bad55b66e82..e4ca123bd186 100644
--- a/pkgs/by-name/qu/quickjs/package.nix
+++ b/pkgs/by-name/qu/quickjs/package.nix
@@ -91,9 +91,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://bellard.org/quickjs/";
-    description = "Small and embeddable Javascript engine";
+    description = "Small and embeddable JavaScript engine";
     longDescription = ''
-      QuickJS is a small and embeddable Javascript engine. It supports the
+      QuickJS is a small and embeddable JavaScript engine. It supports the
       ES2023 specification including modules, asynchronous generators, proxies
       and BigInt.
 
@@ -109,11 +109,11 @@ stdenv.mkDerivation (finalAttrs: {
         generators and full Annex B support (legacy web compatibility).
       - Passes nearly 100% of the ECMAScript Test Suite tests when selecting
         the ES2023 features. A summary is available at Test262 Report.
-      - Can compile Javascript sources to executables with no external dependency.
+      - Can compile JavaScript sources to executables with no external dependency.
       - Garbage collection using reference counting (to reduce memory usage and
         have deterministic behavior) with cycle removal.
       - Command line interpreter with contextual colorization implemented in
-        Javascript.
+        JavaScript.
       - Small built-in standard library with C library wrappers.
 
     '';
diff --git a/pkgs/by-name/qu/quickshell/package.nix b/pkgs/by-name/qu/quickshell/package.nix
index 53be131726b2..fea0c6b08830 100644
--- a/pkgs/by-name/qu/quickshell/package.nix
+++ b/pkgs/by-name/qu/quickshell/package.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://quickshell.org";
-    description = "Flexbile QtQuick based desktop shell toolkit";
+    description = "Flexible QtQuick based desktop shell toolkit";
     license = lib.licenses.lgpl3Only;
     platforms = lib.platforms.linux;
     mainProgram = "quickshell";
diff --git a/pkgs/by-name/ra/rawtherapee/package.nix b/pkgs/by-name/ra/rawtherapee/package.nix
index 00508760d363..6c0ab412d0cd 100644
--- a/pkgs/by-name/ra/rawtherapee/package.nix
+++ b/pkgs/by-name/ra/rawtherapee/package.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "5.12";
 
   src = fetchurl {
-    # The developers ask not to use the tarball from Github releases, see
+    # The developers ask not to use the tarball from GitHub releases, see
     # https://www.rawtherapee.com/downloads/5.12/#news-relevant-to-package-maintainers
     url = "https://rawtherapee.com/shared/source/rawtherapee-${finalAttrs.version}.tar.xz";
     hash = "sha256-2abBBTfWSihbxGVnX+WaqpTOMiOCPfvs8K4slZkILVc=";
diff --git a/pkgs/by-name/rc/rcshist/package.nix b/pkgs/by-name/rc/rcshist/package.nix
index f22aaaf77187..098a9308178a 100644
--- a/pkgs/by-name/rc/rcshist/package.nix
+++ b/pkgs/by-name/rc/rcshist/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   };
 
   meta = {
-    description = "Utitity to display complete revision history of a set of RCS files";
+    description = "Utility to display complete revision history of a set of RCS files";
     homepage = "https://invisible-island.net/rcshist/rcshist.html";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.kaction ];
diff --git a/pkgs/by-name/re/readability-extractor/package.nix b/pkgs/by-name/re/readability-extractor/package.nix
index 94152e28e0a8..f50b53437924 100644
--- a/pkgs/by-name/re/readability-extractor/package.nix
+++ b/pkgs/by-name/re/readability-extractor/package.nix
@@ -21,7 +21,7 @@ buildNpmPackage rec {
 
   meta = {
     homepage = "https://github.com/ArchiveBox/readability-extractor";
-    description = "Javascript wrapper around Mozilla Readability for ArchiveBox to call as a oneshot CLI to extract article text";
+    description = "JavaScript wrapper around Mozilla Readability for ArchiveBox to call as a oneshot CLI to extract article text";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ viraptor ];
     mainProgram = "readability-extractor";
diff --git a/pkgs/by-name/re/reredirect/package.nix b/pkgs/by-name/re/reredirect/package.nix
index fa8d52b9c237..9cb204780971 100644
--- a/pkgs/by-name/re/reredirect/package.nix
+++ b/pkgs/by-name/re/reredirect/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Tool to dynamicly redirect outputs of a running process";
+    description = "Tool to dynamically redirect outputs of a running process";
     homepage = "https://github.com/jerome-pouiller/reredirect";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.tobim ];
diff --git a/pkgs/by-name/re/resnap/package.nix b/pkgs/by-name/re/resnap/package.nix
index 5b635a0a5878..87cb1de7bd99 100644
--- a/pkgs/by-name/re/resnap/package.nix
+++ b/pkgs/by-name/re/resnap/package.nix
@@ -45,7 +45,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Take screnshots of your reMarkable tablet over SSH";
+    description = "Take screenshots of your reMarkable tablet over SSH";
     homepage = "https://github.com/cloudsftp/reSnap";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ _404wolf ];
diff --git a/pkgs/by-name/ri/riemann-dash/package.nix b/pkgs/by-name/ri/riemann-dash/package.nix
index c6b260937bcf..9e12ed1e12ac 100644
--- a/pkgs/by-name/ri/riemann-dash/package.nix
+++ b/pkgs/by-name/ri/riemann-dash/package.nix
@@ -12,7 +12,7 @@ bundlerApp {
   passthru.updateScript = bundlerUpdateScript "riemann-dash";
 
   meta = {
-    description = "Javascript, websockets-powered dashboard for Riemann";
+    description = "JavaScript, websockets-powered dashboard for Riemann";
     homepage = "https://github.com/riemann/riemann-dash";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ri/river/package.nix b/pkgs/by-name/ri/river/package.nix
index 3eddd1e81b8a..921259684bab 100644
--- a/pkgs/by-name/ri/river/package.nix
+++ b/pkgs/by-name/ri/river/package.nix
@@ -27,7 +27,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "river";
-  version = "0.4.7";
+  version = "0.4.8";
   __structuredAttrs = true;
 
   outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "river";
     repo = "river";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uDu4jywRhhEMaYzgBeR7CYuVVoEa5aSJj7ydLJVgBtc=";
+    hash = "sha256-vqOGyd0sddjYZ47xPMFmfzDIg8mHfIBzAJQ2CcsMQ3Y=";
   };
 
   strictDeps = true;
@@ -115,7 +115,6 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     maintainers = with lib.maintainers; [
       GaetanLepage
-      adamcstephens
     ];
     mainProgram = "river";
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/rn/rnxcmp/test.nix b/pkgs/by-name/rn/rnxcmp/test.nix
index 2b492fe31cc2..ad1933f80940 100644
--- a/pkgs/by-name/rn/rnxcmp/test.nix
+++ b/pkgs/by-name/rn/rnxcmp/test.nix
@@ -1,7 +1,7 @@
-# Data flow for testing CRX2RNX and RNX2CRX (file type after each step in paranthesis):
+# Data flow for testing CRX2RNX and RNX2CRX (file type after each step in parenthesis):
 # Example file --(.crx.gz)--> unzip --(.crx)--> CRX2RNX --(.rnx)--> RNX2CRX --(.crx)--> compare two crx files
 
-# Data flow for testing CRZ2RNX and RNX2CRZ (file type after each step in paranthesis):
+# Data flow for testing CRZ2RNX and RNX2CRZ (file type after each step in parenthesis):
 # Example files --(.crx.gz)--> CRZ2RNX --(.rnx)--> RNX2CRZ --(.crx.gz)--> unzip --(.crx)--v
 #                         \--> unzip --(.crx)-------------------------------------------> compare crx files
 # The last unzip step is needed because the .crx files themselves contain
diff --git a/pkgs/by-name/ro/roslyn-ls/package.nix b/pkgs/by-name/ro/roslyn-ls/package.nix
index 9e51067b2b93..50e61fe797d3 100644
--- a/pkgs/by-name/ro/roslyn-ls/package.nix
+++ b/pkgs/by-name/ro/roslyn-ls/package.nix
@@ -73,7 +73,7 @@ buildDotnetModule (finalAttrs: {
   dotnetFlags = [
     "-p:TargetRid=${rid}"
     # we don't want to build the binary
-    # and useAppHost is not enough, need to explicilty set to false
+    # and useAppHost is not enough, need to explicitly set to false
     "-p:UseAppHost=false"
     # avoid platform-specific crossgen packages
     "-p:PublishReadyToRun=false"
diff --git a/pkgs/by-name/ru/rubiks/package.nix b/pkgs/by-name/ru/rubiks/package.nix
index 791ad3f494a4..bb4fb2823553 100644
--- a/pkgs/by-name/ru/rubiks/package.nix
+++ b/pkgs/by-name/ru/rubiks/package.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
     longDescription = ''
       There are several programs for working with Rubik's cubes, by three
       different people. Look inside the directories under /src to see
-      specific info and licensing. In summary the three contributers are:
+      specific info and licensing. In summary the three contributors are:
 
 
       Michael Reid (GPL) http://www.math.ucf.edu/~reid/Rubik/optimal_solver.html
diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index f767b271d601..11f49cc2dd5b 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -63,7 +63,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
-    # FIXME: Pass overrided `rust-analyzer` once `buildRustPackage` also implements #119942
+    # FIXME: Pass overridden `rust-analyzer` once `buildRustPackage` also implements #119942
     # FIXME: test script can't find rust std lib so hover doesn't return expected result
     # https://github.com/NixOS/nixpkgs/pull/354304
     # tests.neovim-lsp = callPackage ./test-neovim-lsp.nix { };
diff --git a/pkgs/by-name/s3/s3rs/package.nix b/pkgs/by-name/s3/s3rs/package.nix
index 04139d0692eb..afd9ed96100b 100644
--- a/pkgs/by-name/s3/s3rs/package.nix
+++ b/pkgs/by-name/s3/s3rs/package.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildInputs = [ openssl ];
 
   meta = {
-    description = "S3 cli client with multi configs with diffent provider";
+    description = "S3 cli client with multi configs with different provider";
     homepage = "https://github.com/yanganto/s3rs";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ yanganto ];
diff --git a/pkgs/by-name/sc/sc/package.nix b/pkgs/by-name/sc/sc/package.nix
index 4358fa4b2e25..2120105d38ae 100644
--- a/pkgs/by-name/sc/sc/package.nix
+++ b/pkgs/by-name/sc/sc/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     longDescription = ''
       This is a fork of the old sc-7.16 application with attention paid to
       reduced compiler warnings, bugfixes, and functionality improvements
-      (e.g. mouse suport, configurability via .scrc).
+      (e.g. mouse support, configurability via .scrc).
       See CHANGES-git or README.md for a full list of changes.
     '';
 
diff --git a/pkgs/by-name/sd/SDL2_gfx/package.nix b/pkgs/by-name/sd/SDL2_gfx/package.nix
index 814e10a603eb..ba1eebb4773f 100644
--- a/pkgs/by-name/sd/SDL2_gfx/package.nix
+++ b/pkgs/by-name/sd/SDL2_gfx/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       The current components of the SDL_gfx library are:
 
-      - Graphic Primitives (SDL_gfxPrimitves.h)
+      - Graphic Primitives (SDL_gfxPrimitives.h)
       - Rotozoomer (SDL_rotozoom.h)
       - Framerate control (SDL_framerate.h)
       - MMX image filters (SDL_imageFilter.h)
diff --git a/pkgs/by-name/sd/SDL_gfx/package.nix b/pkgs/by-name/sd/SDL_gfx/package.nix
index 85ff0a8d4fb3..1e9f3d0097c9 100644
--- a/pkgs/by-name/sd/SDL_gfx/package.nix
+++ b/pkgs/by-name/sd/SDL_gfx/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       The current components of the SDL_gfx library are:
 
-      - Graphic Primitives (SDL_gfxPrimitves.h)
+      - Graphic Primitives (SDL_gfxPrimitives.h)
       - Rotozoomer (SDL_rotozoom.h)
       - Framerate control (SDL_framerate.h)
       - MMX image filters (SDL_imageFilter.h)
diff --git a/pkgs/by-name/se/seashells/package.nix b/pkgs/by-name/se/seashells/package.nix
index 34bc89062070..5cdb8ead2361 100644
--- a/pkgs/by-name/se/seashells/package.nix
+++ b/pkgs/by-name/se/seashells/package.nix
@@ -24,7 +24,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     description = "Pipe command-line programs to seashells.io";
     mainProgram = "seashells";
     longDescription = ''
-      Official cient for seashells.io, which allows you to view
+      Official client for seashells.io, which allows you to view
       command-line output on the web, in real-time.
     '';
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/se/sequoia-sq/package.nix b/pkgs/by-name/se/sequoia-sq/package.nix
index 383f556a1ad6..025206edc06b 100644
--- a/pkgs/by-name/se/sequoia-sq/package.nix
+++ b/pkgs/by-name/se/sequoia-sq/package.nix
@@ -76,7 +76,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     changelog = "https://gitlab.com/sequoia-pgp/sequoia-sq/-/blob/v${finalAttrs.version}/NEWS";
     license = lib.licenses.lgpl2Plus;
     maintainers = with lib.maintainers; [
-      minijackson
       doronbehar
       dvn0
       anish
diff --git a/pkgs/by-name/se/servarr-ffmpeg/package.nix b/pkgs/by-name/se/servarr-ffmpeg/package.nix
index 023bfab478a0..bd64094bc982 100644
--- a/pkgs/by-name/se/servarr-ffmpeg/package.nix
+++ b/pkgs/by-name/se/servarr-ffmpeg/package.nix
@@ -90,7 +90,7 @@ in
 
       # https://github.com/Servarr/ffmpeg-build/blob/bc29af6f0bf84bf9253d4d462611b1dc31ee688e/common.sh#L15-L45
 
-      # Disable unused functionnalities
+      # Disable unused functionalities
       "--disable-encoders"
       "--disable-muxers"
       "--disable-protocols"
diff --git a/pkgs/by-name/si/sieve-connect/package.nix b/pkgs/by-name/si/sieve-connect/package.nix
index dde0d2719c53..6e9f76d02c45 100644
--- a/pkgs/by-name/si/sieve-connect/package.nix
+++ b/pkgs/by-name/si/sieve-connect/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Client for the MANAGESIEVE Protocol";
     longDescription = ''
       This is sieve-connect. A client for the ManageSieve protocol,
-      as specifed in RFC 5804. Historically, this was MANAGESIEVE as
+      as specified in RFC 5804. Historically, this was MANAGESIEVE as
       implemented by timsieved in Cyrus IMAP.
     '';
     homepage = "https://github.com/philpennock/sieve-connect";
diff --git a/pkgs/by-name/si/silverfort-client/package.nix b/pkgs/by-name/si/silverfort-client/package.nix
index dc1ab977ae36..2163ed3b4530 100644
--- a/pkgs/by-name/si/silverfort-client/package.nix
+++ b/pkgs/by-name/si/silverfort-client/package.nix
@@ -21,7 +21,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       Silverfort automatically. Please download ${name} manually and add it
       to the Nix store using `nix-prefetch-url file:///$PWD/${name}`.
       It is recommended to add this file to the garbage collector root
-      to prevent grabage collection.
+      to prevent garbage collection.
     '';
   };
 
diff --git a/pkgs/by-name/sn/snabb/package.nix b/pkgs/by-name/sn/snabb/package.nix
index 4287d431a54b..d42b8e1419e3 100644
--- a/pkgs/by-name/sn/snabb/package.nix
+++ b/pkgs/by-name/sn/snabb/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     longDescription = ''
       Snabb Switch is a LuaJIT-based toolkit for writing high-speed
       packet networking code (such as routing, switching, firewalling,
-      and so on). It includes both a scripting inteface for creating
+      and so on). It includes both a scripting interface for creating
       new applications and also some built-in applications that are
       ready to run.
       It is especially intended for ISPs and other network operators.
diff --git a/pkgs/by-name/sn/snowcat/package.nix b/pkgs/by-name/sn/snowcat/package.nix
index b5623079827f..45b6fb27ac43 100644
--- a/pkgs/by-name/sn/snowcat/package.nix
+++ b/pkgs/by-name/sn/snowcat/package.nix
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
       There are two main modes of operation for Snowcat. With no positional
       argument, Snowcat will assume it is running inside of a cluster enabled
       with Istio, and begin to enumerate the required data. Optionally, you can
-      point snowcat at a directory containing Kubernets YAML files.
+      point snowcat at a directory containing Kubernetes YAML files.
     '';
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ jk ];
diff --git a/pkgs/by-name/so/solarus-launcher/package.nix b/pkgs/by-name/so/solarus-launcher/package.nix
index 9c0ff6a64260..115dd82c0125 100644
--- a/pkgs/by-name/so/solarus-launcher/package.nix
+++ b/pkgs/by-name/so/solarus-launcher/package.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Launcher for the Zelda-like ARPG game engine, Solarus";
     longDescription = ''
       Solarus is a game engine for Zelda-like ARPG games written in lua.
-      Many full-fledged games have been writen for the engine.
+      Many full-fledged games have been written for the engine.
       Games can be created easily using the editor.
     '';
     homepage = "https://www.solarus-games.org";
diff --git a/pkgs/by-name/so/solarus-quest-editor/package.nix b/pkgs/by-name/so/solarus-quest-editor/package.nix
index 3100cf9aa6ea..2d9104670539 100644
--- a/pkgs/by-name/so/solarus-quest-editor/package.nix
+++ b/pkgs/by-name/so/solarus-quest-editor/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "solarus-editor";
     longDescription = ''
       Solarus is a game engine for Zelda-like ARPG games written in lua.
-      Many full-fledged games have been writen for the engine.
+      Many full-fledged games have been written for the engine.
       Games can be created easily using the editor.
     '';
     homepage = "https://www.solarus-games.org";
diff --git a/pkgs/by-name/so/solarus/package.nix b/pkgs/by-name/so/solarus/package.nix
index e5e3fa27af2f..bf0dac5a9855 100644
--- a/pkgs/by-name/so/solarus/package.nix
+++ b/pkgs/by-name/so/solarus/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "solarus";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitLab {
     owner = "solarus-games";
     repo = "solarus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Uq5KRgPzwga7inEVNZ1ObtgtUy+Ld6xzYTNVX6k2nks=";
+    hash = "sha256-V9h27KvBNBGA7mRUkhQn4om7VBTe8ZEgIOBr1aDt8Mo=";
   };
 
   outputs = [
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Zelda-like ARPG game engine";
     longDescription = ''
       Solarus is a game engine for Zelda-like ARPG games written in lua.
-      Many full-fledged games have been writen for the engine.
+      Many full-fledged games have been written for the engine.
     '';
     homepage = "https://www.solarus-games.org";
     mainProgram = "solarus-run";
diff --git a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
index bd8fedd91dc5..449afd7a93c2 100644
--- a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
+++ b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
@@ -18,7 +18,7 @@ buildNpmPackage {
       sha256 = "sha256-kJ//zXBW2IQ5V5dJfAm8iGxf9QILH0uloNYiwG3pTe4=";
     };
 
-    # Applies the follwing PR:
+    # Applies the following PR:
     # https://github.com/KNawm/speed-cloudflare-cli/pull/38
     patches = [
       # fix: handle non-array response from /locations and format
diff --git a/pkgs/by-name/sp/spideroak/package.nix b/pkgs/by-name/sp/spideroak/package.nix
index 0393d819c12e..21b58db85230 100644
--- a/pkgs/by-name/sp/spideroak/package.nix
+++ b/pkgs/by-name/sp/spideroak/package.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "https://spideroak.com";
-    description = "Secure online backup and sychronization";
+    description = "Secure online backup and synchronization";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/sp/spotify/update.sh b/pkgs/by-name/sp/spotify/update.sh
index a05690ceedc4..246cd90bf16c 100755
--- a/pkgs/by-name/sp/spotify/update.sh
+++ b/pkgs/by-name/sp/spotify/update.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 
 # executing this script without arguments will
-# - find the newest stable spotify version avaiable on snapcraft (https://snapcraft.io/spotify)
+# - find the newest stable spotify version available on snapcraft (https://snapcraft.io/spotify)
 # - read the current spotify version from the current nix expression
 # - update the nix expression if the versions differ
 # - try to build the updated version, exit if that fails
diff --git a/pkgs/by-name/sq/sqlcipher/package.nix b/pkgs/by-name/sq/sqlcipher/package.nix
index 03d4e398c231..e6c45dfcddd0 100644
--- a/pkgs/by-name/sq/sqlcipher/package.nix
+++ b/pkgs/by-name/sq/sqlcipher/package.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     TCLLIBDIR = "${placeholder "out"}/lib/tcl${lib.versions.majorMinor tcl.version}";
   };
 
-  # Rename files from sqlite3 to sqlcipher to prevent file collisons
+  # Rename files from sqlite3 to sqlcipher to prevent file collisions
   postInstall = ''
     mv $out/bin/{sqlite3,sqlcipher}
     mkdir $out/include/sqlcipher
diff --git a/pkgs/by-name/sr/srt-live-server/package.nix b/pkgs/by-name/sr/srt-live-server/package.nix
index 60db24f04eab..57d3e1689ca3 100644
--- a/pkgs/by-name/sr/srt-live-server/package.nix
+++ b/pkgs/by-name/sr/srt-live-server/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "Open-source low latency livestreaming server, based on Secure Reliable Tranport (SRT)";
+    description = "Open-source low latency livestreaming server, based on Secure Reliable Transport (SRT)";
     license = lib.licenses.mit;
     homepage = "https://github.com/Edward-Wu/srt-live-server";
     platforms = lib.platforms.linux;
diff --git a/pkgs/tools/security/sslscan/default.nix b/pkgs/by-name/ss/sslscan/package.nix
similarity index 72%
rename from pkgs/tools/security/sslscan/default.nix
rename to pkgs/by-name/ss/sslscan/package.nix
index cbd08a4441db..922d5c658483 100644
--- a/pkgs/tools/security/sslscan/default.nix
+++ b/pkgs/by-name/ss/sslscan/package.nix
@@ -5,18 +5,20 @@
   openssl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sslscan";
   version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "rbsec";
     repo = "sslscan";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-qrd0NJS7M3nKFpAOpd8raGLrMj6PixTqiuus25lv+PA=";
   };
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    (openssl.override { withZlib = true; })
+  ];
 
   makeFlags = [
     "PREFIX=$(out)"
@@ -27,10 +29,10 @@ stdenv.mkDerivation rec {
     description = "Tests SSL/TLS services and discover supported cipher suites";
     mainProgram = "sslscan";
     homepage = "https://github.com/rbsec/sslscan";
-    changelog = "https://github.com/rbsec/sslscan/blob/${version}/Changelog";
+    changelog = "https://github.com/rbsec/sslscan/blob/${finalAttrs.version}/Changelog";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       fpletz
     ];
   };
-}
+})
diff --git a/pkgs/by-name/st/stalwart_0_16/package.nix b/pkgs/by-name/st/stalwart_0_16/package.nix
index 4242fd78686d..0f6318cf1b9d 100644
--- a/pkgs/by-name/st/stalwart_0_16/package.nix
+++ b/pkgs/by-name/st/stalwart_0_16/package.nix
@@ -51,7 +51,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart" + (lib.optionalString stalwartEnterprise "-enterprise");
-  version = "0.16.15";
+  version = "0.16.16";
 
   __structuredAttrs = true;
 
@@ -59,10 +59,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "stalwartlabs";
     repo = "stalwart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DRo+1olglHsOpAk5D8hrTi+KVgFC5MxxqnrOphbvrUo=";
+    hash = "sha256-svf9J8oAMo427X6eiGdPiDMZ2/DdN7+FodGfhQL9hME=";
   };
 
-  cargoHash = "sha256-gjZR0qDdrS7TdWTeeRcKUY6pZFnLCMwnnpGAHWqiWLw=";
+  cargoHash = "sha256-QSEr2XPOh/iLARdjgCeClY2eN6UDF6E9Hoov4xprkag=";
 
   env = {
     # https://docs.rs/openssl/latest/openssl/#manual
diff --git a/pkgs/by-name/st/stardust-xr-gravity/package.nix b/pkgs/by-name/st/stardust-xr-gravity/package.nix
index 622fdd716393..9b99e839ca6c 100644
--- a/pkgs/by-name/st/stardust-xr-gravity/package.nix
+++ b/pkgs/by-name/st/stardust-xr-gravity/package.nix
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Utility to launch apps and stardust clients at an offet";
+    description = "Utility to launch apps and stardust clients at an offset";
     homepage = "https://stardustxr.org";
     license = lib.licenses.mit;
     mainProgram = "gravity";
diff --git a/pkgs/by-name/st/static-server/package.nix b/pkgs/by-name/st/static-server/package.nix
index 0b3f87f69e31..f0bcd23fa337 100644
--- a/pkgs/by-name/st/static-server/package.nix
+++ b/pkgs/by-name/st/static-server/package.nix
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
   vendorHash = "sha256-1p3dCLLo+MTPxf/Y3zjxTagUi+tq7nZSj4ZB/aakJGY=";
 
   patches = [
-    # patch out debug.ReadBuidlInfo since version information is not available with buildGoModule
+    # patch out debug.ReadBuildInfo since version information is not available with buildGoModule
     (replaceVars ./version.patch {
       inherit (finalAttrs) version;
     })
diff --git a/pkgs/by-name/st/stegsolve/package.nix b/pkgs/by-name/st/stegsolve/package.nix
index 0124cefd0dc6..f3951c718eb3 100644
--- a/pkgs/by-name/st/stegsolve/package.nix
+++ b/pkgs/by-name/st/stegsolve/package.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "Steganographic image analyzer, solver and data extractor for challanges";
+    description = "Steganographic image analyzer, solver and data extractor for challenges";
     homepage = "https://www.wechall.net/forum/show/thread/527/Stegsolve_1.3/";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/st/stirling-pdf/deps.json b/pkgs/by-name/st/stirling-pdf/deps.json
index 148482db4c2e..e5dc77980395 100644
--- a/pkgs/by-name/st/stirling-pdf/deps.json
+++ b/pkgs/by-name/st/stirling-pdf/deps.json
@@ -854,35 +854,35 @@
    "module": "sha256-yEQahybbGk+dTzngaOu0LfalnWR+MqnGHBW1OQ7VklI=",
    "pom": "sha256-CPvpfh4ugVoUyvFv9ayHCFEb713ec51gwHE5UYdtomM="
   },
-  "com/stirling#jpdfium-natives-darwin-arm64/1.0.2": {
-   "jar": "sha256-Jy3uCtUMP9v7CnP0Ax223rRCMG5uxUHpl4JcOR+c4WY=",
-   "module": "sha256-x1gci7X676q26K4oKG1P/1THjPVo8ofwT/c2Zxb5OkY=",
-   "pom": "sha256-4BlPDsF6qNpIsPt1sGe3PDoDXeTNPIR/KJ2nZKVdtlQ="
+  "com/stirling#jpdfium-natives-darwin-arm64/1.0.4": {
+   "jar": "sha256-GP8LORIvh0q82cihKer3fYKmD0uBk4hCONfB+zwipLY=",
+   "module": "sha256-VOWBvq3xzyb/6jtJ+GUvaUl0uIup6erhQfuhfabFs34=",
+   "pom": "sha256-aC3bwLjzZoQtABhpK7zcZ7iJVyztOA2NjjHRC7OjF7Q="
   },
-  "com/stirling#jpdfium-natives-darwin-x64/1.0.2": {
-   "jar": "sha256-MOknHnAXXSuX9EicEI02bxeD0CZ7u5RD4uPfuMUa7JQ=",
-   "module": "sha256-ftSn7FE43X1Daf5S3JtKdV5Z284/wIVayo5dXlOVH0g=",
-   "pom": "sha256-Niue51BiUHVNrKTOWoYlX5JvR2KVkSrZK09LlfkDrv4="
+  "com/stirling#jpdfium-natives-darwin-x64/1.0.4": {
+   "jar": "sha256-0fvs/AmgOOrp4plMvxiMoh704aTQIk2nE0SxM/IV8+k=",
+   "module": "sha256-sJvmpLzTuXOfU1pdiL2EKCWA2RQ1FxEH2Nj1SYM6VGw=",
+   "pom": "sha256-s+tVZQ2TRMtaHLNK2fFY8o+xHbWNhOBW+R0oLwDRL1c="
   },
-  "com/stirling#jpdfium-natives-linux-arm64/1.0.2": {
-   "jar": "sha256-PyV9SSpu26fjnBVSjWPk7ZdeqNd+w84to80fyB6RJJQ=",
-   "module": "sha256-PehWG6orSRJ/x/TMaTH7E0nSclIQFc5apD6Tzg1rtPk=",
-   "pom": "sha256-vkeoUt2Ol7DbFPuRqA3bfv3RHhmefEQctCfnBGu0PiM="
+  "com/stirling#jpdfium-natives-linux-arm64/1.0.4": {
+   "jar": "sha256-gD/T/vKIIHPldxUZ+Q038Z/qJxmloSQBjb9tsVrXtSU=",
+   "module": "sha256-VMzWnMRzQyulqQa+WrT1mOqgM/bjE3aGrhLdvtmsUsU=",
+   "pom": "sha256-KG4b/zMv4EkQkJ8Lqhfs8A2YXORJHFElIrTpBLRZNoc="
   },
-  "com/stirling#jpdfium-natives-linux-x64/1.0.2": {
-   "jar": "sha256-SL8w09JO+B07MMq0/I9zNf11YcoiyIHOzVw+bkOa2fY=",
-   "module": "sha256-8mm3odjyo8gozfNk8YaFBGP17Wggr1QfY89zoIa6REE=",
-   "pom": "sha256-0YRWllBTpznT+9RfdlyseRMezCs3JxtEEWHkNMCSTLg="
+  "com/stirling#jpdfium-natives-linux-x64/1.0.4": {
+   "jar": "sha256-u0tnfzEDISd2SmScZhV4Bn/Ucxb5Pm//65kVJHMDtf0=",
+   "module": "sha256-ad5CtEBwXHBGQWZntVz8JhMuSv2yKj4SPHqRAV5NS+g=",
+   "pom": "sha256-kn/kj5Rb2p2o/dn8IiOMXbIMh9emYopuGceU8X2qbL4="
   },
-  "com/stirling#jpdfium-natives-windows-x64/1.0.2": {
-   "jar": "sha256-x+zlqBIhD+qUBFbYNQIYiSsDgKLYZFoObz8h5QaYbv8=",
-   "module": "sha256-B8lrv5noknHeZGIO2spu4fDzJ+KD7MpQSGuz5jW/BEo=",
-   "pom": "sha256-h5aXa6biCbWGtWe+Z7sbOBVU8fjfDshdBusdpvPoiOw="
+  "com/stirling#jpdfium-natives-windows-x64/1.0.4": {
+   "jar": "sha256-R1KlxhnNXsQ3jaS89XlEKvH9Eaob6HHSRiwt7nZYYYg=",
+   "module": "sha256-GK1CPKIIGydZUPtMM/5d8HmbfbANC/TYlLG9M3YF1Z0=",
+   "pom": "sha256-d+vYh31gpx840YXxi/YglZlZ9k6e3QfSkIYI7V//5L8="
   },
-  "com/stirling#jpdfium/1.0.2": {
-   "jar": "sha256-m5vQo+K1whZs+3LV8etFnT047pTIayWhCB98lZ636+Y=",
-   "module": "sha256-iLo6iB9ancv1mXJFZ1oNBMRwZrx5vDEcmCGFm+Ti07U=",
-   "pom": "sha256-d6xFgvn13+/ancvKfseKA+cDSckKlHXYmI6bNNbv0KU="
+  "com/stirling#jpdfium/1.0.4": {
+   "jar": "sha256-Jh+davgVoFtvYrwXy+j9I84gLu+eP8G/P9PxE0Zc4eM=",
+   "module": "sha256-IDofIvoyWKJZJT3ZKjCAUba+ExE5Gm+FJh6If93qUoA=",
+   "pom": "sha256-SBDAt8EqzZjPETiHDbNaNy6idJmNdtvi5Q+kXhNg8/M="
   },
   "com/sun/activation#all/1.2.0": {
    "pom": "sha256-HYUY46x1MqEE5Pe+d97zfJguUwcjxr2z1ncIzOKwwsQ="
@@ -1586,6 +1586,9 @@
   "org/apache#apache/37": {
    "pom": "sha256-Uk7EeHr/c69rOp+voVTH8YgbZIKZtmP9v8rdoShvI1M="
   },
+  "org/apache#apache/39": {
+   "pom": "sha256-cXUu1MJDWh2Dhf4KTTMPOdBO/sifDRul0VmNOfc5ekQ="
+  },
   "org/apache/activemq#activemq-bom/6.1.8": {
    "pom": "sha256-qUF6jlh2GhfWVwzZClBokbUfd03TKZ7IC4Uxr/TlMHw="
   },
@@ -1776,9 +1779,9 @@
   "org/apache/logging/log4j#log4j/2.25.4": {
    "pom": "sha256-+K6JBKKONPoEw103QGGdroNjJAG6HjE7r9fM9aMADew="
   },
-  "org/apache/pdfbox#fontbox/3.0.7": {
-   "jar": "sha256-gUnZiXq1BPej83l9VSzYkl71gUm03j+0cOtG10fmj4Y=",
-   "pom": "sha256-o/xYnFZLQbybtLty0XPM5fjCM10uZtY0SJtqiwS/63o="
+  "org/apache/pdfbox#fontbox/3.0.8": {
+   "jar": "sha256-oZFcJOPtvg7OyTiW379tQUJ4ELZjrel71Oi66G7D/as=",
+   "pom": "sha256-F4Bd6Nrp6AUZZh3RwKYj1plZDyEs7M2x3JhScz8a6W8="
   },
   "org/apache/pdfbox#jbig2-imageio/3.0.3": {
    "jar": "sha256-yAEQ/aVxKFY9PQZWv/eNqL81qTTPVO36EOi3b8Y4mSk=",
@@ -1788,24 +1791,24 @@
    "jar": "sha256-KcspUWIvEKz2H9BlbE5vpVYhlKkJX3odJqpCbi9rF+s=",
    "pom": "sha256-KOp8SskuCYX3lqi8aJCnvviSZwetrf0eLIVsmwvho4s="
   },
-  "org/apache/pdfbox#pdfbox-io/3.0.7": {
-   "jar": "sha256-uag4KRl4BpCG77zR9iuBueSmAW5h3SxoEE7p9ML/mXs=",
-   "pom": "sha256-dCz9VwGuLNV6HS7mG+z+G9FUm6dwTH+xcZN/rQECFLY="
+  "org/apache/pdfbox#pdfbox-io/3.0.8": {
+   "jar": "sha256-NqDgQAEBC0x2SFeBdBK5YzmTCxl1XnKJWYBcwDUgYbI=",
+   "pom": "sha256-ytjpKa+CSTlHcTsDpE0Iwcm3g5qok17Gl5PaWbBrBPc="
   },
-  "org/apache/pdfbox#pdfbox-parent/3.0.7": {
-   "pom": "sha256-z60fFpQrxTkWiDsxQ/JRfseUc3Es1yNKWopxwQsPrnQ="
+  "org/apache/pdfbox#pdfbox-parent/3.0.8": {
+   "pom": "sha256-8DE3PwPA+S+05JIQZFzVPkDpV5IZZVNjzhlkT/d5KD4="
   },
-  "org/apache/pdfbox#pdfbox/3.0.7": {
-   "jar": "sha256-fO+nF2IjMJUbQ0Or8eXTa8yxH0uiRdeKqnMlHQj+xiM=",
-   "pom": "sha256-3nkpJ2LYVd1pqOVVyeDm3kD1OP+9l9AS0bs6TQRa0Ec="
+  "org/apache/pdfbox#pdfbox/3.0.8": {
+   "jar": "sha256-l2R8+95h68/Aa0z4ybD/yq7gczluzrSn9oNqm5EokDw=",
+   "pom": "sha256-Gs/OcY7ckA3/dbF6/UQnKwIqTw6RStvnZTHfVoYkA90="
   },
-  "org/apache/pdfbox#preflight/3.0.7": {
-   "jar": "sha256-ae3MeMB9ZSe6oAYCzn/X+WcoJHVV7xpNmp0LytBSVpM=",
-   "pom": "sha256-sXRZcjGLrEGdHbpf9RvTh5hUHe9/vlNzIN3B+Bhf9Jw="
+  "org/apache/pdfbox#preflight/3.0.8": {
+   "jar": "sha256-N1pdLJPKxIk0NU8UbfkQdOrsnAGBY0bl6VZUNUHofmk=",
+   "pom": "sha256-qGdPrcs8berlpCr4cidcsEdJOPqUYTBmto12iXl0Q0g="
   },
-  "org/apache/pdfbox#xmpbox/3.0.7": {
-   "jar": "sha256-pTB9h3ZBA+YZS7+4AKj3msutLfMtWdq8oiUqv5I8QBo=",
-   "pom": "sha256-fnE6xU8e5I9oIwDC6yft4ZEe9vVZRit38rkS6gPCm1E="
+  "org/apache/pdfbox#xmpbox/3.0.8": {
+   "jar": "sha256-8ETS4xbldxSgrfJyrYq/SoY7iXj9F9xbhtz6gTVGmxA=",
+   "pom": "sha256-KT0RLIe2aDxWAMHy0TmQYE/dtaRPf+AEMNB0ZJ+7d2g="
   },
   "org/apache/poi#poi-ooxml-lite/5.5.1": {
    "jar": "sha256-5uN63rbW7otA7Eka2VXZNNj5mCerBQ8QWxgoblmx2ec=",
@@ -1967,12 +1970,17 @@
    "pom": "sha256-WrvkytLCMJR0ZvsgmiJn48xqDTgKajGRWVnTqtm4F2w="
   },
   "org/bouncycastle#bcpkix-jdk18on/1.77": {
+   "jar": "sha256-Gsf+jv1bLzjNwWW+WgZ1c0/kSAjauScHIB8DpTXW8bg=",
    "pom": "sha256-j7CSbwLixLLcUuR+uwk/kvHTu28UnCpcyl4qZI0sSY0="
   },
   "org/bouncycastle#bcpkix-jdk18on/1.84": {
    "jar": "sha256-yH8W7Z5exhvJQVHp82RqxE5QzUSBIc6ENn+kt+x+wbs=",
    "pom": "sha256-wSge1er48+QFVX56UgXLbzzfdT+E3psagVx16965mSo="
   },
+  "org/bouncycastle#bcprov-jdk18on/1.77": {
+   "jar": "sha256-2ruYwk1yybn1hWM9HfnFzVjZrTc9DNaBNn5qYDpJXVg=",
+   "pom": "sha256-rROCz80DvN2L4TkTwC9E/UadCnalPPLK71vhgK3DayM="
+  },
   "org/bouncycastle#bcprov-jdk18on/1.84": {
    "jar": "sha256-ZNbFphIfzZJxUt0YLL7Tmv4P2mQalw2bzAycsYWLJzE=",
    "pom": "sha256-znq7SpG6XSpz/fF6PfR2LjYFoDksx5g+8vGuFs04TMM="
@@ -1981,6 +1989,7 @@
    "pom": "sha256-p2e8fzQtGTKJfso8i6zHAEygOAv6dSnyOpc0VJZcffw="
   },
   "org/bouncycastle#bcutil-jdk18on/1.77": {
+   "jar": "sha256-lHZzvLxajd4tL6aIpbdZjQym4qdKfqMM2T8E9rOtaPg=",
    "pom": "sha256-Fj36ZjL/uSinBcqDciNQys6knM1iPOc2RaXMOw+p5ug="
   },
   "org/bouncycastle#bcutil-jdk18on/1.84": {
diff --git a/pkgs/by-name/st/stirling-pdf/package.nix b/pkgs/by-name/st/stirling-pdf/package.nix
index a95f181e28af..829d6726ef7b 100644
--- a/pkgs/by-name/st/stirling-pdf/package.nix
+++ b/pkgs/by-name/st/stirling-pdf/package.nix
@@ -12,11 +12,8 @@
   makeBinaryWrapper,
   nodejs,
   npmHooks,
-  pax-utils,
   pkg-config,
-  unzip,
   wrapGAppsHook3,
-  zip,
 
   glib-networking,
   jdk25,
@@ -38,56 +35,18 @@ assert isDesktopVariant -> !buildWithFrontend;
 let
   gradle = gradle_8;
   jre = jdk25;
-  # jpdfium 1.0.2's bundled x86_64 libicudata.so.74 has an erroneous executable
-  # PT_GNU_STACK; the arm64 archive was checked and already has a non-executable stack.
-  # Fixed upstream for the next natives release; remove when Stirling-PDF updates jpdfium.
-  # https://github.com/Stirling-Tools/Stirling-PDF/issues/6869
-  # https://github.com/Stirling-Tools/JPDFium/pull/19
-  patchJpdfium = lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) ''
-    nativeJars=(
-      "$GRADLE_USER_HOME"/caches/modules-2/files-2.1/com.stirling/jpdfium-natives-linux-x64/*/*/jpdfium-natives-linux-x64-*.jar
-    )
-    if (( ''${#nativeJars[@]} != 1 )); then
-      echo "expected exactly one jpdfium native JAR, found ''${#nativeJars[@]}" >&2
-      exit 1
-    fi
-    nativeJar="''${nativeJars[0]}"
-
-    patchDir="$(mktemp -d)"
-    unzip -q "$nativeJar" natives/linux-x64/libicudata.so.74 -d "$patchDir"
-    scanelf -X -e "$patchDir/natives/linux-x64/libicudata.so.74"
-    touch --date=@315532800 "$patchDir/natives/linux-x64/libicudata.so.74"
-
-    chmod u+w "$nativeJar"
-    (cd "$patchDir" && zip -q -X "$nativeJar" natives/linux-x64/libicudata.so.74)
-
-    bootJars=( ./app/core/build/libs/stirling-pdf-*.jar )
-    if (( ''${#bootJars[@]} != 1 )); then
-      echo "expected exactly one Stirling-PDF JAR, found ''${#bootJars[@]}" >&2
-      exit 1
-    fi
-    bootJar="$(realpath "''${bootJars[0]}")"
-    nestedJar="BOOT-INF/lib/$(basename "$nativeJar")"
-    mkdir -p "$patchDir/$(dirname "$nestedJar")"
-    cp "$nativeJar" "$patchDir/$nestedJar"
-    touch --date=@315532800 "$patchDir/$nestedJar"
-
-    chmod u+w "$bootJar"
-    (cd "$patchDir" && zip -q -X -0 "$bootJar" "$nestedJar")
-    rm -rf "$patchDir"
-  '';
 in
 stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "stirling-pdf" + lib.optionalString isDesktopVariant "-desktop";
-  version = "2.14.2";
+  version = "2.14.3";
 
   src = fetchFromGitHub {
     owner = "Stirling-Tools";
     repo = "Stirling-PDF";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2u4d9K4OEuOw9qE4YgpGXDvVLExVGUKAeXYNCySqy1c=";
+    hash = "sha256-Jh7F3e7Zho3BlaBZD8xfXSCjwXyF5qQk4VSm8DIwIBY=";
   };
 
   patches = [
@@ -111,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src patches;
     postPatch = "cd ${finalAttrs.npmRoot}";
-    hash = "sha256-ujvSzang7n6DJZbNU/lDlG0x1265N5LJ6prkPbBYEic=";
+    hash = "sha256-3JYcOtX0pBMIgUtcK6LoejIhoSR2jpnQRzhePdCfJzI=";
   };
 
   cargoRoot = "frontend/editor/src-tauri";
@@ -152,9 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
     gradle
     jre # one of the tests also require that the `java` command is available on the command line
     makeBinaryWrapper
-    pax-utils
-    unzip
-    zip
   ]
   ++ lib.optionals (buildWithFrontend || isDesktopVariant) [
     nodejs
@@ -185,7 +141,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     # this simulates what the desktop:jlink:jar would do
     gradle bootJar
-    ${patchJpdfium}
     install -Dm644 ./app/core/build/libs/stirling-pdf-*.jar -t ./frontend/editor/src-tauri/libs
 
     # creates as minimal jre via jlink
@@ -195,8 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'MimeType=application/pdf;' 'MimeType=application/pdf;x-scheme-handler/stirlingpdf;'
   '';
 
-  postBuild = lib.optionalString (!isDesktopVariant) patchJpdfium;
-
   # we use the installPhase from cargo-tauri-hook when we're building the desktop variant
   installPhase = lib.optionalString (!isDesktopVariant) ''
     runHook preInstall
@@ -209,12 +162,17 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = lib.optionalString (isDesktopVariant && stdenv.hostPlatform.isDarwin) ''
-    makeWrapper "$out/Applications/Stirling-PDF.app/Contents/MacOS/stirling-pdf" "$out/bin/stirling-pdf"
+    makeWrapper "$out/Applications/Stirling PDF.app/Contents/MacOS/Stirling-PDF" "$out/bin/stirling-pdf"
   '';
 
   passthru = {
+    tests = {
+      inherit (nixosTests) stirling-pdf-desktop; # TODO: fix or remove
+    };
+  }
+  // lib.optionalAttrs (!isDesktopVariant) {
+    # this being optional makes the auto-update PRs always put stirling-pdf in the title
     updateScript = nix-update-script { };
-    tests = { inherit (nixosTests) stirling-pdf-desktop; };
   };
 
   meta = {
diff --git a/pkgs/by-name/su/sub-store-frontend/package.nix b/pkgs/by-name/su/sub-store-frontend/package.nix
index ad40acfecffb..33bfd78c7561 100644
--- a/pkgs/by-name/su/sub-store-frontend/package.nix
+++ b/pkgs/by-name/su/sub-store-frontend/package.nix
@@ -14,13 +14,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "sub-store-frontend";
-  version = "2.29.8";
+  version = "2.29.10";
 
   src = fetchFromGitHub {
     owner = "sub-store-org";
     repo = "Sub-Store-Front-End";
     tag = finalAttrs.version;
-    hash = "sha256-23ksXVgWamf3lNBHbfacXgWc+TYVqfLlh2cY9VmZq1c=";
+    hash = "sha256-jQXIwdt9+yndTFBCrs6bZ7dCZ2fmjti0xQAgAGZbC1M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/su/subjs/package.nix b/pkgs/by-name/su/subjs/package.nix
index a004e59dd59a..cbfdbbab3bbe 100644
--- a/pkgs/by-name/su/subjs/package.nix
+++ b/pkgs/by-name/su/subjs/package.nix
@@ -24,11 +24,11 @@ buildGoModule (finalAttrs: {
   ];
 
   meta = {
-    description = "Fetcher for Javascript files";
+    description = "Fetcher for JavaScript files";
     mainProgram = "subjs";
     longDescription = ''
-      subjs fetches Javascript files from a list of URLs or subdomains.
-      Analyzing Javascript files can help you find undocumented endpoints,
+      subjs fetches JavaScript files from a list of URLs or subdomains.
+      Analyzing JavaScript files can help you find undocumented endpoints,
       secrets and more.
     '';
     homepage = "https://github.com/lc/subjs";
diff --git a/pkgs/by-name/su/suitesparse-graphblas/package.nix b/pkgs/by-name/su/suitesparse-graphblas/package.nix
index fd4b4bdbda72..8062ad0bfc8c 100644
--- a/pkgs/by-name/su/suitesparse-graphblas/package.nix
+++ b/pkgs/by-name/su/suitesparse-graphblas/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "suitesparse-graphblas";
-  version = "10.3.2";
+  version = "10.4.0";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "DrTimothyAldenDavis";
     repo = "GraphBLAS";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-M9MSJfrZP8VY/CPGbQkjyLFVXg25xy+8mIiJsHOdhBI=";
+    hash = "sha256-3OJAH9vwWS379gcVLHh1lpgm1eRb1NplIcNscHWgMHU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sw/swaylock-plugin/package.nix b/pkgs/by-name/sw/swaylock-plugin/package.nix
index 367ba39197f5..5dfa969f69f3 100644
--- a/pkgs/by-name/sw/swaylock-plugin/package.nix
+++ b/pkgs/by-name/sw/swaylock-plugin/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Screen locker for Wayland, forked from swaylock";
     longDescription = ''
-      swaylock-pulgins is a fork of swaylock, a screen locking utility for Wayland compositors.
+      swaylock-plugin is a fork of swaylock, a screen locking utility for Wayland compositors.
       On top of the usual swaylock features, it allow you to use a
       subcommand to generate the lockscreen background.
 
diff --git a/pkgs/by-name/sw/swingsane/package.nix b/pkgs/by-name/sw/swingsane/package.nix
index eeb3143ef9c5..eeb2a0203a64 100644
--- a/pkgs/by-name/sw/swingsane/package.nix
+++ b/pkgs/by-name/sw/swingsane/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
       using both local and remote Scanner Access Now Easy (SANE) servers.
       The most powerful feature is its ability to query back-ends for scanner
       specific options which can be set by the user as a scanner profile.
-      It also has support for authentication, mutlicast DNS discovery,
+      It also has support for authentication, multicast DNS discovery,
       simultaneous scan jobs, image transformation jobs (deskew, binarize,
       crop, etc), PDF and PNG output.
     '';
diff --git a/pkgs/by-name/sx/sxhkd/package.nix b/pkgs/by-name/sx/sxhkd/package.nix
index d7e9cf4abff0..19fbcaebbcab 100644
--- a/pkgs/by-name/sx/sxhkd/package.nix
+++ b/pkgs/by-name/sx/sxhkd/package.nix
@@ -8,6 +8,7 @@
   libxcb-util,
   libxcb-keysyms,
   libxcb-wm,
+  versionCheckHook,
   nixosTests,
 }:
 
@@ -18,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "baskerville";
     repo = "sxhkd";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-kbjbTzYL2dz/RpG+SgBYy+XS3W9PBEWkg6ocqAFG3VQ=";
   };
 
@@ -40,9 +41,13 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   makeFlags = [ "PREFIX=$(out)" ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   passthru.tests = {
     inherit (nixosTests) startx;
   };
diff --git a/pkgs/by-name/sy/sysfsutils/package.nix b/pkgs/by-name/sy/sysfsutils/package.nix
index c2cf265c8248..e37de911027f 100644
--- a/pkgs/by-name/sy/sysfsutils/package.nix
+++ b/pkgs/by-name/sy/sysfsutils/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://linux-diag.sourceforge.net/Sysfsutils.html";
     longDescription = ''
-      These are a set of utilites built upon sysfs, a new virtual
+      These are a set of utilities built upon sysfs, a new virtual
       filesystem in Linux kernel versions 2.5+ that exposes a system's
       device tree.
     '';
diff --git a/pkgs/tools/misc/system-config-printer/detect_serverbindir.patch b/pkgs/by-name/sy/system-config-printer/detect_serverbindir.patch
similarity index 100%
rename from pkgs/tools/misc/system-config-printer/detect_serverbindir.patch
rename to pkgs/by-name/sy/system-config-printer/detect_serverbindir.patch
diff --git a/pkgs/tools/misc/system-config-printer/gettext-0.25.patch b/pkgs/by-name/sy/system-config-printer/gettext-0.25.patch
similarity index 100%
rename from pkgs/tools/misc/system-config-printer/gettext-0.25.patch
rename to pkgs/by-name/sy/system-config-printer/gettext-0.25.patch
diff --git a/pkgs/tools/misc/system-config-printer/default.nix b/pkgs/by-name/sy/system-config-printer/package.nix
similarity index 88%
rename from pkgs/tools/misc/system-config-printer/default.nix
rename to pkgs/by-name/sy/system-config-printer/package.nix
index ef000562d406..529ee7f68aaf 100644
--- a/pkgs/tools/misc/system-config-printer/default.nix
+++ b/pkgs/by-name/sy/system-config-printer/package.nix
@@ -9,7 +9,7 @@
   wrapGAppsHook3,
   docbook_xml_dtd_412,
   docbook_xsl,
-  libxml2,
+  libxml2Python,
   desktop-file-utils,
   libusb1,
   cups,
@@ -30,17 +30,24 @@
   fetchpatch,
 }:
 
-stdenv.mkDerivation rec {
+let
+  libxml2 = libxml2Python;
+in
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "system-config-printer";
   version = "1.5.18";
 
   src = fetchFromGitHub {
     owner = "openPrinting";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-l3HEnYycP56vZWREWkAyHmcFgtu09dy4Ds65u7eqNZk=";
+    repo = "system-config-printer";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-l3HEnYycP56vZWREWkAyHmcFgtu09dy4Ds65u7eqNZk=";
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   prePatch = ''
     # for automake
     touch README ChangeLog
@@ -53,7 +60,7 @@ stdenv.mkDerivation rec {
     # fix typeerror, remove on next release
     (fetchpatch {
       url = "https://github.com/OpenPrinting/system-config-printer/commit/399b3334d6519639cfe7f1c0457e2475b8ee5230.patch";
-      sha256 = "sha256-JCdGmZk2vRn3X1BDxOJaY3Aw8dr0ODVzi0oY20ZWfRs=";
+      hash = "sha256-JCdGmZk2vRn3X1BDxOJaY3Aw8dr0ODVzi0oY20ZWfRs=";
       excludes = [ "NEWS" ];
     })
 
@@ -145,4 +152,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2Plus;
   };
-}
+})
diff --git a/pkgs/tools/misc/system-config-printer/pep517.patch b/pkgs/by-name/sy/system-config-printer/pep517.patch
similarity index 100%
rename from pkgs/tools/misc/system-config-printer/pep517.patch
rename to pkgs/by-name/sy/system-config-printer/pep517.patch
diff --git a/pkgs/by-name/te/technitium-dns-server-library/package.nix b/pkgs/by-name/te/technitium-dns-server-library/package.nix
index 4ca8153c47b0..68c5826b831e 100644
--- a/pkgs/by-name/te/technitium-dns-server-library/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server-library/package.nix
@@ -29,7 +29,7 @@ buildDotnetModule (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md";
-    description = "Library for Authorative and Recursive DNS server for Privacy and Security";
+    description = "Library for Authoritative and Recursive DNS server for Privacy and Security";
     homepage = "https://github.com/TechnitiumSoftware/DnsServer";
     license = lib.licenses.gpl3Only;
     mainProgram = "technitium-dns-server-library";
diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix
index 0f2600aff3ac..45752d60153b 100644
--- a/pkgs/by-name/te/technitium-dns-server/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server/package.nix
@@ -49,7 +49,7 @@ buildDotnetModule (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md";
-    description = "Authorative and Recursive DNS server for Privacy and Security";
+    description = "Authoritative and Recursive DNS server for Privacy and Security";
     homepage = "https://github.com/TechnitiumSoftware/DnsServer";
     license = lib.licenses.gpl3Only;
     mainProgram = "technitium-dns-server";
diff --git a/pkgs/by-name/te/teensy-udev-rules/package.nix b/pkgs/by-name/te/teensy-udev-rules/package.nix
index 78a7d415246b..edb8b4235568 100644
--- a/pkgs/by-name/te/teensy-udev-rules/package.nix
+++ b/pkgs/by-name/te/teensy-udev-rules/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     description = "udev rules for the Teensy microcontrollers";
     longDescription = ''
       udev rules that give non-root users permission to communicate with the
-      Teensy family of microcontrolers.
+      Teensy family of microcontrollers.
 
       ModemManager (part of NetworkManager) can interfere with USB Serial
       devices, which includes the Teensy.  See comments in the .rules file (or
diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix
index ad9aad2305e5..737613de9e42 100644
--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -30,7 +30,7 @@ buildGoModule (finalAttrs: {
     "-X=github.com/influxdata/telegraf/internal.Commit=${finalAttrs.src.rev}"
     "-X=github.com/influxdata/telegraf/internal.Version=${finalAttrs.version}"
   ]
-  # Binary is too large for the default GOT PLT displacments on 32-bit ARM;
+  # Binary is too large for the default GOT PLT displacements on 32-bit ARM;
   # need to use larger encoding otherwise linking fails with:
   # BFD (GNU Binutils) 2.46 assertion fail /build/binutils-with-gold-2.46/bfd/elf32-arm.c:9783
   ++ lib.optionals stdenv.hostPlatform.isAarch32 [
diff --git a/pkgs/by-name/te/terminal-parrot/package.nix b/pkgs/by-name/te/terminal-parrot/package.nix
index 2ffb46b10135..474beec19cb7 100644
--- a/pkgs/by-name/te/terminal-parrot/package.nix
+++ b/pkgs/by-name/te/terminal-parrot/package.nix
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
   doCheck = false;
 
   meta = {
-    description = "Shows colorful, animated party parrot in your terminial";
+    description = "Shows colorful, animated party parrot in your terminal";
     homepage = "https://github.com/jmhobbs/terminal-parrot";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.heel ];
diff --git a/pkgs/by-name/ti/tidal/update.sh b/pkgs/by-name/ti/tidal/update.sh
index 7810ec9c5faa..09b2e993e445 100755
--- a/pkgs/by-name/ti/tidal/update.sh
+++ b/pkgs/by-name/ti/tidal/update.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 # executing this script without arguments will
-# - find the newest stable spotify version avaiable on snapcraft (https://snapcraft.io/spotify)
+# - find the newest stable spotify version available on snapcraft (https://snapcraft.io/spotify)
 # - read the current spotify version from the current nix expression
 # - update the nix expression if the versions differ
 # - try to build the updated version, exit if that fails
diff --git a/pkgs/by-name/ti/tinyemu/package.nix b/pkgs/by-name/ti/tinyemu/package.nix
index bfef099f21ea..cf83d9b8fbce 100644
--- a/pkgs/by-name/ti/tinyemu/package.nix
+++ b/pkgs/by-name/ti/tinyemu/package.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
       Main features:
 
       - RISC-V system emulator supporting the RV128IMAFDQC base ISA (user level
-        ISA version 2.2, priviledged architecture version 1.10) including:
+        ISA version 2.2, privileged architecture version 1.10) including:
         - 32/64/128 bit integer registers
         - 32/64/128 bit floating point instructions (using the SoftFP Library)
         - Compressed instructions
@@ -61,8 +61,8 @@ stdenv.mkDerivation (finalAttrs: {
       - Graphical display with SDL
       - JSON configuration file
       - Remote HTTP block device and filesystem
-      - Small code, easy to modify, few external dependancies
-      - Javascript version running Linux and Windows 2000.
+      - Small code, easy to modify, few external dependencies
+      - JavaScript version running Linux and Windows 2000.
     '';
     license = with lib.licenses; [
       mit
diff --git a/pkgs/by-name/to/todoist-electron/package.nix b/pkgs/by-name/to/todoist-electron/package.nix
index f0fd3a508b8a..25c2993add87 100644
--- a/pkgs/by-name/to/todoist-electron/package.nix
+++ b/pkgs/by-name/to/todoist-electron/package.nix
@@ -34,7 +34,7 @@ appimageTools.wrapAppImage {
 
   extraPkgs = pkgs: [ pkgs.hidapi ];
 
-  # Add desktop convencience stuff
+  # Add desktop convenience stuff
   extraInstallCommands = ''
     install -D --mode 0644 ${appimageContents}/todoist.desktop -t $out/share/applications
     install -D --mode 0644 ${appimageContents}/todoist.png -t $out/share/icons/hicolor/512x512/apps
diff --git a/pkgs/by-name/tp/tpm2-pkcs11/package.nix b/pkgs/by-name/tp/tpm2-pkcs11/package.nix
index f0ccd27b4c54..a6fdcc247e35 100644
--- a/pkgs/by-name/tp/tpm2-pkcs11/package.nix
+++ b/pkgs/by-name/tp/tpm2-pkcs11/package.nix
@@ -46,13 +46,13 @@ let
 in
 chosenStdenv.mkDerivation (finalAttrs: {
   pname = "tpm2-pkcs11";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "tpm2-software";
     repo = "tpm2-pkcs11";
     tag = finalAttrs.version;
-    hash = "sha256-89lChdkheSEC0JKMKNXN11BqjeJgt1Hdk+QxjLPY72M=";
+    hash = "sha256-zO52OcSSlkWjrj5Wgftu8bxU3vHS8Lkli6sAiIt1tAc=";
   };
 
   # Disable Java‐based tests because of missing dependencies
diff --git a/pkgs/by-name/tr/tr-patcher/package.nix b/pkgs/by-name/tr/tr-patcher/package.nix
index 8304dacfe9ab..4a93f33eef5d 100644
--- a/pkgs/by-name/tr/tr-patcher/package.nix
+++ b/pkgs/by-name/tr/tr-patcher/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    description = "Allow to update dependancies of the Tamriel-Data mod for morrowind";
+    description = "Allow to update dependencies of the Tamriel-Data mod for morrowind";
     mainProgram = "tr-patcher";
     homepage = "https://gitlab.com/bmwinger/tr-patcher";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
diff --git a/pkgs/by-name/tr/trayer/package.nix b/pkgs/by-name/tr/trayer/package.nix
index 7110e480abb6..74ee6da93b97 100644
--- a/pkgs/by-name/tr/trayer/package.nix
+++ b/pkgs/by-name/tr/trayer/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   '';
 
   patches = [
-    # Adding missing arg in function decleration
+    # Adding missing arg in function declaration
     (fetchpatch {
       name = "fix_function_dec.patch";
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/x11-misc/trayer-srg/files/trayer-srg-1.1.8-fix-define.patch?id=94ae89d1b044c24138d5c8903df68e9654a5462f";
diff --git a/pkgs/by-name/ud/udiskie/package.nix b/pkgs/by-name/ud/udiskie/package.nix
index 053f5332b9ad..357422c54606 100644
--- a/pkgs/by-name/ud/udiskie/package.nix
+++ b/pkgs/by-name/ud/udiskie/package.nix
@@ -96,7 +96,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     changelog = "https://github.com/coldfix/udiskie/blob/${finalAttrs.src.tag}/CHANGES.rst";
     description = "Removable disk automounter for udisks";
     longDescription = ''
-      udiskie is a udisks2 front-end that allows to manage removeable media such
+      udiskie is a udisks2 front-end that allows to manage removable media such
       as CDs or flash drives from userspace.
 
       Its features include:
diff --git a/pkgs/by-name/ud/udunits/package.nix b/pkgs/by-name/ud/udunits/package.nix
index d87e75af72dc..c3287104f71a 100644
--- a/pkgs/by-name/ud/udunits/package.nix
+++ b/pkgs/by-name/ud/udunits/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "https://www.unidata.ucar.edu/software/udunits/";
-    description = "C-based package for the programatic handling of units of physical quantities";
+    description = "C-based package for the programmatic handling of units of physical quantities";
     longDescription = ''
       The UDUNITS package supports units of physical quantities. Its C library
       provides for arithmetic manipulation of units and for conversion of
diff --git a/pkgs/by-name/ug/ugarit/package.nix b/pkgs/by-name/ug/ugarit/package.nix
index 12504c80de8e..40f8278f5c64 100644
--- a/pkgs/by-name/ug/ugarit/package.nix
+++ b/pkgs/by-name/ug/ugarit/package.nix
@@ -40,7 +40,7 @@ chickenPackages_4.eggDerivation rec {
 
   meta = {
     homepage = "https://www.kitten-technologies.co.uk/project/ugarit/";
-    description = "Backup/archival system based around content-addressible storage";
+    description = "Backup/archival system based around content-addressable storage";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/ul/ultrastardx/package.nix b/pkgs/by-name/ul/ultrastardx/package.nix
index 41386a463d70..044b5dfce63c 100644
--- a/pkgs/by-name/ul/ultrastardx/package.nix
+++ b/pkgs/by-name/ul/ultrastardx/package.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
       export NIX_LDFLAGS="$NIX_LDFLAGS ${items}"
     '';
 
-  # dlopened libgcc requires the rpath not to be shrinked
+  # dlopened libgcc requires the rpath not to be shrunk
   dontPatchELF = true;
 
   meta = {
diff --git a/pkgs/by-name/va/vali/package.nix b/pkgs/by-name/va/vali/package.nix
new file mode 100644
index 000000000000..ce87c97fc22e
--- /dev/null
+++ b/pkgs/by-name/va/vali/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  meson,
+  pkg-config,
+  aml,
+  json_c,
+  ninja,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vali";
+  version = "0.1.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "emersion";
+    repo = "vali";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-u7tJi3qHT2HEMa+E9RwcvRyrLuBA5o14ID8Kl3xkzHc=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+  ];
+  propagatedBuildInputs = [
+    json_c
+    aml
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "A C library and code generator for Varlink";
+    mainProgram = "vali";
+    homepage = "https://gitlab.freedesktop.org/emersion/vali";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.macaquinyho ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/vc/vcv-rack/package.nix b/pkgs/by-name/vc/vcv-rack/package.nix
index 3d0b35ea1b16..cdfd95a002b4 100644
--- a/pkgs/by-name/vc/vcv-rack/package.nix
+++ b/pkgs/by-name/vc/vcv-rack/package.nix
@@ -164,7 +164,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    # N.B.: Loading modules may fail due to symbols used by the moodules
+    # N.B.: Loading modules may fail due to symbols used by the modules
     # not being found, to address this issue the libraries providing the
     # symbols are re-exported when building on Darwin using -Wl,-reexport-l.
     ./rack-minimize-vendoring.patch
diff --git a/pkgs/by-name/ve/vector/package.nix b/pkgs/by-name/ve/vector/package.nix
index 454079c9b6a7..c159dcdc372f 100644
--- a/pkgs/by-name/ve/vector/package.nix
+++ b/pkgs/by-name/ve/vector/package.nix
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=sources::journald::tests::parses_string_sequences"
     "--skip=sources::journald::tests::reads_journal"
 
-    # No multicast access avaiable in sandbox
+    # No multicast access available in sandbox
     "--skip=sources::socket::test::multicast_and_unicast_udp_message"
     "--skip=sources::socket::test::multicast_udp_message"
     "--skip=sources::socket::test::multiple_multicast_addresses_udp_message"
diff --git a/pkgs/by-name/vi/viewnior/package.nix b/pkgs/by-name/vi/viewnior/package.nix
index ab06f10d4cfb..b99445e9c3b4 100644
--- a/pkgs/by-name/vi/viewnior/package.nix
+++ b/pkgs/by-name/vi/viewnior/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Fast and simple image viewer";
     longDescription = ''
-      Viewnior is insipred by big projects like Eye of Gnome, because of it's
+      Viewnior is inspired by big projects like Eye of Gnome, because of it's
       usability and richness,and by GPicView, because of it's lightweight design and
       minimal interface. So here comes Viewnior - small and light, with no compromise
       with the quality of it's functions. The program is made with better integration
diff --git a/pkgs/by-name/vy/vym/package.nix b/pkgs/by-name/vy/vym/package.nix
index 0ef8ae7ac292..4d442e8d56be 100644
--- a/pkgs/by-name/vy/vym/package.nix
+++ b/pkgs/by-name/vy/vym/package.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
       get an overview over complex contexts, to sort your ideas etc.
 
       Maps can be drawn by hand on paper or a flip chart and help to structure
-      your thoughs. While a tree like structure like shown on this page can be
+      your thoughts. While a tree like structure like shown on this page can be
       drawn by hand or any drawing software vym offers much more features to
       work with such maps.
     '';
diff --git a/pkgs/by-name/wa/wabt/package.nix b/pkgs/by-name/wa/wabt/package.nix
index 14e8ca664108..eb85ba6a35a0 100644
--- a/pkgs/by-name/wa/wabt/package.nix
+++ b/pkgs/by-name/wa/wabt/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
          binary format
        * wasm2wat: the inverse of wat2wasm, translate from the binary format
          back to the text format (also known as a .wat)
-       * wasm-objdump: print information about a wasm binary. Similiar to
+       * wasm-objdump: print information about a wasm binary. Similar to
          objdump.
        * wasm-interp: decode and run a WebAssembly binary file using a
          stack-based interpreter
diff --git a/pkgs/by-name/wa/wails3/package.nix b/pkgs/by-name/wa/wails3/package.nix
index 117a9605a245..d7f277e83f42 100644
--- a/pkgs/by-name/wa/wails3/package.nix
+++ b/pkgs/by-name/wa/wails3/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "wails3";
-  version = "3.0.0-alpha2.117";
+  version = "3.0.0-beta.3";
 
   __structuredAttrs = true;
 
@@ -17,13 +17,14 @@ buildGoModule (finalAttrs: {
     owner = "wailsapp";
     repo = "wails";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lGMY+xlhclf+1YWJHiZI8/VVOz8e5bCOAw4XUDzecNI=";
+    hash = "sha256-bQIiE2Ah0MnIJUVSHZy8nUK3E6WGjI/qrxMwM+zy+Ww=";
   };
 
-  proxyVendor = true;
-  vendorHash = "sha256-HXUC9f8B+NA74I6wPf+VdqVpcyE+QoRaVWbYLQqOi1o=";
+  sourceRoot = "source/v3";
 
-  subPackages = [ "v3/cmd/wails3" ];
+  vendorHash = "sha256-evBFmY8hyd0PqUbcoigZ/6h/j3k8pGJSqry45z6L/1k=";
+
+  subPackages = [ "cmd/wails3" ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ webkitgtk_6_0 ];
diff --git a/pkgs/by-name/wa/warp-terminal/update.sh b/pkgs/by-name/wa/warp-terminal/update.sh
index 2ea6f06b9e18..cb047233f636 100755
--- a/pkgs/by-name/wa/warp-terminal/update.sh
+++ b/pkgs/by-name/wa/warp-terminal/update.sh
@@ -53,10 +53,10 @@ get_version() {
     echo "$1" | grep -oP -m 1 '(?<=/v)[\d.\w]+(?=/)'
 }
 
-# nix-prefect-url seems to be uncompressing the archive then taking the hash
+# nix-prefetch-url seems to be uncompressing the archive then taking the hash
 # so just get the hash from fetchurl
 sri_get() {
-    local ouput sri
+    local output sri
     output=$(nix-build  --expr \
         "with import $nixpkgs {};
          fetchurl {
diff --git a/pkgs/by-name/wa/wasm-component-ld/package.nix b/pkgs/by-name/wa/wasm-component-ld/package.nix
index 9f9f5f9c89fc..44f2358062a0 100644
--- a/pkgs/by-name/wa/wasm-component-ld/package.nix
+++ b/pkgs/by-name/wa/wasm-component-ld/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-u1rV51QwPG7ZCB6d/P9+seO8yumxUJ9iQ3N58zijbGc=";
 
   # Tests require a rustc that can target wasm32-wasip1, including std. This is awkward for
-  # Nixpkgs to provide at the same time as providing a rustc that's targetting the actual target.
+  # Nixpkgs to provide at the same time as providing a rustc that's targeting the actual target.
   # TODO: work around by patching the test suite to invoke pkgsBuildTarget.rustc rather than just looking in PATH for any old rustc
   doCheck = false;
 
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index 7d7514eedcf1..9785ff80051c 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -96,8 +96,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
       ${manage} compress
     '';
 
-  # Upstream pins all dependencies, so their version constraints are mostly meanningless,
-  # except for a few packages maintained by themselfes.
+  # Upstream pins all dependencies, so their version constraints are mostly meaningless,
+  # except for a few packages maintained by themselves.
   # https://github.com/WeblateOrg/weblate/issues/20003#issuecomment-4691837274
   pythonRelaxDeps =
     let
diff --git a/pkgs/by-name/wi/widevine-cdm/aarch64-linux.nix b/pkgs/by-name/wi/widevine-cdm/aarch64-linux.nix
index f8ce102acdda..80aa1ae08ff6 100644
--- a/pkgs/by-name/wi/widevine-cdm/aarch64-linux.nix
+++ b/pkgs/by-name/wi/widevine-cdm/aarch64-linux.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp squashfs-root/WidevineCdm/LICENSE LICENSE.txt
   '';
 
-  # Accoring to widevine-installer: "Hack because Chromium hardcodes a check for this right now..."
+  # According to widevine-installer: "Hack because Chromium hardcodes a check for this right now..."
   postInstall = ''
     install -vD manifest.json "$out/share/google/chrome/WidevineCdm/manifest.json"
     install -vD LICENSE.txt "$out/share/google/chrome/WidevineCdm/License.txt"
diff --git a/pkgs/by-name/wo/wordlists/package.nix b/pkgs/by-name/wo/wordlists/package.nix
index b4fa7702c572..a6ab16ff1bca 100644
--- a/pkgs/by-name/wo/wordlists/package.nix
+++ b/pkgs/by-name/wo/wordlists/package.nix
@@ -58,7 +58,7 @@ symlinkJoin {
       [rockyou](https://en.wikipedia.org/wiki/RockYou#Data_breach)
       wordlist. If you want to modify the available wordlists you can override
       the `lists` attribute`. In your nixos configuration this would look
-      similiar to this:
+      similar to this:
 
       ```nix
       environment.systemPackages = [
diff --git a/pkgs/by-name/wp/wpgtk/package.nix b/pkgs/by-name/wp/wpgtk/package.nix
index c222439ab46d..28370985c435 100644
--- a/pkgs/by-name/wp/wpgtk/package.nix
+++ b/pkgs/by-name/wp/wpgtk/package.nix
@@ -57,7 +57,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     longDescription = ''
       In short, wpgtk is a colorscheme/wallpaper manager with a template system attached which lets you create templates from any textfile and will replace keywords on it on the fly, allowing for great styling and theming possibilities.
 
-      wpgtk uses pywal16 as its colorscheme generator, but builds upon it with a UI and other features, such as the abilty to mix and edit the colorschemes generated and save them with their respective wallpapers, having light and dark themes, hackable and fast GTK theme made specifically for wpgtk and custom keywords and values to replace in templates.
+      wpgtk uses pywal16 as its colorscheme generator, but builds upon it with a UI and other features, such as the ability to mix and edit the colorschemes generated and save them with their respective wallpapers, having light and dark themes, hackable and fast GTK theme made specifically for wpgtk and custom keywords and values to replace in templates.
 
       INFO: To work properly, this tool needs "programs.dconf.enable = true" on nixos or dconf installed. A reboot may be required after installing dconf.
     '';
diff --git a/pkgs/by-name/wr/wraith/package.nix b/pkgs/by-name/wr/wraith/package.nix
index e8311a65c9d3..272feea652f5 100644
--- a/pkgs/by-name/wr/wraith/package.nix
+++ b/pkgs/by-name/wr/wraith/package.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
       configure it. See https://github.com/wraith/wraith/wiki/GettingStarted .
 
       The binary will not run when moved onto non-NixOS systems; use patchelf
-      to fix its runtime dependenices.
+      to fix its runtime dependencies.
     '';
     homepage = "https://wraith.botpack.net/";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
index 9430f779366e..1d53e7fe7910 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/emersion/xdg-desktop-portal-wlr";
     description = "xdg-desktop-portal backend for wlroots";
-    maintainers = with lib.maintainers; [ minijackson ];
+    maintainers = [ ];
     platforms = lib.platforms.linux;
     license = lib.licenses.mit;
   };
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 6e47fa7230d9..14cf1f243c8f 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -175,7 +175,7 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "xen";
   version = "4.20.4";
 
-  # This attribute can be overriden to correct the file paths in
+  # This attribute can be overridden to correct the file paths in
   # `passthru` when building an unstable Xen.
   upstreamVersion = finalAttrs.version;
   # Useful for further identifying downstream Xen variants. (i.e. Qubes)
diff --git a/pkgs/by-name/xf/xfsdump/package.nix b/pkgs/by-name/xf/xfsdump/package.nix
index 8fc4c7ee7e32..2d7886e597a8 100644
--- a/pkgs/by-name/xf/xfsdump/package.nix
+++ b/pkgs/by-name/xf/xfsdump/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace "cp include/install-sh ." "cp -f include/install-sh ."
   '';
 
-  # Conifigure scripts don't check PATH, see xfstests derviation
+  # Configure scripts don't check PATH, see xfstests derivation
   preConfigure = ''
     export MAKE=$(type -P make)
     export MSGFMT=$(type -P msgfmt)
diff --git a/pkgs/by-name/xk/xkbutils/package.nix b/pkgs/by-name/xk/xkbutils/package.nix
index 4df9a4f93fcc..9af4c5b3cf61 100644
--- a/pkgs/by-name/xk/xkbutils/package.nix
+++ b/pkgs/by-name/xk/xkbutils/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Collection of small XKB utilities";
     longDescription = ''
-      xkbutils is a collection of small utilities using the X Keyboard extenison:
+      xkbutils is a collection of small utilities using the X Keyboard extension:
       - xkbbell: generate X Keyboard Extension bell events
       - xkbvleds: display X Keyboard Extension LED state in a window
       - xkbwatch: report state changes using the X Keyboard Extension
diff --git a/pkgs/by-name/xs/xsane/package.nix b/pkgs/by-name/xs/xsane/package.nix
index a34e6e3ad49e..1e99dea09c12 100644
--- a/pkgs/by-name/xs/xsane/package.nix
+++ b/pkgs/by-name/xs/xsane/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-oOg94nUsT9LLKnHocY0S5g02Y9a1UazzZAjpEI/s+yM=";
   };
 
-  # add all fedora patchs. fix gcc-14 build among other things
+  # add all fedora patches. fix gcc-14 build among other things
   # https://src.fedoraproject.org/rpms/xsane/tree/main
   patches =
     let
diff --git a/pkgs/by-name/xs/xscast/package.nix b/pkgs/by-name/xs/xscast/package.nix
index 7892be0c05d4..b1f717340efe 100644
--- a/pkgs/by-name/xs/xscast/package.nix
+++ b/pkgs/by-name/xs/xscast/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://github.com/tckmn/xscast";
     license = lib.licenses.mit;
-    description = "Screencasts of windows with list of keystrokes overlayed";
+    description = "Screencasts of windows with list of keystrokes overlaid";
     maintainers = [ ];
     mainProgram = "xscast";
   };
diff --git a/pkgs/by-name/xv/xvkbd/package.nix b/pkgs/by-name/xv/xvkbd/package.nix
index db7c7015e44e..8af0f9789c9e 100644
--- a/pkgs/by-name/xv/xvkbd/package.nix
+++ b/pkgs/by-name/xv/xvkbd/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Virtual keyboard for X window system";
     longDescription = ''
       xvkbd is a virtual (graphical) keyboard program for X Window System which provides
-      facility to enter characters onto other clients (softwares) by clicking on a
+      facility to enter characters onto other clients (software) by clicking on a
       keyboard displayed on the screen.
     '';
     homepage = "http://t-sato.in.coocan.jp/xvkbd";
diff --git a/pkgs/by-name/ye/yelp-tools/package.nix b/pkgs/by-name/ye/yelp-tools/package.nix
index 249598201920..887f5a0d05cc 100644
--- a/pkgs/by-name/ye/yelp-tools/package.nix
+++ b/pkgs/by-name/ye/yelp-tools/package.nix
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
     python3.pkgs.lxml
   ];
 
-  strictDeps = false; # TODO: Meson cannot find xmllint oherwise. Maybe add it to machine file?
+  strictDeps = false; # TODO: Meson cannot find xmllint otherwise. Maybe add it to machine file?
 
   doCheck = true;
 
diff --git a/pkgs/by-name/yp/ypbind-mt/package.nix b/pkgs/by-name/yp/ypbind-mt/package.nix
index c52bca61a30f..1ef8a0f2d24c 100644
--- a/pkgs/by-name/yp/ypbind-mt/package.nix
+++ b/pkgs/by-name/yp/ypbind-mt/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    description = "Multithreaded daemon maintaining the NIS binding informations";
+    description = "Multithreaded daemon maintaining the NIS binding information";
     homepage = "https://github.com/thkukuk/ypbind-mt";
     changelog = "https://github.com/thkukuk/ypbind-mt/blob/master/NEWS";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/ze/zenmap/package.nix b/pkgs/by-name/ze/zenmap/package.nix
index cdd955ed9427..7139d3930576 100644
--- a/pkgs/by-name/ze/zenmap/package.nix
+++ b/pkgs/by-name/ze/zenmap/package.nix
@@ -72,7 +72,7 @@ python3Packages.buildPythonApplication {
   '';
 
   meta = nmap.meta // {
-    description = "Offical nmap Security Scanner GUI";
+    description = "Official nmap Security Scanner GUI";
     homepage = "https://nmap.org/zenmap/";
     maintainers = with lib.maintainers; [
       dvaerum
diff --git a/pkgs/development/compilers/gcc/versions.nix b/pkgs/development/compilers/gcc/versions.nix
index 2c91269d5d48..362e24dd2029 100644
--- a/pkgs/development/compilers/gcc/versions.nix
+++ b/pkgs/development/compilers/gcc/versions.nix
@@ -1,6 +1,6 @@
 let
   majorMinorToVersionMap = {
-    "16" = "16.1.0";
+    "16" = "16.2.0";
     "15" = "15.3.0";
     "14" = "14.4.0";
     "13" = "13.4.0";
@@ -14,7 +14,7 @@ let
     {
       # 3 digits: releases (14.2.0)
       # 4 digits: snapshots (14.2.1.20250322)
-      "16.1.0" = "sha256-UO+02Uwzl6/zsNYaWr10i03THZ0/Kre+BbFx02pRD3k=";
+      "16.2.0" = "sha256-5nOOKVl/czJwcxqpBgDzf/3ARQed/CfsfoGSzIEIXD4=";
       "15.3.0" = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
       "14.4.0" = "sha256-dStvVnvqyDFZx3p2gLExa914Rzi/+anQcBEsCdqQ9tk=";
       "13.4.0" = "sha256-nEzm27BAVo/cVFWIrAPFy8lajb8MeqSQFwhDr7WcqPU=";
diff --git a/pkgs/development/compilers/llvm/18/libclc/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/18/libclc/gnu-install-dirs.patch
deleted file mode 100644
index 1e5108a27c38..000000000000
--- a/pkgs/development/compilers/llvm/18/libclc/gnu-install-dirs.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/libclc.pc.in
-+++ b/libclc.pc.in
-@@ -1,5 +1,5 @@
--includedir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@
--libexecdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_DATADIR@/clc
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
-+libexecdir=@CMAKE_INSTALL_FULL_DATADIR@/clc
- 
- Name: libclc
- Description: Library requirements of the OpenCL C programming language
diff --git a/pkgs/development/compilers/llvm/19/libclc/use-default-paths.patch b/pkgs/development/compilers/llvm/19/libclc/use-default-paths.patch
deleted file mode 100644
index 09079242eeac..000000000000
--- a/pkgs/development/compilers/llvm/19/libclc/use-default-paths.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From e8b910246d0c7c3d9fff994f71c6f8a48ec09a50 Mon Sep 17 00:00:00 2001
-From: Tristan Ross <tristan.ross@midstall.com>
-Date: Sat, 24 Aug 2024 19:56:24 -0700
-Subject: [PATCH] [libclc] use default paths with find_program when possible
-
----
- libclc/CMakeLists.txt | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 02bb859ae8590b..6bcd8ae52a5794 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -55,7 +55,7 @@ if( LIBCLC_STANDALONE_BUILD OR CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DI
-   # Import required tools
-   if( NOT EXISTS ${LIBCLC_CUSTOM_LLVM_TOOLS_BINARY_DIR} )
-     foreach( tool IN ITEMS clang llvm-as llvm-link opt )
--      find_program( LLVM_TOOL_${tool} ${tool} PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )
-+      find_program( LLVM_TOOL_${tool} ${tool} PATHS ${LLVM_TOOLS_BINARY_DIR} )
-       set( ${tool}_exe ${LLVM_TOOL_${tool}} )
-       set( ${tool}_target )
-     endforeach()
-@@ -104,7 +104,7 @@ foreach( tool IN ITEMS clang opt llvm-as llvm-link )
- endforeach()
- 
- # llvm-spirv is an optional dependency, used to build spirv-* targets.
--find_program( LLVM_SPIRV llvm-spirv PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )
-+find_program( LLVM_SPIRV llvm-spirv PATHS ${LLVM_TOOLS_BINARY_DIR} )
- 
- if( LLVM_SPIRV )
-   add_executable( libclc::llvm-spirv IMPORTED GLOBAL )
diff --git a/pkgs/development/compilers/llvm/20/libclc/use-default-paths.patch b/pkgs/development/compilers/llvm/20/libclc/use-default-paths.patch
deleted file mode 100644
index 364d503dbdc7..000000000000
--- a/pkgs/development/compilers/llvm/20/libclc/use-default-paths.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index b0e7aac6f8f3..af17e62588fe 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -57,7 +57,7 @@ if( LIBCLC_STANDALONE_BUILD OR CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DI
-   # Import required tools
-   if( NOT EXISTS ${LIBCLC_CUSTOM_LLVM_TOOLS_BINARY_DIR} )
-     foreach( tool IN ITEMS clang llvm-as llvm-link opt )
--      find_program( LLVM_TOOL_${tool} ${tool} PATHS ${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )
-+    find_program( LLVM_TOOL_${tool} ${tool} PATHS ${LLVM_TOOLS_BINARY_DIR} )
-       set( ${tool}_exe ${LLVM_TOOL_${tool}} )
-       set( ${tool}_target )
-     endforeach()
-@@ -93,7 +93,7 @@ if( EXISTS ${LIBCLC_CUSTOM_LLVM_TOOLS_BINARY_DIR} )
-   # and custom tools.
-   foreach( tool IN ITEMS clang llvm-as llvm-link opt )
-     find_program( LLVM_CUSTOM_TOOL_${tool} ${tool}
--      PATHS ${LIBCLC_CUSTOM_LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )
-+      PATHS ${LIBCLC_CUSTOM_LLVM_TOOLS_BINARY_DIR} )
-     set( ${tool}_exe ${LLVM_CUSTOM_TOOL_${tool}} )
-     set( ${tool}_target )
-   endforeach()
diff --git a/pkgs/development/compilers/llvm/21/libclc/gnu-install-dirs.patch b/pkgs/development/compilers/llvm/21/libclc/gnu-install-dirs.patch
deleted file mode 100644
index 637e33d981ef..000000000000
--- a/pkgs/development/compilers/llvm/21/libclc/gnu-install-dirs.patch
+++ /dev/null
@@ -1,8 +0,0 @@
---- a/libclc.pc.in
-+++ b/libclc.pc.in
-@@ -1,4 +1,4 @@
--libexecdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_DATADIR@/clc
-+libexecdir=@CMAKE_INSTALL_FULL_DATADIR@/clc
- 
- Name: libclc
- Description: Library requirements of the OpenCL C programming language
diff --git a/pkgs/development/compilers/llvm/common/default.nix b/pkgs/development/compilers/llvm/common/default.nix
index 4907eb786839..af2e39dced09 100644
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@@ -467,8 +467,6 @@ makeScopeWithSplicing' {
       openmp = callPackage ./openmp { };
 
       mlir = callPackage ./mlir { };
-
-      libclc = callPackage ./libclc { };
     }
     // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "19") {
       bolt = callPackage ./bolt { };
diff --git a/pkgs/development/compilers/llvm/common/libclc/default.nix b/pkgs/development/compilers/llvm/common/libclc/default.nix
deleted file mode 100644
index 69350a9d3834..000000000000
--- a/pkgs/development/compilers/llvm/common/libclc/default.nix
+++ /dev/null
@@ -1,111 +0,0 @@
-{
-  lib,
-  stdenv,
-  version,
-  runCommand,
-  monorepoSrc,
-  llvm,
-  buildPackages,
-  buildLlvmPackages,
-  ninja,
-  cmake,
-  python3,
-  release_version,
-  getVersionFile,
-}:
-let
-  spirv-llvm-translator = buildPackages.spirv-llvm-translator.override {
-    inherit (buildLlvmPackages) llvm;
-  };
-
-  # The build requires an unwrapped clang but wrapped clang++ thus we need to
-  # split the unwrapped clang out to prevent the build from finding the
-  # unwrapped clang++
-  clang-only = runCommand "clang-only" { } ''
-    mkdir -p "$out"/bin
-    ln -s "${lib.getExe' buildLlvmPackages.clang.cc "clang"}" "$out"/bin
-  '';
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libclc";
-  inherit version;
-
-  src = runCommand "libclc-src-${version}" { inherit (monorepoSrc) passthru; } ''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/libclc "$out"
-  '';
-
-  sourceRoot = "${finalAttrs.src.name}/libclc";
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  patches = [
-    (getVersionFile "libclc/gnu-install-dirs.patch")
-  ]
-  # LLVM 19 changes how host tools are looked up.
-  # Need to remove NO_DEFAULT_PATH and the PATHS arguments for find_program
-  # so CMake can actually find the tools in nativeBuildInputs.
-  # https://github.com/llvm/llvm-project/pull/105969
-  ++ lib.optional (lib.versionAtLeast release_version "19") (
-    getVersionFile "libclc/use-default-paths.patch"
-  );
-
-  # cmake expects all required binaries to be in the same place, so it will not be able to find clang without the patch
-  postPatch =
-    lib.optionalString (lib.versionOlder release_version "19") ''
-      substituteInPlace CMakeLists.txt \
-        --replace-fail 'find_program( LLVM_CLANG clang PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                  'find_program( LLVM_CLANG clang PATHS "${buildLlvmPackages.clang.cc}/bin" NO_DEFAULT_PATH )' \
-        --replace-fail 'find_program( LLVM_AS llvm-as PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                  'find_program( LLVM_AS llvm-as PATHS "${buildLlvmPackages.llvm}/bin" NO_DEFAULT_PATH )' \
-        --replace-fail 'find_program( LLVM_LINK llvm-link PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                  'find_program( LLVM_LINK llvm-link PATHS "${buildLlvmPackages.llvm}/bin" NO_DEFAULT_PATH )' \
-        --replace-fail 'find_program( LLVM_OPT opt PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                  'find_program( LLVM_OPT opt PATHS "${buildLlvmPackages.llvm}/bin" NO_DEFAULT_PATH )' \
-        --replace-fail 'find_program( LLVM_SPIRV llvm-spirv PATHS ''${LLVM_TOOLS_BINARY_DIR} NO_DEFAULT_PATH )' \
-                  'find_program( LLVM_SPIRV llvm-spirv PATHS "${spirv-llvm-translator}/bin" NO_DEFAULT_PATH )'
-    ''
-    + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) (
-      if (lib.versionOlder release_version "19") then
-        ''
-          substituteInPlace CMakeLists.txt \
-            --replace-fail 'COMMAND prepare_builtins' \
-                           'COMMAND ${buildLlvmPackages.libclc.dev}/bin/prepare_builtins'
-        ''
-      else
-        ''
-          substituteInPlace CMakeLists.txt \
-            --replace-fail 'set( prepare_builtins_exe prepare_builtins )' \
-                           'set( prepare_builtins_exe ${buildLlvmPackages.libclc.dev}/bin/prepare_builtins )'
-        ''
-    );
-
-  nativeBuildInputs = [
-    cmake
-    ninja
-    python3
-  ]
-  ++ lib.optionals (lib.versionAtLeast release_version "19") [
-    clang-only
-    llvm
-    spirv-llvm-translator
-  ];
-  buildInputs = [ llvm ];
-  strictDeps = true;
-
-  postInstall = lib.optionalString (lib.versionOlder finalAttrs.version "22.1") ''
-    install -Dt $dev/bin prepare_builtins
-  '';
-
-  meta = {
-    homepage = "http://libclc.llvm.org/";
-    description = "Implementation of the library requirements of the OpenCL C programming language";
-    mainProgram = "prepare_builtins";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-  };
-})
diff --git a/pkgs/development/compilers/llvm/common/patches.nix b/pkgs/development/compilers/llvm/common/patches.nix
index 2b6ba46d02cf..b700709c18ab 100644
--- a/pkgs/development/compilers/llvm/common/patches.nix
+++ b/pkgs/development/compilers/llvm/common/patches.nix
@@ -106,31 +106,6 @@
       path = ../18;
     }
   ];
-  "libclc/use-default-paths.patch" = [
-    {
-      after = "20";
-      path = ../20;
-    }
-    {
-      after = "19";
-      before = "20";
-      path = ../19;
-    }
-    {
-      after = "20";
-      path = ../20;
-    }
-  ];
-  "libclc/gnu-install-dirs.patch" = [
-    {
-      before = "21";
-      path = ../18;
-    }
-    {
-      after = "21";
-      path = ../21;
-    }
-  ];
   "mlir/mlir-add-include-cstdint.patch" = [
     {
       after = "18";
diff --git a/pkgs/development/cuda-modules/packages/cuda_cupti.nix b/pkgs/development/cuda-modules/packages/cuda_cupti.nix
index 4a1eb1d19dac..74b30990774f 100644
--- a/pkgs/development/cuda-modules/packages/cuda_cupti.nix
+++ b/pkgs/development/cuda-modules/packages/cuda_cupti.nix
@@ -3,7 +3,7 @@
   buildRedist,
   lib,
 }:
-buildRedist {
+buildRedist (finalAttrs: {
   redistName = "cuda";
   pname = "cuda_cupti";
 
@@ -14,7 +14,13 @@ buildRedist {
     "lib"
     "samples"
   ]
-  ++ lib.optionals (backendStdenv.hostNixSystem == "x86_64-linux") [ "static" ];
+  # NOTE: declaring an output with nothing to move into it is a build failure, and which redist
+  # systems ship static archives has changed over time: linux-x86_64 always has, linux-sbsa only
+  # since 12.6.37, and linux-aarch64 (Jetson) and linux-ppc64le never have.
+  ++ lib.optionals (
+    backendStdenv.hostRedistSystem == "linux-x86_64"
+    || (backendStdenv.hostRedistSystem == "linux-sbsa" && lib.versionAtLeast finalAttrs.version "12.6")
+  ) [ "static" ];
 
   allowFHSReferences = true;
 
@@ -27,4 +33,4 @@ buildRedist {
     homepage = "https://docs.nvidia.com/cupti";
     changelog = "https://docs.nvidia.com/cupti/release-notes/release-notes.html";
   };
-}
+})
diff --git a/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix b/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
index b6acd3a2eff5..0873967727c8 100644
--- a/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
+++ b/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
@@ -21,8 +21,11 @@ let
   inherit (lib.lists) optionals;
   inherit (lib.strings)
     cmakeBool
+    escapeShellArg
     optionalString
     ;
+  compileFeatures = "target_compile_features(cudnn_frontend INTERFACE cxx_std_17)";
+  linkCudart = "target_link_libraries(cudnn_frontend INTERFACE CUDA::cudart)";
 in
 backendStdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
@@ -50,6 +53,31 @@ backendStdenv.mkDerivation (finalAttrs: {
       --replace-fail \
         '#include "cudnn_frontend/thirdparty/nlohmann/json.hpp"' \
         '#include <nlohmann/json.hpp>'
+  ''
+  # Upstream resolves CUDAToolkit at configure time and freezes the result into the exported target
+  # as a bare absolute path, while its config file never forwards the dependency. Consumers then
+  # inherit a build-machine path -- under Nixpkgs, cuda_nvcc's include, a nativeBuildInput -- instead
+  # of resolving the toolkit themselves. Confine the path to the build and export the dependency, so
+  # consumers re-run find_package(CUDAToolkit) in their own environment. This matters beyond the
+  # closure: on CUDA 12 crt/ lives in cuda_nvcc, and cuda_runtime_api.h includes it, so consumers
+  # that do not otherwise pull in the toolkit would fail to compile.
+  # NOTE: the multi-line replacements are built as Nix strings with explicit newlines, so the
+  # formatter cannot reindent them into the substitution.
+  + ''
+    nixLog "patching $PWD/CMakeLists.txt to export CUDAToolkit as a dependency rather than a path"
+    substituteInPlace ./CMakeLists.txt \
+      --replace-fail \
+        '    ''${CUDAToolkit_INCLUDE_DIRS}' \
+        '    $<BUILD_INTERFACE:''${CUDAToolkit_INCLUDE_DIRS}>' \
+      --replace-fail \
+        ${escapeShellArg compileFeatures} \
+        ${escapeShellArg "${linkCudart}\n${compileFeatures}"}
+
+    nixLog "patching $PWD/cudnn_frontend-config.cmake.in to forward the CUDAToolkit dependency"
+    substituteInPlace ./cudnn_frontend-config.cmake.in \
+      --replace-fail \
+        '@PACKAGE_INIT@' \
+        ${escapeShellArg "@PACKAGE_INIT@\n\ninclude(CMakeFindDependencyMacro)\nfind_dependency(CUDAToolkit)"}
   '';
 
   # TODO: As a header-only library, we should make sure we have an `include` directory or similar which is not a
diff --git a/pkgs/development/cuda-modules/packages/cudnn.nix b/pkgs/development/cuda-modules/packages/cudnn.nix
index 91aaeec673e4..71d44df74c94 100644
--- a/pkgs/development/cuda-modules/packages/cudnn.nix
+++ b/pkgs/development/cuda-modules/packages/cudnn.nix
@@ -45,8 +45,11 @@ buildRedist (
 
     # CuDNN depends on libnvrtc.so at runtime, as mentioned here in one small error description
     # https://docs.nvidia.com/deeplearning/cudnn/backend/latest/api/cudnn-graph-library.html
-    appendRunpaths = [
-      "${lib.getLib cuda_nvrtc}/lib"
+    # libcudnn_adv and libcudnn_engines_precompiled dlopen libcublasLt -- the soname lives in
+    # .rodata and is never DT_NEEDED, so the buildInputs entry above never reaches a runpath.
+    appendRunpaths = map (pkg: "${lib.getLib pkg}/lib") [
+      cuda_nvrtc # libnvrtc.so.%s
+      libcublas # libcublasLt.so.%s
     ];
 
     # NOTE:
diff --git a/pkgs/development/cuda-modules/packages/gdrcopy.nix b/pkgs/development/cuda-modules/packages/gdrcopy.nix
index 1aeadb2ee6d5..c6f2e86b06da 100644
--- a/pkgs/development/cuda-modules/packages/gdrcopy.nix
+++ b/pkgs/development/cuda-modules/packages/gdrcopy.nix
@@ -8,6 +8,7 @@
   fetchFromGitHub,
   flags,
   lib,
+  removeReferencesTo,
   # passthru.updateScript
   gitUpdater,
 }:
@@ -35,6 +36,7 @@ backendStdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cuda_nvcc
+    removeReferencesTo
   ];
 
   postPatch = ''
@@ -86,6 +88,23 @@ backendStdenv.mkDerivation (finalAttrs: {
     "exes"
   ];
 
+  # Since CUDA 13, gdrcopy_pplat -- the only test built with relocatable device code -- embeds the
+  # nvlink command line, naming the store paths of both nvcc and the cudart supplying cudadevrt.
+  # Neither is needed at runtime: no binary here has libcudart in DT_NEEDED, and libcuda.so.1 comes
+  # from the driver. Same leak as nccl's; see https://github.com/NixOS/nixpkgs/pull/457803
+  postFixup = ''
+    remove-references-to \
+      -t "${lib.getBin cuda_nvcc}" \
+      -t "${lib.getLib cuda_cudart}" \
+      "$out"/bin/*
+  '';
+
+  # C.f. remove-references-to above. Ensure *all* such references are removed.
+  disallowedRequisites = [
+    (lib.getBin cuda_nvcc)
+    (lib.getLib cuda_cudart)
+  ];
+
   # Tests require gdrdrv be installed (don't know how to communicate dependency on the driver).
   doCheck = false;
 
diff --git a/pkgs/development/cuda-modules/packages/libcublas.nix b/pkgs/development/cuda-modules/packages/libcublas.nix
index 0606bba7eb5d..1c774b529104 100644
--- a/pkgs/development/cuda-modules/packages/libcublas.nix
+++ b/pkgs/development/cuda-modules/packages/libcublas.nix
@@ -1,8 +1,17 @@
-{ buildRedist }:
-buildRedist {
+{
+  buildRedist,
+  cuda_nvrtc,
+  lib,
+}:
+buildRedist (finalAttrs: {
   redistName = "cuda";
   pname = "libcublas";
 
+  # libcublasLt dlopens NVRTC to compile kernels at runtime; absent before 12.8.
+  appendRunpaths = lib.optionals (lib.versionAtLeast finalAttrs.version "12.8") [
+    "${lib.getLib cuda_nvrtc}/lib" # libnvrtc.so.%s
+  ];
+
   outputs = [
     "out"
     "dev"
@@ -19,4 +28,4 @@ buildRedist {
     '';
     homepage = "https://developer.nvidia.com/cublas";
   };
-}
+})
diff --git a/pkgs/development/cuda-modules/packages/libcufft.nix b/pkgs/development/cuda-modules/packages/libcufft.nix
index 7b7aa3611936..6850d27ba7e6 100644
--- a/pkgs/development/cuda-modules/packages/libcufft.nix
+++ b/pkgs/development/cuda-modules/packages/libcufft.nix
@@ -1,8 +1,23 @@
-{ buildRedist }:
+{
+  buildRedist,
+  cuda_nvrtc,
+  cudaAtLeast,
+  lib,
+  libnvjitlink,
+}:
 buildRedist {
   redistName = "cuda";
   pname = "libcufft";
 
+  # dlopen'd for LTO callbacks (cufftXtSetJITCallback, CUFFT_FORCE_LTO). Gated because libnvjitlink
+  # does not exist before CUDA 12.0, and 11.x libcufft references neither soname.
+  appendRunpaths = lib.optionals (cudaAtLeast "12.0") (
+    map (pkg: "${lib.getLib pkg}/lib") [
+      cuda_nvrtc # libnvrtc.so.%s
+      libnvjitlink # libnvJitLink.so.%s
+    ]
+  );
+
   outputs = [
     "out"
     "dev"
diff --git a/pkgs/development/cuda-modules/packages/libcufile.nix b/pkgs/development/cuda-modules/packages/libcufile.nix
index c32a0d0478f1..a4959b1e629f 100644
--- a/pkgs/development/cuda-modules/packages/libcufile.nix
+++ b/pkgs/development/cuda-modules/packages/libcufile.nix
@@ -2,8 +2,11 @@
   buildRedist,
   cudaOlder,
   lib,
+  liburcu,
   numactl,
   rdma-core,
+  systemdLibs,
+  util-linux,
 }:
 buildRedist {
   redistName = "cuda";
@@ -25,6 +28,15 @@ buildRedist {
     rdma-core
   ];
 
+  # dlopen'd by libcufile.so, which is why the buildInputs above do not cover it. Note the
+  # unversioned sonames: the providing output must carry the .so symlink.
+  appendRunpaths = map (pkg: "${lib.getLib pkg}/lib") [
+    systemdLibs # libudev.so
+    util-linux # libmount.so
+    liburcu # liburcu-bp.so, liburcu-cds.so
+    numactl # libnuma.so.%s
+  ];
+
   # Before 11.7 libcufile depends on itself for some reason.
   autoPatchelfIgnoreMissingDeps = [
     "libcuda.so.1"
diff --git a/pkgs/development/cuda-modules/packages/libcuobjclient.nix b/pkgs/development/cuda-modules/packages/libcuobjclient.nix
index e4e4655f8c36..660f88df7521 100644
--- a/pkgs/development/cuda-modules/packages/libcuobjclient.nix
+++ b/pkgs/development/cuda-modules/packages/libcuobjclient.nix
@@ -2,6 +2,7 @@
   buildRedist,
   libcufile,
   numactl,
+  rdma-core,
 }:
 buildRedist {
   redistName = "cuda";
@@ -17,6 +18,9 @@ buildRedist {
   buildInputs = [
     libcufile
     numactl
+    # NOTE: DT_NEEDED, but until now resolved only because auto-patchelf harvests the runpath of
+    # libcufile's libcufile_rdma.so, which happens to point at rdma-core.
+    rdma-core # libibverbs.so.1, librdmacm.so.1, libmlx5.so.1
   ];
 
   meta = {
diff --git a/pkgs/development/cuda-modules/packages/libcusolver.nix b/pkgs/development/cuda-modules/packages/libcusolver.nix
index 0ff5e26d7d52..d1f9c65197ac 100644
--- a/pkgs/development/cuda-modules/packages/libcusolver.nix
+++ b/pkgs/development/cuda-modules/packages/libcusolver.nix
@@ -35,5 +35,10 @@ buildRedist {
       Optimization applications.
     '';
     homepage = "https://developer.nvidia.com/cusolver";
+    # The static output vendors METIS 5.1.0 (lib/libmetis_static.a).
+    license = [
+      lib.licenses.nvidiaCudaRedist
+      lib.licenses.asl20
+    ];
   };
 }
diff --git a/pkgs/development/cuda-modules/packages/libcusparse.nix b/pkgs/development/cuda-modules/packages/libcusparse.nix
index 959cbf8d343b..1d4e69886120 100644
--- a/pkgs/development/cuda-modules/packages/libcusparse.nix
+++ b/pkgs/development/cuda-modules/packages/libcusparse.nix
@@ -17,6 +17,15 @@ buildRedist {
     "stubs"
   ];
 
+  # Through 12.6.3.3 libnvJitLink is DT_NEEDED and the buildInputs entry below covers it; from
+  # 12.7.3.1 it is dlopen'd instead, so it needs a runpath. Unconditional from 12.0 because the
+  # entry is a no-op on the releases which already resolve it. 12.7.x asks for the unversioned
+  # soname, so the providing output must carry the .so symlink. Gated like the buildInputs entry:
+  # libnvjitlink does not exist before CUDA 12.0, and libcusparse does not reference it there.
+  appendRunpaths = lib.optionals (cudaAtLeast "12.0") [
+    "${lib.getLib libnvjitlink}/lib" # libnvJitLink.so, libnvJitLink.so.%s
+  ];
+
   buildInputs =
     # Dependency from 12.0 and on
     lib.optionals (cudaAtLeast "12.0") [ libnvjitlink ];
diff --git a/pkgs/development/cuda-modules/packages/libcusparse_lt.nix b/pkgs/development/cuda-modules/packages/libcusparse_lt.nix
index 9b326baaa96a..f7a7c0704454 100644
--- a/pkgs/development/cuda-modules/packages/libcusparse_lt.nix
+++ b/pkgs/development/cuda-modules/packages/libcusparse_lt.nix
@@ -2,8 +2,8 @@
   _cuda,
   buildRedist,
   cuda_cudart,
+  cuda_nvrtc,
   lib,
-  libcublas,
 }:
 buildRedist (finalAttrs: {
   redistName = "cusparselt";
@@ -17,11 +17,15 @@ buildRedist (finalAttrs: {
     "static"
   ];
 
-  buildInputs = [
-    (lib.getLib libcublas)
-  ]
-  # For some reason, the 1.4.x release of cusparselt requires the cudart library.
-  ++ lib.optionals (lib.hasPrefix "1.4" finalAttrs.version) [ (lib.getLib cuda_cudart) ];
+  # libcusparseLt dlopens NVRTC (the CASK kernel compiler) from 0.8.
+  appendRunpaths = lib.optionals (lib.versionAtLeast finalAttrs.version "0.8") [
+    "${lib.getLib cuda_nvrtc}/lib" # libnvrtc.so.%s
+  ];
+
+  # NOTE: libcusparseLt does not reference libcublas at all, so it is deliberately not an input.
+  buildInputs =
+    # For some reason, the 1.4.x release of cusparselt requires the cudart library.
+    lib.optionals (lib.hasPrefix "1.4" finalAttrs.version) [ (lib.getLib cuda_cudart) ];
 
   meta = {
     description = "High-performance CUDA library dedicated to general matrix-matrix operations in which at least one operand is a structured sparse matrix with 50% sparsity ratio";
diff --git a/pkgs/development/cuda-modules/packages/libnvshmem.nix b/pkgs/development/cuda-modules/packages/libnvshmem.nix
index ef5129f6275e..a5c4ddb7ae3f 100644
--- a/pkgs/development/cuda-modules/packages/libnvshmem.nix
+++ b/pkgs/development/cuda-modules/packages/libnvshmem.nix
@@ -1,5 +1,6 @@
 {
   _cuda,
+  autoAddDriverRunpath,
   backendStdenv,
   buildPackages,
   cmake,
@@ -21,9 +22,11 @@
   mpi,
   nccl,
   ninja,
+  patchelf,
   pmix,
   python3Packages,
   rdma-core,
+  removeReferencesTo,
   ucx,
   # passthru.updateScript
   gitUpdater,
@@ -40,13 +43,16 @@ let
   inherit (lib)
     cmakeBool
     cmakeFeature
+    concatMapStringsSep
     getBin
     getDev
     getExe
     getLib
     licenses
     maintainers
+    makeLibraryPath
     optional
+    optionalString
     optionals
     teams
     ;
@@ -70,13 +76,18 @@ backendStdenv.mkDerivation (finalAttrs: {
   outputs = [ "out" ];
 
   nativeBuildInputs = [
+    # libnvshmem_host dlopens libcuda.so.1 and libnvidia-ml.so.1 by bare soname
+    # (src/host/init/{cudawrap,nvmlwrap}.cpp).
+    autoAddDriverRunpath
     cuda_nvcc
     cmake
     ninja
+    patchelf
 
     # NOTE: Python is required even if not building nvshmem4py:
     # https://github.com/NVIDIA/nvshmem/blob/131da55f643ac87c810ba0bc51d359258bf433a1/CMakeLists.txt#L173
     python3Packages.python
+    removeReferencesTo
   ]
   ++ optionals withMpi [
     # NOTE: mpi is in nativeBuildInputs because it contains compilers and is only discoverable by CMake
@@ -186,6 +197,54 @@ backendStdenv.mkDerivation (finalAttrs: {
     mv -v "$out"/{changelog,git_commit.txt,License.txt,version.txt} "$out/share/"
   '';
 
+  # These are all dlopen'd by bare soname, so buildInputs alone never reaches a RUNPATH. The contrast
+  # is visible within this package: ibgda links libmlx5.so.1 and so does pick up rdma-core, while
+  # ibrc -- the default transport -- only dlopens libibverbs.so.1 and would get nothing.
+  postFixup =
+    # Skips entries already present, so ibgda does not end up with rdma-core twice.
+    ''
+      addMissing() {
+        local elf=$1 rp d
+        shift
+        rp=$(patchelf --print-rpath "$elf")
+        for d in "$@"; do [[ ":$rp:" == *":$d:"* ]] || rp=''${rp:+$rp:}$d; done
+        patchelf --set-rpath "$rp" "$elf"
+      }
+    ''
+    + ''
+      nixLog "adding dlopen'd transport libraries to the transport plugins' runpath"
+      for transport in "$out"/lib/nvshmem_transport_*.so.*.*; do
+        addMissing "$transport" ${makeLibraryPath ([ rdma-core ] ++ optional withGdrcopy gdrcopy)}
+      done
+    ''
+    # libnvshmem_host dlopens libnccl.so.2 for host-side collectives (src/host/coll/cpu_coll.cpp).
+    + optionalString withNccl ''
+      nixLog "adding nccl to libnvshmem_host's runpath"
+      addMissing "$out"/lib/libnvshmem_host.so.*.* "${getLib nccl}/lib"
+    ''
+    # cmake_config/NVSHMEMEnv.cmake:156 bakes every -D*_HOME we pass into NVSHMEM_BUILD_VARS, a
+    # diagnostic banner that nvshmem-info and init.cu only print. Nix still counts the store paths, so
+    # build-only inputs become runtime dependencies -- and the banner is substituted into an installed
+    # header, so consumers inherit them too. Only the dev outputs and nvcc are stripped: gdrcopy and
+    # mpi appear in the same string but are genuine runtime dependencies. No disallowedRequisites
+    # guard here, unlike nccl and gdrcopy, because ucx and openmpi pull nvcc in on their own.
+    + ''
+      nixLog "removing build-time references baked into NVSHMEM_BUILD_VARS"
+      remove-references-to ${
+        concatMapStringsSep " " (p: ''-t "${p}"'') (
+          [ (getBin cuda_nvcc) ]
+          ++ optional withNccl (getDev nccl)
+          ++ optional withUcx (getDev ucx)
+          ++ optional withLibfabric (getDev libfabric)
+          ++ optional withPmix (getDev pmix)
+        )
+      } \
+        "$out"/bin/nvshmem-info \
+        "$out"/lib/libnvshmem_host.so.*.* \
+        "$out"/include/non_abi/nvshmem_version.h \
+        "$out"/share/src/*/include/non_abi/nvshmem_version.h
+    '';
+
   doCheck = false;
 
   passthru = {
diff --git a/pkgs/development/cuda-modules/packages/nccl.nix b/pkgs/development/cuda-modules/packages/nccl.nix
index 7a3979c05dc0..849ebff60cfb 100644
--- a/pkgs/development/cuda-modules/packages/nccl.nix
+++ b/pkgs/development/cuda-modules/packages/nccl.nix
@@ -1,5 +1,6 @@
 {
   _cuda,
+  autoAddDriverRunpath,
   backendStdenv,
   cccl,
   cuda_cudart,
@@ -8,12 +9,18 @@
   cudaNamePrefix,
   fetchFromGitHub,
   flags,
+  gdrcopy,
   lib,
+  patchelf,
   python3,
+  rdma-core,
   removeReferencesTo,
   which,
   # passthru.updateScript
   gitUpdater,
+
+  withGdrcopy ? true,
+  withRdmaCore ? true,
 }:
 let
   inherit (_cuda.lib) _mkMetaBadPlatforms;
@@ -27,6 +34,8 @@ let
     getLib
     licenses
     maintainers
+    makeLibraryPath
+    optional
     optionalString
     teams
     versionAtLeast
@@ -74,7 +83,11 @@ backendStdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
+    # libnccl dlopens libnvidia-ml.so.1 (src/os/linux.cc), and the statically linked CUDA runtime
+    # (src/Makefile: CUDARTLIB ?= cudart_static) dlopens libcuda.so.1, both by bare soname.
+    autoAddDriverRunpath
     cuda_nvcc
+    patchelf
     python3
     removeReferencesTo
     which
@@ -137,6 +150,15 @@ backendStdenv.mkDerivation (finalAttrs: {
     remove-references-to -t "${lib.getBin cuda_nvcc}" \
       ''${!outputLib}/lib/libnccl.so.* \
       ''${!outputStatic}/lib/*.a
+  ''
+  # makefiles/common.mk sets RDMA_CORE=0 and MLX5DV=0, so libibverbs/libmlx5/libgdrapi are dlopen'd
+  # rather than DT_NEEDED and buildInputs would not reach the runpath. Losing them is quiet: NCCL
+  # logs at INFO and falls back to the socket transport.
+  + optionalString (withRdmaCore || withGdrcopy) ''
+    nixLog "adding dlopen'd transport libraries to libnccl's runpath"
+    patchelf --add-rpath "${
+      makeLibraryPath (optional withRdmaCore rdma-core ++ optional withGdrcopy gdrcopy)
+    }" "''${!outputLib:?}"/lib/libnccl.so.*.*
   '';
 
   # C.f. remove-references-to above. Ensure *all* references to cuda_nvcc are removed
diff --git a/pkgs/development/libraries/mesa/darwin.nix b/pkgs/development/libraries/mesa/darwin.nix
index fb64f9e70d60..c0376c69cb2b 100644
--- a/pkgs/development/libraries/mesa/darwin.nix
+++ b/pkgs/development/libraries/mesa/darwin.nix
@@ -20,6 +20,7 @@
   libx11,
   libxcb,
   libxshmfence,
+  mesa-libclc,
   spirv-llvm-translator,
   spirv-tools,
   zlib,
@@ -85,8 +86,8 @@ stdenv.mkDerivation {
     libpng
     libxml2 # should be propagated from libllvm
     llvmPackages.libclang
-    llvmPackages.libclc
     llvmPackages.libllvm
+    mesa-libclc
     python3Packages.python # for shebang
     spirv-llvm-translator
     spirv-tools
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 8afb9543d51b..50094b9f3ca9 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -21,6 +21,7 @@
   libva-minimal,
   llvmPackages,
   lm_sensors,
+  mesa-libclc,
   meson,
   ninja,
   pkg-config,
@@ -280,9 +281,9 @@ stdenv.mkDerivation (finalAttrs: {
     libxxf86vm
     llvmPackages.clang
     llvmPackages.clang-unwrapped
-    llvmPackages.libclc
     llvmPackages.libllvm
     lm_sensors
+    mesa-libclc
     python3Packages.python # for shebang
     spirv-llvm-translator
     udev
diff --git a/pkgs/development/python-modules/azure-appconfiguration/default.nix b/pkgs/development/python-modules/azure-appconfiguration/default.nix
index 43a9b1968a07..20bce7ac0cec 100644
--- a/pkgs/development/python-modules/azure-appconfiguration/default.nix
+++ b/pkgs/development/python-modules/azure-appconfiguration/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "azure-appconfiguration";
-  version = "1.7.2";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_appconfiguration";
     inherit version;
-    hash = "sha256-zv11spi4mKjtn3MEjz859OgQWaWM2DLQUjeH/B2RKgY=";
+    hash = "sha256-Fo57AbNQ9dgGotk1qOw2lMWcY5TVocQJ6wX+8LVrGqA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-keyvault-administration/default.nix b/pkgs/development/python-modules/azure-keyvault-administration/default.nix
index 4c683b2c60b7..aad5427da3e3 100644
--- a/pkgs/development/python-modules/azure-keyvault-administration/default.nix
+++ b/pkgs/development/python-modules/azure-keyvault-administration/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "azure-keyvault-administration";
-  version = "4.7.0";
+  version = "4.8.0b2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_keyvault_administration";
     inherit version;
-    hash = "sha256-GSRWYnTEWWdf6qKbPojD2QspnDKMhNxcG4V85RCp7Zo=";
+    hash = "sha256-vpR+m+p8EnB8m5Xj0X2Ky/hnJ7bo5Pd85pj//qhGZ1g=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
index dc1e286405f8..d4102f054890 100644
--- a/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cognitiveservices/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cognitiveservices";
-  version = "15.0.0b1";
+  version = "15.0.0b4";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_mgmt_cognitiveservices";
     inherit version;
-    hash = "sha256-3ydbAI1IkiIuwnQbd6829kZv9IgFkqTFwG155l58JFQ=";
+    hash = "sha256-pVlaluhJmkS3mZlzzkR1f5+0W+IGokFJaZkajbzpwgk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-mgmt-mysqlflexibleservers/default.nix b/pkgs/development/python-modules/azure-mgmt-mysqlflexibleservers/default.nix
index b2524c5286b3..93176b41dc54 100644
--- a/pkgs/development/python-modules/azure-mgmt-mysqlflexibleservers/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-mysqlflexibleservers/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-mysqlflexibleservers";
-  version = "1.0.0";
+  version = "1.1.0b3";
   pyproject = true;
 
   src = fetchPypi {
     pname = "azure_mgmt_mysqlflexibleservers";
     inherit version;
-    hash = "sha256-0HemVoiKXFl39HmiRKZKxKHTUQAumaft2vakmoIZLlY=";
+    hash = "sha256-15uNv6MKuHxuXxeQYWbpmWQVhmkmzCYjeGkSIamGWAM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/azure-mgmt-signalr/default.nix b/pkgs/development/python-modules/azure-mgmt-signalr/default.nix
index ad28590746cf..dbd255d38d1e 100644
--- a/pkgs/development/python-modules/azure-mgmt-signalr/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-signalr/default.nix
@@ -11,15 +11,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "azure-mgmt-signalr";
-  version = "1.2.0";
+  version = "2.0.0b2";
   pyproject = true;
 
   __structuredAttrs = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    extension = "zip";
-    hash = "sha256-jbFhVoJbObpvcVJr2VoUzY5CmSblJ6OK7Q3l17SARfg=";
+    extension = "tar.gz";
+    hash = "sha256-05PUV8ouAKq/xhGxVEWIzDop0a7WDTV5mGVSC4sv9P4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/azure-mgmt-sqlvirtualmachine/default.nix b/pkgs/development/python-modules/azure-mgmt-sqlvirtualmachine/default.nix
index fbbe81dc56bc..e9901e1e84f4 100644
--- a/pkgs/development/python-modules/azure-mgmt-sqlvirtualmachine/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-sqlvirtualmachine/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-sqlvirtualmachine";
-  version = "0.5.0";
+  version = "1.0.0b5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-talCNRKnsShErAFDZqHVPIEBehTzlna+7fAEpTKqKq0=";
+    hash = "sha256-ZFgJflgynRSxo+B+Vso4eX1JheWlDQjfJ9QmupXypMc=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/azure-mgmt-synapse/default.nix b/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
index 1ea400ce26cf..bdf9e7a4c2b0 100644
--- a/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-synapse/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-synapse";
-  version = "2.0.0";
+  version = "2.1.0b5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vsa9+utVtP3RWfIFXoh1v1CnILsPzoCoFukqI1m4mMg=";
+    hash = "sha256-5E6Yf1GgNyNVjd+SeFDbhDxnOA6fOAG6oojxtCP4m+k=";
     extension = "zip";
   };
 
diff --git a/pkgs/development/python-modules/daft/default.nix b/pkgs/development/python-modules/daft/default.nix
index 280ea502d949..9da57044c91f 100644
--- a/pkgs/development/python-modules/daft/default.nix
+++ b/pkgs/development/python-modules/daft/default.nix
@@ -79,7 +79,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "daft";
-  version = "0.7.21";
+  version = "0.7.23";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -87,12 +87,12 @@ buildPythonPackage (finalAttrs: {
     owner = "Eventual-Inc";
     repo = "Daft";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vz9lCm2zQaWM+9jPH2fnhGEQiCYPH0Jl477yaZDQ370=";
+    hash = "sha256-SFK4iTmrXOgW/wRMs5kTQP+GcMK8W17nmMFbaXAydSU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-8pezsGc2iYlYdPgZFjmFq1shkCWCG6F69Cx/+P1iKU8=";
+    hash = "sha256-x/NOvQRqZhN7x1D/Mga/kMIAgK0bFn5Yuh3jfQPNj5Y=";
 
     # azure-sdk-for-rust omits svc/blobstorage from the services workspace
     postBuild = ''
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 5c22a8db1300..a647cfbd9eff 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "devito";
-  version = "4.8.22";
+  version = "4.8.23";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
     owner = "devitocodes";
     repo = "devito";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7bHMMZKm+n+wSVGUSSoYQjXklxzdTeyCkjMuK0Z8qTI=";
+    hash = "sha256-y+Ao+uJAEHOxegz/AJ7Xs1FUzcfPdEPRWRGTouUpEeg=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/dlinfo/default.nix b/pkgs/development/python-modules/dlinfo/default.nix
index 1937f601ff22..b418484fec03 100644
--- a/pkgs/development/python-modules/dlinfo/default.nix
+++ b/pkgs/development/python-modules/dlinfo/default.nix
@@ -23,6 +23,14 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  enabledTestPaths =
+    if stdenv.hostPlatform.isDarwin then
+      [
+        "tests/dlinfo_macosx_mock_test.py"
+      ]
+    else
+      [ "tests/dlinfo_glibc_test.py" ];
+
   pythonImportsCheck = [ "dlinfo" ];
 
   meta = {
@@ -31,6 +39,5 @@ buildPythonPackage rec {
     homepage = "https://github.com/fphammerle/python-dlinfo";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/matter-ble-proxy/default.nix b/pkgs/development/python-modules/matter-ble-proxy/default.nix
index 3ea2eba75067..283e2d50d618 100644
--- a/pkgs/development/python-modules/matter-ble-proxy/default.nix
+++ b/pkgs/development/python-modules/matter-ble-proxy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "matter-ble-proxy";
-  version = "1.2.7";
+  version = "1.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     owner = "matter-js";
     repo = "matterjs-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VZgC+tBb/xCtX1wNOG9r30vCzoBVERAVgrhRQTAsfI8=";
+    hash = "sha256-eJSDTg00H/G2pPdVC23HiLLjPA8n1vCpqpAZgtUXl78=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python_ble_proxy";
diff --git a/pkgs/development/python-modules/mobly/default.nix b/pkgs/development/python-modules/mobly/default.nix
index 4351f692dfe5..73f3a83573c0 100644
--- a/pkgs/development/python-modules/mobly/default.nix
+++ b/pkgs/development/python-modules/mobly/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "mobly";
-  version = "1.13";
+  version = "1.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mobly";
     tag = version;
-    hash = "sha256-lQyhLZFA9lad7LYKa6AP+nQonTRtiFA8Egjo0ATbLVI=";
+    hash = "sha256-J0mP7l2JXZDSuQm5vsLB87zbFK7MmP5xc8T7qDS34M4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycaption/default.nix b/pkgs/development/python-modules/pycaption/default.nix
index 9f1edd22205b..86e072e817c9 100644
--- a/pkgs/development/python-modules/pycaption/default.nix
+++ b/pkgs/development/python-modules/pycaption/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycaption";
-  version = "2.3.1";
+  version = "2.3.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pbs";
     repo = "pycaption";
     tag = finalAttrs.version;
-    hash = "sha256-nkxdsAiRwWTjPCvXFfvy4COqI3ma1Lr64MRYXIL14dM=";
+    hash = "sha256-oHgRh6J4+22PWMlglzIMwvptK54vB0dpmzZ7jD0klF0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pylance/default.nix b/pkgs/development/python-modules/pylance/default.nix
index 96cfe5a16548..e5bd8b4892e3 100644
--- a/pkgs/development/python-modules/pylance/default.nix
+++ b/pkgs/development/python-modules/pylance/default.nix
@@ -35,7 +35,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pylance";
-  version = "9.0.1";
+  version = "10.0.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -43,7 +43,7 @@ buildPythonPackage (finalAttrs: {
     owner = "lancedb";
     repo = "lance";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-t4Eia0d+w4mhY2RP7WJqebh4SW8Hvk3v5mG0zOPY0zw=";
+    hash = "sha256-s97gITRZ7NLYQyBPd3vbn7mNB8By0CKbg4uEIL7gLkc=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python";
@@ -55,7 +55,7 @@ buildPythonPackage (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-W5FFlsu1LGc6U0VaJQQ7zVlIYGWVcZC448PQ7YqpCy4=";
+    hash = "sha256-geWpbEa5xywjA2RAEmhrsu0miOmfmNHHaNdJwAPjnVM=";
   };
 
   # `lance-linalg`'s AVX-512 VNNI u8-distance kernels call `_mm512_dpbusd_epi32` /
diff --git a/pkgs/development/python-modules/tabview/default.nix b/pkgs/development/python-modules/tabview/default.nix
index 94fc809c9bda..a3d090ac8684 100644
--- a/pkgs/development/python-modules/tabview/default.nix
+++ b/pkgs/development/python-modules/tabview/default.nix
@@ -3,29 +3,32 @@
   buildPythonPackage,
   fetchFromGitHub,
   unittestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tabview";
   version = "1.4.4";
-  format = "setuptools";
+  pyproject = true;
 
   # newest release only available as wheel on pypi
   src = fetchFromGitHub {
     owner = "TabViewer";
     repo = "tabview";
-    rev = version;
-    sha256 = "1d1l8fhdn3w2zg7wakvlmjmgjh9lh9h5fal1clgyiqmhfix4cn4m";
+    tag = finalAttrs.version;
+    hash = "sha256-lVhGenSw4ugfZYEqV2CCNEH5qqx0T8XP+4IP26BDNLQ=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ unittestCheckHook ];
 
   meta = {
     description = "Python curses command line CSV and tabular data viewer";
     mainProgram = "tabview";
     homepage = "https://github.com/TabViewer/tabview";
-    changelog = "https://github.com/TabViewer/tabview/blob/main/CHANGELOG.rst";
+    changelog = "https://github.com/TabViewer/tabview/blob/${finalAttrs.version}/CHANGELOG.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/tokenspeed-triton/default.nix b/pkgs/development/python-modules/tokenspeed-triton/default.nix
index f63b1973cee8..25c767a3bea0 100644
--- a/pkgs/development/python-modules/tokenspeed-triton/default.nix
+++ b/pkgs/development/python-modules/tokenspeed-triton/default.nix
@@ -40,6 +40,20 @@ buildPythonPackage (finalAttrs: {
     substituteInPlace pyproject.toml \
       --replace-fail "cmake>=3.20,<4.0" "cmake>=3.20" \
       --replace-fail "nanobind==2.10.2" "nanobind>=2.10.2"
+  ''
+
+  # nanobind >= 2.13 also requires the `Python::Interpreter`
+  # target, which upstream's `find_package(Python3)` ->
+  # `find_package(Python)` bridge misses:
+  # https://github.com/wjakob/nanobind/commit/706131bef6771ad3634b1d772f029f65b7ea8bd2
+  + ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'if(NOT TARGET Python::Module)' \
+        'if(NOT TARGET Python::Interpreter)
+      add_executable(Python::Interpreter ALIAS Python3::Interpreter)
+    endif()
+    if(NOT TARGET Python::Module)'
   '';
 
   build-system = [
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 5ca73ec6c351..0501e150e708 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -81,11 +81,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "samba";
-  version = "4.23.8";
+  version = "4.23.10";
 
   src = fetchurl {
     url = "https://download.samba.org/pub/samba/stable/samba-${finalAttrs.version}.tar.gz";
-    hash = "sha256-l2EphHRW3Ft4wA+P+3ncYFxJ1qrKiyqncv0i27afrgE=";
+    hash = "sha256-50s/SV1+SOZxC1Aas4HIDd88uZxmBHMtNgQCZdnK9FI=";
   };
 
   outputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ccd0fe5fa3e3..a931f7519c33 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1249,6 +1249,7 @@ mapAliases {
   libbson = throw "'libbson' has been renamed to/replaced by 'mongoc'"; # Converted to throw 2025-10-27
   libcef = throw "'libcef' has been removed, as no packages depend on it"; # Added 2025-11-06
   libchamplain = throw "'libchamplain' has been removed due to reliance on insecure libsoup 2.4. Consider using 'libchamplain_libsoup3' instead"; # Added 2026-05-29
+  libclc = throw "'libclc' has been removed, as no packages use it; reach out to LLVM/Mesa maintainers if you need this back."; # Added 2026-08-06
   libdbiDrivers = warnAlias "'libdbiDrivers' has been renamed to 'libdbi-drivers'" libdbi-drivers; # Added 2026-02-08
   libdbiDriversBase = warnAlias "'libdbiDriversBase' has been renamed to 'libdbi-drivers-base'" libdbi-drivers-base; # Added 2026-02-08
   libdevil = throw "libdevil has been removed, as it was unmaintained in Nixpkgs and upstream since 2017"; # Added 2025-09-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 72801ca5f4ba..7810b90a69c5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2058,17 +2058,6 @@ with pkgs;
 
   gitlab-workhorse = callPackage ../by-name/gi/gitlab/gitlab-workhorse { };
 
-  gmrender-resurrect = callPackage ../tools/networking/gmrender-resurrect {
-    inherit (gst_all_1)
-      gstreamer
-      gst-plugins-base
-      gst-plugins-good
-      gst-plugins-bad
-      gst-plugins-ugly
-      gst-libav
-      ;
-  };
-
   gnome-panel-with-modules = callPackage ../by-name/gn/gnome-panel/wrapper.nix { };
 
   dapl = callPackage ../development/interpreters/dzaima-apl {
@@ -2902,10 +2891,6 @@ with pkgs;
 
   strip-nondeterminism = perlPackages.strip-nondeterminism;
 
-  sslscan = callPackage ../tools/security/sslscan {
-    openssl = openssl.override { withZlib = true; };
-  };
-
   staticjinja = with python3.pkgs; toPythonApplication staticjinja;
 
   stoken = callPackage ../tools/security/stoken (config.stoken or { });
@@ -2922,10 +2907,6 @@ with pkgs;
 
   subzerod = with python3Packages; toPythonApplication subzerod;
 
-  system-config-printer = callPackage ../tools/misc/system-config-printer {
-    libxml2 = libxml2Python;
-  };
-
   tartube-yt-dlp = tartube.override {
     youtube-dl = yt-dlp;
   };
@@ -3902,7 +3883,6 @@ with pkgs;
   llvm = llvmPackages.llvm;
   flang = llvmPackages_20.flang;
 
-  libclc = llvmPackages.libclc;
   libllvm = llvmPackages.libllvm;
   llvm-manpages = llvmPackages.llvm-manpages;
 
@@ -8399,11 +8379,6 @@ with pkgs;
 
   bambootracker-qt6 = bambootracker.override { withQt6 = true; };
 
-  awesome = callPackage ../applications/window-managers/awesome {
-    cairo = cairo.override { xcbSupport = true; };
-    inherit (texFunctions) fontsConf;
-  };
-
   backintime = backintime-qt;
 
   bespokesynth-with-vst2 = bespokesynth.override {
@@ -8511,10 +8486,6 @@ with pkgs;
 
   drawterm-wayland = callPackage ../by-name/dr/drawterm/package.nix { withWayland = true; };
 
-  evilwm = callPackage ../applications/window-managers/evilwm {
-    patches = config.evilwm.patches or [ ];
-  };
-
   eclipses = recurseIntoAttrs (callPackage ../applications/editors/eclipse { });
 
   electrum = libsForQt5.callPackage ../applications/misc/electrum { };
@@ -8575,10 +8546,6 @@ with pkgs;
 
   firewalld-gui = firewalld.override { withGui = true; };
 
-  fossil = callPackage ../applications/version-management/fossil {
-    sqlite = sqlite.override { enableDeserialize = true; };
-  };
-
   fvwm = fvwm2;
 
   gaucheBootstrap = callPackage ../development/interpreters/gauche/boot.nix { };
@@ -8806,14 +8773,6 @@ with pkgs;
 
   hachoir = with python3Packages; toPythonApplication hachoir;
 
-  hydrogen-web-unwrapped =
-    callPackage ../applications/networking/instant-messengers/hydrogen-web/unwrapped.nix
-      { };
-
-  hydrogen-web = callPackage ../applications/networking/instant-messengers/hydrogen-web/wrapper.nix {
-    conf = config.hydrogen-web.conf or { };
-  };
-
   hledger = haskell.lib.compose.justStaticExecutables haskellPackages.hledger;
   hledger-iadd = haskell.lib.compose.justStaticExecutables haskellPackages.hledger-iadd;
   hledger-interest = haskell.lib.compose.justStaticExecutables haskellPackages.hledger-interest;
@@ -8881,10 +8840,6 @@ with pkgs;
     subversionSupport = true;
   };
 
-  avalonia-ilspy = callPackage ../applications/misc/avalonia-ilspy {
-    inherit (darwin) autoSignDarwinBinariesHook;
-  };
-
   imagemagick_light = lowPrio (
     imagemagick.override {
       bzip2Support = false;
@@ -10466,10 +10421,6 @@ with pkgs;
   simulide_1_1_0 = callPackage ../by-name/si/simulide/package.nix { versionNum = "1.1.0"; };
   simulide_1_2_0 = callPackage ../by-name/si/simulide/package.nix { versionNum = "1.2.0"; };
 
-  gerbv = callPackage ../applications/science/electronics/gerbv {
-    cairo = cairo.override { x11Support = true; };
-  };
-
   # this is the same but without the (sizable) 3D models library
   kicad-small = kicad.override {
     pname = "kicad-small";
@@ -10586,11 +10537,6 @@ with pkgs;
 
   faust = faust2;
 
-  gajim = callPackage ../applications/networking/instant-messengers/gajim {
-    inherit (gst_all_1) gstreamer gst-plugins-base gst-libav;
-    gst-plugins-good = gst_all_1.gst-plugins-good.override { gtkSupport = true; };
-  };
-
   helmfile-wrapped = helmfile.override {
     inherit (kubernetes-helm-wrapped.passthru) pluginsDir;
   };
@@ -10817,10 +10763,6 @@ with pkgs;
 
   pwntools = with python3Packages; toPythonApplication pwntools;
 
-  putty = callPackage ../applications/networking/remote/putty {
-    gtk3 = if stdenv.hostPlatform.isDarwin then gtk3-x11 else gtk3;
-  };
-
   qmasterpassword-wayland = qmasterpassword.override {
     x11Support = false;
     waylandSupport = true;